diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5268cd860..24eb37916 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -275,6 +275,30 @@ jobs:
           retention-days: 1
           compression-level: 0
 
+  # This bridge is a separate Cargo workspace, outside the Runtime tests.
+  test-browser-guest-control-bridge:
+    name: test-browser-guest-control-bridge
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    needs: source-gate
+    defaults:
+      run:
+        working-directory: elastos/tools/browser-vm-guest-control-bridge
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || github.sha }}
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@72504271e02fb719eb4eb3eaece3a8e3d06f57c0 # 1.91.0
+        with:
+          components: rustfmt, clippy
+      - name: bridge formatting
+        run: cargo fmt -- --check
+      - name: bridge Clippy
+        run: cargo clippy --locked --all-targets -- -D warnings
+      - name: bridge tests
+        run: cargo test --locked
+
   lint:
     name: lint
     runs-on: ubuntu-24.04
diff --git a/capsules/library/browser/index.html b/capsules/library/browser/index.html
index 2f0ffa428..8a98a88d9 100644
--- a/capsules/library/browser/index.html
+++ b/capsules/library/browser/index.html
@@ -84,7 +84,7 @@ <h2 class="window-sidebar-title">Favorites</h2>
       </header>
 
       <section id="upload-progress" class="upload-progress hidden" aria-label="Upload progress" aria-live="polite"></section>
-      <section id="content" class="content" data-view="list" aria-label="Items"></section>
+      <section id="content" class="content" data-view="list" role="listbox" aria-label="Items" aria-multiselectable="true" tabindex="0"></section>
       <footer class="statusbar explorer-footer">
         <span id="footer-left">0 items</span>
         <span id="footer-right">On this device</span>
diff --git a/capsules/library/browser/src/app.js b/capsules/library/browser/src/app.js
index 0345b5e7e..23389d420 100644
--- a/capsules/library/browser/src/app.js
+++ b/capsules/library/browser/src/app.js
@@ -21,6 +21,7 @@ import { createLibraryActions } from "./actions.js?v=library-20260711d";
 import { createLibraryDialog } from "./dialog.js?v=library-20260711d";
 import { createLibraryEditor } from "./editor.js";
 import { bindLibraryEvents } from "./events.js";
+import { createLibraryFolders } from "./folders.js";
 import { createLibraryMenu } from "./menu.js";
 import { createLibraryNavigation } from "./navigation.js";
 import { createLibraryPreview } from "./preview.js";
@@ -169,6 +170,17 @@ import {
       state,
       visibleObjects,
     });
+    const { loadCurrentFolder } = createLibraryFolders({
+      homeNavigation,
+      perf,
+      providerApi,
+      renderAll,
+      runInitialObjectAction,
+      setFolderStatus,
+      setObjects,
+      setStatus,
+      state,
+    });
     const {
       handleBrowserPopState,
       installBrowserHistory,
@@ -708,57 +720,6 @@ import {
       setStatus("Sidebar order saved.");
     }
 
-    async function loadCurrentFolder(options = {}) {
-      if (!state.currentUri) return;
-      const loadSeq = ++state.loadSeq;
-      const uri = state.currentUri;
-      const cached = options.useCache ? state.folderCache.get(uri) : null;
-      let renderedCached = false;
-      let renderAfterFetch = true;
-      if (cached) {
-        perf.folderCacheHits += 1;
-        state.loading = false;
-        state.currentObject = cached.object || null;
-        setObjects(cached.objects);
-        state.selectedUris.clear();
-        setFolderStatus(`${state.objects.length} item${state.objects.length === 1 ? "" : "s"}.`);
-        renderAll();
-        await runInitialObjectAction();
-        renderedCached = true;
-      } else {
-        state.loading = true;
-        state.currentObject = null;
-        setStatus("Loading...");
-      }
-      try {
-        const data = await providerApi("list", { uri });
-        if (loadSeq !== state.loadSeq || uri !== state.currentUri) {
-          return;
-        }
-        const objects = Array.isArray(data.objects) ? data.objects : [];
-        const currentObject = data.object || null;
-        const nextCache = cacheFolderListing(state, perf, uri, objects, currentObject);
-        state.currentObject = currentObject;
-        if (state.mode === "browse" && currentObject?.uri === uri && isDirectory(currentObject)) {
-          homeNavigation.setQuery({ uri });
-        }
-        if (renderedCached && cached.signature === nextCache.signature) {
-          renderAfterFetch = false;
-          setFolderStatus(`${state.objects.length} item${state.objects.length === 1 ? "" : "s"}.`);
-          return;
-        }
-        setObjects(objects);
-        state.selectedUris.clear();
-        setFolderStatus(`${state.objects.length} item${state.objects.length === 1 ? "" : "s"}.`);
-      } finally {
-        if (loadSeq === state.loadSeq && uri === state.currentUri) {
-          state.loading = false;
-          if (renderAfterFetch) renderAll();
-          if (renderAfterFetch) await runInitialObjectAction();
-        }
-      }
-    }
-
     async function runInitialObjectAction() {
       if (state.initialActionHandled || !state.initialObjectUri || !state.initialAction) {
         return;
diff --git a/capsules/library/browser/src/events.js b/capsules/library/browser/src/events.js
index 6a80a9d58..515429245 100644
--- a/capsules/library/browser/src/events.js
+++ b/capsules/library/browser/src/events.js
@@ -42,6 +42,27 @@ export function bindLibraryEvents({
   uploadFiles,
 }) {
   let draggingPlaceId = "";
+  let keyboardMenuReturnTarget = null;
+  let keyboardNavigationJob = 0;
+
+  function restoreKeyboardMenuFocus() {
+    if (keyboardMenuReturnTarget?.isConnected) keyboardMenuReturnTarget.focus({ preventScroll: true });
+    keyboardMenuReturnTarget = null;
+  }
+
+  function moveKeyboardFocus(targetItem, event, focusedItem) {
+    if (!targetItem) return;
+    if (event.shiftKey) {
+      if (!state.selectionAnchorUri && focusedItem) {
+        state.selectionAnchorUri = focusedItem.dataset.uri;
+      }
+      selectRangeTo(targetItem.dataset.uri, event.ctrlKey || event.metaKey);
+    } else if (!event.ctrlKey && !event.metaKey) {
+      selectOnly(targetItem.dataset.uri);
+    }
+    targetItem.focus({ preventScroll: true });
+    targetItem.scrollIntoView({ block: "nearest", inline: "nearest" });
+  }
 
   elements.sidebar?.addEventListener("contextmenu", (event) => {
     event.preventDefault();
@@ -147,6 +168,14 @@ export function bindLibraryEvents({
     uploadFiles(elements.fileInput.files).catch(showError);
     elements.fileInput.value = "";
   });
+  elements.content.addEventListener("focusin", (event) => {
+    const item = event.target.closest(".item[data-uri]");
+    if (!item) return;
+    for (const previous of elements.content.querySelectorAll('.item[tabindex="0"]')) {
+      if (previous !== item) previous.tabIndex = -1;
+    }
+    if (item.tabIndex !== 0) item.tabIndex = 0;
+  });
   elements.content.addEventListener("click", (event) => {
     if (isNameEditorTarget(event.target)) return;
     const item = event.target.closest(".item");
@@ -215,19 +244,72 @@ export function bindLibraryEvents({
   document.addEventListener("click", (event) => {
     if (!event.target.closest(".context-menu")) {
       hideMenu();
+      keyboardMenuReturnTarget = null;
     }
   });
+  elements.contextMenu.addEventListener("click", (event) => {
+    const button = event.target.closest(".menu-item");
+    if (button && !button.parentElement.classList.contains("menu-entry-has-children")) {
+      restoreKeyboardMenuFocus();
+    }
+  }, true);
   bindDialogEvents();
+  window.addEventListener("pointerdown", () => { keyboardNavigationJob += 1; });
   window.addEventListener("keydown", (event) => {
+    const navigationJob = ++keyboardNavigationJob;
     if (event.key === "Escape") {
       hideMenu();
       hideDialog();
       clearSelection();
+      restoreKeyboardMenuFocus();
       return;
     }
     const editable = event.target.closest?.("input, textarea, select, [contenteditable='true']");
     const itemShortcutTarget = isItemShortcutTarget(event.target, elements);
     const shortcutSurfaceReady = itemShortcutTarget && !editable && !isDialogOpen(elements) && !isMenuOpen(elements);
+    const focusedItem = shortcutSurfaceReady ? event.target.closest?.(".item[data-uri]") : null;
+    if (shortcutSurfaceReady && !event.altKey) {
+      if (event.key === "End" && elements.content.getAttribute?.("aria-busy") === "true") {
+        event.preventDefault();
+        const renderJob = state.contentRenderJob;
+        if (document.activeElement === elements.content) {
+          // A later chunk can restore the previous row. Keep this new key request in control of focus.
+          elements.content.querySelector('.item[tabindex="0"]')?.focus({ preventScroll: true });
+        }
+        const initialFocus = document.activeElement;
+        const finishNavigation = () => {
+          if (navigationJob !== keyboardNavigationJob || renderJob !== state.contentRenderJob
+            || document.activeElement !== initialFocus) return;
+          if (elements.content.getAttribute("aria-busy") === "true") {
+            window.requestAnimationFrame(finishNavigation);
+          } else {
+            moveKeyboardFocus(keyboardNavigationTarget(elements.content, focusedItem, "End"), event, focusedItem);
+          }
+        };
+        window.requestAnimationFrame(finishNavigation);
+        return;
+      }
+      const targetItem = keyboardNavigationTarget(elements.content, focusedItem, event.key);
+      if (targetItem) {
+        event.preventDefault();
+        moveKeyboardFocus(targetItem, event, focusedItem);
+        return;
+      }
+      if (event.key === " " && focusedItem) {
+        event.preventDefault();
+        if (event.shiftKey) {
+          selectRangeTo(focusedItem.dataset.uri, event.ctrlKey || event.metaKey);
+        } else {
+          toggleSelected(focusedItem.dataset.uri);
+        }
+        return;
+      }
+    }
+    const itemAction = ["Enter", "F2", "Delete", "ContextMenu"].includes(event.key)
+      || (event.shiftKey && event.key === "F10");
+    if (itemAction && focusedItem && state.selectedUris.size === 0) {
+      selectOnly(focusedItem.dataset.uri);
+    }
     if ((event.ctrlKey || event.metaKey) && event.key.toLowerCase() === "a" && shortcutSurfaceReady) {
       event.preventDefault();
       selectAllVisible();
@@ -258,12 +340,14 @@ export function bindLibraryEvents({
     }
     if ((event.key === "ContextMenu" || (event.shiftKey && event.key === "F10")) && shortcutSurfaceReady) {
       event.preventDefault();
+      keyboardMenuReturnTarget = focusedItem || elements.content;
       const object = selectedObjects()[0];
       if (object) {
         showKeyboardObjectMenu(elements, object, showMenuForObject);
       } else {
         showKeyboardBackgroundMenu(elements, showBackgroundMenu);
       }
+      elements.contextMenu.querySelector(".menu-item:not(:disabled)")?.focus({ preventScroll: true });
     }
   });
   window.addEventListener("popstate", (event) => {
@@ -304,6 +388,30 @@ function isNameEditorTarget(target) {
   return !!target?.closest?.(".rename-input");
 }
 
+function keyboardNavigationTarget(content, focusedItem, key) {
+  const grid = content.dataset.view === "grid";
+  if (!["ArrowUp", "ArrowDown", "Home", "End"].includes(key)
+    && !(grid && ["ArrowLeft", "ArrowRight"].includes(key))) return null;
+  const items = Array.from(content.querySelectorAll(".item[data-uri]"));
+  if (!items.length) return null;
+  if (key === "Home") return items[0];
+  if (key === "End") return items.at(-1);
+  const index = items.indexOf(focusedItem);
+  if (index < 0) return key === "ArrowUp" || key === "ArrowLeft" ? items.at(-1) : items[0];
+  let step = 1;
+  if (grid && (key === "ArrowUp" || key === "ArrowDown")) {
+    const firstTop = items[0].offsetTop;
+    const nextRow = items.findIndex((item) => item.offsetTop > firstTop);
+    step = nextRow > 0 ? nextRow : items.length;
+    if (key === "ArrowUp" && index < step) return items[index];
+    if (key === "ArrowDown" && Math.floor(index / step) === Math.floor((items.length - 1) / step)) {
+      return items[index];
+    }
+  }
+  const direction = key === "ArrowUp" || key === "ArrowLeft" ? -1 : 1;
+  return items[Math.max(0, Math.min(items.length - 1, index + direction * step))];
+}
+
 function isItemShortcutTarget(target, elements) {
   return !!(target && elements.content && (target === elements.content || elements.content.contains?.(target)));
 }
diff --git a/capsules/library/browser/src/events.test.mjs b/capsules/library/browser/src/events.test.mjs
index ffe8e5713..223c94d30 100644
--- a/capsules/library/browser/src/events.test.mjs
+++ b/capsules/library/browser/src/events.test.mjs
@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 import test from "node:test";
 
 import { bindLibraryEvents } from "./events.js";
+import { createLibrarySelection } from "./selection.js";
 
 function fakeElement({ hidden = true } = {}) {
   return {
@@ -9,6 +10,9 @@ function fakeElement({ hidden = true } = {}) {
     dataset: {},
     value: "",
     files: null,
+    attributes: new Map(),
+    getAttribute(name) { return this.attributes.get(name) || null; },
+    setAttribute(name, value) { this.attributes.set(name, value); },
     classList: {
       contains(name) {
         return hidden && name === "hidden";
@@ -69,22 +73,35 @@ function dispatchWindowKey(windowListener, key, target, extras = {}) {
 }
 
 function createHarness() {
-  const selected = [{ uri: "localhost://Users/test/Documents/fixture.md", name: "fixture.md" }];
+  const objects = ["fixture.md", "second.md", "third.md", "fourth.md", "last.md"].map((name) => ({
+    uri: `localhost://Users/test/Documents/${name}`, name,
+  }));
+  const state = {
+    query: "", selectedUris: new Set([objects[0].uri]), selectionAnchorUri: objects[0].uri,
+    objectsByUri: new Map(objects.map((object) => [object.uri, object])),
+  };
   const openCalls = [];
+  const renameCalls = [];
+  const trashCalls = [];
+  const menuCalls = [];
   let renameCount = 0;
   let deleteCount = 0;
   let trashCount = 0;
   let selectAllCount = 0;
   const windowListeners = new Map();
   const documentListeners = new Map();
+  const animationFrames = [];
 
   const previousWindow = globalThis.window;
   const previousDocument = globalThis.document;
+  const previousCss = globalThis.CSS;
+  globalThis.CSS = { escape: (value) => value };
   globalThis.window = {
     addEventListener(type, listener) {
       windowListeners.set(type, listener);
     },
     innerWidth: 800,
+    requestAnimationFrame(callback) { animationFrames.push(callback); },
   };
   globalThis.document = {
     addEventListener(type, listener) {
@@ -111,10 +128,34 @@ function createHarness() {
     dialog: fakeElement({ hidden: true }),
     contextMenu: fakeElement({ hidden: true }),
   };
+  const items = objects.map((object, index) => ({
+    __insideContent: true,
+    dataset: { uri: object.uri },
+    tabIndex: index === 0 ? 0 : -1,
+    offsetTop: Math.floor(index / 2) * 100,
+    attributes: new Map(),
+    closest(selector) {
+      return selector === ".item" || selector === ".item[data-uri]" ? this : null;
+    },
+    getAttribute(name) { return this.attributes.get(name) || null; },
+    setAttribute(name, value) { this.attributes.set(name, value); },
+    focus() {
+      globalThis.document.activeElement = this;
+      elements.content.listeners.get("focusin")?.forEach((listener) => listener({ target: this }));
+    },
+    scrollIntoView() { this.scrolled = true; },
+  }));
+  elements.content.querySelectorAll = (selector) => selector === '.item[tabindex="0"]'
+    ? items.filter((item) => item.tabIndex === 0) : items;
+  elements.content.querySelector = (selector) => selector === '.item[tabindex="0"]'
+    ? items.find((item) => item.tabIndex === 0) : null;
+  const selection = createLibrarySelection({ content: elements.content, state,
+    visibleObjects: () => objects, renderFooter() {} });
+  selection.syncSelectionDom();
 
