chore: version bump

docs: update CHANGELOG.md and README.md for v0.29.0 [skip ci] (#539 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-08-08 20:26:08 +02:00 · 2026-08-08 16:35:46 +04:00 · 2026-08-08 12:26:50 +00:00 · 2026-08-08 09:08:52 +00:00 · 2026-08-07 06:16:00 -07:00 · 2026-08-06 14:39:53 -07:00
107 changed files with 27787 additions and 1507 deletions
@@ -34,7 +34,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1

      - name: Set up pnpm package manager
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 #v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 #v6.0.10
        with:
          run_install: false

@@ -659,7 +659,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1

      - name: Run opencode
-        uses: anomalyco/opencode/github@4da7bb44c84e013fa53e9c5d02ac753d1435c81a #v1.18.9
+        uses: anomalyco/opencode/github@65cf14df16c191f3e9684f0d9a8bae69103ced6d #v1.18.14
        env:
          ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }}
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -37,7 +37,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1

      - name: Set up pnpm package manager
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 #v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 #v6.0.10
        with:
          run_install: false

@@ -44,7 +44,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1

      - name: Set up pnpm package manager
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 #v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 #v6.0.10
        with:
          run_install: false

@@ -104,7 +104,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1

      - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 #v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 #v6.0.10
        with:
          run_install: false

@@ -111,7 +111,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1

      - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 #v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 #v6.0.10
        with:
          run_install: false

@@ -23,4 +23,4 @@ jobs:
      - name: Checkout Actions Repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
      - name: Spell Check Repo
-        uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 #v1.48.0
+        uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f #v1.49.0
@@ -64,3 +64,10 @@ nodecar/nodecar-bin

 # claude
 .claude/
+# Claude Code session-recovery runtime state
+HANDOFF.md
+.claude/settings.local.json
+.claude/rate-limit-state.json
+.claude/stop-failure-events.jsonl
+.claude/quota-blocked.json
+session-recover.yaml
@@ -1,6 +1,71 @@
 # Changelog


+## v0.29.0 (2026-08-08)
+
+### Features
+
+- prevent launch with inconsistent geodata
+- cookie bot
+- remote sessions
+- xray support
+- mass import via gui, api, and mcp
+- add Turkish (tr) language support
+
+### Bug Fixes
+
+- properly handle x-amz-meta-updated-at
+- improve UI interactions and page consistency
+
+### Refactoring
+
+- cleanup
+- cleanup
+- improve proxy lifetime management
+- cleanup
+- remote cleanup
+- cleanup cloud sync
+- cleanup
+- harden tests
+- block windows app update if the browser is running
+- ui refresh
+
+### Documentation
+
+- contrib-readme-action has updated readme
+- contrib-readme-action has updated readme
+
+### Maintenance
+
+- ci(deps): bump the github-actions group with 3 updates (#538)
+- chore: linting
+- chore: linting
+- chore: linting
+- chore: ci
+- chore: upload sidecars to cdn
+- chore: linting
+- ci(deps): bump the github-actions group with 4 updates
+- chore: linting
+- chore: disable e2e in ci
+- chore: linting
+- chore: linting
+- chore: ai compliance
+- chore: linting
+- ci(deps): bump the github-actions group across 1 directory with 3 updates (#514)
+- chore: linting
+- chore: linting
+- chore: add cross-platform webdriver tests
+- ci(deps): bump the github-actions group with 2 updates
+- chore: update flake.nix for v0.28.2 [skip ci] (#501)
+
+### Other
+
+- deps(deps): bump next from 16.2.10 to 16.2.11 (#515)
+- refactors: animations cleanup
+- restore settings redirect
+- fix group create translation key
+
+
 ## v0.28.2 (2026-07-12)

 ### Features
@@ -46,7 +46,7 @@

 | | Apple Silicon | Intel |
 |---|---|---|
-| **DMG** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.2/Donut_0.28.2_aarch64.dmg) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.2/Donut_0.28.2_x64.dmg) |
+| **DMG** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.29.0/Donut_0.29.0_aarch64.dmg) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.29.0/Donut_0.29.0_x64.dmg) |

 Or install via Homebrew:

@@ -56,15 +56,15 @@ brew install --cask donut

 ### Windows

-[Download Windows Installer (x64)](https://github.com/zhom/donutbrowser/releases/download/v0.28.2/Donut_0.28.2_x64-setup.exe) · [Portable (x64)](https://github.com/zhom/donutbrowser/releases/download/v0.28.2/Donut_0.28.2_x64-portable.zip)
+[Download Windows Installer (x64)](https://github.com/zhom/donutbrowser/releases/download/v0.29.0/Donut_0.29.0_x64-setup.exe) · [Portable (x64)](https://github.com/zhom/donutbrowser/releases/download/v0.29.0/Donut_0.29.0_x64-portable.zip)

 ### Linux

 | Format | x86_64 | ARM64 |
 |---|---|---|
-| **deb** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.2/Donut_0.28.2_amd64.deb) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.2/Donut_0.28.2_arm64.deb) |
-| **rpm** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.2/Donut-0.28.2-1.x86_64.rpm) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.2/Donut-0.28.2-1.aarch64.rpm) |
-| **AppImage** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.2/Donut_0.28.2_amd64.AppImage) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.28.2/Donut_0.28.2_aarch64.AppImage) |
+| **deb** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.29.0/Donut_0.29.0_amd64.deb) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.29.0/Donut_0.29.0_arm64.deb) |
+| **rpm** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.29.0/Donut-0.29.0-1.x86_64.rpm) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.29.0/Donut-0.29.0-1.aarch64.rpm) |
+| **AppImage** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.29.0/Donut_0.29.0_amd64.AppImage) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.29.0/Donut_0.29.0_aarch64.AppImage) |
 <!-- install-links-end -->

 Or install via package manager:
@@ -1809,6 +1809,7 @@ dependencies = [
 "flate2",
 "futures-util",
 "globset",
+ "gtk",
 "http-body-util",
 "hyper",
 "hyper-util",
@@ -25,6 +25,7 @@ export const commandCoverage = {
      "get_system_info",
      "dismiss_window_resize_warning",
      "get_window_resize_warning_dismissed",
+      "window_decorations::get_window_decoration_layout",
      "get_onboarding_completed",
      "complete_onboarding",
    ],
@@ -71,6 +72,7 @@ export const commandCoverage = {
      "update_stored_proxy",
      "delete_stored_proxy",
      "check_proxy_validity",
+      "validate_vless_uri",
      "get_cached_proxy_check",
      "export_proxies",
      "import_proxies_json",
@@ -174,8 +176,9 @@ export const commandCoverage = {
      "generate_sample_fingerprint",
      "is_geoip_database_available",
      "download_geoip_database",
-      "fingerprint_consistency::check_profile_fingerprint_consistency",
      "fingerprint_consistency::match_profile_fingerprint_to_exit",
+      "launch_gate::get_profile_pre_launch_checks",
+      "launch_gate::ack_launch_gate",
      "check_wayfern_terms_accepted",
      "check_wayfern_downloaded",
      "accept_wayfern_terms",
@@ -248,6 +251,40 @@ export const commandCoverage = {
      "team_lock::get_team_lock_status",
    ],
  },
+  remoteSessions: {
+    suite: "integrations",
+    level: "contract",
+    commands: [
+      "list_remote_sessions",
+      "get_remote_session",
+      "stop_remote_session",
+      "get_remote_handoff_states",
+      "start_remote_session_events",
+      "stop_remote_session_events",
+      "get_remote_session_events_status",
+    ],
+  },
+  cookieBot: {
+    suite: "integrations",
+    level: "contract",
+    commands: [
+      "get_cookie_bot_schedules",
+      "get_cookie_bot_schedule",
+      "save_cookie_bot_schedule",
+      "delete_cookie_bot_schedule",
+      "check_cookie_bot_conflicts",
+      "get_cookie_bot_runs",
+      "run_cookie_bot_now",
+      "cancel_cookie_bot_run",
+      "get_cookie_bot_presets",
+      "get_remote_hours_quota",
+      "get_cookie_bot_usage",
+      "cookie_bot::get_cookie_bot_user_templates",
+      "cookie_bot::create_cookie_bot_user_template",
+      "cookie_bot::update_cookie_bot_user_template",
+      "cookie_bot::delete_cookie_bot_user_template",
+    ],
+  },
  updateContracts: {
    suite: "integrations",
    level: "contract",
@@ -244,13 +244,49 @@ test("real Wayfern fingerprinting, terms, API automation, CDP, cookies, and proc
      profileId: profile.id,
      exitIp: "8.8.8.8",
    });
-    const consistency = await app.invoke(
-      "check_profile_fingerprint_consistency",
-      {
-        profileId: profile.id,
-      },
+    // Pre-launch gate: local-only checks that must answer without starting a
+    // proxy, an Xray worker or the browser.
+    const checks = await app.invoke("get_profile_pre_launch_checks", {
+      profileId: profile.id,
+    });
+    assert.ok(Array.isArray(checks.vpn_extensions));
+    assert.equal(
+      typeof checks.scan_state,
+      "string",
+      "the scan must report whether it saw the whole profile",
+    );
+    assert.equal(typeof checks.consistency, "object");
+    assert.equal(typeof checks.exit_probe_pending, "boolean");
+    assert.equal(typeof checks.exit_measurement_unreliable, "boolean");
+    // This profile has no VPN extension, so nothing may block its launch.
+    assert.equal(
+      checks.vpn_extensions.length,
+      0,
+      "a clean profile must not report a VPN extension",
+    );
+    assert.equal(
+      checks.consent_token,
+      null,
+      "a consent token is only minted when a cached mismatch is blocking",
+    );
+
+    // Acknowledgements are per-profile and must be accepted for both kinds.
+    await app.invoke("ack_launch_gate", {
+      profileId: profile.id,
+      ackFingerprint: false,
+      ackExtensionKeys: ["crx:e2e-nonexistent-extension"],
+    });
+    await app.invoke("ack_launch_gate", {
+      profileId: profile.id,
+      ackFingerprint: true,
+      ackExtensionKeys: [],
+    });
+    assert.match(
+      await app.invokeError("get_profile_pre_launch_checks", {
+        profileId: "00000000-0000-0000-0000-000000000000",
+      }),
+      /PROFILE_NOT_FOUND/,
    );
-    assert.equal(typeof consistency, "object");

    const directProfile = (await app.invoke("list_browser_profiles")).find(
      (item) => item.id === profile.id,
@@ -93,6 +93,34 @@ test("profile, group, proxy, tag, metadata, clone, and bulk-delete lifecycle", a
    });
    assert.ok(cachedValidity === null || cachedValidity.is_valid === false);

+    // Donut accepts one VLESS shape (REALITY + XTLS Vision over TCP). The form
+    // uses this to tell the user WHICH part of their setup is unsupported
+    // instead of implying they mistyped, so the reason must survive the IPC hop.
+    const goodVless =
+      "vless://6d6e21a1-4829-4d2b-bc7f-1b25707b61e4@example.com:443" +
+      "?security=reality&flow=xtls-rprx-vision&encryption=none&type=tcp" +
+      "&sni=a.com&pbk=mQB9jxUDHO7g49VaNXLEdcNQ_jLhTbLolUsMUNwb6W4&sid=00&fp=chrome";
+    assert.equal(
+      await app.invoke("validate_vless_uri", { uri: goodVless }),
+      null,
+    );
+
+    for (const [uri, reason] of [
+      [goodVless.replace("security=reality", "security=tls"), "security"],
+      [goodVless.replace("type=tcp", "type=ws"), "transport"],
+      [goodVless.replace("flow=xtls-rprx-vision", "flow=none"), "flow"],
+    ]) {
+      // invokeError returns the command's error wrapped in a message, so match
+      // rather than JSON.parse the whole string.
+      const error = await app.invokeError("validate_vless_uri", { uri });
+      assert.match(error, /VLESS_CONFIG_INVALID/);
+      assert.match(
+        error,
+        new RegExp(`"reason":"${reason}"`),
+        `expected reason ${reason} for ${uri}, got: ${error}`,
+      );
+    }
+
    const exported = JSON.parse(
      await app.invoke("export_proxies", { format: "json" }),
    );
@@ -316,6 +316,13 @@ test("MCP Streamable HTTP initialization, auth, discovery, calls, and isolated a
      "update_proxy",
      "get_page_content",
      "get_interactive_elements",
+      // The remote loop has to be complete from MCP alone: start a session,
+      // watch it become usable, drive it with the interaction tools above, stop
+      // it. Any one of these missing leaves an agent able to lease a host it
+      // cannot use, or unable to lease one at all.
+      "run_profile_remote",
+      "get_remote_session",
+      "stop_remote_session",
    ]) {
      assert.ok(names.includes(name), `MCP is missing ${name}`);
    }
@@ -652,6 +659,152 @@ test("offline cloud, update, team-lock, trial, and synchronizer contracts are de
      assert.ok(versionStatus && typeof versionStatus === "object");
      assert.equal(typeof (await app.invoke("is_default_browser")), "boolean");

+      // Remote sessions and the cookie bot are brokered by the cloud backend.
+      // Signed out, every one of them must fail as a code the UI can
+      // translate — a raw English string from the transport would reach the
+      // user untranslated, which is what the {"code":…} convention prevents.
+      const notSignedIn = /"code":"CLOUD_NOT_SIGNED_IN"/;
+      const missingProfileId = "00000000-0000-0000-0000-0000000000ff";
+      assert.match(await app.invokeError("list_remote_sessions"), notSignedIn);
+      assert.match(
+        await app.invokeError("get_remote_session", {
+          sessionId: "missing-e2e-session",
+        }),
+        notSignedIn,
+      );
+      assert.match(
+        await app.invokeError("stop_remote_session", {
+          sessionId: "missing-e2e-session",
+        }),
+        notSignedIn,
+      );
+      // The local-launch gate. Nothing has run remotely in this session, so it
+      // is empty — but it must answer, because a UI that cannot read it shows
+      // an enabled Run button over a profile the backend will refuse.
+      const handoff = await app.invoke("get_remote_handoff_states");
+      assert.ok(
+        handoff && typeof handoff === "object" && !Array.isArray(handoff),
+        "the handoff gate must answer with a profile-keyed object",
+      );
+      assert.equal(Object.keys(handoff).length, 0);
+
+      // The transition stream is what the desktop uses instead of polling, so
+      // its subscriber has to start, report itself, and stop on demand. Both
+      // calls are repeated: a second start must not open a second socket, and
+      // a second stop must not fail.
+      assert.equal(await app.invoke("get_remote_session_events_status"), false);
+      await app.invoke("start_remote_session_events");
+      assert.equal(await app.invoke("get_remote_session_events_status"), true);
+      await app.invoke("start_remote_session_events");
+      assert.equal(await app.invoke("get_remote_session_events_status"), true);
+      await app.invoke("stop_remote_session_events");
+      assert.equal(await app.invoke("get_remote_session_events_status"), false);
+      await app.invoke("stop_remote_session_events");
+      assert.equal(await app.invoke("get_remote_session_events_status"), false);
+
+      assert.match(
+        await app.invokeError("get_cookie_bot_schedules", { scope: "mine" }),
+        notSignedIn,
+      );
+      assert.match(
+        await app.invokeError("get_cookie_bot_schedule", {
+          profileId: missingProfileId,
+        }),
+        notSignedIn,
+      );
+      assert.match(
+        await app.invokeError("delete_cookie_bot_schedule", {
+          profileId: missingProfileId,
+        }),
+        notSignedIn,
+      );
+      // Saved site lists are cloud-backed like the schedules above, so they
+      // must refuse the same way rather than appearing to work offline.
+      assert.match(
+        await app.invokeError("get_cookie_bot_user_templates", {}),
+        notSignedIn,
+      );
+      assert.match(
+        await app.invokeError("create_cookie_bot_user_template", {
+          name: "e2e list",
+          sites: ["example.com"],
+        }),
+        notSignedIn,
+      );
+      assert.match(
+        await app.invokeError("update_cookie_bot_user_template", {
+          id: "00000000-0000-0000-0000-000000000000",
+          name: "renamed",
+          sites: null,
+        }),
+        notSignedIn,
+      );
+      assert.match(
+        await app.invokeError("delete_cookie_bot_user_template", {
+          id: "00000000-0000-0000-0000-000000000000",
+        }),
+        notSignedIn,
+      );
+      assert.match(
+        await app.invokeError("check_cookie_bot_conflicts", {
+          profileId: missingProfileId,
+          runAtMinute: 120,
+          daysMask: 127,
+        }),
+        notSignedIn,
+      );
+      assert.match(
+        await app.invokeError("get_cookie_bot_runs", { limit: 10 }),
+        notSignedIn,
+      );
+      assert.match(
+        await app.invokeError("cancel_cookie_bot_run", {
+          runId: "missing-e2e-run",
+        }),
+        notSignedIn,
+      );
+      assert.match(
+        await app.invokeError("get_cookie_bot_presets"),
+        notSignedIn,
+      );
+      assert.match(
+        await app.invokeError("get_remote_hours_quota"),
+        notSignedIn,
+      );
+      assert.match(
+        await app.invokeError("get_cookie_bot_usage", { period: "2026-01" }),
+        notSignedIn,
+      );
+
+      // Enrolling and running act on a profile this machine holds: both are
+      // refused before any network call when it does not exist, so a bad id
+      // can never reach a leased host or an hour of the pooled budget.
+      assert.match(
+        await app.invokeError("save_cookie_bot_schedule", {
+          profileId: missingProfileId,
+          schedule: {
+            profile_name: "E2E missing profile",
+            platform: "windows",
+            enabled: true,
+            run_at_minute: 120,
+            days_mask: 127,
+            timezone: "UTC",
+            preset: "balanced",
+            max_minutes: 60,
+            sites: ["https://example.com"],
+          },
+          acknowledgeConflict: false,
+        }),
+        /"code":"PROFILE_NOT_FOUND"/,
+      );
+      assert.match(
+        await app.invokeError("run_cookie_bot_now", {
+          profileId: missingProfileId,
+          maxMinutes: 30,
+        }),
+        /"code":"PROFILE_NOT_FOUND"/,
+      );
+
      const trial = await app.invoke("get_commercial_trial_status");
      assert.ok(trial && typeof trial === "object");
      await app.invoke("acknowledge_trial_expiration");
@@ -22,6 +22,30 @@ test("fresh app renders, completes onboarding, persists settings, and never touc
        true,
      );

+      // Where the app draws its own titlebar it also owns the window controls,
+      // so it needs the desktop's button layout to know which side they go on.
+      const decorations = await app.invoke("get_window_decoration_layout");
+      assert.equal(typeof decorations?.client_side, "boolean");
+      if (decorations.client_side) {
+        // Only reported where decorations were actually dropped, which is
+        // every Linux session except KDE on Wayland.
+        assert.equal(process.platform, "linux");
+        // `layout` may be null when GtkSettings is unavailable; the frontend
+        // falls back to the default arrangement rather than drawing nothing,
+        // so asserting a string here would be stricter than the contract.
+        if (decorations.layout !== null) {
+          assert.equal(typeof decorations.layout, "string");
+          assert.match(
+            decorations.layout,
+            /close|minimize|maximize/,
+            `layout must name a drawable control, got: ${decorations.layout}`,
+          );
+        }
+      } else {
+        // The platform still draws a titlebar; the app must not draw a second.
+        assert.equal(decorations.layout, null);
+      }
+
      const saved = await app.invoke("save_app_settings", {
        settings: {
          ...initial,
@@ -113,8 +137,12 @@ test("keyboard command palette and major navigation surfaces are operable throug
    assert.match(body, /Settings/i);

    // Exercise native WebDriver element marshalling and click, not just script execution.
+    // Scoped to the open dialog on purpose: on Linux the app draws its own
+    // titlebar, whose "Close window" control appears earlier in the DOM, and
+    // clicking that would exercise the window lifecycle instead of the palette.
    const close = await app.execute(
-      `return [...document.querySelectorAll("button")].find(
+      `const dialog = document.querySelector("[role='dialog']") ?? document;
+       return [...dialog.querySelectorAll("button")].find(
        (button) => /close/i.test(button.getAttribute("aria-label") || button.textContent || "")
      ) ?? null;`,
    );
@@ -474,7 +474,7 @@ test("VLESS proxy form keeps the share URI as one clear, validated input", async
    await app.clickSelector('[aria-label="New proxy"]');
    await app.waitForText("Add Proxy");
    await app.fillSelector("#proxy-name", "E2E VLESS");
-    await chooseSelectOption(app, "#proxy-type", "VLESS · Vision · REALITY");
+    await chooseSelectOption(app, "#proxy-type", "VLESS");

    assert.equal(
      await app.execute(
@@ -512,6 +512,22 @@ test("VLESS proxy form keeps the share URI as one clear, validated input", async
      true,
    );

+    // A well-formed URI for a setup Donut cannot use must say WHICH part is
+    // unsupported, rather than implying the user mistyped it.
+    await app.fillSelector(
+      "#proxy-vless-uri",
+      `${uri.replace("type=tcp", "type=ws")}&path=%2Fray`,
+    );
+    await app.waitFor(
+      () =>
+        app.execute(
+          `return /only|TCP|transport/i.test(
+             document.querySelector("#proxy-vless-uri-help")?.textContent || ""
+           );`,
+        ),
+      { description: "transport-specific unsupported message" },
+    );
+
    await app.fillSelector("#proxy-vless-uri", uri);
    await app.waitFor(
      () =>
@@ -2,7 +2,7 @@
  "name": "donutbrowser",
  "private": true,
  "license": "AGPL-3.0",
-  "version": "0.28.2",
+  "version": "0.29.0",
  "type": "module",
  "scripts": {
    "predev": "pnpm licenses:generate",
@@ -10,8 +10,10 @@
    "prebuild": "pnpm licenses:generate",
    "build": "next build",
    "start": "next start",
-    "test": "pnpm test:themes && pnpm test:licenses && pnpm test:xray-packaging && pnpm test:rust:unit && pnpm test:sync-e2e",
+    "test": "pnpm test:themes && pnpm test:window-decorations && pnpm test:cookie-bot-limits && pnpm test:licenses && pnpm test:xray-packaging && pnpm test:rust:unit && pnpm test:sync-e2e",
    "test:themes": "node --test src/lib/themes.test.mjs",
+    "test:window-decorations": "node --test src/lib/window-decorations.test.mjs",
+    "test:cookie-bot-limits": "node --test src/lib/cookie-bot-limits.test.mjs",
    "test:licenses": "node --test scripts/generate-licenses.test.mjs && node scripts/generate-licenses.mjs --check",
    "test:xray-packaging": "node --test src-tauri/download-xray.test.mjs",
    "licenses:generate": "node scripts/generate-licenses.mjs",
@@ -0,0 +1,34 @@
+# cargo-audit configuration.
+#
+# `cargo audit` reads Cargo.lock, which records optional dependencies even when
+# no enabled feature pulls them into the build. An advisory against such a
+# package fails CI while the vulnerable code is never compiled into the binary.
+# Entries here are for exactly that case and must each carry the evidence.
+#
+# Before adding an ignore, prove the crate is genuinely not built:
+#   cd src-tauri
+#   cargo tree -i <crate> --target all     # must print "nothing to print"
+#   cargo tree --target all | grep <crate> # must find nothing
+# If either finds it, the crate IS in the build and the advisory must be fixed,
+# not ignored.
+
+[advisories]
+ignore = [
+  # RUSTSEC-2026-0235 — rkyv: insufficient archive validation can cause
+  # out-of-bounds reads in archives containing Rc/Arc. Fixed in rkyv >= 0.8.17.
+  #
+  # Not reachable here. rkyv is an OPTIONAL dependency of rust_decimal, which
+  # arrives via tauri-plugin-log -> byte-unit -> rust_decimal. No enabled
+  # feature activates it, so it is present in Cargo.lock but absent from the
+  # build graph. Verified with the two commands above (both find nothing) and
+  # by there being no rkyv artifact in target/.
+  #
+  # There is no upgrade path: rust_decimal 1.42.1 is the newest release and
+  # still pins rkyv 0.7.x, so `cargo update` cannot reach 0.8.17.
+  #
+  # REMOVE THIS as soon as either becomes true:
+  #   - rust_decimal ships a release depending on rkyv >= 0.8.17, or
+  #   - `cargo tree -i rkyv --target all` starts printing a path, which would
+  #     mean the crate is now genuinely compiled and the advisory applies.
+  "RUSTSEC-2026-0235",
+]
@@ -1797,7 +1797,7 @@ dependencies = [

 [[package]]
 name = "donutbrowser"
-version = "0.28.2"
+version = "0.29.0"
 dependencies = [
 "aes 0.9.1",
 "aes-gcm 0.11.0",
@@ -1821,6 +1821,7 @@ dependencies = [
 "flate2",
 "futures-util",
 "globset",
+ "gtk",
 "http-body-util",
 "hyper",
 "hyper-util",
@@ -4092,7 +4093,7 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
 dependencies = [
- "proc-macro-crate 3.5.0",
+ "proc-macro-crate 1.3.1",
 "proc-macro2",
 "quote",
 "syn 2.0.118",
@@ -6860,7 +6861,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
 "once_cell",
 "rustix",
 "windows-sys 0.61.2",
@@ -1,6 +1,6 @@
 [package]
 name = "donutbrowser"
-version = "0.28.2"
+version = "0.29.0"
 description = "Simple Yet Powerful Anti-Detect Browser"
 authors = ["zhom@github"]
 edition = "2021"
@@ -116,6 +116,10 @@ sys-locale = "0.3"
 [target.'cfg(unix)'.dependencies]
 nix = { version = "0.31", features = ["signal", "process"] }

+# Reading the desktop's titlebar button layout for the in-app window controls.
+[target.'cfg(target_os = "linux")'.dependencies]
+gtk = "0.18"
+
 [target.'cfg(target_os = "macos")'.dependencies]
 core-foundation = "0.10"
 objc2 = "0.6.4"
@@ -10,6 +10,7 @@
    "core:event:allow-emit-to",
    "core:event:allow-unlisten",
    "core:window:allow-start-dragging",
+    "core:window:allow-start-resize-dragging",
    "core:window:allow-close",
    "core:window:allow-is-maximized",
    "core:window:allow-minimize",
@@ -231,7 +231,7 @@ mod windows {
  pub fn is_wayfern_version_downloaded(install_dir: &Path) -> bool {
    if wayfern_executable_candidates(install_dir)
      .iter()
-      .any(|exe_path| exe_path.exists() && exe_path.is_file())
+      .any(|exe_path| exe_path.exists() && exe_path.is_file() && has_sibling_dll(exe_path))
    {
      return true;
    }
@@ -239,7 +239,8 @@ mod windows {
    // Check for any .exe file that looks like the browser
    if let Ok(entries) = std::fs::read_dir(install_dir) {
      for entry in entries.flatten() {
-        if is_wayfern_exe(&entry.path()) {
+        let path = entry.path();
+        if is_wayfern_exe(&path) && has_sibling_dll(&path) {
          return true;
        }
      }
@@ -380,6 +381,33 @@ impl BrowserFactory {
  }
 }

+/// Whether the directory holding `exe_path` also contains at least one `.dll`.
+///
+/// A Chromium build on Windows cannot start without its sibling libraries
+/// (`chrome.dll` and friends) and its `.manifest`; a lone `.exe` is a gutted
+/// install, and launching it fails inside the Windows loader with os error
+/// 14001 (`ERROR_SXS_CANT_GEN_ACTCTX`, "side-by-side configuration is
+/// incorrect"). Treating such a directory as downloaded is what made that state
+/// permanent: the registry rescan re-added it as a healthy install, so no
+/// re-download was ever offered. The check is scoped to the executable's own
+/// directory because the payload may sit at the version root or in a `bin/`,
+/// `wayfern/`, `wayfern-win/` or `chrome-win/` subdirectory.
+#[cfg(any(target_os = "windows", test))]
+fn has_sibling_dll(exe_path: &Path) -> bool {
+  let Some(dir) = exe_path.parent() else {
+    return false;
+  };
+  let Ok(entries) = std::fs::read_dir(dir) else {
+    return false;
+  };
+  entries.flatten().any(|entry| {
+    entry
+      .path()
+      .extension()
+      .is_some_and(|ext| ext.eq_ignore_ascii_case("dll"))
+  })
+}
+
 /// Check if a file is a valid PE executable by reading its magic bytes (MZ).
 /// Returns false for archive files (.zip starts with PK, etc.) that were
 /// incorrectly named with a .exe extension.
@@ -575,6 +603,58 @@ mod tests {
    assert!(exe.ends_with(std::path::Path::new("wayfern-win").join("wayfern.exe")));
  }

+  /// A gutted Windows install (the `.exe` survived a cleanup pass that deleted
+  /// every `.dll` and the `.manifest`) must not read as downloaded, otherwise it
+  /// is re-registered as healthy and launching it fails with os error 14001.
+  /// Runs on every platform because the predicate is platform-independent.
+  #[test]
+  fn test_lone_exe_is_not_a_valid_windows_install() {
+    use tempfile::TempDir;
+    let temp = TempDir::new().unwrap();
+    let install_dir = temp.path();
+
+    let exe = install_dir.join("chrome.exe");
+    std::fs::File::create(&exe).unwrap();
+    assert!(
+      !has_sibling_dll(&exe),
+      "an .exe with no sibling .dll is a gutted install"
+    );
+
+    std::fs::File::create(install_dir.join("chrome.dll")).unwrap();
+    assert!(
+      has_sibling_dll(&exe),
+      "an .exe next to its libraries is a complete install"
+    );
+  }
+
+  /// The DLL check is scoped to the executable's own directory, so the nested
+  /// `chrome-win/` and `wayfern-win/` layouts are not falsely rejected because
+  /// the version root happens to hold no libraries.
+  #[test]
+  fn test_sibling_dll_check_is_scoped_to_the_executable_directory() {
+    use tempfile::TempDir;
+    let temp = TempDir::new().unwrap();
+    let install_dir = temp.path();
+
+    let subdir = install_dir.join("chrome-win");
+    std::fs::create_dir_all(&subdir).unwrap();
+    let exe = subdir.join("chrome.exe");
+    std::fs::File::create(&exe).unwrap();
+    std::fs::File::create(subdir.join("CHROME.DLL")).unwrap();
+
+    assert!(
+      has_sibling_dll(&exe),
+      "libraries beside the executable count regardless of case or nesting"
+    );
+
+    let root_exe = install_dir.join("chrome.exe");
+    std::fs::File::create(&root_exe).unwrap();
+    assert!(
+      !has_sibling_dll(&root_exe),
+      "libraries in a sibling subdirectory must not validate a bare root .exe"
+    );
+  }
+
  #[test]
  fn test_proxy_settings_serialization() {
    let proxy = ProxySettings {
@@ -15,6 +15,13 @@ static PROFILE_LAUNCH_LOCKS: LazyLock<
  tokio::sync::Mutex<HashMap<String, Arc<tokio::sync::Mutex<()>>>>,
 > = LazyLock::new(|| tokio::sync::Mutex::new(HashMap::new()));

+/// How long a remote navigation waits for the page to settle.
+///
+/// A relayed round trip crosses two networks and the page load itself happens
+/// on hardware in another country, so this is deliberately the same budget the
+/// automation tools give a navigation rather than a loopback-sized one.
+const REMOTE_NAVIGATE_TIMEOUT_SECS: u64 = 30;
+
 async fn lock_profile_launch(profile_id: &str) -> tokio::sync::OwnedMutexGuard<()> {
  let lock = {
    let mut locks = PROFILE_LAUNCH_LOCKS.lock().await;
@@ -165,12 +172,15 @@ impl BrowserRunner {
    });
  }

+  /// Resolve the upstream a launch will use.
+  ///
+  /// Deliberately does NOT fire the launch hook: that moved below the gate, so
+  /// a launch the user blocks and then retries calls the user's webhook once
+  /// rather than once per attempt.
  async fn resolve_launch_proxy(
    &self,
    profile: &BrowserProfile,
  ) -> Result<Option<ProxySettings>, String> {
-    Self::fire_launch_hook(profile);
-
    self
      .resolve_proxy_with_refresh(profile.proxy_id.as_ref(), Some(&profile.id.to_string()))
      .await
@@ -203,9 +213,9 @@ impl BrowserRunner {
    app_handle: tauri::AppHandle,
    profile: &BrowserProfile,
    url: Option<String>,
-    _local_proxy_settings: Option<&ProxySettings>,
    remote_debugging_port: Option<u16>,
    headless: bool,
+    gate: &crate::launch_gate::FingerprintGate,
  ) -> Result<BrowserProfile, Box<dyn std::error::Error + Send + Sync>> {
    // Handle Wayfern profiles using WayfernManager
    if profile.browser == "wayfern" {
@@ -270,12 +280,61 @@ impl BrowserRunner {
        upstream_proxy = Some(worker.local_proxy_settings());
      }

+      /// Stops a VPN worker this launch started, if the launch then fails.
+      ///
+      /// `created` is the whole point: `start_vpn_worker` reuses a live worker
+      /// for the same VPN, so an unconditional stop would sever the tunnel a
+      /// *different* profile is browsing through the moment this one is
+      /// cancelled. The in-use check is a second belt for a worker adopted by a
+      /// browser that started between the two points.
+      struct VpnLaunchGuard {
+        worker_id: Option<String>,
+        vpn_id: String,
+        created: bool,
+        profile_name: String,
+      }
+      impl Drop for VpnLaunchGuard {
+        fn drop(&mut self) {
+          let Some(worker_id) = self.worker_id.take() else {
+            return;
+          };
+          if !self.created {
+            return;
+          }
+          log::warn!(
+            "Launch failed after VPN worker start for profile {}; stopping worker",
+            self.profile_name
+          );
+          let vpn_id = self.vpn_id.clone();
+          tauri::async_runtime::spawn(async move {
+            // Serialize against worker startup for the whole check-then-stop.
+            // Without it another launch can adopt this worker between the
+            // in-use check and the kill, and lose its tunnel a moment later.
+            let _adopt_guard = crate::vpn_worker_runner::lock_vpn_starts().await;
+            if crate::vpn_worker_runner::vpn_id_in_use_by_running_browser(&vpn_id) {
+              log::info!("VPN {vpn_id} is still in use by a running browser; leaving it up");
+              return;
+            }
+            if let Err(error) = crate::vpn_worker_runner::stop_vpn_worker(&worker_id).await {
+              log::warn!("Failed to stop VPN worker after failed launch: {error}");
+            }
+          });
+        }
+      }
+      let mut vpn_launch_guard: Option<VpnLaunchGuard> = None;
+
      // If profile has a VPN instead of proxy, start VPN worker and use it as upstream
      if upstream_proxy.is_none() {
        if let Some(ref vpn_id) = profile.vpn_id {
-          match crate::vpn_worker_runner::start_vpn_worker(vpn_id).await {
-            Ok(vpn_worker) => {
-              if let Some(port) = vpn_worker.local_port {
+          match crate::vpn_worker_runner::start_vpn_worker_tracked(vpn_id).await {
+            Ok(started) => {
+              vpn_launch_guard = Some(VpnLaunchGuard {
+                worker_id: Some(started.config.id.clone()),
+                vpn_id: vpn_id.clone(),
+                created: started.created,
+                profile_name: profile.name.clone(),
+              });
+              if let Some(port) = started.config.local_port {
                upstream_proxy = Some(ProxySettings {
                  proxy_type: "socks5".to_string(),
                  host: "127.0.0.1".to_string(),
@@ -288,12 +347,33 @@ impl BrowserRunner {
              }
            }
            Err(e) => {
-              return Err(format!("Failed to start VPN worker: {e}").into());
+              return Err(crate::backend_error_with_detail("VPN_WORKER_START_FAILED", e).into());
            }
          }
        }
      }

+      // The gate sits exactly here on purpose. By this line the upstream is
+      // fully normalized across all three transports — VLESS and VPN are
+      // authenticated loopback workers, a stored proxy is its resolved
+      // settings — so one probe covers every profile. And it is still ahead of
+      // the local proxy worker, the decrypted profile copy, the extension
+      // unpack, and the browser process, so a blocked launch has nothing to
+      // undo beyond the two workers whose guards are already armed above.
+      //
+      // Run concurrently with the blocklist compile so the added wall clock is
+      // max(), not sum().
+      let (blocklist, gate_result) = tokio::join!(
+        Self::resolve_blocklist_file(profile),
+        crate::launch_gate::enforce_fingerprint_gate(profile, upstream_proxy.as_ref(), gate),
+      );
+      gate_result.map_err(|e| -> Box<dyn std::error::Error + Send + Sync> { e.into() })?;
+      let (blocklist_file, dns_allowlist_mode) = blocklist?;
+
+      // Past the gate: this launch is really happening, so tell the user's
+      // webhook exactly once.
+      Self::fire_launch_hook(profile);
+
      log::info!(
        "Starting local proxy for Wayfern profile: {} (upstream: {})",
        profile.name,
@@ -306,7 +386,6 @@ impl BrowserRunner {
      // Start the proxy and get local proxy settings
      // If proxy startup fails, DO NOT launch Wayfern - it requires local proxy
      let profile_id_str = profile.id.to_string();
-      let (blocklist_file, dns_allowlist_mode) = Self::resolve_blocklist_file(profile).await?;
      // Unique per-launch key: a shared constant here would let concurrent
      // launches overwrite each other's active_proxies entry, ending with one
      // browser's worker tracked under another browser's PID.
@@ -546,11 +625,14 @@ impl BrowserRunner {
        }
      }

-      // The browser and both detached routing workers now share one verified
+      // The browser and every detached routing worker now share one verified
      // process identity, so later profile-persistence failures must not tear
      // down a live route.
      proxy_launch_guard.armed = false;
      xray_launch_guard.worker_id = None;
+      if let Some(guard) = vpn_launch_guard.as_mut() {
+        guard.worker_id = None;
+      }

      // Wayfern.setFingerprint echoes back the fingerprint the browser actually
      // applied, which may be UPGRADED from the stored one (e.g. when the
@@ -687,6 +769,7 @@ impl BrowserRunner {
    url: Option<String>,
    remote_debugging_port: Option<u16>,
    headless: bool,
+    gate: &crate::launch_gate::FingerprintGate,
  ) -> Result<BrowserProfile, Box<dyn std::error::Error + Send + Sync>> {
    // Wayfern starts (and PID-reconciles) its own local proxy
    // inside `launch_browser_internal`, so we hand it None here rather than
@@ -696,9 +779,9 @@ impl BrowserRunner {
        app_handle,
        profile,
        url,
-        None,
        remote_debugging_port,
        headless,
+        gate,
      )
      .await
  }
@@ -709,6 +792,7 @@ impl BrowserRunner {
    profile: &BrowserProfile,
    url: Option<String>,
    internal_proxy_settings: Option<&ProxySettings>,
+    gate: &crate::launch_gate::FingerprintGate,
  ) -> Result<BrowserProfile, Box<dyn std::error::Error + Send + Sync>> {
    log::info!(
      "launch_or_open_url called for profile: {} (ID: {})",
@@ -789,14 +873,7 @@ impl BrowserRunner {
    } else {
      log::info!("Launching new browser instance - browser not running");
      self
-        .launch_browser_internal(
-          app_handle.clone(),
-          &final_profile,
-          url,
-          internal_proxy_settings,
-          None,
-          false,
-        )
+        .launch_browser_internal(app_handle.clone(), &final_profile, url, None, false, gate)
        .await
    }
  }
@@ -829,11 +906,64 @@ impl BrowserRunner {
    profile: &BrowserProfile,
  ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    let _profile_launch_guard = lock_profile_launch(&profile.id.to_string()).await;
+
+    // "Stop this profile" has to mean the browser that is actually running, and
+    // for a profile on the leased fleet that browser is not on this machine.
+    // Without this, stopping reported success, killed nothing, and left the
+    // session running to its two-hour cap — billing the user for every minute
+    // and holding their profile lock the whole time.
+    if self.stop_remote_session_for(&app_handle, profile).await? {
+      return Ok(());
+    }
+
    self
      .kill_browser_process_unlocked(app_handle, profile)
      .await
  }

+  /// Stop this profile's fleet session, if it has one. Returns whether it did.
+  ///
+  /// Guarded on there being no local process so a locally running profile never
+  /// pays for the lookup, exactly as the open-URL path is: the profile lock
+  /// makes a local and a remote browser mutually exclusive.
+  async fn stop_remote_session_for(
+    &self,
+    app_handle: &tauri::AppHandle,
+    profile: &BrowserProfile,
+  ) -> Result<bool, Box<dyn std::error::Error + Send + Sync>> {
+    if profile.process_id.is_some() {
+      return Ok(false);
+    }
+    let profile_id = profile.id.to_string();
+    let Some(session_id) = crate::remote_handoff::running_session_for_profile(&profile_id) else {
+      return Ok(false);
+    };
+
+    log::info!(
+      "Stopping remote session {session_id} for profile {} ({profile_id})",
+      profile.name
+    );
+    crate::remote_session::end_remote_session(&session_id)
+      .await
+      .map_err(|e| -> Box<dyn std::error::Error + Send + Sync> {
+        // Surfaced rather than swallowed. The backend refuses to retire a
+        // session it could not stop on the fleet, so a failure here means the
+        // browser is STILL RUNNING; reporting success would tell the user their
+        // profile is free when a host is still writing to it.
+        log::warn!("Failed to stop remote session {session_id}: {e}");
+        e.to_error_json().into()
+      })?;
+
+    // The session is down and its work is in cloud storage. This is what puts
+    // the profile into "pending sync" and starts the pull, so the user is not
+    // handed back a profile directory that predates the session they just ran.
+    //
+    // The session's own profile lock is released by the backend when it retires
+    // the row; nothing is released from here, because this client never held it.
+    crate::remote_session::note_session_stopped(app_handle, &session_id);
+    Ok(true)
+  }
+
  async fn kill_browser_process_unlocked(
    &self,
    app_handle: tauri::AppHandle,
@@ -1210,6 +1340,7 @@ impl BrowserRunner {
    app_handle: tauri::AppHandle,
    profile_id: String,
    url: String,
+    gate: crate::launch_gate::FingerprintGate,
  ) -> Result<(), String> {
    // Get the profile by name
    let profiles = self
@@ -1222,6 +1353,29 @@ impl BrowserRunner {
      .ok_or_else(|| format!("Profile '{profile_id}' not found"))?;
    let _profile_launch_guard = lock_profile_launch(&profile.id.to_string()).await;

+    // A profile already open on the leased fleet is driven, not launched. This
+    // sits above the cross-OS guard on purpose: a Windows profile cannot run on
+    // this Mac, which is the whole reason it is running remotely, and refusing
+    // to point it at a URL for that reason would make the remote session
+    // unusable from the one endpoint that exists to use it.
+    //
+    // Guarded on there being no local process, so a profile running here never
+    // pays for the lookup: a local launch records a pid, and the profile lock
+    // keeps a local and a remote session mutually exclusive.
+    if profile.process_id.is_none() {
+      if let Ok(target) = crate::cdp_target::resolve(&profile).await {
+        if target.is_remote() {
+          log::info!("Opening URL through {}", target.describe());
+          return crate::cdp_target::navigate(&target, &url, REMOTE_NAVIGATE_TIMEOUT_SECS)
+            .await
+            .map_err(|e| {
+              log::warn!("Failed to open a URL on the remote browser: {e}");
+              format!("Failed to open URL with profile: {e}")
+            });
+        }
+      }
+    }
+
    if profile.is_cross_os() {
      return Err(format!(
        "Cannot open URL with profile '{}': this profile was created on {} and cannot be used on a different operating system",
@@ -1230,19 +1384,36 @@ impl BrowserRunner {
      ));
    }

+    // Past this point a local browser is about to be launched, and until now
+    // this was the ONE launch path that took neither the profile lock nor any
+    // notice of the fleet. A remote session whose state could not be read (a
+    // dropped event stream plus an unreachable backend) fell straight through
+    // to a local launch on a profile a host was writing to.
+    crate::remote_handoff::ensure_local_launch_allowed(&profile.id.to_string())?;
+    let acquired_team_lock = crate::team_lock::acquire_team_lock_if_needed(&profile).await?;
+
    log::info!("Opening URL with selected profile");

    // Use launch_or_open_url which handles both launching new instances and opening in existing ones
-    self
-      .launch_or_open_url(app_handle, &profile, Some(url.clone()), None)
+    if let Err(e) = self
+      .launch_or_open_url(app_handle, &profile, Some(url.clone()), None, &gate)
      .await
-      .map_err(|e| {
-        log::info!(
-          "Failed to open URL with selected profile: {}",
-          crate::log_redaction::text(&e.to_string())
-        );
-        format!("Failed to open URL with profile: {e}")
-      })?;
+    {
+      log::info!(
+        "Failed to open URL with selected profile: {}",
+        crate::log_redaction::text(&e.to_string())
+      );
+      // This path takes the team lock too, and a blocked launch never records a
+      // process_id for the status sweep to release it from.
+      unwind_launch(&profile, acquired_team_lock).await;
+      // Pass structured errors through untouched: the gate's block carries the
+      // mismatch detail the dialog renders, and wrapping it in English would
+      // reach the user as raw JSON.
+      return Err(crate::wrap_backend_error(
+        e,
+        "Failed to open URL with profile",
+      ));
+    }

    log::info!("Successfully opened URL with selected profile");
    Ok(())
@@ -1254,18 +1425,115 @@ pub async fn launch_browser_profile(
  app_handle: tauri::AppHandle,
  profile: BrowserProfile,
  url: Option<String>,
+  consent_token: Option<String>,
 ) -> Result<BrowserProfile, String> {
-  launch_browser_profile_impl(app_handle, profile, url, None, false, false).await
+  let options = LaunchOptions {
+    gate: match consent_token {
+      Some(token) => crate::launch_gate::FingerprintGate::Consented(token),
+      None => crate::launch_gate::FingerprintGate::Enforce,
+    },
+    ..Default::default()
+  };
+  launch_browser_profile_impl(app_handle, profile, url, options).await
+}
+
+/// How one launch should behave.
+///
+/// A struct rather than four trailing positional arguments: `headless` and
+/// `force_new` are already passed adjacently as bare booleans, so a fifth would
+/// compile everywhere while silently inverting behavior wherever the order was
+/// got wrong.
+#[derive(Debug, Clone, Default)]
+pub struct LaunchOptions {
+  pub remote_debugging_port: Option<u16>,
+  pub headless: bool,
+  pub force_new: bool,
+  pub gate: crate::launch_gate::FingerprintGate,
+}
+
+impl LaunchOptions {
+  /// Automation defaults: report, never block, never probe. A headless client
+  /// has no dialog to answer and cannot regenerate its fingerprint mid-run, so
+  /// a hard failure would turn a warning into an outage for a whole fleet.
+  pub fn automation(remote_debugging_port: Option<u16>, headless: bool) -> Self {
+    Self {
+      remote_debugging_port,
+      headless,
+      force_new: true,
+      gate: crate::launch_gate::FingerprintGate::Advisory,
+    }
+  }
+}
+
+/// Release the team lock a launch attempt took before it failed.
+///
+/// Until the gate existed, failing here was rare enough that leaking was merely
+/// untidy. Cancelling a blocked launch is now an ordinary outcome, and the lock
+/// renews itself on a 30s heartbeat while only ever being released via a stored
+/// `process_id` — which a launch that never spawned does not have. So a leak
+/// leaves the profile reading as locked to the whole team until the app quits.
+///
+/// `acquired` is threaded from `acquire_team_lock_if_needed` so this releases
+/// only what this call took, never a lock a REST handler up the stack owns.
+///
+/// Several of these error paths are reachable while a browser for the profile
+/// is genuinely still running — `PROFILE_RUNNING`, or a failure to open a URL
+/// in an existing window. That browser owns the lock and the running mark, so
+/// releasing either would strand it: the team would see the profile as free
+/// while someone is typing in it, and `mark_profile_stopped` would queue a sync
+/// of a profile directory being written to. Hence the liveness check.
+async fn unwind_launch(profile: &BrowserProfile, acquired_team_lock: bool) {
+  if browser_is_running_for(&profile.id.to_string()) {
+    log::debug!(
+      "Not unwinding launch state for {}: a browser is still running for it",
+      profile.name
+    );
+    return;
+  }
+
+  if acquired_team_lock {
+    crate::team_lock::release_team_lock_if_needed(profile).await;
+  }
+  // Otherwise this mark sticks for the rest of the session and silently defers
+  // every sync of the profile. Safe here precisely because nothing is running.
+  if let Some(scheduler) = crate::sync::get_global_scheduler() {
+    scheduler
+      .mark_profile_stopped(&profile.id.to_string())
+      .await;
+  }
+}
+
+/// Whether a live browser process is recorded for this profile right now.
+/// Re-read from disk: the caller's copy predates the launch attempt.
+fn browser_is_running_for(profile_id: &str) -> bool {
+  BrowserRunner::instance()
+    .profile_manager
+    .list_profiles()
+    .ok()
+    .and_then(|profiles| {
+      profiles
+        .into_iter()
+        .find(|p| p.id.to_string() == profile_id)
+        .map(|p| {
+          p.process_id
+            .is_some_and(crate::proxy_storage::is_process_running)
+        })
+    })
+    .unwrap_or(false)
 }

 pub async fn launch_browser_profile_impl(
  app_handle: tauri::AppHandle,
  profile: BrowserProfile,
  url: Option<String>,
-  remote_debugging_port: Option<u16>,
-  headless: bool,
-  force_new: bool,
+  options: LaunchOptions,
 ) -> Result<BrowserProfile, String> {
+  let LaunchOptions {
+    remote_debugging_port,
+    headless,
+    force_new,
+    gate,
+  } = options;
  log::info!(
    "Launch request received for profile: {} (ID: {})",
    profile.name,
@@ -1281,8 +1549,14 @@ pub async fn launch_browser_profile_impl(
    ));
  }

+  // Refuse a launch that would run over work a remote session has not handed
+  // back yet. Checked before the profile lock because it answers without a
+  // round trip and because it stays true after the session's lock is released:
+  // the lock protects the browser, this protects the bytes it wrote.
+  crate::remote_handoff::ensure_local_launch_allowed(&profile.id.to_string())?;
+
  // Team lock check: if profile is sync-enabled and user is on a team, acquire lock
-  crate::team_lock::acquire_team_lock_if_needed(&profile).await?;
+  let acquired_team_lock = crate::team_lock::acquire_team_lock_if_needed(&profile).await?;

  // Notify sync scheduler that profile is now running and queue sync for when it stops
  if let Some(scheduler) = crate::sync::get_global_scheduler() {
@@ -1306,6 +1580,7 @@ pub async fn launch_browser_profile_impl(
      .find(|p| p.id == profile.id)
      .unwrap_or_else(|| profile.clone()),
    Err(e) => {
+      unwind_launch(&profile, acquired_team_lock).await;
      return Err(e);
    }
  };
@@ -1322,15 +1597,24 @@ pub async fn launch_browser_profile_impl(
    profile_for_launch.id
  );

-  if force_new
-    && browser_runner
+  if force_new {
+    let already_running = match browser_runner
      .check_browser_status(app_handle.clone(), &profile_for_launch)
      .await
-      .map_err(|error| {
-        crate::wrap_backend_error(error, "Failed to check browser status before launch")
-      })?
-  {
-    return Err(crate::backend_error("PROFILE_RUNNING"));
+    {
+      Ok(running) => running,
+      Err(error) => {
+        unwind_launch(&profile, acquired_team_lock).await;
+        return Err(crate::wrap_backend_error(
+          error,
+          "Failed to check browser status before launch",
+        ));
+      }
+    };
+    if already_running {
+      unwind_launch(&profile, acquired_team_lock).await;
+      return Err(crate::backend_error("PROFILE_RUNNING"));
+    }
  }

  // Launch browser or open URL in existing instance. Wayfern starts its
@@ -1348,39 +1632,54 @@ pub async fn launch_browser_profile_impl(
        url,
        remote_debugging_port,
        headless,
+        &gate,
      )
      .await
  } else {
    browser_runner
-      .launch_or_open_url(app_handle.clone(), &profile_for_launch, url, None)
+      .launch_or_open_url(app_handle.clone(), &profile_for_launch, url, None, &gate)
      .await
  };
-  let updated_profile = launch_result.map_err(|e| {
-    log::info!("Browser launch failed for profile: {}, error: {}", profile_for_launch.name, e);
+  let updated_profile = match launch_result {
+    Ok(updated) => updated,
+    Err(e) => {
+      log::info!(
+        "Browser launch failed for profile: {}, error: {}",
+        profile_for_launch.name,
+        e
+      );

-    // Emit a failure event to clear loading states in the frontend
-    #[derive(serde::Serialize)]
-    struct RunningChangedPayload {
-      id: String,
-      is_running: bool,
-    }
-    let payload = RunningChangedPayload {
-      id: profile_for_launch.id.to_string(),
-      is_running: false,
-    };
-
-    if let Err(e) = events::emit("profile-running-changed", &payload) {
-      log::warn!("Warning: Failed to emit profile running changed event: {e}");
-    }
-
-    // Check if this is an architecture compatibility issue
-    if let Some(io_error) = e.downcast_ref::<std::io::Error>() {
-      if io_error.kind() == std::io::ErrorKind::Other && io_error.to_string().contains("Exec format error") {
-        return format!("Failed to launch browser: Executable format error. This browser version is not compatible with your system architecture ({}). Please try a different browser or version that supports your platform.", std::env::consts::ARCH);
+      // Emit a failure event to clear loading states in the frontend
+      #[derive(serde::Serialize)]
+      struct RunningChangedPayload {
+        id: String,
+        is_running: bool,
      }
+      let payload = RunningChangedPayload {
+        id: profile_for_launch.id.to_string(),
+        is_running: false,
+      };
+
+      if let Err(e) = events::emit("profile-running-changed", &payload) {
+        log::warn!("Warning: Failed to emit profile running changed event: {e}");
+      }
+
+      unwind_launch(&profile, acquired_team_lock).await;
+
+      // Check if this is an architecture compatibility issue
+      if let Some(io_error) = e.downcast_ref::<std::io::Error>() {
+        if io_error.kind() == std::io::ErrorKind::Other
+          && io_error.to_string().contains("Exec format error")
+        {
+          return Err(format!("Failed to launch browser: Executable format error. This browser version is not compatible with your system architecture ({}). Please try a different browser or version that supports your platform.", std::env::consts::ARCH));
+        }
+      }
+      return Err(crate::wrap_backend_error(
+        e,
+        "Failed to launch browser or open URL",
+      ));
    }
-    crate::wrap_backend_error(e, "Failed to launch browser or open URL")
-  })?;
+  };

  log::info!(
    "Browser launch completed for profile: {} (ID: {})",
@@ -1513,10 +1812,15 @@ pub async fn open_url_with_profile(
  app_handle: tauri::AppHandle,
  profile_id: String,
  url: String,
+  consent_token: Option<String>,
 ) -> Result<(), String> {
  let browser_runner = BrowserRunner::instance();
+  let gate = match consent_token {
+    Some(token) => crate::launch_gate::FingerprintGate::Consented(token),
+    None => crate::launch_gate::FingerprintGate::Enforce,
+  };
  browser_runner
-    .open_url_with_profile(app_handle, profile_id, url)
+    .open_url_with_profile(app_handle, profile_id, url, gate)
    .await
 }

@@ -28,9 +28,9 @@ const DEFAULT_REQUESTS_PER_HOUR: i64 = 100;

 /// Capability + limit set the account is entitled to, derived from its plan.
 /// Mirrors `apps/backend/src/plans/entitlements.ts`. Features are gated on these
-/// flags instead of a single "is paid?" boolean, so a plan like the future
-/// "starter" tier (cross-OS fingerprints + cloud backup, no automation) is just
-/// data here.
+/// flags instead of a single "is paid?" boolean, so a plan like "solo" (cloud
+/// backup + nightly cookie bot, no automation, no fingerprint editing, no
+/// hands-on remote session) is just data here.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Entitlements {
  #[serde(default)]
@@ -43,10 +43,26 @@ pub struct Entitlements {
  pub cloud_backup: bool,
  #[serde(rename = "teamCollaboration", default)]
  pub team_collaboration: bool,
+  /// Overnight profile warming on a leased remote host. Present on the wire
+  /// since the cookie-bot release; a field missing here is silently dropped on
+  /// the way to the UI, which is why every mirror of this struct has to move
+  /// together.
+  #[serde(rename = "cookieBot", default)]
+  pub cookie_bot: bool,
+  /// Whether the plan may open a HANDS-ON remote session. Distinct from
+  /// `cookie_bot`: solo funds a nightly bot out of its remote hours but may not
+  /// drive a remote browser itself, so anything that offers interactive remote
+  /// control must read THIS rather than `remote_browser_hours > 0`.
+  #[serde(rename = "remoteInteractive", default)]
+  pub remote_interactive: bool,
  #[serde(rename = "profileLimit", default)]
  pub profile_limit: i64,
  #[serde(rename = "requestsPerHour", default)]
  pub requests_per_hour: i64,
+  /// Per-seat monthly remote-session allowance. Reporting only — a team pools
+  /// it across seats, so the spendable figure comes from the quota route.
+  #[serde(rename = "remoteBrowserHours", default)]
+  pub remote_browser_hours: i64,
 }

 /// Local fallback mirror of the backend plan -> capability matrix, used only when
@@ -66,15 +82,30 @@ fn derive_entitlements(
      cross_os_fingerprints: false,
      cloud_backup: false,
      team_collaboration: false,
+      cookie_bot: false,
+      remote_interactive: false,
      profile_limit: 0,
      requests_per_hour: 0,
+      remote_browser_hours: 0,
    };
  }
-  // pro and any unrecognized paid plan -> pro-level (never team).
-  let (browser_automation, cross_os_fingerprints, cloud_backup, team_collaboration) = match plan {
-    "starter" => (false, true, true, false),
-    "team" | "enterprise" => (true, true, true, true),
-    _ => (true, true, true, false),
+  // Tuple order: (browser_automation, cross_os_fingerprints, cloud_backup,
+  // team_collaboration, cookie_bot, remote_interactive).
+  //
+  // pro and any unrecognized paid plan -> pro-level (never team). Solo is the
+  // one row where cookie_bot and browser_automation disagree, which is why
+  // cookie_bot can no longer be derived from browser_automation below.
+  let (
+    browser_automation,
+    cross_os_fingerprints,
+    cloud_backup,
+    team_collaboration,
+    cookie_bot,
+    remote_interactive,
+  ) = match plan {
+    "solo" => (false, false, true, false, true, false),
+    "team" | "enterprise" => (true, true, true, true, true, true),
+    _ => (true, true, true, false, true, true),
  };
  Entitlements {
    active,
@@ -82,12 +113,17 @@ fn derive_entitlements(
    cross_os_fingerprints,
    cloud_backup,
    team_collaboration,
+    cookie_bot,
+    remote_interactive,
    profile_limit,
    requests_per_hour: if browser_automation {
      DEFAULT_REQUESTS_PER_HOUR
    } else {
      0
    },
+    // Deliberately 0 in the fallback: the allowance is the server's to state and
+    // guessing it here would show a customer hours they may not have.
+    remote_browser_hours: 0,
  }
 }

@@ -137,6 +173,13 @@ impl CloudUser {
  /// locally from the plan fields (keeps older cached state / backends working).
  pub fn entitlements(&self) -> Entitlements {
    if let Some(e) = &self.entitlements {
+      // Returned verbatim, INCLUDING the `#[serde(default)]` false that a
+      // backend older than this release leaves on `cookie_bot` /
+      // `remote_interactive`. Repairing it here is impossible anyway — serde's
+      // default erases the difference between "sent false" and "not sent" — and
+      // it is not this layer's job: nothing in Rust gates on either flag, and
+      // `getEntitlements()` in `src/lib/entitlements.ts` fills both gaps at the
+      // single point every UI consumer already goes through.
      return e.clone();
    }
    derive_entitlements(
@@ -776,6 +819,21 @@ impl CloudAuthManager {
  }

  /// Launch/drive profiles programmatically (local API + MCP automation).
+  /// Whether this account may run the nightly Cookie Bot.
+  ///
+  /// NOT `can_use_browser_automation`. Solo is exactly the plan where the two
+  /// disagree — it pays for a nightly bot and has `browser_automation: false` —
+  /// so gating the bot on automation refused a Solo customer the one feature
+  /// their plan is sold on, and answered 402 while their scheduled runs kept
+  /// working server-side.
+  pub async fn can_use_cookie_bot(&self) -> bool {
+    self
+      .entitlements()
+      .await
+      .map(|e| e.cookie_bot)
+      .unwrap_or(false)
+  }
+
  pub async fn can_use_browser_automation(&self) -> bool {
    #[cfg(feature = "e2e")]
    if crate::e2e_automation_enabled()
@@ -0,0 +1,438 @@
+//! Turning a donutbrowser-infra HTTP failure into a stable, translatable code.
+//!
+//! Every cloud transport in this crate flattens its failures through
+//! `api_call_with_retry`, which needs a `String` so it can sniff for a 401.
+//! That flattening loses the status, and the body it carries is the backend's
+//! own English — which would reach the user untranslated, the exact bug the
+//! `{"code":…}` convention exists to prevent.
+//!
+//! So the backend sends a machine code, this module recovers it, and the
+//! frontend resolves it through `translateBackendError`. When the backend
+//! sends something else (a proxy error page, a gateway 502), the status alone
+//! still picks a code the user can act on.
+
+use serde_json::Value;
+use std::collections::BTreeMap;
+
+/// A backend failure reduced to the shape `translateBackendError` consumes.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct BackendFailure {
+  /// The HTTP status it came from. 0 when the request never got that far.
+  pub status: u16,
+  pub code: String,
+  pub params: BTreeMap<String, String>,
+}
+
+impl BackendFailure {
+  /// Render as the `{"code":…,"params":{…}}` string a Tauri command returns.
+  pub fn to_error_json(&self) -> String {
+    let mut object = serde_json::Map::new();
+    object.insert("code".to_string(), Value::String(self.code.clone()));
+    if !self.params.is_empty() {
+      let params = self
+        .params
+        .iter()
+        .map(|(k, v)| (k.clone(), Value::String(v.clone())))
+        .collect::<serde_json::Map<_, _>>();
+      object.insert("params".to_string(), Value::Object(params));
+    }
+    Value::Object(object).to_string()
+  }
+}
+
+/// Which code a status maps to when the body carries none.
+///
+/// 404 and 409 mean different things per route — "no schedule for this
+/// profile" and "that run id is not yours" are both 404 — so each caller
+/// supplies its own, rather than every route sharing one vague code.
+#[derive(Debug, Clone, Copy)]
+pub struct FailureCodes {
+  pub bad_request: &'static str,
+  pub forbidden: &'static str,
+  pub not_found: &'static str,
+  pub conflict: &'static str,
+}
+
+/// The desktop has no cloud session at all.
+pub const NOT_SIGNED_IN: &str = "CLOUD_NOT_SIGNED_IN";
+/// The request never reached donutbrowser-infra.
+pub const UNREACHABLE: &str = "CLOUD_UNREACHABLE";
+/// The backend answered, but with nothing the user can act on.
+pub const UNAVAILABLE: &str = "CLOUD_REQUEST_FAILED";
+/// Too many automation requests, backend side.
+pub const RATE_LIMITED: &str = "REMOTE_RATE_LIMITED";
+/// No host of the profile's OS has a free slot.
+pub const NO_CAPACITY: &str = "REMOTE_NO_CAPACITY";
+
+/// Recover `(status, body)` from the string `api_call_with_retry` hands back.
+///
+/// The transports encode a non-2xx as `"(503) no macos host free"` so the
+/// helper can spot a 401 and still let the caller recover the kind. Anything
+/// that is not that shape is a transport failure, not a status.
+pub fn split_status(message: &str) -> Option<(u16, &str)> {
+  let rest = message.strip_prefix('(')?;
+  let (code, tail) = rest.split_once(')')?;
+  let status = code.trim().parse::<u16>().ok()?;
+  Some((status, tail.trim()))
+}
+
+/// Classify one HTTP failure.
+pub fn classify(status: u16, body: &str, codes: FailureCodes) -> BackendFailure {
+  if let Some(failure) = from_body(status, body) {
+    return failure;
+  }
+  BackendFailure {
+    status,
+    code: code_for_status(status, codes).to_string(),
+    params: BTreeMap::new(),
+  }
+}
+
+/// Classify a flattened error string, whether or not it encodes a status.
+///
+/// Some callers strip the status before they get here (a typed error that
+/// kept only the body), so a bare `{"code":…}` envelope is still recognised.
+pub fn classify_message(message: &str, codes: FailureCodes) -> BackendFailure {
+  if let Some((status, body)) = split_status(message) {
+    return classify(status, body, codes);
+  }
+  if let Some(failure) = from_body(0, message) {
+    return failure;
+  }
+  transport_failure(message)
+}
+
+/// A failure that never became an HTTP response.
+///
+/// `api_call_with_retry` reports a missing token as plain text, so the
+/// signed-out case is recognised here rather than surfacing as "something went
+/// wrong" — being signed out is a state the user can fix.
+pub fn transport_failure(message: &str) -> BackendFailure {
+  let code = if message.contains("Not logged in") || message.contains("No refresh token") {
+    NOT_SIGNED_IN
+  } else {
+    UNREACHABLE
+  };
+  BackendFailure {
+    status: 0,
+    code: code.to_string(),
+    params: BTreeMap::new(),
+  }
+}
+
+fn code_for_status(status: u16, codes: FailureCodes) -> &'static str {
+  match status {
+    400 | 422 => codes.bad_request,
+    401 => NOT_SIGNED_IN,
+    402 | 403 => codes.forbidden,
+    404 => codes.not_found,
+    409 => codes.conflict,
+    429 => RATE_LIMITED,
+    503 => NO_CAPACITY,
+    _ => UNAVAILABLE,
+  }
+}
+
+/// Read the backend's own `{"code":…}` envelope when it sent one.
+fn from_body(status: u16, body: &str) -> Option<BackendFailure> {
+  let parsed = serde_json::from_str::<Value>(body).ok()?;
+  let object = parsed.as_object()?;
+  let code = object.get("code")?.as_str()?;
+  if code.is_empty() {
+    return None;
+  }
+
+  let mut params = BTreeMap::new();
+
+  // The nested shape first, so a top-level key of the same name still wins.
+  //
+  // The cookie-bot routes send every interpolated value under `params`
+  // (`{"code":…,"params":{…}}`) while the remote-session routes spread theirs
+  // at the top level. Only the flat one was read, so
+  // COOKIE_BOT_INVALID_TIMEZONE rendered with an empty timezone name,
+  // COOKIE_BOT_SITE_LIMIT always showed the hardcoded fallback, and a team out
+  // of hours was told it had "used 0 of 0".
+  if let Some(Value::Object(nested)) = object.get("params") {
+    collect_scalars(nested, &mut params);
+  }
+
+  for (key, value) in object {
+    if key == "code" || key == "params" {
+      continue;
+    }
+    if let Value::Array(items) = value {
+      if key == "conflicts" {
+        collect_conflict_params(items, &mut params);
+      }
+      continue;
+    }
+    if let Some(text) = scalar(value) {
+      params.insert(key.clone(), text);
+    }
+  }
+
+  Some(BackendFailure {
+    status,
+    code: code.to_string(),
+    params,
+  })
+}
+
+/// A JSON value that can be substituted into a translated sentence.
+///
+/// An object or an array has no rendering, so it is dropped rather than
+/// stringified into the user's face.
+fn scalar(value: &Value) -> Option<String> {
+  match value {
+    Value::String(text) => Some(text.clone()),
+    Value::Number(number) => Some(number.to_string()),
+    Value::Bool(flag) => Some(flag.to_string()),
+    _ => None,
+  }
+}
+
+fn collect_scalars(object: &serde_json::Map<String, Value>, params: &mut BTreeMap<String, String>) {
+  for (key, value) in object {
+    if let Some(text) = scalar(value) {
+      params.insert(key.clone(), text);
+    }
+  }
+}
+
+/// Name the teammate whose enrolment blocks this one.
+///
+/// A schedule conflict is only actionable if the user learns WHO and WHEN, and
+/// the list arrives as an array the generic scalar copy would drop. Only the
+/// first entry is surfaced; the full list is in the response body for the UI.
+fn collect_conflict_params(items: &[Value], params: &mut BTreeMap<String, String>) {
+  params.insert("conflict_count".to_string(), items.len().to_string());
+  let Some(first) = items.first().and_then(Value::as_object) else {
+    return;
+  };
+  if let Some(email) = first.get("email").and_then(Value::as_str) {
+    params.insert("email".to_string(), email.to_string());
+  }
+  if let Some(timezone) = first.get("timezone").and_then(Value::as_str) {
+    params.insert("timezone".to_string(), timezone.to_string());
+  }
+  if let Some(minute) = first.get("run_at_minute").and_then(Value::as_u64) {
+    params.insert("run_at_minute".to_string(), minute.to_string());
+    params.insert("time".to_string(), format_minute_of_day(minute));
+  }
+}
+
+/// Minute-of-day to a zero-padded 24h clock reading.
+///
+/// The value is a wall-clock offset in the conflicting enrolment's own
+/// timezone, so there is no date and nothing to convert — only to render.
+pub fn format_minute_of_day(minute: u64) -> String {
+  let minute = minute % 1440;
+  format!("{:02}:{:02}", minute / 60, minute % 60)
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  const CODES: FailureCodes = FailureCodes {
+    bad_request: "BAD",
+    forbidden: "FORBIDDEN",
+    not_found: "MISSING",
+    conflict: "CLASH",
+  };
+
+  #[test]
+  fn the_backends_own_code_wins_over_the_status_default() {
+    // The status table is a fallback for gateway pages. When infra names the
+    // failure, that name is the one the user's locale has a string for.
+    let failure = classify(403, r#"{"code":"COOKIE_BOT_NOT_ENTITLED"}"#, CODES);
+    assert_eq!(failure.code, "COOKIE_BOT_NOT_ENTITLED");
+    assert_eq!(failure.status, 403);
+  }
+
+  #[test]
+  fn a_body_without_a_code_falls_back_to_the_routes_own_meaning() {
+    // 404 means "no schedule" on one route and "no such run" on another;
+    // sharing one code would tell the user the wrong thing on one of them.
+    assert_eq!(classify(404, "Not Found", CODES).code, "MISSING");
+    assert_eq!(classify(409, "", CODES).code, "CLASH");
+    assert_eq!(classify(400, "<html>", CODES).code, "BAD");
+  }
+
+  #[test]
+  fn capacity_and_rate_limits_are_never_reported_as_a_fault() {
+    // 503 is "come back in a minute" — the fleet is four Windows hosts wide,
+    // so a busy fleet is normal and must not look like an outage.
+    assert_eq!(classify(503, "", CODES).code, NO_CAPACITY);
+    assert_eq!(classify(429, "", CODES).code, RATE_LIMITED);
+  }
+
+  #[test]
+  fn an_unauthenticated_response_is_always_the_signed_out_code() {
+    // Never the route's forbidden code: "sign in" and "upgrade your plan" are
+    // different instructions and the user can only follow one of them.
+    assert_eq!(classify(401, "", CODES).code, NOT_SIGNED_IN);
+    assert_eq!(classify(402, "", CODES).code, "FORBIDDEN");
+  }
+
+  #[test]
+  fn scalar_body_fields_become_translation_params() {
+    let failure = classify(
+      403,
+      r#"{"code":"REMOTE_HOURS_EXHAUSTED","granted":200,"used":201.5,"pooled":true}"#,
+      CODES,
+    );
+    assert_eq!(
+      failure.params.get("granted").map(String::as_str),
+      Some("200")
+    );
+    assert_eq!(
+      failure.params.get("used").map(String::as_str),
+      Some("201.5")
+    );
+    assert_eq!(
+      failure.params.get("pooled").map(String::as_str),
+      Some("true")
+    );
+  }
+
+  #[test]
+  fn nested_params_are_read_because_that_is_the_shape_cookie_bot_sends() {
+    // `body(code, params)` in cookie-bot.errors.ts returns `{code, params}`,
+    // which Nest serialises verbatim. Reading only the top level dropped every
+    // interpolated value: the timezone the user typed, the site limit, the
+    // hours a team had actually spent.
+    let failure = classify(
+      400,
+      r#"{"code":"COOKIE_BOT_INVALID_TIMEZONE","params":{"timezone":"Europe/Nowhere"}}"#,
+      CODES,
+    );
+    assert_eq!(failure.code, "COOKIE_BOT_INVALID_TIMEZONE");
+    assert_eq!(
+      failure.params.get("timezone").map(String::as_str),
+      Some("Europe/Nowhere")
+    );
+
+    let limit = classify(
+      400,
+      r#"{"code":"COOKIE_BOT_SITE_LIMIT","params":{"min":1,"max":40}}"#,
+      CODES,
+    );
+    assert_eq!(limit.params.get("min").map(String::as_str), Some("1"));
+    assert_eq!(limit.params.get("max").map(String::as_str), Some("40"));
+
+    let hours = classify(
+      403,
+      r#"{"code":"REMOTE_HOURS_EXHAUSTED","params":{"granted":200,"used":214.5}}"#,
+      CODES,
+    );
+    assert_eq!(hours.params.get("granted").map(String::as_str), Some("200"));
+    assert_eq!(hours.params.get("used").map(String::as_str), Some("214.5"));
+  }
+
+  #[test]
+  fn both_body_shapes_coexist_and_the_top_level_one_wins() {
+    // The two planes disagree about where params live, and neither is going to
+    // change for the other. A key present in both must resolve once.
+    let failure = classify(
+      403,
+      r#"{"code":"REMOTE_HOURS_EXHAUSTED","granted":200,"params":{"granted":1,"used":5}}"#,
+      CODES,
+    );
+    assert_eq!(
+      failure.params.get("granted").map(String::as_str),
+      Some("200")
+    );
+    assert_eq!(failure.params.get("used").map(String::as_str), Some("5"));
+  }
+
+  #[test]
+  fn a_non_scalar_param_is_dropped_rather_than_rendered_as_json() {
+    // These values are substituted into a translated sentence. An object has
+    // no rendering, and `[object Object]` in a toast is worse than nothing.
+    let failure = classify(
+      400,
+      r#"{"code":"COOKIE_BOT_INVALID_SCHEDULE","params":{"field":"sites","detail":{"a":1},"list":[1,2]}}"#,
+      CODES,
+    );
+    assert_eq!(
+      failure.params.get("field").map(String::as_str),
+      Some("sites")
+    );
+    assert!(!failure.params.contains_key("detail"));
+    assert!(!failure.params.contains_key("list"));
+  }
+
+  #[test]
+  fn a_schedule_conflict_names_the_teammate_and_the_time() {
+    // Without these the dialog can only say "someone else already warms this
+    // profile", which is not something the user can act on.
+    let failure = classify(
+      409,
+      r#"{"code":"COOKIE_BOT_SCHEDULE_CONFLICT","conflicts":[{"email":"alex@example.com","run_at_minute":120,"timezone":"Europe/Berlin"}]}"#,
+      CODES,
+    );
+    assert_eq!(
+      failure.params.get("email").map(String::as_str),
+      Some("alex@example.com")
+    );
+    assert_eq!(
+      failure.params.get("time").map(String::as_str),
+      Some("02:00")
+    );
+    assert_eq!(
+      failure.params.get("conflict_count").map(String::as_str),
+      Some("1")
+    );
+  }
+
+  #[test]
+  fn minute_of_day_renders_as_a_padded_clock_reading() {
+    assert_eq!(format_minute_of_day(0), "00:00");
+    assert_eq!(format_minute_of_day(9 * 60 + 5), "09:05");
+    assert_eq!(format_minute_of_day(1439), "23:59");
+  }
+
+  #[test]
+  fn a_status_encoded_message_round_trips_to_its_code() {
+    assert_eq!(
+      classify_message(r#"(409) {"code":"COOKIE_BOT_RUN_IN_PROGRESS"}"#, CODES).code,
+      "COOKIE_BOT_RUN_IN_PROGRESS"
+    );
+  }
+
+  #[test]
+  fn a_signed_out_desktop_is_told_to_sign_in_not_that_the_network_failed() {
+    assert_eq!(classify_message("Not logged in", CODES).code, NOT_SIGNED_IN);
+    assert_eq!(
+      classify_message("reach backend: connection refused", CODES).code,
+      UNREACHABLE
+    );
+  }
+
+  #[test]
+  fn the_rendered_json_is_what_translate_backend_error_parses() {
+    let failure = classify(404, r#"{"code":"COOKIE_BOT_NOT_ENROLLED"}"#, CODES);
+    assert_eq!(
+      failure.to_error_json(),
+      r#"{"code":"COOKIE_BOT_NOT_ENROLLED"}"#
+    );
+
+    let with_params = classify(
+      403,
+      r#"{"code":"REMOTE_HOURS_EXHAUSTED","granted":200}"#,
+      CODES,
+    );
+    let parsed: Value = serde_json::from_str(&with_params.to_error_json())
+      .expect("the rendered error must be valid JSON");
+    assert_eq!(parsed["code"], "REMOTE_HOURS_EXHAUSTED");
+    assert_eq!(parsed["params"]["granted"], "200");
+  }
+
+  #[test]
+  fn split_status_does_not_misread_ordinary_prose() {
+    assert_eq!(split_status("(503) busy"), Some((503, "busy")));
+    assert_eq!(split_status("(nope) busy"), None);
+    assert_eq!(split_status("decode response: expected value"), None);
+  }
+}
@@ -59,25 +59,48 @@ impl BlocklistLevel {
    }
  }

