diff --git a/.github/workflows/build-linux-packages.yml b/.github/workflows/build-linux-packages.yml
index 6492050f..b64c7018 100644
--- a/.github/workflows/build-linux-packages.yml
+++ b/.github/workflows/build-linux-packages.yml
@@ -4,6 +4,7 @@
 # Pinned first-party actions (bump tag and SHA together when upgrading):
 #   actions/checkout@v6.0.1            8e8c483db84b4bee98b60c0593521ed34d9990e8
 #   actions/upload-artifact@v5.0.0     330a01c490aca151604b8cf639adc76d48f6c5d4
+#   actions/cache@v4.2.0               1bd1e32a3bdc45362d1e726936510720a7c30a57
 
 name: Build Linux packages
 
@@ -18,6 +19,7 @@ on:
             - "package.json"
             - "scripts/ensure-flatpak-flathub-remote.sh"
             - "scripts/ci/github-build-linux-*.sh"
+            - "scripts/ci/github-warm-appimage-tools.sh"
             - ".github/workflows/build-linux-packages.yml"
             - ".github/workflows/build-release.yml"
             - ".github/workflows/frontend-build.yml"
@@ -83,6 +85,14 @@ jobs:
                   node-version: ${{ env.NODE_VERSION }}
                   pnpm-version: ${{ env.PNPM_VERSION }}
 
+            - name: Cache electron-builder toolsets
+              uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
+              with:
+                  path: ~/.cache/electron-builder
+                  key: electron-builder-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'package.json') }}
+                  restore-keys: |
+                      electron-builder-${{ runner.os }}-${{ runner.arch }}-
+
             - name: Linux packaging APT dependencies
               run: bash scripts/ci/github-apt-linux-packaging.sh
 
@@ -100,6 +110,8 @@ jobs:
               run: sh scripts/ci/setup-task.sh
 
             - name: Build release-assets
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
               run: bash scripts/ci/github-build-linux-release-assets.sh
 
             - name: Upload Linux build-test artifact (${{ matrix.arch }})
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 7281836f..9dcd4410 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -117,6 +117,14 @@ jobs:
                   node-version: ${{ env.NODE_VERSION }}
                   pnpm-version: ${{ env.PNPM_VERSION }}
 
+            - name: Cache electron-builder toolsets
+              uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
+              with:
+                  path: ~/.cache/electron-builder
+                  key: electron-builder-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'package.json') }}
+                  restore-keys: |
+                      electron-builder-${{ runner.os }}-${{ runner.arch }}-
+
             - name: Linux packaging APT dependencies
               run: bash scripts/ci/github-apt-linux-packaging.sh
 
@@ -143,6 +151,8 @@ jobs:
               run: sh scripts/ci/setup-trivy.sh
 
             - name: Build release-assets
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
               run: bash scripts/ci/github-build-linux-release-assets.sh
 
             - name: Upload Linux release artifact (${{ matrix.arch }})
diff --git a/meshchatx.rsm b/meshchatx.rsm
index b880b146..98a11f3f 100644
Binary files a/meshchatx.rsm and b/meshchatx.rsm differ
diff --git a/meshchatx/src/frontend/components/messages/ConversationPeerHeader.vue b/meshchatx/src/frontend/components/messages/ConversationPeerHeader.vue
index abd5d0f7..d3616f08 100644
--- a/meshchatx/src/frontend/components/messages/ConversationPeerHeader.vue
+++ b/meshchatx/src/frontend/components/messages/ConversationPeerHeader.vue
@@ -2,7 +2,7 @@
 