   bindLibraryEvents({
+    ...selection,
     bindDialogEvents() {},
-    clearSelection() {},
     copySelectedObjectsTo() {},
     createFolder: async () => {},
     deleteSelectedObjects: async () => {
@@ -130,39 +171,34 @@ function createHarness() {
     navigateBack: async () => {},
     navigateForward: async () => {},
     navigateUp: async () => {},
-    objectByUri(uri) {
-      return selected.find((object) => object.uri === uri) || null;
-    },
     openObject: async (object) => {
       openCalls.push(object.name);
     },
-    prepareDragSelection() {},
     reorderPlace() {},
     scheduleContentRender() {},
     selectAllVisible() {
       selectAllCount += 1;
+      selection.selectAllVisible();
     },
-    selectOnly() {},
-    selectedObjects() {
-      return selected;
-    },
-    selectRangeTo() {},
     setSort() {},
     setView() {},
     showBackgroundMenu() {},
     showError(error) {
       throw error;
     },
-    showMenuForObject() {},
+    showMenuForObject(object) {
+      menuCalls.push(object.uri);
+    },
     showPlaceMenu() {},
-    startRename() {
+    startRename(object) {
       renameCount += 1;
+      renameCalls.push(object.uri);
     },
-    state: { query: "", selectedUris: new Set(selected.map((object) => object.uri)) },
+    state,
     stopLibraryEventStream() {},
-    toggleSelected() {},
     trashSelectedObjects: async () => {
       trashCount += 1;
+      trashCalls.push(selection.selectedObjects().map((object) => object.uri));
     },
     uploadFiles: async () => {},
   });
@@ -171,10 +207,25 @@ function createHarness() {
     cleanup() {
       globalThis.window = previousWindow;
       globalThis.document = previousDocument;
+      if (previousCss === undefined) delete globalThis.CSS;
+      else globalThis.CSS = previousCss;
     },
     deleteCount: () => deleteCount,
     elements,
+    items,
+    selection,
+    state,
+    animationFrames,
+    pointerDown() { windowListeners.get("pointerdown")?.(); },
+    clickItem(index, extras = {}) {
+      elements.content.listeners.get("click").forEach((listener) => listener({
+        target: items[index], ctrlKey: false, metaKey: false, shiftKey: false, ...extras,
+      }));
+    },
     openCalls,
+    renameCalls,
+    trashCalls,
+    menuCalls,
     renameCount: () => renameCount,
     selectAllCount: () => selectAllCount,
     trashCount: () => trashCount,
@@ -266,3 +317,216 @@ test("Library file shortcuts pause while the context menu is open", () => {
     harness.cleanup();
   }
 });
+
+test("Library Enter opens the selected items when focus is outside the selection", async () => {
+  const harness = createHarness();
+  try {
+    const onKeydown = harness.windowKeydown();
+    assert.equal(dispatchWindowKey(onKeydown, "Enter", harness.items[1]), true);
+    await Promise.resolve();
+    assert.deepEqual(harness.openCalls, ["fixture.md"]);
+    assert.deepEqual([...harness.state.selectedUris], [harness.items[0].dataset.uri]);
+    harness.selection.toggleSelected(harness.items[2].dataset.uri);
+    dispatchWindowKey(onKeydown, "Enter", harness.items[1]);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    assert.deepEqual(harness.openCalls, ["fixture.md", "fixture.md", "third.md"]);
+    assert.deepEqual([...harness.state.selectedUris], [harness.items[0].dataset.uri, harness.items[2].dataset.uri]);
+  } finally {
+    harness.cleanup();
+  }
+});
+
+test("Library list keys move one tab stop, extend a range, and toggle selection", () => {
+  const harness = createHarness();
+  try {
+    const onKeydown = harness.windowKeydown();
+    const { items, state } = harness;
+    items[0].focus();
+    assert.equal(dispatchWindowKey(onKeydown, "ArrowDown", items[0]), true);
+    assert.equal(document.activeElement, items[1]);
+    assert.equal(items[1].scrolled, true);
+    assert.deepEqual(items.filter((item) => item.tabIndex === 0), [items[1]]);
+    assert.deepEqual([...state.selectedUris], [items[1].dataset.uri]);
+    dispatchWindowKey(onKeydown, "ArrowDown", items[1], { shiftKey: true });
+    assert.deepEqual([...state.selectedUris], [items[1].dataset.uri, items[2].dataset.uri]);
+    dispatchWindowKey(onKeydown, "ArrowUp", items[2], { shiftKey: true });
+    assert.deepEqual([...state.selectedUris], [items[1].dataset.uri]);
+    dispatchWindowKey(onKeydown, "End", items[1], { ctrlKey: true });
+    assert.equal(document.activeElement, items.at(-1));
+    assert.deepEqual([...state.selectedUris], [items[1].dataset.uri]);
+    dispatchWindowKey(onKeydown, " ", items.at(-1));
+    assert.deepEqual([...state.selectedUris], [items[1].dataset.uri, items.at(-1).dataset.uri]);
+    assert.equal(items.at(-1).attributes.get("aria-selected"), "true");
+    dispatchWindowKey(onKeydown, " ", items.at(-1));
+    assert.equal(items.at(-1).attributes.get("aria-selected"), "false");
+    dispatchWindowKey(onKeydown, "Home", items.at(-1));
+    assert.equal(document.activeElement, items[0]);
+    assert.deepEqual([...state.selectedUris], [items[0].dataset.uri]);
+    assert.equal(dispatchWindowKey(onKeydown, "ArrowLeft", items[0]), false);
+  } finally {
+    harness.cleanup();
+  }
+});
+
+test("Library grid arrows follow columns and stay within the first and last rows", () => {
+  const harness = createHarness();
+  try {
+    const onKeydown = harness.windowKeydown();
+    const { items } = harness;
+    harness.elements.content.dataset.view = "grid";
+    items[1].focus();
+    dispatchWindowKey(onKeydown, "ArrowUp", items[1]);
+    assert.equal(document.activeElement, items[1]);
+    dispatchWindowKey(onKeydown, "ArrowDown", items[1]);
+    assert.equal(document.activeElement, items[3]);
+    dispatchWindowKey(onKeydown, "ArrowDown", items[3]);
+    assert.equal(document.activeElement, items[4]);
+    dispatchWindowKey(onKeydown, "ArrowDown", items[4]);
+    assert.equal(document.activeElement, items[4]);
+    dispatchWindowKey(onKeydown, "ArrowUp", items[4]);
+    assert.equal(document.activeElement, items[2]);
+    dispatchWindowKey(onKeydown, "ArrowRight", items[2]);
+    assert.equal(document.activeElement, items[3]);
+    dispatchWindowKey(onKeydown, "ArrowLeft", items[3]);
+    assert.equal(document.activeElement, items[2]);
+  } finally {
+    harness.cleanup();
+  }
+});
+
+test("Library rename, delete and keyboard menus use the selection when focus is elsewhere", () => {
+  const harness = createHarness();
+  try {
+    const onKeydown = harness.windowKeydown();
+    dispatchWindowKey(onKeydown, "F2", harness.items[1]);
+    assert.deepEqual(harness.renameCalls, [harness.items[0].dataset.uri]);
+    dispatchWindowKey(onKeydown, "Delete", harness.items[2]);
+    assert.deepEqual(harness.trashCalls, [[harness.items[0].dataset.uri]]);
+    dispatchWindowKey(onKeydown, "ContextMenu", harness.items[1]);
+    dispatchWindowKey(onKeydown, "F10", harness.items[2], { shiftKey: true });
+    assert.deepEqual(harness.menuCalls, [harness.items[0].dataset.uri, harness.items[0].dataset.uri]);
+    assert.deepEqual([...harness.state.selectedUris], [harness.items[0].dataset.uri]);
+
+    harness.selection.toggleSelected(harness.items[2].dataset.uri);
+    dispatchWindowKey(onKeydown, "F2", harness.items[1]);
+    assert.equal(harness.renameCount(), 1, "F2 must leave a multiple selection unchanged");
+    dispatchWindowKey(onKeydown, "Delete", harness.items[1]);
+    assert.deepEqual(harness.trashCalls.at(-1), [harness.items[0].dataset.uri, harness.items[2].dataset.uri]);
+  } finally {
+    harness.cleanup();
+  }
+});
+
+test("Library item shortcuts use the focused row when the selection is empty", async () => {
+  const harness = createHarness();
+  try {
+    const onKeydown = harness.windowKeydown();
+    for (const [key, extras] of [["Enter", {}], ["F2", {}], ["Delete", {}], ["ContextMenu", {}], ["F10", { shiftKey: true }]]) {
+      harness.selection.clearSelection();
+      assert.equal(dispatchWindowKey(onKeydown, key, harness.items[1], extras), true);
+      assert.deepEqual([...harness.state.selectedUris], [harness.items[1].dataset.uri], key);
+    }
+    await Promise.resolve();
+    assert.deepEqual(harness.openCalls, ["second.md"]);
+    assert.deepEqual(harness.renameCalls, [harness.items[1].dataset.uri]);
+    assert.deepEqual(harness.trashCalls, [[harness.items[1].dataset.uri]]);
+    assert.deepEqual(harness.menuCalls, [harness.items[1].dataset.uri, harness.items[1].dataset.uri]);
+  } finally {
+    harness.cleanup();
+  }
+});
+
+for (const modifier of ["ctrlKey", "metaKey"]) {
+  test(`Library ${modifier}-click deselect then Delete trashes only the remaining selection`, () => {
+    const harness = createHarness();
+    try {
+      harness.clickItem(1, { [modifier]: true });
+      assert.deepEqual([...harness.state.selectedUris], [harness.items[0].dataset.uri, harness.items[1].dataset.uri]);
+      harness.clickItem(1, { [modifier]: true });
+      assert.equal(document.activeElement, harness.items[1]);
+      assert.deepEqual([...harness.state.selectedUris], [harness.items[0].dataset.uri]);
+      dispatchWindowKey(harness.windowKeydown(), "Delete", document.activeElement);
+      assert.deepEqual(harness.trashCalls, [[harness.items[0].dataset.uri]]);
+      assert.equal(harness.state.selectedUris.has(harness.items[1].dataset.uri), false);
+    } finally {
+      harness.cleanup();
+    }
+  });
+}
+
+test("Library navigation keys leave editing, toolbar, dialog, and menu input native", () => {
+  const harness = createHarness();
+  try {
+    const onKeydown = harness.windowKeydown();
+    for (const key of ["ArrowDown", "Home", "End", " ", "Enter", "F2", "Delete"]) {
+      assert.equal(dispatchWindowKey(onKeydown, key, fakeTarget({ insideContent: true, editable: true })), false);
+      assert.equal(dispatchWindowKey(onKeydown, key, harness.elements.backButton), false);
+      harness.elements.dialog.classList.contains = () => false;
+      assert.equal(dispatchWindowKey(onKeydown, key, harness.items[1]), false);
+      harness.elements.dialog.classList.contains = () => true;
+      harness.elements.contextMenu.classList.contains = () => false;
+      assert.equal(dispatchWindowKey(onKeydown, key, harness.items[1]), false);
+      harness.elements.contextMenu.classList.contains = () => true;
+    }
+    assert.deepEqual([...harness.state.selectedUris], [harness.items[0].dataset.uri]);
+    assert.deepEqual(harness.openCalls, []);
+  } finally {
+    harness.cleanup();
+  }
+});
+
+test("Library End waits for all rows and cancels when user intent or folder changes", () => {
+  const harness = createHarness();
+  try {
+    const onKeydown = harness.windowKeydown();
+    const { items, elements, animationFrames, state } = harness;
+    state.contentRenderJob = 1;
+    items[0].focus();
+    elements.content.setAttribute("aria-busy", "true");
+    dispatchWindowKey(onKeydown, "End", items[0]);
+    animationFrames.shift()();
+    assert.equal(document.activeElement, items[0]);
+    elements.content.setAttribute("aria-busy", "false");
+    animationFrames.shift()();
+    assert.equal(document.activeElement, items.at(-1));
+    assert.deepEqual([...state.selectedUris], [items.at(-1).dataset.uri]);
+
+    for (const cancel of [
+      () => dispatchWindowKey(onKeydown, "Home", items[0]),
+      () => harness.pointerDown(),
+      () => { state.contentRenderJob += 1; },
+      () => { document.activeElement = elements.backButton; },
+    ]) {
+      items[0].focus();
+      elements.content.setAttribute("aria-busy", "true");
+      dispatchWindowKey(onKeydown, "End", items[0]);
+      cancel();
+      const afterCancelFocus = document.activeElement;
+      elements.content.setAttribute("aria-busy", "false");
+      animationFrames.shift()();
+      assert.equal(document.activeElement, afterCancelFocus, "Cancelled End must keep the user's later focus target");
+    }
+  } finally {
+    harness.cleanup();
+  }
+});
+
+test("Library pending End takes focus from the content placeholder during a background render", () => {
+  const harness = createHarness();
+  try {
+    const { items, elements, animationFrames, state } = harness;
+    state.contentRenderJob = 1;
+    harness.selection.selectOnly(items[2].dataset.uri);
+    document.activeElement = elements.content;
+    elements.content.setAttribute("aria-busy", "true");
+    dispatchWindowKey(harness.windowKeydown(), "End", elements.content);
+    assert.equal(document.activeElement, items[0], "A mounted item must keep automatic chunk restoration from cancelling End");
+    assert.deepEqual([...state.selectedUris], [items[2].dataset.uri]);
+    elements.content.setAttribute("aria-busy", "false");
+    animationFrames.shift()();
+    assert.equal(document.activeElement, items.at(-1));
+    assert.deepEqual([...state.selectedUris], [items.at(-1).dataset.uri]);
+  } finally {
+    harness.cleanup();
+  }
+});
diff --git a/capsules/library/browser/src/folders.js b/capsules/library/browser/src/folders.js
new file mode 100644
index 000000000..35228afff
--- /dev/null
+++ b/capsules/library/browser/src/folders.js
@@ -0,0 +1,87 @@
+import { isDirectory } from "./model.js";
+import { cacheFolderListing } from "./state.js";
+
+export function createLibraryFolders({
+  homeNavigation,
+  perf,
+  providerApi,
+  renderAll,
+  runInitialObjectAction,
+  setFolderStatus,
+  setObjects,
+  setStatus,
+  state,
+}) {
+  async function loadCurrentFolder(options = {}) {
+    if (!state.currentUri) return;
+    const loadSeq = ++state.loadSeq;
+    const uri = state.currentUri;
+    const cached = options.useCache ? state.folderCache.get(uri) : null;
+    const sameFolder = state.objectsUri === uri;
+    let renderedCached = false;
+    let renderAfterFetch = true;
+    let loaded = false;
+    state.loadError = false;
+    if (cached) {
+      perf.folderCacheHits += 1;
+      state.loading = false;
+      state.currentObject = cached.object || null;
+      state.objectsUri = uri;
+      setObjects(cached.objects);
+      state.selectedUris.clear();
+      state.selectionAnchorUri = "";
+      setFolderStatus(`${state.objects.length} item${state.objects.length === 1 ? "" : "s"}.`);
+      renderAll();
+      await runInitialObjectAction();
+      renderedCached = true;
+    } else {
+      state.loading = true;
+      setStatus("Loading...");
+      if (!sameFolder) {
+        state.currentObject = null;
+        state.objectsUri = "";
+        setObjects([]);
+        state.selectedUris.clear();
+        state.selectionAnchorUri = "";
+        renderAll();
+      }
+    }
+    try {
+      const data = await providerApi("list", { uri });
+      if (loadSeq !== state.loadSeq || uri !== state.currentUri) {
+        return;
+      }
+      const objects = Array.isArray(data.objects) ? data.objects : [];
+      const currentObject = data.object || null;
+      const nextCache = cacheFolderListing(state, perf, uri, objects, currentObject);
+      state.currentObject = currentObject;
+      state.objectsUri = uri;
+      loaded = true;
+      if (state.mode === "browse" && currentObject?.uri === uri && isDirectory(currentObject)) {
+        homeNavigation.setQuery({ uri });
+      }
+      if (renderedCached && cached.signature === nextCache.signature) {
+        renderAfterFetch = false;
+        setFolderStatus(`${state.objects.length} item${state.objects.length === 1 ? "" : "s"}.`);
+        return;
+      }
+      setObjects(objects);
+      state.selectedUris.clear();
+      state.selectionAnchorUri = "";
+      setFolderStatus(`${state.objects.length} item${state.objects.length === 1 ? "" : "s"}.`);
+    } catch (error) {
+      // A later navigation owns both the rows and any failure message.
+      if (loadSeq !== state.loadSeq || uri !== state.currentUri) return;
+      state.loadError = true;
+      throw error;
+    } finally {
+      if (loadSeq === state.loadSeq && uri === state.currentUri) {
+        state.loading = false;
+        if (renderAfterFetch) renderAll();
+        if (renderAfterFetch && loaded) await runInitialObjectAction();
+      }
+    }
+  }
+
+  return { loadCurrentFolder };
+}
diff --git a/capsules/library/browser/src/folders.test.mjs b/capsules/library/browser/src/folders.test.mjs
new file mode 100644
index 000000000..a843a2596
--- /dev/null
+++ b/capsules/library/browser/src/folders.test.mjs
@@ -0,0 +1,148 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { createLibraryFolders } from "./folders.js";
+import { cacheFolderListing, setLibraryObjects } from "./state.js";
+
+const documents = "localhost://Users/fixture/Documents";
+const photos = `${documents}/Photos`;
+const oldItem = { uri: `${documents}/notes.txt`, name: "notes.txt", kind: "file" };
+const newItem = { uri: `${photos}/photo.png`, name: "photo.png", kind: "file" };
+
+function deferred() {
+  let resolve;
+  let reject;
+  const promise = new Promise((yes, no) => { resolve = yes; reject = no; });
+  return { promise, resolve, reject };
+}
+
+function fixture() {
+  const state = {
+    currentUri: documents, objectsUri: documents, currentObject: { uri: documents, kind: "directory" },
+    loadSeq: 0, mode: "browse", loading: false, loadError: false,
+    folderCache: new Map(), selectedUris: new Set([oldItem.uri]), selectionAnchorUri: oldItem.uri,
+    objectsVersion: 0,
+  };
+  setLibraryObjects(state, [oldItem]);
+  const perf = { folderCacheHits: 0 };
+  const requests = [];
+  const renders = [];
+  const routes = [];
+  const statuses = [];
+  let initialActions = 0;
+  const { loadCurrentFolder } = createLibraryFolders({
+    state,
+    perf,
+    providerApi: (_op, { uri }) => {
+      const request = { uri, ...deferred() };
+      requests.push(request);
+      return request.promise;
+    },
+    setObjects: (objects) => setLibraryObjects(state, objects),
+    renderAll: () => renders.push({ uri: state.currentUri, objects: [...state.objects], loading: state.loading, loadError: state.loadError }),
+    setStatus: (status) => statuses.push(status),
+    setFolderStatus: (status) => statuses.push(status),
+    homeNavigation: { setQuery: (query) => routes.push(query) },
+    runInitialObjectAction: async () => { initialActions += 1; },
+  });
+  return { state, perf, requests, renders, routes, statuses, loadCurrentFolder, initialActions: () => initialActions };
+}
+
+function listing(uri, objects) {
+  return { object: { uri, kind: "directory" }, objects };
+}
+
+test("an uncached folder immediately clears the previous folder and selection while loading", async () => {
+  const f = fixture();
+  f.state.currentUri = photos;
+  const pending = f.loadCurrentFolder({ useCache: true });
+  const beforeResponse = {
+    objects: [...f.state.objects], selected: [...f.state.selectedUris], anchor: f.state.selectionAnchorUri,
+    objectsByUri: f.state.objectsByUri.size, rendered: f.renders.at(-1),
+  };
+  f.requests[0].resolve(listing(photos, [newItem]));
+  await pending;
+  assert.deepEqual(beforeResponse.objects, []);
+  assert.deepEqual(beforeResponse.selected, []);
+  assert.equal(beforeResponse.anchor, "");
+  assert.equal(beforeResponse.objectsByUri, 0);
+  assert.equal(beforeResponse.rendered?.loading, true);
+  assert.deepEqual(beforeResponse.rendered?.objects, []);
+  assert.deepEqual(f.state.objects, [newItem]);
+  assert.equal(f.state.objectsUri, photos);
+  assert.equal(f.state.loading, false);
+  assert.deepEqual(f.routes, [{ uri: photos }]);
+});
+
+test("a failed folder stays empty with a retry state and can load successfully on refresh", async () => {
+  const f = fixture();
+  f.state.currentUri = photos;
+  const pending = f.loadCurrentFolder({ useCache: true });
+  f.requests[0].reject(new Error("list failed"));
+  await assert.rejects(pending, /list failed/);
+  assert.deepEqual(f.state.objects, []);
+  assert.equal(f.state.loading, false);
+  assert.equal(f.state.loadError, true);
+  assert.equal(f.renders.at(-1).loadError, true);
+  assert.deepEqual(f.routes, []);
+  assert.equal(f.initialActions(), 0, "a failed listing must not trigger an initial item action");
+
+  const retry = f.loadCurrentFolder();
+  assert.equal(f.state.loadError, false);
+  assert.equal(f.state.loading, true);
+  f.requests[1].resolve(listing(photos, [newItem]));
+  await retry;
+  assert.deepEqual(f.state.objects, [newItem]);
+  assert.equal(f.state.loadError, false);
+});
+
+test("refresh preserves the current folder and selection during a delayed or failed request", async () => {
+  const f = fixture();
+  const pending = f.loadCurrentFolder();
+  assert.deepEqual(f.state.objects, [oldItem]);
+  assert.deepEqual([...f.state.selectedUris], [oldItem.uri]);
+  f.requests[0].reject(new Error("refresh failed"));
+  await assert.rejects(pending, /refresh failed/);
+  assert.deepEqual(f.state.objects, [oldItem]);
+  assert.deepEqual([...f.state.selectedUris], [oldItem.uri]);
+  assert.equal(f.state.currentObject?.uri, documents);
+});
+
+for (const outcome of ["success", "failure"]) {
+  test(`a superseded folder ${outcome} leaves the new folder and its status alone`, async () => {
+    const f = fixture();
+    f.state.currentUri = photos;
+    const obsolete = f.loadCurrentFolder({ useCache: true });
+    f.state.currentUri = documents;
+    const current = f.loadCurrentFolder({ useCache: true });
+    f.requests[1].resolve(listing(documents, [oldItem]));
+    await current;
+    const renderCount = f.renders.length;
+    const statusCount = f.statuses.length;
+    if (outcome === "success") f.requests[0].resolve(listing(photos, [newItem]));
+    else f.requests[0].reject(new Error("old folder unavailable"));
+    await assert.doesNotReject(obsolete);
+    assert.deepEqual(f.state.objects, [oldItem]);
+    assert.equal(f.state.loading, false);
+    assert.equal(f.state.loadError, false);
+    assert.equal(f.renders.length, renderCount);
+    assert.equal(f.statuses.length, statusCount);
+    assert.deepEqual(f.routes, [{ uri: documents }]);
+  });
+}
+
+test("cached folder navigation is immediate and an equivalent response avoids a second render", async () => {
+  const f = fixture();
+  const data = listing(photos, [newItem]);
+  cacheFolderListing(f.state, f.perf, photos, data.objects, data.object);
+  f.state.currentUri = photos;
+  const pending = f.loadCurrentFolder({ useCache: true });
+  assert.deepEqual(f.state.objects, [newItem]);
+  assert.equal(f.state.loading, false);
+  await Promise.resolve();
+  f.requests[0].resolve(structuredClone(data));
+  await pending;
+  assert.equal(f.perf.folderCacheHits, 1);
+  assert.equal(f.renders.length, 1);
+  assert.equal(f.state.objectsUri, photos);
+});
diff --git a/capsules/library/browser/src/render.js b/capsules/library/browser/src/render.js
index cbcce5e56..1bb93adfb 100644
--- a/capsules/library/browser/src/render.js
+++ b/capsules/library/browser/src/render.js
@@ -34,6 +34,11 @@ export function createLibraryRenderer({
     elements.content.dataset.view = state.view === "list" ? "list" : "grid";
     elements.sortSelect.value = state.sort;
     const objects = visibleObjects();
+    const focusedUri = elements.content.contains(document.activeElement)
+      ? document.activeElement?.closest(".item[data-uri]")?.dataset.uri || "" : "";
+    const previousTabStopUri = elements.content.querySelector('.item[tabindex="0"]')?.dataset.uri;
+    elements.content.tabIndex = objects.length ? -1 : 0;
+    elements.content.setAttribute("aria-busy", String(objects.length > LARGE_RENDER_THRESHOLD));
     if (!objects.length) {
       elements.content.dataset.empty = "true";
       const copy = emptyStateCopy(state);
@@ -41,6 +46,7 @@ export function createLibraryRenderer({
       empty.className = "empty";
       empty.innerHTML = `<div class="empty-inner"><h2>${escapeHtml(copy.title)}</h2><p>${escapeHtml(copy.body)}</p></div>`;
       elements.content.replaceChildren(empty);
+      if (focusedUri) elements.content.focus({ preventScroll: true });
       perf.contentRenderCount += 1;
       perf.lastContentRender = {
         durationMs: performance.now() - startedAt,
@@ -52,14 +58,18 @@ export function createLibraryRenderer({
     elements.content.dataset.empty = "false";
     const chunked = objects.length > LARGE_RENDER_THRESHOLD;
     const firstLimit = chunked ? Math.min(INITIAL_RENDER_LIMIT, objects.length) : objects.length;
+    const initialObjects = objects.slice(0, firstLimit);
+    const tabStopUri = initialObjects.find((object) => object.uri === previousTabStopUri)?.uri
+      || initialObjects.find((object) => isSelected(object.uri))?.uri || initialObjects[0].uri;
     const fragment = document.createDocumentFragment();
     if (state.view === "list") {
       fragment.appendChild(renderListHeader());
     }
-    for (const object of objects.slice(0, firstLimit)) {
-      fragment.appendChild(renderObject(object));
+    for (const object of initialObjects) {
+      fragment.appendChild(renderObject(object, tabStopUri));
     }
     elements.content.replaceChildren(fragment);
+    if (focusedUri) restoreItemFocus(focusedUri);
     pruneObjectNodeCache(objects);
     perf.contentRenderCount += 1;
     perf.lastContentRender = {
@@ -72,11 +82,17 @@ export function createLibraryRenderer({
       view: state.view,
     };
     if (chunked) {
-      renderContentChunks(objects, firstLimit, job, startedAt);
+      renderContentChunks(objects, firstLimit, job, startedAt, focusedUri);
     }
   }
 