-  pub fn url(&self) -> Option<&'static str> {
+  /// Where this tier's `domains/*.txt` list is fetched from.
+  ///
+  /// `raw.githubusercontent.com` only, deliberately. This used to be a jsDelivr
+  /// URL against `hagezi/dns-blocklists`, and it broke every blocklisted launch:
+  /// that repo grew past jsDelivr's 150 MB package-resolution limit, so
+  /// `@latest` began answering `403 Package size exceeded the configured limit
+  /// of 150 MB` for every tier. Nothing was wrong locally and nothing a user
+  /// could do would fix it — a third party's repo got too big and a CDN's
+  /// package resolver gave up.
+  ///
+  /// raw.githubusercontent.com serves the file straight from the ref and
+  /// resolves no package at all, so it cannot fail that way. The
+  /// `domains/*.txt` format now lives in `hagezi/dns-blocklists-legacy`.
+  ///
+  /// Returned as a slice so the fetch path can try several sources if one is
+  /// ever added; today there is exactly one on purpose.
+  pub fn urls(&self) -> &'static [&'static str] {
    match self {
-      Self::None | Self::Custom => None,
+      Self::None | Self::Custom => &[],
      Self::Light => {
-        Some("https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/light.txt")
+        &["https://raw.githubusercontent.com/hagezi/dns-blocklists-legacy/main/domains/light.txt"]
      }
      Self::Normal => {
-        Some("https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/multi.txt")
+        &["https://raw.githubusercontent.com/hagezi/dns-blocklists-legacy/main/domains/multi.txt"]
      }
-      Self::Pro => Some("https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/pro.txt"),
-      Self::ProPlus => {
-        Some("https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/pro.plus.txt")
-      }
-      Self::Ultimate => {
-        Some("https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/ultimate.txt")
+      Self::Pro => {
+        &["https://raw.githubusercontent.com/hagezi/dns-blocklists-legacy/main/domains/pro.txt"]
      }
+      Self::ProPlus => &[
+        "https://raw.githubusercontent.com/hagezi/dns-blocklists-legacy/main/domains/pro.plus.txt",
+      ],
+      Self::Ultimate => &[
+        "https://raw.githubusercontent.com/hagezi/dns-blocklists-legacy/main/domains/ultimate.txt",
+      ],
    }
  }

+  /// The preferred source, for callers that only need to name one.
+  pub fn url(&self) -> Option<&'static str> {
+    self.urls().first().copied()
+  }
+
  pub fn filename(&self) -> Option<&'static str> {
    match self {
      Self::None => None,
@@ -295,49 +318,85 @@ impl BlocklistManager {
  }

  pub async fn fetch_blocklist(level: BlocklistLevel) -> Result<PathBuf, String> {
-    let production_url = level
-      .url()
-      .ok_or_else(|| format!("No URL for level {:?}", level))?;
+    let production_urls: Vec<String> = level.urls().iter().map(|u| (*u).to_string()).collect();
+    if production_urls.is_empty() {
+      return Err(format!("No URL for level {:?}", level));
+    }
    #[cfg(feature = "e2e")]
-    let url = std::env::var("DONUT_E2E_DNS_BLOCKLIST_BASE_URL")
+    let urls = std::env::var("DONUT_E2E_DNS_BLOCKLIST_BASE_URL")
      .ok()
      .filter(|base| !base.is_empty())
      .map(|base| {
-        format!(
+        vec![format!(
          "{}/{}",
          base.trim_end_matches('/'),
          level.filename().unwrap_or("blocklist.txt")
-        )
+        )]
      })
-      .unwrap_or_else(|| production_url.to_string());
+      .unwrap_or(production_urls);
    #[cfg(not(feature = "e2e"))]
-    let url = production_url.to_string();
+    let urls = production_urls;
    let path =
      Self::cached_file_path(level).ok_or_else(|| format!("No filename for level {:?}", level))?;

    let cache_dir = Self::cache_dir();
    std::fs::create_dir_all(&cache_dir).map_err(|e| format!("Failed to create cache dir: {e}"))?;

-    log::info!(
-      "[dns-blocklist] Fetching {} from {}",
-      level.display_name(),
-      url
-    );
+    // Try each source in turn. A tier is only a failure once EVERY source has
+    // refused it: the outage this replaced was one CDN answering 403 for a
+    // reason that had nothing to do with the user, and falling back would have
+    // made it invisible.
+    let mut body: Option<String> = None;
+    let mut failures: Vec<String> = Vec::new();

-    let response = HTTP_CLIENT
-      .get(&url)
-      .send()
-      .await
-      .map_err(|e| format!("Failed to fetch blocklist: {e}"))?;
+    for url in &urls {
+      log::info!(
+        "[dns-blocklist] Fetching {} from {}",
+        level.display_name(),
+        url
+      );

-    if !response.status().is_success() {
-      return Err(format!("HTTP {} when fetching {}", response.status(), url));
+      let response = match HTTP_CLIENT.get(url).send().await {
+        Ok(response) => response,
+        Err(e) => {
+          failures.push(format!("{url}: {e}"));
+          continue;
+        }
+      };
+
+      if !response.status().is_success() {
+        failures.push(format!("{url}: HTTP {}", response.status()));
+        continue;
+      }
+
+      match response.text().await {
+        Ok(text) => {
+          if failures.is_empty() {
+            log::info!("[dns-blocklist] {} fetched", level.display_name());
+          } else {
+            // Worth saying out loud: the primary source is down and somebody
+            // should know before the backup goes too.
+            log::warn!(
+              "[dns-blocklist] {} came from a fallback source after {} failure(s): {}",
+              level.display_name(),
+              failures.len(),
+              failures.join("; ")
+            );
+          }
+          body = Some(text);
+          break;
+        }
+        Err(e) => failures.push(format!("{url}: {e}")),
+      }
    }

-    let body = response
-      .text()
-      .await
-      .map_err(|e| format!("Failed to read response body: {e}"))?;
+    let Some(body) = body else {
+      return Err(format!(
+        "Failed to fetch blocklist {} from any source ({})",
+        level.display_name(),
+        failures.join("; ")
+      ));
+    };

    // Write atomically: write to temp file, then rename
    let tmp_path = path.with_extension("tmp");
@@ -796,6 +855,66 @@ mod tests {
    assert!(BlocklistLevel::None.filename().is_none());
  }

+  #[test]
+  fn every_tier_is_served_only_from_raw_githubusercontent() {
+    // jsDelivr is deliberately not a source. It resolves a whole package to
+    // serve one file, so when `hagezi/dns-blocklists` grew past its 150 MB
+    // limit every tier began answering 403 — an outage nothing local could fix.
+    // raw.githubusercontent.com serves the file straight from the ref and
+    // resolves no package, so it cannot fail that way.
+    for &level in BlocklistLevel::all_downloadable() {
+      let urls = level.urls();
+      assert_eq!(
+        urls.len(),
+        1,
+        "{} should have exactly one source: {urls:?}",
+        level.as_str()
+      );
+      for url in urls {
+        assert!(
+          url.starts_with("https://raw.githubusercontent.com/"),
+          "{} must be served from raw.githubusercontent.com: {url}",
+          level.as_str()
+        );
+        assert!(
+          !url.contains("jsdelivr"),
+          "{} must not reintroduce jsDelivr: {url}",
+          level.as_str()
+        );
+      }
+    }
+  }
+
+  #[test]
+  fn no_tier_points_at_the_oversized_upstream_repo() {
+    // The `domains/*.txt` format moved to `-legacy`, which is small enough for
+    // jsDelivr to resolve. Pointing any tier back at the original repo
+    // reintroduces the 403.
+    for &level in BlocklistLevel::all_downloadable() {
+      for url in level.urls() {
+        assert!(
+          !url.contains("/hagezi/dns-blocklists@") && !url.contains("/hagezi/dns-blocklists/"),
+          "{} still points at the oversized repo: {url}",
+          level.as_str()
+        );
+        assert!(
+          url.contains("dns-blocklists-legacy"),
+          "{} should read the legacy list repo: {url}",
+          level.as_str()
+        );
+        assert!(
+          url.ends_with(
+            level
+              .filename()
+              .expect("downloadable tiers have a filename")
+          ),
+          "{} source must serve its own tier file: {url}",
+          level.as_str()
+        );
+      }
+    }
+  }
+
  #[test]
  fn test_cache_status_returns_all_levels() {
    let statuses = BlocklistManager::get_cache_status();
@@ -26,6 +26,29 @@ pub struct DownloadedBrowsersRegistry {
  geoip_downloader: &'static GeoIPDownloader,
 }

+/// Filename suffixes that identify a *downloaded artifact* — the container we
+/// fetched from the network — rather than a file belonging to the extracted
+/// install. Cleanup preserves these so a manually placed archive survives.
+///
+/// `.exe` and `.AppImage` are deliberately absent even though both can be
+/// downloaded. On Windows the extracted Wayfern payload is flat at the version
+/// root (`extraction::ensure_correct_directory_structure` returns early rather
+/// than nesting it), so preserving `.exe` kept `chrome.exe` while deleting every
+/// sibling `.dll`, the `.manifest`, `.pak` and `locales/` — a gutted install
+/// that then failed to launch with os error 14001. On Linux the `.AppImage`
+/// *is* the extracted payload. Cleanup must never leave behind something that
+/// still reads as an installed browser; the archive is deleted right after a
+/// successful download anyway, so nothing of value is lost.
+const DOWNLOAD_ARTIFACT_SUFFIXES: [&str; 7] =
+  ["zip", "dmg", "tar.xz", "tar.gz", "tar.bz2", "pkg", "msi"];
+
+fn is_download_artifact(file_name: &str) -> bool {
+  let lowered = file_name.to_lowercase();
+  DOWNLOAD_ARTIFACT_SUFFIXES
+    .iter()
+    .any(|suffix| lowered.ends_with(suffix))
+}
+
 impl DownloadedBrowsersRegistry {
  fn new() -> Self {
    Self {
@@ -174,15 +197,19 @@ impl DownloadedBrowsersRegistry {
    browser: &str,
    version: &str,
  ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    // Never delete files out from under a live download or extraction. Both the
+    // detached task that runs the moment a download completes and the periodic
+    // maintenance task land here, and a freshly downloaded version is referenced
+    // by no persisted profile while profile creation is still in flight.
+    if crate::downloader::is_downloading(browser, version) {
+      log::info!("Skipping cleanup of {browser} {version}: a download is in progress");
+      return Ok(());
+    }
+
    if let Some(info) = self.remove_browser(browser, version) {
      // Clean up extracted binaries but preserve downloaded archives
      if info.file_path.exists() {
        if info.file_path.is_dir() {
-          // Allowed archive extensions to preserve
-          let archive_exts = [
-            "zip", "dmg", "tar.xz", "tar.gz", "tar.bz2", "AppImage", "exe", "pkg", "msi",
-          ];
-
          for entry in fs::read_dir(&info.file_path)? {
            let entry = entry?;
            let path = entry.path();
@@ -192,16 +219,11 @@ impl DownloadedBrowsersRegistry {
              continue;
            }

-            // For files, preserve if they look like downloaded archives/installers
+            // For files, preserve only genuine downloaded archives/installers
            let keep = path
              .file_name()
              .and_then(|n| n.to_str())
-              .map(|name| {
-                // Match suffixes (handles multi-part extensions like .tar.xz)
-                archive_exts
-                  .iter()
-                  .any(|ext| name.to_lowercase().ends_with(&ext.to_lowercase()))
-              })
+              .map(is_download_artifact)
              .unwrap_or(false);

            if !keep {
@@ -215,13 +237,7 @@ impl DownloadedBrowsersRegistry {
            .file_name()
            .and_then(|n| n.to_str())
            .unwrap_or("");
-          let archive_exts = [
-            "zip", "dmg", "tar.xz", "tar.gz", "tar.bz2", "AppImage", "exe", "pkg", "msi",
-          ];
-          let is_archive = archive_exts
-            .iter()
-            .any(|ext| file_name.to_lowercase().ends_with(&ext.to_lowercase()));
-          if !is_archive {
+          if !is_download_artifact(file_name) {
            fs::remove_file(&info.file_path)?;
          }
        }
@@ -1230,6 +1246,130 @@ mod tests {
    );
  }

+  /// The Windows payload is extracted flat at the version root, so preserving
+  /// every `*.exe` used to leave `chrome.exe` behind while deleting the `.dll`
+  /// files and the `.manifest` next to it. That gutted directory still passed
+  /// the "is it downloaded?" check, was re-registered as healthy, and launching
+  /// it failed in the Windows loader with os error 14001.
+  #[test]
+  fn test_cleanup_removes_the_browser_executable_not_just_its_libraries() {
+    use tempfile::TempDir;
+    let temp = TempDir::new().unwrap();
+    let version_dir = temp.path().join("wayfern").join("140.0");
+    std::fs::create_dir_all(&version_dir).unwrap();
+
+    for name in [
+      "chrome.exe",
+      "wayfern.exe",
+      "notification_helper.exe",
+      "chrome.dll",
+      "chrome_elf.dll",
+      "chrome.exe.manifest",
+      "resources.pak",
+    ] {
+      std::fs::File::create(version_dir.join(name)).unwrap();
+    }
+    std::fs::create_dir_all(version_dir.join("locales")).unwrap();
+
+    let registry = DownloadedBrowsersRegistry::new();
+    registry.add_browser(DownloadedBrowserInfo {
+      browser: "wayfern".to_string(),
+      version: "140.0".to_string(),
+      file_path: version_dir.clone(),
+    });
+
+    registry
+      .cleanup_failed_download("wayfern", "140.0")
+      .expect("cleanup should succeed");
+
+    let leftovers: Vec<String> = std::fs::read_dir(&version_dir)
+      .unwrap()
+      .flatten()
+      .map(|e| e.file_name().to_string_lossy().into_owned())
+      .collect();
+    assert!(
+      leftovers.is_empty(),
+      "cleanup must not leave a half-deleted install behind, found: {leftovers:?}"
+    );
+  }
+
+  /// The preserve rule still exists for its actual purpose: a downloaded
+  /// archive (including one placed there by hand) survives the cleanup.
+  #[test]
+  fn test_cleanup_preserves_a_downloaded_archive() {
+    use tempfile::TempDir;
+    let temp = TempDir::new().unwrap();
+    let version_dir = temp.path().join("wayfern").join("141.0");
+    std::fs::create_dir_all(&version_dir).unwrap();
+
+    std::fs::File::create(version_dir.join("wayfern-win64.zip")).unwrap();
+    std::fs::File::create(version_dir.join("wayfern-mac.tar.xz")).unwrap();
+    std::fs::File::create(version_dir.join("chrome.exe")).unwrap();
+    std::fs::File::create(version_dir.join("chrome.dll")).unwrap();
+
+    let registry = DownloadedBrowsersRegistry::new();
+    registry.add_browser(DownloadedBrowserInfo {
+      browser: "wayfern".to_string(),
+      version: "141.0".to_string(),
+      file_path: version_dir.clone(),
+    });
+
+    registry
+      .cleanup_failed_download("wayfern", "141.0")
+      .expect("cleanup should succeed");
+
+    assert!(
+      version_dir.join("wayfern-win64.zip").exists(),
+      "a downloaded archive must be preserved"
+    );
+    assert!(
+      version_dir.join("wayfern-mac.tar.xz").exists(),
+      "multi-part archive extensions must still be recognised"
+    );
+    assert!(
+      !version_dir.join("chrome.exe").exists(),
+      "the extracted executable must be removed"
+    );
+    assert!(
+      !version_dir.join("chrome.dll").exists(),
+      "the extracted libraries must be removed"
+    );
+  }
+
+  /// Cleanup runs on a detached task the moment a download completes and again
+  /// on a periodic timer, either of which can land while an install is still
+  /// being written. It must stand down instead of deleting live files.
+  #[test]
+  fn test_cleanup_stands_down_while_a_download_is_in_progress() {
+    use tempfile::TempDir;
+    let temp = TempDir::new().unwrap();
+    let version_dir = temp.path().join("wayfern").join("142.0");
+    std::fs::create_dir_all(&version_dir).unwrap();
+    std::fs::File::create(version_dir.join("chrome.exe")).unwrap();
+    std::fs::File::create(version_dir.join("chrome.dll")).unwrap();
+
+    let registry = DownloadedBrowsersRegistry::new();
+    registry.add_browser(DownloadedBrowserInfo {
+      browser: "wayfern".to_string(),
+      version: "142.0".to_string(),
+      file_path: version_dir.clone(),
+    });
+
+    crate::downloader::mark_downloading_for_test("wayfern", "142.0");
+    let result = registry.cleanup_failed_download("wayfern", "142.0");
+    crate::downloader::clear_download_state_for_browser("wayfern");
+    result.expect("cleanup should succeed");
+
+    assert!(
+      version_dir.join("chrome.exe").exists() && version_dir.join("chrome.dll").exists(),
+      "an in-flight download must not be deleted out from under itself"
+    );
+    assert!(
+      registry.is_browser_registered("wayfern", "142.0"),
+      "the registry entry must survive too, the version is still being installed"
+    );
+  }
+
  #[test]
  fn test_is_browser_registered_vs_downloaded() {
    let registry = DownloadedBrowsersRegistry::new();
@@ -879,6 +879,17 @@ pub fn is_downloading(browser: &str, version: &str) -> bool {
  downloading.contains(&download_key)
 }

+/// Test-only: mark a browser-version pair as in flight so guards that consult
+/// `is_downloading` can be exercised without running a real download. Clear it
+/// again with `clear_download_state_for_browser`.
+#[cfg(test)]
+pub fn mark_downloading_for_test(browser: &str, version: &str) {
+  DOWNLOADING_BROWSERS
+    .lock()
+    .unwrap()
+    .insert(format!("{browser}-{version}"));
+}
+
 /// Clear all in-progress download bookkeeping for a browser.
 ///
 /// Used as a last-resort cleanup when a download future is abandoned (e.g. dropped
@@ -86,6 +86,62 @@ fn find_zip_start(data: &[u8]) -> usize {
  0
 }

+/// Read and parse an extension archive's `manifest.json`. Handles the CRX3
+/// header by seeking to the embedded ZIP. Shared with
+/// `vpn_extension_detect`, which classifies from the raw manifest rather than
+/// from the metadata subset persisted on `Extension`.
+pub(crate) fn read_manifest_from_archive(
+  file_data: &[u8],
+  file_type: &str,
+) -> Option<serde_json::Value> {
+  let zip_start = if file_type == "crx" {
+    find_zip_start(file_data)
+  } else {
+    0
+  };
+
+  let cursor = std::io::Cursor::new(file_data.get(zip_start..)?);
+  let mut archive = zip::ZipArchive::new(cursor).ok()?;
+
+  let mut contents = String::new();
+  {
+    let mut file = archive.by_name("manifest.json").ok()?;
+    std::io::Read::read_to_string(&mut file, &mut contents).ok()?;
+  }
+  serde_json::from_str(&contents).ok()
+}
+
+/// Resolve a `__MSG_key__` placeholder against the archive's default locale
+/// messages. Chromium extensions routinely localize `name`/`description`, and
+/// showing the raw placeholder in a warning dialog reads as a bug.
+pub(crate) fn resolve_archive_i18n(
+  file_data: &[u8],
+  file_type: &str,
+  manifest: &serde_json::Value,
+  value: &str,
+) -> Option<String> {
+  let key = crate::vpn_extension_detect::message_placeholder_key(value)?;
+  let default_locale = manifest.get("default_locale")?.as_str()?;
+
+  let zip_start = if file_type == "crx" {
+    find_zip_start(file_data)
+  } else {
+    0
+  };
+  let cursor = std::io::Cursor::new(file_data.get(zip_start..)?);
+  let mut archive = zip::ZipArchive::new(cursor).ok()?;
+
+  let mut contents = String::new();
+  {
+    let mut file = archive
+      .by_name(&format!("_locales/{default_locale}/messages.json"))
+      .ok()?;
+    std::io::Read::read_to_string(&mut file, &mut contents).ok()?;
+  }
+  let messages: serde_json::Value = serde_json::from_str(&contents).ok()?;
+  crate::vpn_extension_detect::lookup_message(&messages, &key)
+}
+
 #[allow(clippy::type_complexity)]
 fn extract_manifest_metadata(
  file_data: &[u8],
@@ -97,39 +153,11 @@ fn extract_manifest_metadata(
  Option<String>,
  Option<String>,
 ) {
-  let zip_start = if file_type == "crx" {
-    find_zip_start(file_data)
-  } else {
-    0
-  };
-
-  let cursor = std::io::Cursor::new(&file_data[zip_start..]);
-  let mut archive = match zip::ZipArchive::new(cursor) {
-    Ok(a) => a,
-    Err(_) => return (None, None, None, None, None),
-  };
-
-  let manifest_content = if let Ok(mut file) = archive.by_name("manifest.json") {
-    let mut contents = String::new();
-    if std::io::Read::read_to_string(&mut file, &mut contents).is_ok() {
-      Some(contents)
-    } else {
-      None
-    }
-  } else {
-    None
-  };
-
-  let manifest_content = match manifest_content {
-    Some(c) => c,
+  let manifest = match read_manifest_from_archive(file_data, file_type) {
+    Some(v) => v,
    None => return (None, None, None, None, None),
  };

-  let manifest: serde_json::Value = match serde_json::from_str(&manifest_content) {
-    Ok(v) => v,
-    Err(_) => return (None, None, None, None, None),
-  };
-
  let name = manifest
    .get("name")
    .and_then(|v| v.as_str())
@@ -1,11 +1,15 @@
-//! Launch-time consistency check: resolve the proxy's exit IP, geolocate it
-//! with the bundled MaxMind database (the same source the fingerprint generator
-//! uses), then compare its timezone and country against the profile
-//! fingerprint's timezone and language. A mismatch (e.g. a US fingerprint
-//! behind a German exit IP) is a strong anti-bot tell even though the real
-//! device never leaks — so we warn the user after launch and offer to match the
-//! fingerprint to the exit. Launches never rewrite the fingerprint silently, so
-//! a real mismatch always surfaces here.
+//! Measures a proxy's exit node and compares it to a profile's fingerprint.
+//!
+//! Resolve the exit IP through the upstream, geolocate it with the bundled
+//! MaxMind database (the same source the fingerprint generator uses), then
+//! compare its timezone and country against the fingerprint's timezone and
+//! language. A mismatch (e.g. a US fingerprint behind a German exit IP) is a
+//! strong anti-bot tell even though the real device never leaks.
+//!
+//! This module only measures. Deciding what a mismatch *means* for a launch —
+//! block, warn, or ignore — belongs to `launch_gate`, which calls
+//! `probe_and_check_consistency` before the browser is spawned. Launches never
+//! rewrite the fingerprint silently, so a real mismatch always surfaces.

 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
@@ -19,20 +23,68 @@ use crate::proxy_manager::PROXY_MANAGER;
 /// on every launch is wasteful.
 const EXIT_CACHE_TTL_SECS: u64 = 30 * 60;

+/// Ceiling on a single exit probe. `fetch_public_ip` races six endpoints with
+/// a 10s timeout each, which is fine for a background check but far longer
+/// than a user will wait staring at a launch that has not started yet.
+const PROBE_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(8);
+
 #[derive(Clone)]
 struct CachedExit {
  fetched_at: u64,
-  /// The proxy URL this exit was measured through. Editing a stored proxy keeps
+  /// The endpoint this exit was measured through. Editing a stored proxy keeps
  /// its id, so without this an entry outlives the endpoint it describes: the
  /// check would compare a re-generated fingerprint against the *old* exit and
  /// either warn about a correct profile or — worse — call a genuinely
  /// mismatched one consistent, which is exactly the tell it exists to catch.
-  proxy_url: String,
+  ///
+  /// Never a loopback URL: the Xray/VPN workers a launch spins up get a fresh
+  /// random port and credentials each time, so keying on those would miss on
+  /// every relaunch and re-probe forever.
+  identity: String,
  timezone: Option<String>,
  country_code: Option<String>,
  ip: Option<String>,
 }

+/// Identity of the exit a profile routes through, stable across worker
+/// restarts.
+///
+/// `scope` keys the cache; `identity` detects that the endpoint behind that
+/// key changed. Cloud-derived proxies inject a per-profile sticky-session id,
+/// so two profiles sharing one stored proxy correctly get different identities
+/// and never inherit each other's verdict.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ExitCacheKey {
+  pub scope: String,
+  pub identity: String,
+}
+
+/// Resolve the cache identity from the profile's *stored* configuration.
+///
+/// Deliberately not derived from the normalized upstream the launcher passes
+/// to the probe: for VLESS and VPN that upstream is a loopback worker whose
+/// port and credentials are regenerated per launch.
+pub fn exit_cache_key(profile: &BrowserProfile) -> Option<ExitCacheKey> {
+  if let Some(proxy_id) = &profile.proxy_id {
+    let settings = PROXY_MANAGER
+      .resolve_proxy_for_profile(proxy_id, &profile.id.to_string())
+      .or_else(|| PROXY_MANAGER.get_proxy_settings_by_id(proxy_id))?;
+    // build_proxy_url returns the VLESS URI verbatim for vless proxies, so one
+    // call covers every transport.
+    return Some(ExitCacheKey {
+      scope: format!("proxy:{proxy_id}"),
+      identity: crate::proxy_manager::ProxyManager::build_proxy_url(&settings),
+    });
+  }
+  if let Some(vpn_id) = &profile.vpn_id {
+    return Some(ExitCacheKey {
+      scope: format!("vpn:{vpn_id}"),
+      identity: vpn_id.clone(),
+    });
+  }
+  None
+}
+
 lazy_static::lazy_static! {
  static ref EXIT_CACHE: Mutex<HashMap<String, CachedExit>> = Mutex::new(HashMap::new());
 }
@@ -54,7 +106,7 @@ pub struct ConsistencyResult {
 }

 impl ConsistencyResult {
-  fn skip() -> Self {
+  pub fn skip() -> Self {
    Self {
      consistent: true,
      checked: false,
@@ -68,18 +120,15 @@ impl ConsistencyResult {
  }
 }

-/// URL for handing this proxy to reqwest. VLESS is reached through the
-/// authenticated loopback Xray-core worker already serving the profile.
-fn proxy_url(settings: &crate::browser::ProxySettings, profile_id: Option<&str>) -> Option<String> {
+/// Whether this upstream can carry a probe request at all.
+///
+/// Shadowsocks and anything else reqwest cannot dial directly is skipped
+/// rather than guessed at.
+fn probe_url(settings: &crate::browser::ProxySettings) -> Option<String> {
  match settings.proxy_type.to_lowercase().as_str() {
    "http" | "https" | "socks4" | "socks5" => Some(
-      crate::proxy_manager::ProxyManager::build_proxy_url(settings),
+      crate::proxy_manager::ProxyManager::build_probe_proxy_url(settings),
    ),
-    "vless" => profile_id
-      .and_then(crate::xray_worker_storage::find_xray_worker_by_profile_id)
-      .map(|worker| {
-        crate::proxy_manager::ProxyManager::build_proxy_url(&worker.local_proxy_settings())
-      }),
    _ => None,
  }
 }
@@ -119,120 +168,174 @@ fn fingerprint_locale(profile: &BrowserProfile) -> (Option<String>, Option<Strin
  (timezone, language)
 }

-/// Run the check for a profile. No-ops (consistent, unchecked) when the
-/// profile has no proxy or the exit node can't be reached.
-pub async fn check_profile_consistency(
+/// A mutex whose poison is not fatal.
+///
+/// A panic anywhere under this lock used to brick the check process-wide.
+/// That was tolerable when a failed check only skipped a warning; now a launch
+/// consults it, so a poisoned lock must degrade rather than propagate.
+fn exit_cache() -> std::sync::MutexGuard<'static, HashMap<String, CachedExit>> {
+  EXIT_CACHE.lock().unwrap_or_else(|e| e.into_inner())
+}
+
+/// Compare a measured exit against a profile's fingerprint. Pure — no I/O.
+pub fn compare_exit_to_fingerprint(
  profile: &BrowserProfile,
-) -> Result<ConsistencyResult, String> {
-  let Some(proxy_id) = &profile.proxy_id else {
-    return Ok(ConsistencyResult::skip());
-  };
-  let Some(settings) = PROXY_MANAGER.get_proxy_settings_by_id(proxy_id) else {
-    return Ok(ConsistencyResult::skip());
-  };
-  let profile_id = profile.id.to_string();
-  let Some(url) = proxy_url(&settings, Some(&profile_id)) else {
-    return Ok(ConsistencyResult::skip());
-  };
-  let cache_identity = if settings.proxy_type.eq_ignore_ascii_case("vless") {
-    settings.vless_uri.clone().unwrap_or_else(|| url.clone())
-  } else {
-    url.clone()
-  };
-
-  let now = crate::proxy_manager::now_secs();
-
-  // Serve a fresh cached exit lookup for this proxy if we have one, but only if
-  // it was measured through the proxy's current endpoint and credentials.
-  let cached = {
-    let cache = EXIT_CACHE.lock().unwrap();
-    cache
-      .get(proxy_id)
-      .filter(|c| {
-        c.proxy_url == cache_identity && now.saturating_sub(c.fetched_at) < EXIT_CACHE_TTL_SECS
-      })
-      .cloned()
-  };
-
-  let (exit_tz, exit_cc, exit_ip) = if let Some(c) = cached {
-    (c.timezone, c.country_code, c.ip)
-  } else {
-    // Resolve the exit IP through the proxy, then geolocate it with the SAME
-    // bundled MaxMind database the fingerprint generator (and the on-demand
-    // match) use. Using one geo source everywhere means the check can never
-    // disagree with what generation produced — a second source (e.g. ip-api)
-    // routinely reports a different IANA zone for the same IP in multi-zone
-    // countries, which would flag correctly-generated fingerprints and would
-    // leave the "match to proxy" fix unable to satisfy the check.
-    let exit_ip = crate::ip_utils::fetch_public_ip(Some(&url))
-      .await
-      .map_err(|e| format!("exit-node lookup failed: {e}"))?;
-    match crate::geolocation::get_geolocation(&exit_ip) {
-      Ok(geo) => {
-        let tz = Some(geo.timezone);
-        let cc = geo.locale.region.clone();
-        let ip = Some(exit_ip);
-        EXIT_CACHE.lock().unwrap().insert(
-          proxy_id.clone(),
-          CachedExit {
-            fetched_at: now,
-            proxy_url: cache_identity,
-            timezone: tz.clone(),
-            country_code: cc.clone(),
-            ip: ip.clone(),
-          },
-        );
-        (tz, cc, ip)
-      }
-      // Reached the exit but couldn't place it (database missing, or a private
-      // exit IP). Skip rather than warn on an unknown location — the same
-      // database gates fingerprint geo, so there's nothing to disagree with.
-      Err(e) => {
-        log::debug!("Consistency check: could not geolocate exit IP: {e}");
-        return Ok(ConsistencyResult::skip());
-      }
-    }
-  };
-
+  exit_timezone: Option<String>,
+  exit_country_code: Option<String>,
+  exit_ip: Option<String>,
+) -> ConsistencyResult {
  let (fp_tz, fp_lang) = fingerprint_locale(profile);
  let mut mismatches = Vec::new();

-  if let (Some(exit), Some(fp)) = (&exit_tz, &fp_tz) {
+  if let (Some(exit), Some(fp)) = (&exit_timezone, &fp_tz) {
    if !exit.eq_ignore_ascii_case(fp) {
      mismatches.push("timezone".to_string());
    }
  }

-  if let (Some(cc), Some(lang)) = (&exit_cc, &fp_lang) {
+  if let (Some(cc), Some(lang)) = (&exit_country_code, &fp_lang) {
    if language_matches_country(cc, lang) == Some(false) {
      mismatches.push("language".to_string());
    }
  }

-  Ok(ConsistencyResult {
+  ConsistencyResult {
    consistent: mismatches.is_empty(),
    checked: true,
    exit_ip,
-    exit_country_code: exit_cc,
-    exit_timezone: exit_tz,
+    exit_country_code,
+    exit_timezone,
    fingerprint_timezone: fp_tz,
    fingerprint_language: fp_lang,
    mismatches,
-  })
+  }
 }

-#[tauri::command]
-pub async fn check_profile_fingerprint_consistency(
-  profile_id: String,
+/// Look up a still-valid cached exit for this profile.
+fn cached_exit(key: &ExitCacheKey) -> Option<CachedExit> {
+  let now = crate::proxy_manager::now_secs();
+  exit_cache()
+    .get(&key.scope)
+    .filter(|c| {
+      c.identity == key.identity && now.saturating_sub(c.fetched_at) < EXIT_CACHE_TTL_SECS
+    })
+    .cloned()
+}
+
+/// Cache-only check. Never performs I/O, so it is safe to call before a launch
+/// and for every profile in a bulk run. Returns an unchecked result on a miss.
+pub fn check_profile_consistency_cached(profile: &BrowserProfile) -> ConsistencyResult {
+  let Some(key) = exit_cache_key(profile) else {
+    return ConsistencyResult::skip();
+  };
+  let Some(cached) = cached_exit(&key) else {
+    return ConsistencyResult::skip();
+  };
+  compare_exit_to_fingerprint(profile, cached.timezone, cached.country_code, cached.ip)
+}
+
+/// Drop any cached exit for this profile, so the next check re-measures.
+pub fn invalidate_exit_cache(profile: &BrowserProfile) {
+  if let Some(key) = exit_cache_key(profile) {
+    exit_cache().remove(&key.scope);
+  }
+}
+
+/// Measure the exit through an already-normalized upstream and compare it to
+/// the fingerprint.
+///
+/// `upstream` is what the launcher will actually hand the browser — a loopback
+/// worker for VLESS and VPN, the resolved endpoint for a stored proxy — so one
+/// code path covers every transport. `None` means a genuine direct connection,
+/// which has nothing to disagree with.
+pub async fn probe_and_check_consistency(
+  profile: &BrowserProfile,
+  upstream: Option<&crate::browser::ProxySettings>,
+  key: &ExitCacheKey,
 ) -> Result<ConsistencyResult, String> {
-  let profiles = crate::profile::ProfileManager::instance()
-    .list_profiles()
-    .map_err(|e| e.to_string())?;
-  let profile = profiles
-    .into_iter()
-    .find(|p| p.id.to_string() == profile_id)
-    .ok_or_else(|| serde_json::json!({ "code": "PROFILE_NOT_FOUND" }).to_string())?;
-  check_profile_consistency(&profile).await
+  if let Some(cached) = cached_exit(key) {
+    return Ok(compare_exit_to_fingerprint(
+      profile,
+      cached.timezone,
+      cached.country_code,
+      cached.ip,
+    ));
+  }
+
+  let Some(settings) = upstream else {
+    return Ok(ConsistencyResult::skip());
+  };
+  let Some(url) = probe_url(settings) else {
+    return Ok(ConsistencyResult::skip());
+  };
+
+  // Resolve the exit IP through the proxy, then geolocate it with the SAME
+  // bundled MaxMind database the fingerprint generator (and the on-demand
+  // match) use. Using one geo source everywhere means the check can never
+  // disagree with what generation produced — a second source (e.g. ip-api)
+  // routinely reports a different IANA zone for the same IP in multi-zone
+  // countries, which would flag correctly-generated fingerprints and would
+  // leave the "match to proxy" fix unable to satisfy the check.
+  //
+  // Bounded independently of fetch_public_ip's own per-request timeout: that
+  // one races six endpoints and can add up to far longer than a user will wait
+  // in front of a launch.
+  let fetched = tokio::time::timeout(PROBE_TIMEOUT, crate::ip_utils::fetch_public_ip(Some(&url)))
+    .await
+    .map_err(|_| crate::backend_error("EXIT_PROBE_FAILED"))?;
+  let exit_ip = fetched.map_err(|e| crate::backend_error_with_detail("EXIT_PROBE_FAILED", e))?;
+
+  match crate::geolocation::get_geolocation(&exit_ip) {
+    Ok(geo) => {
+      let tz = Some(geo.timezone);
+      let cc = geo.locale.region.clone();
+      exit_cache().insert(
+        key.scope.clone(),
+        CachedExit {
+          fetched_at: crate::proxy_manager::now_secs(),
+          identity: key.identity.clone(),
+          timezone: tz.clone(),
+          country_code: cc.clone(),
+          ip: Some(exit_ip.clone()),
+        },
+      );
+      Ok(compare_exit_to_fingerprint(profile, tz, cc, Some(exit_ip)))
+    }
+    // Reached the exit but couldn't place it (database missing, or a private
+    // exit IP). Skip rather than warn on an unknown location — the same
+    // database gates fingerprint geo, so there's nothing to disagree with.
+    Err(e) => {
+      log::debug!("Consistency check: could not geolocate exit IP: {e}");
+      Ok(ConsistencyResult::skip())
+    }
+  }
+}
+
+/// Measure the exit this machine reaches without any proxy, and compare it to
+/// the fingerprint.
+///
+/// Used when a profile declares a route that did not materialize: the browser
+/// is about to connect directly, so the direct exit is the one that matters.
+/// Deliberately NOT cached — a direct exit belongs to this machine's network,
+/// not to any stored proxy, and it changes without a config edit.
+pub async fn probe_direct_and_check(profile: &BrowserProfile) -> Result<ConsistencyResult, String> {
+  let fetched = tokio::time::timeout(PROBE_TIMEOUT, crate::ip_utils::fetch_public_ip(None))
+    .await
+    .map_err(|_| crate::backend_error("EXIT_PROBE_FAILED"))?;
+  let exit_ip = fetched.map_err(|e| crate::backend_error_with_detail("EXIT_PROBE_FAILED", e))?;
+
+  match crate::geolocation::get_geolocation(&exit_ip) {
+    Ok(geo) => Ok(compare_exit_to_fingerprint(
+      profile,
+      Some(geo.timezone),
+      geo.locale.region.clone(),
+      Some(exit_ip),
+    )),
+    Err(e) => {
+      log::debug!("Consistency check: could not geolocate direct exit IP: {e}");
+      Ok(ConsistencyResult::skip())
+    }
+  }
 }

 /// Rewrite a profile's stored fingerprint so its geolocation (timezone,
@@ -280,6 +383,10 @@ pub async fn match_profile_fingerprint_to_exit(
      .to_string()
  })?;

+  // The stored verdict was computed against the fingerprint we just rewrote.
+  // Leaving it would re-block the very launch this fix exists to unblock.
+  invalidate_exit_cache(&profile);
+
  Ok(())
 }

@@ -344,55 +451,218 @@ mod tests {
    assert!(language_matches_country("CH", "de-CH").is_some());
  }

-  #[test]
-  fn proxy_url_percent_encodes_credentials_and_skips_shadowsocks() {
-    let http = crate::browser::ProxySettings {
-      proxy_type: "http".into(),
-      host: "h".into(),
+  fn settings(
+    proxy_type: &str,
+    user: Option<&str>,
+    pass: Option<&str>,
+  ) -> crate::browser::ProxySettings {
+    crate::browser::ProxySettings {
+      proxy_type: proxy_type.into(),
+      host: "gw.provider.io".into(),
      port: 8080,
-      username: Some("u".into()),
-      password: Some("p".into()),
+      username: user.map(str::to_string),
+      password: pass.map(str::to_string),
      vless_uri: None,
-    };
-    assert_eq!(proxy_url(&http, None).as_deref(), Some("http://u:p@h:8080"));
+    }
+  }
+
+  #[test]
+  fn probe_url_percent_encodes_credentials_and_skips_shadowsocks() {
+    assert_eq!(
+      probe_url(&settings("http", Some("u"), Some("p"))).as_deref(),
+      Some("http://u:p@gw.provider.io:8080")
+    );

    // A password with URL-reserved characters must not break the authority —
    // unencoded, the `/` truncates the host and reqwest targets `u` instead.
-    let reserved = crate::browser::ProxySettings {
-      proxy_type: "http".into(),
-      host: "gw.provider.io".into(),
-      port: 8080,
-      username: Some("user".into()),
-      password: Some("ab/cd@ef".into()),
-      vless_uri: None,
-    };
    assert_eq!(
-      proxy_url(&reserved, None).as_deref(),
+      probe_url(&settings("http", Some("user"), Some("ab/cd@ef"))).as_deref(),
      Some("http://user:ab%2Fcd%40ef@gw.provider.io:8080")
    );

    // Username-only proxies keep their auth.
-    let user_only = crate::browser::ProxySettings {
-      proxy_type: "socks5".into(),
-      host: "h".into(),
-      port: 1080,
-      username: Some("justuser".into()),
-      password: None,
-      vless_uri: None,
-    };
    assert_eq!(
-      proxy_url(&user_only, None).as_deref(),
-      Some("socks5://justuser@h:1080")
+      probe_url(&settings("socks4", Some("justuser"), None)).as_deref(),
+      Some("socks4://justuser@gw.provider.io:8080")
    );

-    let ss = crate::browser::ProxySettings {
-      proxy_type: "ss".into(),
-      host: "h".into(),
-      port: 8080,
-      username: None,
-      password: None,
-      vless_uri: None,
+    // Shadowsocks cannot carry a reqwest probe, so it is skipped rather than
+    // guessed at.
+    assert_eq!(probe_url(&settings("ss", None, None)), None);
+  }
+
+  #[test]
+  fn probe_url_uses_socks5h_so_dns_resolves_at_the_exit() {
+    let url = probe_url(&settings("socks5", Some("u"), Some("p"))).unwrap();
+    assert!(
+      url.starts_with("socks5h://"),
+      "probe must not resolve the echo host locally, got {url}"
+    );
+    // The browser-facing builder is deliberately left alone.
+    assert!(
+      crate::proxy_manager::ProxyManager::build_proxy_url(&settings(
+        "socks5",
+        Some("u"),
+        Some("p")
+      ))
+      .starts_with("socks5://")
+    );
+  }
+
+  fn profile_with_fingerprint(timezone: &str, language: &str) -> BrowserProfile {
+    let mut profile = BrowserProfile {
+      id: uuid::Uuid::new_v4(),
+      name: "p".into(),
+      browser: "wayfern".into(),
+      ..Default::default()
    };
-    assert_eq!(proxy_url(&ss, None), None);
+    profile.wayfern_config = Some(crate::wayfern_manager::WayfernConfig {
+      fingerprint: Some(
+        serde_json::json!({ "timezone": timezone, "language": language }).to_string(),
+      ),
+      ..Default::default()
+    });
+    profile
+  }
+
+  #[test]
+  fn compare_flags_a_timezone_mismatch() {
+    let profile = profile_with_fingerprint("America/New_York", "en-US");
+    let result = compare_exit_to_fingerprint(
+      &profile,
+      Some("Europe/Berlin".into()),
+      Some("DE".into()),
+      Some("1.2.3.4".into()),
+    );
+    assert!(result.checked);
+    assert!(!result.consistent);
+    assert!(result.mismatches.contains(&"timezone".to_string()));
+  }
+
+  #[test]
+  fn compare_accepts_a_matching_exit() {
+    let profile = profile_with_fingerprint("Europe/Berlin", "de-DE");
+    let result = compare_exit_to_fingerprint(
+      &profile,
+      Some("Europe/Berlin".into()),
+      Some("DE".into()),
+      Some("1.2.3.4".into()),
+    );
+    assert!(result.consistent, "{:?}", result.mismatches);
+  }
+
+  #[test]
+  fn compare_is_case_insensitive_on_timezone() {
+    let profile = profile_with_fingerprint("Europe/Berlin", "de-DE");
+    let result = compare_exit_to_fingerprint(
+      &profile,
+      Some("europe/berlin".into()),
+      Some("DE".into()),
+      None,
+    );
+    assert!(result.consistent);
+  }
+
+  #[test]
+  fn compare_skips_dimensions_the_fingerprint_does_not_declare() {
+    // A profile with no fingerprint has nothing to contradict; it must not be
+    // reported as a mismatch and so must never block a launch.
+    let profile = BrowserProfile {
+      id: uuid::Uuid::new_v4(),
+      browser: "wayfern".into(),
+      ..Default::default()
+    };
+    let result = compare_exit_to_fingerprint(
+      &profile,
+      Some("Europe/Berlin".into()),
+      Some("DE".into()),
+      None,
+    );
+    assert!(result.consistent);
+    assert!(result.mismatches.is_empty());
+  }
+
+  #[test]
+  fn cached_check_reports_unchecked_without_a_proxy_or_vpn() {
+    let profile = profile_with_fingerprint("Europe/Berlin", "de-DE");
+    let result = check_profile_consistency_cached(&profile);
+    assert!(!result.checked);
+    assert!(result.consistent, "an unchecked profile must never block");
+  }
+
+  #[test]
+  fn exit_cache_key_is_absent_without_a_proxy_or_vpn() {
+    let profile = profile_with_fingerprint("Europe/Berlin", "de-DE");
+    assert_eq!(exit_cache_key(&profile), None);
+  }
+
+  #[test]
+  fn exit_cache_key_scopes_a_vpn_profile_by_vpn_id() {
+    let mut profile = profile_with_fingerprint("Europe/Berlin", "de-DE");
+    profile.vpn_id = Some("vpn-abc".into());
+    let key = exit_cache_key(&profile).expect("vpn profiles must be cacheable");
+    assert_eq!(key.scope, "vpn:vpn-abc");
+    assert_eq!(key.identity, "vpn-abc");
+  }
+
+  #[test]
+  fn cached_entry_is_ignored_once_the_endpoint_identity_changes() {
+    let key = ExitCacheKey {
+      scope: "proxy:test-identity-change".into(),
+      identity: "http://old@host:1".into(),
+    };
+    exit_cache().insert(
+      key.scope.clone(),
+      CachedExit {
+        fetched_at: crate::proxy_manager::now_secs(),
+        identity: key.identity.clone(),
+        timezone: Some("Europe/Berlin".into()),
+        country_code: Some("DE".into()),
+        ip: Some("1.2.3.4".into()),
+      },
+    );
+    assert!(cached_exit(&key).is_some());
+
+    // Editing a stored proxy keeps its id but changes the endpoint; the old
+    // measurement must not be reused for the new one.
+    let rotated = ExitCacheKey {
+      identity: "http://new@host:2".into(),
+      ..key.clone()
+    };
+    assert!(cached_exit(&rotated).is_none());
+    exit_cache().remove(&key.scope);
+  }
+
+  #[test]
+  fn cached_entry_expires_after_the_ttl() {
+    let key: ExitCacheKey = ExitCacheKey {
+      scope: "proxy:test-ttl".into(),
+      identity: "http://host:1".into(),
+    };
+    exit_cache().insert(
+      key.scope.clone(),
+      CachedExit {
+        fetched_at: crate::proxy_manager::now_secs() - EXIT_CACHE_TTL_SECS - 1,
+        identity: key.identity.clone(),
+        timezone: Some("Europe/Berlin".into()),
+        country_code: Some("DE".into()),
+        ip: None,
+      },
+    );
+    assert!(cached_exit(&key).is_none());
+    exit_cache().remove(&key.scope);
+  }
+
+  #[test]
+  fn exit_cache_survives_a_poisoned_lock() {
+    // A panic under this lock must degrade the check, not brick every
+    // subsequent launch that consults it.
+    let _ = std::thread::spawn(|| {
+      let _guard = EXIT_CACHE.lock().unwrap();
+      panic!("poison the cache");
+    })
+    .join();
+    assert!(EXIT_CACHE.is_poisoned());
+    exit_cache().remove("nonexistent-scope");
  }
 }
@@ -0,0 +1,540 @@
+//! The pre-spawn launch gate.
+//!
+//! Two findings can stop a launch being what the user expects:
+//!
+//! * a **VPN/proxy extension** in the profile, which can override the proxy
+//!   Donut configured and silently move the browser's exit away from the one
+//!   the fingerprint was generated for — a warning, since Donut cannot tell
+//!   from outside whether it is actually routing anything;
+//! * a measured **exit/fingerprint mismatch**, which is a hard block: the
+//!   browser does not start until the user explicitly proceeds.
+//!
+//! The enforcing half runs inside `browser_runner::launch_browser_internal`,
+//! after the upstream has been normalized (so VLESS and VPN profiles are
+//! reachable at all) and before the local proxy starts or the browser spawns.
+//! `get_profile_pre_launch_checks` is the cheap, local-only half the UI calls
+//! first, so a profile whose exit is already known blocks without starting a
+//! single worker.
+
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::sync::Mutex;
+
+use crate::fingerprint_consistency::{self, ConsistencyResult};
+use crate::profile::types::BrowserProfile;
+use crate::vpn_extension_detect::{self, DetectedVpnExtension};
+
+/// How long a "launch anyway" decision stays redeemable. Long enough to read
+/// the dialog, short enough that a token cannot sit around across a session.
+const CONSENT_TTL_SECS: u64 = 10 * 60;
+
+/// What the gate is allowed to do on this launch.
+#[derive(Debug, Clone, Default)]
+pub enum FingerprintGate {
+  /// Block on a measured mismatch. The default, and what the GUI uses.
+  #[default]
+  Enforce,
+  /// Measure only from cache and report; never block, never probe the network.
+  /// Automation runs here: a headless client has no dialog to answer and
+  /// cannot regenerate its fingerprint mid-run, so a hard failure would turn a
+  /// warning into an outage for a whole fleet.
+  Advisory,
+  /// The user already said "launch anyway" and handed back a token.
+  Consented(String),
+}
+
+struct PendingConsent {
+  profile_id: String,
+  fingerprint_hash: String,
+  exit_identity: String,
+  issued_at: u64,
+}
+
+lazy_static::lazy_static! {
+  static ref CONSENTS: Mutex<HashMap<String, PendingConsent>> = Mutex::new(HashMap::new());
+}
+
+fn consents() -> std::sync::MutexGuard<'static, HashMap<String, PendingConsent>> {
+  CONSENTS.lock().unwrap_or_else(|e| e.into_inner())
+}
+
+fn random_token() -> String {
+  use rand::Rng;
+  let mut rng = rand::rng();
+  let mut bytes = [0u8; 16];
+  rng.fill_bytes(&mut bytes);
+  bytes.iter().map(|b| format!("{b:02x}")).collect()
+}
+
+/// Issue a single-use token authorizing one launch of this exact
+/// (profile, fingerprint, exit) combination.
+///
+/// A plain `bypass: bool` cannot express this: a "proceed" the user granted
+/// while looking at proxy A would silently authorize a launch through proxy B
+/// if they changed it before the retry landed.
+pub fn mint_consent(profile: &BrowserProfile, exit_identity: &str) -> String {
+  let token = random_token();
+  let now = crate::proxy_manager::now_secs();
+  let mut store = consents();
+  store.retain(|_, c| now.saturating_sub(c.issued_at) < CONSENT_TTL_SECS);
+  store.insert(
+    token.clone(),
+    PendingConsent {
+      profile_id: profile.id.to_string(),
+      fingerprint_hash: crate::launch_gate_prefs::fingerprint_hash(profile),
+      exit_identity: exit_identity.to_string(),
+      issued_at: now,
+    },
+  );
+  token
+}
+
+/// Redeem a consent token. Single use — a redeemed token is removed whether or
+/// not it validated, so a leaked token cannot be replayed.
+pub fn redeem_consent(
+  token: &str,
+  profile: &BrowserProfile,
+  exit_identity: &str,
+) -> Result<(), String> {
+  let now = crate::proxy_manager::now_secs();
+  let pending = {
+    let mut store = consents();
+    store.retain(|_, c| now.saturating_sub(c.issued_at) < CONSENT_TTL_SECS);
+    store.remove(token)
+  };
+
+  let Some(pending) = pending else {
+    return Err(crate::backend_error("LAUNCH_CONSENT_EXPIRED"));
+  };
+  if pending.profile_id != profile.id.to_string()
+    || pending.fingerprint_hash != crate::launch_gate_prefs::fingerprint_hash(profile)
+    || pending.exit_identity != exit_identity
+  {
+    return Err(crate::backend_error("LAUNCH_CONSENT_EXPIRED"));
+  }
+  Ok(())
+}
+
+fn mismatch_error(result: &ConsistencyResult, token: &str) -> String {
+  serde_json::json!({
+    "code": "FINGERPRINT_EXIT_MISMATCH",
+    "params": {
+      "token": token,
+      "exitIp": result.exit_ip.clone().unwrap_or_default(),
+      "exitCountry": result.exit_country_code.clone().unwrap_or_default(),
+      "exitTimezone": result.exit_timezone.clone().unwrap_or_default(),
+      "fingerprintTimezone": result.fingerprint_timezone.clone().unwrap_or_default(),
+      "fingerprintLanguage": result.fingerprint_language.clone().unwrap_or_default(),
+      "mismatches": result.mismatches.join(","),
+    }
+  })
+  .to_string()
+}
+
+fn gate_disabled() -> bool {
+  crate::settings_manager::SettingsManager::instance()
+    .load_settings()
+    .map(|s| s.fingerprint_gate_disabled)
+    .unwrap_or(false)
+}
+
+fn extension_warning_disabled() -> bool {
+  crate::settings_manager::SettingsManager::instance()
+    .load_settings()
+    .map(|s| s.vpn_extension_warning_disabled)
+    .unwrap_or(false)
+}
+
+/// Identity used for consent and acknowledgement when the browser will connect
+/// directly. Distinct from any proxy identity, so accepting a direct-exit
+/// mismatch never disarms the gate for a proxied one.
+const DIRECT_EXIT_IDENTITY: &str = "direct";
+
+/// Gate a launch that will connect directly despite the profile declaring a
+/// route. Measures the exit the browser will really use.
+async fn enforce_direct_exit(
+  profile: &BrowserProfile,
+  gate: &FingerprintGate,
+) -> Result<(), String> {
+  if gate_disabled() {
+    return Ok(());
+  }
+  if crate::launch_gate_prefs::fingerprint_ack_matches(profile, DIRECT_EXIT_IDENTITY) {
+    return Ok(());
+  }
+  if let FingerprintGate::Consented(token) = gate {
+    return redeem_consent(token, profile, DIRECT_EXIT_IDENTITY);
+  }
+  // Automation never probes; without a cache to consult there is nothing to say.
+  if matches!(gate, FingerprintGate::Advisory) {
+    return Ok(());
+  }
+
+  let result = match fingerprint_consistency::probe_direct_and_check(profile).await {
+    Ok(result) => result,
+    Err(e) => {
+      log::warn!(
+        "Fingerprint gate: direct exit probe failed for profile {}, allowing launch: {e}",
+        profile.name
+      );
+      return Ok(());
+    }
+  };
+  if !result.checked || result.consistent {
+    return Ok(());
+  }
+
+  let token = mint_consent(profile, DIRECT_EXIT_IDENTITY);
+  Err(mismatch_error(&result, &token))
+}
+
+/// The enforcing gate. Called from the launch pipeline once the upstream is
+/// normalized and before anything expensive or user-visible happens.
+///
+/// Fails **open** on every degradation — probe failure, timeout, missing geo
+/// database, private exit IP. The gate blocks only on a positively measured
+/// mismatch; a flaky IP-echo endpoint must never make profiles unlaunchable.
+pub async fn enforce_fingerprint_gate(
+  profile: &BrowserProfile,
+  upstream: Option<&crate::browser::ProxySettings>,
+  gate: &FingerprintGate,
+) -> Result<(), String> {
+  // A profile that declares no route is genuinely direct: the browser's exit is
+  // this machine, which is what an un-proxied fingerprint should describe.
+  //
+  // But a profile that DOES declare one and still arrives here with no upstream
+  // is about to go direct anyway — a deleted or unresolvable proxy resolves to
+  // `None` and the launch continues. That is the exact leak this gate exists to
+  // stop, so it must be measured, not waved through.
+  let declares_route = profile.proxy_id.is_some() || profile.vpn_id.is_some();
+  if upstream.is_none() && !declares_route {
+    return Ok(());
+  }
+  if gate_disabled() {
+    return Ok(());
+  }
+
+  // Decide *once*, before any consent handling, whether this launch is going
+  // out directly. Both a route that no longer resolves (deleted proxy) and one
+  // that produced no usable upstream (a VPN worker with no local port) end up
+  // connecting directly, and both must mint and redeem consent under the same
+  // identity — splitting that decision across the function meant the first
+  // attempt minted under "direct" while the retry redeemed against the proxy
+  // identity, so "Launch anyway" could never succeed.
+  let key = fingerprint_consistency::exit_cache_key(profile);
+  if key.is_none() || upstream.is_none() {
+    log::warn!(
+      "Fingerprint gate: {} declares a proxy/VPN that yielded no usable upstream; \
+       measuring the direct exit it will actually use",
+      profile.name
+    );
+    return enforce_direct_exit(profile, gate).await;
+  }
+  let key = key.expect("checked above");
+
+  // Ack first: a persisted acknowledgement already permits this launch, so a
+  // stale token must not turn it into a hard failure.
+  if crate::launch_gate_prefs::fingerprint_ack_matches(profile, &key.identity) {
+    return Ok(());
+  }
+
+  if let FingerprintGate::Consented(token) = gate {
+    redeem_consent(token, profile, &key.identity)?;
+    return Ok(());
+  }
+
+  let result = if matches!(gate, FingerprintGate::Advisory) {
+    // Automation: answer from a warm cache or say nothing. Probing here would
+    // add seconds to every profile in a batch run.
+    fingerprint_consistency::check_profile_consistency_cached(profile)
+  } else {
+    match fingerprint_consistency::probe_and_check_consistency(profile, upstream, &key).await {
+      Ok(result) => result,
+      Err(e) => {
+        log::warn!(
+          "Fingerprint gate: exit probe failed for profile {}, allowing launch: {e}",
+          profile.name
+        );
+        return Ok(());
+      }
+    }
+  };
+
+  if !result.checked || result.consistent {
+    return Ok(());
+  }
+
+  // Only now is the extension scan worth its disk walk. A confirmed
+  // proxy-permission extension can redirect the browser's traffic away from the
+  // upstream we just measured, so the measurement describes an exit the browser
+  // may not take. Report it, but do not hard-block on a number known to be
+  // unreliable.
+  let measurement_unreliable =
+    vpn_extension_detect::has_confirmed(&vpn_extension_detect::scan_profile(profile));
+
+  if matches!(gate, FingerprintGate::Advisory) || measurement_unreliable {
+    log::warn!(
+      "Fingerprint gate: {} launching with a {} exit mismatch ({})",
+      profile.name,
+      if measurement_unreliable {
+        "unverifiable"
+      } else {
+        "known"
+      },
+      result.mismatches.join(", ")
+    );
+    if let Err(e) = crate::events::emit("fingerprint-consistency-warning", &result) {
+      log::warn!("Failed to emit fingerprint consistency warning: {e}");
+    }
+    return Ok(());
+  }
+
+  let token = mint_consent(profile, &key.identity);
+  Err(mismatch_error(&result, &token))
+}
+
+/// Everything the UI needs to decide whether to stop a launch, answered
+/// without touching the network or starting any worker.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PreLaunchChecks {
+  pub vpn_extensions: Vec<DetectedVpnExtension>,
+  pub scan_state: String,
+  /// Cache-only; `checked` is false when the exit has not been measured yet.
+  pub consistency: ConsistencyResult,
+  /// True when the enforcing gate will still probe during the launch, so the
+  /// UI can say the check is not finished rather than implying it passed.
+  pub exit_probe_pending: bool,
+  /// A confirmed proxy-permission extension is present, so any exit
+  /// measurement describes a route the browser may not take.
+  pub exit_measurement_unreliable: bool,
+  /// Present only when a cached mismatch is already blocking, so "launch
+  /// anyway" can proceed without a second round trip.
+  pub consent_token: Option<String>,
+}
+
+fn load_profile(profile_id: &str) -> Result<BrowserProfile, String> {
+  crate::profile::ProfileManager::instance()
+    .list_profiles()
+    .map_err(|e| e.to_string())?
+    .into_iter()
+    .find(|p| p.id.to_string() == profile_id)
+    .ok_or_else(|| crate::backend_error("PROFILE_NOT_FOUND"))
+}
+
+#[tauri::command]
+pub async fn get_profile_pre_launch_checks(profile_id: String) -> Result<PreLaunchChecks, String> {
+  let profile = load_profile(&profile_id)?;
+
+  let scan = if extension_warning_disabled() {
+    vpn_extension_detect::ExtensionScan {
+      extensions: Vec::new(),
+      scan_state: "scanned".to_string(),
+    }
+  } else {
+    vpn_extension_detect::scan_profile(&profile)
+  };
+
+  // Drop anything the user has already acknowledged for this profile, so the
+  // dialog only ever opens for something new.
+  let vpn_extensions: Vec<DetectedVpnExtension> = scan
+    .extensions
+    .iter()
+    .filter(|e| {
+      !crate::launch_gate_prefs::extensions_acked(&profile_id, std::slice::from_ref(&e.key))
+    })
+    .cloned()
+    .collect();
+  let exit_measurement_unreliable = vpn_extension_detect::has_confirmed(&scan);
+
+  let disabled = gate_disabled();
+  let key = fingerprint_consistency::exit_cache_key(&profile);
+
+  let consistency = if disabled {
+    ConsistencyResult::skip()
+  } else {
+    fingerprint_consistency::check_profile_consistency_cached(&profile)
+  };
+
+  let already_acked = key
+    .as_ref()
+    .is_some_and(|k| crate::launch_gate_prefs::fingerprint_ack_matches(&profile, &k.identity));
+
+  let blocking = consistency.checked && !consistency.consistent && !already_acked;
+  let consent_token = match (&key, blocking) {
+    (Some(k), true) => Some(mint_consent(&profile, &k.identity)),
+    _ => None,
+  };
+
+  Ok(PreLaunchChecks {
+    vpn_extensions,
+    scan_state: scan.scan_state,
+    consistency: if blocking {
+      consistency
+    } else {
+      ConsistencyResult::skip()
+    },
+    exit_probe_pending: !disabled && !already_acked && key.is_some() && !blocking,
+    exit_measurement_unreliable,
+    consent_token,
+  })
+}
+
+/// Persist "don't ask me again" choices from the gate dialog.
+#[tauri::command]
+pub async fn ack_launch_gate(
+  profile_id: String,
+  ack_fingerprint: bool,
+  ack_extension_keys: Vec<String>,
+) -> Result<(), String> {
+  let profile = load_profile(&profile_id)?;
+
+  if ack_fingerprint {
+    // Must match the identity the block was issued against. A profile whose
+    // route did not resolve is gated on the direct exit and has no cache key,
+    // so falling back here is what makes "don't block again" stick for it.
+    let identity = fingerprint_consistency::exit_cache_key(&profile)
+      .map(|key| key.identity)
+      .unwrap_or_else(|| DIRECT_EXIT_IDENTITY.to_string());
+    crate::launch_gate_prefs::ack_fingerprint(&profile, &identity);
+  }
+  crate::launch_gate_prefs::ack_extensions(&profile_id, &ack_extension_keys);
+  Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  fn profile_with(fingerprint: &str) -> BrowserProfile {
+    let mut profile = BrowserProfile {
+      id: uuid::Uuid::new_v4(),
+      browser: "wayfern".into(),
+      ..Default::default()
+    };
+    profile.wayfern_config = Some(crate::wayfern_manager::WayfernConfig {
+      fingerprint: Some(fingerprint.to_string()),
+      ..Default::default()
+    });
+    profile
+  }
+
+  #[test]
+  fn consent_token_authorizes_exactly_one_launch() {
+    let profile = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    let token = mint_consent(&profile, "http://gw:1");
+    assert!(redeem_consent(&token, &profile, "http://gw:1").is_ok());
+    // Replaying it must fail, so a leaked token cannot re-authorize.
+    assert!(redeem_consent(&token, &profile, "http://gw:1").is_err());
+  }
+
+  #[test]
+  fn consent_token_is_rejected_for_a_different_profile() {
+    let profile = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    let other = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    let token = mint_consent(&profile, "http://gw:1");
+    assert!(redeem_consent(&token, &other, "http://gw:1").is_err());
+  }
+
+  #[test]
+  fn consent_token_is_rejected_after_the_fingerprint_changes() {
+    let profile = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    let token = mint_consent(&profile, "http://gw:1");
+
+    let mut regenerated = profile_with(r#"{"timezone":"America/New_York"}"#);
+    regenerated.id = profile.id;
+    assert!(redeem_consent(&token, &regenerated, "http://gw:1").is_err());
+  }
+
+  #[test]
+  fn consent_token_is_rejected_after_the_exit_changes() {
+    // The reason a bare `bypass: bool` is not enough: consent granted for one
+    // proxy must not authorize a launch through another.
+    let profile = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    let token = mint_consent(&profile, "http://gw:1");
+    assert!(redeem_consent(&token, &profile, "http://other:2").is_err());
+  }
+
+  #[test]
+  fn an_unknown_token_is_rejected() {
+    let profile = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    let err = redeem_consent("deadbeef", &profile, "http://gw:1").unwrap_err();
+    assert!(err.contains("LAUNCH_CONSENT_EXPIRED"), "{err}");
+  }
+
+  #[test]
+  fn expired_tokens_are_swept_and_rejected() {
+    let profile = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    let token = mint_consent(&profile, "http://gw:1");
+    // Back-date it past the TTL.
+    {
+      let mut store = consents();
+      if let Some(pending) = store.get_mut(&token) {
+        pending.issued_at = crate::proxy_manager::now_secs() - CONSENT_TTL_SECS - 1;
+      }
+    }
+    assert!(redeem_consent(&token, &profile, "http://gw:1").is_err());
+  }
+
+  #[test]
+  fn mismatch_error_carries_the_details_the_dialog_renders() {
+    let result = ConsistencyResult {
+      consistent: false,
+      checked: true,
+      exit_ip: Some("1.2.3.4".into()),
+      exit_country_code: Some("DE".into()),
+      exit_timezone: Some("Europe/Berlin".into()),
+      fingerprint_timezone: Some("America/New_York".into()),
+      fingerprint_language: Some("en-US".into()),
+      mismatches: vec!["timezone".into(), "language".into()],
+    };
+    let encoded = mismatch_error(&result, "tok");
+    let parsed: serde_json::Value = serde_json::from_str(&encoded).unwrap();
+    assert_eq!(parsed["code"], "FINGERPRINT_EXIT_MISMATCH");
+    assert_eq!(parsed["params"]["token"], "tok");
+    assert_eq!(parsed["params"]["exitTimezone"], "Europe/Berlin");
+    assert_eq!(parsed["params"]["fingerprintTimezone"], "America/New_York");
+    // params values must be strings for the frontend's interpolation.
+    assert_eq!(parsed["params"]["mismatches"], "timezone,language");
+  }
+
+  #[tokio::test]
+  async fn gate_allows_a_direct_connection_without_measuring() {
+    let profile = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    assert!(
+      enforce_fingerprint_gate(&profile, None, &FingerprintGate::Enforce)
+        .await
+        .is_ok()
+    );
+  }
+
+  #[tokio::test]
+  async fn gate_allows_a_profile_with_no_proxy_or_vpn() {
+    // A profile that declares no route has no upstream either — that pairing is
+    // the only one the launcher can actually produce. It must return without
+    // measuring anything, so this stays a pure unit test with no network.
+    let profile = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    assert!(
+      enforce_fingerprint_gate(&profile, None, &FingerprintGate::Enforce)
+        .await
+        .is_ok()
+    );
+  }
+
+  #[tokio::test]
+  async fn consent_for_a_direct_launch_is_redeemable_by_the_gate() {
+    // Regression: a route that yields no usable upstream is gated on the direct
+    // exit, so consent is minted under DIRECT_EXIT_IDENTITY. If the gate then
+    // redeemed against the proxy/VPN identity instead, "Launch anyway" would
+    // fail forever and the profile could never be started.
+    let mut profile = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    profile.vpn_id = Some("vpn-with-no-port".into());
+
+    let token = mint_consent(&profile, DIRECT_EXIT_IDENTITY);
+    // No upstream: the launcher could not bring the route up.
+    let result = enforce_fingerprint_gate(&profile, None, &FingerprintGate::Consented(token)).await;
+    assert!(
+      result.is_ok(),
+      "consent minted for the direct exit must be redeemable, got {result:?}"
+    );
+  }
+}
@@ -0,0 +1,280 @@
+//! Persisted "I know, launch it anyway" acknowledgements for the launch gate.
+//!
+//! Deliberately NOT synced. An acknowledgement is a statement about this
+//! machine's operator ("I understand this profile's exit disagrees with its
+//! fingerprint"), not a property of the profile. Syncing it would let one
+//! teammate disarm another's gate, and writing it into profile metadata would
+//! bump `updated_at` and make a local dismissal look like a remote edit.
+
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::path::PathBuf;
+use std::sync::Mutex;
+
+use crate::profile::types::BrowserProfile;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct FingerprintAck {
+  /// Hash of the fingerprint that was acknowledged.
+  pub fingerprint_hash: String,
+  /// Exit endpoint identity it was acknowledged against.
+  pub exit_identity: String,
+  pub acked_at: u64,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct LaunchGatePrefs {
+  #[serde(default)]
+  pub fingerprint_acks: HashMap<String, FingerprintAck>,
+  /// Profile id -> acknowledged extension keys.
+  #[serde(default)]
+  pub vpn_extension_acks: HashMap<String, Vec<String>>,
+}
+
+lazy_static::lazy_static! {
+  /// Serializes read-modify-write so two concurrent acknowledgements in a bulk
+  /// run cannot clobber each other.
+  static ref PREFS_LOCK: Mutex<()> = Mutex::new(());
+}
+
+fn prefs_file() -> PathBuf {
+  crate::app_dirs::data_subdir().join("launch_gate_prefs.json")
+}
+
+pub fn load() -> LaunchGatePrefs {
+  let Ok(content) = std::fs::read_to_string(prefs_file()) else {
+    return LaunchGatePrefs::default();
+  };
+  serde_json::from_str(&content).unwrap_or_else(|e| {
+    log::warn!("Failed to parse launch gate prefs, ignoring them: {e}");
+    LaunchGatePrefs::default()
+  })
+}
+
+fn save(prefs: &LaunchGatePrefs) {
+  let path = prefs_file();
+  if let Some(parent) = path.parent() {
+    if let Err(e) = std::fs::create_dir_all(parent) {
+      log::warn!("Failed to create launch gate prefs dir: {e}");
+      return;
+    }
+  }
+  match serde_json::to_string_pretty(prefs) {
+    Ok(json) => {
+      if let Err(e) = std::fs::write(&path, json) {
+        log::warn!("Failed to write launch gate prefs: {e}");
+      }
+    }
+    Err(e) => log::warn!("Failed to serialize launch gate prefs: {e}"),
+  }
+}
+
+fn update(mutate: impl FnOnce(&mut LaunchGatePrefs)) {
+  let _guard = PREFS_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+  let mut prefs = load();
+  mutate(&mut prefs);
+  save(&prefs);
+}
+
+/// Stable digest of a profile's stored fingerprint, so an acknowledgement stops
+/// applying the moment the fingerprint is regenerated or matched to a new exit.
+pub fn fingerprint_hash(profile: &BrowserProfile) -> String {
+  use sha2::{Digest, Sha256};
+  let fingerprint = profile
+    .wayfern_config
+    .as_ref()
+    .and_then(|c| c.fingerprint.as_deref())
+    .unwrap_or("");
+  let mut hasher = Sha256::new();
+  hasher.update(fingerprint.as_bytes());
+  hasher
+    .finalize()
+    .iter()
+    .map(|b| format!("{b:02x}"))
+    .collect()
+}
+
+/// Record that the user accepted this exact (fingerprint, exit) mismatch.
+pub fn ack_fingerprint(profile: &BrowserProfile, exit_identity: &str) {
+  let ack = FingerprintAck {
+    fingerprint_hash: fingerprint_hash(profile),
+    exit_identity: exit_identity.to_string(),
+    acked_at: crate::proxy_manager::now_secs(),
+  };
+  let profile_id = profile.id.to_string();
+  update(|prefs| {
+    prefs.fingerprint_acks.insert(profile_id, ack);
+  });
+}
+
+/// Whether the user already accepted the mismatch this profile currently has.
+///
+/// Bound to both the fingerprint and the exit endpoint on purpose: the old
+/// per-profile "don't warn again" flag never expired, so one dismissal left a
+/// profile unprotected forever, including after its proxy was swapped for one
+/// in a different country.
+pub fn fingerprint_ack_matches(profile: &BrowserProfile, exit_identity: &str) -> bool {
+  let prefs = load();
+  prefs
+    .fingerprint_acks
+    .get(&profile.id.to_string())
+    .is_some_and(|ack| {
+      ack.fingerprint_hash == fingerprint_hash(profile) && ack.exit_identity == exit_identity
+    })
+}
+
+pub fn ack_extensions(profile_id: &str, keys: &[String]) {
+  if keys.is_empty() {
+    return;
+  }
+  let profile_id = profile_id.to_string();
+  let keys = keys.to_vec();
+  update(|prefs| {
+    let entry = prefs.vpn_extension_acks.entry(profile_id).or_default();
+    for key in keys {
+      if !entry.contains(&key) {
+        entry.push(key);
+      }
+    }
+  });
+}
+
+/// True when every one of these extensions has already been acknowledged for
+/// this profile. Installing a *different* VPN extension later re-warns, because
+/// its key is not in the acknowledged set.
+pub fn extensions_acked(profile_id: &str, keys: &[String]) -> bool {
+  if keys.is_empty() {
+    return true;
+  }
+  let prefs = load();
+  let Some(acked) = prefs.vpn_extension_acks.get(profile_id) else {
+    return false;
+  };
+  keys.iter().all(|k| acked.contains(k))
+}
+
+/// Drop everything remembered for a profile, for use when it is deleted.
+pub fn forget_profile(profile_id: &str) {
+  let profile_id = profile_id.to_string();
+  update(|prefs| {
+    prefs.fingerprint_acks.remove(&profile_id);
+    prefs.vpn_extension_acks.remove(&profile_id);
+  });
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  fn profile_with(fingerprint: &str) -> BrowserProfile {
+    let mut profile = BrowserProfile {
+      id: uuid::Uuid::new_v4(),
+      browser: "wayfern".into(),
+      ..Default::default()
+    };
+    profile.wayfern_config = Some(crate::wayfern_manager::WayfernConfig {
+      fingerprint: Some(fingerprint.to_string()),
+      ..Default::default()
+    });
+    profile
+  }
+
+  #[test]
+  fn fingerprint_hash_changes_with_the_fingerprint() {
+    let a = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    let b = profile_with(r#"{"timezone":"America/New_York"}"#);
+    assert_ne!(fingerprint_hash(&a), fingerprint_hash(&b));
+  }
+
+  #[test]
+  fn fingerprint_hash_is_stable_for_the_same_fingerprint() {
+    let a = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    let b = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    assert_eq!(fingerprint_hash(&a), fingerprint_hash(&b));
+  }
+
+  #[test]
+  fn a_profile_without_a_fingerprint_still_hashes() {
+    let profile = BrowserProfile {
+      id: uuid::Uuid::new_v4(),
+      ..Default::default()
+    };
+    assert!(!fingerprint_hash(&profile).is_empty());
+  }
+
+  #[test]
+  fn acks_round_trip_and_rearm_on_change() {
+    let _guard = crate::app_dirs::set_test_data_dir(tempfile::tempdir().expect("tempdir").keep());
+
+    let profile = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    assert!(!fingerprint_ack_matches(&profile, "http://gw:1"));
+
+    ack_fingerprint(&profile, "http://gw:1");
+    assert!(fingerprint_ack_matches(&profile, "http://gw:1"));
+
+    // Swapping the proxy re-arms the gate: the mismatch the user accepted is
+    // not the mismatch they now have.
+    assert!(!fingerprint_ack_matches(&profile, "http://other:2"));
+
+    // Regenerating the fingerprint re-arms it too.
+    let regenerated = profile_with(r#"{"timezone":"America/New_York"}"#);
+    let mut same_id = regenerated.clone();
+    same_id.id = profile.id;
+    assert!(!fingerprint_ack_matches(&same_id, "http://gw:1"));
+  }
+
+  #[test]
+  fn extension_acks_are_per_key() {
+    let _guard = crate::app_dirs::set_test_data_dir(tempfile::tempdir().expect("tempdir").keep());
+
+    let profile_id = uuid::Uuid::new_v4().to_string();
+    let nord = vec!["crx:aaaa".to_string()];
+    let other = vec!["crx:bbbb".to_string()];
+
+    assert!(!extensions_acked(&profile_id, &nord));
+    ack_extensions(&profile_id, &nord);
+    assert!(extensions_acked(&profile_id, &nord));
+
+    // A different extension installed later must warn again.
+    assert!(!extensions_acked(&profile_id, &other));
+    assert!(!extensions_acked(
+      &profile_id,
+      &[nord[0].clone(), other[0].clone()]
+    ));
+
+    // Nothing to acknowledge is trivially acknowledged, so an empty scan never
+    // opens the dialog.
+    assert!(extensions_acked(&profile_id, &[]));
+  }
+
+  #[test]
+  fn forgetting_a_profile_clears_both_kinds_of_ack() {
+    let _guard = crate::app_dirs::set_test_data_dir(tempfile::tempdir().expect("tempdir").keep());
+
+    let profile = profile_with(r#"{"timezone":"Europe/Berlin"}"#);
+    let profile_id = profile.id.to_string();
+    ack_fingerprint(&profile, "http://gw:1");
+    ack_extensions(&profile_id, &["crx:aaaa".to_string()]);
+
+    forget_profile(&profile_id);
+
+    assert!(!fingerprint_ack_matches(&profile, "http://gw:1"));
+    assert!(!extensions_acked(&profile_id, &["crx:aaaa".to_string()]));
+  }
+
+  #[test]
+  fn corrupt_prefs_file_is_ignored_rather_than_fatal() {
+    let dir = tempfile::tempdir().expect("tempdir").keep();
+    let _guard = crate::app_dirs::set_test_data_dir(dir.clone());
+    std::fs::create_dir_all(dir.join("data")).unwrap();
+    std::fs::write(
+      dir.join("data").join("launch_gate_prefs.json"),
+      "{ not json",
+    )
+    .unwrap();
+
+    // Must not panic, and must fail closed (nothing acknowledged).
+    let prefs = load();
+    assert!(prefs.fingerprint_acks.is_empty());
+  }
+}
@@ -23,6 +23,16 @@ pub(crate) fn backend_error_with_detail(code: &str, detail: impl std::fmt::Displ
  serde_json::json!({ "code": code, "params": { "detail": detail.to_string() } }).to_string()
 }