 <template>
     <div
-        class="relative z-20 flex flex-wrap items-center gap-y-2 px-3 sm:px-4 py-3 border-b border-gray-200 dark:border-zinc-800 bg-white dark:bg-zinc-950"
+        class="relative z-20 flex items-center gap-2 px-3 sm:px-4 py-2 border-b border-gray-200 dark:border-zinc-800 bg-white dark:bg-zinc-950"
     >
         <div class="shrink-0 mr-3">
             <LxmfUserIcon
@@ -119,14 +119,10 @@
         <div class="ml-auto flex items-center gap-0.5 sm:gap-1.5 min-w-0 shrink-0">
             <DropDownMenu v-if="!compactPeerActions" class="shrink-0" data-testid="conversation-path-ops">
                 <template #button>
-                    <IconButton
-                        :title="$t('nomadnet.path_finder')"
-                        :disabled="pathfinderInProgress"
-                        class="text-blue-600 dark:text-blue-400"
-                    >
+                    <IconButton :title="$t('nomadnet.path_finder')" :disabled="pathfinderInProgress">
                         <MaterialDesignIcon
                             :icon-name="pathfinderInProgress ? 'loading' : 'map-marker-path'"
-                            :class="['size-6 sm:size-7', pathfinderInProgress ? 'animate-spin' : '']"
+                            :class="['size-5', pathfinderInProgress ? 'animate-spin' : '']"
                         />
                     </IconButton>
                 </template>
@@ -165,11 +161,12 @@
             />
 
             <IconButton
+                data-testid="conversation-close"
                 :title="compactPeerActions ? $t('messages.back_to_list') : $t('common.close')"
                 class="shrink-0"
                 @click="$emit('close')"
             >
-                <MaterialDesignIcon :icon-name="compactPeerActions ? 'arrow-left' : 'close'" class="size-6 sm:size-7" />
+                <MaterialDesignIcon :icon-name="compactPeerActions ? 'arrow-left' : 'close'" class="size-5" />
             </IconButton>
         </div>
     </div>
diff --git a/scripts/ci/github-build-linux-release-assets.sh b/scripts/ci/github-build-linux-release-assets.sh
index f02778af..c82d16c4 100755
--- a/scripts/ci/github-build-linux-release-assets.sh
+++ b/scripts/ci/github-build-linux-release-assets.sh
@@ -61,6 +61,46 @@ has_format appimage && appimage_deb_targets="$appimage_deb_targets AppImage"
 has_format deb && appimage_deb_targets="$appimage_deb_targets deb"
 appimage_deb_targets="${appimage_deb_targets# }"
 
+if [ -n "${GITHUB_TOKEN:-}" ] && [ -z "${GH_TOKEN:-}" ]; then
+    export GH_TOKEN="$GITHUB_TOKEN"
+fi
+
+# Retry electron-builder when GitHub CDN drops the TLS stream (ECONNRESET).
+# Freeze already finished. This only re-runs packaging.
+run_electron_builder() {
+    _max="${ELECTRON_BUILDER_RETRIES:-5}"
+    _n=1
+    _delay=8
+    while true; do
+        _log="$(mktemp)"
+        set +e
+        pnpm exec electron-builder "$@" 2>&1 | tee "$_log"
+        _status="${PIPESTATUS[0]}"
+        set -e
+        if [ "$_status" -eq 0 ]; then
+            rm -f "$_log"
+            return 0
+        fi
+        if [ "$_n" -ge "$_max" ]; then
+            echo "electron-builder failed after ${_n} attempt(s)" >&2
+            rm -f "$_log"
+            return "$_status"
+        fi
+        if ! grep -Eqi 'ECONNRESET|ETIMEDOUT|ECONNREFUSED|ENOTFOUND|EPIPE|socket hang up|RequestError' "$_log"; then
+            rm -f "$_log"
+            return "$_status"
+        fi
+        echo "electron-builder hit a transient network error (attempt ${_n}/${_max}). Retrying in ${_delay}s." >&2
+        rm -f "$_log"
+        sleep "$_delay"
+        _n=$((_n + 1))
+        _delay=$((_delay * 2))
+        if [ "$_delay" -gt 60 ]; then
+            _delay=60
+        fi
+    done
+}
+
 if [ "${SKIP_WHEEL:-0}" != 1 ]; then
     if [ "$NATIVE_ARCH" = "x64" ]; then
         echo "Building Python wheel..."
@@ -74,17 +114,20 @@ fi
 