   function emptyStateCopy(state) {
+    if (state.loading) {
+      return { title: "Loading folder...", body: "Your items will appear here." };
+    }
+    if (state.loadError) {
+      return { title: "This folder could not be opened", body: "Choose Refresh from More to try again." };
+    }
     if (state.query) {
       return { title: "No matching items", body: "Try another search." };
     }
@@ -89,7 +105,12 @@ export function createLibraryRenderer({
     return { title: "This folder is empty", body: "Upload a file or create a folder." };
   }
 
-  function renderContentChunks(objects, startIndex, job, startedAt) {
+  function restoreItemFocus(uri) {
+    const item = elements.content.querySelector(`.item[data-uri="${CSS.escape(uri)}"]`);
+    (item || elements.content).focus({ preventScroll: true });
+  }
+
+  function renderContentChunks(objects, startIndex, job, startedAt, focusedUri) {
     window.requestAnimationFrame(() => {
       if (job !== state.contentRenderJob) return;
       const fragment = document.createDocumentFragment();
@@ -98,10 +119,12 @@ export function createLibraryRenderer({
         fragment.appendChild(renderObject(object));
       }
       elements.content.appendChild(fragment);
+      if (focusedUri && document.activeElement === elements.content) restoreItemFocus(focusedUri);
       if (nextIndex < objects.length) {
-        renderContentChunks(objects, nextIndex, job, startedAt);
+        renderContentChunks(objects, nextIndex, job, startedAt, focusedUri);
         return;
       }
+      elements.content.setAttribute("aria-busy", "false");
       perf.lastContentRender = {
         ...(perf.lastContentRender || {}),
         durationMs: perf.lastContentRender?.durationMs || 0,
@@ -124,12 +147,16 @@ export function createLibraryRenderer({
     return header;
   }
 
-  function renderObject(object) {
+  function renderObject(object, tabStopUri = "") {
     const signature = objectRenderSignature(object);
     const cached = state.objectNodeCache.get(object.uri);
     if (cached && cached.signature === signature && !cached.node.querySelector(".rename-input")) {
       perf.objectNodeCacheHits += 1;
-      cached.node.dataset.selected = isSelected(object.uri) ? "true" : "false";
+      const selected = isSelected(object.uri) ? "true" : "false";
+      const tabIndex = object.uri === tabStopUri ? 0 : -1;
+      if (cached.node.dataset.selected !== selected) cached.node.dataset.selected = selected;
+      if (cached.node.getAttribute("aria-selected") !== selected) cached.node.setAttribute("aria-selected", selected);
+      if (cached.node.tabIndex !== tabIndex) cached.node.tabIndex = tabIndex;
       state.objectNodeCache.delete(object.uri);
       state.objectNodeCache.set(object.uri, cached);
       return cached.node;
@@ -141,8 +168,10 @@ export function createLibraryRenderer({
     item.dataset.kind = object.kind;
     item.dataset.blocked = isBlockedObject(object) ? "true" : "false";
     item.dataset.selected = isSelected(object.uri) ? "true" : "false";
+    item.setAttribute("role", "option");
+    item.setAttribute("aria-selected", item.dataset.selected);
     item.draggable = !isBlockedObject(object);
-    item.tabIndex = 0;
+    item.tabIndex = object.uri === tabStopUri ? 0 : -1;
     const visibility = visibilityContract(object);
     const inPublicFolder = visibility.placement === "public_folder";
     const badges = [
diff --git a/capsules/library/browser/src/selection.js b/capsules/library/browser/src/selection.js
index f994dc7d1..70a038ae2 100644
--- a/capsules/library/browser/src/selection.js
+++ b/capsules/library/browser/src/selection.js
@@ -73,7 +73,9 @@ export function createLibrarySelection({
 
   function syncSelectionDom() {
     for (const item of content.querySelectorAll(".item[data-uri]")) {
-      item.dataset.selected = state.selectedUris.has(item.dataset.uri) ? "true" : "false";
+      const selected = state.selectedUris.has(item.dataset.uri) ? "true" : "false";
+      if (item.dataset.selected !== selected) item.dataset.selected = selected;
+      if (item.getAttribute("aria-selected") !== selected) item.setAttribute("aria-selected", selected);
     }
     renderFooter();
   }
diff --git a/capsules/library/browser/src/selection.test.mjs b/capsules/library/browser/src/selection.test.mjs
new file mode 100644
index 000000000..e5104022c
--- /dev/null
+++ b/capsules/library/browser/src/selection.test.mjs
@@ -0,0 +1,82 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { createLibrarySelection } from "./selection.js";
+
+test("Library selection exposes selected state and follows the visible order for ranges", () => {
+  const objects = ["c", "a", "b"].map((name) => ({ uri: `localhost://Users/test/Documents/${name}`, name }));
+  const items = objects.map(({ uri }) => ({
+    dataset: { uri }, attributes: new Map(),
+    getAttribute(name) { return this.attributes.get(name) || null; },
+    setAttribute(name, value) { this.attributes.set(name, value); },
+  }));
+  const state = { objectsByUri: new Map(objects.map((object) => [object.uri, object])),
+    selectedUris: new Set(), selectionAnchorUri: "" };
+  let footerRenders = 0;
+  const selection = createLibrarySelection({
+    content: { querySelectorAll: () => items }, state,
+    visibleObjects: () => objects,
+    renderFooter: () => { footerRenders += 1; },
+  });
+  function selectedNames() { return selection.selectedObjects().map((object) => object.name); }
+  function assertAccessibleSelection() {
+    for (const item of items) {
+      const expected = String(state.selectedUris.has(item.dataset.uri));
+      assert.equal(item.dataset.selected, expected);
+      assert.equal(item.attributes.get("aria-selected"), expected);
+    }
+  }
+  selection.selectOnly(objects[0].uri);
+  selection.selectRangeTo(objects[2].uri);
+  assert.deepEqual(selectedNames(), ["c", "a", "b"]);
+  assertAccessibleSelection();
+  selection.selectRangeTo(objects[1].uri);
+  assert.deepEqual(selectedNames(), ["c", "a"]);
+  assertAccessibleSelection();
+  selection.toggleSelected(objects[0].uri);
+  assert.deepEqual(selectedNames(), ["a"]);
+  assertAccessibleSelection();
+  selection.clearSelection();
+  assert.deepEqual(selectedNames(), []);
+  assertAccessibleSelection();
+  selection.prepareDragSelection(objects[2].uri, items[2]);
+  assert.deepEqual(selectedNames(), ["b"]);
+  assertAccessibleSelection();
+  selection.selectAllVisible();
+  assert.deepEqual(selectedNames(), ["c", "a", "b"]);
+  assertAccessibleSelection();
+  assert.equal(footerRenders, 7);
+});
+
+test("Library selection only changes DOM attributes when their selected state changes", () => {
+  let mutations = 0;
+  const objects = ["a", "b"].map((name) => ({ uri: `localhost://Users/test/Documents/${name}` }));
+  const items = objects.map(({ uri }) => ({
+    dataset: new Proxy({ uri, selected: "false" }, {
+      set(target, name, value) { mutations += 1; target[name] = value; return true; },
+    }),
+    attributes: new Map([["aria-selected", "false"]]),
+    getAttribute(name) { return this.attributes.get(name) || null; },
+    setAttribute(name, value) { mutations += 1; this.attributes.set(name, value); },
+  }));
+  const state = { objectsByUri: new Map(objects.map((object) => [object.uri, object])),
+    selectedUris: new Set(), selectionAnchorUri: "" };
+  const selection = createLibrarySelection({
+    content: { querySelectorAll: () => items }, state,
+    visibleObjects: () => objects, renderFooter() {},
+  });
+  selection.clearSelection();
+  assert.equal(mutations, 0);
+  selection.selectOnly(objects[0].uri);
+  assert.equal(mutations, 2);
+  selection.selectOnly(objects[0].uri);
+  assert.equal(mutations, 2, "An unchanged selection must keep DOM attributes untouched");
+  selection.selectOnly(objects[1].uri);
+  assert.equal(mutations, 6, "Moving selection must update both attributes on only the old and new items");
+  assert.equal(items[0].getAttribute("aria-selected"), "false");
+  assert.equal(items[1].getAttribute("aria-selected"), "true");
+  items[1].attributes.set("aria-selected", "false");
+  selection.syncSelectionDom();
+  assert.equal(mutations, 7, "Accessible state must be repaired even when the visual state is already correct");
+  assert.equal(items[1].getAttribute("aria-selected"), "true");
+});
diff --git a/capsules/library/browser/src/state.js b/capsules/library/browser/src/state.js
index 1e9a76719..23cfa7e4b 100644
--- a/capsules/library/browser/src/state.js
+++ b/capsules/library/browser/src/state.js
@@ -16,6 +16,9 @@ export const MUTATING_PROVIDER_OPS = new Set([
   "share",
 ]);
 