+/// A VLESS URI Donut cannot use, carrying which part is unsupported so the UI
+/// can say so instead of implying a typo.
+pub(crate) fn vless_config_error(error: &crate::xray::XrayError) -> String {
+  serde_json::json!({
+    "code": "VLESS_CONFIG_INVALID",
+    "params": { "reason": error.reason_code(), "detail": error.to_string() }
+  })
+  .to_string()
+}
+
 fn e2e_automation_enabled() -> bool {
  #[cfg(feature = "e2e")]
  {
@@ -51,6 +61,7 @@ mod automation_rate_limiter;
 mod browser;
 mod browser_runner;
 mod browser_version_manager;
+mod cdp_target;
 mod default_browser;
 pub mod dns_blocklist;
 mod downloaded_browsers_registry;
@@ -64,6 +75,8 @@ mod geolocation;
 mod group_manager;
 mod human_typing;
 mod ip_utils;
+mod launch_gate;
+mod launch_gate_prefs;
 mod log_redaction;
 mod platform_browser;
 mod profile;
@@ -72,6 +85,8 @@ mod proxy_manager;
 pub mod proxy_runner;
 pub mod proxy_server;
 pub mod proxy_storage;
+mod remote_exit;
+mod remote_handoff;
 mod remote_session;
 mod settings_manager;
 pub mod socks5_local;
@@ -80,9 +95,12 @@ mod synchronizer;
 pub mod traffic_stats;
 mod wayfern_manager;
 mod wayfern_terms;
+mod window_decorations;
 // mod theme_detector; // removed: theme detection handled in webview via CSS prefers-color-scheme
 pub mod cloud_auth;
+mod cloud_errors;
 mod commercial_license;
+mod cookie_bot;
 mod cookie_manager;
 pub mod events;
 mod mcp_integrations;
@@ -91,6 +109,7 @@ mod tag_manager;
 mod team_lock;
 mod version_updater;
 pub mod vpn;
+mod vpn_extension_detect;
 pub mod vpn_worker_runner;
 pub mod vpn_worker_storage;
 pub mod xray;
@@ -310,6 +329,16 @@ async fn create_stored_proxy(
  }
 }

+/// Validate a VLESS URI without touching the network, so the proxy form can
+/// tell the user their setup is unsupported while they are still editing it
+/// rather than only after they try to save or launch.
+#[tauri::command]
+fn validate_vless_uri(uri: String) -> Result<(), String> {
+  crate::xray::parse_vless_uri(uri.trim())
+    .map(|_| ())
+    .map_err(|error| vless_config_error(&error))
+}
+
 #[tauri::command]
 async fn get_stored_proxies() -> Result<Vec<crate::proxy_manager::StoredProxy>, String> {
  Ok(crate::proxy_manager::PROXY_MANAGER.get_stored_proxies())
@@ -1286,6 +1315,264 @@ async fn generate_sample_fingerprint(
  }
 }

+// --- Remote sessions --------------------------------------------------------
+//
+// Everything below is transport only. The session state machine, the fleet, the
+// schedule, the browsing behaviour and the budget all live behind
+// donutbrowser-infra; these commands carry the user's own scalars there and
+// render back what the server says.
+
+/// Turn a remote-session failure into the code the frontend translates.
+///
+/// The typed variants carry the backend's own English, which reaches the user
+/// untranslated if it is surfaced as-is. The raw text is kept in the app log,
+/// where support can read it, and never in the toast.
+fn remote_session_error(context: &str, err: remote_session::RemoteSessionError) -> String {
+  log::warn!("Remote session {context} failed: {err}");
+  err.to_error_json()
+}
+
+/// Every remote session the signed-in user currently owns.
+#[tauri::command]
+async fn list_remote_sessions() -> Result<Vec<remote_session::RemoteSessionState>, String> {
+  remote_session::list_remote_sessions()
+    .await
+    .map_err(|e| remote_session_error("list", e))
+}
+
+/// One session's real state.
+///
+/// The stream is how the desktop normally learns a transition; this is the
+/// one-shot read for a window opened after the fact, or a reconnect confirming
+/// what it missed.
+#[tauri::command]
+async fn get_remote_session(
+  session_id: String,
+) -> Result<remote_session::RemoteSessionState, String> {
+  remote_session::get_remote_session(&session_id)
+    .await
+    .map_err(|e| remote_session_error("read", e))
+}
+
+/// Stop a remote session and settle what it cost.
+///
+/// Without this the only thing that ends a session is the fleet's two-hour cap,
+/// so a handful of short launches bills an allowance meant for a hundred.
+#[tauri::command]
+async fn stop_remote_session(
+  app_handle: tauri::AppHandle,
+  session_id: String,
+) -> Result<remote_session::EndRemoteSessionOutcome, String> {
+  let outcome = remote_session::end_remote_session(&session_id)
+    .await
+    .map_err(|e| remote_session_error("stop", e))?;
+  // The stream normally reports the close, but a stop must not depend on a
+  // socket being up: without this the session's work would sit in cloud storage
+  // with nothing to pull it, and the profile would look ready to open locally
+  // while its local copy still predated the session.
+  remote_session::note_session_stopped(&app_handle, &session_id);
+  Ok(outcome)
+}
+
+/// Which profiles cannot be launched locally right now, and why.
+///
+/// Backed by the same store the launch gate reads, so the button the UI disables
+/// and the refusal the backend would produce can never disagree.
+#[tauri::command]
+fn get_remote_handoff_states() -> std::collections::HashMap<String, remote_handoff::HandoffState> {
+  remote_handoff::states()
+}
+
+/// Subscribe to session transitions. Idempotent.
+///
+/// Called once the desktop has a cloud session: signed out there is nothing to
+/// stream and the socket would only be refused on a loop.
+#[tauri::command]
+fn start_remote_session_events(app_handle: tauri::AppHandle) {
+  remote_session::start_session_events(app_handle);
+}
+
+/// Unsubscribe. Safe when nothing is running; called on sign-out.
+#[tauri::command]
+fn stop_remote_session_events() {
+  remote_session::stop_session_events();
+}
+
+/// Whether the desktop is subscribed to session transitions.
+///
+/// A UI that mounts after the stream started has no `remote-session-stream`
+/// event to read, so this is how it decides whether to trust the live state or
+/// fall back to `list_remote_sessions`.
+#[tauri::command]
+fn get_remote_session_events_status() -> bool {
+  remote_session::session_events_running()
+}
+
+// --- Cookie bot -------------------------------------------------------------
+
+/// Turn a cookie-bot failure into the code the frontend translates.
+fn cookie_bot_error(context: &str, err: cookie_bot::CookieBotError) -> String {
+  log::warn!(
+    "Cookie bot {context} failed: {} (HTTP {})",
+    err.code(),
+    err.status()
+  );
+  err.to_error_json()
+}
+
+/// The local profile a cookie-bot write refers to.
+///
+/// Enrolment and run-now act on a profile this machine holds: the client-side
+/// preconditions read its sync mode, OS and exit node, and none of that can be
+/// checked for a profile that is not here.
+fn cookie_bot_profile(profile_id: &str) -> Result<profile::BrowserProfile, String> {
+  let profiles = profile::manager::ProfileManager::instance()
+    .list_profiles()
+    .map_err(|e| wrap_backend_error(e, "Failed to read profiles"))?;
+  profiles
+    .into_iter()
+    .find(|p| p.id.to_string() == profile_id)
+    .ok_or_else(|| backend_error("PROFILE_NOT_FOUND"))
+}
+
+/// Every enrolment the caller can see. `scope` is `mine` or `team`.
+#[tauri::command]
+async fn get_cookie_bot_schedules(
+  scope: Option<String>,
+) -> Result<cookie_bot::CookieBotScheduleList, String> {
+  cookie_bot::list_schedules(scope.as_deref())
+    .await
+    .map_err(|e| cookie_bot_error("schedule list", e))
+}
+
+/// This profile's enrolment, or `None` when it has none.
+#[tauri::command]
+async fn get_cookie_bot_schedule(
+  profile_id: String,
+) -> Result<Option<cookie_bot::CookieBotSchedule>, String> {
+  cookie_bot::get_schedule(&profile_id)
+    .await
+    .map_err(|e| cookie_bot_error("schedule read", e))
+}
+
+/// Create or replace this profile's enrolment.
+///
+/// `acknowledge_conflict` is the second half of a two-step write: a teammate's
+/// existing enrolment refuses the first PUT and names them, and the same call
+/// with the flag set goes through.
+#[tauri::command]
+async fn save_cookie_bot_schedule(
+  profile_id: String,
+  schedule: cookie_bot::CookieBotScheduleInput,
+  acknowledge_conflict: bool,
+) -> Result<cookie_bot::CookieBotScheduleSaved, String> {
+  // Refused here rather than at 02:00: a profile that can never be warmed
+  // should never reach a schedule row, an hour of quota or a leased host.
+  let profile = cookie_bot_profile(&profile_id)?;
+  cookie_bot::bot_precondition(&profile, &cookie_bot::exit_reachability(&profile))?;
+  // The frontend sends the user's choices; the profile facts the server refuses
+  // a run on are stamped here, from the profile itself, so a caller cannot
+  // assert them.
+  let schedule = schedule.with_profile_state(cookie_bot::profile_state(&profile));
+  cookie_bot::save_schedule(&profile_id, &schedule, acknowledge_conflict)
+    .await
+    .map_err(|e| cookie_bot_error("schedule write", e))
+}
+
+/// Turn the bot off for this profile. `false` means there was nothing enrolled.
+#[tauri::command]
+async fn delete_cookie_bot_schedule(profile_id: String) -> Result<bool, String> {
+  cookie_bot::delete_schedule(&profile_id)
+    .await
+    .map(|outcome| outcome.deleted)
+    .map_err(|e| cookie_bot_error("schedule delete", e))
+}
+
+/// Who else already warms this profile, without writing anything.
+#[tauri::command]
+async fn check_cookie_bot_conflicts(
+  profile_id: String,
+  run_at_minute: Option<u16>,
+  timezone: Option<String>,
+  days_mask: Option<u8>,
+) -> Result<Vec<cookie_bot::CookieBotConflict>, String> {
+  cookie_bot::check_conflicts(&profile_id, run_at_minute, timezone.as_deref(), days_mask)
+    .await
+    .map(|check| check.conflicts)
+    .map_err(|e| cookie_bot_error("conflict check", e))
+}
+
+/// One page of run history, newest first.
+#[tauri::command]
+async fn get_cookie_bot_runs(
+  profile_id: Option<String>,
+  scope: Option<String>,
+  limit: Option<u32>,
+  before: Option<String>,
+) -> Result<cookie_bot::CookieBotRunPage, String> {
+  cookie_bot::list_runs(
+    profile_id.as_deref(),
+    scope.as_deref(),
+    limit,
+    before.as_deref(),
+  )
+  .await
+  .map_err(|e| cookie_bot_error("run list", e))
+}
+
+/// Start a run now instead of waiting for tonight.
+///
+/// The preset and the site list come from the stored enrolment, so an
+/// unenrolled profile is refused rather than run with client-chosen defaults.
+#[tauri::command]
+async fn run_cookie_bot_now(
+  profile_id: String,
+  max_minutes: Option<u32>,
+) -> Result<cookie_bot::CookieBotRunStarted, String> {
+  let profile = cookie_bot_profile(&profile_id)?;
+  cookie_bot::bot_precondition(&profile, &cookie_bot::exit_reachability(&profile))?;
+  cookie_bot::run_now(&profile_id, max_minutes)
+    .await
+    .map_err(|e| cookie_bot_error("run start", e))
+}
+
+/// Stop a run that is still going.
+#[tauri::command]
+async fn cancel_cookie_bot_run(run_id: String) -> Result<cookie_bot::CookieBotRun, String> {
+  cookie_bot::cancel_run(&run_id)
+    .await
+    .map_err(|e| cookie_bot_error("run cancel", e))
+}
+
+/// The intensities the server offers today. Opaque ids and a typical duration —
+/// what each one actually does is the server's to know.
+#[tauri::command]
+async fn get_cookie_bot_presets() -> Result<cookie_bot::CookieBotPresetList, String> {
+  cookie_bot::list_presets()
+    .await
+    .map_err(|e| cookie_bot_error("preset list", e))
+}
+
+/// The pooled remote-hour budget: bot and interactive sessions share one pool.
+///
+/// Being refused a launch must not be the only way to learn a limit exists.
+#[tauri::command]
+async fn get_remote_hours_quota() -> Result<cookie_bot::RemoteHoursQuota, String> {
+  cookie_bot::remote_hours_quota()
+    .await
+    .map_err(|e| cookie_bot_error("quota read", e))
+}
+
+/// Per-member and per-profile spend for a calendar month (`YYYY-MM`).
+#[tauri::command]
+async fn get_cookie_bot_usage(
+  period: Option<String>,
+) -> Result<cookie_bot::CookieBotUsage, String> {
+  cookie_bot::team_usage(period.as_deref())
+    .await
+    .map_err(|e| cookie_bot_error("usage read", e))
+}
+
 /// Confirm a quit chosen from the close-confirmation dialog and exit the app.
 #[tauri::command]
 fn confirm_quit(app_handle: tauri::AppHandle) {
@@ -1505,7 +1792,12 @@ pub fn run_with_builder(
        .with_state_flags(
          tauri_plugin_window_state::StateFlags::all()
            & !tauri_plugin_window_state::StateFlags::VISIBLE
-            & !tauri_plugin_window_state::StateFlags::FULLSCREEN,
+            & !tauri_plugin_window_state::StateFlags::FULLSCREEN
+            // Whether the window is decorated is decided per-session by
+            // `window_decorations::use_client_side_decorations()`, not by what
+            // a previous run saved. Restoring it would put a real titlebar back
+            // on top of the one the app draws — or strip both.
+            & !tauri_plugin_window_state::StateFlags::DECORATIONS,
        )
        .build(),
    );
@@ -1545,9 +1837,21 @@ pub fn run_with_builder(
          None => win_builder,
      };

+      // The app draws its own titlebar. macOS keeps the native one and makes
+      // it transparent (below); Windows and Linux drop decorations entirely and
+      // render their own controls.
      #[cfg(target_os = "windows")]
      let win_builder = win_builder.decorations(false);

+      // Linux opts out on the one configuration where dropping decorations can
+      // make things worse rather than better — see `use_client_side_decorations`.
+      #[cfg(target_os = "linux")]
+      let win_builder = if window_decorations::use_client_side_decorations() {
+        win_builder.decorations(false)
+      } else {
+        win_builder
+      };
+
      #[allow(unused_variables)]
      let window = win_builder.build().unwrap();

@@ -1580,6 +1884,44 @@ pub fn run_with_builder(
        });
      }

+      // Publish the desktop's titlebar button layout to the frontend. Runs
+      // here because `setup` is the GTK main thread, which `gtk::Settings`
+      // requires.
+      //
+      // The decorated state is logged alongside it: "my window has no titlebar"
+      // and "my window has two titlebars" are both reports that hinge on this
+      // one boolean, and it is otherwise invisible after the fact.
+      #[cfg(target_os = "linux")]
+      {
+        log::info!(
+          "Linux window decorations: server-side = {:?}",
+          window.is_decorated()
+        );
+
+        // tao makes the window visible before it clears the decorations, so it
+        // is realized while still framed and the frame extents come out of the
+        // size we asked for (a requested 880x500 arrives noticeably smaller).
+        //
+        // Only correct that on a first run. Once window-state has geometry
+        // saved, that geometry is the user's and has already been restored —
+        // re-applying the default here would move and resize their window on
+        // every launch, and the plugin would then persist the reset.
+        let has_saved_geometry = app
+          .path()
+          .app_config_dir()
+          .map(|dir| dir.join(".window-state.json").exists())
+          .unwrap_or(false);
+        if window_decorations::use_client_side_decorations() && !has_saved_geometry {
+          if let Err(e) = window.set_size(tauri::LogicalSize::new(880.0, 500.0)) {
+            log::warn!("Failed to re-apply the window size after dropping decorations: {e}");
+          }
+          if let Err(e) = window.center() {
+            log::warn!("Failed to re-center the window after dropping decorations: {e}");
+          }
+        }
+      }
+      window_decorations::init(app.handle());
+
      // Set transparent titlebar for macOS
      #[cfg(target_os = "macos")]
      {
@@ -2286,6 +2628,18 @@ pub fn run_with_builder(
            }
          };
          tokio::join!(sync_token_fut, proxy_fut, wayfern_fut);
+
+          // Subscribe to remote-session transitions. Started here rather than
+          // unconditionally because a signed-out desktop has nothing to stream
+          // and would only be refused on a loop; the frontend starts it again
+          // through `start_remote_session_events` once the user signs in.
+          remote_session::start_session_events(app_handle_cloud.clone());
+
+          // A session that finished while this machine was shut, or whose pull
+          // ran out of retries offline, leaves a profile blocked from launching
+          // with its work still in cloud storage. Signing in is the first moment
+          // that pull can succeed, so it is where it is retried.
+          remote_handoff::resume_pending_pulls(&app_handle_cloud);
        }
        cloud_auth::CloudAuthManager::start_sync_token_refresh_loop(app_handle_cloud).await;
      });
@@ -2400,8 +2754,11 @@ pub fn run_with_builder(
      clear_all_traffic_stats,
      clear_profile_traffic_stats,
      get_traffic_stats_for_period,
-      fingerprint_consistency::check_profile_fingerprint_consistency,
      fingerprint_consistency::match_profile_fingerprint_to_exit,
+      launch_gate::get_profile_pre_launch_checks,
+      launch_gate::ack_launch_gate,
+      window_decorations::get_window_decoration_layout,
+      validate_vless_uri,
      get_sync_settings,
      save_sync_settings,
      set_profile_sync_mode,
@@ -2478,6 +2835,34 @@ pub fn run_with_builder(
      dns_blocklist::set_custom_dns_config,
      dns_blocklist::import_custom_dns_rules,
      dns_blocklist::export_custom_dns_rules,
+      // Remote session commands
+      list_remote_sessions,
+      get_remote_session,
+      stop_remote_session,
+      get_remote_handoff_states,
+      start_remote_session_events,
+      stop_remote_session_events,
+      get_remote_session_events_status,
+      // Cookie bot commands
+      get_cookie_bot_schedules,
+      get_cookie_bot_schedule,
+      save_cookie_bot_schedule,
+      delete_cookie_bot_schedule,
+      check_cookie_bot_conflicts,
+      get_cookie_bot_runs,
+      run_cookie_bot_now,
+      cancel_cookie_bot_run,
+      get_cookie_bot_presets,
+      get_remote_hours_quota,
+      get_cookie_bot_usage,
+      // Defined in `cookie_bot.rs` rather than here because they carry no local
+      // precondition — there is no profile to look up and no `bot_precondition`
+      // to apply. Unregistered they are unreachable, and the saved-list tab
+      // fails at runtime with "command not found" rather than at build time.
+      cookie_bot::get_cookie_bot_user_templates,
+      cookie_bot::create_cookie_bot_user_template,
+      cookie_bot::update_cookie_bot_user_template,
+      cookie_bot::delete_cookie_bot_user_template,
      // Profile password commands
      set_profile_password,
      change_profile_password,
@@ -2490,6 +2875,12 @@ pub fn run_with_builder(
    .build(tauri::generate_context!())
    .expect("error while building tauri application")
    .run(|_app_handle, _event| {
+      // Drop the session stream before the runtime goes away, so a shutdown
+      // never waits out a reconnect backoff that is about to be pointless.
+      if let tauri::RunEvent::Exit = _event {
+        remote_session::stop_session_events();
+      }
+
      #[cfg(target_os = "macos")]
      if let tauri::RunEvent::Reopen { .. } = _event {
        if let Some(window) = _app_handle.get_webview_window("main") {
@@ -2523,6 +2914,30 @@ mod tests {
    );
  }

+  #[test]
+  fn the_frontend_listens_for_the_remote_session_events_that_are_emitted() {
+    // These names are the whole of BUG-2's fix: the backend answers a launch
+    // with `provisioning` and nothing else, so a desktop that subscribes to a
+    // name the emitter does not use is blind between launch and stop and shows
+    // nothing at all. Renaming one side is silent everywhere else.
+    let client = fs::read_to_string("../src/lib/remote-sessions.ts")
+      .expect("the frontend remote-session client must exist");
+    for event in [
+      crate::remote_session::EVENT_SESSION_STATE,
+      crate::remote_session::EVENT_SESSION_SNAPSHOT,
+      crate::remote_session::EVENT_STREAM_STATUS,
+      // The launch gate is emitted from the same place for the same reason: a
+      // Run button that does not hear about it stays enabled over a profile the
+      // backend will refuse, or over unsynced work it must not open.
+      crate::remote_handoff::EVENT_REMOTE_HANDOFF,
+    ] {
+      assert!(
+        client.contains(&format!("\"{event}\"")),
+        "no frontend listener for the emitted event {event}"
+      );
+    }
+  }
+
  #[test]
  fn test_no_unused_tauri_commands() {
    check_unused_commands(false); // Run in strict mode for CI
@@ -41,7 +41,7 @@ fn is_kept(name: &str) -> bool {
 /// step since it regenerates — leaves a populated `Default/` without it. Such a
 /// directory would then be treated as stale and removed wholesale, destroying the
 /// Extensions and Bookmarks this feature exists to preserve.
-fn is_profile_dir_name(name: &str) -> bool {
+pub(crate) fn is_profile_dir_name(name: &str) -> bool {
  matches!(name, "Default" | "Guest Profile" | "System Profile")
    || name
      .strip_prefix("Profile ")
@@ -479,6 +479,10 @@ impl ProfileManager {
      );
    }

+    // Launch-gate acknowledgements are keyed by profile id and are not synced,
+    // so nothing else would ever clean them up.
+    crate::launch_gate_prefs::forget_profile(profile_id);
+
    // Remember sync mode before deleting local files
    let was_sync_enabled = profile.is_sync_enabled();

@@ -1189,6 +1193,12 @@ impl ProfileManager {

    crate::sync::queue_profile_sync_if_eligible(&profile);

+    // The cookie bot refuses a run on a profile with no exit node, using the
+    // copy of that fact the desktop last declared. Detaching a proxy has to
+    // move that copy, or tonight's run egresses from the leased host's own
+    // datacenter address.
+    crate::cookie_bot::report_profile_state(&profile);
+
    // Auto-enable sync for new proxy if profile has sync enabled
    if profile.is_sync_enabled() {
      if let Some(ref new_proxy_id) = proxy_id {
@@ -1250,6 +1260,10 @@ impl ProfileManager {

    crate::sync::queue_profile_sync_if_eligible(&profile);

+    // Same reason as the proxy path: a VPN is the profile's exit node too, and
+    // the server only knows what this machine last told it.
+    crate::cookie_bot::report_profile_state(&profile);
+
    // Auto-enable sync for the new VPN if profile has sync enabled.
    if profile.is_sync_enabled() {
      if let Some(ref new_vpn_id) = vpn_id {
@@ -464,10 +464,10 @@ impl ProxyManager {
      .as_deref()
      .filter(|uri| !uri.is_empty())
      .ok_or_else(|| crate::backend_error("VLESS_CONFIG_INVALID"))?;
-    let parsed = crate::xray::parse_vless_uri(uri)
-      .map_err(|error| crate::backend_error_with_detail("VLESS_CONFIG_INVALID", error))?;
+    let parsed =
+      crate::xray::parse_vless_uri(uri).map_err(|error| crate::vless_config_error(&error))?;
    let canonical_uri = crate::xray::export_vless_uri(&parsed.config, parsed.name.as_deref())
-      .map_err(|error| crate::backend_error_with_detail("VLESS_CONFIG_INVALID", error))?;
+      .map_err(|error| crate::vless_config_error(&error))?;

    proxy_settings.proxy_type = "vless".to_string();
    proxy_settings.host = parsed.config.address;
@@ -1152,6 +1152,21 @@ impl ProxyManager {
    url
  }

+  /// Proxy URL for a diagnostic probe made by the app itself (reqwest), as
+  /// opposed to `build_proxy_url`, which feeds the browser.
+  ///
+  /// SOCKS5 becomes `socks5h://` so the probe endpoint's hostname resolves at
+  /// the exit rather than on this machine. Resolving locally would leak the
+  /// real DNS and, behind a split-horizon resolver, can reach a different host
+  /// than the browser would.
+  pub fn build_probe_proxy_url(proxy_settings: &ProxySettings) -> String {
+    let url = Self::build_proxy_url(proxy_settings);
+    if proxy_settings.proxy_type.eq_ignore_ascii_case("socks5") {
+      return url.replacen("socks5://", "socks5h://", 1);
+    }
+    url
+  }
+
  // Check if a proxy is valid by routing through a temporary donut-proxy process.
  // This tests the exact same code path the browser uses.
  // Falls back to direct reqwest check if the proxy worker fails to start.
@@ -210,14 +210,51 @@ pub fn generate_proxy_id() -> String {
  )
 }

-/// A process that has exited but whose parent has not reaped it. It still owns
-/// a PID and still appears in the process table, so an existence check reports
-/// it as alive — forever, since the workers and browsers we spawn are detached
-/// and never waited on. Treating it as running is what would keep a dead
-/// browser's worker alive on Linux, where zombies persist for the whole life of
-/// the parent process.
-fn process_is_zombie(process: &sysinfo::Process) -> bool {
-  process.status() == sysinfo::ProcessStatus::Zombie
+/// Has this process exited even though the process table still lists it?
+///
+/// Both platforms have a way for a dead process to keep its PID and its
+/// process-table entry, which makes a bare existence check report it as alive.
+///
+/// Unix: a zombie, exited but not reaped by its parent. It persists for the
+/// whole life of the parent, and since the workers and browsers we spawn are
+/// detached and never waited on, that is forever. Treating one as running is
+/// what would keep a dead browser's worker alive.
+///
+/// Windows: no zombie status, but the same hazard. The process object outlives
+/// the last thread that exited, and its PID stays reserved for as long as any
+/// handle to it is open, so a snapshot taken right after a kill can still list
+/// a process that is already gone. `WaitForSingleObject` with a zero timeout
+/// answers authoritatively: a signalled process object has exited, whatever the
+/// snapshot says.
+fn process_has_exited(process: &sysinfo::Process) -> bool {
+  if process.status() == sysinfo::ProcessStatus::Zombie {
+    return true;
+  }
+
+  #[cfg(target_os = "windows")]
+  {
+    use windows::Win32::Foundation::{CloseHandle, WAIT_OBJECT_0};
+    use windows::Win32::System::Threading::{
+      OpenProcess, WaitForSingleObject, PROCESS_SYNCHRONIZE,
+    };
+
+    unsafe {
+      // Opening fails for processes we are not allowed to touch (another user,
+      // elevated, protected). Those we cannot query, so keep the snapshot's
+      // verdict rather than declaring a live process dead.
+      let Ok(handle) = OpenProcess(PROCESS_SYNCHRONIZE, false, process.pid().as_u32()) else {
+        return false;
+      };
+      let signalled = WaitForSingleObject(handle, 0) == WAIT_OBJECT_0;
+      let _ = CloseHandle(handle);
+      signalled
+    }
+  }
+
+  #[cfg(not(target_os = "windows"))]
+  {
+    false
+  }
 }

 pub fn process_start_time(pid: u32) -> Option<u64> {
@@ -231,15 +268,16 @@ pub fn process_start_time(pid: u32) -> Option<u64> {
  );
  system
    .process(pid)
-    .filter(|process| !process_is_zombie(process))
+    .filter(|process| !process_has_exited(process))
    .map(sysinfo::Process::start_time)
 }

 /// Whether a process from an existing `System` snapshot is genuinely alive.
 /// Callers that already hold a full scan use this instead of re-querying, but
-/// must still exclude zombies the same way `process_start_time` does.
+/// must still exclude the dead-yet-listed the same way `process_start_time`
+/// does.
 pub fn snapshot_process_is_alive(process: &sysinfo::Process) -> bool {
-  !process_is_zombie(process)
+  !process_has_exited(process)
 }

 pub fn is_process_running(pid: u32) -> bool {
@@ -395,25 +433,12 @@ mod tests {
      .expect("failed to spawn child");
    let pid = child.id();
    child.wait().expect("child failed");
-    // On Windows a terminated process remains a live kernel object (and sysinfo
-    // keeps reporting it) until the LAST handle to it is closed. std::Child
-    // holds that handle until dropped, so the check below would otherwise see
-    // the just-exited process as still running. Drop the handle, then allow a
-    // brief moment for the OS to reclaim the process before asserting. (In
-    // production these PIDs belong to detached browsers/workers that no handle
-    // outlives, so is_process_running already observes their exit promptly.)
-    drop(child);

-    let mut became_dead = false;
-    for _ in 0..50 {
-      if !is_process_running(pid) {
-        became_dead = true;
-        break;
-      }
-      std::thread::sleep(std::time::Duration::from_millis(20));
-    }
+    // `child` is deliberately still in scope. On Windows its open handle keeps
+    // the exited process a live kernel object that the snapshot still reports,
+    // which is exactly the case `process_has_exited` has to see through.
    assert!(
-      became_dead,
+      !is_process_running(pid),
      "is_process_running must return false for a dead process (PID {pid})"
    );
  }
@@ -0,0 +1,511 @@
+//! Whether a profile's exit node can be reached from somewhere that is not this
+//! machine.
+//!
+//! Remote execution — an interactive remote session or a Cookie Bot night — runs
+//! the browser on a leased fleet host, but the PROFILE (and its proxy, and its
+//! VPN config) is pulled from the user's sync namespace. Nothing in that
+//! handover rewrites addresses, so a proxy recorded as `127.0.0.1:8080` arrives
+//! on the fleet host meaning *the fleet host's own loopback*.
+//!
+//! That is the whole bug this module exists to prevent. The server already
+//! refuses a profile with NO exit (`proxy_required`), because a night browsed
+//! from the fleet's datacenter address damages an identity rather than building
+//! it — but it was asking whether an exit was *configured*, never whether it was
+//! *reachable*. A local proxy satisfied the first question and failed the
+//! second, so the run was accepted, dispatched, and burned a leased host either
+//! erroring out or (worse) egressing direct from the datacenter: exactly the
+//! outcome `proxy_required` exists to stop, reached by the one route it did not
+//! check.
+//!
+//! Local proxies are not an exotic case. A local MITM proxy, an SSH tunnel, a
+//! locally-run SOCKS client and Donut's own VLESS support all present to the
+//! browser as `127.0.0.1:<port>`.
+//!
+//! This module is the single answer, shared by every caller, and it FAILS
+//! CLOSED: anything it cannot parse is reported as unreachable. Refusing a
+//! working setup costs the user one support question; accepting a broken one
+//! costs a burned hour and a damaged profile identity.
+
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+
+/// Whether a leased fleet host could dial this profile's exit.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ExitReachability {
+  /// No proxy and no VPN. The caller's existing "no exit" refusal applies.
+  None,
+  /// An address a host elsewhere on the internet can reach.
+  Remote,
+  /// An address that only means anything on this machine or this LAN.
+  LocalOnly {
+    /// The offending host, for a message the user can act on.
+    host: String,
+    /// Which part of the config it came from: "proxy" or "VPN".
+    source: &'static str,
+  },
+  /// Configured, but this code could not determine the host.
+  ///
+  /// Treated as unreachable by [`ExitReachability::is_remote`] — see the
+  /// fail-closed note in the module docs.
+  Unknown {
+    reason: String,
+    source: &'static str,
+  },
+}
+
+impl ExitReachability {
+  /// Whether remote execution may proceed.
+  pub fn is_remote(&self) -> bool {
+    matches!(self, ExitReachability::Remote)
+  }
+
+  /// A one-line reason for a refusal, or None when there is nothing to refuse.
+  pub fn refusal_detail(&self) -> Option<String> {
+    match self {
+      ExitReachability::Remote | ExitReachability::None => None,
+      ExitReachability::LocalOnly { host, source } => Some(format!(
+        "The {source} for this profile points at {host}, which only exists on this computer. \
+         Remote runs happen on our hosts and cannot reach it."
+      )),
+      ExitReachability::Unknown { reason, source } => Some(format!(
+        "The {source} for this profile could not be read ({reason}), so we cannot confirm a \
+         remote host could use it."
+      )),
+    }
+  }
+}
+
+/// Whether a hostname or IP literal is reachable from another machine.
+///
+/// Rejects, in order: empty/whitespace, unparsable-as-either, and every IP
+/// range that is scoped to a machine or a private network. Hostnames that are
+/// not IP literals are accepted unless they use a name suffix that is
+/// definitionally local — a public DNS name cannot be validated here without a
+/// lookup, and doing a lookup would make this impure and slow on a hot path.
+pub fn host_is_remote_reachable(host: &str) -> bool {
+  let host = normalize_host(host);
+  if host.is_empty() {
+    return false;
+  }
+
+  if let Ok(ip) = host.parse::<IpAddr>() {
+    return ip_is_remote_reachable(ip);
+  }
+
+  let lower = host.to_ascii_lowercase();
+
+  // `localhost` and anything under it resolve to loopback everywhere.
+  if lower == "localhost" || lower.ends_with(".localhost") {
+    return false;
+  }
+
+  // Suffixes reserved for local/private name resolution (RFC 6762 mDNS, RFC
+  // 8375, and the names router vendors hand out on a LAN). A fleet host
+  // resolving one of these gets its own network's answer, not the user's.
+  const LOCAL_SUFFIXES: [&str; 7] = [
+    ".local",
+    ".localdomain",
+    ".internal",
+    ".home",
+    ".home.arpa",
+    ".lan",
+    ".intranet",
+  ];
+  if LOCAL_SUFFIXES.iter().any(|suffix| lower.ends_with(suffix)) {
+    return false;
+  }
+
+  // A bare single-label name ("my-proxy", "router") is only resolvable through
+  // a local search domain, so it is no more use to a fleet host than `.local`.
+  if !lower.contains('.') {
+    return false;
+  }
+
+  true
+}
+
+/// Whether an IP literal is routable from another machine.
+fn ip_is_remote_reachable(ip: IpAddr) -> bool {
+  match ip {
+    IpAddr::V4(v4) => ipv4_is_remote_reachable(v4),
+    IpAddr::V6(v6) => ipv6_is_remote_reachable(v6),
+  }
+}
+
+fn ipv4_is_remote_reachable(ip: Ipv4Addr) -> bool {
+  // `is_private`/`is_loopback`/`is_link_local` are stable; the rest are not, so
+  // the remaining ranges are spelled out rather than gated behind a nightly
+  // feature.
+  if ip.is_loopback() || ip.is_private() || ip.is_link_local() || ip.is_unspecified() {
+    return false;
+  }
+  if ip.is_broadcast() || ip.is_multicast() || ip.is_documentation() {
+    return false;
+  }
+  let [a, b, ..] = ip.octets();
+  // 100.64.0.0/10 — carrier-grade NAT (RFC 6598). Reachable inside one
+  // carrier's network and nowhere else.
+  if a == 100 && (64..128).contains(&b) {
+    return false;
+  }
+  // 0.0.0.0/8 "this network", and 240.0.0.0/4 reserved.
+  if a == 0 || a >= 240 {
+    return false;
+  }
+  true
+}
+
+fn ipv6_is_remote_reachable(ip: Ipv6Addr) -> bool {
+  if ip.is_loopback() || ip.is_unspecified() || ip.is_multicast() {
+    return false;
+  }
+  // An IPv4 address wearing an IPv6 hat is still that IPv4 address — classify
+  // it as one, or `::ffff:127.0.0.1` walks straight through.
+  if let Some(v4) = ip.to_ipv4_mapped() {
+    return ipv4_is_remote_reachable(v4);
+  }
+  if let Some(v4) = ip.to_ipv4() {
+    return ipv4_is_remote_reachable(v4);
+  }
+  let segments = ip.segments();
+  // fc00::/7 unique-local, fe80::/10 link-local.
+  if (segments[0] & 0xfe00) == 0xfc00 {
+    return false;
+  }
+  if (segments[0] & 0xffc0) == 0xfe80 {
+    return false;
+  }
+  true
+}
+
+/// Strip the decoration a host can arrive wrapped in: whitespace, `[...]`
+/// around an IPv6 literal, a trailing dot on an FQDN, and any `user@` or
+/// `:port` that came along from a URI.
+fn normalize_host(raw: &str) -> String {
+  let mut host = raw.trim();
+  if host.is_empty() {
+    return String::new();
+  }
+
+  // `user:pass@host` — take what follows the LAST '@', since a password may
+  // itself contain one.
+  if let Some(at) = host.rfind('@') {
+    host = &host[at + 1..];
+  }
+
+  // Bracketed IPv6, optionally with a port: `[::1]:1080`.
+  if let Some(stripped) = host.strip_prefix('[') {
+    if let Some(end) = stripped.find(']') {
+      return stripped[..end].trim().to_string();
+    }
+    return stripped.trim().to_string();
+  }
+
+  // `host:port`, but only when there is exactly one colon — more than one means
+  // a bare IPv6 literal, whose colons are part of the address.
+  if host.matches(':').count() == 1 {
+    if let Some((left, _port)) = host.split_once(':') {
+      host = left;
+    }
+  }
+
+  host.trim().trim_end_matches('.').to_string()
+}
+
+/// The host a VLESS URI actually dials.
+///
+/// Load-bearing because of an asymmetry that is easy to get backwards: a VLESS
+/// proxy presents to the browser as `127.0.0.1:<port>` — Donut runs a local xray
+/// worker and points the browser at it — but the address that decides whether
+/// anyone else could use this config is the SERVER inside the URI. The local
+/// port is an implementation detail of this machine; the URI is the exit.
+pub fn vless_uri_host(uri: &str) -> Option<String> {
+  let rest = uri.trim().strip_prefix("vless://")?;
+  // Cut the fragment (`#label`) and query (`?type=...`) before looking for the
+  // authority — either may contain '@' or ':'.
+  let rest = rest.split('#').next()?;
+  let rest = rest.split('?').next()?;
+  // `uuid@host:port/...`
+  let authority = rest.split('/').next()?;
+  let host_port = authority
+    .rsplit_once('@')
+    .map(|(_, h)| h)
+    .unwrap_or(authority);
+  let host = normalize_host(host_port);
+  if host.is_empty() {
+    None
+  } else {
+    Some(host)
+  }
+}
+
+/// The exit host a stored proxy represents, as a remote host would have to dial
+/// it.
+pub fn proxy_exit_host(settings: &crate::browser::ProxySettings) -> Result<String, String> {
+  if settings.proxy_type.eq_ignore_ascii_case("vless") {
+    let uri = settings
+      .vless_uri
+      .as_deref()
+      .filter(|uri| !uri.trim().is_empty())
+      .ok_or_else(|| "VLESS proxy has no server URI".to_string())?;
+    return vless_uri_host(uri).ok_or_else(|| "VLESS server URI is malformed".to_string());
+  }
+
+  let host = normalize_host(&settings.host);
+  if host.is_empty() {
+    return Err("proxy has no host".to_string());
+  }
+  Ok(host)
+}
+
+/// Classify a stored proxy.
+pub fn classify_proxy(settings: &crate::browser::ProxySettings) -> ExitReachability {
+  match proxy_exit_host(settings) {
+    Err(reason) => ExitReachability::Unknown {
+      reason,
+      source: "proxy",
+    },
+    Ok(host) => {
+      if host_is_remote_reachable(&host) {
+        ExitReachability::Remote
+      } else {
+        ExitReachability::LocalOnly {
+          host,
+          source: "proxy",
+        }
+      }
+    }
+  }
+}
+
+/// Classify a WireGuard peer endpoint (`host:port`).
+pub fn classify_wireguard_endpoint(peer_endpoint: &str) -> ExitReachability {
+  let host = normalize_host(peer_endpoint);
+  if host.is_empty() {
+    return ExitReachability::Unknown {
+      reason: "VPN config has no peer endpoint".to_string(),
+      source: "VPN",
+    };
+  }
+  if host_is_remote_reachable(&host) {
+    ExitReachability::Remote
+  } else {
+    ExitReachability::LocalOnly {
+      host,
+      source: "VPN",
+    }
+  }
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+  use crate::browser::ProxySettings;
+
+  fn proxy(proxy_type: &str, host: &str) -> ProxySettings {
+    ProxySettings {
+      proxy_type: proxy_type.to_string(),
+      host: host.to_string(),
+      port: 8080,
+      username: None,
+      password: None,
+      vless_uri: None,
+    }
+  }
+
+  #[test]
+  fn loopback_in_every_spelling_is_local() {
+    // The literal case the bug was reported for, plus the spellings that reach
+    // the same place. `::ffff:127.0.0.1` is the one a naive IPv6 check misses.
+    for host in [
+      "127.0.0.1",
+      "127.1.2.3",
+      "localhost",
+      "LOCALHOST",
+      "foo.localhost",
+      "::1",
+      "[::1]",
+      "::ffff:127.0.0.1",
+      "0.0.0.0",
+      "::",
+    ] {
+      assert!(
+        !host_is_remote_reachable(host),
+        "{host} should not be remote-reachable"
+      );
+    }
+  }
+
+  #[test]
+  fn private_and_carrier_ranges_are_local() {
+    for host in [
+      "10.0.0.1",
+      "192.168.1.1",
+      "172.16.0.1",
+      "172.31.255.254",
+      "169.254.1.1", // link-local / APIPA
+      "100.64.0.1",  // CGNAT
+      "100.127.255.1",
+      "fd00::1", // unique-local
+      "fe80::1", // link-local
+      "240.0.0.1",
+      "0.1.2.3",
+    ] {
+      assert!(
+        !host_is_remote_reachable(host),
+        "{host} should not be remote-reachable"
+      );
+    }
+  }
+
+  #[test]
+  fn public_addresses_and_names_are_reachable() {
+    for host in [
+      "1.1.1.1",
+      "8.8.8.8",
+      "172.15.0.1", // just outside 172.16/12
+      "172.32.0.1",
+      "100.63.255.255", // just outside 100.64/10
+      "100.128.0.1",
+      "2606:4700:4700::1111",
+      "proxy.example.com",
+      "gate.smartproxy.net.",
+      "residential.example.co.uk",
+    ] {
+      assert!(
+        host_is_remote_reachable(host),
+        "{host} should be remote-reachable"
+      );
+    }
+  }
+
+  #[test]
+  fn lan_only_names_are_local() {
+    // A fleet host resolving these gets ITS network's answer, not the user's —
+    // which is worse than failing, because it may well succeed against
+    // something unrelated.
+    for host in [
+      "my-proxy", // single label: needs a search domain
+      "router.local",
+      "nas.home.arpa",
+      "proxy.lan",
+      "box.internal",
+      "server.localdomain",
+      "gateway.intranet",
+    ] {
+      assert!(
+        !host_is_remote_reachable(host),
+        "{host} should not be remote-reachable"
+      );
+    }
+  }
+
+  #[test]
+  fn host_port_and_credentials_are_stripped_before_classifying() {
+    assert!(!host_is_remote_reachable("127.0.0.1:8080"));
+    assert!(!host_is_remote_reachable("user:pass@127.0.0.1:8080"));
+    assert!(!host_is_remote_reachable("[::1]:1080"));
+    assert!(host_is_remote_reachable("user:p@ss@proxy.example.com:8080"));
+  }
+
+  #[test]
+  fn a_vless_proxy_is_judged_by_its_server_not_its_local_port() {
+    // THE asymmetry. Donut points the browser at a local xray worker, so the
+    // browser-facing address of every VLESS proxy is 127.0.0.1 — but the stored
+    // config names a real server, and that is what a fleet host would dial.
+    // Classifying VLESS off `settings.host` would refuse every VLESS profile.
+    let mut settings = proxy("vless", "127.0.0.1");
+    settings.vless_uri =
+      Some("vless://6d6e21a1-4829-4d2b-bc7f-1b25707b61e4@vpn.example.com:443?type=tcp#node".into());
+
+    assert_eq!(classify_proxy(&settings), ExitReachability::Remote);
+  }
+
+  #[test]
+  fn a_vless_uri_pointing_at_loopback_is_still_local() {
+    let mut settings = proxy("vless", "127.0.0.1");
+    settings.vless_uri = Some("vless://uuid@127.0.0.1:443?type=tcp".into());
+
+    assert_eq!(
+      classify_proxy(&settings),
+      ExitReachability::LocalOnly {
+        host: "127.0.0.1".to_string(),
+        source: "proxy",
+      }
+    );
+  }
+
+  #[test]
+  fn vless_host_parsing_survives_query_and_fragment() {
+    assert_eq!(
+      vless_uri_host("vless://uuid@example.com:443?sni=a@b.com&x=1#my@label"),
+      Some("example.com".to_string())
+    );
+    assert_eq!(
+      vless_uri_host("vless://uuid@[2606:4700::1111]:443?type=ws"),
+      Some("2606:4700::1111".to_string())
+    );
+    assert_eq!(vless_uri_host("not-a-vless-uri"), None);
+  }
+
+  #[test]
+  fn an_unreadable_config_fails_closed() {
+    // Unknown must never be treated as usable: the point of the check is that
+    // we could not confirm reachability, and guessing "yes" reintroduces the
+    // exact failure it prevents.
+    let mut settings = proxy("vless", "");
+    settings.vless_uri = None;
+    let verdict = classify_proxy(&settings);
+
+    assert!(matches!(verdict, ExitReachability::Unknown { .. }));
+    assert!(!verdict.is_remote());
+    assert!(verdict.refusal_detail().is_some());
+  }
+
+  #[test]
+  fn ordinary_proxies_are_classified_by_host() {
+    assert_eq!(
+      classify_proxy(&proxy("socks5", "gate.example.com")),
+      ExitReachability::Remote
+    );
+    assert_eq!(
+      classify_proxy(&proxy("http", "192.168.0.10")),
+      ExitReachability::LocalOnly {
+        host: "192.168.0.10".to_string(),
+        source: "proxy",
+      }
+    );
+  }
+
+  #[test]
+  fn wireguard_endpoints_are_classified_by_their_peer() {
+    assert_eq!(
+      classify_wireguard_endpoint("vpn.example.com:51820"),
+      ExitReachability::Remote
+    );
+    assert_eq!(
+      classify_wireguard_endpoint("10.0.0.1:51820"),
+      ExitReachability::LocalOnly {
+        host: "10.0.0.1".to_string(),
+        source: "VPN",
+      }
+    );
+    assert!(matches!(
+      classify_wireguard_endpoint("  "),
+      ExitReachability::Unknown { .. }
+    ));
+  }
+
+  #[test]
+  fn only_remote_permits_a_run() {
+    assert!(ExitReachability::Remote.is_remote());
+    assert!(!ExitReachability::None.is_remote());
+    assert!(!ExitReachability::LocalOnly {
+      host: "127.0.0.1".into(),
+      source: "proxy"
+    }
+    .is_remote());
+    // `None` has no detail: the caller's existing "no exit at all" refusal is
+    // the better message, and two refusals for one condition read as a bug.
+    assert!(ExitReachability::None.refusal_detail().is_none());
+  }
+}
@@ -0,0 +1,543 @@
+//! What a remote session owes this machine, and the gate that collects it.
+//!
+//! A profile that runs on the leased fleet is written by the host, not here.
+//! The host pushes it back to cloud storage when the session ends, and until
+//! this machine has pulled that push, the local profile directory is a stale
+//! copy of something that has moved on.
+//!
+//! Opening that stale copy is not a cosmetic problem, it is destructive. The
+//! local browser writes, every local mtime jumps past the host's push, and the
+//! next ordinary sync therefore reads local as the newer side: it uploads the
+//! pre-session files and puts everything the host wrote into
+//! `files_to_delete_remote`. A night of cookie warming is deleted with no error
+//! anywhere. Nothing in the manifest can prevent this, because by then the local
+//! clock genuinely IS later.
+//!
+//! So the gate is here instead, and it is deliberately a LOCAL, per-machine
+//! fact rather than a synced one. "This computer has not yet pulled" is true of
+//! one computer at a time; putting it in the profile's synced metadata would let
+//! a second device that had already pulled clear it for a first device that had
+//! not.
+//!
+//! Two states, and the difference matters to the user:
+//!
+//! - [`HandoffState::Running`]: a session is live on the fleet. The profile lock
+//!   is held server-side, so a launch would be refused anyway; this makes the
+//!   refusal instant and legible instead of a round trip and a raw string.
+//! - [`HandoffState::PendingSync`]: the session is over, the lock is released,
+//!   and the work is sitting in cloud storage. This is the window that used to
+//!   be wide open.
+
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::sync::RwLock;
+use std::time::Duration;
+
+/// Emitted whenever the set of gated profiles changes.
+pub const EVENT_REMOTE_HANDOFF: &str = "remote-handoff-changed";
+
+/// Attempts at pulling a finished session's work before giving up for now.
+///
+/// The entry survives a failure, so "giving up" only means this burst stops;
+/// the next stream event, app start or manual sync tries again. What the retries
+/// buy is the common case: the profile lock is released server-side a moment
+/// before this machine's cached copy of it expires, and a single attempt would
+/// hit `Skipped("profile is locked elsewhere")` and leave the user blocked for
+/// no reason.
+const PULL_ATTEMPTS: u32 = 5;
+
+/// Delay before the second pull attempt. Doubles, capped by [`PULL_RETRY_MAX`].
+const PULL_RETRY_BASE: Duration = Duration::from_secs(2);
+
+/// Ceiling on the pull backoff. Above the 30s profile-lock refresh, so a run of
+/// attempts is guaranteed to span at least one refresh of the lock cache.
+const PULL_RETRY_MAX: Duration = Duration::from_secs(45);
+
+/// Where a profile stands with respect to the fleet.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum HandoffState {
+  /// A session is live on the fleet right now.
+  Running,
+  /// A session has finished and its work has not been pulled down yet.
+  PendingSync,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct HandoffEntry {
+  session_id: String,
+  state: HandoffState,
+  /// When this entry last changed, unix seconds. Diagnostics only; the gate
+  /// never expires on its own, because an entry that timed out would reopen
+  /// exactly the window it exists to close.
+  observed_at: u64,
+}
+
+type Store = HashMap<String, HandoffEntry>;
+
+static STORE: RwLock<Option<Store>> = RwLock::new(None);
+
+fn store_path() -> std::path::PathBuf {
+  crate::app_dirs::settings_dir().join("remote_handoff.json")
+}
+
+fn load_from_disk() -> Store {
+  let path = store_path();
+  let Ok(bytes) = std::fs::read(&path) else {
+    return Store::new();
+  };
+  match serde_json::from_slice::<Store>(&bytes) {
+    Ok(store) => store,
+    Err(e) => {
+      // Losing the file means losing the gate, so say so loudly rather than
+      // starting empty and quietly permitting a launch over pending work.
+      log::error!(
+        "Could not read {}: {e}. Profiles with unsynced remote work will not be gated until \
+         the next session event.",
+        path.display()
+      );
+      Store::new()
+    }
+  }
+}
+
+fn persist(store: &Store) {
+  let path = store_path();
+  if let Some(parent) = path.parent() {
+    if let Err(e) = std::fs::create_dir_all(parent) {
+      log::warn!("Could not create {}: {e}", parent.display());
+      return;
+    }
+  }
+  match serde_json::to_vec_pretty(store) {
+    Ok(bytes) => {
+      if let Err(e) = crate::app_dirs::write_owner_only(&path, &bytes) {
+        log::warn!("Could not write {}: {e}", path.display());
+      }
+    }
+    Err(e) => log::warn!("Could not encode the remote handoff store: {e}"),
+  }
+}
+
+fn with_store<T>(f: impl FnOnce(&mut Store) -> T) -> T {
+  let mut guard = STORE
+    .write()
+    .unwrap_or_else(std::sync::PoisonError::into_inner);
+  let store = guard.get_or_insert_with(load_from_disk);
+  f(store)
+}
+
+/// Apply a mutation, and persist plus announce it only if it changed anything.
+fn mutate(f: impl FnOnce(&mut Store) -> bool) {
+  let changed = with_store(|store| {
+    let changed = f(store);
+    if changed {
+      persist(store);
+    }
+    changed
+  });
+  if changed {
+    announce();
+  }
+}
+
+fn now_secs() -> u64 {
+  std::time::SystemTime::now()
+    .duration_since(std::time::UNIX_EPOCH)
+    .map(|d| d.as_secs())
+    .unwrap_or(0)
+}
+
+fn announce() {
+  let _ = crate::events::emit(EVENT_REMOTE_HANDOFF, states());
+}
+
+/// Every gated profile, for the UI and for one-shot reads.
+pub fn states() -> HashMap<String, HandoffState> {
+  with_store(|store| {
+    store
+      .iter()
+      .map(|(profile_id, entry)| (profile_id.clone(), entry.state))
+      .collect()
+  })
+}
+
+/// Where this profile stands, if it is gated at all.
+pub fn state_for(profile_id: &str) -> Option<HandoffState> {
+  with_store(|store| store.get(profile_id).map(|entry| entry.state))
+}
+
+/// The session currently holding this profile on the fleet, if any.
+///
+/// Answers for a `provisioning` session too, which the drivable-session index
+/// deliberately does not. Stopping a session that has not finished coming up is
+/// the single most common thing a user does after starting one by mistake, and
+/// an index built for "where do I attach a CDP client" cannot serve it.
+pub fn running_session_for_profile(profile_id: &str) -> Option<String> {
+  with_store(|store| {
+    store
+      .get(profile_id)
+      .filter(|entry| entry.state == HandoffState::Running)
+      .map(|entry| entry.session_id.clone())
+  })
+}
+
+/// Which profile a session belongs to, as this machine last recorded it.
+///
+/// The backend's stop reply carries a session id and a duration but no profile,
+/// and the caller that pressed stop needs to know whose work to pull. Reading it
+/// back from the gate avoids a second round trip for something already known.
+pub fn profile_for_session(session_id: &str) -> Option<String> {
+  with_store(|store| {
+    store
+      .iter()
+      .find(|(_, entry)| entry.session_id == session_id)
+      .map(|(profile_id, _)| profile_id.clone())
+  })
+}
+
+/// Record that a session is live on the fleet for this profile.
+///
+/// Written to disk immediately, and this is the point of the whole store: if the
+/// app is closed while a session runs, nothing on restart would otherwise
+/// distinguish "this profile is fine" from "a host has been writing to this
+/// profile for the last hour".
+pub fn note_running(profile_id: &str, session_id: &str) {
+  mutate(|store| {
+    let entry = store.get(profile_id);
+    if entry
+      .is_some_and(|held| held.state == HandoffState::Running && held.session_id == session_id)
+    {
+      return false;
+    }
+    store.insert(
+      profile_id.to_string(),
+      HandoffEntry {
+        session_id: session_id.to_string(),
+        state: HandoffState::Running,
+        observed_at: now_secs(),
+      },
+    );
+    true
+  });
+}
+
+/// Record that a session has finished and its work is waiting in cloud storage.
+///
+/// Returns whether this call is the one that moved the profile into
+/// `PendingSync`, so the caller starts exactly one pull for a transition that
+/// the stream may well deliver more than once.
+pub fn note_ended(profile_id: &str, session_id: &str) -> bool {
+  let mut transitioned = false;
+  mutate(|store| {
+    // Only a session this machine was watching can hand work over to it.
+    //
+    // No entry means one of two things and both say "do nothing": the pull for
+    // this session already completed and cleared the gate, or this machine
+    // never held the profile. The backend's listing returns closed sessions
+    // alongside live ones, so the snapshot on every reconnect replays each
+    // finished session — treating those as fresh handoffs would gate a
+    // perfectly current profile on every app start, and keep it blocked for as
+    // long as the machine happened to be offline.
+    let Some(entry) = store.get(profile_id) else {
+      return false;
+    };
+    // A late `closed` for a session that has already been replaced by a newer
+    // one must not mark the newer one's profile as finished.
+    if entry.session_id != session_id {
+      return false;
+    }
+    if entry.state == HandoffState::PendingSync {
+      return false;
+    }
+    transitioned = true;
+    store.insert(
+      profile_id.to_string(),
+      HandoffEntry {
+        session_id: session_id.to_string(),
+        state: HandoffState::PendingSync,
+        observed_at: now_secs(),
+      },
+    );
+    true
+  });
+  transitioned
+}
+
+/// Drop the gate. Called only after a pull has actually completed.
+pub fn clear(profile_id: &str) {
+  mutate(|store| store.remove(profile_id).is_some());
+}
+
+/// Bring stored `Running` entries back in line with what the backend reports.
+///
+/// The stream is how a transition normally arrives, and it cannot deliver one
+/// that happened while the app was shut. Any profile this machine last saw
+/// running, whose session the backend no longer reports as live, finished
+/// without being observed — and its work is sitting in cloud storage unpulled.
+/// Returns the profiles that just moved into `PendingSync`.
+pub fn reconcile(live_session_ids: &std::collections::HashSet<String>) -> Vec<String> {
+  let mut ended = Vec::new();
+  mutate(|store| {
+    let stale: Vec<(String, String)> = store
+      .iter()
+      .filter(|(_, entry)| entry.state == HandoffState::Running)
+      .filter(|(_, entry)| !live_session_ids.contains(&entry.session_id))
+      .map(|(profile_id, entry)| (profile_id.clone(), entry.session_id.clone()))
+      .collect();
+    for (profile_id, session_id) in stale {
+      log::info!(
+        "Remote session {session_id} for profile {profile_id} ended while this machine was not \
+         watching; its work is still in cloud storage"
+      );
+      store.insert(
+        profile_id.clone(),
+        HandoffEntry {
+          session_id,
+          state: HandoffState::PendingSync,
+          observed_at: now_secs(),
+        },
+      );
+      ended.push(profile_id);
+    }
+    !ended.is_empty()
+  });
+  ended
+}
+
+/// Refuse a local launch that would run over unsynced remote work.
+///
+/// Returns the `{"code":…}` string a Tauri command and the REST layer both
+/// surface. Every local launch path calls this: the two that did not are how a
+/// profile could be opened locally while a host was still writing to it.
+pub fn ensure_local_launch_allowed(profile_id: &str) -> Result<(), String> {
+  match state_for(profile_id) {
+    None => Ok(()),
+    Some(HandoffState::Running) => Err(crate::backend_error("PROFILE_RUNNING_REMOTELY")),
+    Some(HandoffState::PendingSync) => Err(crate::backend_error("PROFILE_REMOTE_SYNC_PENDING")),
+  }
+}
+
+/// Restart the pull for every profile still waiting on one.
+///
+/// A pull can fail for as long as the machine is offline, and its retries are
+/// bounded, so without this a profile could stay blocked from launching until
+/// the user found the manual sync button. Called whenever the app has a cloud
+/// session again, which is exactly when a previously impossible pull becomes
+/// possible.
+pub fn resume_pending_pulls(app_handle: &tauri::AppHandle) {
+  let pending: Vec<String> = with_store(|store| {
+    store
+      .iter()
+      .filter(|(_, entry)| entry.state == HandoffState::PendingSync)
+      .map(|(profile_id, _)| profile_id.clone())
+      .collect()
+  });
+  for profile_id in pending {
+    log::info!("Resuming the post-session pull for profile {profile_id}");
+    schedule_pull(app_handle.clone(), profile_id);
+  }
+}
+
+/// Pull one profile's finished session down, then lift its gate.
+///
+/// Spawned rather than awaited by its callers: a stream frame and a stop button
+/// must not block on a transfer that can take minutes. The gate stays up for the
+/// whole attempt, so there is no window in which the user can open the stale
+/// copy while this is in flight.
+pub fn schedule_pull(app_handle: tauri::AppHandle, profile_id: String) {
+  tauri::async_runtime::spawn(async move {
+    for attempt in 0..PULL_ATTEMPTS {
+      if state_for(&profile_id) != Some(HandoffState::PendingSync) {
+        // A new session started, or another pull got there first.
+        return;
+      }
+      if attempt > 0 {
+        let delay = PULL_RETRY_BASE
+          .saturating_mul(1u32 << (attempt - 1).min(16))
+          .min(PULL_RETRY_MAX);
+        tokio::time::sleep(delay).await;
+      }
+
+      match crate::sync::pull_profile_after_remote_session(&app_handle, &profile_id).await {
+        Ok(outcome) if outcome.is_completed() => {
+          log::info!("Pulled remote session work for profile {profile_id}");
+          clear(&profile_id);
+          return;
+        }
+        Ok(crate::sync::ProfileSyncOutcome::Skipped(reason)) => {
+          log::info!("Post-session pull for profile {profile_id} did nothing ({reason}); retrying");
+        }
+        Ok(_) => unreachable!("is_completed covers every completed outcome"),
+        Err(e) => {
+          log::warn!("Post-session pull for profile {profile_id} failed: {e}");
+        }
+      }
+    }
+
+    log::warn!(
+      "Could not pull remote session work for profile {profile_id} yet; it stays blocked from \
+       launching locally until the pull succeeds"
+    );
+  });
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+  use std::collections::HashSet;
+
+  /// Serialises the tests.
+  ///
+  /// `TEST_DATA_DIR` is thread-local but [`STORE`] is process-global, so two
+  /// tests running at once would share one store while pointing at different
+  /// directories. That fails intermittently, which is the worst way for a test
+  /// guarding a data-loss bug to fail.
+  static TEST_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
+  /// Point the store at a scratch directory and start it empty.
+  ///
+  /// Everything returned must outlive the test body: dropping the guard
+  /// restores the real data directory, and a test that let it drop early would
+  /// write a gate file into the developer's own app data.
+  fn isolated() -> (
+    tempfile::TempDir,
+    crate::app_dirs::TestDirGuard,
+    std::sync::MutexGuard<'static, ()>,
+  ) {
+    let lock = TEST_LOCK
+      .lock()
+      .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let dir = tempfile::TempDir::new().expect("a scratch directory");
+    let guard = crate::app_dirs::set_test_data_dir(dir.path().to_path_buf());
+    *STORE
+      .write()
+      .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(Store::new());
+    (dir, guard, lock)
+  }
+
+  #[test]
+  fn a_live_session_blocks_a_local_launch() {
+    let _iso = isolated();
+    note_running("p1", "s1");
+    let err = ensure_local_launch_allowed("p1").expect_err("a live session must block a launch");
+    assert!(err.contains("PROFILE_RUNNING_REMOTELY"));
+  }
+
+  #[test]
+  fn a_finished_session_still_blocks_until_the_work_is_pulled() {
+    // The whole point. The profile lock is released the moment the session
+    // closes, so without this the user can open the stale copy and the next
+    // sync deletes everything the host wrote.
+    let _iso = isolated();
+    note_running("p1", "s1");
+    assert!(note_ended("p1", "s1"));
+    let err = ensure_local_launch_allowed("p1").expect_err("pending work must block a launch");
+    assert!(err.contains("PROFILE_REMOTE_SYNC_PENDING"));
+
+    clear("p1");
+    assert!(ensure_local_launch_allowed("p1").is_ok());
+  }
+
+  #[test]
+  fn an_ungated_profile_is_not_blocked() {
+    let _iso = isolated();
+    note_running("p1", "s1");
+    assert!(ensure_local_launch_allowed("p2").is_ok());
+  }
+
+  #[test]
+  fn the_end_transition_is_reported_once_however_often_the_frame_arrives() {
+    // The stream re-delivers a snapshot on every reconnect, and `closed` can
+    // arrive alongside it. Starting a pull per frame would run several
+    // concurrent transfers of the same profile.
+    let _iso = isolated();
+    note_running("p1", "s1");
+    assert!(note_ended("p1", "s1"));
+    assert!(!note_ended("p1", "s1"));
+    assert!(!note_ended("p1", "s1"));
+  }
+
+  #[test]
+  fn a_closed_session_this_machine_never_watched_does_not_gate_anything() {
+    // `listForUser` returns closed sessions next to live ones, so the snapshot
+    // on every reconnect replays every session that ever finished. Treating
+    // those as fresh handoffs would block the Run button on a perfectly current
+    // profile at each app start, and block it indefinitely while offline.
+    let _iso = isolated();
+    assert!(!note_ended("p1", "s-finished-last-week"));
+    assert_eq!(state_for("p1"), None);
+    assert!(ensure_local_launch_allowed("p1").is_ok());
+  }
+
+  #[test]
+  fn a_pulled_profile_is_not_re_gated_by_a_replayed_close() {
+    // Same frame, one step later: the pull completed and cleared the gate. The
+    // next reconnect must not put it back.
+    let _iso = isolated();
+    note_running("p1", "s1");
+    note_ended("p1", "s1");
+    clear("p1");
+    assert!(!note_ended("p1", "s1"));
+    assert!(ensure_local_launch_allowed("p1").is_ok());
+  }
+
+  #[test]
+  fn a_late_close_for_a_replaced_session_does_not_gate_the_new_one() {
+    // Session s1 finished and was pulled; s2 is now live on the same profile. A
+    // straggling `closed` for s1 must not declare s2's profile finished, or the
+    // gate lifts while a host is still writing.
+    let _iso = isolated();
+    note_running("p1", "s2");
+    assert!(!note_ended("p1", "s1"));
+    assert_eq!(state_for("p1"), Some(HandoffState::Running));
+  }
+
+  #[test]
+  fn a_session_that_ended_while_the_app_was_shut_is_recovered() {
+    // Nothing streams a transition to a process that is not running. Without
+    // this the profile reads as still-running for ever and can never be
+    // launched again, and its work is never pulled.
+    let _iso = isolated();
+    note_running("p1", "s1");
+    let live: HashSet<String> = HashSet::new();
+    assert_eq!(reconcile(&live), vec!["p1".to_string()]);
+    assert_eq!(state_for("p1"), Some(HandoffState::PendingSync));
+  }
+
+  #[test]
+  fn reconcile_leaves_a_session_that_is_genuinely_still_live() {
+    let _iso = isolated();
+    note_running("p1", "s1");
+    let live: HashSet<String> = ["s1".to_string()].into_iter().collect();
+    assert!(reconcile(&live).is_empty());
+    assert_eq!(state_for("p1"), Some(HandoffState::Running));
+  }
+
+  #[test]
+  fn reconcile_does_not_reopen_a_pending_profile() {
+    // `PendingSync` is not a session state and no listing will ever contain it.
+    // Re-deriving it from the snapshot would report the same handoff as new on
+    // every reconnect and start a pull each time.
+    let _iso = isolated();
+    note_running("p1", "s1");
+    note_ended("p1", "s1");
+    let live: HashSet<String> = HashSet::new();
+    assert!(reconcile(&live).is_empty());
+  }
+
+  #[test]
+  fn the_gate_survives_a_restart() {
+    // Held on disk precisely because the dangerous window outlives the process:
+    // an app killed mid-session comes back with no memory of it.
+    let (_dir, _guard, _lock) = isolated();
+    note_running("p1", "s1");
+    note_ended("p1", "s1");
+
+    *STORE
+      .write()
+      .unwrap_or_else(std::sync::PoisonError::into_inner) = None;
+
+    assert_eq!(state_for("p1"), Some(HandoffState::PendingSync));
+  }
+}
@@ -54,6 +54,14 @@ pub struct AppSettings {
  pub language: Option<String>, // ISO 639-1: "en", "es", "pt", "fr", "zh", "ja", "ko", "ru", or None for system default
  #[serde(default)]
  pub window_resize_warning_dismissed: bool,
+  /// Stop blocking launches whose proxy exit disagrees with the fingerprint.
+  /// Lives here rather than in localStorage because the Rust launch path is
+  /// what enforces the block and cannot read the frontend's storage.
+  #[serde(default)]
+  pub fingerprint_gate_disabled: bool,
+  /// Stop warning about VPN/proxy extensions found in a profile.
+  #[serde(default)]
+  pub vpn_extension_warning_disabled: bool,
  #[serde(default)]
  pub onboarding_completed: bool, // First-launch onboarding has been shown/handled (one-shot)
  #[serde(default)]
@@ -96,6 +104,8 @@ impl Default for AppSettings {
      mcp_token: None,
      language: None,
      window_resize_warning_dismissed: false,
+      fingerprint_gate_disabled: false,
+      vpn_extension_warning_disabled: false,
      onboarding_completed: false,
      disable_auto_updates: false,
      keep_decrypted_profiles_in_ram: false,
@@ -1190,6 +1200,8 @@ mod tests {
      mcp_token: None,
      language: None,
      window_resize_warning_dismissed: false,
+      fingerprint_gate_disabled: false,
+      vpn_extension_warning_disabled: false,
      onboarding_completed: false,
      disable_auto_updates: false,
      keep_decrypted_profiles_in_ram: false,
@@ -1,6 +1,8 @@
 use super::client::SyncClient;
 use super::encryption;
-use super::manifest::{compute_diff, generate_manifest, get_cache_path, HashCache, SyncManifest};
+use super::manifest::{
+  compute_diff_with_bias, generate_manifest, get_cache_path, DiffBias, HashCache, SyncManifest,
+};
 use super::types::*;
 use crate::events;
 use crate::profile::types::{BrowserProfile, SyncMode};
@@ -20,6 +22,22 @@ use tokio::sync::{Mutex as TokioMutex, Semaphore};
 /// (last-write-wins) from a HEAD request without downloading the object body.
 const UPDATED_AT_META_KEY: &str = "updated-at";