 if [ "${SKIP_ELECTRON:-0}" != 1 ]; then
     if [ -n "$appimage_deb_targets" ]; then
+        if has_format appimage; then
+            bash scripts/ci/github-warm-appimage-tools.sh
+        fi
         pnpm run electron-postinstall
         if [ "$NATIVE_ARCH" = "x64" ]; then
             echo "Electron linux x64 ($appimage_deb_targets)..."
             PLATFORM=linux ARCH=x64 pnpm run build
             # shellcheck disable=SC2086
-            pnpm exec electron-builder --linux $appimage_deb_targets --x64 --publish=never
+            run_electron_builder --linux $appimage_deb_targets --x64 --publish=never
         elif [ "$NATIVE_ARCH" = "arm64" ]; then
             echo "Electron linux arm64 ($appimage_deb_targets)..."
             PLATFORM=linux ARCH=arm64 pnpm run build
             # shellcheck disable=SC2086
-            pnpm exec electron-builder --linux $appimage_deb_targets --arm64 --publish=never
+            run_electron_builder --linux $appimage_deb_targets --arm64 --publish=never
         fi
     else
         echo "Skipping AppImage/deb (not selected in MESHCHATX_LINUX_FORMATS)."
diff --git a/scripts/ci/github-warm-appimage-tools.sh b/scripts/ci/github-warm-appimage-tools.sh
new file mode 100755
index 00000000..80973bdc
--- /dev/null
+++ b/scripts/ci/github-warm-appimage-tools.sh
@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+# Pre-download the electron-builder AppImage toolset into ELECTRON_BUILDER_CACHE.
+# GitHub release CDN over HTTP/2 (got inside electron-builder) often resets the
+# TLS stream after freeze has already finished (read ECONNRESET). curl HTTP/1.1
+# plus --retry-all-errors matches scripts/ci/setup-task.sh.
+#
+# Pins must match package.json build.toolsets.appimage and the sha256 in
+# app-builder-lib toolsets/linux.js for that version (electron-builder 26.15.3:
+# appimage@1.0.2).
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$ROOT"
+
+APPIMAGE_TOOLSET="1.0.2"
+FILENAME="appimage-tools-runtime-20251108.tar.gz"
+SHA256="a784a8c26331ec2e945c23d6bdb14af5c9df27f5939825d84b8709c61dc81eb0"
+RELEASE_NAME="appimage@${APPIMAGE_TOOLSET}"
+URL="https://github.com/electron-userland/electron-builder-binaries/releases/download/${RELEASE_NAME}/${FILENAME}"
+
+pkg_toolset="$(node -p "require('./package.json').build.toolsets.appimage" 2>/dev/null || true)"
+if [ "$pkg_toolset" != "$APPIMAGE_TOOLSET" ]; then
+    echo "github-warm-appimage-tools.sh: package.json build.toolsets.appimage is '${pkg_toolset:-missing}', script pin is '${APPIMAGE_TOOLSET}'" >&2
+    echo "Update APPIMAGE_TOOLSET, FILENAME, and SHA256 in this script to match app-builder-lib." >&2
+    exit 1
+fi
+
+electron_builder_cache_dir() {
+    if [ -n "${ELECTRON_BUILDER_CACHE:-}" ]; then
+        case "${ELECTRON_BUILDER_CACHE}" in
+            /*)
+                printf '%s\n' "${ELECTRON_BUILDER_CACHE}"
+                return
+                ;;
+        esac
+    fi
+    if [ -n "${XDG_CACHE_HOME:-}" ]; then
+        case "${XDG_CACHE_HOME}" in
+            /*)
+                printf '%s\n' "${XDG_CACHE_HOME}/electron-builder"
+                return
+                ;;
+        esac
+    fi
+    printf '%s\n' "${HOME}/.cache/electron-builder"
+}
+
+CACHE_DIR="$(electron_builder_cache_dir)"
+DEST_DIR="${CACHE_DIR}/${RELEASE_NAME}"
+DEST="${DEST_DIR}/${FILENAME}"
+mkdir -p "$DEST_DIR"
+
+hash_ok() {
+    [ -f "$1" ] || return 1
+    local actual
+    actual="$(sha256sum "$1" | cut -d' ' -f1)"
+    [ "$actual" = "$SHA256" ]
+}
+
+if hash_ok "$DEST"; then
+    echo "github-warm-appimage-tools.sh: using cached ${DEST}"
+    exit 0
+fi
+
+if [ "${MESHCHATX_OFFLINE_BUILD:-0}" = "1" ]; then
+    echo "github-warm-appimage-tools.sh: MESHCHATX_OFFLINE_BUILD=1 but ${DEST} is missing or checksum-mismatched" >&2
+    exit 1
+fi
+
+download_release() {
+    dest="$1"
+    url="$2"
+    token="${GITHUB_TOKEN:-${GH_TOKEN:-}}"
+    if [ -n "$token" ]; then
+        curl -fsSL --http1.1 \
+            --retry 8 \
+            --retry-all-errors \
+            --retry-delay 4 \
+            --retry-max-time 180 \
+            --connect-timeout 20 \
+            --max-time 180 \
+            -H "Authorization: Bearer ${token}" \
+            -o "$dest" \
+            "$url"
+    else
+        curl -fsSL --http1.1 \
+            --retry 8 \
+            --retry-all-errors \
+            --retry-delay 4 \
+            --retry-max-time 180 \
+            --connect-timeout 20 \
+            --max-time 180 \
+            -o "$dest" \
+            "$url"
+    fi
+}
+
+TMP="${DEST}.tmp"
+rm -f "$TMP" "$DEST"
+echo "github-warm-appimage-tools.sh: downloading ${FILENAME} (${RELEASE_NAME})"
+download_release "$TMP" "$URL"
+
+ACTUAL="$(sha256sum "$TMP" | cut -d' ' -f1)"
+if [ "$ACTUAL" != "$SHA256" ]; then
+    echo "github-warm-appimage-tools.sh: SHA256 mismatch for ${FILENAME}" >&2
+    echo "  expected: ${SHA256}" >&2
+    echo "  got:      ${ACTUAL}" >&2
+    rm -f "$TMP"
+    exit 1
+fi
+
+mv -f "$TMP" "$DEST"
+echo "github-warm-appimage-tools.sh: cached ${DEST} (${ACTUAL})"
diff --git a/tests/backend/test_http_auth_security.py b/tests/backend/test_http_auth_security.py
index 440f3fe7..9a3486fa 100644
--- a/tests/backend/test_http_auth_security.py
+++ b/tests/backend/test_http_auth_security.py
@@ -248,8 +248,14 @@ async def test_auth_rejects_api_paths_that_end_with_static_extensions(mock_app):
             f"expected 401 for status prefix disguise, got {status_prefix.status}"
         )
 