+// Reuse locale setup across comparisons and folder refreshes.
+const nameCollator = new Intl.Collator(undefined, { sensitivity: "base" });
+
 export function createLibraryState({ queryParams, storage, perfTarget }) {
   const rawMode = queryParams.get("mode") || "";
   const state = {
@@ -30,6 +33,7 @@ export function createLibraryState({ queryParams, storage, perfTarget }) {
     currentUri: "",
     currentObject: null,
     objects: [],
+    objectsUri: "",
     objectsByUri: new Map(),
     objectsVersion: 0,
     visibleCacheKey: "",
@@ -49,6 +53,7 @@ export function createLibraryState({ queryParams, storage, perfTarget }) {
     showHidden: storage.getItem("library.showHidden") === "true",
     query: "",
     loading: false,
+    loadError: false,
     loadSeq: 0,
     eventSource: null,
     eventReconnectTimer: null,
@@ -151,7 +156,7 @@ export function visibleObjectsForState(state) {
     if (state.sort === "modified") result = Number(left.modified_at || 0) - Number(right.modified_at || 0);
     else if (state.sort === "size") result = Number(left.size || 0) - Number(right.size || 0);
     else if (state.sort === "type") result = String(left.mime || "").localeCompare(String(right.mime || ""));
-    else result = String(left.name || "").localeCompare(String(right.name || ""), undefined, { sensitivity: "base" });
+    else result = nameCollator.compare(String(left.name || ""), String(right.name || ""));
     return state.sortOrder === "desc" ? -result : result;
   });
   state.visibleCacheKey = cacheKey;
@@ -165,18 +170,23 @@ function invalidateVisibleCache(state) {
 }
 
 function folderListingSignature(objects) {
+  // A matching signature keeps the cached objects, including their action and
+  // viewer facts. Metadata can change independently of a content revision.
   return JSON.stringify((Array.isArray(objects) ? objects : []).map((object) => [
     object.uri,
     object.revision,
     object.kind,
     object.name,
+    object.mime,
     object.size,
+    object.created_at,
     object.modified_at,
     object.content_cid || "",
     object.published_cid || "",
     object.availability || "",
-    object.metadata?.visibility?.placement || "",
-    object.metadata?.visibility?.effective_access || "",
+    object.capabilities,
+    object.viewers,
+    object.metadata,
     object.published ? 1 : 0,
     object.shared ? 1 : 0,
     object.blocked_reason || "",
diff --git a/elastos/tools/browser-vm-guest-control-bridge/src/main.rs b/elastos/tools/browser-vm-guest-control-bridge/src/main.rs
index 56cd600ce..54e84740a 100644
--- a/elastos/tools/browser-vm-guest-control-bridge/src/main.rs
+++ b/elastos/tools/browser-vm-guest-control-bridge/src/main.rs
@@ -46,6 +46,7 @@ struct BridgeConfig {
     replace_existing_socket: bool,
     #[serde(default = "default_buffer_bytes")]
     buffer_bytes: usize,
+    // Finite runs are for tests and smoke runs. The guest service uses zero.
     #[serde(default)]
     max_sessions: usize,
     #[serde(default = "default_control_socket_ready_timeout_ms")]
@@ -125,11 +126,13 @@ fn run_bridge(config: &BridgeConfig, stdout: &mut dyn Write) -> Result<(), Strin
 
     let mut accepted = 0_usize;
     let mut workers = Vec::new();
+    let mut worker_error = None;
     loop {
         if config.max_sessions > 0 && accepted >= config.max_sessions {
             break;
         }
         let host_stream = listener.accept()?;
+        reap_finished_workers(&mut workers, &mut worker_error);
         accepted += 1;
         let session_id = accepted;
         eprintln!("browser VM guest control bridge accepted session {session_id}");
@@ -137,7 +140,7 @@ fn run_bridge(config: &BridgeConfig, stdout: &mut dyn Write) -> Result<(), Strin
         let buffer_bytes = config.buffer_bytes;
         let control_socket_ready_timeout_ms = config.control_socket_ready_timeout_ms;
         let control_request_timeout = Duration::from_millis(config.control_request_timeout_ms);
-        workers.push(thread::spawn(move || {
+        workers.push((session_id, thread::spawn(move || {
             let guest_stream = match connect_guest_control_socket(
                 &guest_control_path,
                 Duration::from_millis(control_socket_ready_timeout_ms),
@@ -166,15 +169,71 @@ fn run_bridge(config: &BridgeConfig, stdout: &mut dyn Write) -> Result<(), Strin
                 eprintln!("browser VM guest control bridge session {session_id} failed: {err}");
             }
             Ok(())
-        }));
+        })));
+        #[cfg(test)]
+        tests::observe_retained_workers(&workers);
     }
 
+    finish_workers_in_accept_order(workers, worker_error)
+}
+
+type ControlWorker = (usize, thread::JoinHandle<Result<(), String>>);
+
+fn finish_workers_in_accept_order(
+    mut workers: Vec<ControlWorker>,
+    mut first_error: Option<(usize, String)>,
+) -> Result<(), String> {
+    // Only tests and smoke runs set max_sessions for this finite shutdown path.
+    // Reaping can reorder retained workers: resolve earlier sessions, then
+    // return the first error without waiting for later requests.
+    workers.sort_unstable_by_key(|(session_id, _)| *session_id);
     for worker in workers {
-        worker
-            .join()
-            .map_err(|_| "browser VM guest control bridge worker panicked".to_string())??;
+        if first_error
+            .as_ref()
+            .is_some_and(|(failed_session, _)| worker.0 > *failed_session)
+        {
+            break;
+        }
+        record_worker_result(worker, &mut first_error);
+    }
+    match first_error {
+        Some((_, error)) => Err(error),
+        None => Ok(()),
+    }
+}
+
+fn reap_finished_workers(
+    workers: &mut Vec<ControlWorker>,
+    first_error: &mut Option<(usize, String)>,
+) {
+    let mut index = 0;
+    while index < workers.len() {
+        if workers[index].1.is_finished() {
+            record_worker_result(workers.swap_remove(index), first_error);
+        } else {
+            index += 1;
+        }
+    }
+}
+
+fn record_worker_result(
+    (session_id, worker): ControlWorker,
+    first_error: &mut Option<(usize, String)>,
+) {
+    let result = worker
+        .join()
+        .unwrap_or_else(|_| Err("browser VM guest control bridge worker panicked".to_string()));
+    if let Err(error) = result {
+        eprintln!("browser VM guest control bridge session {session_id} worker failed: {error}");
+        // Finite runs report the first failed accepted session even when later
+        // sessions finish first. A completed failure does not stop accepting.
+        if first_error
+            .as_ref()
+            .is_none_or(|(first_session, _)| session_id < *first_session)
+        {
+            *first_error = Some((session_id, error));
+        }
     }
-    Ok(())
 }
 
 fn proxy_http_control_request(
@@ -707,6 +766,343 @@ fn accept_vsock(_listener_fd: RawFd) -> Result<File, String> {
 mod tests {
     use super::*;
 
+    thread_local! {
+        static RETAINED_WORKER_COUNTS: std::cell::RefCell<Option<Vec<usize>>> = const {
+            std::cell::RefCell::new(None)
+        };
+    }
+
+    pub(super) fn observe_retained_workers(workers: &[ControlWorker]) {
+        RETAINED_WORKER_COUNTS.with_borrow_mut(|counts| {
+            if let Some(counts) = counts {
+                counts.push(workers.len());
+                // Make the next production accept see completed handles. This
+                // observes the actual vector and never removes a handle.
+                for (_, worker) in workers {
+                    wait_until_finished(worker);
+                }
+            }
+        });
+    }
+
+    struct TestDirectory(PathBuf);
+
+    impl TestDirectory {
+        fn new() -> Self {
+            let nonce = std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos();
+            let path = std::env::temp_dir().join(format!("eb-{}-{nonce:x}", std::process::id()));
+            fs::create_dir(&path).unwrap();
+            Self(path)
+        }
+    }
+
+    impl Drop for TestDirectory {
+        fn drop(&mut self) {
+            fs::remove_dir_all(&self.0).unwrap();
+        }
+    }
+
+    fn accept_test_session(listener: &UnixListener) -> UnixStream {
+        let deadline = Instant::now() + Duration::from_secs(5);
+        loop {
+            match listener.accept() {
+                Ok((stream, _)) => return stream,
+                Err(error) if error.kind() == io::ErrorKind::WouldBlock => {
+                    assert!(Instant::now() < deadline, "guest session was not accepted");
+                    thread::yield_now();
+                }
+                Err(error) => panic!("guest accept failed: {error}"),
+            }
+        }
+    }
+
+    #[test]
+    fn run_bridge_reclaims_completed_handles_between_sessions() {
+        let directory = TestDirectory::new();
+        let guest_path = directory.0.join("guest.sock");
+        let host_path = directory.0.join("host.sock");
+        let guest_listener = UnixListener::bind(&guest_path).unwrap();
+        guest_listener.set_nonblocking(true).unwrap();
+        let guest = thread::spawn(move || {
+            for _ in 0..3 {
+                let mut stream = DuplexStream::Unix(accept_test_session(&guest_listener));
+                let request = read_one_http_request(
+                    &mut stream,
+                    1024,
+                    Instant::now() + Duration::from_secs(5),
+                )
+                .unwrap();
+                assert!(request.starts_with(b"GET /status HTTP/1.1\r\n"));
+                stream
+                    .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok")
+                    .unwrap();
+            }
+        });
+        let client_path = host_path.clone();
+        let client = thread::spawn(move || {
+            for _ in 0..3 {
+                let mut stream = connect_guest_control_socket(
+                    client_path.to_str().unwrap(),
+                    Duration::from_secs(5),
+                )
+                .unwrap();
+                stream
+                    .set_read_timeout(Some(Duration::from_secs(5)))
+                    .unwrap();
+                stream
+                    .write_all(b"GET /status HTTP/1.1\r\nHost: browser-vm\r\n\r\n")
+                    .unwrap();
+                let mut response = String::new();
+                stream.read_to_string(&mut response).unwrap();
+                assert_eq!(response, "HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok");
+            }
+        });
+
+        let mut bridge = config(HostListenConfig::UnixListen {
+            path: host_path.to_str().unwrap().to_string(),
+        });
+        bridge.guest_control_socket_path = guest_path.to_str().unwrap().to_string();
+        bridge.max_sessions = 3;
+        bridge.control_socket_ready_timeout_ms = 5000;
+        bridge.control_request_timeout_ms = 5000;
+        RETAINED_WORKER_COUNTS.with_borrow_mut(|counts| *counts = Some(Vec::new()));
+        let result = run_bridge(&bridge, &mut Vec::new());
+        let retained = RETAINED_WORKER_COUNTS
+            .with_borrow_mut(Option::take)
+            .unwrap();
+        let client_result = client.join();
+        let guest_result = guest.join();
+
+        assert_eq!(result, Ok(()));
+        client_result.unwrap();
+        guest_result.unwrap();
+        assert_eq!(
+            retained,
+            vec![1, 1, 1],
+            "completed handles survived the next accept"
+        );
+    }
+
+    #[test]
+    fn reaped_worker_failures_are_logged() {
+        for (test, messages) in [
+            (
+                "tests::reaped_failures_keep_accept_order_until_final_join",
+                vec![
+                    "session 2 worker failed: later accepted failure",
+                    "session 1 worker failed: first accepted failure",
+                ],
+            ),
+            (
+                "tests::reaped_worker_panics_preserve_bridge_error",
+                vec!["session 1 worker failed: browser VM guest control bridge worker panicked"],
+            ),
+        ] {
+            let output = std::process::Command::new(std::env::current_exe().unwrap())
+                .args(["--exact", test, "--nocapture"])
+                .output()
+                .unwrap();
+            assert!(output.status.success());
+            let stderr = String::from_utf8(output.stderr).unwrap();
+            for message in messages {
+                assert!(
+                    stderr.contains(message),
+                    "missing worker log: {message}\n{stderr}"
+                );
+            }
+        }
+    }
+
+    fn wait_until_finished(worker: &thread::JoinHandle<Result<(), String>>) {
+        let deadline = Instant::now() + Duration::from_secs(5);
+        while !worker.is_finished() {
+            assert!(Instant::now() < deadline, "worker did not finish");
+            thread::yield_now();
+        }
+    }
+
+    #[test]
+    fn reaping_finished_workers_keeps_active_requests() {
+        let (release, blocked) = std::sync::mpsc::channel();
+        let active = thread::spawn(move || {
+            blocked.recv().map_err(|error| error.to_string())?;
+            Ok(())
+        });
+        let finished = thread::spawn(|| Ok(()));
+        wait_until_finished(&finished);
+        let another_finished = thread::spawn(|| Ok(()));
+        wait_until_finished(&another_finished);
+        let (reported, observation) = std::sync::mpsc::channel();
+        let reaper = thread::spawn(move || {
+            let mut workers = vec![(1, active), (2, finished), (3, another_finished)];
+            let mut first_error = None;
+            reap_finished_workers(&mut workers, &mut first_error);
+            reported.send((workers, first_error)).unwrap();
+        });
+
+        let result = observation.recv_timeout(Duration::from_secs(5));
+        // Release and join every worker even if a regression made reaping wait
+        // for the active request to finish.
+        release.send(()).unwrap();
+        reaper.join().unwrap();
+        let (workers, mut first_error) = result.expect("reaping waited for an active request");
+        let retained_sessions: Vec<_> = workers.iter().map(|(id, _)| *id).collect();
+        for worker in workers {
+            record_worker_result(worker, &mut first_error);
+        }
+        assert_eq!(retained_sessions, vec![1]);
+        assert!(first_error.is_none());
+    }
+
+    #[test]
+    fn reaped_failures_keep_accept_order_until_final_join() {
+        let first = thread::spawn(|| Err("first accepted failure".to_string()));
+        let later = thread::spawn(|| Err("later accepted failure".to_string()));
+        wait_until_finished(&first);
+        wait_until_finished(&later);
+        let mut workers = vec![(2, later)];
+        let mut first_error = None;
+        reap_finished_workers(&mut workers, &mut first_error);
+        let earlier_failure = first_error.clone();
+        record_worker_result((1, first), &mut first_error);
+        assert_eq!(earlier_failure, Some((2, "later accepted failure".into())));
+        assert_eq!(first_error, Some((1, "first accepted failure".into())));
+    }
+
+    #[test]
+    fn finite_shutdown_does_not_wait_for_requests_after_the_first_failure() {
+        for reap_failure_first in [false, true] {
+            let (release, blocked) = std::sync::mpsc::channel();
+            let (completed, completion) = std::sync::mpsc::channel();
+            let active = thread::spawn(move || {
+                blocked.recv().map_err(|error| error.to_string())?;
+                completed.send(()).unwrap();
+                Ok(())
+            });
+            let failed = thread::spawn(|| Err("first accepted failure".to_string()));
+            wait_until_finished(&failed);
+            // Reaping can leave a later active session ahead of an earlier one.
+            let mut workers = vec![(2, active), (1, failed)];
+            let mut first_error = None;
+            if reap_failure_first {
+                reap_finished_workers(&mut workers, &mut first_error);
+            }
+            let (reported, observation) = std::sync::mpsc::channel();
+            let finisher = thread::spawn(move || {
+                reported
+                    .send(finish_workers_in_accept_order(workers, first_error))
+                    .unwrap();
+            });
+
+            let result = observation.recv_timeout(Duration::from_secs(5));
+            // Release the later worker before assertions, including when a
+            // regression caused finalization to wait for it.
+            release.send(()).unwrap();
+            finisher.join().unwrap();
+            completion.recv_timeout(Duration::from_secs(5)).unwrap();
+            assert_eq!(
+                result.expect("finalization waited for a later active request"),
+                Err("first accepted failure".to_string()),
+                "reap_failure_first={reap_failure_first}"
+            );
+        }
+    }
+
+    #[test]
+    fn finite_shutdown_resolves_earlier_requests_before_a_reaped_failure() {
+        let (release_earlier, earlier_blocked) = std::sync::mpsc::channel();
+        let (release_later, later_blocked) = std::sync::mpsc::channel();
+        let (completed, completion) = std::sync::mpsc::channel();
+        let earlier_completed = completed.clone();
+        let earlier = thread::spawn(move || {
+            earlier_blocked.recv().map_err(|error| error.to_string())?;
+            earlier_completed.send(()).unwrap();
+            Err("earlier accepted failure".to_string())
+        });
+        let later = thread::spawn(move || {
+            later_blocked.recv().map_err(|error| error.to_string())?;
+            completed.send(()).unwrap();
+            Ok(())
+        });
+        let (reported, observation) = std::sync::mpsc::channel();
+        let finisher = thread::spawn(move || {
+            reported
+                .send(finish_workers_in_accept_order(
+                    vec![(3, later), (1, earlier)],
+                    Some((2, "already reaped failure".to_string())),
+                ))
+                .unwrap();
+        });
+
+        let premature = observation.recv_timeout(Duration::from_millis(20));
+        let returned_before_earlier_finished = premature.is_ok();
+        release_earlier.send(()).unwrap();
+        let result = match premature {
+            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {
+                observation.recv_timeout(Duration::from_secs(5))
+            }
+            other => other,
+        };
+        // Finalization must resolve session 1, but must not wait for session 3.
+        release_later.send(()).unwrap();
+        finisher.join().unwrap();
+        completion.recv_timeout(Duration::from_secs(5)).unwrap();
+        completion.recv_timeout(Duration::from_secs(5)).unwrap();
+        assert!(!returned_before_earlier_finished);
+        assert_eq!(
+            result.expect("finalization waited for a later active request"),
+            Err("earlier accepted failure".to_string())
+        );
+    }
+
+    #[test]
+    fn finite_shutdown_joins_active_requests_when_none_has_failed() {
+        let (release, blocked) = std::sync::mpsc::channel();
+        let (completed, completion) = std::sync::mpsc::channel();
+        let active = thread::spawn(move || {
+            blocked.recv().map_err(|error| error.to_string())?;
+            completed.send(()).unwrap();
+            Ok(())
+        });
+        let (reported, observation) = std::sync::mpsc::channel();
+        let finisher = thread::spawn(move || {
+            reported
+                .send(finish_workers_in_accept_order(vec![(1, active)], None))
+                .unwrap();
+        });
+
+        let premature = observation.recv_timeout(Duration::from_millis(20));
+        let returned_before_request_finished = premature.is_ok();
+        release.send(()).unwrap();
+        finisher.join().unwrap();
+        completion.recv_timeout(Duration::from_secs(5)).unwrap();
+        let result = match premature {
+            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => {
+                observation.recv_timeout(Duration::from_secs(5))
+            }
+            other => other,
+        };
+        assert!(!returned_before_request_finished);
+        assert_eq!(result.expect("finalization did not report success"), Ok(()));
+    }
+
+    #[test]
+    fn reaped_worker_panics_preserve_bridge_error() {
+        let panicked = thread::spawn(|| panic!("test worker panic"));
+        wait_until_finished(&panicked);
+        let mut workers = vec![(1, panicked)];
+        let mut first_error = None;
+        reap_finished_workers(&mut workers, &mut first_error);
+        assert!(workers.is_empty());
+        assert_eq!(
+            first_error,
+            Some((1, "browser VM guest control bridge worker panicked".into()))
+        );
+    }
+
     fn config(transport: HostListenConfig) -> BridgeConfig {
         BridgeConfig {
             schema: "elastos.browser.vm-guest-control-bridge.config/v1".to_string(),
diff --git a/justfile b/justfile
index b219d847f..5542fe957 100644
--- a/justfile
+++ b/justfile
@@ -216,6 +216,14 @@ product-ui-source:
     node scripts/chat-room-product-behavior-smoke.mjs
     node --test scripts/chat-room-reconnect.test.mjs
 
+# Library behavior, large-folder responsiveness and concurrent uploads.
+# Browser setup and explicit overrides are documented in scripts/README.md.
+library-regression:
+    node --test scripts/library-state.test.mjs capsules/library/browser/src/*.test.mjs
+    node scripts/library-product-behavior-smoke.mjs
+    node scripts/library-performance-smoke.mjs
+    node scripts/library-menu-smoke.mjs
+
 product-ui-browser:
     node scripts/people-product-layout-smoke.mjs
     node scripts/inbox-product-layout-smoke.mjs
diff --git a/scripts/README.md b/scripts/README.md
index 07adecac0..e1717b5b4 100644
--- a/scripts/README.md
+++ b/scripts/README.md
@@ -45,6 +45,188 @@ tests, and the separate Browser local-exit checks. `just verify-release` adds
 browser-based UI source checks, local Carrier setup and Home front-door proofs.
 Publishing trust and signer verification are separate release gates.
 