+/// What one profile reconcile actually did.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ProfileSyncOutcome {
+  /// The local directory and the remote copy now agree.
+  Completed,
+  /// Nothing was transferred, and the reason is not an error. A caller waiting
+  /// on the remote copy has NOT got it and must try again.
+  Skipped(&'static str),
+}
+
+impl ProfileSyncOutcome {
+  pub fn is_completed(&self) -> bool {
+    matches!(self, Self::Completed)
+  }
+}
+
 lazy_static::lazy_static! {
  static ref SYNC_CANCEL_FLAGS: StdMutex<HashMap<String, Arc<AtomicBool>>> =
    StdMutex::new(HashMap::new());
@@ -313,7 +331,7 @@ impl SyncProgressTracker {
 /// Check if sync is configured (cloud or self-hosted)
 pub fn is_sync_configured() -> bool {
  // Cloud backup is a plan capability. Every paid plan (incl. the future
-  // "starter" tier) grants it, but gating on the capability — not just "is paid"
+  // "solo" tier) grants it, but gating on the capability — not just "is paid"
  // — keeps this correct if a plan without cloud backup is ever added.
  if crate::cloud_auth::CLOUD_AUTH.can_use_cloud_backup_sync() {
    return true;
@@ -450,13 +468,35 @@ impl SyncEngine {
    app_handle: &tauri::AppHandle,
    profile: &BrowserProfile,
  ) -> SyncResult<()> {
+    self
+      .sync_profile_with_bias(app_handle, profile, DiffBias::Auto)
+      .await
+      .map(|_| ())
+  }
+
+  /// Reconcile a profile, stating which side wins and whether anything happened.
+  ///
+  /// The outcome matters to exactly one caller: the pull that follows a remote
+  /// session. Every skip below returns `Ok(())` from `sync_profile`, so a caller
+  /// that treated success as "the profile is now current" would clear the local
+  /// launch gate without having downloaded a single byte — and the user would
+  /// then open a stale profile over the session's work. `Skipped` says so.
+  pub async fn sync_profile_with_bias(
+    &self,
+    app_handle: &tauri::AppHandle,
+    profile: &BrowserProfile,
+    bias: DiffBias,
+  ) -> SyncResult<ProfileSyncOutcome> {
    if profile.is_cross_os() {
      log::info!(
        "Cross-OS profile: {} ({}) — syncing metadata only",
        profile.name,
        profile.id
      );
-      return self.sync_cross_os_metadata(app_handle, profile).await;
+      self.sync_cross_os_metadata(app_handle, profile).await?;
+      // The browser files are the thing a remote session changes, and a cross-OS
+      // profile syncs none of them here, so this is not a completed pull.
+      return Ok(ProfileSyncOutcome::Skipped("cross-OS profile"));
    }

    // Skip team profiles for self-hosted sync
@@ -466,7 +506,9 @@ impl SyncEngine {
        profile.name,
        profile.id
      );
-      return Ok(());
+      return Ok(ProfileSyncOutcome::Skipped(
+        "team profile, self-hosted sync",
+      ));
    }

    // Skip if profile is currently running locally
@@ -476,20 +518,21 @@ impl SyncEngine {
        profile.name,
        profile.id
      );
-      return Ok(());
+      return Ok(ProfileSyncOutcome::Skipped("profile is running locally"));
    }

-    // Skip if profile is locked by another team member
+    // Skip if profile is locked by another team member, or by one of this
+    // user's own remote sessions.
    if crate::team_lock::TEAM_LOCK
      .is_locked_by_another(&profile.id.to_string())
      .await
    {
      log::info!(
-        "Skipping sync for profile locked by another team member: {} ({})",
+        "Skipping sync for profile locked by another holder: {} ({})",
        profile.name,
        profile.id
      );
-      return Ok(());
+      return Ok(ProfileSyncOutcome::Skipped("profile is locked elsewhere"));
    }

    let reconciled_profile = self.reconcile_profile_metadata(profile).await?;
@@ -591,7 +634,7 @@ impl SyncEngine {
      .await?;

    // Compute diff
-    let diff = compute_diff(&local_manifest, remote_manifest.as_ref());
+    let diff = compute_diff_with_bias(&local_manifest, remote_manifest.as_ref(), bias);

    if diff.is_empty() {
      log::info!("Profile {} is already in sync", profile_id);
@@ -603,7 +646,9 @@ impl SyncEngine {
          "status": "synced"
        }),
      );
-      return Ok(());
+      // Nothing to transfer IS a completed reconcile: the local copy already
+      // matches what the host pushed, which is exactly what the caller waits for.
+      return Ok(ProfileSyncOutcome::Completed);
    }

    let upload_bytes: u64 = diff.files_to_upload.iter().map(|f| f.size).sum();
@@ -769,7 +814,7 @@ impl SyncEngine {
    );

    log::info!("Profile {} synced successfully", profile_id);
-    Ok(())
+    Ok(ProfileSyncOutcome::Completed)
  }

  async fn download_manifest(
@@ -3321,6 +3366,12 @@ pub async fn set_profile_sync_mode(
    .save_profile(&profile)
    .map_err(|e| format!("Failed to save profile: {e}"))?;

+  // The bot materialises the profile from donut-sync, so switching sync off (or
+  // to Encrypted, which the host cannot decrypt) is a refusal reason. The server
+  // holds only the copy this machine declared; without this, an enrolment keeps
+  // claiming a syncable profile every night after the user turned sync off.
+  crate::cookie_bot::report_profile_state(&profile);
+
  let _ = events::emit("profiles-changed", ());

  // When (re-)enabling sync, clear any stale tombstone from a previous
@@ -3540,6 +3591,40 @@ pub async fn trigger_sync_for_profile(
  Ok(())
 }

+/// Pull a profile back down after a remote session wrote to it.
+///
+/// Not `trigger_sync_for_profile` with a different name. Two things differ, and
+/// both of them are the reason the session's work used to be destroyed:
+///
+/// - The diff is biased to the remote copy. The host has just written the
+///   authoritative profile; local mtimes may nonetheless be newer, and under the
+///   ordinary rule that uploads the stale copy and deletes the host's files.
+/// - The outcome is reported. Every skip inside `sync_profile` returns success,
+///   so the caller could otherwise mark the profile current without a byte
+///   having moved.
+pub async fn pull_profile_after_remote_session(
+  app_handle: &tauri::AppHandle,
+  profile_id: &str,
+) -> Result<ProfileSyncOutcome, String> {
+  let engine = SyncEngine::create_from_settings(app_handle)
+    .await
+    .map_err(|e| format!("Failed to create sync engine: {e}"))?;
+
+  let profile_uuid =
+    uuid::Uuid::parse_str(profile_id).map_err(|_| format!("Invalid profile ID: {profile_id}"))?;
+  let profile = ProfileManager::instance()
+    .list_profiles()
+    .map_err(|e| format!("Failed to list profiles: {e}"))?
+    .into_iter()
+    .find(|p| p.id == profile_uuid)
+    .ok_or_else(|| format!("Profile with ID '{profile_id}' not found"))?;
+
+  engine
+    .sync_profile_with_bias(app_handle, &profile, DiffBias::PreferRemote)
+    .await
+    .map_err(|e| format!("Sync failed: {e}"))
+}
+
 #[tauri::command]
 pub async fn set_proxy_sync_enabled(
  app_handle: tauri::AppHandle,
@@ -414,11 +414,41 @@ impl ManifestDiff {
 }

 /// Compute what needs to be synced between local and remote
+/// Which side a sync should believe when both have moved.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum DiffBias {
+  /// Newest `updated_at` wins. What an ordinary background sync uses.
+  #[default]
+  Auto,
+  /// Remote wins regardless of timestamps.
+  ///
+  /// Used for exactly one thing: the pull that follows a remote session. A
+  /// leased host has just written the authoritative copy of this profile, and
+  /// the local directory is whatever it was before the session started. If the
+  /// user launched locally in between, local mtimes are NEWER than the host's
+  /// push, so `Auto` would upload the stale copy and put every file the host
+  /// wrote into `files_to_delete_remote` — the whole session's work destroyed,
+  /// silently. There is no timestamp comparison that gets this right, because
+  /// the local clock genuinely is later; only the caller knows that the remote
+  /// copy is the one that matters.
+  PreferRemote,
+}
+
 pub fn compute_diff(local: &SyncManifest, remote: Option<&SyncManifest>) -> ManifestDiff {
+  compute_diff_with_bias(local, remote, DiffBias::Auto)
+}
+
+pub fn compute_diff_with_bias(
+  local: &SyncManifest,
+  remote: Option<&SyncManifest>,
+  bias: DiffBias,
+) -> ManifestDiff {
  let mut diff = ManifestDiff::default();

  let Some(remote) = remote else {
-    // No remote manifest - upload everything
+    // No remote manifest - upload everything. Even under PreferRemote: there is
+    // no remote copy to prefer, and refusing to upload would leave the profile
+    // with no cloud copy at all.
    diff.files_to_upload = local.files.clone();
    return diff;
  };
@@ -446,11 +476,14 @@ pub fn compute_diff(local: &SyncManifest, remote: Option<&SyncManifest>) -> Mani
  let local_updated = local.updated_at_datetime();
  let remote_updated = remote.updated_at_datetime();

-  let local_is_newer = match (local_updated, remote_updated) {
-    (Some(l), Some(r)) => l > r,
-    (Some(_), None) => true,
-    (None, Some(_)) => false,
-    (None, None) => true, // Default to uploading
+  let local_is_newer = match bias {
+    DiffBias::PreferRemote => false,
+    DiffBias::Auto => match (local_updated, remote_updated) {
+      (Some(l), Some(r)) => l > r,
+      (Some(_), None) => true,
+      (None, Some(_)) => false,
+      (None, None) => true, // Default to uploading
+    },
  };

  if local_is_newer {
@@ -674,6 +707,68 @@ mod tests {
    assert!(diff.files_to_delete_remote.is_empty());
  }

+  /// A manifest with one file, at a stated time.
+  fn manifest_at(updated_at: &str, files: &[(&str, &str)]) -> SyncManifest {
+    SyncManifest {
+      version: 1,
+      profile_id: "test".to_string(),
+      generated_at: updated_at.to_string(),
+      updated_at: updated_at.to_string(),
+      exclude_globs: vec![],
+      files: files
+        .iter()
+        .map(|(path, hash)| ManifestFileEntry {
+          path: (*path).to_string(),
+          size: 10,
+          mtime: 1000,
+          hash: (*hash).to_string(),
+        })
+        .collect(),
+      encrypted: false,
+    }
+  }
+
+  #[test]
+  fn prefer_remote_downloads_even_though_the_local_clock_is_later() {
+    // The exact shape of the data-loss bug. A remote session finishes and the
+    // host pushes the profile; the user then launches locally before the pull
+    // lands, so every local mtime is newer than the host's write. Under Auto
+    // that uploads the stale copy and deletes the session's own files.
+    let local = manifest_at("2026-01-02T00:00:00Z", &[("Cookies", "before-session")]);
+    let remote = manifest_at(
+      "2026-01-01T00:00:00Z",
+      &[("Cookies", "after-session"), ("History", "warmed")],
+    );
+
+    let lossy = compute_diff_with_bias(&local, Some(&remote), DiffBias::Auto);
+    assert_eq!(lossy.files_to_delete_remote, vec!["History".to_string()]);
+    assert_eq!(lossy.files_to_upload.len(), 1);
+
+    let safe = compute_diff_with_bias(&local, Some(&remote), DiffBias::PreferRemote);
+    assert!(
+      safe.files_to_delete_remote.is_empty(),
+      "a post-session pull must never delete what the host just wrote"
+    );
+    assert!(safe.files_to_upload.is_empty());
+    let downloaded: Vec<&str> = safe
+      .files_to_download
+      .iter()
+      .map(|f| f.path.as_str())
+      .collect();
+    assert_eq!(downloaded.len(), 2);
+    assert!(downloaded.contains(&"Cookies"));
+    assert!(downloaded.contains(&"History"));
+  }
+
+  #[test]
+  fn prefer_remote_still_uploads_when_there_is_no_remote_copy() {
+    // Nothing to prefer. Refusing to upload here would leave a profile with no
+    // cloud copy because a session once ran against it.
+    let local = manifest_at("2026-01-02T00:00:00Z", &[("Cookies", "only-local")]);
+    let diff = compute_diff_with_bias(&local, None, DiffBias::PreferRemote);
+    assert_eq!(diff.files_to_upload.len(), 1);
+  }
+
  #[test]
  fn test_compute_diff_detect_changes() {
    let old_time = "2024-01-01T00:00:00Z";
@@ -15,12 +15,16 @@ pub use engine::{
  enable_proxy_sync_if_needed, enable_sync_for_all_entities, enable_vpn_sync_if_needed,
  get_unsynced_entity_counts, is_group_in_use_by_synced_profile, is_group_used_by_synced_profile,
  is_proxy_in_use_by_synced_profile, is_proxy_used_by_synced_profile, is_sync_configured,
-  is_vpn_in_use_by_synced_profile, is_vpn_used_by_synced_profile, request_profile_sync,
-  rollover_encryption_for_all_entities, set_extension_group_sync_enabled,
-  set_extension_sync_enabled, set_group_sync_enabled, set_profile_sync_mode,
-  set_proxy_sync_enabled, set_vpn_sync_enabled, sync_profile, trigger_sync_for_profile, SyncEngine,
+  is_vpn_in_use_by_synced_profile, is_vpn_used_by_synced_profile,
+  pull_profile_after_remote_session, request_profile_sync, rollover_encryption_for_all_entities,
+  set_extension_group_sync_enabled, set_extension_sync_enabled, set_group_sync_enabled,
+  set_profile_sync_mode, set_proxy_sync_enabled, set_vpn_sync_enabled, sync_profile,
+  trigger_sync_for_profile, ProfileSyncOutcome, SyncEngine,
+};
+pub use manifest::{
+  compute_diff, compute_diff_with_bias, generate_manifest, DiffBias, HashCache, ManifestDiff,
+  SyncManifest,
 };
-pub use manifest::{compute_diff, generate_manifest, HashCache, ManifestDiff, SyncManifest};
 pub use scheduler::{get_global_scheduler, set_global_scheduler, SyncScheduler};
 pub use subscription::{SubscriptionManager, SyncWorkItem};
 pub use types::{SyncError, SyncResult};
@@ -72,6 +72,24 @@ impl SyncScheduler {
    self.running.store(false, Ordering::SeqCst);
  }

+  /// Whether this specific profile is mid-sync or queued to sync.
+  ///
+  /// A remote host materialises the profile by pulling the synced manifest, so
+  /// launching one while the upload is still running hands it a torn snapshot:
+  /// the manifest is written last, but a launch that races a *queued* sync can
+  /// still pull files that are about to be replaced. Either way the browser
+  /// comes up on a profile that never existed on this machine.
+  ///
+  /// Deliberately per-profile rather than the global
+  /// {@link Self::is_sync_in_progress}: an unrelated profile uploading 80 MB
+  /// must not block launching this one.
+  pub async fn is_profile_sync_in_progress(&self, profile_id: &str) -> bool {
+    if self.in_flight_profiles.lock().await.contains(profile_id) {
+      return true;
+    }
+    self.pending_profiles.lock().await.contains_key(profile_id)
+  }
+
  /// Check if any sync operation is currently in progress
  pub async fn is_sync_in_progress(&self) -> bool {
    let in_flight = self.in_flight_profiles.lock().await;
@@ -168,7 +168,7 @@ impl SynchronizerManager {
    );

    // Launch leader first so it gets focus
-    crate::browser_runner::launch_browser_profile(app_handle.clone(), leader.clone(), None)
+    crate::browser_runner::launch_browser_profile(app_handle.clone(), leader.clone(), None, None)
      .await
      .map_err(|e| format!("Failed to launch leader: {e}"))?;

@@ -179,7 +179,7 @@ impl SynchronizerManager {
        let ah = app_handle.clone();
        let fp = fp.clone();
        set.spawn(async move {
-          crate::browser_runner::launch_browser_profile(ah, fp.clone(), None)
+          crate::browser_runner::launch_browser_profile(ah, fp.clone(), None, None)
            .await
            .map_err(|e| (fp.name.clone(), e.to_string()))
        });
@@ -95,8 +95,8 @@ impl ProfileLockManager {

  pub async fn acquire_lock(&self, profile_id: &str) -> Result<(), String> {
    let client = Client::new();
-    let access_token =
-      CloudAuthManager::load_access_token()?.ok_or_else(|| "Not logged in".to_string())?;
+    let access_token = CloudAuthManager::load_access_token()?
+      .ok_or_else(|| crate::backend_error("PROFILE_LOCK_UNAVAILABLE"))?;

    let url = format!("{CLOUD_API_URL}/api/profile-locks/{profile_id}");
    let response = client
@@ -104,24 +104,29 @@ impl ProfileLockManager {
      .header("Authorization", format!("Bearer {access_token}"))
      .send()
      .await
-      .map_err(|e| format!("Failed to acquire lock: {e}"))?;
+      .map_err(|e| {
+        log::warn!("Failed to acquire profile lock for {profile_id}: {e}");
+        crate::backend_error("PROFILE_LOCK_UNAVAILABLE")
+      })?;

    if !response.status().is_success() {
      let status = response.status();
      let body = response.text().await.unwrap_or_default();
-      return Err(format!("Lock acquisition failed ({status}): {body}"));
+      log::warn!("Profile lock acquisition for {profile_id} failed ({status}): {body}");
+      return Err(crate::backend_error("PROFILE_LOCK_UNAVAILABLE"));
    }

-    let result: AcquireLockResponse = response
-      .json()
-      .await
-      .map_err(|e| format!("Failed to parse lock response: {e}"))?;
+    let result: AcquireLockResponse = response.json().await.map_err(|e| {
+      log::warn!("Could not parse the profile lock response for {profile_id}: {e}");
+      crate::backend_error("PROFILE_LOCK_UNAVAILABLE")
+    })?;

    if !result.success {
-      let email = result
-        .locked_by_email
-        .unwrap_or_else(|| "another device".to_string());
-      return Err(format!("Profile is in use by {email}"));
+      return Err(lock_conflict_error(
+        profile_id,
+        result.locked_by.as_deref(),
+        result.locked_by_email.as_deref(),
+      ));
    }

    // Update local cache
@@ -274,15 +279,51 @@ impl ProfileLockManager {
  }
 }

+/// Separator the backend puts between a user id and a non-desktop holder's
+/// sub-identity. Mirrors `HOLDER_SEPARATOR` in donutbrowser-infra's
+/// `profile-locks.service.ts`.
+///
+/// A remote VM session takes the lock under `<user id>:vm:<session id>` so it
+/// contends with this desktop instead of silently sharing its lock. That makes
+/// the holder string the one place a client can tell "a teammate has this open"
+/// apart from "this is my own profile, running on the fleet" — two refusals that
+/// need completely different words.
+const VM_HOLDER_SEPARATOR: &str = ":vm:";
+
+/// The `{"code":…}` for a lock this caller could not take.
+fn lock_conflict_error(
+  profile_id: &str,
+  holder: Option<&str>,
+  holder_email: Option<&str>,
+) -> String {
+  if holder.is_some_and(|id| id.contains(VM_HOLDER_SEPARATOR)) {
+    // The user's own remote session. Saying "in use by you@example.com" here,
+    // which is what the raw backend message did, reads as a bug.
+    log::info!("Profile {profile_id} is held by a remote session");
+    return crate::backend_error("PROFILE_RUNNING_REMOTELY");
+  }
+  match holder_email {
+    Some(email) if !email.is_empty() => serde_json::json!({
+      "code": "PROFILE_LOCKED_BY_MEMBER",
+      "params": { "email": email }
+    })
+    .to_string(),
+    _ => crate::backend_error("PROFILE_LOCKED_ELSEWHERE"),
+  }
+}
+
 /// Acquire profile lock if profile is sync-enabled and user has a paid subscription.
+/// Returns whether a lock was actually taken, so a caller that unwinds a failed
+/// launch releases only what it acquired. Releasing unconditionally would drop
+/// a lock a REST handler up the stack still owns.
 pub async fn acquire_team_lock_if_needed(
  profile: &crate::profile::BrowserProfile,
-) -> Result<(), String> {
+) -> Result<bool, String> {
  if !profile.is_sync_enabled() {
-    return Ok(());
+    return Ok(false);
  }
  if !CLOUD_AUTH.has_active_paid_subscription().await {
-    return Ok(());
+    return Ok(false);
  }

  // Ensure lock manager is connected
@@ -294,13 +335,18 @@ pub async fn acquire_team_lock_if_needed(
    .is_locked_by_another(&profile.id.to_string())
    .await
  {
-    if let Some(lock) = PROFILE_LOCK.get_lock_status(&profile.id.to_string()).await {
-      return Err(format!("Profile is in use by {}", lock.locked_by_email));
-    }
-    return Err("Profile is in use on another device".to_string());
+    let held = PROFILE_LOCK.get_lock_status(&profile.id.to_string()).await;
+    return Err(lock_conflict_error(
+      &profile.id.to_string(),
+      held.as_ref().map(|lock| lock.locked_by.as_str()),
+      held.as_ref().map(|lock| lock.locked_by_email.as_str()),
+    ));
  }

-  PROFILE_LOCK.acquire_lock(&profile.id.to_string()).await
+  PROFILE_LOCK
+    .acquire_lock(&profile.id.to_string())
+    .await
+    .map(|()| true)
 }

 /// Release profile lock if profile is sync-enabled and user has a paid subscription.
@@ -328,3 +374,39 @@ pub async fn get_team_locks() -> Result<Vec<ProfileLockInfo>, String> {
 pub async fn get_team_lock_status(profile_id: String) -> Result<Option<ProfileLockInfo>, String> {
  Ok(PROFILE_LOCK.get_lock_status(&profile_id).await)
 }
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  #[test]
+  fn a_users_own_remote_session_is_not_reported_as_a_teammate() {
+    // The holder for a fleet session is `<user id>:vm:<session id>` and the row
+    // carries the OWNER's email, so the previous message read "Profile is in use
+    // by you@example.com" — the user's own address, about their own profile.
+    let err = lock_conflict_error(
+      "p1",
+      Some("11111111-2222-3333-4444-555555555555:vm:run-remote:p1:abc"),
+      Some("owner@example.com"),
+    );
+    assert_eq!(err, r#"{"code":"PROFILE_RUNNING_REMOTELY"}"#);
+    assert!(!err.contains("owner@example.com"));
+  }
+
+  #[test]
+  fn a_teammates_lock_names_them_through_a_translatable_code() {
+    let err = lock_conflict_error("p1", Some("other-user-id"), Some("mate@example.com"));
+    let json: serde_json::Value = serde_json::from_str(&err).expect("a code envelope");
+    assert_eq!(json["code"], "PROFILE_LOCKED_BY_MEMBER");
+    assert_eq!(json["params"]["email"], "mate@example.com");
+  }
+
+  #[test]
+  fn a_lock_with_no_identifiable_holder_still_produces_a_code() {
+    // Raw English here is what reaches a Russian user untranslated.
+    for holder in [None, Some("")] {
+      let err = lock_conflict_error("p1", holder, None);
+      assert_eq!(err, r#"{"code":"PROFILE_LOCKED_ELSEWHERE"}"#);
+    }
+  }
+}
@@ -0,0 +1,664 @@
+//! Enumerates extensions the user installed from inside the browser, by
+//! walking the Chromium profile directory on disk.
+//!
+//! Depends only on `std`, `serde_json`, the sibling `rules` module, and the
+//! shared profile-directory-name predicate, so the directory-layout handling —
+//! the riskiest part of detection — stays testable without app state.
+
+use std::collections::HashSet;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use super::rules::{
+  classify, keyword_hit, lookup_message, manifest_str, message_placeholder_key, signal_labels,
+  signals_from_manifest, version_dir_sort_key, DetectedVpnExtension,
+};
+
+/// Upper bound on extension directories walked per profile. A launch must not
+/// stall behind a pathological profile; whatever was found is still reported,
+/// flagged `partial`.
+const MAX_EXTENSION_DIRS: usize = 300;
+/// Manifests are a few KiB. Anything past this is not a manifest we can use.
+const MAX_MANIFEST_BYTES: u64 = 512 * 1024;
+/// Wall-clock ceiling for the whole scan. This runs on the launch path.
+const SCAN_DEADLINE: Duration = Duration::from_millis(750);
+/// Chromium preference files are larger than a manifest but still bounded; a
+/// pathological one must not be parsed while the user waits for a browser.
+const MAX_PREFERENCES_BYTES: u64 = 32 * 1024 * 1024;
+
+/// Chromium profile directories to search inside a user-data dir.
+///
+/// Two layouts are real here: Donut launches Wayfern with only
+/// `--user-data-dir`, so Chromium uses `Default/`; but an imported profile is
+/// copied in as the profile directory itself, putting `Extensions/` at the
+/// root. Checking only one layout misses every profile of the other kind.
+fn candidate_profile_dirs(user_data_dir: &Path) -> Vec<PathBuf> {
+  let mut dirs = Vec::new();
+
+  if user_data_dir.join("Preferences").exists() || user_data_dir.join("Extensions").is_dir() {
+    dirs.push(user_data_dir.to_path_buf());
+  }
+
+  if let Ok(entries) = std::fs::read_dir(user_data_dir) {
+    for entry in entries.flatten() {
+      let path = entry.path();
+      if !path.is_dir() {
+        continue;
+      }
+      let Some(name) = path.file_name().and_then(|n| n.to_str()) else {
+        continue;
+      };
+      if crate::profile::clear_on_close::is_profile_dir_name(name)
+        || path.join("Preferences").exists()
+      {
+        dirs.push(path);
+      }
+    }
+  }
+
+  dirs.sort();
+  dirs.dedup();
+  dirs
+}
+
+fn read_json_file(path: &Path, max_bytes: Option<u64>) -> Option<serde_json::Value> {
+  let metadata = std::fs::metadata(path).ok()?;
+  if !metadata.is_file() {
+    return None;
+  }
+  if max_bytes.is_some_and(|cap| metadata.len() > cap) {
+    return None;
+  }
+  serde_json::from_str(&std::fs::read_to_string(path).ok()?).ok()
+}
+
+/// Chromium locale directory names are `[A-Za-z0-9_-]` (`en`, `en_GB`,
+/// `zh_CN`). Anything else in a manifest we did not write is untrusted input
+/// being joined into a filesystem path, so it is refused rather than sanitized
+/// — this runs on the launch path against extensions the user may have
+/// sideloaded.
+fn is_safe_locale_name(name: &str) -> bool {
+  !name.is_empty()
+    && name.len() <= 32
+    && name
+      .chars()
+      .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
+}
+
+fn resolve_dir_i18n(
+  version_dir: &Path,
+  manifest: &serde_json::Value,
+  value: &str,
+) -> Option<String> {
+  let key = message_placeholder_key(value)?;
+  let default_locale = manifest.get("default_locale")?.as_str()?;
+  if !is_safe_locale_name(default_locale) {
+    log::warn!("Ignoring extension with a suspicious default_locale: {default_locale:?}");
+    return None;
+  }
+  let messages = read_json_file(
+    &version_dir
+      .join("_locales")
+      .join(default_locale)
+      .join("messages.json"),
+    Some(MAX_MANIFEST_BYTES),
+  )?;
+  lookup_message(&messages, &key)
+}
+
+/// What the profile's preference files say about installed extensions.
+///
+/// Read-only on purpose: `Secure Preferences` is MAC-protected, and rewriting
+/// it invalidates the signature, which disables every extension in the profile.
+#[derive(Default)]
+struct PreferenceExtensions {
+  /// Explicitly disabled. A disabled extension cannot touch the proxy, so
+  /// warning about it would be a false alarm.
+  disabled: HashSet<String>,
+  /// Unpacked ("Load unpacked" / developer mode) extensions, which live
+  /// OUTSIDE `Extensions/` and are therefore invisible to the directory walk.
+  /// Sideloading is exactly how someone gets a VPN extension in without the
+  /// Web Store, so missing these would leave the obvious hole open.
+  unpacked: Vec<(String, PathBuf)>,
+}
+
+fn preference_extensions(profile_dir: &Path) -> PreferenceExtensions {
+  let mut out = PreferenceExtensions::default();
+  for file in ["Secure Preferences", "Preferences"] {
+    // Larger than a manifest, but still capped: this is parsed while the user
+    // waits for a browser to start.
+    let Some(prefs) = read_json_file(&profile_dir.join(file), Some(MAX_PREFERENCES_BYTES)) else {
+      continue;
+    };
+    let Some(settings) = prefs
+      .get("extensions")
+      .and_then(|e| e.get("settings"))
+      .and_then(|s| s.as_object())
+    else {
+      continue;
+    };
+    for (id, entry) in settings {
+      // Chromium's Extension::State: 0 = disabled.
+      if entry.get("state").and_then(serde_json::Value::as_i64) == Some(0) {
+        out.disabled.insert(id.clone());
+        continue;
+      }
+      // A packed extension's `path` is relative to Extensions/; an unpacked
+      // one records an absolute path elsewhere on disk.
+      if let Some(path) = entry.get("path").and_then(|p| p.as_str()) {
+        let path = PathBuf::from(path);
+        if path.is_absolute() {
+          out.unpacked.push((id.clone(), path));
+        }
+      }
+    }
+  }
+  out
+}
+
+/// Walk a user-data dir for VPN/proxy extensions.
+///
+/// Returns false when the walk was cut short by a cap or the deadline, so the
+/// caller can report the scan as incomplete rather than clean.
+pub(super) fn scan_browser_extensions(
+  user_data_dir: &Path,
+  out: &mut Vec<DetectedVpnExtension>,
+  started: Instant,
+) -> bool {
+  let mut walked = 0usize;
+
+  for profile_dir in candidate_profile_dirs(user_data_dir) {
+    // Read preferences first: unpacked extensions live outside Extensions/, so
+    // a profile that has only sideloaded ones has no Extensions/ dir at all and
+    // must not be skipped before they are considered.
+    if started.elapsed() > SCAN_DEADLINE {
+      return false;
+    }
+    let prefs = preference_extensions(&profile_dir);
+    let disabled = &prefs.disabled;
+
+    for (crx_id, unpacked_dir) in &prefs.unpacked {
+      if walked >= MAX_EXTENSION_DIRS || started.elapsed() > SCAN_DEADLINE {
+        return false;
+      }
+      walked += 1;
+      if let Some(found) = detect_in_version_dir(crx_id, unpacked_dir) {
+        out.push(found);
+      }
+    }
+
+    let Ok(entries) = std::fs::read_dir(profile_dir.join("Extensions")) else {
+      continue;
+    };
+
+    for entry in entries.flatten() {
+      if walked >= MAX_EXTENSION_DIRS || started.elapsed() > SCAN_DEADLINE {
+        return false;
+      }
+      walked += 1;
+
+      let ext_dir = entry.path();
+      if !ext_dir.is_dir() {
+        continue;
+      }
+      let Some(crx_id) = ext_dir
+        .file_name()
+        .and_then(|n| n.to_str())
+        .map(str::to_string)
+      else {
+        continue;
+      };
+      if disabled.contains(&crx_id) {
+        continue;
+      }
+
+      // Several versions can coexist on disk; Chromium runs the highest.
+      let Ok(version_entries) = std::fs::read_dir(&ext_dir) else {
+        continue;
+      };
+      let mut versions: Vec<PathBuf> = version_entries
+        .flatten()
+        .map(|e| e.path())
+        .filter(|p| p.is_dir())
+        .collect();
+      versions.sort_by_key(|p| {
+        p.file_name()
+          .and_then(|n| n.to_str())
+          .map(version_dir_sort_key)
+          .unwrap_or_default()
+      });
+      let Some(version_dir) = versions.last() else {
+        continue;
+      };
+
+      if let Some(found) = detect_in_version_dir(&crx_id, version_dir) {
+        out.push(found);
+      }
+    }
+  }
+
+  true
+}
+
+/// Classify the extension whose unpacked files live in `version_dir`.
+/// Shared by the packed walk and the unpacked (developer-mode) entries.
+fn detect_in_version_dir(crx_id: &str, version_dir: &Path) -> Option<DetectedVpnExtension> {
+  let manifest = read_json_file(&version_dir.join("manifest.json"), Some(MAX_MANIFEST_BYTES))?;
+
+  let raw_name = manifest_str(&manifest, "name").unwrap_or_else(|| crx_id.to_string());
+  let name = resolve_dir_i18n(version_dir, &manifest, &raw_name).unwrap_or_else(|| {
+    if message_placeholder_key(&raw_name).is_some() {
+      crx_id.to_string()
+    } else {
+      raw_name.clone()
+    }
+  });
+  let description = manifest_str(&manifest, "description").and_then(|d| {
+    resolve_dir_i18n(version_dir, &manifest, &d).or(if message_placeholder_key(&d).is_some() {
+      None
+    } else {
+      Some(d)
+    })
+  });
+
+  let signals = signals_from_manifest(&manifest);
+  let keyword = keyword_hit(&name, description.as_deref());
+  let confidence = classify(&signals, keyword)?;
+
+  Some(DetectedVpnExtension {
+    key: format!("crx:{crx_id}"),
+    name,
+    version: manifest_str(&manifest, "version"),
+    source: "browser".to_string(),
+    confidence: confidence.to_string(),
+    signals: signal_labels(&signals, keyword),
+  })
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+  use std::fs;
+
+  fn write(path: &Path, contents: &str) {
+    fs::create_dir_all(path.parent().unwrap()).unwrap();
+    fs::write(path, contents).unwrap();
+  }
+
+  /// Build a Chromium `Preferences` blob for one extension.
+  ///
+  /// Serialized rather than string-interpolated on purpose: a Windows path is
+  /// `C:\Users\...`, and pasting it into a JSON string literal produces invalid
+  /// escape sequences, so the file silently fails to parse and every assertion
+  /// about it passes for the wrong reason.
+  fn preferences_json(crx_id: &str, state: i64, path: &Path) -> String {
+    serde_json::json!({
+      "extensions": {
+        "settings": {
+          crx_id: { "state": state, "path": path.to_string_lossy() }
+        }
+      }
+    })
+    .to_string()
+  }
+
+  const VPN_MANIFEST: &str = r#"{"name":"Turbo VPN","version":"2.1.0","permissions":["proxy"]}"#;
+  const CRX_ID: &str = "abcdefghijklmnopabcdefghijklmnop";
+
+  #[test]
+  fn candidate_dirs_accepts_the_default_layout() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    write(&root.join("Default").join("Preferences"), "{}");
+    assert_eq!(candidate_profile_dirs(root), vec![root.join("Default")]);
+  }
+
+  #[test]
+  fn candidate_dirs_accepts_the_imported_root_layout() {
+    // profile_importer copies a Chromium profile dir in as the root, so
+    // Preferences and Extensions/ sit at the top level.
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    write(&root.join("Preferences"), "{}");
+    assert_eq!(candidate_profile_dirs(root), vec![root.to_path_buf()]);
+  }
+
+  #[test]
+  fn candidate_dirs_finds_named_profile_dirs_without_preferences() {
+    // Chromium writes Preferences lazily, so a populated Default/ can lack it.
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    fs::create_dir_all(root.join("Profile 2").join("Extensions")).unwrap();
+    assert_eq!(candidate_profile_dirs(root), vec![root.join("Profile 2")]);
+  }
+
+  #[test]
+  fn scan_finds_a_vpn_extension_in_the_default_layout() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    write(
+      &root
+        .join("Default")
+        .join("Extensions")
+        .join(CRX_ID)
+        .join("2.1.0_0")
+        .join("manifest.json"),
+      VPN_MANIFEST,
+    );
+
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(root, &mut out, Instant::now()));
+    assert_eq!(out.len(), 1);
+    assert_eq!(out[0].key, format!("crx:{CRX_ID}"));
+    assert_eq!(out[0].name, "Turbo VPN");
+    assert_eq!(out[0].confidence, "confirmed");
+    assert_eq!(out[0].source, "browser");
+  }
+
+  #[test]
+  fn scan_finds_a_vpn_extension_in_the_imported_root_layout() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    write(&root.join("Preferences"), "{}");
+    write(
+      &root
+        .join("Extensions")
+        .join(CRX_ID)
+        .join("2.1.0_0")
+        .join("manifest.json"),
+      VPN_MANIFEST,
+    );
+
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(root, &mut out, Instant::now()));
+    assert_eq!(out.len(), 1);
+  }
+
+  #[test]
+  fn scan_reads_the_highest_version_directory() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    let ext = root.join("Default").join("Extensions").join(CRX_ID);
+    // Lexicographically "1.9.0_0" > "1.10.0_0"; numerically it is not.
+    write(
+      &ext.join("1.9.0_0").join("manifest.json"),
+      r#"{"name":"Old","version":"1.9.0","permissions":["storage"]}"#,
+    );
+    write(
+      &ext.join("1.10.0_0").join("manifest.json"),
+      r#"{"name":"New VPN","version":"1.10.0","permissions":["proxy"]}"#,
+    );
+
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(root, &mut out, Instant::now()));
+    assert_eq!(out.len(), 1);
+    assert_eq!(out[0].version.as_deref(), Some("1.10.0"));
+  }
+
+  #[test]
+  fn scan_skips_extensions_chromium_has_disabled() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    let profile = root.join("Default");
+    write(
+      &profile
+        .join("Extensions")
+        .join(CRX_ID)
+        .join("2.1.0_0")
+        .join("manifest.json"),
+      VPN_MANIFEST,
+    );
+    write(
+      &profile.join("Secure Preferences"),
+      &format!(r#"{{"extensions":{{"settings":{{"{CRX_ID}":{{"state":0}}}}}}}}"#),
+    );
+
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(root, &mut out, Instant::now()));
+    assert!(
+      out.is_empty(),
+      "a disabled extension cannot touch the proxy"
+    );
+  }
+
+  #[test]
+  fn scan_keeps_enabled_extensions_listed_in_preferences() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    let profile = root.join("Default");
+    write(
+      &profile
+        .join("Extensions")
+        .join(CRX_ID)
+        .join("2.1.0_0")
+        .join("manifest.json"),
+      VPN_MANIFEST,
+    );
+    write(
+      &profile.join("Secure Preferences"),
+      &format!(r#"{{"extensions":{{"settings":{{"{CRX_ID}":{{"state":1}}}}}}}}"#),
+    );
+
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(root, &mut out, Instant::now()));
+    assert_eq!(out.len(), 1);
+  }
+
+  #[test]
+  fn scan_resolves_a_localized_extension_name() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    let version_dir = root
+      .join("Default")
+      .join("Extensions")
+      .join(CRX_ID)
+      .join("2.1.0_0");
+    write(
+      &version_dir.join("manifest.json"),
+      r#"{"name":"__MSG_appName__","version":"2.1.0","default_locale":"en","permissions":["proxy"]}"#,
+    );
+    write(
+      &version_dir
+        .join("_locales")
+        .join("en")
+        .join("messages.json"),
+      r#"{"appName":{"message":"Nord VPN"}}"#,
+    );
+
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(root, &mut out, Instant::now()));
+    assert_eq!(out[0].name, "Nord VPN");
+  }
+
+  #[test]
+  fn scan_falls_back_to_the_crx_id_when_a_placeholder_cannot_be_resolved() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    write(
+      &root
+        .join("Default")
+        .join("Extensions")
+        .join(CRX_ID)
+        .join("2.1.0_0")
+        .join("manifest.json"),
+      r#"{"name":"__MSG_appName__","version":"2.1.0","permissions":["proxy"]}"#,
+    );
+
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(root, &mut out, Instant::now()));
+    assert_eq!(out[0].name, CRX_ID, "never show a raw __MSG_ placeholder");
+  }
+
+  #[test]
+  fn scan_ignores_an_ordinary_extension() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    write(
+      &root
+        .join("Default")
+        .join("Extensions")
+        .join(CRX_ID)
+        .join("1.0.0_0")
+        .join("manifest.json"),
+      r#"{"name":"Dark Reader","version":"1.0.0","permissions":["storage","activeTab"]}"#,
+    );
+
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(root, &mut out, Instant::now()));
+    assert!(out.is_empty());
+  }
+
+  #[test]
+  fn scan_reports_incomplete_when_the_deadline_has_passed() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    write(
+      &root
+        .join("Default")
+        .join("Extensions")
+        .join(CRX_ID)
+        .join("2.1.0_0")
+        .join("manifest.json"),
+      VPN_MANIFEST,
+    );
+
+    let mut out = Vec::new();
+    // A start time already past the deadline stands in for a slow disk.
+    let expired = Instant::now() - SCAN_DEADLINE - Duration::from_millis(10);
+    assert!(!scan_browser_extensions(root, &mut out, expired));
+  }
+
+  #[test]
+  fn scan_survives_a_malformed_manifest() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    write(
+      &root
+        .join("Default")
+        .join("Extensions")
+        .join(CRX_ID)
+        .join("2.1.0_0")
+        .join("manifest.json"),
+      "{ not json",
+    );
+
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(root, &mut out, Instant::now()));
+    assert!(out.is_empty());
+  }
+
+  #[test]
+  fn preferences_json_escapes_windows_style_paths() {
+    // The Windows CI failure this guards: a raw `C:\Users\...` pasted into a
+    // JSON string literal is invalid (`\U` is not an escape), so Preferences
+    // failed to parse, `preference_extensions` returned nothing, and the
+    // unpacked extension silently vanished — on Linux the same test passed
+    // because POSIX paths contain no backslashes.
+    let json = preferences_json(CRX_ID, 1, Path::new(r"C:\Users\runner\ext\my-vpn"));
+    let parsed: serde_json::Value =
+      serde_json::from_str(&json).expect("Preferences must be valid JSON on every platform");
+    assert_eq!(
+      parsed["extensions"]["settings"][CRX_ID]["path"],
+      r"C:\Users\runner\ext\my-vpn"
+    );
+  }
+
+  #[test]
+  fn scan_finds_an_unpacked_developer_mode_extension() {
+    // Sideloading via "Load unpacked" is exactly how a VPN extension gets in
+    // without the Web Store, and those files live outside Extensions/.
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    let unpacked = root.join("somewhere-else").join("my-vpn");
+    write(&unpacked.join("manifest.json"), VPN_MANIFEST);
+    write(
+      &root.join("Default").join("Preferences"),
+      &preferences_json(CRX_ID, 1, &unpacked),
+    );
+
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(root, &mut out, Instant::now()));
+    assert_eq!(out.len(), 1, "unpacked extensions must not be invisible");
+    assert_eq!(out[0].key, format!("crx:{CRX_ID}"));
+    assert_eq!(out[0].confidence, "confirmed");
+  }
+
+  #[test]
+  fn scan_ignores_a_disabled_unpacked_extension() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    let unpacked = root.join("somewhere-else").join("my-vpn");
+    write(&unpacked.join("manifest.json"), VPN_MANIFEST);
+    write(
+      &root.join("Default").join("Preferences"),
+      &preferences_json(CRX_ID, 0, &unpacked),
+    );
+
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(root, &mut out, Instant::now()));
+    assert!(out.is_empty());
+  }
+
+  #[test]
+  fn packed_relative_paths_are_not_treated_as_unpacked() {
+    // A packed extension records a path relative to Extensions/; following it
+    // as if absolute would read the wrong place (or nothing).
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    write(
+      &root.join("Default").join("Preferences"),
+      &preferences_json(CRX_ID, 1, Path::new(&format!("{CRX_ID}/2.1.0_0"))),
+    );
+
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(root, &mut out, Instant::now()));
+    assert!(out.is_empty());
+  }
+
+  #[test]
+  fn a_traversing_default_locale_is_refused() {
+    // `default_locale` comes from a manifest we did not write. Joined naively
+    // it reads any file the user can read, on the launch path.
+    assert!(!is_safe_locale_name("../../../../etc"));
+    assert!(!is_safe_locale_name("..\\..\\windows"));
+    assert!(!is_safe_locale_name("/etc/passwd"));
+    assert!(!is_safe_locale_name(""));
+    assert!(is_safe_locale_name("en"));
+    assert!(is_safe_locale_name("en_GB"));
+    assert!(is_safe_locale_name("zh-CN"));
+  }
+
+  #[test]
+  fn a_localized_name_with_a_traversing_locale_is_not_resolved() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    let version_dir = root
+      .join("Default")
+      .join("Extensions")
+      .join(CRX_ID)
+      .join("2.1.0_0");
+    write(
+      &version_dir.join("manifest.json"),
+      r#"{"name":"__MSG_appName__","version":"2.1.0","default_locale":"../../../../etc","permissions":["proxy"]}"#,
+    );
+
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(root, &mut out, Instant::now()));
+    // Still detected (the proxy permission is what matters), but the name
+    // falls back rather than the traversal being followed.
+    assert_eq!(out.len(), 1);
+    assert_eq!(out[0].name, CRX_ID);
+  }
+
+  #[test]
+  fn scan_tolerates_a_missing_user_data_dir() {
+    let tmp = tempfile::tempdir().unwrap();
+    let mut out = Vec::new();
+    assert!(scan_browser_extensions(
+      &tmp.path().join("nope"),
+      &mut out,
+      Instant::now()
+    ));
+    assert!(out.is_empty());
+  }
+}
@@ -0,0 +1,163 @@
+//! Detects VPN/proxy browser extensions present in a profile.
+//!
+//! An extension holding Chromium's `proxy` permission can override the proxy
+//! Donut passes on the command line, so the browser's real exit stops being the
+//! one Donut measured and generated the fingerprint against. That produces
+//! exactly the geo/timezone/language mismatch the fingerprint exists to avoid,
+//! except Donut cannot observe it from the outside — hence a launch-time
+//! warning rather than a measurement.
+//!
+//! Two sources, deliberately both: Donut-managed extensions live in the app's
+//! own store and are handed to Chromium via `--load-extension` from *outside*
+//! the profile directory, while extensions the user installed from the Web
+//! Store live *inside* it. Neither set appears in the other.
+
+mod browser_scan;
+mod rules;
+
+// `message_placeholder_key`/`lookup_message` are shared with
+// `extension_manager`, which resolves the same placeholders out of a zip.
+use rules::{classify, keyword_hit, manifest_str, signal_labels, signals_from_manifest};
+pub use rules::{lookup_message, message_placeholder_key, DetectedVpnExtension};
+
+use serde::{Deserialize, Serialize};
+use std::collections::HashSet;
+use std::time::Instant;
+
+use crate::profile::types::BrowserProfile;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ExtensionScan {
+  pub extensions: Vec<DetectedVpnExtension>,
+  /// `scanned` | `partial` | `encrypted` | `ephemeral` | `missing`.
+  ///
+  /// Reported honestly so the dialog can say the scan was incomplete rather
+  /// than implying a clean profile it never managed to read.
+  pub scan_state: String,
+}
+
+/// Donut-managed extensions, reached through the profile's extension group.
+///
+/// Read live from the stored archive rather than from the metadata cached on
+/// `Extension`, so replacing an extension's file cannot leave a stale verdict
+/// behind. N is the group size — typically a handful.
+fn scan_donut_extensions(profile: &BrowserProfile, out: &mut Vec<DetectedVpnExtension>) {
+  let Some(group_id) = &profile.extension_group_id else {
+    return;
+  };
+  let Ok(manager) = crate::extension_manager::EXTENSION_MANAGER.lock() else {
+    log::warn!("VPN extension scan: extension manager lock poisoned, skipping managed extensions");
+    return;
+  };
+  let Ok(group) = manager.get_group(group_id) else {
+    return;
+  };
+
+  for ext_id in &group.extension_ids {
+    let Ok(ext) = manager.get_extension(ext_id) else {
+      continue;
+    };
+    let path = manager.get_file_dir_public(ext_id).join(&ext.file_name);
+    let Ok(data) = std::fs::read(&path) else {
+      continue;
+    };
+    let Some(manifest) =
+      crate::extension_manager::read_manifest_from_archive(&data, &ext.file_type)
+    else {
+      continue;
+    };
+
+    let raw_name = manifest_str(&manifest, "name").unwrap_or_else(|| ext.name.clone());
+    let name =
+      crate::extension_manager::resolve_archive_i18n(&data, &ext.file_type, &manifest, &raw_name)
+        .unwrap_or_else(|| {
+          // An unresolvable placeholder is not a name — fall back to the one
+          // the extension carries in Donut.
+          if message_placeholder_key(&raw_name).is_some() {
+            ext.name.clone()
+          } else {
+            raw_name.clone()
+          }
+        });
+    let description = manifest_str(&manifest, "description").and_then(|d| {
+      crate::extension_manager::resolve_archive_i18n(&data, &ext.file_type, &manifest, &d).or(
+        if message_placeholder_key(&d).is_some() {
+          None
+        } else {
+          Some(d)
+        },
+      )
+    });
+
+    let signals = signals_from_manifest(&manifest);
+    let keyword = keyword_hit(&name, description.as_deref());
+    let Some(confidence) = classify(&signals, keyword) else {
+      continue;
+    };
+
+    out.push(DetectedVpnExtension {
+      key: format!("donut:{ext_id}"),
+      name,
+      version: manifest_str(&manifest, "version").or_else(|| ext.version.clone()),
+      source: "donut".to_string(),
+      confidence: confidence.to_string(),
+      signals: signal_labels(&signals, keyword),
+    });
+  }
+}
+
+/// Scan a profile for VPN/proxy extensions from both sources.
+///
+/// Never fails: an unreadable profile reports whatever it could see plus a
+/// `scan_state` explaining why the picture is incomplete.
+pub fn scan_profile(profile: &BrowserProfile) -> ExtensionScan {
+  let started = Instant::now();
+  let mut extensions = Vec::new();
+
+  scan_donut_extensions(profile, &mut extensions);
+
+  let profiles_dir = crate::app_dirs::profiles_dir();
+  let user_data_dir = crate::ephemeral_dirs::get_effective_profile_path(profile, &profiles_dir);
+
+  // `get_effective_profile_path` only returns the decrypted RAM copy while the
+  // profile is unlocked; locked, it falls back to the on-disk directory, which
+  // exists but is ciphertext. Walking that finds nothing — so the state has to
+  // be decided on whether we actually got a readable copy, not on the path
+  // existing, or a locked profile reports as verified-clean.
+  let has_plaintext_dir = !(profile.password_protected || profile.ephemeral)
+    || crate::ephemeral_dirs::get_ephemeral_dir(&profile.id.to_string()).is_some();
+
+  let scan_state = if !has_plaintext_dir {
+    if profile.password_protected {
+      "encrypted"
+    } else {
+      "ephemeral"
+    }
+  } else if !user_data_dir.is_dir() {
+    // Never launched, so there is no profile directory to inspect yet.
+    "missing"
+  } else if browser_scan::scan_browser_extensions(&user_data_dir, &mut extensions, started) {
+    "scanned"
+  } else {
+    "partial"
+  };
+
+  // Collapse only exact duplicates of the same extension. `key` is the real
+  // identity (`donut:<uuid>` / `crx:<id>`); name+version is not, and two
+  // distinct extensions sharing a display name would silently fold into one —
+  // dropping a `confirmed` detection would then flip `has_confirmed()` and stop
+  // the gate treating its own exit measurement as unreliable.
+  let mut seen = HashSet::new();
+  extensions.retain(|e| seen.insert(e.key.clone()));
+
+  ExtensionScan {
+    extensions,
+    scan_state: scan_state.to_string(),
+  }
+}
+
+/// True when at least one detection is `confirmed` — the extension holds the
+/// `proxy` permission and can actually redirect the browser's traffic.
+pub fn has_confirmed(scan: &ExtensionScan) -> bool {
+  scan.extensions.iter().any(|e| e.confidence == "confirmed")
+}
@@ -0,0 +1,335 @@
+//! Pure classification rules for VPN/proxy extension detection.
+//!
+//! Deliberately free of crate-internal dependencies (`std` + `serde_json`
+//! only): these rules are the heart of the feature and the part most worth
+//! testing in isolation, so nothing here may reach for app state, the
+//! filesystem, or the network. Enumerating the two extension sources and
+//! reading them off disk lives in the parent module.
+
+use serde::{Deserialize, Serialize};
+
+/// Substrings that corroborate a request-blocking extension being a VPN.
+/// Matched case-insensitively against name + description.
+const KEYWORDS: &[&str] = &[
+  "vpn",
+  "proxy",
+  "tunnel",
+  "unblock",
+  "wireguard",
+  "shadowsocks",
+  "socks",
+];
+
+/// Matched as a whole token rather than a substring — too short to be safe
+/// inside other words ("warped", "warpaint").
+const TOKEN_KEYWORDS: &[&str] = &["warp"];
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct DetectedVpnExtension {
+  /// Stable acknowledgement identity: `donut:<uuid>` or `crx:<32-char-id>`.
+  pub key: String,
+  pub name: String,
+  pub version: Option<String>,
+  /// `"donut"` (managed by Donut) or `"browser"` (installed inside the profile).
+  pub source: String,
+  /// `"confirmed"` or `"likely"`.
+  pub confidence: String,
+  /// Why it matched, for the dialog's detail line.
+  pub signals: Vec<String>,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct ManifestSignals {
+  pub proxy_permission: bool,
+  pub optional_proxy_permission: bool,
+  pub declarative_net_request: bool,
+  pub web_request_blocking: bool,
+  pub broad_host_permissions: bool,
+}
+
+fn string_list<'a>(manifest: &'a serde_json::Value, key: &str) -> Vec<&'a str> {
+  manifest
+    .get(key)
+    .and_then(|v| v.as_array())
+    .map(|a| a.iter().filter_map(|v| v.as_str()).collect())
+    .unwrap_or_default()
+}
+
+fn is_broad_host(pattern: &str) -> bool {
+  matches!(pattern, "<all_urls>" | "*://*/*")
+}
+
+pub fn signals_from_manifest(manifest: &serde_json::Value) -> ManifestSignals {
+  let permissions = string_list(manifest, "permissions");
+  let optional_permissions = string_list(manifest, "optional_permissions");
+  let host_permissions = string_list(manifest, "host_permissions");
+  let optional_host_permissions = string_list(manifest, "optional_host_permissions");
+
+  let has = |list: &[&str], name: &str| list.contains(&name);
+
+  // MV2 keeps host patterns inside `permissions`; MV3 splits them into
+  // `host_permissions`. Look in both so one manifest version isn't silently
+  // under-detected.
+  let all_hosts: Vec<&str> = permissions
+    .iter()
+    .chain(host_permissions.iter())
+    .chain(optional_host_permissions.iter())
+    .copied()
+    .collect();
+  let broad = all_hosts.iter().any(|p| is_broad_host(p))
+    || (all_hosts.contains(&"http://*/*") && all_hosts.contains(&"https://*/*"));
+
+  ManifestSignals {
+    proxy_permission: has(&permissions, "proxy"),
+    optional_proxy_permission: has(&optional_permissions, "proxy"),
+    declarative_net_request: has(&permissions, "declarativeNetRequest")
+      || has(&permissions, "declarativeNetRequestWithHostAccess"),
+    web_request_blocking: has(&permissions, "webRequest")
+      && has(&permissions, "webRequestBlocking"),
+    broad_host_permissions: broad,
+  }
+}
+
+pub fn keyword_hit(name: &str, description: Option<&str>) -> bool {
+  let mut haystack = name.to_lowercase();
+  if let Some(d) = description {
+    haystack.push(' ');
+    haystack.push_str(&d.to_lowercase());
+  }
+  if KEYWORDS.iter().any(|k| haystack.contains(k)) {
+    return true;
+  }
+  haystack
+    .split(|c: char| !c.is_alphanumeric())
+    .any(|token| TOKEN_KEYWORDS.contains(&token))
+}
+
+/// Classify an extension from its manifest signals.
+///
+/// The `proxy` permission is the only signal that *proves* the capability: it
+/// is what Chromium requires to call `chrome.proxy`, and it stays in
+/// `permissions` under both manifest versions because it is an API permission,
+/// not a host pattern.
+///
+/// The request-blocking tier additionally requires a keyword, and that
+/// corroboration is not optional: `declarativeNetRequest` plus `<all_urls>`
+/// describes every content blocker in the ecosystem, so without it the warning
+/// fires on uBlock Origin — which would teach users to dismiss the dialog on
+/// sight, destroying the value of the mismatch block that shares it.
+pub fn classify(signals: &ManifestSignals, keyword: bool) -> Option<&'static str> {
+  if signals.proxy_permission {
+    return Some("confirmed");
+  }
+  if signals.optional_proxy_permission {
+    return Some("likely");
+  }
+  if (signals.declarative_net_request || signals.web_request_blocking)
+    && signals.broad_host_permissions
+    && keyword
+  {
+    return Some("likely");
+  }
+  None
+}
+
+pub fn signal_labels(signals: &ManifestSignals, keyword: bool) -> Vec<String> {
+  let mut out = Vec::new();
+  if signals.proxy_permission {
+    out.push("permissions:proxy".to_string());
+  }
+  if signals.optional_proxy_permission {
+    out.push("optionalPermissions:proxy".to_string());
+  }
+  if signals.declarative_net_request {
+    out.push("declarativeNetRequest".to_string());
+  }
+  if signals.web_request_blocking {
+    out.push("webRequestBlocking".to_string());
+  }
+  if signals.broad_host_permissions {
+    out.push("broadHostPermissions".to_string());
+  }
+  if keyword {
+    out.push("keyword".to_string());
+  }
+  out
+}
+
+/// `__MSG_someKey__` -> `someKey`.
+pub fn message_placeholder_key(value: &str) -> Option<String> {
+  value
+    .strip_prefix("__MSG_")
+    .and_then(|rest| rest.strip_suffix("__"))
+    .map(str::to_string)
+}
+
+/// Chromium's `messages.json` shape: `{ "key": { "message": "..." } }`, with
+/// keys compared case-insensitively.
+pub fn lookup_message(messages: &serde_json::Value, key: &str) -> Option<String> {
+  let obj = messages.as_object()?;
+  obj
+    .iter()
+    .find(|(k, _)| k.eq_ignore_ascii_case(key))
+    .and_then(|(_, v)| v.get("message"))
+    .and_then(|v| v.as_str())
+    .map(str::to_string)
+}
+
+pub fn manifest_str(manifest: &serde_json::Value, key: &str) -> Option<String> {
+  manifest
+    .get(key)
+    .and_then(|v| v.as_str())
+    .map(str::to_string)
+}
+
+/// Sort key for an extension version directory (`1.10.0_0`), compared
+/// numerically so `1.10.0` sorts above `1.9.0` where a lexicographic compare
+/// would put it below.
+pub fn version_dir_sort_key(name: &str) -> Vec<u64> {
+  name
+    .split(['.', '_'])
+    .map(|part| part.parse::<u64>().unwrap_or(0))
+    .collect()
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+  use serde_json::json;
+
+  fn signals_of(manifest: serde_json::Value) -> ManifestSignals {
+    signals_from_manifest(&manifest)
+  }
+
+  #[test]
+  fn classify_confirms_on_proxy_permission() {
+    let s = signals_of(json!({ "permissions": ["proxy", "storage"] }));
+    assert!(s.proxy_permission);
+    assert_eq!(classify(&s, false), Some("confirmed"));
+  }
+
+  #[test]
+  fn classify_confirms_proxy_permission_in_mv2() {
+    // `proxy` is an API permission, so MV3's host_permissions split does not
+    // move it — the same key works for both manifest versions.
+    let s = signals_of(json!({
+      "manifest_version": 2,
+      "permissions": ["proxy", "<all_urls>", "webRequest"]
+    }));
+    assert_eq!(classify(&s, false), Some("confirmed"));
+  }
+
+  #[test]
+  fn classify_likely_on_optional_proxy() {
+    let s = signals_of(json!({ "optional_permissions": ["proxy"] }));
+    assert_eq!(classify(&s, false), Some("likely"));
+  }
+
+  #[test]
+  fn classify_ignores_content_blocker() {
+    // The regression guard: a content blocker declares exactly these and is
+    // not a VPN. Firing here would train users to dismiss the dialog.
+    let s = signals_of(json!({
+      "permissions": ["declarativeNetRequest"],
+      "host_permissions": ["<all_urls>"]
+    }));
+    assert!(s.declarative_net_request && s.broad_host_permissions);
+    assert_eq!(classify(&s, keyword_hit("uBlock Origin", None)), None);
+  }
+
+  #[test]
+  fn classify_likely_on_dnr_plus_keyword() {
+    let s = signals_of(json!({
+      "permissions": ["declarativeNetRequest"],
+      "host_permissions": ["<all_urls>"]
+    }));
+    assert_eq!(
+      classify(&s, keyword_hit("Free VPN Proxy", None)),
+      Some("likely")
+    );
+  }
+
+  #[test]
+  fn classify_ignores_keyword_only() {
+    // A name alone proves nothing; without a capability signal this is noise.
+    let s = signals_of(json!({ "permissions": ["storage"] }));
+    assert_eq!(classify(&s, keyword_hit("VPN Deals Finder", None)), None);
+  }
+
+  #[test]
+  fn classify_requires_broad_hosts_for_the_blocking_tier() {
+    let s = signals_of(json!({
+      "permissions": ["declarativeNetRequest"],
+      "host_permissions": ["https://example.com/*"]
+    }));
+    assert_eq!(classify(&s, keyword_hit("Some VPN", None)), None);
+  }
+
+  #[test]
+  fn broad_hosts_detected_from_split_http_and_https() {
+    let s = signals_of(json!({
+      "permissions": ["webRequest", "webRequestBlocking"],
+      "host_permissions": ["http://*/*", "https://*/*"]
+    }));
+    assert!(s.broad_host_permissions);
+    assert!(s.web_request_blocking);
+  }
+
+  #[test]
+  fn broad_hosts_detected_from_mv2_permissions_array() {
+    // MV2 puts host patterns in `permissions`; the split-out key is absent.
+    let s = signals_of(json!({
+      "manifest_version": 2,
+      "permissions": ["webRequest", "webRequestBlocking", "<all_urls>"]
+    }));
+    assert!(s.broad_host_permissions);
+    assert_eq!(classify(&s, keyword_hit("Turbo VPN", None)), Some("likely"));
+  }
+
+  #[test]
+  fn keyword_matching_is_substring_but_token_bound_for_short_terms() {
+    assert!(keyword_hit("TouchVPN", None));
+    assert!(keyword_hit("Unblock Sites", None));
+    assert!(keyword_hit("Cloudflare WARP", None));
+    // "warp" only matches as a whole token, so this must not hit.
+    assert!(!keyword_hit("Time Warped Clock", None));
+    assert!(keyword_hit(
+      "Anything",
+      Some("a fast tunnel for your browser")
+    ));
+  }
+
+  #[test]
+  fn message_placeholder_round_trip() {
+    assert_eq!(
+      message_placeholder_key("__MSG_appName__").as_deref(),
+      Some("appName")
+    );
+    assert_eq!(message_placeholder_key("Plain Name"), None);
+    let messages = json!({ "appName": { "message": "Nord VPN" } });
+    assert_eq!(
+      lookup_message(&messages, "appName").as_deref(),
+      Some("Nord VPN")
+    );
+    // Chromium compares message keys case-insensitively.
+    assert_eq!(
+      lookup_message(&messages, "APPNAME").as_deref(),
+      Some("Nord VPN")
+    );
+  }
+
+  #[test]
+  fn version_dirs_sort_numerically_not_lexicographically() {
+    let mut dirs = ["1.9.0_0", "1.10.0_0", "1.2.0_0"];
+    dirs.sort_by_key(|d| version_dir_sort_key(d));
+    assert_eq!(dirs.last(), Some(&"1.10.0_0"));
+  }
+
+  #[test]
+  fn malformed_manifest_yields_no_signals() {
+    // Arrays of non-strings, wrong types, and missing keys must not panic.
+    let s = signals_of(json!({ "permissions": [1, 2, {"a": "b"}], "host_permissions": "nope" }));
+    assert_eq!(s, ManifestSignals::default());
+    assert_eq!(classify(&s, true), None);
+  }
+}
@@ -99,7 +99,50 @@ async fn wait_for_vpn_worker_ready(
  }
 }