-        manifest = await client.get("/manifest.json")
-        assert manifest.status == 200
+        # Do not GET /manifest.json here. That route uses FileResponse, which
+        # calls loop.run_in_executor. mock_app patches threading.Thread so the
+        # executor never runs and the client hangs until TimeoutError.
+        # A missing static asset is enough: middleware must not 401 it.
+        static_js = await client.get("/assets/does-not-exist.js")
+        assert static_js.status != 401, (
+            f"expected static non-API path to skip auth, got {static_js.status}"
+        )
 
 
 @pytest.mark.asyncio
diff --git a/tests/frontend/AppSidebarIdentityAnnounce.test.js b/tests/frontend/AppSidebarIdentityAnnounce.test.js
index 479abaeb..3edc4ece 100644
--- a/tests/frontend/AppSidebarIdentityAnnounce.test.js
+++ b/tests/frontend/AppSidebarIdentityAnnounce.test.js
@@ -144,6 +144,7 @@ describe("App.vue sidebar identity label and announce control", () => {
         window.api = axiosMock;
         vi.clearAllMocks();
         axiosMock.get.mockImplementation(defaultAxiosImplementation);
+        window.localStorage?.removeItem("meshchatx.sidebar.app");
     });
 
     afterEach(() => {
@@ -259,13 +260,37 @@ describe("App.vue sidebar identity label and announce control", () => {
         expect(axiosMock.get).toHaveBeenCalledWith("/api/v1/announce");
     });
 