+## From requirements to acceptance
+
+For each changed user journey, connect the brief or vision requirement to the
+current [principle](../PRINCIPLES.md) and capsule or provider contract. State the
+observable result, the failure that would violate it, and the existing check
+that exercises that boundary. Use current repository names and workflow when a
+historical brief refers to retired branches or status files. Keep this mapping
+and current evidence in the owning issue's
+[Acceptance record](../AGENTS.md#acceptance-record). Broader
+portability, distribution and host-support claims need their own evidence.
+
+Before selecting an implementation, refresh the relevant remote heads and read
+open pull requests. Check the configured fetch refspec: a fetch that updates only
+the release branch does not establish the state of other work. Compare the
+proposed behavior and exact changed paths with unmerged branches, including
+branches without a pull request. Extend the existing concern when appropriate;
+keep unrelated changes with their owners. Record the observed heads and refresh
+this comparison before publication. Published refs cannot establish the absence
+of unpublished work.
+
+Choose evidence by what the check actually runs:
+
+- Source and manifest checks such as `just product-data` and
+  `node scripts/check-elastos-bus-wit.mjs` enforce declared structure and
+  consistency. Source text matching establishes that the expected text exists.
+- Executed module, Component and browser fixtures establish behavior for the
+  tested inputs. `just bus-conformance` observes provider dispatch and audit;
+  `just library-regression` observes Library state, DOM order, responsiveness
+  and upload requests. Name the substituted provider or host boundary.
+- Installed acceptance exercises the complete journey through the candidate
+  Runtime and providers. Follow the [artifact-parity and installed-proof
+  requirements](../AGENTS.md#verification-gate), including restart, recovery and
+  human checks where required. Signed installation on another compatible node
+  is separate from starting a source Home. Browser engine and microVM claims
+  require a suitable target host and the existing Browser product proof.
+
+Assert results independently of the implementation being changed: expected
+object identities and bytes, actual provider calls, stored state, rendered
+controls and visible errors. For a regression, reproduce the broken behavior
+and show that its check fails before the fix and passes after it when practical.
+Include interrupted, concurrent or unavailable-service cases when those affect
+the journey. Exercise each changed pointer, keyboard, API or Home-message entry
+point through its shared operation; one working entry point proves only that
+path. A mock response or an internal success counter cannot by itself establish
+that the intended effect occurred.
+
+For performance, keep the workload and timing budget explicit, observe user
+input and intermediate frames, and compare measurements on the same host.
+Preserve rooted object identity, granted operations and truthful completion
+while improving responsiveness.
+Preserve runner exit status and confirm that the intended tests executed;
+report skipped and unrun target checks separately from passes. The Library
+browser performance and menu smokes run before the concurrent tests in
+`just test-behaviour`, its CI job and the local pre-push gate. Run
+`just test-behaviour-inputs` to install that suite's pinned browser inputs.
+`just library-regression` provides the focused Library gate; `just verify`
+remains a separate source gate.
+
+## Runtime contract regression checks
+
+Run `just bus-conformance` after changing the Component-to-Runtime operation
+path. It executes the checked-in Component fixture through request, grant,
+provider dispatch and audit, then checks that a grant for a different action
+cannot dispatch the operation. The command requires exactly one discovered test.
+
+For Component loading, run
+`cargo test --locked -p elastos-compute --lib component_load -- --nocapture`
+from `elastos/`. The real Component fixture checks that unrelated async work
+stays responsive, artifact errors are preserved, and stopping a loaded instance
+removes it. The cancellation test queues the compile job behind a held blocking
+worker and checks that the job retains its slot after the caller cancels.
+The blocked-worker test checks executor responsiveness. A paused-clock test
+checks that waiting for the compile slot stops after 30 seconds; an admitted
+blocking job retains its slot until it finishes. This checks loading, while Bus
+conformance checks Runtime dispatch.
+
+For request-store changes, run
+`cargo test --locked -p elastos-runtime` from `elastos/`. This covers the pending
+request and capability stores, including concurrent admission limits,
+expired-request recovery and retention of grants for user revocation. The
+32-record session share covers outstanding requests and retained live grants;
+one full session must leave room for another while global capacity remains.
+Verify that concurrent revocation keeps the epoch monotonic and that cleanup
+retains still-valid grants.
+
+For capacity reclamation, also run
+`cargo test --locked -p elastos-server --lib api::handlers::capability::tests::test_request_capacity_recovers -- --nocapture`
+from `elastos/`. Also run
+`cargo test --locked -p elastos-server --lib api::handlers::capability::tests::test_revoke_all_failure_returns_500_and_keeps_live_grants -- --nocapture`
+to check that a failed epoch write returns an error and leaves live grants
+unchanged. These regressions invoke the real Rust handlers directly with
+`State`, `Extension` and `Json`; HTTP routing, middleware and installed acceptance
+need separate evidence. Together these checks exercise Runtime ownership of
+effects as defined in [PRINCIPLES.md](../PRINCIPLES.md); they complement the source
+gate and installed acceptance checks rather than certifying every product journey.
+
+## Library regression checks
+
+Run `just library-regression` after changing Library sorting, listing caches,
+rendering, menus, keyboard input or uploads. It runs the focused state and action
+tests, the existing structure and dialog-copy smoke, and the browser performance
+and menu smokes. The browser fixtures serve the current Library and Home client
+modules with local provider responses; they do not establish installed Runtime
+or provider acceptance.
+
+Use Node 26 and the Playwright dependency pinned in
+`elastos/tools/browser-playwright-engine/package.json`, with its installed
+Chromium browser. An existing Playwright module and Chromium-compatible browser
+can be selected explicitly:
+
+```bash
+ELASTOS_PLAYWRIGHT_MODULE=/absolute/path/to/playwright/index.mjs \
+BRAVE_BIN=/absolute/path/to/chromium just library-regression
+```
+
+Missing modules or browsers fail the check. The browser smoke exercises a
+shuffled folder of 5,000 files and directories, cached navigation, name and size
+sorting, search, updated listing facts, and overlapping uploads while changing
+folders. Navigation to an uncached folder must clear the previous folder's rows
+while waiting, explain how to retry a failed listing and preserve a newer
+navigation when an old response arrives. Refreshing the same folder keeps its
+current rows until a successful response. The smoke checks that sorting yields
+intermediate frames, reports first-paint and completion times, and rejects
+unexpected console and request errors.
+The existing 750 ms first-paint budget and a 5 s completion budget allow ordinary
+test-host variation; use the reported times to compare changes on the same host.
+
+The menu smoke uses browser keyboard input to check one Tab entry and exit,
+list and grid navigation, range and toggle selection, focused-item operations,
+rename input, menu focus return and folder/back navigation. It observes the
+requested object URI as well as the visible result.
+
+## Browser interaction and control-bridge regressions
+
+Browser observation changes must preserve the selected page's Runtime ownership
+while retiring stopped polling and refresh runs. Exercise delayed success,
+transport failure, authority renewal and terminal failure after both stop and
+restart, including a restart that retains the same page. A retired request must
+not change the current view or start another observation loop. A current request
+must retain the existing authority and cleanup behavior.
+
+```bash
+node --test capsules/browser/browser/*.test.mjs scripts/browser-observation-recovery.test.mjs scripts/browser-viewer-restore.test.mjs scripts/browser-window-close-handshake.test.mjs scripts/browser-input-ordering.test.mjs
+node scripts/browser-window-close-headless-smoke.mjs
+node scripts/home-browser-restored-lifecycle-headless-smoke.mjs
+```
+
+The Node checks execute modules or actual functions with controlled responses.
+The headless checks exercise Home and Browser in Chromium with fixture APIs and
+a substituted peer connection. They establish viewer lifecycle behavior, not
+actual Engine media or installed VM acceptance. The headless scripts support
+`ELASTOS_PLAYWRIGHT_MODULE`; their explicit browser overrides are
+`ELASTOS_BROWSER_CLOSE_CHROMIUM_EXECUTABLE` and `ELASTOS_BROWSER_EXECUTABLE`,
+respectively.
+
+For input batching, verify event ordering, page ownership and bounded pending
+work. Measure encoded movement through the selected Engine protocol as well as
+raw input totals: an encoder that rounds every batch can change the distance
+when batch frequency changes. Preserve discrete actions and make uncertain
+delivery explicit.
+
+The VM guest control bridge is a separate Cargo workspace. Run its lifecycle
+tests and process-level forwarding smoke after changing request-worker handling:
+
+```bash
+cargo test --locked --manifest-path elastos/tools/browser-vm-guest-control-bridge/Cargo.toml
+cargo clippy --locked --manifest-path elastos/tools/browser-vm-guest-control-bridge/Cargo.toml --all-targets -- -D warnings
+scripts/browser-vm-guest-control-bridge-smoke.sh
+```
+
+Completed worker handles are reclaimed when another connection is accepted.
+Finite runs join all remaining workers when every request succeeds. On failure,
+they resolve earlier accepted sessions and report the earliest failed session
+without waiting for later workers. Returning a worker error does not roll back
+effects already dispatched. Test that active requests remain independent and
+that worker failures retain their acceptance order. Repeated
+successful requests can measure completed-history retention separately from
+simultaneous active-request capacity. The Unix-socket smoke exercises a real
+bridge process against a local control-service fixture without requiring KVM.
+Target VM transport, WebRTC media and manual usability remain the separate
+[Browser acceptance gates](../docs/BROWSER_ACCEPTANCE.md).
+
 ## Local pre-push gate
 
 Commit the candidate, then run `just ci-local-prepush`. Resolve the source and
diff --git a/scripts/ci-release-policy-test.py b/scripts/ci-release-policy-test.py
index a576b012e..c40002ec9 100644
--- a/scripts/ci-release-policy-test.py
+++ b/scripts/ci-release-policy-test.py
@@ -1643,6 +1643,37 @@ def test_restored_inputs_are_verified_before_use(self):
             with self.subTest(mutation=name), self.assertRaises(AssertionError):
                 validate_restores_are_verified(changed)
 
+    def test_guest_control_bridge_runs_its_own_workspace_checks(self):
+        def check(source):
+            workflow_jobs = jobs(source)
+            name = "test-browser-guest-control-bridge"
+            job = workflow_jobs[name]
+            self.assertEqual(field(job, "needs"), "source-gate")
+            self.assertEqual(field(job, "working-directory"),
+                             "elastos/tools/browser-vm-guest-control-bridge")
+            job_steps = steps(name, workflow_jobs)
+            checkout, = [step for step in job_steps if "uses: actions/checkout@" in step]
+            self.assertEqual(field(checkout, "ref"),
+                             "${{ github.event_name == 'workflow_dispatch' && inputs.ref || github.sha }}")
+            self.assertEqual(field(checkout, "persist-credentials"), "false")
+            toolchain, = [step for step in job_steps if "uses: dtolnay/rust-toolchain@" in step]
+            self.assertEqual(field(toolchain, "components"), "rustfmt, clippy")
+            commands = [field(step, "run") for step in job_steps
+                        if re.search(r"(?m)^\s+run:", step)]
+            self.assertEqual(commands, ["cargo fmt -- --check",
+                                       "cargo clippy --locked --all-targets -- -D warnings",
+                                       "cargo test --locked"])
+            self.assertNotRegex(job, r"(?m)^\s+(?:if|continue-on-error):")
+
+        check(SOURCE)
+        for command in ("cargo fmt -- --check",
+                        "cargo clippy --locked --all-targets -- -D warnings",
+                        "cargo test --locked"):
+            changed = SOURCE.replace(f"        run: {command}\n", "        run: true\n", 1)
+            self.assertNotEqual(changed, SOURCE)
+            with self.subTest(removed=command), self.assertRaises(AssertionError):
+                check(changed)
+
     def test_github_runners_and_check_names_stay_fixed(self):
         expected = {
             "source-gate": ("source-gate", "ubuntu-24.04"),
@@ -1650,6 +1681,7 @@ def test_github_runners_and_check_names_stay_fixed(self):
             "engine-llama-amd64": ("engine-llama-amd64", "ubuntu-24.04"),
             "lint": ("lint", "ubuntu-24.04"),
             "test-elastos": ("test-elastos", "ubuntu-24.04"),
+            "test-browser-guest-control-bridge": ("test-browser-guest-control-bridge", "ubuntu-24.04"),
             "test-behaviour": ("test-behaviour", "ubuntu-24.04"),
             "test-capsules": ("test-capsules", "ubuntu-24.04"),
             "custody-harness-smoke": ("custody-harness-smoke", "ubuntu-24.04"),
diff --git a/scripts/home-navigation-consumers-smoke.mjs b/scripts/home-navigation-consumers-smoke.mjs
index 2819cdde6..671006a82 100644
--- a/scripts/home-navigation-consumers-smoke.mjs
+++ b/scripts/home-navigation-consumers-smoke.mjs
@@ -3,6 +3,8 @@ import { readFileSync } from "node:fs";
 import vm from "node:vm";
 import { webcrypto } from "node:crypto";
 import { createHomeNavigationClient } from "../capsules/home/browser/home-navigation-client.js";
+import { createLibraryFolders } from "../capsules/library/browser/src/folders.js";
+import { setLibraryObjects } from "../capsules/library/browser/src/state.js";
 
 export function navigationClientFixture({ homeToken, homeOrigin, parent, top, enabled = true }) {
   const listeners = new Map();
@@ -28,15 +30,18 @@ export async function exerciseNavigationConsumers(makeClient) {
     const transport = makeClient?.(target);
     return { setQuery(query) { reports[target] = JSON.parse(JSON.stringify(query)); transport?.setQuery(query); } };
   };
-  const library = vm.createContext({
+  const library = {
     state: { currentUri: "localhost://Users/fixture/Documents/B", loadSeq: 0, mode: "browse",
-      folderCache: new Map(), selectedUris: new Set(), objects: [] }, perf: {},
+      folderCache: new Map(), selectedUris: new Set(), objects: [], objectsVersion: 0 }, perf: {},
     homeNavigation: client("library"),
     providerApi: async (_op, { uri }) => ({ object: { uri, kind: "directory" }, objects: [] }),
-    cacheFolderListing: () => ({}), setObjects() {}, setStatus() {}, setFolderStatus() {}, renderAll() {}, runInitialObjectAction() {},
-    isDirectory: object => object?.kind === "directory",
-  });
-  vm.runInContext(selectionFunction(read("capsules/library/browser/src/app.js"), "loadCurrentFolder"), library);
+    setStatus() {}, setFolderStatus() {}, renderAll() {}, runInitialObjectAction() {},
+  };
+  Object.assign(library, createLibraryFolders({
+    ...library,
+    providerApi: (...args) => library.providerApi(...args),
+    setObjects: (objects) => setLibraryObjects(library.state, objects),
+  }));
   await library.loadCurrentFolder();
   assert.deepEqual(reports.library, { uri: library.state.currentUri });
   const folderB = library.state.currentUri;
diff --git a/scripts/library-menu-smoke.mjs b/scripts/library-menu-smoke.mjs
index e6dcf000a..c6a1285a2 100644
--- a/scripts/library-menu-smoke.mjs
+++ b/scripts/library-menu-smoke.mjs
@@ -291,6 +291,7 @@ const localVideoFile = object(`${documentsUri}/Clip.mp4`, "Clip.mp4", "file", [
   "move",
   "copy",
   "publish",
+  "protect",
   "trash",
   "properties",
 ], {
@@ -1813,6 +1814,216 @@ function excludesAll(actual, forbidden, context) {
   }
 }
 