+/// Serializes worker startup for a given VPN, so two concurrent launches cannot
+/// both observe "no worker" and both believe they created it. Benign until a
+/// launch guard may stop one on failure; then double-ownership means a
+/// cancelled launch tears down a tunnel another profile is using. Mirrors
+/// `xray_worker_runner::XRAY_START_LOCK`.
+static VPN_START_LOCK: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
+
+/// A started VPN worker plus whether *this* call spawned it.
+pub struct VpnWorkerStart {
+  pub config: VpnWorkerConfig,
+  /// False when an already-running worker was adopted. Only the creator may
+  /// stop it while unwinding a failed launch.
+  pub created: bool,
+}
+
+/// Whether any profile with a live browser process is routing through this VPN.
+///
+/// Extracted from the startup sweep so the launch guard and the sweep agree on
+/// what "in use" means instead of each carrying its own copy.
+pub fn vpn_id_in_use_by_running_browser(vpn_id: &str) -> bool {
+  let Ok(profiles) = crate::profile::ProfileManager::instance().list_profiles() else {
+    // Unable to tell — assume in use rather than tear down a live tunnel.
+    return true;
+  };
+  profiles
+    .iter()
+    .filter(|p| p.process_id.is_some_and(is_process_running))
+    .any(|p| p.vpn_id.as_deref() == Some(vpn_id))
+}
+
+/// Hold the start lock across an adopt-sensitive section (a launch guard
+/// deciding whether to stop a worker it created).
+pub async fn lock_vpn_starts() -> tokio::sync::MutexGuard<'static, ()> {
+  VPN_START_LOCK.lock().await
+}
+
 pub async fn start_vpn_worker(vpn_id: &str) -> Result<VpnWorkerConfig, Box<dyn std::error::Error>> {
+  start_vpn_worker_tracked(vpn_id).await.map(|s| s.config)
+}
+
+pub async fn start_vpn_worker_tracked(
+  vpn_id: &str,
+) -> Result<VpnWorkerStart, Box<dyn std::error::Error>> {
+  let _start_guard = VPN_START_LOCK.lock().await;
  crate::proxy_runner::ensure_sidecar_version().await?;

  for config in list_vpn_worker_configs() {
@@ -117,10 +160,18 @@ pub async fn start_vpn_worker(vpn_id: &str) -> Result<VpnWorkerConfig, Box<dyn s
    if let Some(pid) = existing.pid {
      if is_process_running(pid) {
        if vpn_worker_accepting_connections(&existing).await {
-          return Ok(existing);
+          return Ok(VpnWorkerStart {
+            config: existing,
+            created: false,
+          });
        }

-        return wait_for_vpn_worker_ready(&existing.id).await;
+        return wait_for_vpn_worker_ready(&existing.id)
+          .await
+          .map(|config| VpnWorkerStart {
+            config,
+            created: false,
+          });
      }
    }
    // Worker config exists but process is dead, clean up
@@ -263,7 +314,12 @@ pub async fn start_vpn_worker(vpn_id: &str) -> Result<VpnWorkerConfig, Box<dyn s
    drop(child);
  }

-  wait_for_vpn_worker_ready(&id).await
+  wait_for_vpn_worker_ready(&id)
+    .await
+    .map(|config| VpnWorkerStart {
+      config,
+      created: true,
+    })
 }

 pub async fn stop_vpn_worker(id: &str) -> Result<bool, Box<dyn std::error::Error>> {
@@ -0,0 +1,182 @@
+//! Client-side window decorations on Linux.
+//!
+//! The app draws its own titlebar (as it already does on macOS and Windows), so
+//! the window is built without server-side decorations. That means the app also
+//! owns the window *controls*, and their side and order are a desktop-wide user
+//! preference that differs between environments — GNOME defaults to
+//! `:minimize,maximize,close` (all on the right), and a user who has moved them
+//! to the left expects every app to follow.
+//!
+//! `GtkSettings::gtk-decoration-layout` is the one place every desktop
+//! publishes that preference to GTK applications: GNOME mirrors
+//! `org.gnome.desktop.wm.preferences button-layout` into it, and on KDE Plasma
+//! `kde-gtk-config` mirrors KWin's decoration button configuration into it.
+//! Reading this property therefore gets both environments right without any
+//! desktop-specific branching.
+
+use serde::Serialize;
+
+/// Whether this window draws its own titlebar, and how.
+#[derive(Debug, Clone, Serialize)]
+pub struct WindowDecorations {
+  /// True when the app owns the titlebar and must draw controls and resize
+  /// edges. False means the platform still draws a real titlebar and the
+  /// frontend must render nothing.
+  pub client_side: bool,
+  /// The desktop's button layout, e.g. `":minimize,maximize,close"`. Only
+  /// meaningful when `client_side` is true.
+  pub layout: Option<String>,
+}
+
+/// Whether to drop server-side decorations on this Linux session.
+///
+/// Enabled everywhere except KDE Plasma on Wayland, and overridable with
+/// `DONUT_LINUX_CLIENT_DECORATIONS=1|0`.
+///
+/// The KDE/Wayland exclusion is deliberate and is about a failure mode, not a
+/// preference. GTK3 speaks no `xdg-decoration`; when a window is built
+/// undecorated, GTK does not mark it client-decorated, and on Wayland it
+/// therefore *announces server-side decorations* to the compositor. mutter
+/// ignores that (it never decorates Wayland toplevels), which is why GNOME
+/// works. KWin honors it, so Plasma would be free to draw a Breeze titlebar
+/// directly above the one the app draws — two titlebars, worse than the
+/// feature is good. Whether it actually does depends on the decoration mode
+/// KWin advertises, which could not be established from documentation and
+/// cannot be tested from here, so this stays off until somebody can run it.
+///
+/// KDE on X11 is *not* excluded: there the request travels as `_MOTIF_WM_HINTS`,
+/// which KWin has honored for as long as it has existed.
+#[cfg(target_os = "linux")]
+pub fn use_client_side_decorations() -> bool {
+  if let Ok(value) = std::env::var("DONUT_LINUX_CLIENT_DECORATIONS") {
+    let forced = matches!(value.trim(), "1" | "true" | "yes");
+    log::info!("Client-side decorations forced to {forced} by DONUT_LINUX_CLIENT_DECORATIONS");
+    return forced;
+  }
+
+  let env = |key: &str| std::env::var(key).unwrap_or_default().to_lowercase();
+
+  // GDK_BACKEND is a comma-separated preference list ("wayland,x11"), and GDK
+  // takes the FIRST entry it can open. Testing for a substring would read
+  // "wayland,x11" as X11 and hand a Plasma Wayland session the undecorated
+  // path this guard exists to withhold.
+  let backend = env("GDK_BACKEND");
+  let preferred = backend
+    .split(',')
+    .map(str::trim)
+    .find(|value| !value.is_empty());
+  let on_wayland = match preferred {
+    Some("x11") => false,
+    Some("wayland") => true,
+    // Unset or something exotic: fall back to what the session advertises.
+    _ => {
+      !std::env::var("WAYLAND_DISPLAY")
+        .unwrap_or_default()
+        .is_empty()
+        && env("XDG_SESSION_TYPE") != "x11"
+    }
+  };
+
+  let on_kde = env("XDG_CURRENT_DESKTOP").contains("kde")
+    || env("XDG_SESSION_DESKTOP").contains("plasma")
+    || env("DESKTOP_SESSION").contains("plasma")
+    || !std::env::var("KDE_FULL_SESSION")
+      .unwrap_or_default()
+      .is_empty();
+
+  if on_kde && on_wayland {
+    log::info!(
+      "Keeping server-side decorations: KWin on Wayland may draw its own titlebar over the \
+       app's. Set DONUT_LINUX_CLIENT_DECORATIONS=1 to override."
+    );
+    return false;
+  }
+  true
+}
+
+#[cfg(target_os = "linux")]
+mod imp {
+  use std::sync::Mutex;
+
+  lazy_static::lazy_static! {
+    static ref LAYOUT: Mutex<Option<String>> = Mutex::new(None);
+  }
+
+  fn store(layout: Option<String>) {
+    if let Ok(mut slot) = LAYOUT.lock() {
+      *slot = layout;
+    }
+  }
+
+  pub fn cached() -> Option<String> {
+    LAYOUT.lock().ok().and_then(|slot| slot.clone())
+  }
+
+  /// Read the layout and subscribe to changes.
+  ///
+  /// MUST be called on the GTK main thread — `gtk::Settings::default()` panics
+  /// elsewhere, and the notify subscription has to be attached from the thread
+  /// owning the GTK main context. The app's `setup` hook already runs there.
+  pub fn init<R: tauri::Runtime>(app: &tauri::AppHandle<R>) {
+    use gtk::prelude::*;
+    use tauri::Emitter;
+
+    let Some(settings) = gtk::Settings::default() else {
+      log::warn!("No GTK settings available; using the default decoration layout");
+      return;
+    };
+
+    store(settings.gtk_decoration_layout().map(|v| v.to_string()));
+    log::info!(
+      "Window decoration layout: {}",
+      cached().as_deref().unwrap_or("<unset>")
+    );
+
+    // The user can rearrange titlebar buttons while the app is running, and
+    // every other application follows immediately. Note this never fires where
+    // the value comes only from gtk-3.0/settings.ini (a KDE X11 box with no
+    // xsettings daemon) — there it is simply static until restart.
+    let handle = app.clone();
+    settings.connect_gtk_decoration_layout_notify(move |settings| {
+      let layout = settings.gtk_decoration_layout().map(|v| v.to_string());
+      log::info!(
+        "Window decoration layout changed to: {}",
+        layout.as_deref().unwrap_or("<unset>")
+      );
+      store(layout.clone());
+      if let Err(e) = handle.emit("window-decoration-layout-changed", layout) {
+        log::warn!("Failed to emit window decoration layout change: {e}");
+      }
+    });
+  }
+}
+
+#[cfg(not(target_os = "linux"))]
+mod imp {
+  pub fn init<R: tauri::Runtime>(_app: &tauri::AppHandle<R>) {}
+}
+
+pub use imp::init;
+
+/// How this window is decorated, and the desktop's button layout when the app
+/// owns the titlebar.
+#[tauri::command]
+pub fn get_window_decoration_layout() -> WindowDecorations {
+  #[cfg(target_os = "linux")]
+  {
+    let client_side = use_client_side_decorations();
+    WindowDecorations {
+      client_side,
+      layout: if client_side { imp::cached() } else { None },
+    }
+  }
+  // Every other platform keeps a real titlebar: macOS makes the native one
+  // transparent, Windows draws its own controls on a fixed layout.
+  #[cfg(not(target_os = "linux"))]
+  {
+    WindowDecorations {
+      client_side: false,
+      layout: None,
+    }
+  }
+}
@@ -27,3 +27,42 @@ pub enum XrayError {
  #[error("failed to serialize Xray client configuration")]
  Serialization,
 }
+
+impl XrayError {
+  /// A stable, translatable identifier for *why* a URI was rejected.
+  ///
+  /// Donut supports one VLESS shape — REALITY + XTLS Vision over TCP — so most
+  /// rejections are "your setup is a kind we do not support", not "you made a
+  /// typo". The frontend turns these into a sentence naming the unsupported
+  /// part; without them every rejection reads as a malformed URI and a user
+  /// with a working WebSocket or plain-TLS server has no idea why it failed.
+  pub fn reason_code(&self) -> &'static str {
+    match self {
+      Self::UnsupportedScheme => "scheme",
+      Self::UnsupportedValue { field, .. } | Self::InvalidField { field, .. } => match *field {
+        "security" => "security",
+        "flow" => "flow",
+        "type" => "transport",
+        "encryption" => "encryption",
+        "headerType" => "headerType",
+        "fp" => "fingerprint",
+        // A malformed sni/public key is the same user-facing problem as a
+        // missing one, so it earns the same specific help rather than the
+        // generic "invalid URI".
+        "sni" | "server_name" => "sni",
+        "pbk" | "public_key" => "publicKey",
+        _ => "malformed",
+      },
+      Self::MissingField(field) => match *field {
+        "sni" => "sni",
+        "pbk" => "publicKey",
+        "security" => "security",
+        "flow" => "flow",
+        _ => "malformed",
+      },
+      Self::UnsupportedParameter(_) => "parameter",
+      Self::DuplicateParameter(_) => "malformed",
+      Self::InvalidUri | Self::Serialization => "malformed",
+    }
+  }
+}
@@ -61,10 +61,10 @@ pub fn parse_vless_uri(input: &str) -> XrayResult<ParsedVlessUri> {
  };
  let port = url.port().ok_or(XrayError::MissingField("port"))?;

-  let parameters = parse_parameters(&url)?;
-  require_value(&parameters, "security", "reality")?;
-  require_value(&parameters, "flow", VlessFlow::Vision.as_str())?;
-  optional_value(&parameters, "encryption", "none")?;
+  let (parameters, unsupported) = parse_parameters(&url)?;
+
+  // Transport first: it is the most common reason a real-world VLESS server is
+  // unusable here, and it explains the stray parameters that come with it.
  match parameters.get("type").map(String::as_str) {
    None | Some("tcp" | "raw") => {}
    Some(_) => {
@@ -74,8 +74,17 @@ pub fn parse_vless_uri(input: &str) -> XrayResult<ParsedVlessUri> {
      });
    }
  }
+  require_value(&parameters, "security", "reality")?;
+  require_value(&parameters, "flow", VlessFlow::Vision.as_str())?;
+  optional_value(&parameters, "encryption", "none")?;
  optional_value(&parameters, "headerType", "none")?;

+  // Only once the shape is known-good does an unrecognized parameter become
+  // the most useful thing to report.
+  if let Some(name) = unsupported.into_iter().next() {
+    return Err(XrayError::UnsupportedParameter(name));
+  }
+
  let server_name = required_parameter(&parameters, "sni")?.to_string();
  let public_key = required_parameter(&parameters, "pbk")?.to_string();
  let short_id = parameters.get("sid").cloned().unwrap_or_default();
@@ -162,15 +171,28 @@ pub fn export_vless_uri(config: &VlessRealityConfig, name: Option<&str>) -> Xray
    query.append_pair("type", "tcp");
    query.append_pair("headerType", "none");
  }
-  url.set_fragment(name);
+  // The parser percent-DECODES the fragment, so the exporter must encode it or
+  // a name containing `%` (or `#`) comes back different every time the URI is
+  // canonicalized — the name mutates a little more on each save.
+  let encoded_name = name.map(|value| urlencoding::encode(value).into_owned());
+  url.set_fragment(encoded_name.as_deref());
  Ok(url.into())
 }

-fn parse_parameters(url: &Url) -> XrayResult<HashMap<String, String>> {
+/// Split the query into recognized parameters and the names of the rest.
+///
+/// Unrecognized names are returned rather than rejected on the spot so the
+/// caller can report the *shape* problem first. A WebSocket URI always carries
+/// `path` (and usually `host`), gRPC carries `serviceName` — naming those keys
+/// instead of the transport sends the user deleting parameters when the real
+/// answer is that Donut only speaks plain TCP.
+fn parse_parameters(url: &Url) -> XrayResult<(HashMap<String, String>, Vec<String>)> {
  let mut parameters = HashMap::new();
+  let mut unsupported = Vec::new();
  for (name, value) in url.query_pairs() {
    if !SUPPORTED_PARAMETERS.contains(&name.as_ref()) {
-      return Err(XrayError::UnsupportedParameter(name.into_owned()));
+      unsupported.push(name.into_owned());
+      continue;
    }
    if parameters
      .insert(name.to_string(), value.into_owned())
@@ -179,7 +201,7 @@ fn parse_parameters(url: &Url) -> XrayResult<HashMap<String, String>> {
      return Err(XrayError::DuplicateParameter(name.into_owned()));
    }
  }
-  Ok(parameters)
+  Ok((parameters, unsupported))
 }

 fn required_parameter<'a>(
@@ -230,6 +252,109 @@ mod tests {

  const ID: &str = "6d6e21a1-4829-4d2b-bc7f-1b25707b61e4";

+  /// Donut accepts exactly one VLESS shape, so most rejections mean "your
+  /// server is a kind we do not support" rather than "you mistyped". These pin
+  /// the reason each rejection reports, because the UI turns it into the one
+  /// sentence that tells a user with a working WebSocket or plain-TLS server
+  /// why Donut will not take it.
+  #[test]
+  fn unsupported_setups_report_which_part_is_unsupported() {
+    let good = format!(
+      "vless://{ID}@example.com:443?security=reality&flow=xtls-rprx-vision\
+&encryption=none&type=tcp&sni=a.com&pbk=mQB9jxUDHO7g49VaNXLEdcNQ_jLhTbLolUsMUNwb6W4&sid=00&fp=chrome"
+    );
+    assert!(parse_vless_uri(&good).is_ok(), "baseline URI must parse");
+
+    let reason = |uri: &str| parse_vless_uri(uri).unwrap_err().reason_code();
+
+    // Plain TLS instead of REALITY — the most common real-world setup.
+    assert_eq!(
+      reason(&good.replace("security=reality", "security=tls")),
+      "security"
+    );
+    assert_eq!(
+      reason(&good.replace("flow=xtls-rprx-vision", "flow=none")),
+      "flow"
+    );
+    // WebSocket / gRPC transports.
+    assert_eq!(reason(&good.replace("type=tcp", "type=ws")), "transport");
+    assert_eq!(reason(&good.replace("type=tcp", "type=grpc")), "transport");
+    assert_eq!(reason(&good.replace("&sni=a.com", "")), "sni");
+    assert_eq!(
+      reason(&good.replace("&pbk=mQB9jxUDHO7g49VaNXLEdcNQ_jLhTbLolUsMUNwb6W4", "")),
+      "publicKey"
+    );
+    assert_eq!(reason(&good.replace("vless://", "vmess://")), "scheme");
+    assert_eq!(reason("not a uri"), "malformed");
+  }
+
+  /// The URIs users actually paste, not canonical-REALITY-with-one-field-changed.
+  ///
+  /// A real WebSocket link carries `path` (and usually `host`); a gRPC link
+  /// carries `serviceName`. Those keys are not in SUPPORTED_PARAMETERS, so
+  /// before the shape was checked first they produced "unsupported option"
+  /// and sent the user deleting query parameters instead of telling them
+  /// Donut only speaks plain TCP.
+  #[test]
+  fn a_display_name_survives_an_export_parse_round_trip() {
+    // Percent signs are legal in a fragment, so they used to pass through
+    // unencoded and then get decoded on the way back in — "50% off" became
+    // "50 off"-ish and drifted further on every canonicalizing save.
+    for name in ["50% off", "a#b", "spaced name", "100%25", "üñî"] {
+      let parsed = parse_vless_uri(&format!(
+        "vless://{ID}@example.com:443?security=reality&flow=xtls-rprx-vision\
+&encryption=none&type=tcp&sni=a.com&pbk=mQB9jxUDHO7g49VaNXLEdcNQ_jLhTbLolUsMUNwb6W4"
+      ))
+      .expect("baseline parses");
+
+      let exported = export_vless_uri(&parsed.config, Some(name)).expect("exports");
+      let reparsed = parse_vless_uri(&exported).expect("re-parses");
+      assert_eq!(
+        reparsed.name.as_deref(),
+        Some(name),
+        "display name mutated across a round trip: {exported}"
+      );
+
+      // And a second round trip must be a fixed point, not drift again.
+      let exported_again =
+        export_vless_uri(&reparsed.config, reparsed.name.as_deref()).expect("re-exports");
+      assert_eq!(exported, exported_again);
+    }
+  }
+
+  #[test]
+  fn real_world_websocket_and_grpc_links_name_the_transport() {
+    let ws = format!(
+      "vless://{ID}@cdn.example.com:443?encryption=none&security=tls&type=ws\
+&path=%2Fray&host=cdn.example.com&sni=cdn.example.com#WS%20node"
+    );
+    assert_eq!(
+      parse_vless_uri(&ws).unwrap_err().reason_code(),
+      "transport",
+      "a WebSocket link must be told its transport is unsupported"
+    );
+
+    let grpc = format!(
+      "vless://{ID}@grpc.example.com:443?encryption=none&security=reality&type=grpc\
+&serviceName=gun&sni=a.com&pbk=mQB9jxUDHO7g49VaNXLEdcNQ_jLhTbLolUsMUNwb6W4"
+    );
+    assert_eq!(
+      parse_vless_uri(&grpc).unwrap_err().reason_code(),
+      "transport"
+    );
+
+    // A genuinely unknown option on an otherwise-supported URI still reports
+    // as a parameter problem, which is the accurate answer there.
+    let odd = format!(
+      "vless://{ID}@example.com:443?security=reality&flow=xtls-rprx-vision\
+&encryption=none&type=tcp&sni=a.com&pbk=mQB9jxUDHO7g49VaNXLEdcNQ_jLhTbLolUsMUNwb6W4&madeUpKey=1"
+    );
+    assert_eq!(
+      parse_vless_uri(&odd).unwrap_err().reason_code(),
+      "parameter"
+    );
+  }
+
  fn public_key() -> String {
    URL_SAFE_NO_PAD.encode([7_u8; 32])
  }
@@ -165,7 +165,7 @@ pub async fn start_xray_worker(
 ) -> Result<XrayWorkerConfig, Box<dyn std::error::Error>> {
  let _start_guard = XRAY_START_LOCK.lock().await;
  parse_vless_uri(vless_uri)
-    .map_err(|error| structured_error_with_detail("VLESS_CONFIG_INVALID", error))?;
+    .map_err(|error| -> Box<dyn std::error::Error> { crate::vless_config_error(&error).into() })?;
  crate::proxy_runner::ensure_sidecar_version().await?;
  ensure_xray_binary()?;
  let owner_pid = std::process::id();
@@ -521,14 +521,14 @@ pub async fn run_xray_worker(config_path: &Path) -> Result<(), Box<dyn std::erro
  save_xray_worker_config_to_path(&config, config_path)
    .map_err(|error| structured_error_with_detail("XRAY_START_FAILED", error))?;
  let parsed = parse_vless_uri(&config.vless_uri)
-    .map_err(|error| structured_error_with_detail("VLESS_CONFIG_INVALID", error))?;
+    .map_err(|error| -> Box<dyn std::error::Error> { crate::vless_config_error(&error).into() })?;
  let runtime = XrayClientRuntime {
    listen_port: config.local_port,
    username: config.username.clone(),
    password: config.password.clone(),
  };
  let runtime_json = build_client_config_json(&parsed.config, &runtime)
-    .map_err(|error| structured_error_with_detail("VLESS_CONFIG_INVALID", error))?;
+    .map_err(|error| -> Box<dyn std::error::Error> { crate::vless_config_error(&error).into() })?;
  write_xray_runtime_config(&config.id, runtime_json.as_bytes())
    .map_err(|error| structured_error_with_detail("XRAY_START_FAILED", error))?;
  let runtime_path = crate::xray_worker_storage::xray_runtime_config_path(&config.id);
@@ -182,6 +182,39 @@ fn worker_is_tombstoned(id: &str) -> bool {
  xray_worker_tombstone_path(id).exists()
 }

+/// How long a tombstone has to outlive its worker.
+///
+/// It only has to survive long enough to beat a write already in flight from
+/// the process that owned that id. A day is many orders of magnitude more than
+/// that, and bounds a directory that otherwise gains a file per worker forever.
+const TOMBSTONE_TTL: std::time::Duration = std::time::Duration::from_secs(24 * 60 * 60);
+
+/// Drop tombstones old enough that nothing could still be racing them.
+fn prune_stale_tombstones() {
+  let Ok(entries) = fs::read_dir(crate::proxy_storage::get_storage_dir()) else {
+    return;
+  };
+  for entry in entries.flatten() {
+    let path = entry.path();
+    if path.extension().and_then(|e| e.to_str()) != Some("stopped") {
+      continue;
+    }
+    let aged_out = path
+      .metadata()
+      .and_then(|meta| meta.modified())
+      .map(|modified| {
+        modified
+          .elapsed()
+          .map(|age| age > TOMBSTONE_TTL)
+          .unwrap_or(false)
+      })
+      .unwrap_or(false);
+    if aged_out {
+      let _ = fs::remove_file(&path);
+    }
+  }
+}
+
 pub fn create_xray_worker_log(id: &str) -> std::io::Result<std::fs::File> {
  ensure_private_storage_dir()?;
  if worker_is_tombstoned(id) {
@@ -275,6 +308,8 @@ pub fn delete_xray_worker_config(id: &str) -> bool {
 }

 pub fn list_xray_worker_configs() -> Vec<XrayWorkerConfig> {
+  // Cheap, and this is the one call every sweep already makes.
+  prune_stale_tombstones();
  let storage_dir = crate::proxy_storage::get_storage_dir();
  let Ok(entries) = fs::read_dir(storage_dir) else {
    return Vec::new();
@@ -1,7 +1,7 @@
 {
  "$schema": "https://schema.tauri.app/config/2",
  "productName": "Donut",
-  "version": "0.28.2",
+  "version": "0.29.0",
  "identifier": "com.donutbrowser",
  "build": {
    "beforeDevCommand": "pnpm copy-proxy-binary && pnpm dev",
@@ -13,11 +13,7 @@ import { CloneProfileDialog } from "@/components/clone-profile-dialog";
 import { CloseConfirmDialog } from "@/components/close-confirm-dialog";
 import { CommandPalette } from "@/components/command-palette";
 import { CommercialTrialModal } from "@/components/commercial-trial-modal";
-import {
-  type ConsistencyResult,
-  ConsistencyWarningDialog,
-  isConsistencyWarningSuppressed,
-} from "@/components/consistency-warning-dialog";
+import { CookieBotPage, type CookieBotTab } from "@/components/cookie-bot-page";
 import { CookieCopyDialog } from "@/components/cookie-copy-dialog";
 import { CookieManagementDialog } from "@/components/cookie-management-dialog";
 import { CreateProfileDialog } from "@/components/create-profile-dialog";
@@ -32,6 +28,11 @@ import { ImportProfileDialog } from "@/components/import-profile-dialog";
 import { IntegrationsDialog } from "@/components/integrations-dialog";
 import { ONBOARDING_TOUR } from "@/components/onboarding-provider";
 import { PermissionDialog } from "@/components/permission-dialog";
+import {
+  type GateDecision,
+  type GateFindings,
+  PreLaunchGateDialog,
+} from "@/components/pre-launch-gate-dialog";
 import { ProfilesDataTable } from "@/components/profile-data-table";
 import {
  type PasswordDialogMode,
@@ -55,6 +56,7 @@ import { WindowResizeWarningDialog } from "@/components/window-resize-warning-di
 import { useAppUpdateNotifications } from "@/hooks/use-app-update-notifications";
 import { useCloudAuth } from "@/hooks/use-cloud-auth";
 import { useCommercialTrial } from "@/hooks/use-commercial-trial";
+import { cookieBotScopeFor, useCookieBot } from "@/hooks/use-cookie-bot";
 import { useGroupEvents } from "@/hooks/use-group-events";
 import type { PermissionType } from "@/hooks/use-permissions";
 import { usePermissions } from "@/hooks/use-permissions";
@@ -65,8 +67,8 @@ import { useUpdateNotifications } from "@/hooks/use-update-notifications";
 import { useVersionUpdater } from "@/hooks/use-version-updater";
 import { useVpnEvents } from "@/hooks/use-vpn-events";
 import { useWayfernTerms } from "@/hooks/use-wayfern-terms";
-import { translateBackendError } from "@/lib/backend-errors";
-import { getEntitlements } from "@/lib/entitlements";
+import { parseBackendError, translateBackendError } from "@/lib/backend-errors";
+import { canUseCookieBot, getEntitlements } from "@/lib/entitlements";
 import { MOTION_EASE_OUT } from "@/lib/motion";
 import {
  ONBOARDING_TOUR_CLOSED_EVENT,
@@ -86,7 +88,42 @@ import {
  showSyncProgressToast,
  showToast,
 } from "@/lib/toast-utils";
-import type { BrowserProfile, SyncSettings, WayfernConfig } from "@/types";
+import type {
+  BrowserProfile,
+  ConsistencyResult,
+  PreLaunchChecks,
+  SyncSettings,
+  WayfernConfig,
+} from "@/types";
+
+type GateRequest = {
+  profile: BrowserProfile;
+  findings: GateFindings;
+};
+
+type LaunchResult = {
+  status: "launched" | "cancelled" | "blocked";
+};
+
+/**
+ * Rebuild the mismatch detail the gate dialog renders from a
+ * FINGERPRINT_EXIT_MISMATCH error's params. Every param is a string, because
+ * backend error params always are.
+ */
+function consistencyFromErrorParams(
+  params?: Record<string, string>,
+): ConsistencyResult {
+  return {
+    consistent: false,
+    checked: true,
+    exit_ip: params?.exitIp || null,
+    exit_country_code: params?.exitCountry || null,
+    exit_timezone: params?.exitTimezone || null,
+    fingerprint_timezone: params?.fingerprintTimezone || null,
+    fingerprint_language: params?.fingerprintLanguage || null,
+    mismatches: (params?.mismatches ?? "").split(",").filter(Boolean),
+  };
+}

 type BrowserTypeString = "wayfern";

@@ -250,9 +287,17 @@ export default function Home() {
  const { user: cloudUser } = useCloudAuth();
  const crossOsUnlocked = getEntitlements(cloudUser).crossOsFingerprints;
  // Bulk run/stop is a paid (browser automation) feature, matching the
-  // /v1/profiles/batch/run API gate. Free/starter users see the bulk Run/Stop
+  // /v1/profiles/batch/run API gate. Free/solo users see the bulk Run/Stop
  // actions disabled with a Pro badge.
  const automationUnlocked = getEntitlements(cloudUser).browserAutomation;
+  // The rail needs to show a live run from every page, so the shell subscribes
+  // to the shared cookie-bot store too. It is a module singleton, so this costs
+  // one more listener and no extra request. This is also what starts the event
+  // stream for a user who signs in without restarting the app.
+  const { liveSessions: cookieBotLiveSessions } = useCookieBot(
+    canUseCookieBot(cloudUser),
+    cookieBotScopeFor(cloudUser),
+  );

  const [selfHostedSyncConfigured, setSelfHostedSyncConfigured] =
    useState(false);
@@ -269,7 +314,12 @@ export default function Home() {
    }
  }, [cloudUser]);

-  const syncUnlocked = crossOsUnlocked || selfHostedSyncConfigured;
+  // Cloud sync follows `cloudBackup`, NOT `crossOsFingerprints`. They agreed on
+  // every plan until Solo, which buys 20 cloud backups and deliberately has no
+  // fingerprint editing — so deriving sync from the fingerprint capability put a
+  // Pro badge on the one feature a Solo customer is paying for.
+  const cloudBackupUnlocked = getEntitlements(cloudUser).cloudBackup;
+  const syncUnlocked = cloudBackupUnlocked || selfHostedSyncConfigured;

  const [currentPage, setCurrentPage] = useState<AppPage>("profiles");
  const [accountDialogOpen, setAccountDialogOpen] = useState(false);
@@ -283,6 +333,9 @@ export default function Home() {
  const [integrationsInitialTab, setIntegrationsInitialTab] = useState<
    "api" | "mcp"
  >("api");
+  const [cookieBotDialogOpen, setCookieBotDialogOpen] = useState(false);
+  const [cookieBotInitialTab, setCookieBotInitialTab] =
+    useState<CookieBotTab>("overview");
  const [createProfileDialogOpen, setCreateProfileDialogOpen] = useState(false);
  const [settingsDialogOpen, setSettingsDialogOpen] = useState(false);
  const [integrationsDialogOpen, setIntegrationsDialogOpen] = useState(false);
@@ -352,10 +405,30 @@ export default function Home() {
    useState<BrowserProfile | null>(null);
  const [commandPaletteOpen, setCommandPaletteOpen] = useState(false);
  const [aboutDialogOpen, setAboutDialogOpen] = useState(false);
-  const [consistencyWarning, setConsistencyWarning] = useState<{
-    profile: BrowserProfile;
-    result: ConsistencyResult;
+  // Pre-launch gate. Requests queue instead of overwriting a single resolver:
+  // a bulk run enqueues one per profile, and every waiter must settle or the
+  // Promise.allSettled below it never resolves and the bulk spinner sticks.
+  const gateQueueRef = useRef<
+    Array<{ req: GateRequest; resolve: (decision: GateDecision) => void }>
+  >([]);
+  const [gateState, setGateState] = useState<{
+    req: GateRequest;
+    remaining: number;
  } | null>(null);
+  // Set when the user ticks "apply to the remaining profiles" during a bulk
+  // run, so the rest are answered without prompting again. Scoped to one bulk
+  // run and to the severity it was given for.
+  const blanketGateDecisionRef = useRef<{
+    decision: GateDecision;
+    /// Only auto-answers gates no more severe than the one the user saw. A
+    /// choice made on an extension warning must never silently bypass a hard
+    /// block on a later profile.
+    coversBlocking: boolean;
+    /// Identifies the bulk run, so a single launch started while a bulk run is
+    /// in flight still gets its own dialog.
+    runId: number;
+  } | null>(null);
+  const bulkRunIdRef = useRef(0);
  // Owned by page.tsx so the command palette can request opening the profile
  // info dialog. ProfilesDataTable consumes it through controlled props.
  const [profileInfoDialog, setProfileInfoDialog] =
@@ -379,6 +452,7 @@ export default function Home() {
    setIntegrationsDialogOpen(false);
    setImportProfileDialogOpen(false);
    setAccountDialogOpen(false);
+    setCookieBotDialogOpen(false);

    setCurrentPage(page);
    switch (page) {
@@ -397,6 +471,9 @@ export default function Home() {
      case "groups":
        setGroupManagementDialogOpen(true);
        break;
+      case "cookieBot":
+        setCookieBotDialogOpen(true);
+        break;
      case "integrations":
        setIntegrationsDialogOpen(true);
        break;
@@ -462,6 +539,19 @@ export default function Home() {
        case "goGroups":
          handleRailNavigate("groups");
          break;
+        case "goCookieBot": {
+          // Mod+B: navigate first time; flip overview↔activity while already
+          // there, matching how Mod+I flips the integrations tabs.
+          if (currentPage === "cookieBot") {
+            setCookieBotInitialTab((cur) =>
+              cur === "overview" ? "activity" : "overview",
+            );
+          } else {
+            setCookieBotInitialTab("overview");
+            handleRailNavigate("cookieBot");
+          }
+          break;
+        }
        case "goIntegrations": {
          // Mod+I: flip api↔mcp tab when already on integrations.
          if (currentPage === "integrations") {
@@ -903,8 +993,137 @@ export default function Home() {
    [selectedGroupId, t],
  );

+  // Show the queue's head, and how many are waiting behind it.
+  // The backend gate downgrades to advisory rather than blocking when it
+  // cannot trust its own measurement (a confirmed VPN extension can reroute
+  // traffic away from the proxy it just probed), and for unattended launches.
+  // Without a listener that finding was emitted into the void.
+  useEffect(() => {
+    const unlisten = listen<ConsistencyResult>(
+      "fingerprint-consistency-warning",
+      (event) => {
+        const { exit_timezone, fingerprint_timezone } = event.payload;
+        showErrorToast(t("backendErrors.fingerprintExitMismatch"), {
+          // The cause differs by path (an unverifiable measurement vs an
+          // unattended launch), so state the measurement rather than guess.
+          description:
+            exit_timezone && fingerprint_timezone
+              ? t("consistencyWarning.timezoneDetail", {
+                  exit: exit_timezone,
+                  fingerprint: fingerprint_timezone,
+                })
+              : undefined,
+          id: `fingerprint-mismatch-${exit_timezone ?? "unknown"}`,
+        });
+      },
+    );
+    return () => {
+      void unlisten.then((fn) => {
+        fn();
+      });
+    };
+  }, [t]);
+
+  const syncGateUi = useCallback(() => {
+    const queue = gateQueueRef.current;
+    setGateState(
+      queue.length > 0
+        ? { req: queue[0].req, remaining: queue.length - 1 }
+        : null,
+    );
+  }, []);
+
+  const requestGateDecision = useCallback(
+    (req: GateRequest, runId?: number): Promise<GateDecision> => {
+      const blanket = blanketGateDecisionRef.current;
+      const isBlocking = req.findings.fingerprint !== null;
+      if (
+        blanket &&
+        blanket.runId === runId &&
+        (blanket.coversBlocking || !isBlocking)
+      ) {
+        // A blanket answer covers only whether to launch. The acknowledgements
+        // it carried were about the first profile's specific mismatch and
+        // extensions, and must not be persisted against profiles the user
+        // never saw.
+        return Promise.resolve({
+          ...blanket.decision,
+          ackFingerprint: false,
+          ackExtensionKeys: [],
+        });
+      }
+      return new Promise<GateDecision>((resolve) => {
+        gateQueueRef.current.push({ req, resolve });
+        syncGateUi();
+      });
+    },
+    [syncGateUi],
+  );
+
+  const settleGate = useCallback(
+    (decision: GateDecision) => {
+      const entry = gateQueueRef.current.shift();
+      entry?.resolve(decision);
+      if (decision.applyToRemaining) {
+        const coversBlocking = entry?.req.findings.fingerprint !== null;
+        blanketGateDecisionRef.current = {
+          decision,
+          coversBlocking,
+          runId: bulkRunIdRef.current,
+        };
+        // Drain the queue rather than leaving promises pending forever — but
+        // only those the blanket actually covers. A hard block still deserves
+        // its own dialog even after the user blanket-approved a warning.
+        const remaining = gateQueueRef.current.splice(0);
+        const kept = remaining.filter(
+          (queued) =>
+            !coversBlocking && queued.req.findings.fingerprint !== null,
+        );
+        for (const queued of remaining) {
+          if (kept.includes(queued)) {
+            continue;
+          }
+          queued.resolve({
+            ...decision,
+            ackFingerprint: false,
+            ackExtensionKeys: [],
+          });
+        }
+        gateQueueRef.current = kept;
+      }
+      syncGateUi();
+    },
+    [syncGateUi],
+  );
+
+  const persistGateAcks = useCallback(
+    async (profileId: string, decision: GateDecision) => {
+      // Only on proceed. Cancel is the autofocused default action, so a stray
+      // Enter would otherwise permanently disarm the gate for this profile.
+      if (!decision.proceed) {
+        return;
+      }
+      if (!decision.ackFingerprint && decision.ackExtensionKeys.length === 0) {
+        return;
+      }
+      try {
+        await invoke("ack_launch_gate", {
+          profileId,
+          ackFingerprint: decision.ackFingerprint,
+          ackExtensionKeys: decision.ackExtensionKeys,
+        });
+      } catch (err) {
+        console.warn("Failed to persist launch gate acknowledgement:", err);
+      }
+    },
+    [],
+  );
+
  const launchProfile = useCallback(
-    async (profile: BrowserProfile) => {
+    async (
+      profile: BrowserProfile,
+      opts?: { bulkRunId?: number },
+    ): Promise<LaunchResult> => {
      console.log("Starting launch for profile:", profile.name);

      // Password-protected: must be unlocked before launch
@@ -917,7 +1136,7 @@ export default function Home() {
            pendingLaunchAfterUnlockRef.current = profile;
            setPasswordDialogMode("unlock");
            setPasswordDialogProfile(profile);
-            return;
+            return { status: "cancelled" };
          }
        } catch (err) {
          console.error("Failed to check profile lock state:", err);
@@ -936,7 +1155,7 @@ export default function Home() {
              setWindowResizeWarningOpen(true);
            });
            if (!proceed) {
-              return;
+              return { status: "cancelled" };
            }
          }
        } catch (error) {
@@ -944,30 +1163,106 @@ export default function Home() {
        }
      }

+      // Tier 1: purely local checks — an extension scan and a cached exit
+      // verdict. No network, no worker started, so a profile whose exit is
+      // already known blocks before the launch touches anything.
+      let consentToken: string | null = null;
+      try {
+        // One-shot migration of the old per-profile "don't warn again" flag,
+        // so a user who already dismissed this profile isn't hard-blocked by
+        // the new gate. Granted against the profile's current exit, which is
+        // the mismatch they were looking at when they dismissed it.
+        const legacySkipKey = `consistency-warn-skip-${profile.id}`;
+        if (localStorage.getItem(legacySkipKey) === "1") {
+          await invoke("ack_launch_gate", {
+            profileId: profile.id,
+            ackFingerprint: true,
+            ackExtensionKeys: [],
+          }).catch((err: unknown) => {
+            console.warn("Failed to migrate consistency skip flag:", err);
+          });
+          localStorage.removeItem(legacySkipKey);
+        }
+
+        const checks = await invoke<PreLaunchChecks>(
+          "get_profile_pre_launch_checks",
+          { profileId: profile.id },
+        );
+        const blocked =
+          checks.consistency.checked && !checks.consistency.consistent;
+        if (blocked || checks.vpn_extensions.length > 0) {
+          const decision = await requestGateDecision(
+            {
+              profile,
+              findings: {
+                vpnExtensions: checks.vpn_extensions,
+                scanState: checks.scan_state,
+                fingerprint: blocked ? checks.consistency : null,
+                measurementUnreliable: checks.exit_measurement_unreliable,
+                probePending: checks.exit_probe_pending,
+              },
+            },
+            opts?.bulkRunId,
+          );
+          await persistGateAcks(profile.id, decision);
+          if (!decision.proceed) {
+            return { status: "cancelled" };
+          }
+          consentToken = checks.consent_token;
+        }
+      } catch (err) {
+        // Same posture as the password and window-resize gates: a check that
+        // cannot run must not make profiles unlaunchable.
+        console.warn("Pre-launch checks failed, launching anyway:", err);
+      }
+
      try {
        const result = await invoke<BrowserProfile>("launch_browser_profile", {
          profile,
+          consentToken,
        });
        console.log("Successfully launched profile:", result.name);
-
-        // Non-blocking: after a successful launch, check that the proxy exit
-        // node's timezone/country agrees with the fingerprint. A mismatch is a
-        // strong anti-bot tell even though the real device never leaks.
-        if (profile.proxy_id && !isConsistencyWarningSuppressed(profile.id)) {
-          void invoke<ConsistencyResult>(
-            "check_profile_fingerprint_consistency",
-            { profileId: profile.id },
-          )
-            .then((res) => {
-              if (res.checked && !res.consistent) {
-                setConsistencyWarning({ profile, result: res });
-              }
-            })
-            .catch((e) => {
-              console.warn("Consistency check failed:", e);
-            });
-        }
+        return { status: "launched" };
      } catch (err: unknown) {
+        // Tier 2: the enforcing gate measured the exit mid-launch and stopped
+        // before spawning the browser. Offer the same decision, then retry
+        // exactly once with the token it minted — bounded, so a gate loop is
+        // structurally impossible.
+        const parsed = parseBackendError(err);
+        if (parsed?.code === "FINGERPRINT_EXIT_MISMATCH") {
+          const decision = await requestGateDecision(
+            {
+              profile,
+              findings: {
+                vpnExtensions: [],
+                scanState: "scanned",
+                fingerprint: consistencyFromErrorParams(parsed.params),
+                measurementUnreliable: false,
+                probePending: false,
+              },
+            },
+            opts?.bulkRunId,
+          );
+          await persistGateAcks(profile.id, decision);
+          if (!decision.proceed) {
+            return { status: "cancelled" };
+          }
+          try {
+            await invoke<BrowserProfile>("launch_browser_profile", {
+              profile,
+              consentToken: parsed.params?.token ?? null,
+            });
+            return { status: "launched" };
+          } catch (retryErr: unknown) {
+            showErrorToast(
+              t("errors.launchBrowserFailed", {
+                error: translateBackendError(t, retryErr),
+              }),
+            );
+            return { status: "blocked" };
+          }
+        }
+
        console.error("Failed to launch browser:", err);
        const errorMessage = translateBackendError(t, err);
        showErrorToast(
@@ -976,7 +1271,7 @@ export default function Home() {
        throw err;
      }
    },
-    [t],
+    [persistGateAcks, requestGateDecision, t],
  );

  const handleCloneProfile = useCallback((profile: BrowserProfile) => {
@@ -1173,15 +1468,34 @@ export default function Home() {
  const executeBulkRun = useCallback(
    async (targets: BrowserProfile[]) => {
      setIsBulkActing(true);
+      blanketGateDecisionRef.current = null;
+      bulkRunIdRef.current += 1;
+      const runId = bulkRunIdRef.current;
      try {
-        await Promise.allSettled(targets.map((p) => launchProfile(p)));
+        const results = await Promise.allSettled(
+          targets.map((p) => launchProfile(p, { bulkRunId: runId })),
+        );
+        const stopped = results.filter(
+          (r) => r.status === "fulfilled" && r.value.status !== "launched",
+        ).length;
+        if (stopped > 0) {
+          // Previously a declined launch resolved to undefined, so allSettled
+          // reported success and the user was told nothing.
+          showErrorToast(
+            t("prelaunchGate.cancelledSummary", {
+              cancelled: stopped,
+              total: targets.length,
+            }),
+          );
+        }
        setSelectedProfiles([]);
      } finally {
+        blanketGateDecisionRef.current = null;
        setIsBulkActing(false);
        setPendingBulkAction(null);
      }
    },
-    [launchProfile],
+    [launchProfile, t],
  );

  const executeBulkStop = useCallback(
@@ -1636,6 +1950,7 @@ export default function Home() {
          onOpenAbout={() => {
            setAboutDialogOpen(true);
          }}
+          cookieBotRunning={Object.keys(cookieBotLiveSessions).length > 0}
        />
        <main className="flex min-w-0 flex-1 flex-col overflow-hidden">
          {currentPage === "profiles" && (
@@ -1666,6 +1981,7 @@ export default function Home() {
                isUpdating={isUpdating}
                onDeleteSelectedProfiles={handleDeleteSelectedProfiles}
                onAssignProfilesToGroup={handleAssignProfilesToGroup}
+                onAssignProfilesToProxy={handleAssignProfilesToProxy}
                selectedGroupId={selectedGroupId}
                selectedProfiles={selectedProfiles}
                onSelectedProfilesChange={setSelectedProfiles}
@@ -1786,6 +2102,22 @@ export default function Home() {
            />
          )}

+          {cookieBotDialogOpen && (
+            <CookieBotPage
+              isOpen={cookieBotDialogOpen}
+              onClose={() => {
+                setCookieBotDialogOpen(false);
+                setCurrentPage("profiles");
+              }}
+              subPage={currentPage === "cookieBot"}
+              initialTab={cookieBotInitialTab}
+              profiles={profiles}
+              cloudUser={cloudUser}
+              onOpenProfileSync={handleOpenProfileSyncDialog}
+              onAssignProxy={handleAssignProfilesToProxy}
+            />
+          )}
+
          {accountDialogOpen && (
            <AccountPage
              isOpen={accountDialogOpen}
@@ -1850,14 +2182,13 @@ export default function Home() {
        }}
      />

-      <ConsistencyWarningDialog
-        isOpen={consistencyWarning !== null}
-        onClose={() => {
-          setConsistencyWarning(null);
-        }}
-        profileName={consistencyWarning?.profile.name ?? ""}
-        profileId={consistencyWarning?.profile.id ?? ""}
-        result={consistencyWarning?.result ?? null}
+      <PreLaunchGateDialog
+        isOpen={gateState !== null}
+        profileName={gateState?.req.profile.name ?? ""}
+        profileId={gateState?.req.profile.id ?? ""}
+        findings={gateState?.req.findings ?? null}
+        remainingCount={gateState?.remaining ?? 0}
+        onResult={settleGate}
      />

      {pendingUrls.map((pendingUrl) => (
@@ -11,7 +11,13 @@ import {
  LuRefreshCw,
  LuUser,
 } from "react-icons/lu";
+import {
+  formatDate,
+  formatHours,
+  RemoteHoursMeter,
+} from "@/components/cookie-bot-shared";
 import { LoadingButton } from "@/components/loading-button";
+import { TeamUsagePanel } from "@/components/team-usage-panel";
 import {
  AnimatedTabs,
  AnimatedTabsContent,
@@ -24,8 +30,13 @@ import { Dialog, DialogContent } from "@/components/ui/dialog";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import { useCloudAuth } from "@/hooks/use-cloud-auth";
+import { cookieBotScopeFor, useCookieBot } from "@/hooks/use-cookie-bot";
 import { translateBackendError } from "@/lib/backend-errors";
-import { getEntitlements } from "@/lib/entitlements";
+import {
+  canUseCookieBot,
+  getEntitlements,
+  isTeamOwner,
+} from "@/lib/entitlements";
 import { showErrorToast, showSuccessToast } from "@/lib/toast-utils";
 import { cn } from "@/lib/utils";
 import type { SyncSettings } from "@/types";
@@ -56,6 +67,25 @@ export function AccountPage({
  const [isRefreshing, setIsRefreshing] = useState(false);
  const [isLoggingOut, setIsLoggingOut] = useState(false);

+  // Remote hours are plan truth, so they belong here rather than only next to
+  // the controls that spend them. Until this landed, `remote-sessions/quota`
+  // had no caller anywhere and a customer's first sight of their allowance was
+  // a refused launch.
+  const remoteHoursVisible = isLoggedIn && canUseCookieBot(user);
+  const showTeamUsage = remoteHoursVisible && isTeamOwner(user);
+  const { quota, isLoading: isQuotaLoading } = useCookieBot(
+    remoteHoursVisible,
+    cookieBotScopeFor(user),
+  );
+  const [activeTab, setActiveTab] = useState("account");
+
+  // Signing out (or losing the team) removes the tab while it is the selected
+  // one, which would leave the page showing an empty panel with no trigger to
+  // click back to.
+  useEffect(() => {
+    if (!showTeamUsage && activeTab === "team-usage") setActiveTab("account");
+  }, [showTeamUsage, activeTab]);
+
  // Self-hosted server state. Loaded once when the dialog opens and persisted
  // via `save_sync_settings` so the rest of the app picks up the new URL/token
  // from `SettingsManager`.
@@ -201,11 +231,16 @@ export function AccountPage({
      <DialogContent className="flex max-h-[calc(100vh-5rem)] max-w-3xl flex-col">
        <div className="min-h-0 flex-1 overflow-y-auto">
          <div className={cn(subPage && "mx-auto w-full max-w-4xl")}>
-            <AnimatedTabs defaultValue="account">
+            <AnimatedTabs value={activeTab} onValueChange={setActiveTab}>
              <AnimatedTabsList>
                <AnimatedTabsTrigger value="account">
                  {t("account.tabs.account")}
                </AnimatedTabsTrigger>
+                {showTeamUsage && (
+                  <AnimatedTabsTrigger value="team-usage">
+                    {t("account.tabs.teamUsage")}
+                  </AnimatedTabsTrigger>
+                )}
                <AnimatedTabsTrigger
                  value="self-hosted"
                  disabled={selfHostedDisabled}
@@ -251,6 +286,63 @@ export function AccountPage({
                    </div>
                  </div>

+                  {remoteHoursVisible && (
+                    // A headline block, not one field among six: the allowance
+                    // is the number a customer needs before a launch is
+                    // refused, which is the only way they ever saw it before.
+                    <div className="rounded-md border border-border bg-muted/40 px-3 py-2.5">
+                      <div className="flex items-baseline justify-between gap-3">
+                        <p className="text-[10px] tracking-wide text-muted-foreground uppercase">
+                          {t("cookieBot.hours.label")}
+                        </p>
+                        {formatDate(quota?.period_end) && (
+                          <p className="text-xs tabular-nums text-muted-foreground">
+                            {t("cookieBot.hours.resets", {
+                              date: formatDate(quota?.period_end),
+                            })}
+                          </p>
+                        )}
+                      </div>
+                      <p className="mt-1 text-lg leading-none font-semibold tabular-nums">
+                        {quota ? formatHours(quota.remaining_hours) : "—"}
+                        <span className="ml-1 text-sm font-normal text-muted-foreground">
+                          {t("cookieBot.hours.remainingOf", {
+                            total: quota
+                              ? formatHours(quota.granted_hours)
+                              : "—",
+                          })}
+                        </span>
+                      </p>
+                      <RemoteHoursMeter
+                        quota={quota}
+                        isLoading={isQuotaLoading}
+                        variant="inline"
+                        className="mt-2"
+                      />
+                      <div className="mt-2 flex items-baseline justify-between gap-3">
+                        <p className="text-xs tabular-nums text-muted-foreground">
+                          {t("cookieBot.hours.used", {
+                            used: quota ? formatHours(quota.used_hours) : "—",
+                            total: quota
+                              ? formatHours(quota.granted_hours)
+                              : "—",
+                          })}
+                        </p>
+                        {showTeamUsage && (
+                          <button
+                            type="button"
+                            onClick={() => {
+                              setActiveTab("team-usage");
+                            }}
+                            className="text-xs text-muted-foreground underline underline-offset-2 transition-colors duration-100 hover:text-foreground"
+                          >
+                            {t("account.viewTeamUsage")}
+                          </button>
+                        )}
+                      </div>
+                    </div>
+                  )}
+
                  {isLoggedIn && user && (
                    <div className="grid grid-cols-2 gap-2 text-xs">
                      <div className="rounded-md border border-border bg-muted/40 px-3 py-2">
@@ -362,6 +454,12 @@ export function AccountPage({
                </div>
              </AnimatedTabsContent>