-    it("clicking announce section header (not the radio) toggles expanded state", async () => {
+    it("clicking grouped account chip (not the radio) toggles expanded state", async () => {
+        wrapper = makeMountedApp();
+        await readyShell(wrapper.vm.$router);
+        const footer = wrapper.findComponent({ name: "AppSidebarAccountFooter" });
+        expect(footer.exists()).toBe(true);
+        expect(footer.find("[data-testid=sidebar-account-chip]").exists()).toBe(true);
+        expect(footer.find("[data-testid=sidebar-announce-radio]").exists()).toBe(true);
+        expect(footer.vm.isExpanded).toBe(false);
+        await footer.find("[data-testid=sidebar-account-chip]").trigger("click");
+        expect(footer.vm.isExpanded).toBe(true);
+        await footer.find("[data-testid=sidebar-account-chip]").trigger("click");
+        expect(footer.vm.isExpanded).toBe(false);
+    });
+
+    it("classic sidebar announce header toggles expanded state", async () => {
+        axiosMock.get.mockImplementation((url) => {
+            if (url === "/api/v1/config") {
+                return Promise.resolve({
+                    data: { config: makeConfig({ app_sidebar_layout: "classic" }) },
+                });
+            }
+            return defaultAxiosImplementation(url);
+        });
         wrapper = makeMountedApp();
         await readyShell(wrapper.vm.$router);
         const header = wrapper.find("[data-testid=sidebar-announce-header]");
         expect(header.exists()).toBe(true);
-        wrapper.vm.isShowingAnnounceSection = true;
+        const footer = wrapper.findComponent({ name: "AppSidebarClassicFooter" });
+        expect(footer.exists()).toBe(true);
+        expect(footer.vm.isShowingAnnounceSection).toBe(true);
         await header.trigger("click");
-        expect(wrapper.vm.isShowingAnnounceSection).toBe(false);
+        expect(footer.vm.isShowingAnnounceSection).toBe(false);
     });
 });
diff --git a/tests/frontend/ConversationViewerButtons.test.js b/tests/frontend/ConversationViewerButtons.test.js
index 65565202..bd5b1744 100644
--- a/tests/frontend/ConversationViewerButtons.test.js
+++ b/tests/frontend/ConversationViewerButtons.test.js
@@ -141,8 +141,8 @@ describe("ConversationViewer.vue button interactions", () => {
         const wrapper = mountViewer();
         await wrapper.vm.$nextTick();
 
-        const closeBtn = wrapper.findAll("button").find((b) => b.attributes("title") === "Close");
-        expect(closeBtn).toBeDefined();
+        const closeBtn = wrapper.find("[data-testid=conversation-close]");
+        expect(closeBtn.exists()).toBe(true);
 
         await closeBtn.trigger("click");
 
@@ -172,12 +172,12 @@ describe("ConversationViewer.vue button interactions", () => {
         expect(wrapper.vm.messageContextMenu.show).toBe(true);
 
         const menuEl = Array.from(document.body.querySelectorAll(".context-menu-panel")).find(
-            (el) => el.textContent?.includes("Reply") && el.textContent?.includes("Delete")
+            (el) => el.textContent?.includes("messages.reply") && el.textContent?.includes("common.delete")
         );
         expect(menuEl).toBeTruthy();
 
         const replyBtn = menuEl?.querySelector("button");
-        expect(replyBtn?.textContent).toContain("Reply");
+        expect(replyBtn?.textContent).toContain("messages.reply");
 
         replyBtn?.click();
         await wrapper.vm.$nextTick();
@@ -202,10 +202,10 @@ describe("ConversationViewer.vue button interactions", () => {
         await wrapper.vm.$nextTick();
 
         const menuEl = Array.from(document.body.querySelectorAll(".context-menu-panel")).find(
-            (el) => el.textContent?.includes("Reply") && el.textContent?.includes("Delete")
+            (el) => el.textContent?.includes("messages.reply") && el.textContent?.includes("common.delete")
         );
         const deleteBtn = menuEl
-            ? Array.from(menuEl.querySelectorAll("button")).find((b) => b.textContent.includes("Delete"))
+            ? Array.from(menuEl.querySelectorAll("button")).find((b) => b.textContent.includes("common.delete"))
             : null;
         expect(deleteBtn).toBeTruthy();
 