+async function assertKeyboardJourney(page) {
+  const content = page.locator("#content");
+  const rows = page.locator("#content .item");
+  const selected = page.locator('#content .item[aria-selected="true"]');
+  const focusedUri = () => page.evaluate(() => document.activeElement?.dataset.uri || "");
+  const rowUri = (index) => rows.nth(index).getAttribute("data-uri");
+  assert(await content.getAttribute("role") === "listbox", "Library items must expose a selectable collection");
+  assert(await content.getAttribute("aria-multiselectable") === "true", "Library must expose multiple selection");
+  assert(await rows.first().getAttribute("role") === "option", "Library rows must expose selectable item semantics");
+  const initialTabOrder = await rows.evaluateAll((items) => ({
+    rowFocused: items.some((item) => item.contains(document.activeElement)),
+    contentTabIndex: document.getElementById("content").tabIndex,
+    tabStops: items.filter((item) => item.tabIndex >= 0)
+      .map((item) => ({ uri: item.dataset.uri, tabIndex: item.tabIndex })),
+  }));
+  assert(!initialTabOrder.rowFocused, "Initial Tab order must be checked before a Library row receives focus");
+  assert(initialTabOrder.contentTabIndex === -1 && initialTabOrder.tabStops.length === 1
+    && initialTabOrder.tabStops[0].uri === await rowUri(0) && initialTabOrder.tabStops[0].tabIndex === 0,
+  "The first Library row must be the only initial sequential tab stop before focus can repair it");
+  await page.locator("#more-button").focus();
+  await page.keyboard.press("Tab");
+  assert(await focusedUri() === await rowUri(0), "Tab must enter Library at its current item");
+  assert(await page.locator('#content .item[tabindex="0"]').count() === 1, "Library must have one item in the Tab order");
+  await page.keyboard.press("ArrowDown");
+  assert(await focusedUri() === await rowUri(1), "ArrowDown must focus the next details row");
+  assert(await selected.count() === 1 && await selected.first().getAttribute("data-uri") === await rowUri(1),
+    "ArrowDown must select the focused row");
+  await page.keyboard.press("Shift+ArrowDown");
+  assert(await selected.count() === 2, "Shift+ArrowDown must extend the visible selection");
+  await page.keyboard.press("Shift+ArrowUp");
+  assert(await selected.count() === 1, "Shift+ArrowUp must shrink the selection toward its anchor");
+  await page.keyboard.press(`${multiSelectModifier}+End`);
+  assert(await focusedUri() === await rows.last().getAttribute("data-uri") && await selected.count() === 1,
+    "Modified End must move focus while keeping the selection");
+  await page.keyboard.press("Space");
+  assert(await selected.count() === 2, "Space must add the focused row to the selection");
+  await page.keyboard.press("Space");
+  assert(await selected.count() === 1, "Space must remove the focused row from the selection");
+  await page.keyboard.press("Home");
+  assert(await focusedUri() === await rowUri(0) && await selected.count() === 1, "Home must focus and select the first row");
+
+  const readme = rows.filter({ hasText: "Readme.md" }).first();
+  const published = rows.filter({ hasText: "Published.md" }).first();
+  await readme.click();
+  await published.focus();
+  const readsBefore = ops.filter((entry) => entry.op === "read").length;
+  await page.keyboard.press("Enter");
+  await page.locator(".dialog-card").filter({ hasText: "Readme.md" }).first().waitFor();
+  assert(ops.filter((entry) => entry.op === "read").length === readsBefore + 1
+    && ops.filter((entry) => entry.op === "read").at(-1).payload.uri === `${documentsUri}/Readme.md`,
+    "Enter must open the selected item when a different item has focus");
+  await page.keyboard.press("Escape");
+  await published.click();
+  await readme.focus();
+  await page.keyboard.press("F2");
+  const editor = page.locator(".rename-input");
+  await editor.waitFor();
+  assert(await editor.inputValue() === "Published.md", "F2 must rename the selected item when a different item has focus");
+  await page.keyboard.press(`${multiSelectModifier}+a`);
+  assert(await selected.count() === 1, "Select all inside the name editor must keep item selection unchanged");
+  await page.keyboard.press("ArrowLeft");
+  assert(await editor.evaluate((input) => document.activeElement === input), "Arrow keys must remain in the name editor");
+  await page.keyboard.press("Escape");
+  assert(await focusedUri() === `${documentsUri}/Published.md`, "Cancel rename must return focus to its item");
+  await readme.click();
+  await published.focus();
+  await page.keyboard.press("Shift+F10");
+  assert(await page.evaluate(() => document.activeElement?.matches("#context-menu .menu-item")),
+    "The keyboard context menu must focus its first action");
+  assert(await selected.count() === 1 && await selected.first().getAttribute("data-uri") === `${documentsUri}/Readme.md`,
+    "The keyboard context menu must preserve the selected item when another item has focus");
+  await page.keyboard.press("Escape");
+  assert(await focusedUri() === `${documentsUri}/Published.md`, "Escape from a keyboard menu must return focus to its owner");
+  await readme.click();
+  await published.focus();
+  await page.keyboard.press("Shift+F10");
+  await page.keyboard.press("Enter");
+  await page.locator(".dialog-card").filter({ hasText: "Readme.md" }).first().waitFor();
+  await page.keyboard.press("Escape");
+  assert(await focusedUri() === `${documentsUri}/Published.md`, "Keyboard menu Open must preserve the menu owner's focus target");
+
+  await page.locator("#grid-button").click();
+  await rows.first().focus();
+  const columnCount = await rows.evaluateAll((items) => {
+    const nextRow = items.findIndex((item) => item.offsetTop > items[0].offsetTop);
+    return nextRow < 0 ? items.length : nextRow;
+  });
+  assert(columnCount > 1 && columnCount < await rows.count(), "Keyboard grid fixture must contain multiple columns and rows");
+  await page.keyboard.press("ArrowRight");
+  assert(await focusedUri() === await rowUri(1), "ArrowRight must focus the next icon");
+  await page.keyboard.press("ArrowDown");
+  assert(await focusedUri() === await rowUri(1 + columnCount), "ArrowDown must focus the icon in the next row");
+  await page.keyboard.press("ArrowUp");
+  assert(await focusedUri() === await rowUri(1), "ArrowUp must return to the previous icon row");
+  await page.keyboard.press("ArrowLeft");
+  assert(await focusedUri() === await rowUri(0), "ArrowLeft must focus the previous icon");
+  await page.locator("#list-button").click();
+  const projects = rows.filter({ hasText: "Projects" }).first();
+  await projects.click();
+  await page.keyboard.press("Enter");
+  await page.locator(".crumb-current").filter({ hasText: "Projects" }).first().waitFor();
+  await page.locator("#back-button").focus();
+  await page.keyboard.press("Enter");
+  await page.locator(".crumb-current").filter({ hasText: "Documents" }).first().waitFor();
+  await page.locator("#more-button").focus();
+  await page.keyboard.press("Tab");
+  assert(await focusedUri() !== "", "Tab must re-enter Library after returning from a folder");
+  await page.keyboard.press("Tab");
+  assert(await focusedUri() === "", "One Tab must leave the item collection");
+  await page.keyboard.press("Escape");
+}
+
+async function assertDeselectDeleteJourney(context, port) {
+  const selectedName = "Keyboard selected.md";
+  const deselectedName = "Keyboard deselected.md";
+  const selectedUri = `${documentsUri}/${selectedName}`;
+  const deselectedUri = `${documentsUri}/${deselectedName}`;
+  putObject(documentsUri, createFileObject(selectedUri, selectedName));
+  putObject(documentsUri, createFileObject(deselectedUri, deselectedName));
+  const page = await context.newPage();
+  try {
+    await page.goto(`http://127.0.0.1:${port}/apps/library/#home_token=${encodeURIComponent(token)}`);
+    const selected = page.locator(`#content .item[data-uri="${selectedUri}"]`);
+    const deselected = page.locator(`#content .item[data-uri="${deselectedUri}"]`);
+    await selected.click();
+    await deselected.click({ modifiers: [multiSelectModifier] });
+    assert(await page.locator('#content .item[aria-selected="true"]').count() === 2,
+      "Modified click must add the second item to the selection");
+    await deselected.click({ modifiers: [multiSelectModifier] });
+    assert(await deselected.evaluate((item) => document.activeElement === item),
+      "The deselected item must retain focus for this regression");
+    assert(await selected.getAttribute("aria-selected") === "true" && await deselected.getAttribute("aria-selected") === "false",
+      "Modified click must remove only the focused item from the selection");
+    const before = ops.length;
+    await page.keyboard.press("Delete");
+    await waitForOp((entry) => entry.op === "trash" && entry.payload.uri === selectedUri,
+      "Delete after deselection must trash the remaining selected item");
+    await selected.waitFor({ state: "detached" });
+    const trashed = ops.slice(before).filter((entry) => entry.op === "trash").map((entry) => entry.payload.uri);
+    assert(trashed.length === 1 && trashed[0] === selectedUri,
+      "Delete must dispatch exactly the selected item to Trash");
+    assert(await deselected.count() === 1 && findObject(deselectedUri)?.uri === deselectedUri,
+      "Delete must preserve the focused item that the user deselected");
+  } finally {
+    await page.close();
+    for (const name of [selectedName, deselectedName]) {
+      removeObject(`${documentsUri}/${name}`);
+      removeObject(`${principalRoot}/.Trash/${name}`);
+    }
+  }
+}
+
+async function assertEmptyWebspaceReadiness(context, port) {
+  for (const readonly of [false, true]) {
+    const page = await context.newPage();
+    let releaseList;
+    const held = new Promise((resolve) => { releaseList = resolve; });
+    const folderObject = {
+      ...webspaceMutable,
+      capabilities: readonly ? ["open", "list", "properties"] : webspaceMutable.capabilities,
+      metadata: { ...webspaceMutable.metadata, readonly, access_policy: readonly ? "read-only" : "owner-writable" },
+    };
+    try {
+      await page.route("**/api/provider/object/list", async (route) => {
+        if (route.request().postDataJSON()?.uri !== webspaceMutableUri) {
+          return route.continue();
+        }
+        await held;
+        await route.fulfill({
+          status: 200,
+          contentType: "application/json",
+          body: ok({ objects: [], object: folderObject }),
+        });
+      });
+      await page.goto(`http://127.0.0.1:${port}/apps/library/#home_token=${encodeURIComponent(token)}`);
+      await page.locator(".item").filter({ hasText: "Readme.md" }).first().waitFor();
+      await page.locator(".place").filter({ hasText: "Spaces" }).first().click();
+      await Promise.all([
+        page.waitForRequest((request) =>
+          new URL(request.url()).pathname === "/api/provider/object/list"
+          && request.postDataJSON()?.uri === webspaceMutableUri, { timeout: 30_000 }),
+        page.locator(".item").filter({ hasText: "Mutable" }).first().dblclick(),
+      ]);
+      await page.locator(".crumb-current").filter({ hasText: "Mutable" }).first().waitFor();
+      await page.locator("#content .empty h2").getByText("Loading folder...", { exact: true }).waitFor();
+      const loadedEmptyState = page.locator("#content .empty h2").getByText("This space is empty", { exact: true });
+      assert(await loadedEmptyState.count() === 0, "The completed empty-folder state must wait for the provider listing");
+      excludesAll(await openBackgroundMenu(page), ["New", "Upload Here", "Paste"], "WebSpace menu while its metadata is pending");
+      const responded = page.waitForResponse((response) =>
+        new URL(response.url()).pathname === "/api/provider/object/list"
+        && response.request().postDataJSON()?.uri === webspaceMutableUri);
+      releaseList();
+      assert((await responded).ok(), "Empty WebSpace listing must succeed");
+      await loadedEmptyState.waitFor();
+      const rows = await openBackgroundMenu(page);
+      includesAll(rows, ["Sort By", "Refresh", "Properties"], "completed empty WebSpace menu");
+      if (readonly) {
+        excludesAll(rows, ["New", "Upload Here", "Paste"], "completed read-only empty WebSpace menu");
+      } else {
+        includesAll(rows, ["New", "Upload Here"], "completed mutable empty WebSpace menu");
+        excludesAll(rows, ["Paste"], "completed mutable empty WebSpace menu");
+      }
+    } finally {
+      releaseList();
+      await page.unrouteAll({ behavior: "wait" });
+      await page.close();
+    }
+  }
+}
+
 async function run() {
   const server = createServer();
   await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
@@ -1877,6 +2088,10 @@ async function run() {
       );
     }
 
+    await assertEmptyWebspaceReadiness(context, port);
+    await assertDeselectDeleteJourney(context, port);
+    await assertKeyboardJourney(page);
+
     for (const label of ["Home", "Desktop", "Documents", "Pictures", "Videos", "Downloads", "Public", "Trash", "Spaces"]) {
       await page.locator(".place").filter({ hasText: label }).first().click();
       await page.locator(".crumb-current").filter({ hasText: label }).first().waitFor();
@@ -2327,6 +2542,8 @@ async function run() {
     await page.locator(".place").filter({ hasText: "Spaces" }).first().click();
     await page.locator(".item").filter({ hasText: "Mutable" }).first().dblclick();
     await page.locator(".crumb-current").filter({ hasText: "Mutable" }).first().waitFor();
+    // The route changes before the provider returns this folder's metadata.
+    await page.locator("#content .empty h2").getByText("This space is empty", { exact: true }).waitFor();
     const mutableBackgroundRows = await openBackgroundMenu(page);
     includesAll(mutableBackgroundRows, ["New", "Upload Here", "Properties"], "mutable WebSpace background menu");
     excludesAll(mutableBackgroundRows, ["Paste"], "mutable WebSpace background menu");
@@ -2451,6 +2668,10 @@ async function run() {
     await clickMenu(page, "Copy");
     await openItemMenu(page, "Work");
     await clickMenu(page, "Paste Into Folder");
+    await waitForOp(
+      (entry) => entry.op === "copy" && entry.payload.uri === `${documentsUri}/Guide.md` && entry.payload.target_parent_uri === `${documentsUri}/Work`,
+      "Copy/Paste Into Folder must dispatch the intended source and destination",
+    );
     assert(
       ops.some((entry) => entry.op === "copy" && entry.payload.target_parent_uri.endsWith("/Work")),
       "Copy/Paste Into Folder must call copy with the destination folder",
@@ -2477,6 +2698,10 @@ async function run() {
     await page.locator(".item").filter({ hasText: "Upload.txt" }).first().click();
     await dropSelectionOnFolder(page, "Work", { copy: true });
     await page.locator(".item").filter({ hasText: "Upload.txt" }).first().waitFor();
+    await waitForOp(
+      (entry) => entry.op === "copy" && entry.payload.uri === `${documentsUri}/Upload.txt` && entry.payload.target_parent_uri === `${documentsUri}/Work`,
+      "Alt-drag/drop copy must dispatch the intended source and destination",
+    );
     assert(
       ops.some((entry) => entry.op === "copy" && entry.payload.uri.endsWith("/Upload.txt") && entry.payload.target_parent_uri.endsWith("/Work")),
       "Alt-drag/drop copy must call copy with the destination folder",
diff --git a/scripts/library-performance-smoke.mjs b/scripts/library-performance-smoke.mjs
index cf14f88f2..a464cb9fc 100644
--- a/scripts/library-performance-smoke.mjs
+++ b/scripts/library-performance-smoke.mjs
@@ -4,9 +4,12 @@ import { stat } from "node:fs/promises";
 import { createServer } from "node:http";
 import { createRequire } from "node:module";
 import path from "node:path";
+import { pathToFileURL } from "node:url";
 
-const require = createRequire(new URL("../elastos/tools/browser-playwright-engine/package.json", import.meta.url));
-const { chromium } = require("playwright");
+const playwrightModule = process.env.ELASTOS_PLAYWRIGHT_MODULE
+  ? await import(pathToFileURL(process.env.ELASTOS_PLAYWRIGHT_MODULE).href)
+  : createRequire(new URL("../elastos/tools/browser-playwright-engine/package.json", import.meta.url))("playwright");
+const { chromium } = playwrightModule.chromium ? playwrightModule : playwrightModule.default;
 
 const capsuleRoot = path.resolve("capsules/library/browser");
 const homeClipboardClientPath = path.resolve(
@@ -15,6 +18,7 @@ const homeClipboardClientPath = path.resolve(
 const homeClipboardProtocolPath = path.resolve(
   "capsules/home/browser/home-clipboard-protocol.js",
 );
+const homeNavigationClientPath = path.resolve("capsules/home/browser/home-navigation-client.js");
 const token = "library-performance-smoke-token";
 const principalRoot = "localhost://Users/perf";
 const documentsUri = `${principalRoot}/Documents`;
@@ -53,11 +57,19 @@ const roots = [
   { schema: "elastos.library.root/v1", id: "webspaces", label: "Spaces", uri: "localhost://WebSpaces", kind: "webspace-root" },
 ];
 
-const documents = Array.from({ length: 1000 }, (_, index) => {
+const objectCount = 5_000;
+const documents = Array.from({ length: objectCount }, (_, index) => {
   const number = String(index + 1).padStart(4, "0");
-  return object(`${documentsUri}/File-${number}.txt`, `File-${number}.txt`, "file", index);
+  const kind = index % 25 === 24 ? "directory" : "file";
+  const name = kind === "directory" ? `Folder-${number}` : `File-${number}.txt`;
+  return object(`${documentsUri}/${name}`, name, kind, index);
 });
+// A repeatable permutation exercises comparison work instead of an already sorted folder.
+const listedDocuments = documents.map((_, index) => documents[(index * 7919) % objectCount]);
 const writePayloads = [];
+const pendingUploads = new Map();
+const uploadWaiters = new Map();
+let holdUploads = false;
 
 function contentType(filePath) {
   if (filePath.endsWith(".html")) return "text/html; charset=utf-8";
@@ -70,6 +82,11 @@ function contentType(filePath) {
 function createAppServer() {
   return createServer(async (req, res) => {
     const url = new URL(req.url || "/", "http://127.0.0.1");
+    if (url.pathname === "/favicon.ico") {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
     if (url.pathname === "/api/provider/object/events/stream") {
       res.writeHead(200, {
         "content-type": "text/event-stream",
@@ -91,14 +108,22 @@ function createAppServer() {
           contentType: req.headers["content-type"] || "",
         };
         writePayloads.push(payload);
-        res.writeHead(200, { "content-type": "application/json" });
-        res.end(JSON.stringify({
-          status: "ok",
-          data: {
-            transport: "raw-body",
-            object: object(uri, name, "file", writePayloads.length),
-          },
-        }));
+        const finish = () => {
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(JSON.stringify({
+            status: "ok",
+            data: {
+              transport: "raw-body",
+              object: object(uri, name, "file", writePayloads.length),
+            },
+          }));
+        };
+        if (holdUploads) {
+          pendingUploads.set(name, finish);
+          uploadWaiters.get(name)?.();
+        } else {
+          finish();
+        }
       });
       return;
     }
@@ -116,7 +141,7 @@ function createAppServer() {
           const uri = payload.uri || documentsUri;
           data = {
             uri,
-            objects: uri === documentsUri ? documents : [],
+            objects: uri === documentsUri ? listedDocuments : [],
           };
         } else if (op === "write") {
           writePayloads.push(payload);
@@ -132,6 +157,11 @@ function createAppServer() {
       return;
     }
 