+              {showTeamUsage && (
+                <AnimatedTabsContent value="team-usage" className="mt-4">
+                  <TeamUsagePanel quota={quota} />
+                </AnimatedTabsContent>
+              )}
+
              <AnimatedTabsContent value="self-hosted" className="mt-4">
                {selfHostedDisabled ? (
                  // Defensive: the tab trigger is disabled while the user is
@@ -8,6 +8,7 @@ import {
  LuBadgeInfo,
  LuCircleStop,
  LuCloud,
+  LuCookie,
  LuInfo,
  LuKeyboard,
  LuPlay,
@@ -67,6 +68,7 @@ const ICONS: Record<ShortcutId, React.ComponentType<{ className?: string }>> = {
  goProxies: FiWifi,
  goExtensions: LuPuzzle,
  goGroups: LuUsers,
+  goCookieBot: LuCookie,
  goIntegrations: LuPlug,
  goAccount: LuCloud,
  goSettings: GoGear,
@@ -1,176 +0,0 @@
-"use client";
-
-import { invoke } from "@tauri-apps/api/core";
-import { useState } from "react";
-import { useTranslation } from "react-i18next";
-import { LuTriangleAlert } from "react-icons/lu";
-import { Checkbox } from "@/components/ui/checkbox";
-import {
-  Dialog,
-  DialogContent,
-  DialogHeader,
-  DialogTitle,
-} from "@/components/ui/dialog";
-import { translateBackendError } from "@/lib/backend-errors";
-import { showErrorToast, showSuccessToast } from "@/lib/toast-utils";
-import { RippleButton } from "./ui/ripple";
-
-export interface ConsistencyResult {
-  consistent: boolean;
-  checked: boolean;
-  exit_ip: string | null;
-  exit_country_code: string | null;
-  exit_timezone: string | null;
-  fingerprint_timezone: string | null;
-  fingerprint_language: string | null;
-  mismatches: string[];
-}
-
-const GLOBAL_DISABLE_KEY = "consistency-warn-disabled";
-const perProfileKey = (id: string) => `consistency-warn-skip-${id}`;
-
-export function isConsistencyWarningSuppressed(profileId: string): boolean {
-  try {
-    return (
-      localStorage.getItem(GLOBAL_DISABLE_KEY) === "1" ||
-      localStorage.getItem(perProfileKey(profileId)) === "1"
-    );
-  } catch {
-    return false;
-  }
-}
-
-interface ConsistencyWarningDialogProps {
-  isOpen: boolean;
-  onClose: () => void;
-  profileName: string;
-  profileId: string;
-  result: ConsistencyResult | null;
-}
-
-export function ConsistencyWarningDialog({
-  isOpen,
-  onClose,
-  profileName,
-  profileId,
-  result,
-}: ConsistencyWarningDialogProps) {
-  const { t } = useTranslation();
-  const [dontWarnAgain, setDontWarnAgain] = useState(false);
-  const [isMatching, setIsMatching] = useState(false);
-
-  const handleClose = () => {
-    if (dontWarnAgain) {
-      try {
-        localStorage.setItem(perProfileKey(profileId), "1");
-      } catch {
-        // localStorage unavailable — nothing to persist
-      }
-    }
-    setDontWarnAgain(false);
-    onClose();
-  };
-
-  const mismatches = result?.mismatches ?? [];
-  const exitIp = result?.exit_ip ?? null;
-
-  const handleMatch = async () => {
-    if (!exitIp) {
-      return;
-    }
-    setIsMatching(true);
-    try {
-      await invoke("match_profile_fingerprint_to_exit", {
-        profileId,
-        exitIp,
-      });
-      showSuccessToast(t("consistencyWarning.matchSuccess"));
-      handleClose();
-    } catch (e) {
-      showErrorToast(translateBackendError(t, e));
-    } finally {
-      setIsMatching(false);
-    }
-  };
-
-  return (
-    <Dialog open={isOpen} onOpenChange={handleClose}>
-      <DialogContent className="max-w-md">
-        <DialogHeader>
-          <DialogTitle className="flex items-center gap-2">
-            <LuTriangleAlert className="size-5 text-warning-text" />
-            {t("consistencyWarning.title")}
-          </DialogTitle>
-        </DialogHeader>
-
-        <div className="space-y-3 text-sm">
-          <p className="text-muted-foreground">
-            {t("consistencyWarning.intro", { name: profileName })}
-          </p>
-
-          <div className="space-y-2 rounded-md border border-warning/40 bg-warning/10 p-3">
-            {mismatches.includes("timezone") && (
-              <div>
-                <p className="font-medium">
-                  {t("consistencyWarning.timezoneTitle")}
-                </p>
-                <p className="text-xs text-muted-foreground">
-                  {t("consistencyWarning.timezoneDetail", {
-                    exit: result?.exit_timezone ?? "?",
-                    fingerprint: result?.fingerprint_timezone ?? "?",
-                  })}
-                </p>
-              </div>
-            )}
-            {mismatches.includes("language") && (
-              <div>
-                <p className="font-medium">
-                  {t("consistencyWarning.languageTitle")}
-                </p>
-                <p className="text-xs text-muted-foreground">
-                  {t("consistencyWarning.languageDetail", {
-                    country: result?.exit_country_code ?? "?",
-                    fingerprint: result?.fingerprint_language ?? "?",
-                  })}
-                </p>
-              </div>
-            )}
-          </div>
-
-          <p className="text-xs text-muted-foreground">
-            {t("consistencyWarning.explainer")}
-          </p>
-
-          <label
-            htmlFor="consistency-dont-warn"
-            className="flex cursor-pointer items-center gap-2 text-xs"
-          >
-            <Checkbox
-              id="consistency-dont-warn"
-              checked={dontWarnAgain}
-              onCheckedChange={(v) => setDontWarnAgain(v === true)}
-            />
-            {t("consistencyWarning.dontWarnAgain")}
-          </label>
-        </div>
-
-        <div className="flex justify-end gap-2">
-          <RippleButton
-            variant="outline"
-            onClick={handleClose}
-            disabled={isMatching}
-          >
-            {t("common.buttons.close")}
-          </RippleButton>
-          {exitIp && (
-            <RippleButton onClick={handleMatch} disabled={isMatching}>
-              {isMatching
-                ? t("consistencyWarning.matching")
-                : t("consistencyWarning.matchToProxy")}
-            </RippleButton>
-          )}
-        </div>
-      </DialogContent>
-    </Dialog>
-  );
-}
@@ -0,0 +1,583 @@
+"use client";
+
+import { AnimatePresence, motion, useReducedMotion } from "motion/react";
+import { useCallback, useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { LuSearch } from "react-icons/lu";
+import {
+  formatDateTime,
+  formatDuration,
+  formatElapsed,
+  hasRunCounters,
+  indexProfiles,
+  indexRunsById,
+  indexRunsBySession,
+  outcomeLabel,
+  parseIso,
+  runStatusLabel,
+  runStatusTone,
+  StatusDot,
+  sessionCloseReason,
+  sessionDisplayName,
+  sessionElapsedSeconds,
+  sessionPhaseLabel,
+  sessionTone,
+  useSecondTicker,
+} from "@/components/cookie-bot-shared";
+import { Button } from "@/components/ui/button";
+import { FadingScrollArea } from "@/components/ui/fading-scroll-area";
+import { Input } from "@/components/ui/input";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { Skeleton } from "@/components/ui/skeleton";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "@/components/ui/table";
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/ui/tooltip";
+import { translateBackendError } from "@/lib/backend-errors";
+import { type CookieBotRun, cancelCookieBotRun } from "@/lib/cookie-bot";
+import { MOTION_EASE_OUT } from "@/lib/motion";
+import {
+  type RemoteSessionState,
+  stopRemoteSession,
+} from "@/lib/remote-sessions";
+import { showErrorToast, showSuccessToast } from "@/lib/toast-utils";
+import { cn } from "@/lib/utils";
+import type { BrowserProfile } from "@/types";
+
+export type RunFilter = "all" | "succeeded" | "partial" | "failed";
+
+interface CookieBotActivityProps {
+  live: RemoteSessionState[];
+  streamConnected: boolean;
+  runs: CookieBotRun[];
+  isLoading: boolean;
+  profiles: BrowserProfile[];
+  showOperator: boolean;
+  filter: RunFilter;
+  onFilterChange: (filter: RunFilter) => void;
+  onRefresh: () => void;
+}
+
+export function CookieBotActivity({
+  live,
+  streamConnected,
+  runs,
+  isLoading,
+  profiles,
+  showOperator,
+  filter,
+  onFilterChange,
+  onRefresh,
+}: CookieBotActivityProps) {
+  const { t } = useTranslation();
+  const [search, setSearch] = useState("");
+
+  const profileIndex = useMemo(() => indexProfiles(profiles), [profiles]);
+  const runsBySession = useMemo(() => indexRunsBySession(runs), [runs]);
+  const runsById = useMemo(() => indexRunsById(runs), [runs]);
+
+  const filtered = useMemo(() => {
+    const needle = search.trim().toLowerCase();
+    return runs.filter((run) => {
+      if (filter !== "all" && run.status !== filter) return false;
+      if (!needle) return true;
+      const name = run.profile_name ?? profileIndex.get(run.profile_id)?.name;
+      return (
+        (name ?? "").toLowerCase().includes(needle) ||
+        (run.email ?? "").toLowerCase().includes(needle)
+      );
+    });
+  }, [runs, filter, search, profileIndex]);
+
+  return (
+    <div className="flex min-h-0 flex-1 flex-col gap-3">
+      <LiveSessions
+        live={live}
+        streamConnected={streamConnected}
+        profileIndex={profileIndex}
+        runsBySession={runsBySession}
+        runsById={runsById}
+        onChanged={onRefresh}
+      />
+
+      <div className="flex shrink-0 items-center gap-2">
+        <div className="relative min-w-0 flex-1">
+          <LuSearch className="absolute top-1/2 left-2.5 size-3.5 -translate-y-1/2 text-muted-foreground" />
+          <Input
+            value={search}
+            onChange={(event) => {
+              setSearch(event.target.value);
+            }}
+            className="h-8 pl-8 text-sm"
+            placeholder={t("cookieBot.history.searchPlaceholder")}
+          />
+        </div>
+        <Select
+          value={filter}
+          onValueChange={(value) => {
+            onFilterChange(value as RunFilter);
+          }}
+        >
+          <SelectTrigger className="h-8 w-[150px]">
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem value="all">
+              {t("cookieBot.history.filterAll")}
+            </SelectItem>
+            <SelectItem value="succeeded">
+              {t("cookieBot.history.filterComplete")}
+            </SelectItem>
+            <SelectItem value="partial">
+              {t("cookieBot.history.filterPartial")}
+            </SelectItem>
+            <SelectItem value="failed">
+              {t("cookieBot.history.filterFailed")}
+            </SelectItem>
+          </SelectContent>
+        </Select>
+      </div>
+
+      <FadingScrollArea
+        className="min-h-0 flex-1"
+        style={{ "--scroll-fade-top-offset": "32px" } as React.CSSProperties}
+      >
+        <Table
+          className="w-full table-fixed"
+          containerClassName="overflow-visible"
+        >
+          <TableHeader className="sticky top-0 z-10 bg-background">
+            <TableRow>
+              <TableHead className="w-40">
+                {t("cookieBot.history.columnStarted")}
+              </TableHead>
+              <TableHead className="max-w-0">
+                {t("cookieBot.history.columnProfile")}
+              </TableHead>
+              <TableHead className="hidden w-24 @2xl:table-cell">
+                {t("cookieBot.history.columnDuration")}
+              </TableHead>
+              <TableHead className="hidden w-20 text-right @3xl:table-cell">
+                {t("cookieBot.history.columnSites")}
+              </TableHead>
+              <TableHead className="w-32">
+                {t("cookieBot.history.columnStatus")}
+              </TableHead>
+              {showOperator && (
+                <TableHead className="hidden max-w-0 @4xl:table-cell">
+                  {t("cookieBot.history.columnOperator")}
+                </TableHead>
+              )}
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {isLoading && runs.length === 0 ? (
+              Array.from({ length: 6 }, (_, i) => (
+                <TableRow key={`skeleton-${i}`}>
+                  <TableCell colSpan={showOperator ? 6 : 5}>
+                    <div className="flex items-center gap-3">
+                      <Skeleton className="h-3 w-28" />
+                      <Skeleton
+                        className="h-3"
+                        style={{ width: `${30 + ((i * 17) % 40)}%` }}
+                      />
+                      <div className="flex-1" />
+                      <Skeleton className="h-3 w-16" />
+                      <Skeleton className="h-3 w-10" />
+                    </div>
+                  </TableCell>
+                </TableRow>
+              ))
+            ) : filtered.length === 0 ? (
+              <TableRow className="border-0! hover:bg-transparent">
+                <TableCell colSpan={showOperator ? 6 : 5} className="py-16">
+                  <p className="text-center text-sm text-muted-foreground">
+                    {runs.length === 0
+                      ? t("cookieBot.history.empty")
+                      : t("cookieBot.history.noMatch")}
+                  </p>
+                </TableCell>
+              </TableRow>
+            ) : (
+              filtered.map((run) => (
+                <RunRow
+                  key={run.id}
+                  run={run}
+                  profileName={
+                    run.profile_name ??
+                    profileIndex.get(run.profile_id)?.name ??
+                    null
+                  }
+                  showOperator={showOperator}
+                />
+              ))
+            )}
+          </TableBody>
+        </Table>
+      </FadingScrollArea>
+    </div>
+  );
+}
+
+function RunRow({
+  run,
+  profileName,
+  showOperator,
+}: {
+  run: CookieBotRun;
+  profileName: string | null;
+  showOperator: boolean;
+}) {
+  const { t } = useTranslation();
+  const [expanded, setExpanded] = useState(false);
+  const reduceMotion = useReducedMotion();
+
+  const started = parseIso(run.started_at);
+  const ended = parseIso(run.ended_at);
+  const durationSeconds =
+    started && ended
+      ? Math.max(0, Math.floor((ended.getTime() - started.getTime()) / 1000))
+      : run.billed_seconds > 0
+        ? run.billed_seconds
+        : null;
+
+  const countersKnown = hasRunCounters(run);
+  const hasDetail = Boolean(run.outcome_code) || run.sites_failed > 0;
+
+  return (
+    <>
+      <TableRow
+        className={cn("hover:bg-muted/30", hasDetail && "cursor-pointer")}
+        onClick={() => {
+          if (hasDetail) setExpanded((open) => !open);
+        }}
+      >
+        <TableCell className="tabular-nums text-muted-foreground">
+          {formatDateTime(run.started_at ?? run.scheduled_for) ?? "—"}
+        </TableCell>
+        <TableCell className="max-w-0 truncate">
+          {profileName ?? t("cookieBot.history.unknownProfile")}
+        </TableCell>
+        <TableCell className="hidden tabular-nums @2xl:table-cell">
+          {durationSeconds === null ? "—" : formatDuration(t, durationSeconds)}
+        </TableCell>
+        {/* An em dash, not a confident `0/12`: the counters are not written
+            until the fleet's figures are ingested, and printing the column
+            default as a fact tells a paying user their run did nothing. */}
+        <TableCell className="hidden text-right tabular-nums text-muted-foreground @3xl:table-cell">
+          {!countersKnown ? (
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <span className="cursor-default">—</span>
+              </TooltipTrigger>
+              <TooltipContent>
+                {t("cookieBot.history.sitesUnknown")}
+              </TooltipContent>
+            </Tooltip>
+          ) : run.sites_total > 0 ? (
+            `${run.sites_visited}/${run.sites_total}`
+          ) : (
+            String(run.sites_visited)
+          )}
+        </TableCell>
+        <TableCell>
+          <span className="flex items-center gap-2 text-xs">
+            <StatusDot tone={runStatusTone(run.status)} />
+            {runStatusLabel(t, run.status)}
+          </span>
+        </TableCell>
+        {showOperator && (
+          <TableCell className="hidden max-w-0 truncate text-muted-foreground @4xl:table-cell">
+            {run.email ?? "—"}
+          </TableCell>
+        )}
+      </TableRow>
+      {hasDetail && (
+        <TableRow className="border-0! hover:bg-transparent">
+          <TableCell
+            colSpan={showOperator ? 6 : 5}
+            className={cn("p-0", !expanded && "border-0!")}
+          >
+            <AnimatePresence initial={false}>
+              {expanded && (
+                <motion.div
+                  initial={{ opacity: 0, y: reduceMotion ? 0 : -4 }}
+                  animate={{ opacity: 1, y: 0 }}
+                  exit={{ opacity: 0, y: reduceMotion ? 0 : -4 }}
+                  transition={{
+                    duration: reduceMotion ? 0.15 : 0.16,
+                    ease: MOTION_EASE_OUT,
+                  }}
+                  className="flex flex-col gap-1 px-2 pb-3 text-xs text-muted-foreground"
+                >
+                  {run.outcome_code && (
+                    <span>
+                      {t("cookieBot.history.outcome", {
+                        reason: outcomeLabel(t, run.outcome_code) ?? "",
+                      })}
+                    </span>
+                  )}
+                  {run.sites_failed > 0 && (
+                    <span>
+                      {t("cookieBot.history.sitesFailed", {
+                        count: run.sites_failed,
+                      })}
+                    </span>
+                  )}
+                  {run.consent_dismissed > 0 && (
+                    <span>
+                      {t("cookieBot.history.consentHandled", {
+                        count: run.consent_dismissed,
+                      })}
+                    </span>
+                  )}
+                </motion.div>
+              )}
+            </AnimatePresence>
+          </TableCell>
+        </TableRow>
+      )}
+    </>
+  );
+}
+
+/* -------------------------------------------------------------------------- */
+/* Live                                                                       */
+/* -------------------------------------------------------------------------- */
+
+function LiveSessions({
+  live,
+  streamConnected,
+  profileIndex,
+  runsBySession,
+  runsById,
+  onChanged,
+}: {
+  live: RemoteSessionState[];
+  streamConnected: boolean;
+  profileIndex: Map<string, BrowserProfile>;
+  runsBySession: Map<string, CookieBotRun>;
+  runsById: Map<string, CookieBotRun>;
+  onChanged: () => void;
+}) {
+  const { t } = useTranslation();
+  const now = useSecondTicker(live.length > 0);
+
+  if (live.length === 0) {
+    return (
+      <div className="flex shrink-0 items-center gap-2 rounded-md border border-border bg-card px-3 py-2.5">
+        <StatusDot tone="muted" />
+        <span className="text-sm text-muted-foreground">
+          {streamConnected
+            ? t("cookieBot.live.idle")
+            : t("cookieBot.live.streamOffline")}
+        </span>
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex shrink-0 flex-col gap-2">
+      {!streamConnected && (
+        <p className="text-xs text-warning-text">
+          {t("cookieBot.live.streamOfflineDetail")}
+        </p>
+      )}
+      {live.map((session) => (
+        <LiveSessionRow
+          key={session.session_id}
+          session={session}
+          now={now}
+          name={sessionDisplayName(
+            session,
+            profileIndex,
+            session.run_id
+              ? runsById.get(session.run_id)
+              : runsBySession.get(session.session_id),
+          )}
+          run={
+            session.run_id
+              ? runsById.get(session.run_id)
+              : runsBySession.get(session.session_id)
+          }
+          onChanged={onChanged}
+        />
+      ))}
+    </div>
+  );
+}
+
+function LiveSessionRow({
+  session,
+  now,
+  name,
+  run,
+  onChanged,
+}: {
+  session: RemoteSessionState;
+  now: number;
+  name: string | null;
+  run: CookieBotRun | undefined;
+  onChanged: () => void;
+}) {
+  const { t } = useTranslation();
+  const reduceMotion = useReducedMotion();
+  const [isStopping, setIsStopping] = useState(false);
+
+  const elapsed = sessionElapsedSeconds(session, now);
+  const phase = sessionPhaseLabel(t, session);
+  const tone = sessionTone(session);
+  const closeReason = sessionCloseReason(t, session);
+  // Only once the backend has actually written a counter. Until then the bar
+  // sat at zero for the whole run and read as "nothing is happening".
+  const countersKnown = run ? hasRunCounters(run) : false;
+  const total = run?.sites_total ?? 0;
+  const visited = run?.sites_visited ?? 0;
+  const progress =
+    countersKnown && total > 0 ? Math.min(1, visited / total) : null;
+  // A night longer than one session's cap is split into chunks, and the run row
+  // is the only place that can say which one is running. `chunk_index` counts
+  // chunks STARTED — the server bumps it as it launches each one and treats 0
+  // as "never got going" — so it already reads as a 1-based position and must
+  // not be incremented again.
+  const chunks =
+    run && run.chunks_total > 1 && run.chunk_index > 0
+      ? t("cookieBot.live.chunk", {
+          index: Math.min(run.chunk_index, run.chunks_total),
+          total: run.chunks_total,
+        })
+      : null;
+
+  const stop = useCallback(async () => {
+    setIsStopping(true);
+    try {
+      if (session.run_id) {
+        await cancelCookieBotRun(session.run_id);
+      } else {
+        await stopRemoteSession(session.session_id);
+      }
+      showSuccessToast(t("cookieBot.running.stopped"));
+      onChanged();
+    } catch (error) {
+      showErrorToast(translateBackendError(t, error));
+    } finally {
+      setIsStopping(false);
+    }
+  }, [session.run_id, session.session_id, onChanged, t]);
+
+  return (
+    <div className="flex flex-col gap-2 rounded-md border border-border bg-card px-3 py-2.5">
+      <div className="flex flex-wrap items-center gap-x-3 gap-y-1">
+        <StatusDot tone={tone} pulse={session.state === "provisioning"} />
+        <span className="min-w-0 flex-1 truncate text-sm font-medium text-foreground">
+          {name ?? t("cookieBot.live.unnamedSession")}
+        </span>
+
+        {/* The phase swaps in place: the words change, the row does not move.
+            The slot is a fixed width so the elapsed clock beside it never
+            shifts, and the entering label starts at 0.55 rather than 0 — if
+            the animation never runs, the single most important live signal on
+            the screen is still legible. */}
+        <span className="w-36 shrink-0 text-right">
+          <AnimatePresence mode="wait" initial={false}>
+            <motion.span
+              key={phase}
+              initial={{ opacity: reduceMotion ? 1 : 0.55 }}
+              animate={{ opacity: 1 }}
+              exit={{ opacity: 0 }}
+              transition={{ duration: reduceMotion ? 0.01 : 0.12 }}
+              className="block truncate text-xs text-muted-foreground"
+            >
+              {phase}
+            </motion.span>
+          </AnimatePresence>
+        </span>
+
+        <span className="shrink-0 text-xs tabular-nums text-foreground">
+          {elapsed === null ? (
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <span className="cursor-default text-muted-foreground">—</span>
+              </TooltipTrigger>
+              <TooltipContent>
+                {t("cookieBot.live.notStartedYet")}
+              </TooltipContent>
+            </Tooltip>
+          ) : (
+            formatElapsed(elapsed)
+          )}
+        </span>
+
+        <Button
+          variant="outline"
+          size="sm"
+          className="h-7 shrink-0 text-xs"
+          disabled={isStopping}
+          onClick={() => {
+            void stop();
+          }}
+        >
+          {t("cookieBot.running.stop")}
+        </Button>
+      </div>
+
+      <div className="flex flex-wrap items-center gap-x-4 gap-y-1 text-xs text-muted-foreground">
+        <span className="tabular-nums">
+          {countersKnown && total > 0
+            ? t("cookieBot.live.sitesProgress", { visited, total })
+            : t("cookieBot.live.sitesUnknown")}
+        </span>
+        <span className="tabular-nums">
+          {countersKnown && run
+            ? t("cookieBot.live.consentHandled", {
+                count: run.consent_dismissed,
+              })
+            : t("cookieBot.live.consentUnknown")}
+        </span>
+        <span className="tabular-nums">
+          {session.billed_seconds !== null &&
+          session.billed_seconds !== undefined
+            ? t("cookieBot.live.billed", {
+                duration: formatElapsed(session.billed_seconds),
+              })
+            : t("cookieBot.live.billedUnknown")}
+        </span>
+        {chunks && <span className="tabular-nums">{chunks}</span>}
+        {closeReason && (
+          <span className="text-destructive-text">{closeReason}</span>
+        )}
+      </div>
+
+      {progress !== null && (
+        <div className="h-1 overflow-hidden rounded-full bg-muted">
+          <motion.div
+            initial={false}
+            animate={{ scaleX: progress }}
+            transition={
+              reduceMotion
+                ? { duration: 0 }
+                : { duration: 0.22, ease: MOTION_EASE_OUT }
+            }
+            style={{ transformOrigin: "left", willChange: "transform" }}
+            className="h-full w-full bg-success"
+          />
+        </div>
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,575 @@
+"use client";
+
+import { AnimatePresence, motion, useReducedMotion } from "motion/react";
+import { useMemo } from "react";
+import { useTranslation } from "react-i18next";
+import { LuCookie, LuPencil, LuTrash2 } from "react-icons/lu";
+import {
+  Area,
+  AreaChart,
+  CartesianGrid,
+  Tooltip as ChartTooltip,
+  ResponsiveContainer,
+  XAxis,
+  YAxis,
+} from "recharts";
+import type { RunFilter } from "@/components/cookie-bot-activity";
+import {
+  describeCadence,
+  formatDate,
+  formatDateTime,
+  minutesToClock,
+  parseIso,
+  StatusDot,
+  scheduleBlockedReason,
+  scheduleTone,
+  sessionDisplayName,
+  sessionPhaseLabel,
+  sessionTone,
+  useNextDue,
+} from "@/components/cookie-bot-shared";
+import { Button } from "@/components/ui/button";
+import { FadingScrollArea } from "@/components/ui/fading-scroll-area";
+import { RippleButton } from "@/components/ui/ripple";
+import { Skeleton } from "@/components/ui/skeleton";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "@/components/ui/table";
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/ui/tooltip";
+import type {
+  CookieBotRun,
+  CookieBotSchedule,
+  RemoteHoursQuota,
+} from "@/lib/cookie-bot";
+import type { RemoteSessionState } from "@/lib/remote-sessions";
+import { cn } from "@/lib/utils";
+import type { BrowserProfile } from "@/types";
+
+const CHART_NIGHTS = 30;
+
+interface CookieBotOverviewProps {
+  schedules: CookieBotSchedule[];
+  runs: CookieBotRun[];
+  live: RemoteSessionState[];
+  quota: RemoteHoursQuota | null;
+  profiles: BrowserProfile[];
+  isLoading: boolean;
+  currentUserId: string | null;
+  onEnrol: () => void;
+  onEditSchedule: (schedule: CookieBotSchedule) => void;
+  onRemoveSchedule: (schedule: CookieBotSchedule) => void;
+  onJumpToActivity: (filter: RunFilter) => void;
+}
+
+export function CookieBotOverview({
+  schedules,
+  runs,
+  live,
+  quota,
+  profiles,
+  isLoading,
+  currentUserId,
+  onEnrol,
+  onEditSchedule,
+  onRemoveSchedule,
+  onJumpToActivity,
+}: CookieBotOverviewProps) {
+  const { t } = useTranslation();
+  const { next, nextAt, dueCount } = useNextDue(schedules);
+  const profileIndex = useMemo(
+    () => new Map(profiles.map((p) => [p.id, p])),
+    [profiles],
+  );
+
+  const recent = useMemo(() => summariseRecent(runs), [runs]);
+  const chartData = useMemo(() => nightlyMinutes(runs), [runs]);
+  const exhausted =
+    quota !== null && quota.granted_hours > 0 && quota.remaining_hours <= 0;
+  const resetDate = formatDate(quota?.period_end);
+
+  if (!isLoading && schedules.length === 0) {
+    return (
+      <div className="flex min-h-0 flex-1 flex-col items-center justify-center gap-3 py-16 text-center">
+        <LuCookie className="size-12 text-muted-foreground" />
+        <div>
+          <p className="text-sm font-medium text-foreground">
+            {t("cookieBot.empty.title")}
+          </p>
+          <p className="mt-1 max-w-md text-xs text-muted-foreground">
+            {t("cookieBot.empty.hint")}
+          </p>
+        </div>
+        <RippleButton size="sm" onClick={onEnrol}>
+          {t("cookieBot.empty.cta")}
+        </RippleButton>
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex min-h-0 flex-1 flex-col gap-3">
+      <TonightStrip
+        live={live}
+        nextAt={nextAt}
+        nextMinute={next?.run_at_minute ?? null}
+        dueCount={dueCount}
+        profileIndex={profileIndex}
+      />
+
+      {exhausted && (
+        <div className="shrink-0 rounded-md border border-warning/50 bg-warning/10 px-3 py-2 text-xs text-warning-text">
+          {resetDate
+            ? t("cookieBot.hours.exhaustedOn", { date: resetDate })
+            : t("cookieBot.hours.exhausted")}
+        </div>
+      )}
+
+      <div className="flex shrink-0 flex-wrap items-center gap-x-3 gap-y-1 text-xs">
+        <span className="text-muted-foreground">
+          {t("cookieBot.lastDay.label")}
+        </span>
+        {recent.total === 0 ? (
+          <span className="text-muted-foreground">
+            {t("cookieBot.lastDay.none")}
+          </span>
+        ) : (
+          <>
+            <RecentSegment
+              label={t("cookieBot.lastDay.ran", { count: recent.succeeded })}
+              tone="text-foreground"
+              onClick={() => {
+                onJumpToActivity("succeeded");
+              }}
+            />
+            {recent.partial > 0 && (
+              <RecentSegment
+                label={t("cookieBot.lastDay.partial", {
+                  count: recent.partial,
+                })}
+                tone="text-warning-text"
+                onClick={() => {
+                  onJumpToActivity("partial");
+                }}
+              />
+            )}
+            {recent.failed > 0 && (
+              <RecentSegment
+                label={t("cookieBot.lastDay.failed", { count: recent.failed })}
+                tone="text-destructive-text"
+                onClick={() => {
+                  onJumpToActivity("failed");
+                }}
+              />
+            )}
+          </>
+        )}
+      </div>
+
+      <div className="shrink-0">
+        <p className="mb-1 text-xs font-medium text-foreground">
+          {t("cookieBot.chart.machineTime")}
+        </p>
+        <div className="h-[clamp(140px,20vh,260px)] w-full">
+          {isLoading && runs.length === 0 ? (
+            <Skeleton className="size-full" />
+          ) : (
+            <ResponsiveContainer
+              width="100%"
+              height="100%"
+              minWidth={1}
+              minHeight={1}
+            >
+              <AreaChart
+                data={chartData}
+                margin={{ top: 6, right: 8, bottom: 0, left: 0 }}
+              >
+                <defs>
+                  <linearGradient
+                    id="cookieBotMinutesGradient"
+                    x1="0"
+                    y1="0"
+                    x2="0"
+                    y2="1"
+                  >
+                    <stop
+                      offset="0%"
+                      stopColor="var(--chart-1)"
+                      stopOpacity={0.5}
+                    />
+                    <stop
+                      offset="100%"
+                      stopColor="var(--chart-1)"
+                      stopOpacity={0.1}
+                    />
+                  </linearGradient>
+                </defs>
+                <CartesianGrid strokeDasharray="3 3" className="stroke-muted" />
+                <XAxis
+                  dataKey="label"
+                  className="text-xs"
+                  tick={{ fill: "var(--muted-foreground)" }}
+                  minTickGap={24}
+                />
+                <YAxis
+                  className="text-xs"
+                  tick={{ fill: "var(--muted-foreground)" }}
+                  width={36}
+                />
+                <ChartTooltip
+                  content={({ active, payload, label }) => {
+                    if (!active || !payload?.length) return null;
+                    const minutes = Number(payload[0]?.value ?? 0);
+                    return (
+                      <div className="rounded-lg border bg-popover px-3 py-2 shadow-lg">
+                        <p className="text-xs font-medium text-popover-foreground">
+                          {String(label)}
+                        </p>
+                        <p className="text-xs tabular-nums text-muted-foreground">
+                          {t("cookieBot.chart.minutes", { minutes })}
+                        </p>
+                      </div>
+                    );
+                  }}
+                />
+                <Area
+                  type="monotone"
+                  dataKey="minutes"
+                  stroke="var(--chart-1)"
+                  fill="url(#cookieBotMinutesGradient)"
+                  strokeWidth={1.5}
+                  isAnimationActive={false}
+                />
+              </AreaChart>
+            </ResponsiveContainer>
+          )}
+        </div>
+      </div>
+
+      <FadingScrollArea
+        className="min-h-0 flex-1"
+        style={{ "--scroll-fade-top-offset": "32px" } as React.CSSProperties}
+      >
+        <Table
+          className="w-full table-fixed"
+          containerClassName="overflow-visible"
+        >
+          <TableHeader className="sticky top-0 z-10 bg-background">
+            <TableRow>
+              <TableHead className="max-w-0">
+                {t("cookieBot.enrolled.columnProfile")}
+              </TableHead>
+              <TableHead className="hidden w-32 @2xl:table-cell">
+                {t("cookieBot.enrolled.columnCadence")}
+              </TableHead>
+              <TableHead className="w-20">
+                {t("cookieBot.enrolled.columnTime")}
+              </TableHead>
+              <TableHead className="hidden w-40 @3xl:table-cell">
+                {t("cookieBot.enrolled.columnNextRun")}
+              </TableHead>
+              <TableHead className="hidden w-40 @4xl:table-cell">
+                {t("cookieBot.enrolled.columnLastRun")}
+              </TableHead>
+              <TableHead className="w-20" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {isLoading && schedules.length === 0
+              ? Array.from({ length: 5 }, (_, i) => (
+                  <TableRow key={`enrolled-skeleton-${i}`}>
+                    <TableCell colSpan={6}>
+                      <div className="flex items-center gap-3">
+                        <Skeleton
+                          className="h-3"
+                          style={{ width: `${30 + ((i * 17) % 40)}%` }}
+                        />
+                        <div className="flex-1" />
+                        <Skeleton className="h-3 w-16" />
+                        <Skeleton className="h-3 w-10" />
+                      </div>
+                    </TableCell>
+                  </TableRow>
+                ))
+              : schedules.map((schedule) => (
+                  <EnrolledRow
+                    key={`${schedule.owner_user_id ?? "me"}-${schedule.profile_id}`}
+                    schedule={schedule}
+                    mine={
+                      !schedule.owner_user_id ||
+                      schedule.owner_user_id === currentUserId
+                    }
+                    exhausted={exhausted}
+                    onEdit={onEditSchedule}
+                    onRemove={onRemoveSchedule}
+                  />
+                ))}
+          </TableBody>
+        </Table>
+      </FadingScrollArea>
+    </div>
+  );
+}
+
+function RecentSegment({
+  label,
+  tone,
+  onClick,
+}: {
+  label: string;
+  tone: string;
+  onClick: () => void;
+}) {
+  return (
+    <button
+      type="button"
+      onClick={onClick}
+      className={cn(
+        "cursor-pointer tabular-nums underline-offset-2 transition-colors duration-100 hover:underline",
+        tone,
+      )}
+    >
+      {label}
+    </button>
+  );
+}
+
+function TonightStrip({
+  live,
+  nextAt,
+  nextMinute,
+  dueCount,
+  profileIndex,
+}: {
+  live: RemoteSessionState[];
+  nextAt: Date | null;
+  nextMinute: number | null;
+  dueCount: number;
+  profileIndex: Map<string, BrowserProfile>;
+}) {
+  const { t } = useTranslation();
+  const reduceMotion = useReducedMotion();
+  const running = live.length > 0;
+
+  return (
+    <div className="flex shrink-0 items-center gap-3 rounded-md border border-border bg-card px-3 py-2.5">
+      <span className="text-[10px] uppercase tracking-wide text-muted-foreground">
+        {running ? t("cookieBot.running.label") : t("cookieBot.tonight.label")}
+      </span>
+      <AnimatePresence mode="wait" initial={false}>
+        <motion.div
+          key={running ? `running-${live.length}` : "idle"}
+          initial={{ opacity: reduceMotion ? 1 : 0.55 }}
+          animate={{ opacity: 1 }}
+          exit={{ opacity: 0 }}
+          transition={{ duration: reduceMotion ? 0.01 : 0.12 }}
+          className="flex min-w-0 flex-1 items-center gap-2"
+        >
+          {running ? (
+            <>
+              <StatusDot
+                tone={sessionTone(live[0])}
+                pulse={live[0].state === "provisioning"}
+              />
+              <span className="min-w-0 truncate text-sm font-medium text-foreground">
+                {sessionDisplayName(live[0], profileIndex, undefined) ??
+                  t("cookieBot.live.unnamedSession")}
+              </span>
+              <span className="shrink-0 text-sm text-muted-foreground">
+                {sessionPhaseLabel(t, live[0])}
+              </span>
+              {live.length > 1 && (
+                <span className="shrink-0 text-xs tabular-nums text-muted-foreground">
+                  {t("cookieBot.running.more", { count: live.length - 1 })}
+                </span>
+              )}
+            </>
+          ) : nextMinute === null ? (
+            <span className="text-sm text-muted-foreground">
+              {t("cookieBot.tonight.nothingScheduled")}
+            </span>
+          ) : (
+            <span className="text-sm tabular-nums text-foreground">
+              {t("cookieBot.tonight.nextRun", {
+                time: minutesToClock(nextMinute),
+              })}
+              {nextAt ? (
+                <Tooltip>
+                  <TooltipTrigger asChild>
+                    <span className="ml-2 cursor-default text-muted-foreground">
+                      {t("cookieBot.tonight.dueCount", { count: dueCount })}
+                    </span>
+                  </TooltipTrigger>
+                  <TooltipContent>
+                    {formatDateTime(nextAt.toISOString()) ?? ""}
+                  </TooltipContent>
+                </Tooltip>
+              ) : (
+                <span className="ml-2 text-muted-foreground">
+                  {t("cookieBot.tonight.dueCount", { count: dueCount })}
+                </span>
+              )}
+            </span>
+          )}
+        </motion.div>
+      </AnimatePresence>
+    </div>
+  );
+}
+
+function EnrolledRow({
+  schedule,
+  mine,
+  exhausted,
+  onEdit,
+  onRemove,
+}: {
+  schedule: CookieBotSchedule;
+  mine: boolean;
+  exhausted: boolean;
+  onEdit: (schedule: CookieBotSchedule) => void;
+  onRemove: (schedule: CookieBotSchedule) => void;
+}) {
+  const { t } = useTranslation();
+  const blocked = scheduleBlockedReason(t, schedule);
+
+  return (
+    <TableRow className="hover:bg-muted/30">
+      <TableCell className="max-w-0 truncate">
+        <span className="flex items-center gap-2">
+          <StatusDot tone={scheduleTone(schedule)} />
+          <span className="min-w-0 truncate">{schedule.profile_name}</span>
+          {!mine && schedule.owner_email && (
+            <span className="shrink-0 text-[10px] uppercase tracking-wide text-muted-foreground">
+              {schedule.owner_email}
+            </span>
+          )}
+        </span>
+      </TableCell>
+      <TableCell className="hidden text-muted-foreground @2xl:table-cell">
+        {describeCadence(t, schedule.days_mask)}
+      </TableCell>
+      <TableCell className="tabular-nums">
+        {minutesToClock(schedule.run_at_minute)}
+      </TableCell>
+      {/* The server publishes why tonight would be refused on every read. A
+          next-run time the enrolment cannot keep is worse than no time. */}
+      <TableCell className="hidden tabular-nums text-muted-foreground @3xl:table-cell">
+        {blocked ? (
+          <span className="text-warning-text">{blocked}</span>
+        ) : exhausted ? (
+          <span className="text-warning-text">
+            {t("cookieBot.enrolled.pausedNoHours")}
+          </span>
+        ) : (
+          (formatDateTime(schedule.next_run_at) ?? "—")
+        )}
+      </TableCell>
+      <TableCell className="hidden tabular-nums text-muted-foreground @4xl:table-cell">
+        {formatDateTime(schedule.last_run_at) ??
+          t("cookieBot.enrolled.neverRun")}
+      </TableCell>
+      <TableCell>
+        <div className="flex items-center justify-end gap-0.5">
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <Button
+                variant="ghost"
+                size="icon"
+                className="size-7"
+                aria-label={t("cookieBot.enrolled.edit")}
+                onClick={() => {
+                  onEdit(schedule);
+                }}
+              >
+                <LuPencil className="size-3.5" />
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent>{t("cookieBot.enrolled.edit")}</TooltipContent>
+          </Tooltip>
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <Button
+                variant="ghost"
+                size="icon"
+                className="size-7 text-destructive-text hover:bg-destructive/10"
+                aria-label={t("cookieBot.schedule.unenrol")}
+                onClick={() => {
+                  onRemove(schedule);
+                }}
+              >
+                <LuTrash2 className="size-3.5" />
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent>{t("cookieBot.schedule.unenrol")}</TooltipContent>
+          </Tooltip>
+        </div>
+      </TableCell>
+    </TableRow>
+  );
+}
+
+/* -------------------------------------------------------------------------- */
+/* Derivations — all of these read run rows the server wrote. Nothing here     */
+/* predicts, estimates or fills in a value the backend did not report.        */
+/* -------------------------------------------------------------------------- */
+
+function summariseRecent(runs: CookieBotRun[]) {
+  const cutoff = Date.now() - 24 * 60 * 60 * 1000;
+  let succeeded = 0;
+  let partial = 0;
+  let failed = 0;
+  let total = 0;
+  for (const run of runs) {
+    const at = parseIso(run.started_at ?? run.scheduled_for);
+    if (!at || at.getTime() < cutoff) continue;
+    total += 1;
+    if (run.status === "succeeded") succeeded += 1;
+    else if (run.status === "partial" || run.status === "skipped") partial += 1;
+    else if (run.status === "failed") failed += 1;
+  }
+  return { succeeded, partial, failed, total };
+}
+
+function nightlyMinutes(runs: CookieBotRun[]) {
+  const buckets = new Map<string, number>();
+  const days: { key: string; label: string }[] = [];
+  const today = new Date();
+  today.setHours(0, 0, 0, 0);
+  for (let i = CHART_NIGHTS - 1; i >= 0; i -= 1) {
+    const day = new Date(today);
+    day.setDate(day.getDate() - i);
+    const key = dayKey(day);
+    buckets.set(key, 0);
+    days.push({
+      key,
+      label: day.toLocaleDateString(undefined, {
+        day: "numeric",
+        month: "short",
+      }),
+    });
+  }
+  for (const run of runs) {
+    const at = parseIso(run.started_at ?? run.scheduled_for);
+    if (!at) continue;
+    const key = dayKey(at);
+    if (!buckets.has(key)) continue;
+    buckets.set(key, (buckets.get(key) ?? 0) + run.billed_seconds / 60);
+  }
+  return days.map(({ key, label }) => ({
+    label,
+    minutes: Math.round(buckets.get(key) ?? 0),
+  }));
+}
+
+function dayKey(date: Date): string {
+  return `${date.getFullYear()}-${date.getMonth() + 1}-${date.getDate()}`;
+}
@@ -0,0 +1,604 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { GoPlus } from "react-icons/go";
+import { LuCookie, LuSearch } from "react-icons/lu";
+import {
+  CookieBotActivity,
+  type RunFilter,
+} from "@/components/cookie-bot-activity";
+import { CookieBotEnrolDialog } from "@/components/cookie-bot-enrol-dialog";
+import { CookieBotOverview } from "@/components/cookie-bot-overview";
+import { CookieBotScheduleTab } from "@/components/cookie-bot-schedule";
+import {
+  preflight,
+  preflightReason,
+  RemoteHoursMeter,
+} from "@/components/cookie-bot-shared";
+import { DeleteConfirmationDialog } from "@/components/delete-confirmation-dialog";
+import { TeamUsagePanel } from "@/components/team-usage-panel";
+import {
+  AnimatedTabs,
+  AnimatedTabsContent,
+  AnimatedTabsList,
+  AnimatedTabsTrigger,
+} from "@/components/ui/animated-tabs";
+import { Button } from "@/components/ui/button";
+import { Checkbox } from "@/components/ui/checkbox";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { FadingScrollArea } from "@/components/ui/fading-scroll-area";
+import { Input } from "@/components/ui/input";
+import { ProBadge } from "@/components/ui/pro-badge";
+import { RippleButton } from "@/components/ui/ripple";
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/ui/tooltip";
+import { cookieBotScopeFor, useCookieBot } from "@/hooks/use-cookie-bot";
+import { translateBackendError } from "@/lib/backend-errors";
+import {
+  type CookieBotRun,
+  type CookieBotSchedule,
+  deleteCookieBotSchedule,
+  getCookieBotRuns,
+} from "@/lib/cookie-bot";
+import { canUseCookieBot, getEntitlements } from "@/lib/entitlements";
+import { showErrorToast, showSuccessToast } from "@/lib/toast-utils";
+import { cn } from "@/lib/utils";
+import type { BrowserProfile, CloudUser } from "@/types";
+
+export type CookieBotTab = "overview" | "schedule" | "activity" | "team";
+
+/** How often the run rows are re-read while something is running. A run's site
+ * counter advances without a session transition, so the stream alone would show
+ * a frozen number for an hour. */
+const LIVE_POLL_MS = 15_000;
+const RUN_PAGE_SIZE = 100;
+
+interface CookieBotPageProps {
+  isOpen: boolean;
+  onClose: () => void;
+  subPage?: boolean;
+  initialTab?: CookieBotTab;
+  profiles: BrowserProfile[];
+  cloudUser: CloudUser | null;
+  /** Opens the profile's sync settings for an end-to-end encrypted profile. */
+  onOpenProfileSync: (profile: BrowserProfile) => void;
+  /** Opens proxy assignment for profiles with no exit node. */
+  onAssignProxy: (profileIds: string[]) => void;
+}
+
+export function CookieBotPage({
+  isOpen,
+  onClose,
+  subPage,
+  initialTab = "overview",
+  profiles,
+  cloudUser,
+  onOpenProfileSync,
+  onAssignProxy,
+}: CookieBotPageProps) {
+  const { t } = useTranslation();
+  const entitlements = getEntitlements(cloudUser);
+  const unlocked = canUseCookieBot(cloudUser);
+  const isTeam = entitlements.teamCollaboration && Boolean(cloudUser?.teamId);
+  const isOwnerOrAdmin =
+    cloudUser?.teamRole === "owner" || cloudUser?.teamRole === "admin";
+  const showTeamTab = isTeam && cloudUser?.teamRole === "owner";
+  const scope = cookieBotScopeFor(cloudUser);
+
+  // Enrolments, the pooled budget and the live sessions all come from the one
+  // shared store the profile table reads, so an edit here moves both at once.
+  //
+  // Enabled is `unlocked`, NOT `isOpen && unlocked`: the store is a module
+  // singleton whose enabled flag is set by whichever consumer's effect ran
+  // last, so a closed page passing `false` would switch the event stream off
+  // underneath the rail and the profile table.
+  const {
+    schedules: schedulesByProfile,
+    liveSessions,
+    quota,
+    isLoading: isStoreLoading,
+    error: storeError,
+    streamConnected,
+    refresh: refreshStore,
+  } = useCookieBot(unlocked, scope);
+
+  const schedules = useMemo(
+    () =>
+      Object.values(schedulesByProfile).sort(
+        (a, b) =>
+          a.run_at_minute - b.run_at_minute ||
+          a.profile_name.localeCompare(b.profile_name),
+      ),
+    [schedulesByProfile],
+  );
+  const live = useMemo(() => Object.values(liveSessions), [liveSessions]);
+  const liveCount = live.length;
+
+  const [activeTab, setActiveTab] = useState<CookieBotTab>(initialTab);
+  const [runs, setRuns] = useState<CookieBotRun[]>([]);
+  const [isLoadingRuns, setIsLoadingRuns] = useState(true);
+  const [runsError, setRunsError] = useState<unknown>(null);
+  const [runFilter, setRunFilter] = useState<RunFilter>("all");
+  const hasLoadedRuns = useRef(false);
+
+  const [pickerOpen, setPickerOpen] = useState(false);
+  const [enrolTargets, setEnrolTargets] = useState<BrowserProfile[]>([]);
+  const [editing, setEditing] = useState<CookieBotSchedule | null>(null);
+  const [enrolOpen, setEnrolOpen] = useState(false);
+  const [pendingRemoval, setPendingRemoval] =
+    useState<CookieBotSchedule | null>(null);
+  const [isRemoving, setIsRemoving] = useState(false);
+
+  const isLoading = isStoreLoading || isLoadingRuns;
+  const loadError: unknown = runsError ?? storeError;
+
+  /**
+   * Runs are the one thing the shared store does not hold: only this page and
+   * the per-profile history read them, and they page. `withSpinner` is false
+   * for every background pass, because swapping a correct table for a skeleton
+   * every fifteen seconds is worse than a row being a few seconds stale.
+   */
+  const loadRuns = useCallback(
+    async (withSpinner: boolean) => {
+      if (withSpinner) setIsLoadingRuns(true);
+      try {
+        const page = await getCookieBotRuns({ scope, limit: RUN_PAGE_SIZE });
+        setRuns(page.runs);
+        setRunsError(null);
+      } catch (error) {
+        // A background refresh that fails leaves the previous rows on screen.
+        if (withSpinner) setRunsError(error);
+      } finally {
+        if (withSpinner) setIsLoadingRuns(false);
+      }
+    },
+    [scope],
+  );
+
+  const reload = useCallback(() => {
+    void refreshStore();
+    void loadRuns(true);
+  }, [refreshStore, loadRuns]);
+
+  useEffect(() => {
+    setActiveTab(initialTab);
+  }, [initialTab]);
+
+  useEffect(() => {
+    if (!isOpen || !unlocked) {
+      hasLoadedRuns.current = false;
+      return;
+    }
+    // The first pass shows a skeleton. Every later pass — a session appearing
+    // or closing, or the poll below — swaps rows in silently. Both matter: the
+    // live set changing means a run row moved, and a run's site counter
+    // advances with no session transition at all.
+    const first = !hasLoadedRuns.current;
+    hasLoadedRuns.current = true;
+    void loadRuns(first);
+
+    if (liveCount === 0) return;
+    const id = window.setInterval(() => {
+      void loadRuns(false);
+    }, LIVE_POLL_MS);
+    return () => {
+      window.clearInterval(id);
+    };
+  }, [isOpen, unlocked, liveCount, loadRuns]);
+
+  const enrolledIds = useMemo(
+    () => new Set(Object.keys(schedulesByProfile)),
+    [schedulesByProfile],
+  );
+
+  const openEnrolFor = useCallback(
+    (targets: BrowserProfile[], schedule: CookieBotSchedule | null) => {
+      if (targets.length === 0) return;
+      setEnrolTargets(targets);
+      setEditing(schedule);
+      setEnrolOpen(true);
+    },
+    [],
+  );
+
+  const handleEditSchedule = useCallback(
+    (schedule: CookieBotSchedule) => {
+      const profile = profiles.find((p) => p.id === schedule.profile_id);
+      if (!profile) {
+        showErrorToast(t("cookieBot.enrolled.profileMissing"));
+        return;
+      }
+      openEnrolFor([profile], schedule);
+    },
+    [profiles, openEnrolFor, t],
+  );
+
+  const confirmRemoval = useCallback(async () => {
+    if (!pendingRemoval) return;
+    setIsRemoving(true);
+    try {
+      await deleteCookieBotSchedule(pendingRemoval.profile_id);
+      showSuccessToast(t("cookieBot.schedule.unenrolled"));
+      setPendingRemoval(null);
+      reload();
+    } catch (error) {
+      showErrorToast(translateBackendError(t, error));
+    } finally {
+      setIsRemoving(false);
+    }
+  }, [pendingRemoval, reload, t]);
+
+  const dialogBody = !unlocked ? (
+    <LockedState />
+  ) : (
+    <div className="@container flex min-h-0 w-full flex-1 flex-col">
+      <AnimatedTabs
+        value={activeTab}
+        onValueChange={(value) => {
+          setActiveTab(value as CookieBotTab);
+        }}
+        className="flex min-h-0 flex-1 flex-col"
+      >
+        <div className="flex shrink-0 flex-wrap items-center justify-between gap-2">
+          <AnimatedTabsList>
+            <AnimatedTabsTrigger value="overview">
+              <span>{t("cookieBot.tabs.overview")}</span>
+              <span className="text-xs tabular-nums">{schedules.length}</span>
+            </AnimatedTabsTrigger>
+            <AnimatedTabsTrigger value="schedule">
+              {t("cookieBot.tabs.schedule")}
+            </AnimatedTabsTrigger>
+            <AnimatedTabsTrigger value="activity">
+              <span>{t("cookieBot.tabs.activity")}</span>
+              {live.length > 0 && (
+                <span className="size-1.5 rounded-full bg-success" />
+              )}
+            </AnimatedTabsTrigger>
+            {showTeamTab && (
+              <AnimatedTabsTrigger value="team">
+                {t("cookieBot.tabs.team")}
+              </AnimatedTabsTrigger>
+            )}
+          </AnimatedTabsList>
+
+          <div className="flex items-center gap-3">
+            <RemoteHoursMeter
+              quota={quota}
+              isLoading={isStoreLoading && quota === null}
+              variant="compact"
+            />
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <RippleButton
+                  size="sm"
+                  className="flex items-center gap-2"
+                  aria-label={t("cookieBot.enrolled.enrolProfiles")}
+                  onClick={() => {
+                    setPickerOpen(true);
+                  }}
+                >
+                  <GoPlus className="size-4" />
+                  <span className="hidden @2xl:inline">
+                    {t("cookieBot.enrolled.enrolProfiles")}
+                  </span>
+                </RippleButton>
+              </TooltipTrigger>
+              <TooltipContent>
+                {t("cookieBot.enrolled.enrolProfiles")}
+              </TooltipContent>
+            </Tooltip>
+          </div>
+        </div>
+
+        {loadError !== null && (
+          <div className="mt-4 flex shrink-0 items-center gap-3 rounded-md border border-destructive/50 bg-destructive/10 p-3">
+            <p className="min-w-0 flex-1 text-sm text-destructive-text">
+              {translateBackendError(t, loadError)}
+            </p>
+            <RippleButton variant="outline" size="sm" onClick={reload}>
+              {t("common.buttons.retry")}
+            </RippleButton>
+          </div>
+        )}
+
+        <AnimatedTabsContent
+          value="overview"
+          className="mt-4 min-h-0 flex-1 flex-col data-[state=active]:flex"
+        >
+          <CookieBotOverview
+            schedules={schedules}
+            runs={runs}
+            live={live}
+            quota={quota}
+            profiles={profiles}
+            isLoading={isLoading}
+            currentUserId={cloudUser?.id ?? null}
+            onEnrol={() => {
+              setPickerOpen(true);
+            }}
+            onEditSchedule={handleEditSchedule}
+            onRemoveSchedule={setPendingRemoval}
+            onJumpToActivity={(filter) => {
+              setRunFilter(filter);
+              setActiveTab("activity");
+            }}
+          />
+        </AnimatedTabsContent>
+
+        <AnimatedTabsContent
+          value="schedule"
+          className="mt-4 min-h-0 flex-1 flex-col data-[state=active]:flex"
+        >
+          <CookieBotScheduleTab
+            schedules={schedules}
+            isLoading={isStoreLoading}
+            currentUserId={cloudUser?.id ?? null}
+            canEditOthers={isOwnerOrAdmin}
+            onEdit={handleEditSchedule}
+            onRemove={setPendingRemoval}
+          />
+        </AnimatedTabsContent>
+
+        <AnimatedTabsContent
+          value="activity"
+          className="mt-4 min-h-0 flex-1 flex-col data-[state=active]:flex"
+        >
+          <CookieBotActivity
+            live={live}
+            streamConnected={streamConnected}
+            runs={runs}
+            isLoading={isLoadingRuns}
+            profiles={profiles}
+            showOperator={isTeam}
+            filter={runFilter}
+            onFilterChange={setRunFilter}
+            onRefresh={reload}
+          />
+        </AnimatedTabsContent>
+
+        {showTeamTab && (
+          <AnimatedTabsContent
+            value="team"
+            className="mt-4 min-h-0 flex-1 flex-col data-[state=active]:flex"
+          >
+            {/* One team-usage implementation, shared with the Account page,
+                so the two never disagree about who spent the pool. */}
+            <TeamUsagePanel quota={quota} className="min-h-0 flex-1" />
+          </AnimatedTabsContent>
+        )}
+      </AnimatedTabs>
+    </div>
+  );
+
+  return (
+    <>
+      <Dialog open={isOpen} onOpenChange={onClose} subPage={subPage}>
+        <DialogContent className="flex max-h-[85vh] max-w-[min(80rem,calc(100%-4rem))] flex-col">
+          {!subPage && (
+            <DialogHeader>
+              <DialogTitle>{t("cookieBot.title")}</DialogTitle>
+              <DialogDescription>
+                {t("cookieBot.description")}
+              </DialogDescription>
+            </DialogHeader>
+          )}
+          {dialogBody}
+        </DialogContent>
+      </Dialog>
+
+      <EnrolPickerDialog
+        isOpen={pickerOpen}
+        profiles={profiles}
+        enrolledIds={enrolledIds}
+        onClose={() => {
+          setPickerOpen(false);
+        }}
+        onConfirm={(selected) => {
+          setPickerOpen(false);
+          openEnrolFor(selected, null);
+        }}
+      />
+
+      <CookieBotEnrolDialog
+        isOpen={enrolOpen}
+        onClose={() => {
+          setEnrolOpen(false);
+        }}
+        profiles={enrolTargets}
+        existing={editing}
+        onSaved={reload}
+        onOpenProfileSync={onOpenProfileSync}
+        onAssignProxy={onAssignProxy}
+      />
+
+      <DeleteConfirmationDialog
+        isOpen={pendingRemoval !== null}
+        onClose={() => {
+          setPendingRemoval(null);
+        }}
+        onConfirm={() => {
+          void confirmRemoval();
+        }}
+        title={t("cookieBot.schedule.unenrolTitle", {
+          name: pendingRemoval?.profile_name ?? "",
+        })}
+        description={t("cookieBot.schedule.unenrolDescription")}
+        confirmButtonText={t("cookieBot.schedule.unenrol")}
+        isLoading={isRemoving}
+      />
+    </>
+  );
+}
+
+function LockedState() {
+  const { t } = useTranslation();
+  return (
+    <div className="flex min-h-0 flex-1 flex-col items-center justify-center gap-3 py-16 text-center">
+      <LuCookie className="size-12 text-muted-foreground" />
+      <div className="flex items-center gap-2">
+        <p className="text-sm font-medium text-foreground">
+          {t("cookieBot.locked.title")}
+        </p>
+        <ProBadge />
+      </div>
+      <p className="max-w-md text-xs text-muted-foreground">
+        {t("cookieBot.locked.hint")}
+      </p>
+    </div>
+  );
+}
+
+/**
+ * Picking which profiles to enrol. Ineligible profiles are shown with their
+ * reason rather than hidden, so the list matches what the operator sees in the
+ * main table and the refusal is discovered here, not at 02:00.
+ */
+function EnrolPickerDialog({
+  isOpen,
+  profiles,
+  enrolledIds,
+  onClose,
+  onConfirm,
+}: {
+  isOpen: boolean;
+  profiles: BrowserProfile[];
+  enrolledIds: Set<string>;
+  onClose: () => void;
+  onConfirm: (selected: BrowserProfile[]) => void;
+}) {
+  const { t } = useTranslation();
+  const [search, setSearch] = useState("");
+  const [selected, setSelected] = useState<Set<string>>(new Set());
+
+  useEffect(() => {
+    if (!isOpen) return;
+    setSearch("");
+    setSelected(new Set());
+  }, [isOpen]);
+
+  const rows = useMemo(() => {
+    const needle = search.trim().toLowerCase();
+    return profiles
+      .filter((profile) => profile.name.toLowerCase().includes(needle))
+      .map((profile) => ({
+        profile,
+        check: preflight(profile),
+        enrolled: enrolledIds.has(profile.id),
+      }))
+      .sort((a, b) => {
+        if (a.check.eligible !== b.check.eligible) {
+          return a.check.eligible ? -1 : 1;
+        }
+        return a.profile.name.localeCompare(b.profile.name);
+      });
+  }, [profiles, search, enrolledIds]);
+
+  const chosen = useMemo(
+    () => profiles.filter((profile) => selected.has(profile.id)),
+    [profiles, selected],
+  );
+
+  return (
+    <Dialog
+      open={isOpen}
+      onOpenChange={(open) => {
+        if (!open) onClose();
+      }}
+    >
+      <DialogContent className="flex max-h-[70vh] max-w-lg flex-col">
+        <DialogHeader>
+          <DialogTitle>{t("cookieBot.picker.title")}</DialogTitle>
+          <DialogDescription>
+            {t("cookieBot.picker.description")}
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="relative shrink-0">
+          <LuSearch className="absolute top-1/2 left-2.5 size-3.5 -translate-y-1/2 text-muted-foreground" />
+          <Input
+            value={search}
+            onChange={(event) => {
+              setSearch(event.target.value);
+            }}
+            className="h-8 pl-8 text-sm"
+            placeholder={t("cookieBot.picker.searchPlaceholder")}
+          />
+        </div>
+
+        <FadingScrollArea className="min-h-0 flex-1">
+          <div className="flex flex-col gap-0.5 pr-1">
+            {rows.length === 0 ? (
+              <p className="py-8 text-center text-sm text-muted-foreground">
+                {t("cookieBot.picker.noProfiles")}
+              </p>
+            ) : (
+              rows.map(({ profile, check, enrolled }) => (
+                <label
+                  key={profile.id}
+                  htmlFor={`cookie-bot-pick-${profile.id}`}
+                  className={cn(
+                    "flex h-8 cursor-pointer items-center gap-2 rounded-md px-2 text-xs transition-colors duration-100 hover:bg-accent hover:text-accent-foreground",
+                    !check.eligible && "cursor-not-allowed opacity-60",
+                  )}
+                >
+                  <Checkbox
+                    id={`cookie-bot-pick-${profile.id}`}
+                    checked={selected.has(profile.id)}
+                    disabled={!check.eligible}
+                    onCheckedChange={(value) => {
+                      setSelected((prev) => {
+                        const next = new Set(prev);
+                        if (value === true) next.add(profile.id);
+                        else next.delete(profile.id);
+                        return next;
+                      });
+                    }}
+                  />
+                  <span className="min-w-0 flex-1 truncate">
+                    {profile.name}
+                  </span>
+                  {enrolled && (
+                    <span className="shrink-0 text-[10px] uppercase tracking-wide text-muted-foreground">
+                      {t("cookieBot.picker.alreadyEnrolled")}
+                    </span>
+                  )}
+                  {!check.eligible && (
+                    <span className="shrink-0 text-muted-foreground">
+                      {preflightReason(t, check)}
+                    </span>
+                  )}
+                </label>
+              ))
+            )}
+          </div>
+        </FadingScrollArea>
+
+        <DialogFooter>
+          <Button variant="outline" size="sm" onClick={onClose}>
+            {t("common.buttons.cancel")}
+          </Button>
+          <RippleButton
+            size="sm"
+            disabled={chosen.length === 0}
+            onClick={() => {
+              onConfirm(chosen);
+            }}
+          >
+            {t("cookieBot.picker.continue", { count: chosen.length })}
+          </RippleButton>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
@@ -0,0 +1,237 @@
+"use client";
+
+import * as React from "react";
+import { useTranslation } from "react-i18next";
+import {
+  formatDateTime,
+  formatDuration,
+  hasRunCounters,
+  outcomeLabel,
+  runStatusLabel,
+  runStatusTone,
+  StatusDot,
+} from "@/components/cookie-bot-shared";
+import { LoadingButton } from "@/components/loading-button";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { Skeleton } from "@/components/ui/skeleton";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "@/components/ui/table";
+import { translateBackendError } from "@/lib/backend-errors";
+import {
+  type CookieBotRun,
+  cancelCookieBotRun,
+  getCookieBotRuns,
+} from "@/lib/cookie-bot";
+import { showErrorToast, showSuccessToast } from "@/lib/toast-utils";
+
+const RUN_PAGE_SIZE = 25;
+
+/** Statuses that are still moving, so the row can offer a stop. */
+const IN_FLIGHT = new Set(["pending", "running"]);
+
+function runDurationSeconds(run: CookieBotRun): number | null {
+  if (run.billed_seconds > 0) return run.billed_seconds;
+  const started = run.started_at ? new Date(run.started_at).getTime() : NaN;
+  const ended = run.ended_at ? new Date(run.ended_at).getTime() : NaN;
+  if (!Number.isNaN(started) && !Number.isNaN(ended) && ended > started) {
+    return (ended - started) / 1000;
+  }
+  return null;
+}
+
+interface CookieBotRunsDialogProps {
+  isOpen: boolean;
+  onClose: () => void;
+  profileId: string | null;
+  profileName?: string;
+  /** Called after a run is cancelled, so shared state can be re-read. */
+  onRunCancelled?: () => void;
+}
+
+/**
+ * What the bot actually did for one profile, reached from that profile's row.
+ *
+ * The Cookie Bot page owns the fleet-wide activity view; this is the same data
+ * narrowed to a single profile, which is the question an operator asks while
+ * looking at the table. Every number is the server's — the desktop keeps no run
+ * history of its own — and the status vocabulary is the shared one, so a status
+ * cannot read differently in two places.
+ */
+export function CookieBotRunsDialog({
+  isOpen,
+  onClose,
+  profileId,
+  profileName,
+  onRunCancelled,
+}: CookieBotRunsDialogProps) {
+  const { t } = useTranslation();
+  const [runs, setRuns] = React.useState<CookieBotRun[]>([]);
+  const [isLoading, setIsLoading] = React.useState(false);
+  const [error, setError] = React.useState<string | null>(null);
+  const [cancellingId, setCancellingId] = React.useState<string | null>(null);
+
+  const load = React.useCallback(async () => {
+    if (!profileId) return;
+    setIsLoading(true);
+    setError(null);
+    try {
+      const page = await getCookieBotRuns({ profileId, limit: RUN_PAGE_SIZE });
+      setRuns(page.runs);
+    } catch (err) {
+      setError(translateBackendError(t as never, err));
+    } finally {
+      setIsLoading(false);
+    }
+  }, [profileId, t]);
+
+  React.useEffect(() => {
+    if (!isOpen) return;
+    setRuns([]);
+    void load();
+  }, [isOpen, load]);
+
+  const handleCancel = React.useCallback(
+    async (run: CookieBotRun) => {
+      setCancellingId(run.id);
+      try {
+        await cancelCookieBotRun(run.id);
+        showSuccessToast(t("cookieBot.running.stopped"));
+        onRunCancelled?.();
+        await load();
+      } catch (err) {
+        showErrorToast(translateBackendError(t as never, err));
+      } finally {
+        setCancellingId(null);
+      }
+    },
+    [load, onRunCancelled, t],
+  );
+
+  return (
+    <Dialog
+      open={isOpen}
+      onOpenChange={(open) => {
+        if (!open) onClose();
+      }}
+    >
+      <DialogContent className="flex max-h-[80vh] max-w-2xl flex-col">
+        <DialogHeader className="shrink-0">
+          <DialogTitle>{t("cookieBot.history.title")}</DialogTitle>
+          <DialogDescription>
+            {profileName ?? t("cookieBot.history.allProfiles")}
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="min-h-0 flex-1 overflow-y-auto">
+          {error ? (
+            <p className="py-8 text-center text-sm text-destructive-text">
+              {error}
+            </p>
+          ) : isLoading && runs.length === 0 ? (
+            <div className="space-y-2 py-2">
+              {Array.from({ length: 5 }, (_, index) => (
+                <Skeleton
+                  key={`run-skeleton-${index}`}
+                  className="h-7 w-full"
+                />
+              ))}
+            </div>
+          ) : runs.length === 0 ? (
+            <p className="py-8 text-center text-sm text-muted-foreground">
+              {t("cookieBot.history.empty")}
+            </p>
+          ) : (
+            <Table>
+              <TableHeader className="sticky top-0 z-10 bg-background">
+                <TableRow>
+                  <TableHead>{t("cookieBot.history.columnStarted")}</TableHead>
+                  <TableHead>{t("cookieBot.history.columnDuration")}</TableHead>
+                  <TableHead>{t("cookieBot.history.columnSites")}</TableHead>
+                  <TableHead>{t("cookieBot.history.columnStatus")}</TableHead>
+                  <TableHead />
+                </TableRow>
+              </TableHeader>
+              <TableBody>
+                {runs.map((run) => {
+                  const duration = runDurationSeconds(run);
+                  const started =
+                    formatDateTime(run.started_at ?? run.scheduled_for) ?? "—";
+                  return (
+                    <TableRow key={run.id}>
+                      <TableCell className="text-xs tabular-nums whitespace-nowrap">
+                        {started}
+                      </TableCell>
+                      <TableCell className="text-xs tabular-nums">
+                        {duration === null ? "—" : formatDuration(t, duration)}
+                      </TableCell>
+                      {/* Never a confident `0/12`: nothing writes these
+                          counters yet, so the column default is not a fact
+                          about what the bot did. */}
+                      <TableCell className="text-xs tabular-nums">
+                        {hasRunCounters(run)
+                          ? t("cookieBot.history.sitesVisited", {
+                              visited: run.sites_visited,
+                              total: run.sites_total,
+                            })
+                          : t("cookieBot.history.sitesUnknown")}
+                        {run.sites_failed > 0 && (
+                          <span className="ml-1 text-warning-text">
+                            {t("cookieBot.history.sitesFailed", {
+                              count: run.sites_failed,
+                            })}
+                          </span>
+                        )}
+                      </TableCell>
+                      <TableCell className="text-xs">
+                        <span className="flex items-center gap-1.5">
+                          <StatusDot
+                            tone={runStatusTone(run.status)}
+                            pulse={run.status === "running"}
+                            className="size-1.5"
+                          />
+                          {runStatusLabel(t, run.status)}
+                        </span>
+                        {run.outcome_code && (
+                          <span className="mt-0.5 block text-[11px] text-muted-foreground">
+                            {outcomeLabel(t, run.outcome_code)}
+                          </span>
+                        )}
+                      </TableCell>
+                      <TableCell className="text-right">
+                        {IN_FLIGHT.has(run.status) && (
+                          <LoadingButton
+                            size="sm"
+                            variant="outline"
+                            isLoading={cancellingId === run.id}
+                            onClick={() => {
+                              void handleCancel(run);
+                            }}
+                            className="h-6 text-[11px]"
+                          >
+                            {t("cookieBot.running.stop")}
+                          </LoadingButton>
+                        )}
+                      </TableCell>
+                    </TableRow>
+                  );
+                })}
+              </TableBody>
+            </Table>
+          )}
+        </div>
+      </DialogContent>
+    </Dialog>
+  );
+}
@@ -0,0 +1,264 @@
+"use client";
+
+import { useMemo } from "react";
+import { useTranslation } from "react-i18next";
+import { LuPencil, LuTrash2 } from "react-icons/lu";
+import {
+  describeCadence,
+  minutesToClock,
+  StatusDot,
+  scheduleBlockedReason,
+  scheduleTone,
+} from "@/components/cookie-bot-shared";
+import { Button } from "@/components/ui/button";
+import { FadingScrollArea } from "@/components/ui/fading-scroll-area";
+import { Skeleton } from "@/components/ui/skeleton";
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/ui/tooltip";
+import type { CookieBotSchedule } from "@/lib/cookie-bot";
+import { cn } from "@/lib/utils";
+
+/** A slot holding this many enrolments is worth flagging: the fleet leases a
+ * handful of machines per platform, so a pile-up at one minute is a real
+ * capacity fact, not a decoration. */
+const CROWDED_SLOT = 4;
+
+interface Slot {
+  hour: number;
+  entries: CookieBotSchedule[];
+}
+
+interface CookieBotScheduleTabProps {
+  schedules: CookieBotSchedule[];
+  isLoading: boolean;
+  currentUserId: string | null;
+  canEditOthers: boolean;
+  onEdit: (schedule: CookieBotSchedule) => void;
+  onRemove: (schedule: CookieBotSchedule) => void;
+}
+
+/**
+ * The night, drawn as a night. Every enrolment the caller can see sits under
+ * the hour it starts, so two operators aiming at the same profile — or twelve
+ * profiles aiming at 02:00 — is visible before it becomes a 409 at 02:00.
+ */
+export function CookieBotScheduleTab({
+  schedules,
+  isLoading,
+  currentUserId,
+  canEditOthers,
+  onEdit,
+  onRemove,
+}: CookieBotScheduleTabProps) {
+  const { t } = useTranslation();
+
+  const rows = useMemo(() => buildRows(schedules), [schedules]);
+
+  if (isLoading && schedules.length === 0) {
+    return (
+      <div className="flex min-h-0 flex-1 flex-col gap-3 pt-2">
+        {Array.from({ length: 5 }, (_, i) => (
+          <div key={`slot-skeleton-${i}`} className="flex items-center gap-3">
+            <Skeleton className="h-3 w-10" />
+            <Skeleton
+              className="h-3"
+              style={{ width: `${30 + ((i * 17) % 40)}%` }}
+            />
+          </div>
+        ))}
+      </div>
+    );
+  }
+
+  if (schedules.length === 0) {
+    return (
+      <div className="flex min-h-0 flex-1 items-center justify-center py-16">
+        <p className="text-sm text-muted-foreground">
+          {t("cookieBot.schedule.empty")}
+        </p>
+      </div>
+    );
+  }
+
+  return (
+    <FadingScrollArea
+      className="min-h-0 flex-1"
+      style={{ "--scroll-fade-top-offset": "16px" } as React.CSSProperties}
+    >
+      <div className="flex flex-col pr-1">
+        {rows.map((row) =>
+          row.kind === "gap" ? (
+            <div
+              key={`gap-${row.from}`}
+              className="flex h-6 items-center gap-2 pl-14 text-[10px] uppercase tracking-wide text-muted-foreground"
+            >
+              <span>
+                {t("cookieBot.schedule.quietHours", { count: row.count })}
+              </span>
+              <span className="h-px flex-1 rounded-full bg-border" />
+            </div>
+          ) : (
+            <div key={`slot-${row.slot.hour}`} className="flex gap-3 pb-4">
+              <span className="w-14 shrink-0 pt-1 text-right text-xs tabular-nums text-muted-foreground">
+                {minutesToClock(row.slot.hour * 60)}
+              </span>
+              <div className="flex min-w-0 flex-1 flex-col gap-0.5 border-l border-border pl-3">
+                {row.slot.entries.map((schedule) => {
+                  const mine =
+                    !schedule.owner_user_id ||
+                    schedule.owner_user_id === currentUserId;
+                  const editable = mine || canEditOthers;
+                  const blocked = scheduleBlockedReason(t, schedule);
+                  return (
+                    <div
+                      key={`${schedule.owner_user_id ?? "me"}-${schedule.profile_id}`}
+                      className="group flex h-7 items-center gap-2 rounded-md px-2 text-xs transition-colors duration-100 hover:bg-accent hover:text-accent-foreground"
+                    >
+                      <StatusDot
+                        tone={scheduleTone(schedule)}
+                        className="size-1.5"
+                      />
+                      <span className="min-w-0 flex-1 truncate">
+                        {schedule.profile_name}
+                      </span>
+                      {/* "This cannot run" beats "it runs nightly": an
+                          enrolment the server will refuse should not read as a
+                          cadence it is about to keep. */}
+                      <span
+                        className={cn(
+                          "shrink-0 text-[10px] uppercase tracking-wide",
+                          blocked
+                            ? "text-warning-text"
+                            : "text-muted-foreground",
+                        )}
+                      >
+                        {blocked ?? describeCadence(t, schedule.days_mask)}
+                      </span>
+                      <span className="shrink-0 tabular-nums text-muted-foreground">
+                        {minutesToClock(schedule.run_at_minute)}
+                      </span>
+                      {!mine && schedule.owner_email && (
+                        <span className="hidden max-w-40 shrink-0 truncate text-[10px] uppercase tracking-wide text-muted-foreground @2xl:inline">
+                          {schedule.owner_email}
+                        </span>
+                      )}
+                      <SlotAction
+                        label={t("cookieBot.enrolled.edit")}
+                        forbidden={!editable}
+                        onClick={() => {
+                          onEdit(schedule);
+                        }}
+                      >
+                        <LuPencil className="size-3.5" />
+                      </SlotAction>
+                      <SlotAction
+                        label={t("cookieBot.schedule.unenrol")}
+                        forbidden={!editable}
+                        destructive
+                        onClick={() => {
+                          onRemove(schedule);
+                        }}
+                      >
+                        <LuTrash2 className="size-3.5" />
+                      </SlotAction>
+                    </div>
+                  );
+                })}
+                {row.slot.entries.length >= CROWDED_SLOT && (
+                  <span className="px-2 pt-1 text-[11px] text-warning-text">
+                    {t("cookieBot.schedule.crowded", {
+                      count: row.slot.entries.length,
+                    })}
+                  </span>
+                )}
+              </div>
+            </div>
+          ),
+        )}
+      </div>
+    </FadingScrollArea>
+  );
+}
+
+function SlotAction({
+  label,
+  forbidden,
+  destructive,
+  onClick,
+  children,
+}: {
+  label: string;
+  forbidden: boolean;
+  destructive?: boolean;
+  onClick: () => void;
+  children: React.ReactNode;
+}) {
+  const { t } = useTranslation();
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <span className="inline-flex shrink-0">
+          <Button
+            variant="ghost"
+            size="icon"
+            className={cn(
+              "size-7",
+              destructive && "text-destructive-text hover:bg-destructive/10",
+            )}
+            aria-label={label}
+            disabled={forbidden}
+            onClick={onClick}
+          >
+            {children}
+          </Button>
+        </span>
+      </TooltipTrigger>
+      <TooltipContent>
+        {forbidden ? t("cookieBot.conflict.replaceForbidden") : label}
+      </TooltipContent>
+    </Tooltip>
+  );
+}
+
+type Row =
+  | { kind: "slot"; slot: Slot }
+  | { kind: "gap"; from: number; count: number };
+
+/**
+ * Groups enrolments into the hour they start and collapses the empty stretches
+ * between them. A 24-row skeleton of empty hours would be a grid pretending to
+ * be information.
+ */
+function buildRows(schedules: CookieBotSchedule[]): Row[] {
+  const byHour = new Map<number, CookieBotSchedule[]>();
+  for (const schedule of schedules) {
+    const hour = Math.floor(schedule.run_at_minute / 60) % 24;
+    const bucket = byHour.get(hour);
+    if (bucket) bucket.push(schedule);
+    else byHour.set(hour, [schedule]);
+  }
+
+  const hours = [...byHour.keys()].sort((a, b) => a - b);
+  const rows: Row[] = [];
+  let previous: number | null = null;
+  for (const hour of hours) {
+    if (previous !== null && hour - previous > 1) {
+      rows.push({
+        kind: "gap",
+        from: previous + 1,
+        count: hour - previous - 1,
+      });
+    }
+    const entries = (byHour.get(hour) ?? []).sort(
+      (a, b) =>
+        a.run_at_minute - b.run_at_minute ||
+        a.profile_name.localeCompare(b.profile_name),
+    );
+    rows.push({ kind: "slot", slot: { hour, entries } });
+    previous = hour;
+  }
+  return rows;
+}
@@ -0,0 +1,949 @@
+"use client";
+
+import { invoke } from "@tauri-apps/api/core";
+import type { TFunction } from "i18next";
+import { motion, useReducedMotion } from "motion/react";
+import { useEffect, useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Skeleton } from "@/components/ui/skeleton";
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/ui/tooltip";
+import { parseBackendError, translateBackendError } from "@/lib/backend-errors";
+import type {
+  CookieBotRun,
+  CookieBotSchedule,
+  CookieBotSlot,
+  RemoteHoursQuota,
+} from "@/lib/cookie-bot";
+import { MOTION_EASE_OUT } from "@/lib/motion";
+import type { RemoteSessionState } from "@/lib/remote-sessions";
+import { cn } from "@/lib/utils";
+import type { BrowserProfile, WayfernFingerprintConfig } from "@/types";
+
+/* -------------------------------------------------------------------------- */
+/* Cadence                                                                    */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * Weekday bitmask, bit 0 = Monday. The masks below are the only three the
+ * enrolment dialog offers; anything else that comes back from the server is
+ * rendered as its own weekday list rather than forced into one of these.
+ */
+export const DAYS_NIGHTLY = 127;
+export const DAYS_WEEKNIGHTS = 31;
+export const DAYS_ALTERNATE = 85; // Mon / Wed / Fri / Sun
+
+export type CadenceId = "nightly" | "weeknights" | "alternate";
+
+export const CADENCES: { id: CadenceId; mask: number; labelKey: string }[] = [
+  {
+    id: "nightly",
+    mask: DAYS_NIGHTLY,
+    labelKey: "cookieBot.enrol.cadenceNightly",
+  },
+  {
+    id: "weeknights",
+    mask: DAYS_WEEKNIGHTS,
+    labelKey: "cookieBot.enrol.cadenceWeeknights",
+  },
+  {
+    id: "alternate",
+    mask: DAYS_ALTERNATE,
+    labelKey: "cookieBot.enrol.cadenceAlternate",
+  },
+];
+
+export function cadenceForMask(mask: number): CadenceId | null {
+  return CADENCES.find((c) => c.mask === mask)?.id ?? null;
+}
+
+export function nightsPerWeek(mask: number): number {
+  let count = 0;
+  for (let bit = 0; bit < 7; bit += 1) {
+    if ((mask & (1 << bit)) !== 0) count += 1;
+  }
+  return count;
+}
+
+/* -------------------------------------------------------------------------- */
+/* Slots                                                                      */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * Every time-of-day an enrolment fires, from whichever shape the server sent.
+ *
+ * ALWAYS at least one slot. A server that predates multi-slot scheduling sends
+ * only the mirrored `run_at_minute` / `days_mask` pair, and a renderer that read
+ * `slots` directly would show an enrolment as firing at no time at all. Reading
+ * the wire through here is what keeps that fallback in one place.
+ */
+export function scheduleSlots(schedule: {
+  slots?: CookieBotSlot[];
+  run_at_minute: number;
+  days_mask: number;
+}): CookieBotSlot[] {
+  const slots = schedule.slots ?? [];
+  if (slots.length > 0) return slots;
+  return [
+    { days_mask: schedule.days_mask, run_at_minute: schedule.run_at_minute },
+  ];
+}
+
+/**
+ * How many times a week a whole calendar fires.
+ *
+ * Counted across slots, not read off the first one: an enrolment with three
+ * slots costs three times the hours, and the budget estimate beside it is the
+ * only place a user sees that before committing.
+ *
+ * DISTINCT (weekday, minute) pairs rather than a sum of night counts, because
+ * two slots landing on the same weekday at the same minute are the same
+ * instant and the server dispatches them as ONE run — `upcomingSlotsMulti`
+ * collapses coincident fires. Summing quoted a Mon+Tue and a Tue+Wed slot at
+ * 02:00 as four nights when it is three, and that inflated figure is what the
+ * over-budget warning is compared against.
+ */
+export function weeklyRuns(
+  slots: { days_mask: number; run_at_minute: number }[],
+): number {
+  const fires = new Set<number>();
+  for (const slot of slots) {
+    for (let bit = 0; bit < 7; bit += 1) {
+      if ((slot.days_mask & (1 << bit)) !== 0) {
+        fires.add(bit * 1440 + slot.run_at_minute);
+      }
+    }
+  }
+  return fires.size;
+}
+
+/**
+ * Monday-first weekday names, from the viewer's own locale.
+ *
+ * Derived rather than translated into ten locale files: `narrow` already gives
+ * each language its own single-letter convention, and a hand-written table
+ * would be ten more places for Monday-first to be got wrong. The reference week
+ * is formatted in UTC so a user east of Greenwich does not see it shift by a
+ * day.
+ */
+export function weekdayNames(): { narrow: string; long: string }[] {
+  // 2024-01-01 was a Monday, which is bit 0 of the server's mask.
+  const monday = Date.UTC(2024, 0, 1);
+  const narrow = new Intl.DateTimeFormat(undefined, {
+    weekday: "narrow",
+    timeZone: "UTC",
+  });
+  const long = new Intl.DateTimeFormat(undefined, {
+    weekday: "long",
+    timeZone: "UTC",
+  });
+  return Array.from({ length: 7 }, (_, index) => {
+    const day = new Date(monday + index * 24 * 60 * 60 * 1000);
+    return { narrow: narrow.format(day), long: long.format(day) };
+  });
+}
+
+/** A human cadence label. Unknown masks fall back to the night count. */
+export function describeCadence(t: TFunction, mask: number): string {
+  const id = cadenceForMask(mask);
+  if (id) {
+    return t(CADENCES.find((c) => c.id === id)?.labelKey ?? "");
+  }
+  return t("cookieBot.enrol.cadenceCustom", { count: nightsPerWeek(mask) });
+}
+
+/* -------------------------------------------------------------------------- */
+/* Time formatting                                                            */
+/* -------------------------------------------------------------------------- */
+
+/** `137` -> `02:17`. Always zero-padded so the column stays on one grid. */
+export function minutesToClock(minutes: number): string {
+  const safe = ((Math.round(minutes) % 1440) + 1440) % 1440;
+  const h = Math.floor(safe / 60);
+  const m = safe % 60;
+  return `${String(h).padStart(2, "0")}:${String(m).padStart(2, "0")}`;
+}
+
+/** `02:17` -> `137`. Returns null for anything that isn't a real time. */
+export function clockToMinutes(value: string): number | null {
+  const match = /^(\d{1,2}):(\d{2})$/.exec(value.trim());
+  if (!match) return null;
+  const h = Number(match[1]);
+  const m = Number(match[2]);
+  if (!Number.isFinite(h) || !Number.isFinite(m)) return null;
+  if (h < 0 || h > 23 || m < 0 || m > 59) return null;
+  return h * 60 + m;
+}
+
+/** `724` -> `12:04`. Used for the live elapsed clock; never rounds up. */
+export function formatElapsed(seconds: number): string {
+  const total = Math.max(0, Math.floor(seconds));
+  const h = Math.floor(total / 3600);
+  const m = Math.floor((total % 3600) / 60);
+  const s = total % 60;
+  if (h > 0) {
+    return `${h}:${String(m).padStart(2, "0")}:${String(s).padStart(2, "0")}`;
+  }
+  return `${String(m).padStart(2, "0")}:${String(s).padStart(2, "0")}`;
+}
+
+/** `724` -> `12m 04s`, for a finished run's duration column. */
+export function formatDuration(t: TFunction, seconds: number): string {
+  const total = Math.max(0, Math.floor(seconds));
+  const h = Math.floor(total / 3600);
+  const m = Math.floor((total % 3600) / 60);
+  const s = total % 60;
+  if (h > 0) return t("cookieBot.duration.hm", { hours: h, minutes: m });
+  if (m > 0) {
+    return t("cookieBot.duration.ms", {
+      minutes: m,
+      seconds: String(s).padStart(2, "0"),
+    });
+  }
+  return t("cookieBot.duration.s", { seconds: s });
+}
+
+/** Parses a server ISO timestamp. Returns null rather than an Invalid Date. */
+export function parseIso(value: string | null | undefined): Date | null {
+  if (!value) return null;
+  const date = new Date(value);
+  return Number.isNaN(date.getTime()) ? null : date;
+}
+
+export function formatDateTime(
+  value: string | null | undefined,
+): string | null {
+  const date = parseIso(value);
+  if (!date) return null;
+  return date.toLocaleString(undefined, {
+    dateStyle: "medium",
+    timeStyle: "short",
+  });
+}
+
+export function formatDate(value: string | null | undefined): string | null {
+  const date = parseIso(value);
+  if (!date) return null;
+  return date.toLocaleDateString(undefined, {
+    day: "numeric",
+    month: "short",
+  });
+}
+
+/* -------------------------------------------------------------------------- */
+/* Preflight                                                                  */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * Hosts the fleet can lease. Mirrors `BOT_PLATFORMS` in
+ * `src-tauri/src/cookie_bot.rs`; a profile built for anything else has no
+ * machine to run on and is refused before a schedule row is ever written.
+ */
+const BOT_PLATFORMS = ["windows", "macos"];
+
+export type PreflightCode =
+  | "syncOff"
+  | "encrypted"
+  | "unknownPlatform"
+  | "unsupportedPlatform"
+  | "noExitNode";
+
+/** The one-click repairs a failed preflight can name. */
+export type PreflightFix = "sync" | "syncSettings" | "proxy";
+
+export interface PreflightResult {
+  eligible: boolean;
+  code: PreflightCode | null;
+  /** Substituted into the reason line, e.g. the refused OS name. */
+  params: Record<string, string>;
+  /** Which one-click repair applies, when one does. */
+  fix: PreflightFix | null;
+}
+
+const ELIGIBLE: PreflightResult = {
+  eligible: true,
+  code: null,
+  params: {},
+  fix: null,
+};
+
+/** The OS a profile claims, from its own record then its fingerprint. */
+export function resolvedOs(profile: BrowserProfile): string | null {
+  return profile.host_os ?? profile.wayfern_config?.os ?? null;
+}
+
+/**
+ * The exact refusals `cookie_bot::bot_precondition` applies, evaluated here so
+ * a user finds out at enrolment rather than at 02:00. Keeping the two in step
+ * matters: a profile this says is fine but the backend refuses would burn a
+ * schedule row and a night.
+ */
+export function preflight(profile: BrowserProfile): PreflightResult {
+  const syncMode = profile.sync_mode ?? "Disabled";
+  if (syncMode === "Disabled") {
+    return { eligible: false, code: "syncOff", params: {}, fix: "sync" };
+  }
+  if (syncMode === "Encrypted") {
+    return {
+      eligible: false,
+      code: "encrypted",
+      params: {},
+      fix: "syncSettings",
+    };
+  }
+  const os = resolvedOs(profile);
+  if (!os) {
+    return {
+      eligible: false,
+      code: "unknownPlatform",
+      params: {},
+      fix: null,
+    };
+  }
+  if (!BOT_PLATFORMS.includes(os)) {
+    return {
+      eligible: false,
+      code: "unsupportedPlatform",
+      params: { os },
+      fix: null,
+    };
+  }
+  if (!profile.proxy_id && !profile.vpn_id) {
+    return { eligible: false, code: "noExitNode", params: {}, fix: "proxy" };
+  }
+  return ELIGIBLE;
+}
+
+/**
+ * Whether this profile could be launched on a remote host.
+ *
+ * A strict subset of {@link preflight}: a remote session needs the profile to
+ * exist in cloud storage in a form a host can read, and nothing more. The bot's
+ * extra requirement — an exit node — exists because a night of unattended
+ * traffic from a datacenter address is worse for the profile than not warming
+ * it, and that reasoning does not apply to a session the user is driving.
+ *
+ * Mirrors `remote_launch_profile_rules` in `api_server.rs`, which is
+ * authoritative; this only avoids offering an action that would be refused.
+ */
+export function canLaunchRemotely(profile: BrowserProfile): boolean {
+  const syncMode = profile.sync_mode ?? "Disabled";
+  if (syncMode === "Disabled" || syncMode === "Encrypted") return false;
+  return resolvedOs(profile) !== null;
+}
+
+export function preflightReason(t: TFunction, result: PreflightResult): string {
+  switch (result.code) {
+    case "syncOff":
+      return t("cookieBot.preflight.reasonSync");
+    case "encrypted":
+      return t("cookieBot.preflight.reasonEncrypted");
+    case "unknownPlatform":
+      return t("cookieBot.preflight.reasonNoFingerprint");
+    case "unsupportedPlatform":
+      return t("cookieBot.preflight.reasonCrossOs", {
+        os: result.params.os ?? "",
+      });
+    case "noExitNode":
+      return t("cookieBot.preflight.reasonNoExitNode");
+    default:
+      return "";
+  }
+}
+
+export function preflightFixLabel(
+  t: TFunction,
+  fix: PreflightResult["fix"],
+): string | null {
+  switch (fix) {
+    case "sync":
+      return t("cookieBot.preflight.fixSync");
+    case "syncSettings":
+      return t("cookieBot.preflight.fixEncrypted");
+    case "proxy":
+      return t("cookieBot.preflight.fixProxy");
+    default:
+      return null;
+  }
+}
+
+/** Turning sync on is the one repair the dialog can perform by itself. */
+export function enableProfileSync(profileId: string): Promise<void> {
+  return invoke<void>("set_profile_sync_mode", {
+    profileId,
+    syncMode: "Regular",
+  });
+}
+
+/* -------------------------------------------------------------------------- */
+/* Timezone                                                                   */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * The timezone the profile pretends to live in. The run is anchored to it so
+ * a "02:00" enrolment means 02:00 where the identity claims to be, not where
+ * the operator happens to be sitting. Falls back to this machine's zone.
+ */
+export function profileTimezone(profile: BrowserProfile): string {
+  const raw = profile.wayfern_config?.fingerprint;
+  if (raw) {
+    try {
+      const parsed = JSON.parse(raw) as WayfernFingerprintConfig;
+      if (typeof parsed.timezone === "string" && parsed.timezone.length > 0) {
+        return parsed.timezone;
+      }
+    } catch {
+      // A fingerprint we cannot parse is not an error here — the local zone is
+      // a correct, if less specific, anchor.
+    }
+  }
+  return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+}
+
+/* -------------------------------------------------------------------------- */
+/* Run + session status                                                       */
+/* -------------------------------------------------------------------------- */
+
+export type StatusTone =
+  | "success"
+  | "warning"
+  | "destructive"
+  | "muted"
+  | "live";
+
+export function runStatusTone(status: string): StatusTone {
+  switch (status) {
+    case "succeeded":
+      return "success";
+    case "running":
+    case "pending":
+      return "live";
+    case "partial":
+    case "skipped":
+      return "warning";
+    case "failed":
+      return "destructive";
+    default:
+      return "muted";
+  }
+}
+
+export function runStatusLabel(t: TFunction, status: string): string {
+  switch (status) {
+    case "pending":
+      return t("cookieBot.runStatus.pending");
+    case "running":
+      return t("cookieBot.runStatus.running");
+    case "succeeded":
+      return t("cookieBot.runStatus.succeeded");
+    case "partial":
+      return t("cookieBot.runStatus.partial");
+    case "failed":
+      return t("cookieBot.runStatus.failed");
+    case "skipped":
+      return t("cookieBot.runStatus.skipped");
+    case "cancelled":
+      return t("cookieBot.runStatus.cancelled");
+    default:
+      // The status vocabulary belongs to the server. One it adds after this
+      // build renders as itself rather than as a blank cell.
+      return status;
+  }
+}
+
+/**
+ * Every value of the server's `CookieBotOutcomeCode`, mapped to a translated
+ * sentence.
+ *
+ * The code exists so a refusal is something a user can SEE in their history.
+ * Printed raw it was a snake_case English token in ten locales: a Russian
+ * operator asking why last night did nothing read "Причина: no_capacity".
+ * A value newer than this build still falls through to its own name, which
+ * beats a blank cell, but every code the server defines today has a sentence.
+ */
+const OUTCOME_KEYS: Record<string, string> = {
+  not_entitled: "cookieBot.outcome.notEntitled",
+  sync_disabled: "cookieBot.outcome.syncDisabled",
+  encrypted_sync: "cookieBot.outcome.encryptedSync",
+  proxy_required: "cookieBot.outcome.proxyRequired",
+  touch_fingerprint: "cookieBot.outcome.touchFingerprint",
+  platform_unsupported: "cookieBot.outcome.platformUnsupported",
+  no_sites: "cookieBot.outcome.noSites",
+  quota_exhausted: "cookieBot.outcome.quotaExhausted",
+  profile_locked: "cookieBot.outcome.profileLocked",
+  no_capacity: "cookieBot.outcome.noCapacity",
+  manager_error: "cookieBot.outcome.managerError",
+  budget_exceeded: "cookieBot.outcome.budgetExceeded",
+  cancelled_by_user: "cookieBot.outcome.cancelledByUser",
+};
+
+export function outcomeLabel(
+  t: TFunction,
+  code: string | null | undefined,
+): string | null {
+  if (!code) return null;
+  const key = OUTCOME_KEYS[code];
+  return key ? t(key) : t("cookieBot.outcome.unknown", { code });
+}
+
+/**
+ * The three refusals only the saved-list routes can raise.
+ *
+ * They are absent from the shared `backendErrors` table, so
+ * `translateBackendError` renders them through its unknown-code fallback: a
+ * user who reuses a name would be told "Something went wrong:
+ * COOKIE_BOT_TEMPLATE_NAME_TAKEN" instead of that the name is taken, in the one
+ * dialog where the fix is a single keystroke. Everything else — a signed-out
+ * desktop, an unreachable cloud — still goes through the shared translator.
+ */
+const TEMPLATE_ERROR_KEYS: Record<string, string> = {
+  COOKIE_BOT_TEMPLATE_NAME_TAKEN: "cookieBot.enrol.templateNameTaken",
+  COOKIE_BOT_INVALID_TEMPLATE_NAME: "cookieBot.enrol.templateNameInvalid",
+  COOKIE_BOT_TEMPLATE_NOT_FOUND: "cookieBot.enrol.templateMissing",
+};
+
+export function templateErrorMessage(t: TFunction, error: unknown): string {
+  const parsed = parseBackendError(error);
+  const key = parsed ? TEMPLATE_ERROR_KEYS[parsed.code] : undefined;
+  if (!key) return translateBackendError(t, error);
+  const max = parsed?.params?.max;
+  // The server does not always send a limit. Interpolating an empty string
+  // rendered "a name of  characters or fewer", so fall back to wording that
+  // does not need the number.
+  if (key === "cookieBot.enrol.templateNameInvalid" && !max) {
+    return t("cookieBot.enrol.templateNameInvalidNoMax");
+  }
+  return t(key, { max });
+}
+
+/**
+ * The session state machine, named honestly. `provisioning -> ready -> live ->
+ * closed`, with `error` reachable from any of the first three, is what the
+ * backend actually reports; nothing here infers a phase the backend has not
+ * sent.
+ */
+export function sessionPhaseLabel(
+  t: TFunction,
+  session: RemoteSessionState,
+): string {
+  switch (session.state) {
+    case "provisioning":
+      return t("cookieBot.status.provisioning");
+    case "ready":
+      return t("cookieBot.status.ready");
+    case "live":
+      return t("cookieBot.status.warming");
+    case "closed":
+      return t("cookieBot.status.finished");
+    case "error":
+      return t("cookieBot.status.failed");
+    default:
+      return session.state;
+  }
+}
+
+export function sessionTone(session: RemoteSessionState): StatusTone {
+  switch (session.state) {
+    case "provisioning":
+      return "warning";
+    case "ready":
+      return "live";
+    case "live":
+      return "success";
+    case "closed":
+      return "muted";
+    // A session the fleet failed is not a session that quietly finished. It
+    // read as an untranslated `error` beside the same grey dot as an idle one,
+    // in the exact place a user checks whether last night worked.
+    case "error":
+      return "destructive";
+    default:
+      return "muted";
+  }
+}
+
+/**
+ * Why a session ended, when the backend named a reason.
+ *
+ * `close_reason` has been on the wire since the stream existed and nothing read
+ * it, so a session that hit the two-hour cap and one the user stopped looked
+ * identical.
+ */
+export function sessionCloseReason(
+  t: TFunction,
+  session: RemoteSessionState,
+): string | null {
+  switch (session.close_reason) {
+    case null:
+    case undefined:
+    case "":
+      return null;
+    case "stopped_by_user":
+      return t("cookieBot.closeReason.stoppedByUser");
+    case "max_duration":
+      return t("cookieBot.closeReason.maxDuration");
+    default:
+      // The vocabulary is the fleet's and it grows. An unknown reason still
+      // beats no reason, but it is labelled so it does not read as a sentence.
+      return t("cookieBot.closeReason.other", { reason: session.close_reason });
+  }
+}
+
+const TONE_DOT: Record<StatusTone, string> = {
+  success: "bg-success",
+  warning: "bg-warning",
+  destructive: "bg-destructive",
+  muted: "bg-muted-foreground",
+  live: "bg-warning",
+};
+
+/**
+ * The app's one status vocabulary: a bare dot, no chip and no background.
+ * `pulse` is reserved for "a transfer is in progress", exactly as the sync dots
+ * use it, so a pulsing dot always means the same thing.
+ */
+export function StatusDot({
+  tone,
+  pulse,
+  className,
+}: {
+  tone: StatusTone;
+  pulse?: boolean;
+  className?: string;
+}) {
+  return (
+    <span
+      aria-hidden="true"
+      className={cn(
+        "inline-block size-2 shrink-0 rounded-full",
+        TONE_DOT[tone],
+        pulse && "animate-pulse",
+        className,
+      )}
+    />
+  );
+}
+
+/* -------------------------------------------------------------------------- */
+/* Numbers                                                                    */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * A cookie delta. A gain reads as a gain, a loss reads with a real minus sign
+ * (U+2212, not a hyphen), and "nothing happened" reads as an em dash instead of
+ * a confident zero.
+ */
+export function CookieDelta({
+  value,
+  className,
+}: {
+  value: number | null | undefined;
+  className?: string;
+}) {
+  if (value === null || value === undefined) {
+    return (
+      <span className={cn("text-muted-foreground", className)} aria-hidden>
+        —
+      </span>
+    );
+  }
+  if (value === 0) {
+    return (
+      <span className={cn("text-muted-foreground", className)} aria-hidden>
+        —
+      </span>
+    );
+  }
+  const positive = value > 0;
+  return (
+    <span
+      className={cn(
+        "tabular-nums",
+        positive ? "text-chart-1" : "text-muted-foreground",
+        className,
+      )}
+    >
+      {positive ? `+${value}` : `−${Math.abs(value)}`}
+    </span>
+  );
+}
+
+/** One decimal, but only when it earns one: `4.7 h`, `128 h`. */
+export function formatHours(hours: number): string {
+  if (!Number.isFinite(hours)) return "0";
+  if (hours >= 100 || Number.isInteger(hours)) return String(Math.round(hours));
+  return hours.toFixed(1);
+}
+
+/* -------------------------------------------------------------------------- */
+/* Remote hours                                                               */
+/* -------------------------------------------------------------------------- */
+
+function meterFill(usedRatio: number): string {
+  if (usedRatio >= 1) return "bg-destructive";
+  if (usedRatio >= 0.9) return "bg-warning";
+  return "bg-foreground";
+}
+
+/**
+ * The hours meter. The track renders at full opacity on the first paint with
+ * the label already in place; only the numerals wait for the server. The fill
+ * is a scaleX transform with `initial={false}` so the first frame is the true
+ * value and never grows in — and the radius lives on the track, so the fill's
+ * caps cannot flip shape halfway through a change.
+ */
+export function RemoteHoursMeter({
+  quota,
+  isLoading,
+  variant = "compact",
+  className,
+}: {
+  quota: RemoteHoursQuota | null;
+  isLoading: boolean;
+  variant?: "compact" | "full" | "inline";
+  className?: string;
+}) {
+  const reduceMotion = useReducedMotion();
+  const granted = quota?.granted_hours ?? 0;
+  const used = quota?.used_hours ?? 0;
+  const remaining = quota?.remaining_hours ?? 0;
+  const ratio = granted > 0 ? Math.min(1, Math.max(0, used / granted)) : 0;
+  const resets = formatDate(quota?.period_end);
+
+  const bar = (
+    <div
+      className={cn(
+        "h-1 overflow-hidden rounded-full bg-muted",
+        variant === "compact" ? "w-32" : "w-full",
+      )}
+    >
+      <motion.div
+        initial={false}
+        animate={{ scaleX: ratio }}
+        transition={
+          reduceMotion
+            ? { duration: 0 }
+            : { duration: 0.22, ease: MOTION_EASE_OUT }
+        }
+        style={{ transformOrigin: "left", willChange: "transform" }}
+        className={cn("h-full w-full", meterFill(ratio))}
+      />
+    </div>
+  );
+
+  if (variant === "inline") {
+    return <div className={cn("w-full", className)}>{bar}</div>;
+  }
+
+  return (
+    <div className={cn("flex flex-col items-end gap-1", className)}>
+      <div className="flex items-baseline gap-1.5">
+        {isLoading ? (
+          <Skeleton className="h-3 w-24" />
+        ) : (
+          <RemoteHoursReadout
+            remaining={remaining}
+            granted={granted}
+            resets={resets}
+          />
+        )}
+      </div>
+      {bar}
+    </div>
+  );
+}
+
+function RemoteHoursReadout({
+  remaining,
+  granted,
+  resets,
+}: {
+  remaining: number;
+  granted: number;
+  resets: string | null;
+}) {
+  const { t } = useTranslation();
+  const text = t("cookieBot.hours.remaining", {
+    remaining: formatHours(remaining),
+    total: formatHours(granted),
+  });
+  if (!resets) {
+    return (
+      <span className="text-xs tabular-nums text-muted-foreground">{text}</span>
+    );
+  }
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <span className="cursor-default text-xs tabular-nums text-muted-foreground">
+          {text}
+        </span>
+      </TooltipTrigger>
+      <TooltipContent>
+        {t("cookieBot.hours.resets", { date: resets })}
+      </TooltipContent>
+    </Tooltip>
+  );
+}
+
+/* -------------------------------------------------------------------------- */
+/* Live sessions                                                              */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * A ticking wall clock, only while something is actually running. Returns
+ * `Date.now()` once a second; consumers render it into `tabular-nums` so a
+ * changing digit never reflows the row.
+ */
+export function useSecondTicker(active: boolean): number {
+  const [now, setNow] = useState(() => Date.now());
+  useEffect(() => {
+    if (!active) return;
+    setNow(Date.now());
+    const id = window.setInterval(() => {
+      setNow(Date.now());
+    }, 1000);
+    return () => {
+      window.clearInterval(id);
+    };
+  }, [active]);
+  return now;
+}
+
+/* -------------------------------------------------------------------------- */
+/* Joins                                                                      */
+/* -------------------------------------------------------------------------- */
+
+export function indexProfiles(
+  profiles: BrowserProfile[],
+): Map<string, BrowserProfile> {
+  return new Map(profiles.map((p) => [p.id, p]));
+}
+
+export function indexRunsBySession(
+  runs: CookieBotRun[],
+): Map<string, CookieBotRun> {
+  const map = new Map<string, CookieBotRun>();
+  for (const run of runs) {
+    if (run.session_id) map.set(run.session_id, run);
+  }
+  return map;
+}
+
+export function indexRunsById(runs: CookieBotRun[]): Map<string, CookieBotRun> {
+  return new Map(runs.map((run) => [run.id, run]));
+}
+
+/**
+ * The name to print for a session. The local profile record wins because it is
+ * what the operator renamed; the run row is the fallback for a teammate's
+ * profile this machine has never held.
+ */
+export function sessionDisplayName(
+  session: RemoteSessionState,
+  profiles: Map<string, BrowserProfile>,
+  run: CookieBotRun | undefined,
+): string | null {
+  if (session.profile_id) {
+    const profile = profiles.get(session.profile_id);
+    if (profile) return profile.name;
+  }
+  return run?.profile_name ?? null;
+}
+
+export function scheduleSortKey(schedule: CookieBotSchedule): number {
+  return schedule.run_at_minute;
+}
+
+/**
+ * The dot a stored enrolment gets.
+ *
+ * `blocked_by` outranks `enabled`: an armed schedule the server will refuse is
+ * not a healthy one, and showing it green with a next-run time is how a
+ * detached proxy stayed invisible until the run was skipped at 02:00.
+ */
+export function scheduleTone(schedule: CookieBotSchedule): StatusTone {
+  if (!schedule.enabled) return "muted";
+  return schedule.blocked_by ? "warning" : "success";
+}
+
+/** Why this enrolment cannot run tonight, translated, or null. */
+export function scheduleBlockedReason(
+  t: TFunction,
+  schedule: CookieBotSchedule,
+): string | null {
+  if (!schedule.enabled) return null;
+  return outcomeLabel(t, schedule.blocked_by);
+}
+
+/** Seconds a session has been alive, or null when the backend has not said. */
+export function sessionElapsedSeconds(
+  session: RemoteSessionState,
+  now: number,
+): number | null {
+  const started = parseIso(session.started_at);
+  if (!started) return null;
+  const end = parseIso(session.ended_at)?.getTime() ?? now;
+  return Math.max(0, Math.floor((end - started.getTime()) / 1000));
+}
+
+/**
+ * Whether a run's per-site counters mean anything yet.
+ *
+ * `sites_visited`, `sites_failed` and `consent_dismissed` are columns the
+ * server declares with `DEFAULT 0` and, today, nothing ever writes: the fleet
+ * computes them but donutbrowser-infra does not ingest them. Rendering the
+ * default as a fact told a paying user their run visited "0 of 12 sites" and
+ * drew a success-green progress bar pinned at zero for the whole night.
+ *
+ * So a run is only credited with counters once one of them is non-zero. Until
+ * then the UI says it does not know, which is the truth. The moment the
+ * ingestion lands this starts reporting real numbers with no further change.
+ */
+export function hasRunCounters(run: {
+  sites_visited: number;
+  sites_failed: number;
+  consent_dismissed: number;
+}): boolean {
+  return (
+    run.sites_visited > 0 || run.sites_failed > 0 || run.consent_dismissed > 0
+  );
+}
+
+/**
+ * Runs whose schedule fires on the next occurrence of their local start time.
+ * Purely a read of the server's own `next_run_at` — nothing here computes a
+ * schedule, it only sorts what the server already decided.
+ */
+export function sortByNextRun(
+  schedules: CookieBotSchedule[],
+): CookieBotSchedule[] {
+  return [...schedules].sort((a, b) => {
+    const at = parseIso(a.next_run_at)?.getTime();
+    const bt = parseIso(b.next_run_at)?.getTime();
+    if (at !== undefined && bt !== undefined) return at - bt;
+    if (at !== undefined) return -1;
+    if (bt !== undefined) return 1;
+    return scheduleSortKey(a) - scheduleSortKey(b);
+  });
+}
+
+export function useNextDue(schedules: CookieBotSchedule[]) {
+  return useMemo(() => {
+    const enabled = schedules.filter((s) => s.enabled);
+    const sorted = sortByNextRun(enabled);
+    const first = sorted[0] ?? null;
+    const firstAt = parseIso(first?.next_run_at ?? null);
+    const dueCount = firstAt
+      ? sorted.filter((s) => {
+          const at = parseIso(s.next_run_at);
+          if (!at) return false;
+          return at.getTime() - firstAt.getTime() < 12 * 60 * 60 * 1000;
+        }).length
+      : enabled.length;
+    return { next: first, nextAt: firstAt, dueCount };
+  }, [schedules]);
+}
@@ -5,6 +5,7 @@ import { useCallback, useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { GoPlus } from "react-icons/go";
 import { LuChevronLeft, LuChevronRight, LuSearch, LuX } from "react-icons/lu";
+import { useWindowDecorations } from "@/hooks/use-window-decorations";
 import { getCurrentOS } from "@/lib/browser-utils";
 import { cn } from "@/lib/utils";
 import type { GroupWithCount } from "@/types";
@@ -59,8 +60,14 @@ const HomeHeader = ({
  }, []);