diff --git a/tests/frontend/UIThemeAndVisibility.test.js b/tests/frontend/UIThemeAndVisibility.test.js
index bc31e186..1be086b4 100644
--- a/tests/frontend/UIThemeAndVisibility.test.js
+++ b/tests/frontend/UIThemeAndVisibility.test.js
@@ -294,7 +294,8 @@ describe("Visibility Checks", () => {
 
         const dialogElement = wrapper.find(".fixed");
         expect(dialogElement.exists()).toBe(true);
-        expect(wrapper.text()).toContain("Confirm");
+        expect(wrapper.text()).toContain("common.confirm_action");
+        expect(wrapper.text()).toContain("common.confirm");
     });
 
     it("ConfirmDialog hides when pendingConfirm is null", async () => {
diff --git a/tests/frontend/__snapshots__/uiSnapshots.test.js.snap b/tests/frontend/__snapshots__/uiSnapshots.test.js.snap
index 820c5ae3..8e78c539 100644
--- a/tests/frontend/__snapshots__/uiSnapshots.test.js.snap
+++ b/tests/frontend/__snapshots__/uiSnapshots.test.js.snap
@@ -1,6 +1,6 @@
 // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
-exports[`UI snapshot regression > ConfirmDialog.vue > visible confirm dialog 1`] = `"<div="" class="fixed inset-0 z-9999 flex items-center justify-center p-4 confirm-dialog-enter-from confirm-dialog-enter-active"><div="" class="fixed inset-0 bg-black/50 backdrop-blur-xs shadow-2xl"></div><div="" class="relative w-full sm:w-auto sm:min-w-[400px] sm:max-w-md bg-white dark:bg-zinc-900 sm:rounded-3xl rounded-3xl shadow-2xl border border-gray-200 dark:border-zinc-800 overflow-hidden transform transition-all"><div="" class="p-8"><div="" class="flex items-start mb-6"><div="" class="shrink-0 flex items-center justify-center w-12 h-12 rounded-2xl bg-red-100 dark:bg-red-900/30 text-red-600 dark:text-red-400 mr-4"><span="" class="mdi-snapshot w-6 h-6" data-icon="alert-circle"></span></div><div="" class="flex-1 min-w-0"><h3="" class="text-xl font-black text-gray-900 dark:text-white mb-2">Confirm Action</h3><p="" class="text-gray-600 dark:text-zinc-300 whitespace-pre-wrap leading-relaxed">Delete this item?</p></div></div><div="" class="flex flex-col sm:flex-row gap-3 sm:justify-end mt-8"><button="" type="button" class="px-6 py-3 text-sm font-bold text-gray-700 dark:text-zinc-300 bg-gray-100 dark:bg-zinc-800 rounded-xl hover:bg-gray-200 dark:hover:bg-zinc-700 transition-all active:scale-95"> Cancel </button><button="" type="button" class="px-6 py-3 text-sm font-bold text-white bg-red-600 hover:bg-red-700 rounded-xl shadow-lg shadow-red-600/20 transition-all active:scale-95"> Confirm </button></div></div></div></div>"`;
+exports[`UI snapshot regression > ConfirmDialog.vue > visible confirm dialog 1`] = `"<div="" class="fixed inset-0 z-9999 flex items-center justify-center p-4 confirm-dialog-enter-from confirm-dialog-enter-active"><div="" class="fixed inset-0 bg-black/50 backdrop-blur-xs shadow-2xl"></div><div="" class="relative w-full sm:w-auto sm:min-w-[400px] sm:max-w-md bg-white dark:bg-zinc-900 sm:rounded-3xl rounded-3xl shadow-2xl border border-gray-200 dark:border-zinc-800 overflow-hidden transform transition-all"><div="" class="p-8"><div="" class="flex items-start mb-6"><div="" class="shrink-0 flex items-center justify-center w-12 h-12 rounded-2xl bg-red-100 dark:bg-red-900/30 text-red-600 dark:text-red-400 mr-4"><span="" class="mdi-snapshot w-6 h-6" data-icon="alert-circle"></span></div><div="" class="flex-1 min-w-0"><h3="" class="text-xl font-black text-gray-900 dark:text-white mb-2">common.confirm_action</h3><p="" class="text-gray-600 dark:text-zinc-300 whitespace-pre-wrap leading-relaxed">Delete this item?</p></div></div><div="" class="flex flex-col sm:flex-row gap-3 sm:justify-end mt-8"><button="" type="button" class="px-6 py-3 text-sm font-bold text-gray-700 dark:text-zinc-300 bg-gray-100 dark:bg-zinc-800 rounded-xl hover:bg-gray-200 dark:hover:bg-zinc-700 transition-all active:scale-95">common.cancel</button><button="" type="button" class="px-6 py-3 text-sm font-bold text-white bg-red-600 hover:bg-red-700 rounded-xl shadow-lg shadow-red-600/20 transition-all active:scale-95">common.confirm</button></div></div></div></div>"`;
 