+    if (url.pathname === "/apps/home/home-navigation-client.js") {
+      res.writeHead(200, { "content-type": "text/javascript; charset=utf-8" });
+      createReadStream(homeNavigationClientPath).pipe(res);
+      return;
+    }
     if (url.pathname === "/apps/home/home-clipboard-client.js") {
       res.writeHead(200, { "content-type": "text/javascript; charset=utf-8" });
       createReadStream(homeClipboardClientPath).pipe(res);
@@ -162,12 +192,153 @@ function createAppServer() {
   });
 }
 
+async function sortFolder(page, label) {
+  await page.keyboard.press("Escape");
+  await page.locator("#more-button").click();
+  const parent = page.locator("#context-menu > .menu-entry > .menu-item").filter({ hasText: "Sort By" });
+  await parent.click();
+  const button = parent.locator("xpath=..").locator(".menu-submenu .menu-item").filter({ hasText: label });
+  await button.evaluate((element) => {
+    element.addEventListener("click", () => {
+      const startedAt = performance.now();
+      const renderCount = window.__libraryPerf.contentRenderCount;
+      const probe = window.__librarySortProbe = { partialFrames: 0, firstPaintMs: null, completeMs: null };
+      const observe = () => {
+        const perf = window.__libraryPerf;
+        if (perf.contentRenderCount > renderCount) {
+          probe.firstPaintMs ??= performance.now() - startedAt;
+          if (perf.lastContentRender.complete) {
+            probe.completeMs = performance.now() - startedAt;
+            return;
+          }
+          probe.partialFrames += 1;
+        }
+        requestAnimationFrame(observe);
+      };
+      requestAnimationFrame(observe);
+    }, { once: true, capture: true });
+  });
+  await button.click();
+  await page.waitForFunction(() => window.__librarySortProbe?.completeMs !== null);
+  const result = await page.evaluate(() => ({ ...window.__librarySortProbe, ...window.__libraryPerf.lastContentRender }));
+  assert(result.objectCount === objectCount && await page.locator(".item").count() === objectCount,
+    `${label} sort must retain every object`);
+  assert(result.partialFrames > 0, `${label} sort must yield frames while the remaining rows render`);
+  assert(result.firstPaintMs < 750, `${label} sort first paint took ${result.firstPaintMs}ms`);
+  assert(result.completeMs < 5_000, `${label} sort completion took ${result.completeMs}ms`);
+  return { sort: label, ...result };
+}
+
+async function assertNameOrder(page, descending) {
+  const rows = await page.locator(".item").evaluateAll((items) => items.map((item) => ({
+    name: item.querySelector(".item-name").textContent,
+    kind: item.dataset.kind,
+  })));
+  const expected = ["directory", "file"].flatMap((kind) => {
+    const names = documents.filter((entry) => entry.kind === kind).map((entry) => entry.name).sort();
+    return descending ? names.reverse() : names;
+  });
+  assert(rows.every((row, index) => row.name === expected[index]),
+    `Name sort must keep directories first and names ${descending ? "descending" : "ascending"}`);
+}
+
+async function waitForUpload(name) {
+  if (pendingUploads.has(name)) return;
+  let timer;
+  try {
+    await new Promise((resolve, reject) => {
+      uploadWaiters.set(name, resolve);
+      timer = setTimeout(() => reject(new Error(`Upload fixture did not receive ${name}`)), 5_000);
+    });
+  } finally {
+    clearTimeout(timer);
+    uploadWaiters.delete(name);
+  }
+}
+
+function finishUpload(name) {
+  const finish = pendingUploads.get(name);
+  assert(finish, `Upload ${name} must be pending before it can complete`);
+  pendingUploads.delete(name);
+  finish();
+}
+
+async function assertFolderLoadRecovery(page) {
+  const firstFolder = documents.find((entry) => entry.kind === "directory");
+  const secondFolder = documents.find((entry) => entry.kind === "directory" && entry !== firstFolder);
+  const held = new Map();
+  const waiters = new Map();
+  const controlledUris = new Set([firstFolder.uri, secondFolder.uri]);
+  await page.route("**/api/provider/object/list", (route) => {
+    const uri = route.request().postDataJSON()?.uri;
+    if (!controlledUris.has(uri)) return route.continue();
+    held.set(uri, route);
+    waiters.get(uri)?.();
+  });
+  async function requestFor(uri) {
+    if (!held.has(uri)) {
+      let timer;
+      try {
+        await new Promise((resolve, reject) => {
+          waiters.set(uri, resolve);
+          timer = setTimeout(() => reject(new Error(`Folder request did not arrive: ${uri}`)), 5_000);
+        });
+      } finally {
+        clearTimeout(timer);
+        waiters.delete(uri);
+      }
+    }
+    const route = held.get(uri);
+    held.delete(uri);
+    return route;
+  }
+  const folderRow = (entry) => page.locator(`.item[data-uri="${entry.uri}"]`);
+  const respond = (route, envelope) => route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify(envelope) });
+
+  await page.locator(".place").filter({ hasText: "Documents" }).first().click();
+  await page.waitForFunction((count) => window.__libraryPerf.lastContentRender?.complete
+    && document.querySelectorAll(".item").length === count, objectCount);
+  await page.locator(".item").filter({ hasText: "File-0001.txt" }).first().click();
+  await folderRow(firstFolder).dblclick();
+  const failing = await requestFor(firstFolder.uri);
+  assert(await page.locator(".item").count() === 0, "A pending folder must clear rows from the previous folder");
+  await page.locator(".empty h2").filter({ hasText: "Loading folder..." }).waitFor();
+  assert(await page.locator("#footer-left").textContent() === "0 items", "Pending navigation must clear previous selection and count");
+  await respond(failing, { status: "error", message: "This folder is temporarily unavailable." });
+  await page.locator(".empty h2").filter({ hasText: "This folder could not be opened" }).waitFor();
+  assert(await page.locator(".item").count() === 0, "A failed folder must keep previous rows out of its view");
+  assert((await page.locator(".empty").textContent()).includes("Choose Refresh from More"),
+    "A failed folder must explain how to retry");
+
+  await page.locator("#more-button").click();
+  await page.locator("#context-menu .menu-item").filter({ hasText: /^Refresh$/ }).click();
+  const retry = await requestFor(firstFolder.uri);
+  await page.locator(".empty h2").filter({ hasText: "Loading folder..." }).waitFor();
+  const recovered = object(`${firstFolder.uri}/Recovered.txt`, "Recovered.txt");
+  await respond(retry, { status: "ok", data: { object: firstFolder, objects: [recovered] } });
+  await page.locator(".item").filter({ hasText: "Recovered.txt" }).waitFor();
+  assert(await page.locator(".item").count() === 1, "Refresh must recover the requested folder's items");
+
+  await page.locator("#back-button").click();
+  await folderRow(secondFolder).waitFor();
+  await folderRow(secondFolder).dblclick();
+  const obsolete = await requestFor(secondFolder.uri);
+  await page.locator(".place").filter({ hasText: "Desktop" }).first().click();
+  await page.locator(".crumb-current").filter({ hasText: "Desktop" }).waitFor();
+  await respond(obsolete, { status: "error", message: "The old folder is unavailable." });
+  await page.evaluate(() => new Promise((resolve) => requestAnimationFrame(() => requestAnimationFrame(resolve))));
+  assert(await page.locator("#status-text").textContent() === "", "An obsolete failure must leave the current folder's status unchanged");
+  assert(await page.locator(".crumb-current").textContent() === "Desktop", "An obsolete response must preserve the current folder");
+  assert(await page.locator(".item").count() === 0, "An obsolete response must preserve the current folder's rows");
+}
+
 async function run() {
   const server = createAppServer();
   await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
   const { port } = server.address();
-  const browser = await chromium.launch({ headless: true });
+  let browser;
   try {
+    browser = await chromium.launch({ headless: true, executablePath: process.env.BRAVE_BIN || undefined });
     const page = await browser.newPage();
     const pageErrors = [];
     const consoleErrors = [];
@@ -177,7 +348,7 @@ async function run() {
     });
     page.on("console", (message) => {
       if (message.type() === "error") {
-        consoleErrors.push(message.text());
+        consoleErrors.push({ message: message.text(), location: message.location() });
       }
     });
     page.on("requestfailed", (request) => {
@@ -194,6 +365,26 @@ async function run() {
         });
       }
     });
+    await page.addInitScript(() => {
+      const observer = new MutationObserver(() => {
+        const content = document.getElementById("content");
+        const first = content?.querySelector(".item");
+        if (!first || content.getAttribute("aria-busy") !== "true") return;
+        observer.disconnect();
+        const items = Array.from(content.querySelectorAll(".item"));
+        window.__libraryEarlyEnd = {
+          initialCount: items.length,
+          initialRowFocused: items.some((item) => item.contains(document.activeElement)),
+          initialContentTabIndex: content.tabIndex,
+          initialFirstUri: first.dataset.uri,
+          initialTabStops: items.filter((item) => item.tabIndex >= 0)
+            .map((item) => ({ uri: item.dataset.uri, tabIndex: item.tabIndex })),
+        };
+        first.focus();
+        first.dispatchEvent(new KeyboardEvent("keydown", { key: "End", bubbles: true, cancelable: true }));
+      });
+      observer.observe(document, { childList: true, subtree: true });
+    });
     await page.goto(
       `http://127.0.0.1:${port}/apps/library/#home_token=${encodeURIComponent(token)}`,
     );
@@ -212,24 +403,97 @@ async function run() {
     const initialPerf = await page.evaluate(() => window.__libraryPerf);
     assert(initialPerf?.iconFetchCount === 0, "Library must not fetch/hydrate SVG icons from JavaScript");
     assert(initialPerf?.renderPlacesCount === 1, "Library sidebar should render once on boot");
-    assert(initialPerf?.lastContentRender?.objectCount === 1000, "Library must render the full large folder");
+    assert(initialPerf?.lastContentRender?.objectCount === objectCount, "Library must render the full large folder");
     assert(initialPerf?.lastContentRender?.chunked === true, "Large folders should render in chunks for fast first paint");
-    assert(initialPerf?.lastContentRender?.initialRenderedCount < 1000, "Initial large-folder paint should not build every row synchronously");
+    assert(initialPerf?.lastContentRender?.initialRenderedCount < objectCount, "Initial large-folder paint should not build every row synchronously");
     assert(initialPerf?.lastContentRender?.durationMs < 750, `Large folder render too slow: ${initialPerf?.lastContentRender?.durationMs}ms`);
     assert(await page.locator("[data-icon-src], [data-icon-ready]").count() === 0, "Library DOM must not expose async icon hydration markers");
-    await page.locator(".item").filter({ hasText: "File-1000.txt" }).first().waitFor();
     await page.waitForFunction(() => window.__libraryPerf?.lastContentRender?.complete === true);
+    assert(await page.locator(".item").count() === objectCount, "Every object must finish rendering");
+    const expectedLastUri = documents.filter((entry) => entry.kind === "file")
+      .sort((left, right) => left.name.localeCompare(right.name)).at(-1).uri;
+    await page.waitForFunction((uri) => document.activeElement?.dataset.uri === uri, expectedLastUri);
+    const earlyEnd = await page.evaluate(() => ({
+      ...window.__libraryEarlyEnd,
+      focusedUri: document.activeElement?.dataset.uri,
+      lastUri: document.querySelector("#content .item:last-child")?.dataset.uri,
+      selected: Array.from(document.querySelectorAll('#content .item[aria-selected="true"]'), (item) => item.dataset.uri),
+      tabStops: Array.from(document.querySelectorAll('#content .item[tabindex="0"]'), (item) => item.dataset.uri),
+    }));
+    assert(earlyEnd.initialCount > 0 && earlyEnd.initialCount < objectCount,
+      "End must be pressed while only part of the folder has rendered");
+    assert(earlyEnd.initialRowFocused === false,
+      "Initial chunk Tab order must be captured before a Library row receives focus");
+    assert(earlyEnd.initialContentTabIndex === -1 && earlyEnd.initialTabStops.length === 1
+      && earlyEnd.initialTabStops[0].uri === earlyEnd.initialFirstUri && earlyEnd.initialTabStops[0].tabIndex === 0,
+    "The first rendered row must be the only initial sequential tab stop before focus can repair it");
+    assert(earlyEnd.focusedUri === expectedLastUri && earlyEnd.lastUri === expectedLastUri,
+      "End during rendering must focus the last object in the complete folder");
+    assert(earlyEnd.selected.length === 1 && earlyEnd.selected[0] === expectedLastUri,
+      "End must select the actual last object");
+    assert(earlyEnd.tabStops.length === 1 && earlyEnd.tabStops[0] === expectedLastUri,
+      "The last object must become the folder's single tab stop");
+
+    await page.locator("#content .item").nth(1_000).evaluate((item) => item.focus());
+    const refreshEnd = await page.evaluate(() => new Promise((resolve) => {
+      document.querySelector("#sort-select").dispatchEvent(new Event("change", { bubbles: true }));
+      requestAnimationFrame(() => {
+        const probe = {
+          busy: document.getElementById("content").getAttribute("aria-busy"),
+          focus: document.activeElement.id,
+          renderedCount: document.querySelectorAll("#content .item").length,
+        };
+        document.activeElement.dispatchEvent(new KeyboardEvent("keydown", { key: "End", bubbles: true, cancelable: true }));
+        resolve(probe);
+      });
+    }));
+    assert(refreshEnd.busy === "true" && refreshEnd.focus === "content" && refreshEnd.renderedCount < objectCount,
+      "Refresh End must start while the previously focused row is outside the rendered prefix");
+    await page.waitForFunction((uri) => window.__libraryPerf.lastContentRender.complete
+      && document.activeElement?.dataset.uri === uri, expectedLastUri);
+    assert(await page.locator("#content .item").count() === objectCount,
+      "End during refresh must retain the complete folder");
+    assert(await page.locator('#content .item[aria-selected="true"]').count() === 1
+      && await page.locator('#content .item[aria-selected="true"]').getAttribute("data-uri") === expectedLastUri,
+    "End during refresh must select the last object after focus restoration");
+    assert(await page.locator('#content .item[tabindex="0"]').count() === 1
+      && await page.locator('#content .item[tabindex="0"]').getAttribute("data-uri") === expectedLastUri,
+    "End during refresh must retain one tab stop on the last object");
 
     await page.waitForFunction(() => (window.__libraryPerf?.folderCacheSize || 0) >= 3);
     await page.locator(".place").filter({ hasText: "Desktop" }).first().click();
     await page.locator(".crumb-current").filter({ hasText: "Desktop" }).first().waitFor();
     await page.locator(".place").filter({ hasText: "Documents" }).first().click();
-    await page.locator(".item").filter({ hasText: "File-1000.txt" }).first().waitFor();
+    await page.waitForFunction((count) => window.__libraryPerf?.lastContentRender?.objectCount === count
+      && window.__libraryPerf.lastContentRender.complete === true, objectCount);
+    assert((await page.locator('.place:focus').textContent())?.trim() === "Documents",
+      "Completed End navigation must preserve later sidebar focus while a folder renders");
     const afterNavigation = await page.evaluate(() => window.__libraryPerf);
     assert(afterNavigation.renderPlacesCount === 1, "Folder navigation must not rebuild the sidebar");
     assert(afterNavigation.folderCacheHits >= 2, "Root navigation should render from prefetched folder cache");
     assert(afterNavigation.objectNodeCacheHits >= 1000, "Returning to a large folder should reuse existing item DOM nodes");
 