  const isMacOS = platform === "macos";
+  const isLinux = platform === "linux";
  const showProfileToolbar = !pageTitle;

+  // Same hook the controls use, so the reserved space can never disagree with
+  // what is actually drawn.
+  const decorations = useWindowDecorations();
+  const linuxLayout = decorations.clientSide ? decorations.layout : null;
+
  // Press-and-hold drag: any pixel of the sys-bar becomes a drag handle after
  // HOLD_MS, but quick clicks still reach buttons/inputs underneath.
  const holdTimeoutRef = useRef<number | null>(null);
@@ -179,14 +186,29 @@ const HomeHeader = ({
      onPointerCancel={handlePointerEnd}
      onDoubleClick={handleDoubleClick}
      className={cn(
-        "flex h-11 items-center gap-2 border-b border-border bg-card pl-3 select-none",
+        "flex h-11 items-center gap-2 border-b border-border bg-card select-none",
        // Windows: WindowDragArea renders three 44px native-style controls
        // (minimize + maximize/restore + close) fixed at top-right with
        // z-50, total 132px wide. Reserve 144px on the right edge so the
        // "+ New" button and search input clear them with a few pixels of
        // breathing room and never sit underneath the controls.
-        isWindows ? "pr-[144px]" : "pr-3",
+        isWindows ? "pl-3 pr-[144px]" : null,
+        // Linux reserves its space through the inline style below, because the
+        // desktop chooses which side the controls sit on and how many there
+        // are. Everything else keeps the plain symmetric padding.
+        !isWindows && !isLinux ? "pl-3 pr-3" : null,
      )}
+      style={
+        isLinux
+          ? {
+              // Each control is 44px wide; add the usual 12px gutter. Before
+              // the layout resolves, fall back to the gutter alone rather than
+              // to no padding, which would visibly shift the content.
+              paddingLeft: (linuxLayout?.left.length ?? 0) * 44 + 12,
+              paddingRight: (linuxLayout?.right.length ?? 0) * 44 + 12,
+            }
+          : undefined
+      }
    >
      {isMacOS && (
        <div
@@ -0,0 +1,312 @@
+"use client";
+
+import { invoke } from "@tauri-apps/api/core";
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { LuTriangleAlert } from "react-icons/lu";
+import { Checkbox } from "@/components/ui/checkbox";
+import {
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { Label } from "@/components/ui/label";
+import { translateBackendError } from "@/lib/backend-errors";
+import { showErrorToast, showSuccessToast } from "@/lib/toast-utils";
+import type { ConsistencyResult, DetectedVpnExtension } from "@/types";
+import { RippleButton } from "./ui/ripple";
+
+export interface GateFindings {
+  /// Extensions that can reroute traffic. A warning: the user may proceed.
+  vpnExtensions: DetectedVpnExtension[];
+  scanState: string;
+  /// A measured exit/fingerprint mismatch. A block: the browser has not started.
+  fingerprint: ConsistencyResult | null;
+  /// A confirmed proxy-permission extension makes any exit measurement suspect.
+  measurementUnreliable: boolean;
+  /// The exit has not been measured yet; the launch itself will still check.
+  probePending: boolean;
+}
+
+export interface GateDecision {
+  proceed: boolean;
+  ackFingerprint: boolean;
+  ackExtensionKeys: string[];
+  applyToRemaining: boolean;
+}
+
+interface PreLaunchGateDialogProps {
+  isOpen: boolean;
+  profileName: string;
+  profileId: string;
+  findings: GateFindings | null;
+  /// How many further profiles are queued behind this one; >0 offers to apply
+  /// the same decision to all of them.
+  remainingCount: number;
+  /// The single exit route. Every path out of this dialog calls it exactly
+  /// once, so a caller awaiting a decision can never be left hanging.
+  onResult: (decision: GateDecision) => void;
+}
+
+export function PreLaunchGateDialog({
+  isOpen,
+  profileName,
+  profileId,
+  findings,
+  remainingCount,
+  onResult,
+}: PreLaunchGateDialogProps) {
+  const { t } = useTranslation();
+  const [ackFingerprint, setAckFingerprint] = useState(false);
+  const [ackExtensions, setAckExtensions] = useState(false);
+  const [applyToRemaining, setApplyToRemaining] = useState(false);
+  const [isMatching, setIsMatching] = useState(false);
+  // The dialog node is reused as the queue advances, so without this a double
+  // click would decide for the next profile too.
+  const [decided, setDecided] = useState(false);
+
+  // Keyed on profileId, not just isOpen: a queued gate promotes the next
+  // profile without ever closing the dialog, so an isOpen-only reset would
+  // carry the previous profile's ticked boxes — and persist an acknowledgement
+  // against a profile the user never saw.
+  useEffect(() => {
+    setAckFingerprint(false);
+    setAckExtensions(false);
+    setIsMatching(false);
+    setDecided(false);
+  }, []);
+
+  useEffect(() => {
+    if (isOpen) {
+      setApplyToRemaining(false);
+    }
+  }, [isOpen]);
+
+  const fingerprint = findings?.fingerprint ?? null;
+  const extensions = findings?.vpnExtensions ?? [];
+  const mismatches = fingerprint?.mismatches ?? [];
+  const exitIp = fingerprint?.exit_ip ?? null;
+  const isBlocked = fingerprint !== null;
+
+  const decide = (proceed: boolean) => {
+    if (decided) {
+      return;
+    }
+    setDecided(true);
+    onResult({
+      proceed,
+      ackFingerprint: ackFingerprint && isBlocked,
+      ackExtensionKeys: ackExtensions ? extensions.map((e) => e.key) : [],
+      applyToRemaining,
+    });
+  };
+
+  const handleMatchFingerprint = async () => {
+    if (!exitIp) {
+      return;
+    }
+    setIsMatching(true);
+    try {
+      await invoke("match_profile_fingerprint_to_exit", {
+        profileId,
+        exitIp,
+      });
+      showSuccessToast(t("consistencyWarning.matchSuccess"));
+      // The fingerprint the block was measured against no longer exists, so
+      // this launch is abandoned rather than forced through with a stale
+      // consent token; the user relaunches against the corrected profile.
+      decide(false);
+    } catch (e) {
+      showErrorToast(translateBackendError(t, e));
+    } finally {
+      setIsMatching(false);
+    }
+  };
+
+  const scanNotice = (() => {
+    switch (findings?.scanState) {
+      case "encrypted":
+        return t("prelaunchGate.scanIncompleteEncrypted");
+      case "ephemeral":
+        return t("prelaunchGate.scanIncompleteEphemeral");
+      case "partial":
+        return t("prelaunchGate.scanIncompletePartial");
+      case "missing":
+        return t("prelaunchGate.scanIncompleteMissing");
+      default:
+        return null;
+    }
+  })();
+
+  return (
+    <Dialog open={isOpen}>
+      <DialogContent className="sm:max-w-md" dismissible={false}>
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <LuTriangleAlert className="size-5 text-warning-text" />
+            {isBlocked
+              ? t("prelaunchGate.titleBlocked")
+              : t("prelaunchGate.titleWarning")}
+          </DialogTitle>
+        </DialogHeader>
+
+        <div className="space-y-3 text-sm">
+          <p className="text-muted-foreground">
+            {t("prelaunchGate.intro", { name: profileName })}
+          </p>
+
+          {isBlocked && (
+            <div className="space-y-2 rounded-md border border-destructive/50 bg-destructive/10 p-3">
+              <p className="font-medium">
+                {t("prelaunchGate.fingerprintHeading")}
+              </p>
+              {mismatches.includes("timezone") && (
+                <p className="text-xs text-muted-foreground">
+                  {t("consistencyWarning.timezoneDetail", {
+                    exit: fingerprint?.exit_timezone ?? "?",
+                    fingerprint: fingerprint?.fingerprint_timezone ?? "?",
+                  })}
+                </p>
+              )}
+              {mismatches.includes("language") && (
+                <p className="text-xs text-muted-foreground">
+                  {t("consistencyWarning.languageDetail", {
+                    country: fingerprint?.exit_country_code ?? "?",
+                    fingerprint: fingerprint?.fingerprint_language ?? "?",
+                  })}
+                </p>
+              )}
+              <p className="text-xs text-muted-foreground">
+                {t("consistencyWarning.explainer")}
+              </p>
+            </div>
+          )}
+
+          {extensions.length > 0 && (
+            <div className="space-y-2 rounded-md border border-warning/50 bg-warning/10 p-3">
+              <p className="font-medium">
+                {t("prelaunchGate.vpnExtensionHeading")}
+              </p>
+              <p className="text-xs text-muted-foreground">
+                {t("prelaunchGate.vpnExtensionIntro")}
+              </p>
+              <ul className="space-y-1">
+                {extensions.map((ext) => (
+                  <li key={ext.key} className="text-xs">
+                    <span className="font-medium">{ext.name}</span>
+                    <span className="text-muted-foreground">
+                      {t("prelaunchGate.vpnExtensionEntry", {
+                        version: ext.version ?? "",
+                        capability:
+                          ext.confidence === "confirmed"
+                            ? t("prelaunchGate.vpnExtensionConfirmed")
+                            : t("prelaunchGate.vpnExtensionLikely"),
+                        source:
+                          ext.source === "donut"
+                            ? t("prelaunchGate.sourceDonut")
+                            : t("prelaunchGate.sourceBrowser"),
+                      })}
+                    </span>
+                  </li>
+                ))}
+              </ul>
+              <p className="text-xs text-muted-foreground">
+                {t("prelaunchGate.vpnExtensionExplainer")}
+              </p>
+            </div>
+          )}
+
+          {findings?.measurementUnreliable && isBlocked && (
+            <p className="text-xs text-muted-foreground">
+              {t("prelaunchGate.measurementUnreliable")}
+            </p>
+          )}
+
+          {findings?.probePending && !isBlocked && (
+            <p className="text-xs text-muted-foreground">
+              {t("prelaunchGate.probePending")}
+            </p>
+          )}
+
+          {scanNotice && (
+            <p className="text-xs text-muted-foreground">{scanNotice}</p>
+          )}
+
+          <div className="space-y-2">
+            {isBlocked && (
+              <div className="flex items-center gap-x-2">
+                <Checkbox
+                  id="gate-ack-fingerprint"
+                  checked={ackFingerprint}
+                  onCheckedChange={(v) => setAckFingerprint(v === true)}
+                />
+                <Label htmlFor="gate-ack-fingerprint" className="text-xs">
+                  {t("prelaunchGate.dontBlockAgain")}
+                </Label>
+              </div>
+            )}
+            {extensions.length > 0 && (
+              <div className="flex items-center gap-x-2">
+                <Checkbox
+                  id="gate-ack-extensions"
+                  checked={ackExtensions}
+                  onCheckedChange={(v) => setAckExtensions(v === true)}
+                />
+                <Label htmlFor="gate-ack-extensions" className="text-xs">
+                  {t("prelaunchGate.dontWarnExtensions")}
+                </Label>
+              </div>
+            )}
+            {remainingCount > 0 && (
+              <div className="flex items-center gap-x-2">
+                <Checkbox
+                  id="gate-apply-remaining"
+                  checked={applyToRemaining}
+                  onCheckedChange={(v) => setApplyToRemaining(v === true)}
+                />
+                <Label htmlFor="gate-apply-remaining" className="text-xs">
+                  {t("prelaunchGate.applyToRemaining")}
+                </Label>
+              </div>
+            )}
+          </div>
+        </div>
+
+        <DialogFooter className="flex-row justify-between sm:justify-between">
+          {/* Cancel is the default action: the browser has not started, and
+              not starting it is the safe outcome. */}
+          <RippleButton
+            variant="outline"
+            onClick={() => decide(false)}
+            disabled={isMatching || decided}
+            autoFocus
+          >
+            {t("common.buttons.cancel")}
+          </RippleButton>
+          <div className="flex gap-2">
+            {isBlocked && exitIp && (
+              <RippleButton
+                variant="outline"
+                onClick={() => void handleMatchFingerprint()}
+                disabled={isMatching || decided}
+              >
+                {isMatching
+                  ? t("consistencyWarning.matching")
+                  : t("consistencyWarning.matchToProxy")}
+              </RippleButton>
+            )}
+            <RippleButton
+              variant={isBlocked ? "destructive" : "default"}
+              onClick={() => decide(true)}
+              disabled={isMatching || decided}
+            >
+              {t("prelaunchGate.launchAnyway")}
+            </RippleButton>
+          </div>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
@@ -27,6 +27,7 @@ import {
  LuCookie,
  LuInfo,
  LuLock,
+  LuMoon,
  LuPlay,
  LuPuzzle,
  LuSquare,
@@ -35,6 +36,22 @@ import {
  LuUserSearch,
  LuUsers,
 } from "react-icons/lu";
+import { CookieBotEnrolDialog } from "@/components/cookie-bot-enrol-dialog";
+import { CookieBotRunsDialog } from "@/components/cookie-bot-runs-dialog";
+import {
+  describeCadence,
+  enableProfileSync,
+  minutesToClock,
+  outcomeLabel,
+  type PreflightFix,
+  preflight,
+  preflightFixLabel,
+  preflightReason,
+  runStatusLabel,
+  StatusDot,
+  sessionPhaseLabel,
+  sessionTone,
+} from "@/components/cookie-bot-shared";
 import { DeleteConfirmationDialog } from "@/components/delete-confirmation-dialog";
 import {
  ProfileBypassRulesDialog,
@@ -57,6 +74,8 @@ import {
  DropdownMenu,
  DropdownMenuContent,
  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
  DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
 import {
@@ -80,24 +99,37 @@ import {
 } from "@/components/ui/tooltip";
 import { useBrowserState } from "@/hooks/use-browser-state";
 import { useCloudAuth } from "@/hooks/use-cloud-auth";
+import { cookieBotScopeFor, useCookieBot } from "@/hooks/use-cookie-bot";
 import { useProxyEvents } from "@/hooks/use-proxy-events";
+import { useRemoteHandoff } from "@/hooks/use-remote-handoff";
 import { useScrollFade } from "@/hooks/use-scroll-fade";
 import { useTableSorting } from "@/hooks/use-table-sorting";
 import { useTeamLocks } from "@/hooks/use-team-locks";
 import { useVpnEvents } from "@/hooks/use-vpn-events";
+import { parseBackendError, translateBackendError } from "@/lib/backend-errors";
 import {
  getBrowserDisplayName,
  getOSDisplayName,
  getProfileIcon,
  isCrossOsProfile,
 } from "@/lib/browser-utils";
+import {
+  type CookieBotSchedule,
+  cancelCookieBotRun,
+  deleteCookieBotSchedule,
+  runCookieBotNow,
+} from "@/lib/cookie-bot";
 import { DNS_BLOCKLIST_LEVELS } from "@/lib/dns-blocklist-levels";
+import { canUseCookieBot } from "@/lib/entitlements";
 import { formatRelativeTime } from "@/lib/flag-utils";
+import type { RemoteHandoffState } from "@/lib/remote-sessions";
+import { showErrorToast, showSuccessToast } from "@/lib/toast-utils";
 import { cn } from "@/lib/utils";
 import type {
  BrowserProfile,
  ExtensionGroup,
  LocationItem,
+  ProfileBotState,
  ProxyCheckResult,
  StoredProxy,
  SyncSessionInfo,
@@ -210,7 +242,7 @@ interface TableMeta {
  setLaunchingProfiles: React.Dispatch<React.SetStateAction<Set<string>>>;
  setStoppingProfiles: React.Dispatch<React.SetStateAction<Set<string>>>;
  onKillProfile: (profile: BrowserProfile) => void | Promise<void>;
-  onLaunchProfile: (profile: BrowserProfile) => void | Promise<void>;
+  onLaunchProfile: (profile: BrowserProfile) => void | Promise<unknown>;

  // Overflow actions
  onAssignProfilesToGroup?: (profileIds: string[]) => void;
@@ -243,6 +275,15 @@ interface TableMeta {
  isProfileLockedByAnother: (profileId: string) => boolean;
  getProfileLockEmail: (profileId: string) => string | undefined;

+  // Remote execution.
+  //
+  // `getRemoteHandoff` is the authoritative answer to "can this be opened
+  // here", read from the same store the backend gate reads. The team-lock cache
+  // above cannot serve it: it refreshes on a 30-second poll and says nothing at
+  // all about a session that has finished but whose work has not been pulled
+  // back yet.
+  getRemoteHandoff: (profileId: string) => RemoteHandoffState | null;
+
  // Synchronizer
  getProfileSyncInfo: (profileId: string) =>
    | {
@@ -252,8 +293,52 @@ interface TableMeta {
      }
    | undefined;
  onLaunchWithSync: (profile: BrowserProfile) => void;
+
+  // Cookie Bot
+  cookieBotUnlocked: boolean;
+  /** Narrow container: the bot column shows its state mark without the label. */
+  cookieBotCompact: boolean;
+  getProfileBotState: (profileId: string) => ProfileBotState;
+  /** A run this desktop has just asked for, before the stream confirms it. */
+  botPendingProfiles: Set<string>;
+  onBotEnrol: (profile: BrowserProfile) => void;
+  onBotEdit: (profile: BrowserProfile, schedule: CookieBotSchedule) => void;
+  onBotRunNow: (profile: BrowserProfile) => void;
+  onBotStopRun: (runId: string) => void;
+  onBotViewActivity: (profile: BrowserProfile) => void;
+  onBotUnenrol: (profile: BrowserProfile) => void;
+  /**
+   * Perform the repair a failed preflight names, or null when this surface has
+   * no way to reach it. A reason with no affordance is what the menu showed
+   * before: "No proxy or VPN · Attach a proxy" as inert label text that reads
+   * like a button and answers no click.
+   */
+  onBotFix: ((profile: BrowserProfile, fix: PreflightFix) => void) | null;
 }

+/**
+ * Below this container width the bot column keeps its state mark but drops the
+ * "next run" label: an operator still sees at a glance which rows are enrolled
+ * and which are running, and the row menu stays reachable, without taking the
+ * width the name needs.
+ */
+const BOT_LABEL_WIDTH = 880;
+
+/** Below this the bot column leaves entirely, like the other low-priority ones. */
+const BOT_COLUMN_MIN_WIDTH = 400;
+
+/** Bulk enrolments of this size or larger are confirmed, as run and stop are. */
+const BULK_ENROL_CONFIRM_THRESHOLD = 10;
+
+/**
+ * Run statuses that mean the browser never came up.
+ *
+ * `POST /cookie-bot/runs` answers 202 with the run row it recorded, so a
+ * refusal — no capacity, no sites, a profile someone else has open — arrives as
+ * a successful response carrying a terminal status.
+ */
+const RUN_DID_NOT_START = new Set(["skipped", "failed", "cancelled"]);
+
 interface SyncStatusDot {
  color: string;
  tooltip: string;
@@ -1117,9 +1202,199 @@ const NoteCell = React.memo<{

 NoteCell.displayName = "NoteCell";

+/** `HH:MM` of the server's own next-run instant, in this machine's locale. */
+function formatNextRun(schedule: CookieBotSchedule): string | null {
+  if (!schedule.next_run_at) return null;
+  const date = new Date(schedule.next_run_at);
+  if (Number.isNaN(date.getTime())) return null;
+  return date.toLocaleTimeString(undefined, {
+    hour: "2-digit",
+    minute: "2-digit",
+  });
+}
+
+/**
+ * One row's Cookie Bot state, and the row's bot actions.
+ *
+ * The whole cell is the menu trigger. A dedicated kebab would cost another
+ * column of width in a table that is already dense, and the state mark is
+ * exactly the thing an operator reaches for when they want to change it. The
+ * dot, the tone and the phase wording all come from the shared status
+ * vocabulary, so a run cannot read one way here and another on the Cookie Bot
+ * page.
+ */
+const BotCell = React.memo<{
+  profile: BrowserProfile;
+  meta: TableMeta;
+}>(({ profile, meta }) => {
+  // Own `t` rather than `meta.t`: the shared status helpers take a real
+  // `TFunction`, and every other cell in this file resolves it the same way.
+  const { t } = useTranslation();
+  const { schedule, liveSession } = meta.getProfileBotState(profile.id);
+  const check = preflight(profile);
+  const isPending = meta.botPendingProfiles.has(profile.id);
+  const isLive = liveSession !== null;
+  const nextRun = schedule ? formatNextRun(schedule) : null;
+
+  // The server computes "why tonight would be refused" on every read, precisely
+  // so a detached proxy is visible in the afternoon rather than announcing
+  // itself as a skipped run at 02:00. Dropping it left a broken enrolment
+  // showing a healthy dot and a next-run time it could never keep.
+  const blockedReason =
+    schedule?.enabled && schedule.blocked_by
+      ? outcomeLabel(t, schedule.blocked_by)
+      : null;
+
+  // `provisioning` is a transfer in progress — the one meaning the app already
+  // reserves a pulsing dot for. Nothing else pulses.
+  const isPreparing = liveSession?.state === "provisioning" || isPending;
+  const tone = liveSession
+    ? sessionTone(liveSession)
+    : isPending
+      ? "warning"
+      : schedule
+        ? schedule.enabled && !blockedReason
+          ? "muted"
+          : "warning"
+        : null;
+
+  const label = isPending
+    ? t("cookieBot.status.provisioning")
+    : liveSession
+      ? sessionPhaseLabel(t, liveSession)
+      : schedule
+        ? !schedule.enabled
+          ? t("cookieBot.state.paused")
+          : (blockedReason ?? nextRun ?? t("cookieBot.state.enrolled"))
+        : "—";
+
+  const summary = schedule
+    ? blockedReason
+      ? t("cookieBot.state.blocked", { reason: blockedReason })
+      : t("cookieBot.state.summary", {
+          cadence: describeCadence(t, schedule.days_mask),
+          time: minutesToClock(schedule.run_at_minute),
+        })
+    : check.eligible
+      ? t("cookieBot.state.notEnrolled")
+      : // The repair is its own menu item when this surface can reach it, so
+        // the label stays a statement instead of looking like a second button.
+        [
+          preflightReason(t, check),
+          meta.onBotFix ? null : preflightFixLabel(t, check.fix),
+        ]
+          .filter(Boolean)
+          .join(" · ");
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <button
+          type="button"
+          aria-label={t("cookieBot.state.rowMenu", { name: profile.name })}
+          className="flex h-9 w-full min-w-0 cursor-pointer items-center gap-1.5 rounded border-none bg-transparent px-1.5 text-left transition-colors duration-100 hover:bg-muted"
+        >
+          {tone ? (
+            <StatusDot tone={tone} pulse={isPreparing} className="size-1.5" />
+          ) : (
+            <span aria-hidden="true" className="size-1.5 shrink-0" />
+          )}
+          {!meta.cookieBotCompact && (
+            <span
+              className={cn(
+                "min-w-0 truncate text-xs tabular-nums",
+                isLive || isPending
+                  ? "text-foreground"
+                  : "text-muted-foreground",
+              )}
+            >
+              {label}
+            </span>
+          )}
+        </button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end" className="min-w-56">
+        <DropdownMenuLabel className="font-normal text-muted-foreground">
+          {summary}
+        </DropdownMenuLabel>
+        <DropdownMenuSeparator />
+        {schedule ? (
+          <>
+            <DropdownMenuItem
+              onClick={() => {
+                meta.onBotEdit(profile, schedule);
+              }}
+            >
+              {t("cookieBot.actions.editSchedule")}
+            </DropdownMenuItem>
+            {liveSession?.run_id ? (
+              <DropdownMenuItem
+                onClick={() => {
+                  if (liveSession.run_id) {
+                    meta.onBotStopRun(liveSession.run_id);
+                  }
+                }}
+              >
+                {t("cookieBot.running.stop")}
+              </DropdownMenuItem>
+            ) : (
+              <DropdownMenuItem
+                disabled={isLive || isPending}
+                onClick={() => {
+                  meta.onBotRunNow(profile);
+                }}
+              >
+                {t("cookieBot.actions.runNow")}
+              </DropdownMenuItem>
+            )}
+            <DropdownMenuItem
+              onClick={() => {
+                meta.onBotViewActivity(profile);
+              }}
+            >
+              {t("cookieBot.actions.viewActivity")}
+            </DropdownMenuItem>
+            <DropdownMenuSeparator />
+            <DropdownMenuItem
+              variant="destructive"
+              onClick={() => {
+                meta.onBotUnenrol(profile);
+              }}
+            >
+              {t("cookieBot.schedule.unenrol")}
+            </DropdownMenuItem>
+          </>
+        ) : (
+          <>
+            {!check.eligible && check.fix && meta.onBotFix && (
+              <DropdownMenuItem
+                onClick={() => {
+                  meta.onBotFix?.(profile, check.fix as PreflightFix);
+                }}
+              >
+                {preflightFixLabel(t, check.fix)}
+              </DropdownMenuItem>
+            )}
+            <DropdownMenuItem
+              disabled={!check.eligible}
+              onClick={() => {
+                meta.onBotEnrol(profile);
+              }}
+            >
+              {t("cookieBot.actions.enrol")}
+            </DropdownMenuItem>
+          </>
+        )}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+});
+
+BotCell.displayName = "BotCell";
+
 interface ProfilesDataTableProps {
  profiles: BrowserProfile[];
-  onLaunchProfile: (profile: BrowserProfile) => void | Promise<void>;
+  onLaunchProfile: (profile: BrowserProfile) => void | Promise<unknown>;
  onKillProfile: (profile: BrowserProfile) => void | Promise<void>;
  onCloneProfile: (profile: BrowserProfile) => void | Promise<void>;
  onDeleteProfile: (profile: BrowserProfile) => void | Promise<void>;
@@ -1131,6 +1406,8 @@ interface ProfilesDataTableProps {
  isUpdating: (browser: string) => boolean;
  onDeleteSelectedProfiles: (profileIds: string[]) => Promise<void>;
  onAssignProfilesToGroup: (profileIds: string[]) => void;
+  /** Opens proxy assignment for a specific set of profiles. */
+  onAssignProfilesToProxy?: (profileIds: string[]) => void;
  selectedGroupId: string | null;
  selectedProfiles: string[];
  onSelectedProfilesChange: Dispatch<SetStateAction<string[]>>;
@@ -1186,6 +1463,7 @@ export function ProfilesDataTable({
  runningProfiles,
  isUpdating,
  onAssignProfilesToGroup,
+  onAssignProfilesToProxy,
  selectedProfiles,
  onSelectedProfilesChange,
  onBulkDelete,
@@ -1318,6 +1596,40 @@ export function ProfilesDataTable({
  const { vpnConfigs } = useVpnEvents();
  const { user } = useCloudAuth();
  const { isProfileLocked, getLockInfo } = useTeamLocks(user?.id);
+  // Which profiles cannot be opened on this computer, and why. Event-driven and
+  // read from the backend's own gate, so the button state and the refusal the
+  // backend would give can never disagree.
+  const { handoffFor } = useRemoteHandoff();
+
+  // Cookie Bot. Enrolments and live runs both live server-side, so the table
+  // reads them from the shared store rather than from BrowserProfile.
+  const cookieBotUnlocked = canUseCookieBot(user);
+  const {
+    scheduleFor,
+    liveSessionFor,
+    refresh: refreshCookieBotState,
+  } = useCookieBot(cookieBotUnlocked, cookieBotScopeFor(user));
+  const [botPendingProfiles, setBotPendingProfiles] = React.useState<
+    Set<string>
+  >(new Set());
+  const [botScheduleDialog, setBotScheduleDialog] = React.useState<{
+    profiles: BrowserProfile[];
+    existing: CookieBotSchedule | null;
+  } | null>(null);
+  const [botRunsProfile, setBotRunsProfile] =
+    React.useState<BrowserProfile | null>(null);
+  const [botUnenrolProfile, setBotUnenrolProfile] =
+    React.useState<BrowserProfile | null>(null);
+  const [isUnenrolling, setIsUnenrolling] = React.useState(false);
+  const [pendingBulkEnrol, setPendingBulkEnrol] = React.useState<
+    BrowserProfile[] | null
+  >(null);
+
+  // Content columns grow proportionally with the container but never drop
+  // below the compact-layout floor; the name column takes the remainder.
+  // Computed in px from the observed container width because fixed table
+  // layout ignores max()/calc() column widths.
+  const [containerWidth, setContainerWidth] = React.useState(0);

  const [proxyOverrides, setProxyOverrides] = React.useState<
    Record<string, string | null>
@@ -1512,6 +1824,142 @@ export function ProfilesDataTable({
    [handleProxySelection],
  );

+  const getProfileBotState = React.useCallback(
+    (profileId: string): ProfileBotState => ({
+      schedule: scheduleFor(profileId),
+      liveSession: liveSessionFor(profileId),
+    }),
+    [scheduleFor, liveSessionFor],
+  );
+
+  const handleBotEnrol = React.useCallback((profile: BrowserProfile) => {
+    setBotScheduleDialog({ profiles: [profile], existing: null });
+  }, []);
+
+  const handleBotEdit = React.useCallback(
+    (profile: BrowserProfile, schedule: CookieBotSchedule) => {
+      setBotScheduleDialog({ profiles: [profile], existing: schedule });
+    },
+    [],
+  );
+
+  const handleBotViewActivity = React.useCallback((profile: BrowserProfile) => {
+    setBotRunsProfile(profile);
+  }, []);
+
+  const handleBotFix = React.useCallback(
+    (profile: BrowserProfile, fix: PreflightFix) => {
+      if (fix === "proxy") {
+        onAssignProfilesToProxy?.([profile.id]);
+        return;
+      }
+      if (fix === "syncSettings") {
+        onOpenProfileSyncDialog?.(profile);
+        return;
+      }
+      void enableProfileSync(profile.id).catch((error: unknown) => {
+        showErrorToast(
+          parseBackendError(error)
+            ? translateBackendError(t as never, error)
+            : t("cookieBot.preflight.fixFailed"),
+        );
+      });
+    },
+    [onAssignProfilesToProxy, onOpenProfileSyncDialog, t],
+  );
+
+  // Null rather than a no-op when nothing is wired: the menu then states the
+  // reason without offering a repair it cannot perform.
+  const botFixHandler =
+    onAssignProfilesToProxy || onOpenProfileSyncDialog ? handleBotFix : null;
+
+  const handleBotRunNow = React.useCallback(
+    async (profile: BrowserProfile) => {
+      // Held locally until the stream reports the session: the run is real the
+      // moment the command returns, and a row that still looks idle invites a
+      // second click that would spend a second hour.
+      setBotPendingProfiles((prev) => new Set(prev).add(profile.id));
+      try {
+        const started = await runCookieBotNow(profile.id);
+        // 202, not 200: the route answers with a RECORDED run, and a run that
+        // could not get a host comes back already terminal, carrying an
+        // `outcome_code`, rather than as an HTTP error. Treating every 2xx as
+        // "started" told a user their run had begun on a night when every
+        // Windows host in a four-slot fleet was busy, and the only trace was a
+        // row in a history panel they had to go and open.
+        if (RUN_DID_NOT_START.has(started.run.status)) {
+          showErrorToast(
+            t("cookieBot.actions.runNotStarted", {
+              reason:
+                outcomeLabel(t as never, started.run.outcome_code) ??
+                runStatusLabel(t as never, started.run.status),
+            }),
+          );
+        } else {
+          showSuccessToast(t("cookieBot.actions.runStarted"));
+        }
+        await refreshCookieBotState();
+      } catch (error) {
+        showErrorToast(translateBackendError(t as never, error));
+      } finally {
+        setBotPendingProfiles((prev) => {
+          const next = new Set(prev);
+          next.delete(profile.id);
+          return next;
+        });
+      }
+    },
+    [refreshCookieBotState, t],
+  );
+
+  const handleBotStopRun = React.useCallback(
+    async (runId: string) => {
+      try {
+        await cancelCookieBotRun(runId);
+        showSuccessToast(t("cookieBot.running.stopped"));
+        await refreshCookieBotState();
+      } catch (error) {
+        showErrorToast(translateBackendError(t as never, error));
+      }
+    },
+    [refreshCookieBotState, t],
+  );
+
+  const handleBotUnenrol = React.useCallback(async () => {
+    if (!botUnenrolProfile) return;
+    setIsUnenrolling(true);
+    try {
+      await deleteCookieBotSchedule(botUnenrolProfile.id);
+      showSuccessToast(t("cookieBot.schedule.unenrolled"));
+      setBotUnenrolProfile(null);
+      await refreshCookieBotState();
+    } catch (error) {
+      showErrorToast(translateBackendError(t as never, error));
+    } finally {
+      setIsUnenrolling(false);
+    }
+  }, [botUnenrolProfile, refreshCookieBotState, t]);
+
+  const handleBulkCookieBotEnrol = React.useCallback(() => {
+    const targets = profiles.filter((p) => selectedProfiles.includes(p.id));
+    if (targets.length === 0) return;
+    const eligible = targets.filter((p) => preflight(p).eligible);
+    // Same guard as bulk run: an action that can touch nothing says so instead
+    // of opening a dialog whose only outcome is a refusal.
+    if (eligible.length === 0) {
+      showErrorToast(t("cookieBot.actionBar.noneEligible"));
+      return;
+    }
+    // Ten or more is the threshold bulk run and stop already use, and enrolling
+    // is the heavier commitment of the three: each row books a nightly job
+    // against a shared budget.
+    if (eligible.length >= BULK_ENROL_CONFIRM_THRESHOLD) {
+      setPendingBulkEnrol(targets);
+      return;
+    }
+    setBotScheduleDialog({ profiles: targets, existing: null });
+  }, [profiles, selectedProfiles, t]);
+
  // Use shared browser state hook
  const browserState = useBrowserState(
    profiles,
@@ -2012,6 +2460,9 @@ export function ProfilesDataTable({
      getProfileLockEmail: (profileId: string) =>
        getLockInfo(profileId)?.lockedByEmail,

+      // Remote execution
+      getRemoteHandoff: handoffFor,
+
      // Synchronizer
      getProfileSyncInfo: getProfileSyncInfo ?? (() => undefined),
      onLaunchWithSync:
@@ -2019,6 +2470,23 @@ export function ProfilesDataTable({
        (() => {
          /* empty */
        }),
+
+      // Cookie Bot
+      cookieBotUnlocked,
+      cookieBotCompact: containerWidth > 0 && containerWidth < BOT_LABEL_WIDTH,
+      getProfileBotState,
+      botPendingProfiles,
+      onBotEnrol: handleBotEnrol,
+      onBotEdit: handleBotEdit,
+      onBotRunNow: (profile: BrowserProfile) => {
+        void handleBotRunNow(profile);
+      },
+      onBotStopRun: (runId: string) => {
+        void handleBotStopRun(runId);
+      },
+      onBotViewActivity: handleBotViewActivity,
+      onBotUnenrol: setBotUnenrolProfile,
+      onBotFix: botFixHandler,
    }),
    [
      t,
@@ -2074,8 +2542,19 @@ export function ProfilesDataTable({
      handleCreateCountryProxy,
      isProfileLocked,
      getLockInfo,
+      handoffFor,
      getProfileSyncInfo,
      onLaunchWithSync,
+      cookieBotUnlocked,
+      containerWidth,
+      getProfileBotState,
+      botPendingProfiles,
+      handleBotEnrol,
+      handleBotEdit,
+      handleBotRunNow,
+      handleBotStopRun,
+      handleBotViewActivity,
+      botFixHandler,
    ],
  );

@@ -2265,20 +2744,37 @@ export function ProfilesDataTable({
        cell: ({ row, table }) => {
          const meta = table.options.meta as TableMeta;
          const profile = row.original;
+          const handoff = meta.getRemoteHandoff(profile.id);
+          // A profile open on the fleet IS running, and the button has to say
+          // so: it is the control that stops it, and stopping now reaches the
+          // remote browser rather than looking for a local process that was
+          // never there.
+          const isRunningRemotely = handoff === "running";
+          const isPendingRemotePull = handoff === "pending_sync";
          const isRunning =
-            meta.isClient && meta.runningProfiles.has(profile.id);
+            (meta.isClient && meta.runningProfiles.has(profile.id)) ||
+            isRunningRemotely;
          const isLaunching = meta.launchingProfiles.has(profile.id);
          const isStopping = meta.stoppingProfiles.has(profile.id);
          const isLockedByAnother = meta.isProfileLockedByAnother(profile.id);
          const isSyncing = meta.syncStatuses[profile.id]?.status === "syncing";
-          const canLaunch =
-            meta.browserState.canLaunchProfile(profile) &&
-            !isLockedByAnother &&
-            !isSyncing;
+          // A remote session holds the profile lock under its own holder id, so
+          // `isLockedByAnother` is true for the user's OWN fleet session. That
+          // must not disable the control that stops it.
+          const canLaunch = isRunningRemotely
+            ? true
+            : meta.browserState.canLaunchProfile(profile) &&
+              !isPendingRemotePull &&
+              !isLockedByAnother &&
+              !isSyncing;
          const lockEmail = meta.getProfileLockEmail(profile.id);
-          const tooltipContent = isLockedByAnother
-            ? meta.t("sync.team.cannotLaunchLocked", { email: lockEmail })
-            : meta.browserState.getLaunchTooltipContent(profile);
+          const tooltipContent = isRunningRemotely
+            ? meta.t("profiles.remote.runningTooltip")
+            : isPendingRemotePull
+              ? meta.t("profiles.remote.pendingSyncTooltip")
+              : isLockedByAnother
+                ? meta.t("sync.team.cannotLaunchLocked", { email: lockEmail })
+                : meta.browserState.getLaunchTooltipContent(profile);

          const handleProfileStop = async (profile: BrowserProfile) => {
            meta.setStoppingProfiles((prev: Set<string>) =>
@@ -2976,6 +3472,19 @@ export function ProfilesDataTable({
          return <DnsCell profile={profile} meta={meta} />;
        },
      },
+      {
+        id: "bot",
+        size: 84,
+        header: ({ table }) => {
+          const meta = table.options.meta as TableMeta;
+          if (meta.cookieBotCompact) return null;
+          return meta.t("profiles.table.bot");
+        },
+        cell: ({ row, table }) => {
+          const meta = table.options.meta as TableMeta;
+          return <BotCell profile={row.original} meta={meta} />;
+        },
+      },
      {
        id: "sync",
        header: "",
@@ -3053,14 +3562,11 @@ export function ProfilesDataTable({
  // Low-priority columns leave the table as the container narrows (most
  // expendable first); their data stays reachable via the profile info
  // dialog. Visibility (not CSS hiding) so table-fixed reclaims the width.
+  // `bot` starts hidden and is switched on by the resize effect below. An
+  // unentitled account must never see a paid column, not even for the frame
+  // before the observer's first measurement lands.
  const [columnVisibility, setColumnVisibility] =
-    React.useState<VisibilityState>({ created_at: false });
-
-  // Content columns grow proportionally with the container but never drop
-  // below the compact-layout floor; the name column takes the remainder.
-  // Computed in px from the observed container width because fixed table
-  // layout ignores max()/calc() column widths.
-  const [containerWidth, setContainerWidth] = React.useState(0);
+    React.useState<VisibilityState>({ created_at: false, bot: false });

  const table = useReactTable({
    data: profiles,
@@ -3090,6 +3596,14 @@ export function ProfilesDataTable({
  const scrollParentRef = React.useRef<HTMLDivElement | null>(null);
  const columnWidth = React.useCallback(
    (id: string, sizePx: number) => {
+      // The bot column is the one column with two shapes: a labelled state at
+      // full width, a bare mark when the table is narrow. Taking a proportion
+      // in the compact shape would waste the space the name column needs.
+      if (id === "bot") {
+        return containerWidth > 0 && containerWidth < BOT_LABEL_WIDTH
+          ? "28px"
+          : `${Math.max(84, Math.round(containerWidth * 0.09))}px`;
+      }
      const proportions: Record<string, { pct: number; floor: number }> = {
        tags: { pct: 0.12, floor: 100 },
        note: { pct: 0.1, floor: 80 },
@@ -3120,6 +3634,10 @@ export function ProfilesDataTable({
          ext: w >= 672,
          note: w >= 576,
          tags: w >= 512,
+          // Bot state survives further down than the other content columns:
+          // by then it is a 28px mark, and it is the only place a row's
+          // enrolment and its actions can be reached.
+          bot: cookieBotUnlocked && w >= BOT_COLUMN_MIN_WIDTH,
        };
        return Object.keys(next).every((k) => prev[k] === next[k])
          ? prev
@@ -3132,7 +3650,7 @@ export function ProfilesDataTable({
    return () => {
      ro.disconnect();
    };
-  }, []);
+  }, [cookieBotUnlocked]);

  // Compact 36px row from the redesign spec; estimateSize must match the
  // actual rendered row height or virtualizer placement drifts under scroll.
@@ -3508,6 +4026,23 @@ export function ProfilesDataTable({
            <LuCookie />
          </DataTableActionBarAction>
        )}
+        <span className="relative inline-flex">
+          <DataTableActionBarAction
+            tooltip={
+              cookieBotUnlocked
+                ? t("cookieBot.actionBar.enrol")
+                : t("cookieBot.actionBar.proRequired")
+            }
+            onClick={cookieBotUnlocked ? handleBulkCookieBotEnrol : undefined}
+            disabled={!cookieBotUnlocked}
+            size="icon"
+          >
+            <LuMoon />
+          </DataTableActionBarAction>
+          {!cookieBotUnlocked && (
+            <ProBadge className="pointer-events-none absolute -top-2 -right-2" />
+          )}
+        </span>
        {onBulkDelete && (
          <DataTableActionBarAction
            tooltip={t("common.buttons.delete")}
@@ -3554,6 +4089,85 @@ export function ProfilesDataTable({
        profileId={launchHookProfile?.id ?? null}
        currentLaunchHook={launchHookProfile?.launch_hook ?? null}
      />
+      {botScheduleDialog && (
+        <CookieBotEnrolDialog
+          isOpen
+          onClose={() => {
+            setBotScheduleDialog(null);
+          }}
+          profiles={botScheduleDialog.profiles}
+          existing={botScheduleDialog.existing}
+          onOpenProfileSync={onOpenProfileSyncDialog}
+          // "A proxy or VPN is required" is the precondition most profiles
+          // fail, and without this the dialog showed the reason with no way to
+          // act on it — one-click fixable from the Cookie Bot page and a dead
+          // end from the row menu that is the primary entry point.
+          onAssignProxy={onAssignProfilesToProxy}
+          onSaved={() => {
+            // Clearing after a bulk write mirrors the other bulk actions: the
+            // selection has been acted on, and leaving it live invites a second
+            // pass over profiles that are already enrolled.
+            if (botScheduleDialog.profiles.length > 1) {
+              onSelectedProfilesChange([]);
+            }
+          }}
+        />
+      )}
+      <DeleteConfirmationDialog
+        isOpen={pendingBulkEnrol !== null}
+        onClose={() => {
+          setPendingBulkEnrol(null);
+        }}
+        onConfirm={() => {
+          if (!pendingBulkEnrol) return;
+          setBotScheduleDialog({
+            profiles: pendingBulkEnrol,
+            existing: null,
+          });
+          setPendingBulkEnrol(null);
+        }}
+        title={t("cookieBot.enrol.confirmBulkTitle", {
+          count:
+            pendingBulkEnrol?.filter((p) => preflight(p).eligible).length ?? 0,
+        })}
+        description={t("cookieBot.enrol.confirmBulkDescription", {
+          count:
+            pendingBulkEnrol?.filter((p) => preflight(p).eligible).length ?? 0,
+        })}
+        confirmButtonText={t("cookieBot.enrol.confirmBulkButton", {
+          count:
+            pendingBulkEnrol?.filter((p) => preflight(p).eligible).length ?? 0,
+        })}
+        confirmButtonVariant="default"
+        profileIds={pendingBulkEnrol
+          ?.filter((p) => preflight(p).eligible)
+          .map((p) => p.id)}
+        profiles={pendingBulkEnrol?.map((p) => ({ id: p.id, name: p.name }))}
+      />
+      <CookieBotRunsDialog
+        isOpen={botRunsProfile !== null}
+        onClose={() => {
+          setBotRunsProfile(null);
+        }}
+        profileId={botRunsProfile?.id ?? null}
+        profileName={botRunsProfile?.name}
+        onRunCancelled={() => {
+          void refreshCookieBotState();
+        }}
+      />
+      <DeleteConfirmationDialog
+        isOpen={botUnenrolProfile !== null}
+        onClose={() => {
+          setBotUnenrolProfile(null);
+        }}
+        onConfirm={handleBotUnenrol}
+        title={t("cookieBot.schedule.unenrolTitle", {
+          name: botUnenrolProfile?.name ?? "",
+        })}
+        description={t("cookieBot.schedule.unenrolDescription")}
+        confirmButtonText={t("cookieBot.schedule.unenrol")}
+        isLoading={isUnenrolling}
+      />
    </>
  );
 }
@@ -2034,8 +2034,7 @@ function SecuritySectionInline({
    }
    if (mode === "set" || mode === "change") {
      if (password.length < 8) return t("profilePassword.errors.tooShort");
-      if (password !== confirm)
-        return t("profilePassword.errors.passwordMismatch");
+      if (password !== confirm) return t("profilePassword.errors.mismatch");
    }
    return null;
  };
@@ -28,7 +28,9 @@ import {
 import { useBrowserState } from "@/hooks/use-browser-state";
 import { useProfileEvents } from "@/hooks/use-profile-events";
 import { useProxyEvents } from "@/hooks/use-proxy-events";
+import { translateBackendError } from "@/lib/backend-errors";
 import { getBrowserDisplayName, getBrowserIcon } from "@/lib/browser-utils";
+import { showErrorToast } from "@/lib/toast-utils";
 import type { BrowserProfile } from "@/types";
 import { CopyToClipboard } from "./ui/copy-to-clipboard";
 import { RippleButton } from "./ui/ripple";
@@ -108,10 +110,15 @@ export function ProfileSelectorDialog({
      await invoke("open_url_with_profile", {
        profileId: selected.id,
        url,
+        consentToken: null,
      });
      onClose();
    } catch (error) {
      console.error("Failed to open URL with profile:", error);
+      // This path reaches the browser without going through page.tsx's gate,
+      // so a launch the gate blocks surfaces here. Without a toast the deep
+      // link would simply appear to do nothing.
+      showErrorToast(translateBackendError(t, error));
    } finally {
      setIsLaunching(false);
      if (selected) {
@@ -122,7 +129,7 @@ export function ProfileSelectorDialog({
        });
      }
    }
-  }, [selectedProfile, url, onClose, profiles]);
+  }, [selectedProfile, url, onClose, profiles, t]);

  const handleCancel = useCallback(() => {
    setSelectedProfile(null);
@@ -89,6 +89,12 @@ export function ProxyFormDialog({
  const { t } = useTranslation();
  const [isSubmitting, setIsSubmitting] = useState(false);
  const [form, setForm] = useState<ProxyFormData>(DEFAULT_FORM);
+  // The local parse only covers scheme/host/port. Whether Donut can actually
+  // use the server — REALITY, XTLS Vision, plain TCP — is decided by the Rust
+  // parser, so ask it (below) and show the specific reason while the user is
+  // still editing rather than after they save. Declared here because
+  // `handleSubmit` guards on it.
+  const [vlessUnsupported, setVlessUnsupported] = useState<string | null>(null);

  const resetForm = useCallback(() => {
    setForm(DEFAULT_FORM);
@@ -134,6 +140,11 @@ export function ProxyFormDialog({
      return;
    }

+    if (isVless && vlessUnsupported) {
+      toast.error(vlessUnsupported);
+      return;
+    }
+
    if (!isVless && (!form.host.trim() || !form.port)) {
      toast.error(t("proxies.form.hostPortRequired"));
      return;
@@ -183,7 +194,7 @@ export function ProxyFormDialog({
    } finally {
      setIsSubmitting(false);
    }
-  }, [editingProxy, form, onClose, t]);
+  }, [editingProxy, form, onClose, t, vlessUnsupported]);

  const handleClose = useCallback(() => {
    if (!isSubmitting) {
@@ -193,12 +204,37 @@ export function ProxyFormDialog({

  const isVless = form.proxy_type === "vless";
  const vlessEndpoint = isVless ? parseVlessEndpoint(form.vless_uri) : null;
+
+  const trimmedVlessUri = form.vless_uri.trim();
+  useEffect(() => {
+    if (!isVless || trimmedVlessUri.length === 0) {
+      setVlessUnsupported(null);
+      return;
+    }
+    let cancelled = false;
+    const timer = window.setTimeout(() => {
+      void invoke("validate_vless_uri", { uri: trimmedVlessUri })
+        .then(() => {
+          if (!cancelled) setVlessUnsupported(null);
+        })
+        .catch((error: unknown) => {
+          if (!cancelled) setVlessUnsupported(translateBackendError(t, error));
+        });
+    }, 300);
+    return () => {
+      cancelled = true;
+      window.clearTimeout(timer);
+    };
+  }, [isVless, trimmedVlessUri, t]);
+
  const hasInvalidVlessUri =
-    isVless && form.vless_uri.trim().length > 0 && !vlessEndpoint;
+    isVless &&
+    trimmedVlessUri.length > 0 &&
+    (!vlessEndpoint || vlessUnsupported !== null);
  const isFormValid =
    form.name.trim() &&
    (isVless
-      ? vlessEndpoint !== null
+      ? vlessEndpoint !== null && vlessUnsupported === null
      : form.host.trim() &&
        form.port > 0 &&
        form.port <= 65535 &&
@@ -286,7 +322,7 @@ export function ProxyFormDialog({
                role={hasInvalidVlessUri ? "alert" : undefined}
              >
                {hasInvalidVlessUri
-                  ? t("proxies.form.vlessUriInvalid")
+                  ? (vlessUnsupported ?? t("proxies.form.vlessUriInvalid"))
                  : t("proxies.form.vlessUriHint")}
              </p>
            </div>
@@ -8,6 +8,7 @@ import { FiWifi } from "react-icons/fi";
 import { GoGear, GoKebabHorizontal } from "react-icons/go";
 import {
  LuCloud,
+  LuCookie,
  LuInfo,
  LuKeyboard,
  LuPlug,
@@ -26,6 +27,7 @@ export type AppPage =
  | "proxies"
  | "extensions"
  | "groups"
+  | "cookieBot"
  | "vpns"
  | "settings"
  | "integrations"
@@ -174,6 +176,12 @@ interface RailNavProps {
  currentPage: AppPage;
  onNavigate: (page: AppPage) => void;
  onOpenAbout: () => void;
+  /**
+   * A remote session is running right now. The Cookie Bot item carries a dot so
+   * the state is legible from every other page — an overnight job you cannot
+   * see from where you are standing may as well not be observable at all.
+   */
+  cookieBotRunning?: boolean;
 }