 exports[`UI snapshot regression > FormLabel.vue > default label 1`] = `"<label class="block text-sm font-medium text-gray-900 dark:text-zinc-100">Display name</label>"`;
 
diff --git a/tests/frontend/linuxAppimagePackagingContracts.test.js b/tests/frontend/linuxAppimagePackagingContracts.test.js
new file mode 100644
index 00000000..85ca3bdb
--- /dev/null
+++ b/tests/frontend/linuxAppimagePackagingContracts.test.js
@@ -0,0 +1,55 @@
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const ROOT = resolve(__dirname, "../..");
+
+function readSource(relativePath) {
+    return readFileSync(resolve(ROOT, relativePath), "utf8");
+}
+
+describe("Linux AppImage packaging contracts", () => {
+    it("pins the warm-script AppImage toolset to package.json", () => {
+        const pkg = JSON.parse(readSource("package.json"));
+        const toolset = pkg.build.toolsets.appimage;
+        expect(toolset).toBe("1.0.2");
+
+        const warm = readSource("scripts/ci/github-warm-appimage-tools.sh");
+        expect(warm).toContain(`APPIMAGE_TOOLSET="${toolset}"`);
+        expect(warm).toContain("FILENAME=\"appimage-tools-runtime-20251108.tar.gz\"");
+        expect(warm).toContain("SHA256=\"a784a8c26331ec2e945c23d6bdb14af5c9df27f5939825d84b8709c61dc81eb0\"");
+        expect(warm).toContain("--http1.1");
+        expect(warm).toContain("--retry-all-errors");
+    });
+
+    it("warms AppImage tools before freeze and retries ECONNRESET", () => {
+        const script = readSource("scripts/ci/github-build-linux-release-assets.sh");
+        const warmAt = script.indexOf("github-warm-appimage-tools.sh");
+        const freezeAt = script.indexOf("PLATFORM=linux ARCH=x64 pnpm run build");
+        const retryAt = script.indexOf("run_electron_builder --linux");
+        expect(warmAt).toBeGreaterThan(-1);
+        expect(freezeAt).toBeGreaterThan(warmAt);
+        expect(retryAt).toBeGreaterThan(freezeAt);
+        expect(script).toContain("ECONNRESET");
+        expect(script).toContain("run_electron_builder()");
+    });
+
+    it("caches electron-builder toolsets on Linux package and release jobs", () => {
+        const linux = readSource(".github/workflows/build-linux-packages.yml");
+        const release = readSource(".github/workflows/build-release.yml");
+        expect(linux).toContain("Cache electron-builder toolsets");
+        expect(linux).toContain("~/.cache/electron-builder");
+        expect(release).toContain("Cache electron-builder toolsets");
+        expect(release).toContain("~/.cache/electron-builder");
+
+        const linuxBuild = linux.slice(linux.indexOf("- name: Build release-assets"), linux.indexOf("- name: Build release-assets") + 400);
+        const releaseBuild = release.slice(
+            release.indexOf("- name: Build release-assets"),
+            release.indexOf("- name: Build release-assets") + 400
+        );
+        expect(linuxBuild).toContain("GITHUB_TOKEN: ${{ github.token }}");
+        expect(releaseBuild).toContain("GITHUB_TOKEN: ${{ github.token }}");
+        expect(linuxBuild).toContain("github-build-linux-release-assets.sh");
+        expect(releaseBuild).toContain("github-build-linux-release-assets.sh");
+    });
+});