+    const sorts = [await sortFolder(page, "Descending")];
+    await assertNameOrder(page, true);
+    sorts.push(await sortFolder(page, "Size"));
+    const fileSizes = await page.locator('.item[data-kind="file"]').evaluateAll((items) =>
+      items.map((item) => Number(item.dataset.uri.match(/File-(\d+)/)[1])));
+    assert(fileSizes.every((size, index) => index === 0 || fileSizes[index - 1] > size),
+      "Descending size sort must order every file by size");
+    sorts.push(await sortFolder(page, "Name"));
+    sorts.push(await sortFolder(page, "Ascending"));
+    await assertNameOrder(page, false);
+
+    await page.locator("#search-toggle-button").click();
+    await page.locator("#search").fill("File-04");
+    const matchingCount = documents.filter((entry) => entry.name.includes("File-04")).length;
+    await page.waitForFunction((count) => window.__libraryPerf?.lastContentRender?.objectCount === count,
+      matchingCount);
+    assert(await page.locator(".item").count() === matchingCount, "Search must show every matching object");
+    await page.locator("#search").fill("");
+    await page.waitForFunction((count) => window.__libraryPerf?.lastContentRender?.objectCount === count
+      && window.__libraryPerf.lastContentRender.complete === true, objectCount);
+
     await page.locator(".item").filter({ hasText: "File-0001.txt" }).first().click({ button: "right" });
     await page.locator("#context-menu button").filter({ hasText: "Open" }).first().waitFor();
     const afterMenu = await page.evaluate(() => window.__libraryPerf);
@@ -260,8 +524,56 @@ async function run() {
       uploadRenderDelta <= uploadScheduledDelta + 3,
       `Upload progress rendered too often: ${uploadRenderDelta} renders for ${uploadScheduledDelta} scheduled frames`,
     );
+
+    // A refreshed listing can change presentation and available actions without changing its revision.
+    documents[0].mime = "application/json";
+    documents[0].capabilities = ["properties"];
+    await page.locator(".place").filter({ hasText: "Desktop" }).first().click();
+    await page.locator(".crumb-current").filter({ hasText: "Desktop" }).first().waitFor();
+    await page.locator(".place").filter({ hasText: "Documents" }).first().click();
+    const changedItem = page.locator(".item").filter({ hasText: "File-0001.txt" }).first();
+    await changedItem.locator(".item-type").filter({ hasText: "application/json" }).waitFor();
+    await changedItem.click({ button: "right" });
+    assert(await page.locator("#context-menu .menu-item").filter({ hasText: /^Download$/ }).count() === 0,
+      "Refreshed capabilities must replace cached menu actions");
+    await page.keyboard.press("Escape");
+
+    holdUploads = true;
+    const file = (name) => ({ name, mimeType: "text/plain", buffer: Buffer.from(name) });
+    await page.setInputFiles("#file-input", [file("documents-one.txt"), file("documents-two.txt")]);
+    await waitForUpload("documents-one.txt");
+    await page.locator(".place").filter({ hasText: "Desktop" }).first().click();
+    await page.locator(".crumb-current").filter({ hasText: "Desktop" }).first().waitFor();
+    await page.setInputFiles("#file-input", file("desktop-one.txt"));
+    await waitForUpload("desktop-one.txt");
+    for (const name of ["documents-one.txt", "documents-two.txt", "desktop-one.txt"]) {
+      await page.locator(".upload-name").filter({ hasText: name }).waitFor();
+    }
+    finishUpload("documents-one.txt");
+    await waitForUpload("documents-two.txt");
+    finishUpload("documents-two.txt");
+    await page.locator(".upload-name").filter({ hasText: "documents-one.txt" }).waitFor({ state: "detached" });
+    assert(await page.locator(".upload-name").filter({ hasText: "desktop-one.txt" }).count() === 1,
+      "Completing one batch must preserve another batch's progress");
+    finishUpload("desktop-one.txt");
+    await page.waitForFunction(() => document.querySelector("#upload-progress").classList.contains("hidden"));
+    assert(writePayloads.length === 4, "Every chosen file must be dispatched exactly once");
+    for (const name of ["documents-one.txt", "documents-two.txt", "desktop-one.txt"]) {
+      const destination = name.startsWith("documents-") ? documentsUri : desktopUri;
+      assert(writePayloads.some((entry) => entry.uri === `${destination}/${name}` && entry.body === name),
+        `${name} must retain its selected destination and exact bytes during navigation`);
+    }
+    assert(pageErrors.length === 0 && consoleErrors.length === 0 && failedRequests.length === 0,
+      `Library fixture reported errors: ${JSON.stringify({ pageErrors, consoleErrors, failedRequests })}`);
+    await assertFolderLoadRecovery(page);
+    assert(pageErrors.length === 0 && failedRequests.length === 0,
+      `Folder recovery fixture reported unexpected errors: ${JSON.stringify({ pageErrors, failedRequests })}`);
+    assert(consoleErrors.length === 1 && consoleErrors[0].message.includes("This folder is temporarily unavailable."),
+      `Only the current folder failure should be reported: ${JSON.stringify(consoleErrors)}`);
+    console.log(JSON.stringify({ objectCount, browser: browser.version(), earlyEnd, refreshEnd, sorts }, null, 2));
   } finally {
-    await browser.close();
+    await browser?.close();
+    server.closeAllConnections();
     await new Promise((resolve) => server.close(resolve));
   }
 }
diff --git a/scripts/library-state.test.mjs b/scripts/library-state.test.mjs
new file mode 100644
index 000000000..c3898ff67
--- /dev/null
+++ b/scripts/library-state.test.mjs
@@ -0,0 +1,216 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  cacheFolderListing,
+  setLibraryObjects,
+  visibleObjectsForState,
+} from "../capsules/library/browser/src/state.js";
+
+function makeState(objects = [], options = {}) {
+  const state = {
+    objectsVersion: 0,
+    folderCache: new Map(),
+    query: "",
+    showHidden: false,
+    sort: "name",
+    sortOrder: "asc",
+    ...options,
+  };
+  setLibraryObjects(state, objects);
+  return state;
+}
+
+function item(name, fields = {}) {
+  return { uri: `localhost://Library/${name}`, name, kind: "file", ...fields };
+}
+
+function names(state) {
+  return visibleObjectsForState(state).map((object) => object.name);
+}
+
+test("name sorting preserves the default locale, case/accent equivalence and source objects", () => {
+  const objects = ["zoo", "Éclair", "apple", "eclair", "Ångström", "éclair", "İ", "ı", "I", "2", "10"]
+    .map((name) => item(name));
+  const originalOrder = objects.slice();
+  const expected = objects.slice().sort((left, right) =>
+    left.name.localeCompare(right.name, undefined, { sensitivity: "base" }));
+  const state = makeState(objects);
+
+  assert.deepEqual(names(state), expected.map((object) => object.name));
+  assert.deepEqual(objects, originalOrder, "sorting must preserve provider order");
+  for (const object of visibleObjectsForState(state)) {
+    assert.strictEqual(object, objects.find((source) => source.uri === object.uri));
+  }
+
+  const ties = makeState([item("Éclair"), item("eclair"), item("éclair")]);
+  assert.deepEqual(names(ties), ["Éclair", "eclair", "éclair"]);
+  ties.sortOrder = "desc";
+  assert.deepEqual(names(ties), ["Éclair", "eclair", "éclair"]);
+});
+
+test("name sorting reuses one locale collator across comparisons and folder refreshes", async (t) => {
+  const NativeCollator = Intl.Collator;
+  let constructions = 0;
+  let comparisons = 0;
+  t.mock.method(Intl, "Collator", function (...args) {
+    constructions += 1;
+    const collator = new NativeCollator(...args);
+    return {
+      compare(left, right) {
+        comparisons += 1;
+        return collator.compare(left, right);
+      },
+    };
+  });
+  const subject = await import("../capsules/library/browser/src/state.js?collator-reuse");
+  const state = makeState();
+  for (const objects of [[item("Zulu"), item("alpha")], [item("delta"), item("Bravo"), item("charlie")]]) {
+    subject.setLibraryObjects(state, objects);
+    const before = comparisons;
+    const ascending = subject.visibleObjectsForState(state).map((object) => object.name);
+    assert.ok(comparisons > before, "name comparisons must use the shared collator");
+    assert.deepEqual(ascending, objects.map((object) => object.name).sort(new NativeCollator(undefined, { sensitivity: "base" }).compare));
+    state.sortOrder = "desc";
+    assert.deepEqual(subject.visibleObjectsForState(state).map((object) => object.name), ascending.toReversed());
+    state.sortOrder = "asc";
+    assert.equal(constructions, 1, "new listings and sort directions must reuse locale setup");
+  }
+});
+
+test("directories stay first in both name sort directions", () => {
+  const state = makeState([
+    item("beta.txt"), item("Z folder", { kind: "directory" }),
+    item("Alpha.txt"), item("A folder", { kind: "directory" }),
+  ]);
+  assert.deepEqual(names(state), ["A folder", "Z folder", "Alpha.txt", "beta.txt"]);
+  state.sortOrder = "desc";
+  assert.deepEqual(names(state), ["Z folder", "A folder", "beta.txt", "Alpha.txt"]);
+});
+
+for (const [sort, field, values] of [
+  ["size", "size", ["20", "3", undefined]],
+  ["modified", "modified_at", ["20", "3", undefined]],
+  ["type", "mime", ["video/mp4", "text/plain", undefined]],
+]) {
+  test(`${sort} sorting preserves defaults, stable ties and directory precedence`, () => {
+    const state = makeState([
+      item("large", { [field]: values[0] }),
+      item("folder", { kind: "directory", [field]: values[0] }),
+      item("small", { [field]: values[1] }),
+      item("missing", { [field]: values[2] }),
+      item("small tie", { [field]: values[1] }),
+    ], { sort });
+    assert.deepEqual(names(state), ["folder", "missing", "small", "small tie", "large"]);
+    state.sortOrder = "desc";
+    assert.deepEqual(names(state), ["folder", "large", "small", "small tie", "missing"]);
+  });
+}
+
+test("hidden filtering and search cover names, rooted URIs, MIME and both CIDs", () => {
+  const state = makeState([
+    item("Photo", { mime: "image/png", content_cid: "bafyLocal", published_cid: "bafyPublic" }),
+    item("Notes", { uri: "localhost://Library/special-location" }),
+    item(".Photo", { mime: "image/png" }),
+    item("Other"),
+  ]);
+  assert.deepEqual(names(state), ["Notes", "Other", "Photo"]);
+  for (const query of ["  pHoTo  ", "IMAGE/PNG", "bafylocal", "BAFYPUBLIC"]) {
+    state.query = query;
+    assert.deepEqual(names(state), ["Photo"], query);
+  }
+  state.query = "special-location";
+  assert.deepEqual(names(state), ["Notes"]);
+  state.query = "photo";
+  state.showHidden = true;
+  assert.deepEqual(names(state), [".Photo", "Photo"]);
+  state.query = "absent";
+  assert.deepEqual(names(state), []);
+});
+
+test("visible cache reuses results until preferences or fresh objects change", () => {
+  const state = makeState([item("Beta", { size: 1 }), item("Alpha", { size: 2 }), item(".Hidden")]);
+  let previous = visibleObjectsForState(state);
+  assert.strictEqual(visibleObjectsForState(state), previous);
+  for (const change of [
+    { query: "alpha" }, { query: "" }, { showHidden: true },
+    { sort: "size" }, { sortOrder: "desc" },
+  ]) {
+    Object.assign(state, change);
+    const next = visibleObjectsForState(state);
+    assert.notStrictEqual(next, previous);
+    assert.strictEqual(visibleObjectsForState(state), next);
+    previous = next;
+  }
+  assert.deepEqual(names(state), ["Alpha", "Beta", ".Hidden"]);
+
+  const replacement = item("Beta", { size: 3, mime: "video/mp4", capabilities: [] });
+  const version = state.objectsVersion;
+  setLibraryObjects(state, [replacement]);
+  assert.equal(state.objectsVersion, version + 1);
+  assert.deepEqual(names(state), ["Beta"]);
+  assert.strictEqual(visibleObjectsForState(state)[0], replacement);
+  assert.strictEqual(state.objectsByUri.get(replacement.uri), replacement);
+  setLibraryObjects(state, null);
+  assert.deepEqual(visibleObjectsForState(state), []);
+  assert.equal(state.objectsByUri.size, 0);
+});
+
+const folderUri = "localhost://Library";
+
+function listingSignature(objects, folder = null) {
+  return cacheFolderListing(makeState(), {}, folderUri, objects, folder).signature;
+}
+
+test("folder cache keeps equivalent listings while detecting membership and order changes", () => {
+  const first = item("Alpha", { metadata: { visibility: { placement: "private_folder" } } });
+  const second = item("Beta");
+  const state = makeState();
+  const perf = {};
+  const objects = [first, second];
+  const folder = item("Library", { uri: folderUri, kind: "directory", metadata: { readonly: false } });
+  const cached = cacheFolderListing(state, perf, folderUri, objects, folder);
+  assert.strictEqual(cached.objects, objects);
+  assert.strictEqual(cached.object, folder);
+  assert.strictEqual(state.folderCache.get(folderUri), cached);
+  assert.equal(perf.folderCacheSize, 1);
+  assert.equal(cached.signature, listingSignature(structuredClone(objects), structuredClone(folder)));
+  for (const changed of [[first], [first, second, item("Gamma")], [second, first]]) {
+    assert.notEqual(cached.signature, listingSignature(changed, folder));
+  }
+  assert.notEqual(cached.signature, listingSignature(objects, { ...folder, metadata: { readonly: true } }));
+  assert.equal(listingSignature(null), listingSignature([]));
+});
+
+test("fresh action, viewer and property metadata invalidates a same-revision cached listing", async (t) => {
+  const object = item("movie.mp4", {
+    revision: "same-revision",
+    mime: "video/mp4",
+    capabilities: ["open", "download", "publish", "protect"],
+    viewers: [{ id: "media-player", default: true }],
+    created_at: 10,
+    metadata: { visibility: { placement: "private_folder", effective_access: "principal_private" } },
+  });
+  const signature = listingSignature([object]);
+  const changes = {
+    mime: { mime: "application/octet-stream" },
+    capabilities: { capabilities: [] },
+    viewers: { viewers: [{ id: "elacity-player", default: true }] },
+    created_at: { created_at: 20 },
+    readonly: { metadata: { ...object.metadata, readonly: true } },
+    protection: { metadata: { ...object.metadata, protected_content: { schema: "elastos.library.protected-content-identity/v1", mint_id: "42" } } },
+    archive: { metadata: { ...object.metadata, archive_support: { status: "policy_gated_unsupported_archive_family" } } },
+    visibility: { metadata: { ...object.metadata, visibility: { ...object.metadata.visibility, share_policy: "shared" } } },
+    resolver: { metadata: { ...object.metadata, resolver_target: "localhost://NewTarget" } },
+    trash: { metadata: { ...object.metadata, trash: { original_uri: "localhost://Library/Original" } } },
+  };
+  for (const [name, change] of Object.entries(changes)) {
+    await t.test(name, () => {
+      const fresh = { ...object, ...change };
+      assert.equal(fresh.revision, object.revision);
+      assert.notEqual(listingSignature([fresh]), signature, `${name} changed without a content revision`);
+    });
+  }
+  assert.notEqual(listingSignature([item("File")]), listingSignature([item("File", { capabilities: [] })]),
+    "missing capabilities and an explicit empty capability list have different action behavior");
+});
diff --git a/scripts/test-behaviour.sh b/scripts/test-behaviour.sh
index 8e03138fc..c87dc87d8 100755
--- a/scripts/test-behaviour.sh
+++ b/scripts/test-behaviour.sh
@@ -34,4 +34,8 @@ if ! installed "$browser" playwright 1.60.0 || ! installed "$core" playwright-co
 fi
 export NODE_PATH="${browser}/node_modules"
 export BROWSER_OPERATOR_PLAYWRIGHT_CORE="${core}/node_modules/playwright-core"
+# Run large-folder timing checks before the concurrent suite so other browser
+# fixtures do not compete for the measured rendering budget.
+node scripts/library-performance-smoke.mjs
+node scripts/library-menu-smoke.mjs
 exec node --test --test-force-exit --test-timeout=60000 --test-reporter=spec elastos/esp/projections.test.mjs scripts/*.test.mjs scripts/build/*.test.mjs scripts/lib/*.test.mjs capsules/*/browser/*.test.mjs capsules/*/browser/src/*.test.mjs scripts/home-fixture-contracts-smoke.mjs scripts/documents-save-conflict-smoke.mjs scripts/gba-save-conflict-smoke.mjs scripts/assistant-shell-smoke.mjs scripts/model-preparation-failure-smoke.mjs scripts/model-management-browser-smoke.mjs
diff --git a/scripts/test-behaviour.test.mjs b/scripts/test-behaviour.test.mjs
index abe4ff5b0..022c49d12 100644
--- a/scripts/test-behaviour.test.mjs
+++ b/scripts/test-behaviour.test.mjs
@@ -101,3 +101,33 @@ test("behaviour inputs reject a missing pinned installer binary instead of using
   assert.notEqual(result.status, 0, result.stderr);
   assert.match(result.stderr, /node\/bin\/node.*(?:No such file|not found)/);
 });
+
+for (const [failedScript, expectedScripts, exitCode] of [
+  ["scripts/library-performance-smoke.mjs", ["scripts/library-performance-smoke.mjs"], 73],
+  ["scripts/library-menu-smoke.mjs", ["scripts/library-performance-smoke.mjs", "scripts/library-menu-smoke.mjs"], 74],
+]) {
+  test(`behaviour runner stops before the Node suite when ${failedScript} fails`, t => {
+    const { env, log } = fixture(t);
+    // Keep the real package-version probes, then substitute only executed
+    // test processes. This exercises the runner without launching a browser.
+    const nodeShim = join(env.PATH.split(":")[0], "node");
+    writeFileSync(nodeShim, `#!${process.execPath}
+      const fs = require("node:fs"), childProcess = require("node:child_process");
+      const args = process.argv.slice(2);
+      if (args[0] === "-p") {
+        const result = childProcess.spawnSync(process.execPath, args, { stdio: "inherit" });
+        process.exit(result.status ?? 1);
+      }
+      fs.appendFileSync(process.env.INPUTS_LOG, JSON.stringify(args) + "\\n");
+      process.exit(args[0] === process.env.FAILED_SCRIPT ? Number(process.env.FAILED_EXIT) : 0);
+    `, { mode: 0o755 });
+    const result = spawnSync("bash", [script], {
+      env: { ...env, FAILED_SCRIPT: failedScript, FAILED_EXIT: String(exitCode) },
+      encoding: "utf8", timeout: 10_000,
+    });
+    assert.equal(result.status, exitCode, result.stderr);
+    const commands = readFileSync(log, "utf8").trim().split("\n").map(JSON.parse);
+    assert.deepEqual(commands, expectedScripts.map(name => [name]),
+      "a failed browser prelude must stop all subsequent checks");
+  });
+}