 /** Shared-element indicator that slides between the active rail items. */
@@ -199,6 +207,7 @@ const TOP_ITEMS: RailItem[] = [
  { page: "proxies", Icon: FiWifi, labelKey: "rail.network" },
  { page: "extensions", Icon: LuPuzzle, labelKey: "rail.extensions" },
  { page: "groups", Icon: LuUsers, labelKey: "rail.groups" },
+  { page: "cookieBot", Icon: LuCookie, labelKey: "rail.cookieBot" },
  { page: "integrations", Icon: LuPlug, labelKey: "rail.integrations" },
  { page: "account", Icon: LuCloud, labelKey: "rail.account" },
 ];
@@ -229,6 +238,7 @@ export function RailNav({
  currentPage,
  onNavigate,
  onOpenAbout,
+  cookieBotRunning = false,
 }: RailNavProps) {
  const { t } = useTranslation();
  const [moreOpen, setMoreOpen] = useState(false);
@@ -325,9 +335,19 @@ export function RailNav({
                >
                  {active && <ActiveIndicator />}
                  <Icon className="size-3.5" />
+                  {page === "cookieBot" && cookieBotRunning && (
+                    <span
+                      aria-hidden="true"
+                      className="absolute top-1 right-1 size-1.5 rounded-full bg-success"
+                    />
+                  )}
                </button>
              </TooltipTrigger>
-              <TooltipContent side="right">{t(labelKey)}</TooltipContent>
+              <TooltipContent side="right">
+                {page === "cookieBot" && cookieBotRunning
+                  ? t("rail.cookieBotRunning")
+                  : t(labelKey)}
+              </TooltipContent>
            </Tooltip>
          );
        })}
@@ -73,6 +73,8 @@ interface AppSettings {
  api_token?: string;
  disable_auto_updates?: boolean;
  keep_decrypted_profiles_in_ram?: boolean;
+  fingerprint_gate_disabled?: boolean;
+  vpn_extension_warning_disabled?: boolean;
 }

 interface CustomThemeState {
@@ -127,15 +129,6 @@ export function SettingsDialog({
  const [isSettingDefault, setIsSettingDefault] = useState(false);
  const [isClearingCache, setIsClearingCache] = useState(false);
  const [isClearingTraffic, setIsClearingTraffic] = useState(false);
-  const [consistencyWarningEnabled, setConsistencyWarningEnabled] = useState(
-    () => {
-      try {
-        return localStorage.getItem("consistency-warn-disabled") !== "1";
-      } catch {
-        return true;
-      }
-    },
-  );
  const [permissions, setPermissions] = useState<PermissionInfo[]>([]);
  const [isLoadingPermissions, setIsLoadingPermissions] = useState(false);
  const [requestingPermission, setRequestingPermission] =
@@ -267,9 +260,28 @@ export function SettingsDialog({
            ? normalizeThemeColors(appSettings.custom_theme)
            : tokyoNightTheme.colors,
      };
-      setSettings(merged);
-      setOriginalSettings(merged);
-      originalSettingsRef.current = merged;
+      // One-shot migration off the old localStorage flag. Without it, a user
+      // who explicitly turned the warning off would start getting hard blocks
+      // after updating — the single most likely support complaint here.
+      let migrated = merged;
+      try {
+        if (
+          localStorage.getItem("consistency-warn-disabled") === "1" &&
+          !merged.fingerprint_gate_disabled
+        ) {
+          migrated = { ...merged, fingerprint_gate_disabled: true };
+          await invoke<AppSettings>("save_app_settings", {
+            settings: migrated,
+          });
+        }
+        localStorage.removeItem("consistency-warn-disabled");
+      } catch (err) {
+        console.warn("Failed to migrate consistency warning preference:", err);
+      }
+
+      setSettings(migrated);
+      setOriginalSettings(migrated);
+      originalSettingsRef.current = migrated;
      hasLoadedSettingsRef.current = true;
      setHasLoadedSettings(true);

@@ -687,7 +699,11 @@ export function SettingsDialog({
    (settings.theme !== "custom" &&
      JSON.stringify(settings.custom_theme ?? {}) !==
        JSON.stringify(originalSettings.custom_theme ?? {})) ||
-    settings.disable_auto_updates !== originalSettings.disable_auto_updates;
+    settings.disable_auto_updates !== originalSettings.disable_auto_updates ||
+    settings.fingerprint_gate_disabled !==
+      originalSettings.fingerprint_gate_disabled ||
+    settings.vpn_extension_warning_disabled !==
+      originalSettings.vpn_extension_warning_disabled;

  return (
    <>
@@ -1392,21 +1408,32 @@ export function SettingsDialog({
                  </div>
                  <AnimatedSwitch
                    aria-label={t("settings.privacy.consistencyWarning")}
-                    checked={consistencyWarningEnabled}
+                    checked={!(settings.fingerprint_gate_disabled ?? false)}
                    onCheckedChange={(v) => {
-                      setConsistencyWarningEnabled(v === true);
-                      try {
-                        if (v === true) {
-                          localStorage.removeItem("consistency-warn-disabled");
-                        } else {
-                          localStorage.setItem(
-                            "consistency-warn-disabled",
-                            "1",
-                          );
-                        }
-                      } catch {
-                        // localStorage unavailable
-                      }
+                      updateSetting("fingerprint_gate_disabled", v !== true);
+                    }}
+                  />
+                </div>
+
+                <div className="flex items-start justify-between gap-x-3 rounded-lg border p-3">
+                  <div className="min-w-0 flex-1">
+                    <span className="text-sm font-medium">
+                      {t("settings.privacy.vpnExtensionWarning")}
+                    </span>
+                    <span className="block text-xs text-muted-foreground">
+                      {t("settings.privacy.vpnExtensionWarningDescription")}
+                    </span>
+                  </div>
+                  <AnimatedSwitch
+                    aria-label={t("settings.privacy.vpnExtensionWarning")}
+                    checked={
+                      !(settings.vpn_extension_warning_disabled ?? false)
+                    }
+                    onCheckedChange={(v) => {
+                      updateSetting(
+                        "vpn_extension_warning_disabled",
+                        v !== true,
+                      );
                    }}
                  />
                </div>
@@ -0,0 +1,470 @@
+"use client";
+
+import { motion, useReducedMotion } from "motion/react";
+import * as React from "react";
+import { useTranslation } from "react-i18next";
+import {
+  Area,
+  AreaChart,
+  CartesianGrid,
+  ResponsiveContainer,
+  Tooltip,
+  XAxis,
+  YAxis,
+} from "recharts";
+import type {
+  NameType,
+  ValueType,
+} from "recharts/types/component/DefaultTooltipContent";
+import type { TooltipContentProps } from "recharts/types/component/Tooltip";
+import { formatHours, RemoteHoursMeter } from "@/components/cookie-bot-shared";
+import { AnimatedDisclosureItem } from "@/components/ui/animated-disclosure";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { Skeleton } from "@/components/ui/skeleton";
+import { translateBackendError } from "@/lib/backend-errors";
+import {
+  type CookieBotUsage,
+  type CookieBotUsageMember,
+  getCookieBotUsage,
+  type RemoteHoursQuota,
+} from "@/lib/cookie-bot";
+import { MOTION_EASE_OUT } from "@/lib/motion";
+import { cn } from "@/lib/utils";
+
+/** How many past billing periods the selector offers. */
+const PERIOD_COUNT = 6;
+
+function periodKey(date: Date): string {
+  return `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, "0")}`;
+}
+
+function recentPeriods(): { value: string; label: string }[] {
+  const now = new Date();
+  return Array.from({ length: PERIOD_COUNT }, (_, index) => {
+    const date = new Date(now.getFullYear(), now.getMonth() - index, 1);
+    return {
+      value: periodKey(date),
+      label: date.toLocaleDateString(undefined, {
+        month: "long",
+        year: "numeric",
+      }),
+    };
+  });
+}
+
+/** The part of an address that identifies the person, for a dense axis. */
+function shortName(email: string): string {
+  const local = email.split("@")[0] ?? email;
+  return local.length > 14 ? `${local.slice(0, 13)}…` : local;
+}
+
+interface MemberDatum {
+  name: string;
+  email: string;
+  bot: number;
+  interactive: number;
+  total: number;
+  runs: number;
+  /** How many of those runs did not do what they were asked. */
+  runsFailed: number;
+  sessions: number;
+}
+
+interface TeamUsagePanelProps {
+  /**
+   * The live pooled budget. Only used before the selected period's own figures
+   * arrive, so the block is never empty on first paint; once `usage` lands the
+   * period's numbers win, because looking at June must show what June allowed
+   * rather than what is left today.
+   */
+  quota?: RemoteHoursQuota | null;
+  className?: string;
+}
+
+/**
+ * Who spent the pooled remote hours this period.
+ *
+ * The account page owns plan truth — what was bought — and this is the other
+ * half of that: what it was spent on and by whom. Every figure is served; the
+ * desktop computes no allowance and no share of one.
+ */
+export function TeamUsagePanel({ quota, className }: TeamUsagePanelProps) {
+  const { t } = useTranslation();
+  const reduceMotion = useReducedMotion();
+  const periods = React.useMemo(() => recentPeriods(), []);
+  const [period, setPeriod] = React.useState(periods[0].value);
+  const [usage, setUsage] = React.useState<CookieBotUsage | null>(null);
+  const [isLoading, setIsLoading] = React.useState(true);
+  const [error, setError] = React.useState<string | null>(null);
+
+  React.useEffect(() => {
+    let active = true;
+    setIsLoading(true);
+    setError(null);
+    void getCookieBotUsage(period)
+      .then((result) => {
+        if (active) setUsage(result);
+      })
+      .catch((err: unknown) => {
+        if (active) {
+          setUsage(null);
+          setError(translateBackendError(t as never, err));
+        }
+      })
+      .finally(() => {
+        if (active) setIsLoading(false);
+      });
+    return () => {
+      active = false;
+    };
+  }, [period, t]);
+
+  // Heaviest first: the whole point of the view is to make the biggest
+  // consumer the first thing read, both in the chart and in the table.
+  const members: MemberDatum[] = React.useMemo(() => {
+    if (!usage) return [];
+    return [...usage.members]
+      .sort(
+        (a: CookieBotUsageMember, b: CookieBotUsageMember) =>
+          b.used_hours - a.used_hours,
+      )
+      .map((member) => ({
+        name: shortName(member.email),
+        email: member.email,
+        bot: member.bot_hours,
+        interactive: member.interactive_hours,
+        total: member.used_hours,
+        runs: member.bot_runs,
+        runsFailed: member.bot_runs_failed,
+        sessions: member.sessions,
+      }));
+  }, [usage]);
+
+  const heaviest = members[0]?.total ?? 0;
+  const isSolo = members.length <= 1;
+
+  // The meter takes a quota shape; the usage response carries the same numbers
+  // for the period being looked at, so it is adapted rather than
+  // re-implemented. The live quota is only the stand-in until it arrives.
+  const pooled: RemoteHoursQuota | null = React.useMemo(
+    () =>
+      usage
+        ? {
+            granted_hours: usage.granted_hours,
+            used_hours: usage.used_hours,
+            remaining_hours: usage.remaining_hours,
+            period_start: usage.period_start,
+            period_end: usage.period_end,
+            team_id: usage.team_id,
+            seats: usage.seats,
+            per_seat_hours: 0,
+            members: [],
+          }
+        : (quota ?? null),
+    [usage, quota],
+  );
+
+  const renderTooltip = React.useCallback(
+    ({ active, payload }: TooltipContentProps<ValueType, NameType>) => {
+      if (!active || !payload || payload.length === 0) return null;
+      const datum = payload[0].payload as MemberDatum;
+      return (
+        <div className="rounded-md border border-border bg-popover px-2.5 py-2 text-xs text-popover-foreground shadow-sm">
+          <p className="font-medium">{datum.email}</p>
+          <p className="mt-1 flex items-center justify-between gap-4 tabular-nums">
+            <span className="text-chart-1">
+              {t("cookieBot.team.legendBot")}
+            </span>
+            <span>
+              {t("cookieBot.team.hours", { hours: formatHours(datum.bot) })}
+            </span>
+          </p>
+          <p className="flex items-center justify-between gap-4 tabular-nums">
+            <span className="text-chart-2">
+              {t("cookieBot.team.legendInteractive")}
+            </span>
+            <span>
+              {t("cookieBot.team.hours", {
+                hours: formatHours(datum.interactive),
+              })}
+            </span>
+          </p>
+        </div>
+      );
+    },
+    [t],
+  );
+
+  return (
+    <div className={cn("flex flex-col gap-3", className)}>
+      <div className="flex items-center justify-between gap-3">
+        <h3 className="text-sm font-medium">{t("cookieBot.team.title")}</h3>
+        <Select
+          value={period}
+          onValueChange={(value) => {
+            setPeriod(value);
+          }}
+        >
+          <SelectTrigger className="h-8 w-[150px]">
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            {periods.map((item) => (
+              <SelectItem key={item.value} value={item.value}>
+                {item.label}
+              </SelectItem>
+            ))}
+          </SelectContent>
+        </Select>
+      </div>
+
+      {/* Driven by the selected period's own figures, not by the live quota:
+          choosing June must show what June was allowed, not what is left
+          today. */}
+      <div className="flex flex-col gap-1.5">
+        {pooled ? (
+          <p className="text-xs tabular-nums text-muted-foreground">
+            {t("cookieBot.team.pooled", {
+              used: formatHours(pooled.used_hours),
+              total: formatHours(pooled.granted_hours),
+              // `count` (not `seats`) so i18next can pluralise: "1 seat" and
+              // "across 4 seats" are different sentences in most locales.
+              count: pooled.seats,
+            })}
+          </p>
+        ) : (
+          <Skeleton className="h-3 w-56" />
+        )}
+        <RemoteHoursMeter
+          quota={pooled}
+          isLoading={isLoading && usage === null}
+          variant="inline"
+        />
+      </div>
+
+      {error ? (
+        <p className="py-6 text-center text-xs text-destructive-text">
+          {error}
+        </p>
+      ) : isLoading && !usage ? (
+        <div className="space-y-2">
+          <Skeleton className="h-[180px] w-full" />
+          <Skeleton className="h-6 w-full" />
+          <Skeleton className="h-6 w-full" />
+        </div>
+      ) : members.length === 0 ? (
+        <p className="py-6 text-center text-xs text-muted-foreground">
+          {t("cookieBot.team.noActivity")}
+        </p>
+      ) : (
+        <>
+          {!isSolo && (
+            <>
+              <div className="h-[clamp(160px,22vh,240px)] w-full">
+                <ResponsiveContainer
+                  width="100%"
+                  height="100%"
+                  minWidth={1}
+                  minHeight={1}
+                >
+                  <AreaChart
+                    data={members}
+                    margin={{ top: 8, right: 8, bottom: 0, left: 0 }}
+                  >
+                    <defs>
+                      <linearGradient
+                        id="cookieBotHoursGradient"
+                        x1="0"
+                        y1="0"
+                        x2="0"
+                        y2="1"
+                      >
+                        <stop
+                          offset="0%"
+                          stopColor="var(--chart-1)"
+                          stopOpacity={0.5}
+                        />
+                        <stop
+                          offset="100%"
+                          stopColor="var(--chart-1)"
+                          stopOpacity={0.1}
+                        />
+                      </linearGradient>
+                      <linearGradient
+                        id="interactiveHoursGradient"
+                        x1="0"
+                        y1="0"
+                        x2="0"
+                        y2="1"
+                      >
+                        <stop
+                          offset="0%"
+                          stopColor="var(--chart-2)"
+                          stopOpacity={0.5}
+                        />
+                        <stop
+                          offset="100%"
+                          stopColor="var(--chart-2)"
+                          stopOpacity={0.1}
+                        />
+                      </linearGradient>
+                    </defs>
+                    <CartesianGrid
+                      strokeDasharray="3 3"
+                      className="stroke-muted"
+                    />
+                    <XAxis
+                      dataKey="name"
+                      className="text-xs"
+                      tick={{ fill: "var(--muted-foreground)" }}
+                      interval={0}
+                    />
+                    <YAxis
+                      className="text-xs"
+                      tick={{ fill: "var(--muted-foreground)" }}
+                      width={40}
+                    />
+                    <Tooltip content={renderTooltip} />
+                    {/* `linear` because the axis is a ranking, not time: a
+                        monotone curve would invent values between people. */}
+                    <Area
+                      type="linear"
+                      dataKey="bot"
+                      stackId="1"
+                      stroke="var(--chart-1)"
+                      fill="url(#cookieBotHoursGradient)"
+                      strokeWidth={1.5}
+                      isAnimationActive={false}
+                    />
+                    <Area
+                      type="linear"
+                      dataKey="interactive"
+                      stackId="1"
+                      stroke="var(--chart-2)"
+                      fill="url(#interactiveHoursGradient)"
+                      strokeWidth={1.5}
+                      isAnimationActive={false}
+                    />
+                  </AreaChart>
+                </ResponsiveContainer>
+              </div>
+
+              <div className="flex items-center justify-center gap-6">
+                <div className="flex items-center gap-2">
+                  <div
+                    className="size-2.5 rounded"
+                    style={{ backgroundColor: "var(--chart-1)" }}
+                  />
+                  <span className="text-xs text-muted-foreground">
+                    {t("cookieBot.team.legendBot")}
+                  </span>
+                </div>
+                <div className="flex items-center gap-2">
+                  <div
+                    className="size-2.5 rounded"
+                    style={{ backgroundColor: "var(--chart-2)" }}
+                  />
+                  <span className="text-xs text-muted-foreground">
+                    {t("cookieBot.team.legendInteractive")}
+                  </span>
+                </div>
+              </div>
+            </>
+          )}
+
+          {isSolo && (
+            <p className="text-xs text-muted-foreground">
+              {t("cookieBot.team.soloNote")}
+            </p>
+          )}
+
+          <div className="overflow-hidden rounded-md border border-border">
+            <div className="grid grid-cols-[1fr_auto_auto_5rem] items-center gap-3 border-b border-border bg-muted/40 px-3 py-1.5 text-[10px] tracking-wide text-muted-foreground uppercase">
+              <span>{t("cookieBot.team.columnMember")}</span>
+              <span className="text-right">
+                {t("cookieBot.team.columnRuns")}
+              </span>
+              <span className="text-right">
+                {t("cookieBot.team.columnHours")}
+              </span>
+              <span className="text-right">
+                {t("cookieBot.team.columnShare")}
+              </span>
+            </div>
+            {members.map((member, index) => (
+              // The ranking genuinely re-orders when the period changes, so the
+              // rows travel to their new places instead of teleporting. Layout
+              // only — the row is fully rendered and readable on first paint.
+              <AnimatedDisclosureItem
+                key={member.email}
+                className="grid grid-cols-[1fr_auto_auto_5rem] items-center gap-3 px-3 py-1.5 text-xs"
+              >
+                <span
+                  className={cn(
+                    "min-w-0 truncate",
+                    index === 0 ? "font-medium text-foreground" : "",
+                  )}
+                  title={member.email}
+                >
+                  {member.email}
+                </span>
+                {/* The failure count is already on the wire and answers the
+                    question the run count cannot: whether the hours bought
+                    anything. */}
+                <span className="text-right tabular-nums text-muted-foreground">
+                  {member.runs}
+                  {member.runsFailed > 0 && (
+                    <span className="ml-1 text-warning-text">
+                      {t("cookieBot.team.runsFailed", {
+                        n: member.runsFailed,
+                      })}
+                    </span>
+                  )}
+                </span>
+                <span
+                  className={cn(
+                    "text-right tabular-nums",
+                    index === 0
+                      ? "font-semibold text-foreground"
+                      : "text-muted-foreground",
+                  )}
+                >
+                  {t("cookieBot.team.hours", {
+                    hours: formatHours(member.total),
+                  })}
+                </span>
+                <span className="h-1 overflow-hidden rounded-full bg-muted">
+                  {/* Radius on the track, scale on the fill: a rounded cap that
+                      is being scaled flips shape mid-transition. `initial=
+                      {false}` keeps the first paint at the true share. */}
+                  <motion.span
+                    initial={false}
+                    animate={{
+                      scaleX: heaviest > 0 ? member.total / heaviest : 0,
+                    }}
+                    transition={
+                      reduceMotion
+                        ? { duration: 0 }
+                        : { duration: 0.22, ease: MOTION_EASE_OUT }
+                    }
+                    style={{ transformOrigin: "left", willChange: "transform" }}
+                    className={cn(
+                      "block h-full w-full rounded-full",
+                      index === 0 ? "bg-foreground" : "bg-muted-foreground",
+                    )}
+                  />
+                </span>
+              </AnimatedDisclosureItem>
+            ))}
+          </div>
+        </>
+      )}
+    </div>
+  );
+}
@@ -3,19 +3,23 @@
 import { getCurrentWindow } from "@tauri-apps/api/window";
 import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
+import { useWindowDecorations } from "@/hooks/use-window-decorations";
 import { getCurrentOS, type OperatingSystem } from "@/lib/platform";
+import type { WindowControl } from "@/lib/window-decorations";
+import { WindowResizeHandles } from "./window-resize-handles";

 export function WindowDragArea() {
  const { t } = useTranslation();
  const [platform, setPlatform] = useState<OperatingSystem | null>(null);
  const [isMaximized, setIsMaximized] = useState(false);
+  const decorations = useWindowDecorations();

  useEffect(() => {
    setPlatform(getCurrentOS());
  }, []);

  useEffect(() => {
-    if (platform !== "windows") return;
+    if (platform !== "windows" && platform !== "linux") return;
    const win = getCurrentWindow();
    let cancelled = false;
    const sync = async () => {
@@ -38,42 +42,6 @@ export function WindowDragArea() {
    };
  }, [platform]);

-  const handlePointerDown = (e: React.PointerEvent) => {
-    if (e.button !== 0) return;
-    e.preventDefault();
-    e.stopPropagation();
-
-    const startDrag = async () => {
-      try {
-        const window = getCurrentWindow();
-        await window.startDragging();
-      } catch (error) {
-        console.error("Failed to start window dragging:", error);
-      }
-    };
-
-    void startDrag();
-  };
-
-  // Linux: system decorations handle everything
-  if (!platform || platform === "linux" || platform === "unknown") {
-    return null;
-  }
-
-  // macOS: nothing to render here. The transparent native titlebar (set via
-  // `set_transparent_titlebar(true)` in src-tauri/src/lib.rs) lets the OS
-  // handle dragging directly, and the sys-bar inside `home-header.tsx`
-  // declares its own `data-tauri-drag-region` overlay for the WebView area.
-  // The previous full-width fixed z-[999999] button was stealing every
-  // click in the top 40px of the window.
-  if (platform === "macos") {
-    return null;
-  }
-
-  // Windows: minimize/maximize/close controls anchored at the top-right
-  // corner of the sys-bar. The HomeHeader's own drag-region overlay handles window
-  // dragging via Tauri 2, so we don't need a separate draggable spacer
-  // covering the whole width.
  const handleMinimize = async () => {
    try {
      await getCurrentWindow().minimize();
@@ -97,93 +65,172 @@ export function WindowDragArea() {
      console.error("Failed to close window:", error);
    }
  };
-  void handlePointerDown; // kept for backwards-compat; not used on Windows now

+  const renderControl = (control: WindowControl) => {
+    switch (control) {
+      case "minimize":
+        return (
+          <button
+            key="minimize"
+            type="button"
+            onClick={() => {
+              void handleMinimize();
+            }}
+            className="flex h-full w-11 items-center justify-center text-muted-foreground transition-colors hover:bg-muted/50 hover:text-foreground"
+            aria-label={t("common.window.minimize")}
+          >
+            <svg
+              width="10"
+              height="1"
+              viewBox="0 0 10 1"
+              fill="currentColor"
+              role="img"
+              aria-label={t("common.window.minimize")}
+            >
+              <rect width="10" height="1" />
+            </svg>
+          </button>
+        );
+      case "maximize":
+        return (
+          <button
+            key="maximize"
+            type="button"
+            onClick={() => {
+              void handleToggleMaximize();
+            }}
+            className="flex h-full w-11 items-center justify-center text-muted-foreground transition-colors hover:bg-muted/50 hover:text-foreground"
+            aria-label={
+              isMaximized
+                ? t("common.window.restore")
+                : t("common.window.maximize")
+            }
+          >
+            {isMaximized ? (
+              <svg
+                width="10"
+                height="10"
+                viewBox="0 0 10 10"
+                fill="none"
+                stroke="currentColor"
+                strokeWidth="1.2"
+                role="img"
+                aria-label={t("common.window.restore")}
+              >
+                <rect x="1" y="3" width="6" height="6" />
+                <path d="M3 3 V1 H9 V7 H7" />
+              </svg>
+            ) : (
+              <svg
+                width="10"
+                height="10"
+                viewBox="0 0 10 10"
+                fill="none"
+                stroke="currentColor"
+                strokeWidth="1.2"
+                role="img"
+                aria-label={t("common.window.maximize")}
+              >
+                <rect x="1" y="1" width="8" height="8" />
+              </svg>
+            )}
+          </button>
+        );
+      case "close":
+        return (
+          <button
+            key="close"
+            type="button"
+            onClick={() => {
+              void handleClose();
+            }}
+            className="flex h-full w-11 items-center justify-center text-muted-foreground transition-colors hover:bg-destructive hover:text-destructive-foreground"
+            aria-label={t("common.window.close")}
+          >
+            <svg
+              width="10"
+              height="10"
+              viewBox="0 0 10 10"
+              fill="none"
+              stroke="currentColor"
+              strokeWidth="1.2"
+              role="img"
+              aria-label={t("common.window.close")}
+            >
+              <line x1="1" y1="1" x2="9" y2="9" />
+              <line x1="9" y1="1" x2="1" y2="9" />
+            </svg>
+          </button>
+        );
+    }
+  };
+
+  if (!platform || platform === "unknown") {
+    return null;
+  }
+
+  // macOS: nothing to render here. The transparent native titlebar (set via
+  // `set_transparent_titlebar(true)` in src-tauri/src/lib.rs) lets the OS
+  // handle dragging directly, and the sys-bar inside `home-header.tsx`
+  // declares its own `data-tauri-drag-region` overlay for the WebView area.
+  // The previous full-width fixed z-[999999] button was stealing every
+  // click in the top 40px of the window.
+  if (platform === "macos") {
+    return null;
+  }
+
+  // Linux: the window has no server-side decorations, so the app owns both the
+  // controls and the resize edges. Which buttons appear and on which side is a
+  // desktop-wide preference (GNOME's `button-layout`, KWin's decoration
+  // settings), read through GTK so both environments are honored.
+  if (platform === "linux") {
+    // Not resolved yet, or the session keeps server-side decorations (KDE on
+    // Wayland — see `use_client_side_decorations` in the backend). Either way
+    // there is a real titlebar and nothing for the app to draw.
+    if (!decorations.resolved || !decorations.clientSide) {
+      return null;
+    }
+    const { layout } = decorations;
+    return (
+      <>
+        {/* Dropping decorations also drops the compositor's drop shadow, and
+            neither Tauri nor tao exposes a Linux shadow API. Without some edge
+            the window is invisible against a similarly coloured desktop, so
+            draw a hairline. Not rounded: that needs a transparent window, which
+            would conflict with the WebView and the resize strips. */}
+        {!isMaximized && (
+          <div
+            aria-hidden="true"
+            className="pointer-events-none fixed inset-0 z-[99999] border border-border"
+          />
+        )}
+        <WindowResizeHandles isMaximized={isMaximized} />
+        {layout.left.length > 0 && (
+          <div className="fixed top-0 left-0 z-[100000] flex h-11 items-center select-none pointer-events-auto">
+            {layout.left.map(renderControl)}
+          </div>
+        )}
+        {layout.right.length > 0 && (
+          <div className="fixed top-0 right-0 z-[100000] flex h-11 items-center select-none pointer-events-auto">
+            {layout.right.map(renderControl)}
+          </div>
+        )}
+      </>
+    );
+  }
+
+  // Windows: minimize/maximize/close controls anchored at the top-right
+  // corner of the sys-bar. The HomeHeader's own drag-region overlay handles
+  // window dragging via Tauri 2, so we don't need a separate draggable spacer
+  // covering the whole width.
  return (
    <div
      className="fixed top-0 right-0 z-50 flex h-11 items-center select-none"
      aria-hidden="false"
    >
-      <button
-        type="button"
-        onClick={() => {
-          void handleMinimize();
-        }}
-        className="flex h-full w-11 items-center justify-center text-muted-foreground transition-colors hover:bg-muted/50 hover:text-foreground"
-        aria-label={t("common.window.minimize")}
-      >
-        <svg
-          width="10"
-          height="1"
-          viewBox="0 0 10 1"
-          fill="currentColor"
-          role="img"
-          aria-label={t("common.window.minimize")}
-        >
-          <rect width="10" height="1" />
-        </svg>
-      </button>
-      <button
-        type="button"
-        onClick={() => {
-          void handleToggleMaximize();
-        }}
-        className="flex h-full w-11 items-center justify-center text-muted-foreground transition-colors hover:bg-muted/50 hover:text-foreground"
-        aria-label={
-          isMaximized ? t("common.window.restore") : t("common.window.maximize")
-        }
-      >
-        {isMaximized ? (
-          <svg
-            width="10"
-            height="10"
-            viewBox="0 0 10 10"
-            fill="none"
-            stroke="currentColor"
-            strokeWidth="1.2"
-            role="img"
-            aria-label={t("common.window.restore")}
-          >
-            <rect x="1" y="3" width="6" height="6" />
-            <path d="M3 3 V1 H9 V7 H7" />
-          </svg>
-        ) : (
-          <svg
-            width="10"
-            height="10"
-            viewBox="0 0 10 10"
-            fill="none"
-            stroke="currentColor"
-            strokeWidth="1.2"
-            role="img"
-            aria-label={t("common.window.maximize")}
-          >
-            <rect x="1" y="1" width="8" height="8" />
-          </svg>
-        )}
-      </button>
-      <button
-        type="button"
-        onClick={() => {
-          void handleClose();
-        }}
-        className="flex h-full w-11 items-center justify-center text-muted-foreground transition-colors hover:bg-destructive hover:text-destructive-foreground"
-        aria-label={t("common.buttons.close")}
-      >
-        <svg
-          width="10"
-          height="10"
-          viewBox="0 0 10 10"
-          fill="none"
-          stroke="currentColor"
-          strokeWidth="1.2"
-          role="img"
-          aria-label={t("common.buttons.close")}
-        >
-          <line x1="1" y1="1" x2="9" y2="9" />
-          <line x1="9" y1="1" x2="1" y2="9" />
-        </svg>
-      </button>
+      {(["minimize", "maximize", "close"] as WindowControl[]).map(
+        renderControl,
+      )}
    </div>
  );
 }
@@ -0,0 +1,137 @@
+"use client";
+
+import { getCurrentWindow } from "@tauri-apps/api/window";
+
+/**
+ * Mirrors the API's own `ResizeDirection`, which it declares but does not
+ * export. Structurally identical, so a drift would fail the call below.
+ */
+type ResizeDirection =
+  | "East"
+  | "North"
+  | "NorthEast"
+  | "NorthWest"
+  | "South"
+  | "SouthEast"
+  | "SouthWest"
+  | "West";
+
+/**
+ * Mouse resize areas for a window with no server-side decorations.
+ *
+ * `gtk_window_set_decorated(false)` removes GTK's own invisible resize border
+ * along with the frame, so without these the window can only be resized through
+ * window-manager shortcuts (Super+right-drag and friends). Each handle hands the
+ * pointer to the compositor via `begin_resize_drag`, which is the same call
+ * GTK's client-side decorations make, so edge snapping and the resize cursor
+ * come from the WM exactly as they do for a native window.
+ *
+ * Rendered only where the app owns the frame; on macOS the native titlebar is
+ * still in place and the system draws its own resize edges.
+ */
+
+/**
+ * GTK's own grab area is far wider, but all of it sits *outside* the window in
+ * the shadow margin. Ours is inside, so every pixel is taken from real content.
+ */
+/** Top edge only — it overlaps the 44px-tall window controls. */
+const TOP_EDGE = "6px";
+/** Sides and bottom overlap nothing, so they can be comfortably grabbable. */
+const EDGE = "8px";
+/** Corners need to win over the edges that overlap them. */
+const CORNER = "16px";
+
+interface Handle {
+  direction: ResizeDirection;
+  style: React.CSSProperties;
+  cursor: string;
+}
+
+const HANDLES: Handle[] = [
+  // Edges.
+  {
+    direction: "North",
+    cursor: "ns-resize",
+    style: { top: 0, left: CORNER, right: CORNER, height: TOP_EDGE },
+  },
+  {
+    direction: "South",
+    cursor: "ns-resize",
+    style: { bottom: 0, left: CORNER, right: CORNER, height: EDGE },
+  },
+  {
+    direction: "West",
+    cursor: "ew-resize",
+    style: { left: 0, top: CORNER, bottom: CORNER, width: EDGE },
+  },
+  {
+    direction: "East",
+    cursor: "ew-resize",
+    style: { right: 0, top: CORNER, bottom: CORNER, width: EDGE },
+  },
+  // Corners, drawn after the edges so they sit on top of the overlap.
+  {
+    direction: "NorthWest",
+    cursor: "nwse-resize",
+    style: { top: 0, left: 0, width: CORNER, height: TOP_EDGE },
+  },
+  {
+    direction: "NorthEast",
+    cursor: "nesw-resize",
+    style: { top: 0, right: 0, width: CORNER, height: TOP_EDGE },
+  },
+  {
+    direction: "SouthWest",
+    cursor: "nesw-resize",
+    style: { bottom: 0, left: 0, width: CORNER, height: CORNER },
+  },
+  {
+    direction: "SouthEast",
+    cursor: "nwse-resize",
+    style: { bottom: 0, right: 0, width: CORNER, height: CORNER },
+  },
+];
+
+export function WindowResizeHandles({ isMaximized }: { isMaximized: boolean }) {
+  // A maximized window has no resizable edge, and leaving the strips live would
+  // put invisible hit areas over real content. Tauri's own built-in undecorated
+  // resizing disables itself while maximized for the same reason.
+  if (isMaximized) {
+    return null;
+  }
+
+  const startResize =
+    (direction: ResizeDirection) => (e: React.PointerEvent) => {
+      // Left button only: right-click belongs to the WM/window menu, and a
+      // middle-click drag should not resize.
+      if (e.button !== 0) {
+        return;
+      }
+      e.preventDefault();
+      e.stopPropagation();
+      void getCurrentWindow()
+        .startResizeDragging(direction)
+        .catch((error: unknown) => {
+          console.error("Failed to start window resize:", error);
+        });
+    };
+
+  return (
+    <>
+      {HANDLES.map((handle) => (
+        <div
+          key={handle.direction}
+          // Deliberately BELOW the window controls (z-100000) rather than
+          // above: a real CSD window keeps its resize border outside the
+          // buttons, but ours is inside the window, so layering it on top
+          // would steal the corner of whichever control sits in that corner.
+          // Edges still win over ordinary content, which is all they need.
+          className="fixed z-[99998] pointer-events-auto"
+          style={{ ...handle.style, cursor: handle.cursor }}
+          onPointerDown={startResize(handle.direction)}
+          aria-hidden="true"
+        />
+      ))}
+    </>
+  );
+}
@@ -0,0 +1,306 @@
+"use client";
+
+import { useCallback, useEffect, useId, useSyncExternalStore } from "react";
+import {
+  type CookieBotSchedule,
+  type CookieBotScope,
+  getCookieBotSchedules,
+  getRemoteHoursQuota,
+  type RemoteHoursQuota,
+} from "@/lib/cookie-bot";
+import {
+  isSessionOver,
+  onRemoteSessionSnapshot,
+  onRemoteSessionState,
+  onRemoteSessionStream,
+  type RemoteSessionState,
+  startRemoteSessionEvents,
+  stopRemoteSessionEvents,
+} from "@/lib/remote-sessions";
+
+/**
+ * One shared read of the cookie-bot plane.
+ *
+ * Several surfaces need the same three facts at once — the profile table, the
+ * account page, the enrolment dialog — and each is mounted independently. A
+ * per-component fetch would mean three requests on open and three different
+ * answers after an edit, so the state lives in one module store and every
+ * consumer subscribes to it.
+ *
+ * `POST /api/remote-sessions` answers `provisioning` and nothing more, so a
+ * live run is only observable through the event stream. This store is what
+ * starts that stream on the desktop: without it a signed-in user is blind
+ * between launch and stop.
+ */
+export interface CookieBotSnapshot {
+  /** Enrolments by profile id. */
+  schedules: Record<string, CookieBotSchedule>;
+  /** Remote sessions that have not closed yet, by profile id. */
+  liveSessions: Record<string, RemoteSessionState>;
+  /** The pooled remote-hour budget, or null before the first answer. */
+  quota: RemoteHoursQuota | null;
+  /** True only while the first load of a newly enabled session is in flight. */
+  isLoading: boolean;
+  /** The last load failure, as a backend error code envelope or message. */
+  error: string | null;
+  /** Whether transitions are currently arriving. */
+  streamConnected: boolean;
+}
+
+const EMPTY: CookieBotSnapshot = {
+  schedules: {},
+  liveSessions: {},
+  quota: null,
+  isLoading: false,
+  error: null,
+  streamConnected: false,
+};
+
+type Listener = () => void;
+
+const listeners = new Set<Listener>();
+let snapshot: CookieBotSnapshot = EMPTY;
+let subscriberCount = 0;
+let unlisteners: (() => void)[] = [];
+let attachGeneration = 0;
+let enabled = false;
+let scope: CookieBotScope = "mine";
+let loadToken = 0;
+
+function emit(next: Partial<CookieBotSnapshot>) {
+  snapshot = { ...snapshot, ...next };
+  for (const listener of listeners) listener();
+}
+
+function getSnapshot(): CookieBotSnapshot {
+  return snapshot;
+}
+
+/** Sessions still in flight, keyed by the profile they are warming. */
+function indexOpenSessions(
+  sessions: RemoteSessionState[],
+): Record<string, RemoteSessionState> {
+  const next: Record<string, RemoteSessionState> = {};
+  for (const session of sessions) {
+    if (!session.profile_id || isSessionOver(session)) continue;
+    next[session.profile_id] = session;
+  }
+  return next;
+}
+
+async function attachStream() {
+  // Idempotent on the Rust side; calling it here is what covers the user who
+  // signs in without restarting the app.
+  try {
+    await startRemoteSessionEvents();
+  } catch (error) {
+    // A signed-out or unentitled desktop refuses the subscription. That is not
+    // a UI failure — the rest of the state still renders — so it is logged and
+    // the stream simply stays disconnected.
+    console.error("Failed to subscribe to remote session events:", error);
+  }
+}
+
+async function attachListeners() {
+  // `listen()` resolves a tick later, and subscribe/unsubscribe can both happen
+  // before it does (React runs mount effects twice in development). Without
+  // this generation check the first attach would install its handlers after the
+  // detach had already run, leaking a listener that no unsubscribe can reach
+  // and double-emitting every session transition for the rest of the session.
+  const generation = ++attachGeneration;
+  const offs = await Promise.all([
+    onRemoteSessionState((session) => {
+      if (!session.profile_id) return;
+      const over = isSessionOver(session);
+      const next = { ...snapshot.liveSessions };
+      if (over) {
+        delete next[session.profile_id];
+      } else {
+        next[session.profile_id] = session;
+      }
+      emit({ liveSessions: next });
+      // A run that just ended has spent hours and may have moved the
+      // schedule's next slot, so both are re-read rather than guessed at.
+      if (over) void refreshCookieBot();
+    }),
+    onRemoteSessionSnapshot((payload) => {
+      emit({ liveSessions: indexOpenSessions(payload.sessions) });
+    }),
+    onRemoteSessionStream((status) => {
+      emit({ streamConnected: status.connected });
+    }),
+  ]);
+  if (generation !== attachGeneration) {
+    for (const off of offs) off();
+    return;
+  }
+  unlisteners = offs;
+}
+
+function detachListeners() {
+  attachGeneration += 1;
+  for (const off of unlisteners) off();
+  unlisteners = [];
+}
+
+async function load() {
+  const token = ++loadToken;
+  emit({ isLoading: snapshot.quota === null, error: null });
+  const [schedules, quota] = await Promise.allSettled([
+    getCookieBotSchedules(scope),
+    getRemoteHoursQuota(),
+  ]);
+  // A later load (or a sign-out) has already superseded this one.
+  if (token !== loadToken || !enabled) return;
+
+  const next: Partial<CookieBotSnapshot> = { isLoading: false };
+  if (schedules.status === "fulfilled") {
+    const byProfile: Record<string, CookieBotSchedule> = {};
+    for (const schedule of schedules.value.schedules) {
+      byProfile[schedule.profile_id] = schedule;
+    }
+    next.schedules = byProfile;
+  }
+  if (quota.status === "fulfilled") next.quota = quota.value;
+
+  // Both failing is a real outage worth surfacing; one failing leaves the
+  // other half of the screen correct, which beats blanking everything.
+  if (schedules.status === "rejected" && quota.status === "rejected") {
+    next.error = String(schedules.reason);
+  } else {
+    next.error = null;
+  }
+  emit(next);
+}
+
+/** Re-read schedules and the quota. Call after any write. */
+export async function refreshCookieBot(): Promise<void> {
+  if (!enabled) return;
+  await load();
+}
+
+function reconcile(nextEnabled: boolean, nextScope: CookieBotScope) {
+  const scopeChanged = nextScope !== scope;
+  scope = nextScope;
+  if (nextEnabled === enabled) {
+    if (nextEnabled && scopeChanged) void load();
+    return;
+  }
+  enabled = nextEnabled;
+  if (enabled) {
+    void attachStream();
+    void load();
+  } else {
+    loadToken++;
+    void stopRemoteSessionEvents().catch((error: unknown) => {
+      console.error("Failed to unsubscribe from remote session events:", error);
+    });
+    snapshot = EMPTY;
+    for (const listener of listeners) listener();
+  }
+}
+
+/**
+ * What each mounted consumer wants. The store is a singleton with several
+ * consumers whose lifetimes differ — the shell holds it open for the whole
+ * session, a dialog only while it is on screen — so the wish is a union, never
+ * last-writer-wins. Without this, closing the enrol dialog (which passes
+ * `isOpen && entitled`) would tear down the event stream the shell and the
+ * profile table are still reading from.
+ */
+const wishes = new Map<string, { enabled: boolean; scope: CookieBotScope }>();
+let applyScheduled = false;
+
+function applyWishes() {
+  let nextEnabled = false;
+  let nextScope: CookieBotScope = "mine";
+  for (const wish of wishes.values()) {
+    if (wish.enabled) nextEnabled = true;
+    if (wish.scope === "team") nextScope = "team";
+  }
+  reconcile(nextEnabled, nextScope);
+}
+
+/**
+ * React runs an effect's cleanup and its next body back to back, so a consumer
+ * re-registering would otherwise be seen as a momentary "nobody wants this" and
+ * flush the whole snapshot. Coalescing into a microtask means only the settled
+ * state is ever acted on.
+ */
+function scheduleApplyWishes() {
+  if (applyScheduled) return;
+  applyScheduled = true;
+  queueMicrotask(() => {
+    applyScheduled = false;
+    applyWishes();
+  });
+}
+
+function subscribe(listener: Listener): () => void {
+  listeners.add(listener);
+  subscriberCount += 1;
+  if (subscriberCount === 1) void attachListeners();
+  return () => {
+    listeners.delete(listener);
+    subscriberCount -= 1;
+    if (subscriberCount === 0) detachListeners();
+  };
+}
+
+/**
+ * Which enrolments to read. Derive it here rather than at each call site: the
+ * store is shared, so two consumers asking for different scopes would refetch
+ * over each other, and the server refuses `team` from a caller with no team.
+ */
+export function cookieBotScopeFor(
+  user: { teamId?: string } | null | undefined,
+): CookieBotScope {
+  return user?.teamId ? "team" : "mine";
+}
+
+export interface UseCookieBotResult extends CookieBotSnapshot {
+  refresh: () => Promise<void>;
+  /** This profile's enrolment, or null. */
+  scheduleFor: (profileId: string) => CookieBotSchedule | null;
+  /** An unfinished remote session for this profile, or null. */
+  liveSessionFor: (profileId: string) => RemoteSessionState | null;
+}
+
+/**
+ * @param isEnabled the user is signed in and entitled. False keeps the store
+ *   idle so an unentitled desktop never polls a route that will refuse it.
+ * @param teamScope read the whole team's enrolments. Only pass `"team"` when
+ *   the user actually belongs to one — the server refuses it otherwise.
+ */
+export function useCookieBot(
+  isEnabled: boolean,
+  teamScope: CookieBotScope = "mine",
+): UseCookieBotResult {
+  const state = useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
+  const consumerId = useId();
+
+  useEffect(() => {
+    wishes.set(consumerId, { enabled: isEnabled, scope: teamScope });
+    scheduleApplyWishes();
+    return () => {
+      wishes.delete(consumerId);
+      scheduleApplyWishes();
+    };
+  }, [consumerId, isEnabled, teamScope]);
+
+  const scheduleFor = useCallback(
+    (profileId: string) => state.schedules[profileId] ?? null,
+    [state.schedules],
+  );
+  const liveSessionFor = useCallback(
+    (profileId: string) => state.liveSessions[profileId] ?? null,
+    [state.liveSessions],
+  );
+
+  return {
+    ...state,
+    refresh: refreshCookieBot,
+    scheduleFor,
+    liveSessionFor,
+  };
+}
@@ -0,0 +1,51 @@
+import { useCallback, useEffect, useState } from "react";
+import {
+  getRemoteHandoffStates,
+  onRemoteHandoffChanged,
+  type RemoteHandoffState,
+} from "@/lib/remote-sessions";
+
+/**
+ * Which profiles cannot be opened on this computer right now.
+ *
+ * Reads the same store the backend launch gate reads, so the button this
+ * disables and the refusal the backend would produce can never disagree. That
+ * matters more than it sounds: the previous signal was the profile-lock cache,
+ * which refreshes on a 30-second server poll and only refetches on this
+ * device's own lock events. A profile running on the fleet therefore looked
+ * launchable for up to half a minute, and a profile whose finished session had
+ * not been pulled back looked launchable indefinitely.
+ *
+ * Updates arrive as an event rather than a poll because every transition that
+ * can change this already emits one.
+ */
+export function useRemoteHandoff() {
+  const [states, setStates] = useState<Record<string, RemoteHandoffState>>({});
+
+  const refresh = useCallback(async () => {
+    try {
+      setStates(await getRemoteHandoffStates());
+    } catch (error) {
+      // Not signed in, or the app is still starting. The backend gate still
+      // applies; the button is simply not pre-disabled.
+      console.warn("Could not read remote handoff state:", error);
+    }
+  }, []);
+
+  useEffect(() => {
+    void refresh();
+    const unlisten = onRemoteHandoffChanged(setStates);
+    return () => {
+      void unlisten.then((off) => {
+        off();
+      });
+    };
+  }, [refresh]);
+
+  const handoffFor = useCallback(
+    (profileId: string): RemoteHandoffState | null => states[profileId] ?? null,
+    [states],
+  );
+
+  return { handoffStates: states, handoffFor, refreshHandoff: refresh };
+}
@@ -0,0 +1,76 @@
+"use client";
+
+import { invoke } from "@tauri-apps/api/core";
+import { listen } from "@tauri-apps/api/event";
+import { useEffect, useState } from "react";
+import {
+  type DecorationLayout,
+  parseDecorationLayout,
+  type WindowDecorationsInfo,
+} from "@/lib/window-decorations";
+
+export interface WindowDecorationsState {
+  /** True when the app owns the titlebar and must draw controls and edges. */
+  clientSide: boolean;
+  /** Which controls go on which side. Meaningless unless `clientSide`. */
+  layout: DecorationLayout;
+  /** False until the backend has answered. */
+  resolved: boolean;
+}
+
+const PENDING: WindowDecorationsState = {
+  clientSide: false,
+  layout: { left: [], right: [] },
+  resolved: false,
+};
+
+/**
+ * The window's decoration state, shared by everything that has to agree about
+ * it.
+ *
+ * The controls and the header padding that clears them are rendered by two
+ * different components. Fetching this separately in each let them disagree for
+ * a frame — or indefinitely, if one missed the change event — and the visible
+ * result is window controls sitting on top of the search box. One subscription
+ * per consumer, one shared derivation.
+ */
+export function useWindowDecorations(): WindowDecorationsState {
+  const [state, setState] = useState<WindowDecorationsState>(PENDING);
+
+  useEffect(() => {
+    let cancelled = false;
+    const read = async () => {
+      try {
+        const value = await invoke<WindowDecorationsInfo>(
+          "get_window_decoration_layout",
+        );
+        if (cancelled) return;
+        setState({
+          clientSide: value.client_side,
+          layout: parseDecorationLayout(value.layout),
+          resolved: true,
+        });
+      } catch (error) {
+        console.error("Failed to read window decoration layout:", error);
+        // Assume the platform still draws the titlebar: drawing a second one
+        // over a real one is worse than drawing none.
+        if (!cancelled) {
+          setState({ ...PENDING, resolved: true });
+        }
+      }
+    };
+    void read();
+    // The user can rearrange titlebar buttons while the app is running.
+    const unlisten = listen("window-decoration-layout-changed", () => {
+      void read();
+    });
+    return () => {
+      cancelled = true;
+      void unlisten.then((fn) => {
+        fn();
+      });
+    };
+  }, []);
+
+  return state;
+}
@@ -92,7 +92,8 @@
    "window": {
      "minimize": "Minimize",
      "maximize": "Maximize",
-      "restore": "Restore"
+      "restore": "Restore",
+      "close": "Close window"
    },
    "commandPalette": {
      "title": "Command Palette",
@@ -199,11 +200,13 @@
    "keepDecryptedProfilesInRam": "Keep Decrypted Profiles In RAM",
    "keepDecryptedProfilesInRamDescription": "Preserve the decrypted in-RAM copy of password-protected profiles between launches for faster startup. The on-disk copy stays encrypted regardless.",
    "privacy": {
-      "consistencyWarning": "Fingerprint consistency warning",
-      "consistencyWarningDescription": "Warn on launch when a profile's timezone or language doesn't match its proxy exit node.",
+      "consistencyWarning": "Block on fingerprint mismatch",
+      "consistencyWarningDescription": "Stop the browser from starting when a profile's timezone or language doesn't match its proxy exit node. You can still choose to launch.",
      "clearTraffic": "Clear all traffic history",
      "clearTrafficDescription": "Securely erase recorded traffic statistics for every profile.",
-      "clearTrafficSuccess": "Traffic history cleared"
+      "clearTrafficSuccess": "Traffic history cleared",
+      "vpnExtensionWarning": "VPN extension warning",
+      "vpnExtensionWarningDescription": "Warn before launching when a profile contains an extension that can reroute the browser's traffic."
    }
  },
  "header": {
@@ -258,7 +261,8 @@
      "emptyCreate": "Create profile",
      "emptyImport": "Import profiles",
      "emptyFilteredTitle": "No profiles found",
-      "emptyFilteredHint": "No profiles match this group or search. Try another filter or create a new one."
+      "emptyFilteredHint": "No profiles match this group or search. Try another filter or create a new one.",
+      "bot": "Bot"
    },
    "actions": {
      "launch": "Launch",
@@ -344,6 +348,10 @@
      "nameDesc": "Name (Z–A)",
      "newest": "Newest first",
      "oldest": "Oldest first"
+    },
+    "remote": {
+      "runningTooltip": "Running on a remote machine. Stop it to bring the profile back here.",
+      "pendingSyncTooltip": "Downloading what the remote session changed. Available again when it finishes."
    }
  },
  "createProfile": {
@@ -460,7 +468,7 @@
      "ssCipherRequired": "Cipher and password are required for Shadowsocks",
      "selectType": "Select proxy type",
      "saveFailed": "Failed to save proxy: {{error}}",
-      "vlessType": "VLESS · Vision · REALITY",
+      "vlessType": "VLESS",
      "vlessUri": "VLESS URI",
      "vlessUriPlaceholder": "vless://…",
      "vlessUriHint": "Requires XTLS Vision and REALITY.",
@@ -1851,7 +1859,62 @@
    "vlessConfigInvalid": "The VLESS URI is invalid.",
    "xrayUnavailable": "Xray-core is unavailable on this system.",
    "xrayUnsupportedOs": "VLESS requires macOS 12 or newer.",
-    "xrayStartFailed": "Xray-core could not start."
+    "xrayStartFailed": "Xray-core could not start.",
+    "cloudNotSignedIn": "Sign in to your Donut Browser account to use this.",
+    "cloudUnreachable": "Could not reach Donut Browser's servers. Check your connection and try again.",
+    "cloudRequestFailed": "The request failed. Please try again in a moment.",
+    "remoteRateLimited": "Too many requests. Wait a moment and try again.",
+    "remoteNoCapacity": "No remote host is free right now. Try again in a few minutes.",
+    "remoteNotEntitled": "Your plan does not include remote execution.",
+    "remoteInteractiveNotEntitled": "Your plan includes remote hours for the Cookie Bot only, not for hands-on remote sessions.",
+    "remoteRequiresRemoteExitNode": "This profile's proxy only works on this computer (for example 127.0.0.1 or a home network address). A remote session runs on our hosts, so it needs a proxy with a public address.",
+    "remoteSessionRefused": "The remote host refused this session.",
+    "remoteSessionNotFound": "That remote session no longer exists.",
+    "remoteSessionConflict": "This profile is already open somewhere else.",
+    "remoteSyncInProgress": "This profile is still uploading to cloud sync. Wait for the sync to finish, then try again.",
+    "remoteHoursExhausted": "You have used all {{used}} of your {{granted}} remote hours this month.",
+    "notTeamMember": "You are not a member of a team.",
+    "cookieBotNotEntitled": "Your plan does not include the cookie bot.",
+    "cookieBotNotEnrolled": "This profile is not set up for the cookie bot yet.",
+    "cookieBotScheduleConflict": "{{email}} already warms this profile at {{time}}.",
+    "cookieBotRunInProgress": "A run is already in progress for this profile.",
+    "cookieBotRunNotFound": "That run no longer exists.",
+    "cookieBotInvalidSchedule": "That schedule is not valid. Check the run time, days and duration.",
+    "cookieBotInvalidTimezone": "{{timezone}} is not a time zone the server recognises.",
+    "cookieBotInvalidPeriod": "That period is not valid. Use a month such as 2026-08.",
+    "cookieBotSiteLimit": "Enter between {{min}} and {{max}} sites, each a full http or https address.",
+    "cookieBotRequiresCloudSync": "Turn on cloud sync for this profile first — a remote host has no other way to obtain it.",
+    "cookieBotEncryptedSyncUnsupported": "This profile uses end-to-end encrypted sync, which a remote host cannot decrypt. Switch it to Regular sync.",
+    "cookieBotUnknownPlatform": "This profile has no recorded operating system, so it cannot be matched to a host.",
+    "cookieBotUnsupportedPlatform": "The cookie bot cannot run {{platform}} profiles. Only Windows and macOS profiles are supported.",
+    "cookieBotRequiresExitNode": "Attach a proxy or VPN first. Without one the run would come from a datacenter address, which damages the profile's identity.",
+    "cookieBotRequiresRemoteExitNode": "This profile's proxy only works on this computer (for example 127.0.0.1 or a home network address). Cookie Bot runs on our hosts, so it needs a proxy with a public address.",
+    "unknownCode": "Something went wrong: {{code}}",
+    "cookieBotTouchFingerprintUnsupported": "This profile claims a touch device, which the bot cannot drive. Use a desktop fingerprint.",
+    "profileRunningRemotely": "This profile is running on a remote machine. Stop the remote session first.",
+    "profileRemoteSyncPending": "A remote session just finished. Waiting for its changes to download before this profile can open here.",
+    "profileLockedByMember": "This profile is in use by {{email}}.",
+    "profileLockedElsewhere": "This profile is in use on another device.",
+    "profileLockUnavailable": "Could not check whether this profile is in use elsewhere. Check your connection and try again.",
+    "fingerprintExitMismatch": "The proxy exit node doesn't match this profile's fingerprint.",
+    "launchConsentExpired": "That confirmation is no longer valid. Try launching again.",
+    "vpnWorkerStartFailed": "Couldn't start the VPN connection: {{detail}}",
+    "exitProbeFailed": "Couldn't reach the proxy exit node to check its location.",
+    "vlessUnsupported": {
+      "security": "This VLESS server does not use REALITY. Donut supports VLESS with REALITY only.",
+      "flow": "This VLESS server does not use XTLS Vision flow, which Donut requires.",
+      "transport": "Donut supports VLESS over plain TCP only — this server uses a different transport (such as WebSocket or gRPC).",
+      "encryption": "This VLESS server uses an encryption setting Donut does not support.",
+      "headerType": "This VLESS server uses a header obfuscation Donut does not support.",
+      "fingerprint": "This VLESS URI requests a TLS fingerprint Donut does not support.",
+      "sni": "The VLESS URI is missing the SNI (sni) needed for REALITY.",
+      "publicKey": "The VLESS URI is missing the REALITY public key (pbk).",
+      "scheme": "That is not a VLESS link. It must start with vless://.",
+      "parameter": "The VLESS URI contains an option Donut does not support.",
+      "malformed": "The VLESS URI is invalid."
+    },
+    "camoufoxRemoved": "Camoufox is no longer supported. Recreate this profile with Wayfern.",
+    "noE2ePasswordSet": "No end-to-end encryption password is set. Set one before syncing encrypted data."
  },
  "rail": {
    "profiles": "Profiles",
@@ -1870,7 +1933,9 @@
    },
    "network": "Network",
    "integrations": "Integrations",
-    "account": "Account"
+    "account": "Account",
+    "cookieBot": "Cookie Bot",
+    "cookieBotRunning": "Cookie Bot — running now"
  },
  "pageTitle": {
    "proxies": "Network",
@@ -1881,7 +1946,8 @@
    "integrations": "Integrations",
    "account": "Account",
    "import": "Import profile",
-    "shortcuts": "Keyboard shortcuts"
+    "shortcuts": "Keyboard shortcuts",
+    "cookieBot": "Cookie Bot"
  },
  "encryption": {
    "required": {
@@ -1924,7 +1990,8 @@
    },
    "tabs": {
      "account": "Account",
-      "selfHosted": "Self-hosted"
+      "selfHosted": "Self-hosted",
+      "teamUsage": "Team usage"
    },
    "selfHosted": {
      "title": "Self-hosted sync server",
@@ -1937,7 +2004,8 @@
    },
    "deviceOrdinal": "{{ordinal}} of {{count}}",
    "automationPrimaryOnly": "Browser automation runs only on your primary device (Device 1). Sign out there to use it here.",
-    "automationActiveHere": "Browser automation is active on this device."
+    "automationActiveHere": "Browser automation is active on this device.",
+    "viewTeamUsage": "View team usage"
  },
  "shortcutsPage": {
    "title": "Keyboard shortcuts",
@@ -1970,7 +2038,8 @@
    "goGroups": "Go to Groups",
    "goIntegrations": "Go to Integrations",
    "goAccount": "Go to Account",
-    "goSettings": "Go to Settings"
+    "goSettings": "Go to Settings",
+    "goCookieBot": "Cookie Bot"
  },
  "closeConfirm": {
    "title": "Close Donut Browser?",
@@ -2091,16 +2160,354 @@
    "description": "Wipe cookies, history and cache when the browser closes. Extensions and bookmarks are kept."
  },
  "consistencyWarning": {
-    "title": "Fingerprint mismatch",
-    "intro": "Your proxy exit for \"{{name}}\" doesn't match this profile's fingerprint:",
-    "timezoneTitle": "Timezone mismatch",
    "timezoneDetail": "Exit node is in {{exit}} but the fingerprint reports {{fingerprint}}.",
-    "languageTitle": "Language mismatch",
    "languageDetail": "Exit country is {{country}} but the fingerprint language is {{fingerprint}}.",
    "explainer": "A timezone or language that disagrees with your exit IP is a strong anti-bot signal, even though your real device never leaks. Align the fingerprint with the proxy location to reduce hostile treatment.",
-    "dontWarnAgain": "Don't warn again for this profile",
    "matchToProxy": "Match fingerprint to proxy",
    "matching": "Matching…",
    "matchSuccess": "Fingerprint updated to match the proxy. Relaunch the profile to apply."
+  },
+  "cookieBot": {
+    "title": "Cookie Bot",
+    "description": "Overnight profile warming on a remote machine.",
+    "tabs": {
+      "overview": "Overview",
+      "schedule": "Schedule",
+      "activity": "Activity",
+      "team": "Team"
+    },
+    "locked": {
+      "title": "Cookie Bot",
+      "hint": "Cookie Bot warms your profiles overnight on a remote machine, so they keep their cookies and their history without your computer being on. It needs a Pro or Team plan."
+    },
+    "empty": {
+      "title": "No profiles are enrolled",
+      "hint": "Pick a profile and the bot warms it overnight on a remote machine. Your computer can be off.",
+      "cta": "Enrol a profile"
+    },
+    "tonight": {
+      "label": "Tonight",
+      "nextRun": "Next run {{time}}",
+      "dueCount_one": "{{count}} profile due",
+      "dueCount_other": "{{count}} profiles due",
+      "nothingScheduled": "Nothing scheduled"
+    },
+    "lastDay": {
+      "label": "Last 24 hours",
+      "none": "No runs yet",
+      "ran_one": "{{count}} ran",
+      "ran_other": "{{count}} ran",
+      "partial_one": "{{count}} partial",
+      "partial_other": "{{count}} partial",
+      "failed_one": "{{count}} failed",
+      "failed_other": "{{count}} failed"
+    },
+    "chart": {
+      "machineTime": "Machine time per night",
+      "minutes": "{{minutes}} min"
+    },
+    "hours": {
+      "label": "Remote hours",
+      "remaining": "{{remaining}} h left of {{total}}",
+      "remainingOf": "of {{total}} h",
+      "used": "{{used}} of {{total}} h used",
+      "resets": "Resets {{date}}",
+      "exhausted": "No remote hours left. Schedules stay enrolled and resume next cycle.",
+      "exhaustedOn": "No remote hours left. Schedules stay enrolled and resume {{date}}.",
+      "estimate": "About {{hours}} h per week · {{remaining}} h left this cycle",
+      "estimateOverBudget": "Needs about {{hours}} h per week — only {{remaining}} h left",
+      "estimateOnly": "About {{hours}} h per week"
+    },
+    "enrolled": {
+      "columnProfile": "Profile",
+      "columnCadence": "Cadence",
+      "columnTime": "Time",
+      "columnNextRun": "Next run",
+      "columnLastRun": "Last run",
+      "enrolProfiles": "Enrol profiles",
+      "edit": "Edit schedule",
+      "neverRun": "Never",
+      "pausedNoHours": "Paused — out of hours",
+      "profileMissing": "That profile is not on this computer."
+    },
+    "schedule": {
+      "empty": "Nothing is scheduled yet.",
+      "quietHours_one": "{{count}} quiet hour",
+      "quietHours_other": "{{count}} quiet hours",
+      "crowded_one": "{{count}} profile starts at once",
+      "crowded_other": "{{count}} profiles start at once",
+      "unenrol": "Remove from Cookie Bot",
+      "unenrolTitle": "Remove {{name}} from Cookie Bot?",
+      "unenrolDescription": "It stops warming tonight. Past runs stay in Activity.",
+      "unenrolled": "Removed from Cookie Bot"
+    },
+    "status": {
+      "provisioning": "Preparing a machine",
+      "ready": "Loading profile",
+      "warming": "Warming",
+      "finished": "Finishing",
+      "failed": "Failed"
+    },
+    "runStatus": {
+      "pending": "Queued",
+      "running": "Running",
+      "succeeded": "Complete",
+      "partial": "Partial",
+      "failed": "Failed",
+      "skipped": "Skipped",
+      "cancelled": "Stopped"
+    },
+    "running": {
+      "label": "Running now",
+      "more": "+{{count}} more",
+      "stop": "Stop run",
+      "stopped": "Run stopped"
+    },
+    "live": {
+      "idle": "Nothing is running right now",
+      "streamOffline": "Live updates are offline",
+      "streamOfflineDetail": "Live updates are offline — reconnecting. The runs below may be out of date.",
+      "unnamedSession": "Remote session",
+      "notStartedYet": "The machine has not reported a start time yet.",
+      "sitesProgress": "{{visited}} of {{total}} sites",
+      "sitesUnknown": "Sites not reported yet",
+      "consentHandled_one": "{{count}} consent prompt handled",
+      "consentHandled_other": "{{count}} consent prompts handled",
+      "consentUnknown": "Consent prompts not reported yet",
+      "billed": "{{duration}} billed",
+      "billedUnknown": "Billed time not reported yet",
+      "chunk": "Part {{index}} of {{total}}"
+    },
+    "history": {
+      "title": "Runs",
+      "allProfiles": "All profiles",
+      "searchPlaceholder": "Search profiles…",
+      "filterAll": "All runs",
+      "filterComplete": "Complete",
+      "filterPartial": "Partial",
+      "filterFailed": "Failed",
+      "columnStarted": "Started",
+      "columnProfile": "Profile",
+      "columnDuration": "Duration",
+      "columnSites": "Sites",
+      "columnStatus": "Status",
+      "columnOperator": "Operator",
+      "empty": "No runs yet.",
+      "noMatch": "No runs match this filter.",
+      "unknownProfile": "Unknown profile",
+      "outcome": "Reason: {{reason}}",
+      "sitesVisited": "{{visited}}/{{total}}",
+      "sitesFailed_one": "{{count}} site could not be reached",
+      "sitesFailed_other": "{{count}} sites could not be reached",
+      "consentHandled_one": "{{count}} consent prompt handled",
+      "consentHandled_other": "{{count}} consent prompts handled",
+      "sitesUnknown": "Not reported"
+    },
+    "duration": {
+      "hm": "{{hours}}h {{minutes}}m",
+      "ms": "{{minutes}}m {{seconds}}s",
+      "s": "{{seconds}}s"
+    },
+    "picker": {
+      "title": "Enrol profiles",
+      "description": "Pick the profiles the bot should warm overnight.",
+      "searchPlaceholder": "Search profiles…",
+      "noProfiles": "No profiles match.",
+      "alreadyEnrolled": "Enrolled",
+      "continue_one": "Continue with {{count}}",
+      "continue_other": "Continue with {{count}}"
+    },
+    "enrol": {
+      "titleOne": "Enrol {{name}}",
+      "titleCount_one": "Enrol {{count}} profile",
+      "titleCount_other": "Enrol {{count}} profiles",
+      "editTitle": "Edit schedule",
+      "description": "The bot opens the profile on a remote machine and browses the sites you list. Your computer can be off.",
+      "summaryNightly": "Runs every night at {{time}}, up to {{minutes}} min each.",
+      "summaryWeeknights": "Runs Monday to Friday at {{time}}, up to {{minutes}} min each.",
+      "summaryAlternate": "Runs every other night at {{time}}, up to {{minutes}} min each.",
+      "summaryCustom_one": "Runs {{count}} night a week at {{time}}, up to {{minutes}} min each.",
+      "summaryCustom_other": "Runs {{count}} nights a week at {{time}}, up to {{minutes}} min each.",
+      "confirm": "Enrol tonight",
+      "confirmSome": "Enrol {{eligible}} of {{total}} tonight",
+      "fixFirst": "Fix these first",
+      "saving": "Enrolling…",
+      "saved": "Schedule saved",
+      "enrolled_one": "Enrolled {{count}} profile",
+      "enrolled_other": "Enrolled {{count}} profiles",
+      "adjust": "Adjust schedule",
+      "cadenceLabel": "Cadence",
+      "cadenceNightly": "Nightly",
+      "cadenceWeeknights": "Weeknights",
+      "cadenceAlternate": "Every other night",
+      "cadenceCustom_one": "{{count}} night a week",
+      "cadenceCustom_other": "{{count}} nights a week",
+      "timeLabel": "Start time",
+      "timeHint": "Local to each profile's fingerprint timezone.",
+      "maxMinutesLabel": "Max minutes",
+      "intensityLabel": "Depth",
+      "sitesLabel": "Sites",
+      "sitesPlaceholder": "One address per line",
+      "sitesHint_one": "{{count}} site. Only pages you list here are visited.",
+      "sitesHint_other": "{{count}} sites. Only pages you list here are visited.",
+      "sitesTooMany": "At most {{max}} sites.",
+      "presetsUnavailable": "Could not load the depth presets. Try again in a moment.",
+      "confirmBulkTitle_one": "Enrol {{count}} profile in Cookie Bot?",
+      "confirmBulkTitle_other": "Enrol {{count}} profiles in Cookie Bot?",
+      "confirmBulkDescription_one": "It books a nightly run against your shared remote hours. You choose the time and the sites next.",
+      "confirmBulkDescription_other": "They book {{count}} nightly runs against your shared remote hours. You choose the time and the sites next.",
+      "confirmBulkButton_one": "Continue with {{count}} profile",
+      "confirmBulkButton_other": "Continue with {{count}} profiles",
+      "sitesRequired": "Add at least one site.",
+      "addSitesFirst": "Add a site first",
+      "presetsMissing": "Depth presets unavailable",
+      "sourceOwn": "My own list",
+      "sourceCurated": "Curated",
+      "sourceSaved": "Saved",
+      "curatedEmpty": "No curated lists are available right now.",
+      "curatedNote": "A curated list we keep up to date. Every profile draws its own sample from it, so no two profiles browse the same set — which is what stops the list itself becoming a signature. The addresses stay on our side.",
+      "savedEmpty": "Nothing saved yet. Type a list under My own list, then save it from there.",
+      "savedNote": "The sites are copied onto the schedule when you save it, so editing a list later leaves existing schedules alone.",
+      "savedUnavailable": "Could not load your saved lists.",
+      "saveAsList": "Save as a list",
+      "listNamePlaceholder": "Name this list",
+      "listSaved": "List saved",
+      "listRenamed": "List renamed",
+      "listDeleted": "List deleted",
+      "listRename": "Rename",
+      "listDeleteConfirm": "Delete?",
+      "templateMissing": "That saved list no longer exists. Pick another one.",
+      "templateNameTaken": "You already have a list with that name.",
+      "templateNameInvalid": "Give the list a name of {{max}} characters or fewer.",
+      "calendarLabel": "When it runs",
+      "daysLabel": "Days of the week",
+      "addSlot": "Add a time",
+      "slotsFull": "At most {{max}} start times.",
+      "removeSlot": "Remove this time",
+      "pickListFirst": "Pick a list first",
+      "finishCalendarFirst": "Finish the schedule first",
+      "duplicateSlot": "Two rows have the same days and time",
+      "listSites_one": "{{count}} site",
+      "listSites_other": "{{count}} sites",
+      "summarySlots_one": "Runs {{count}} time a week, up to {{minutes}} min each.",
+      "summarySlots_other": "Runs {{count}} times a week, up to {{minutes}} min each.",
+      "templateNameInvalidNoMax": "That name can't be used for a saved list."
+    },
+    "preset": {
+      "light": "Light",
+      "balanced": "Standard",
+      "deep": "Deep"
+    },
+    "template": {
+      "lowIntentPurchaser": "Low-intent purchaser",
+      "lowIntentPurchaserHint": "Positions the profile as a price-sensitive buyer: comparison, coupon, cashback and resale sites, reaching retailers through aggregators rather than directly."
+    },
+    "preflight": {
+      "ineligible_one": "{{count}} profile can't run remotely",
+      "ineligible_other": "{{count}} profiles can't run remotely",
+      "reasonSync": "Sync is off",
+      "reasonEncrypted": "End-to-end encrypted",
+      "reasonNoFingerprint": "No recorded operating system",
+      "reasonCrossOs": "Built for {{os}} — no remote machine matches",
+      "reasonNoExitNode": "No proxy or VPN",
+      "fixSync": "Turn on sync",
+      "fixEncrypted": "Open sync settings",
+      "fixProxy": "Attach a proxy",
+      "fixFailed": "Could not apply that fix.",
+      "exitNodeHint": "Without a proxy or VPN the run leaves from the fleet's own datacenter address. Hours of traffic from a hosting network damages the profile's identity more than not warming it at all."
+    },
+    "conflict": {
+      "title": "{{email}} already warms this profile at {{time}}",
+      "detail": "Two schedules on one profile spend hours twice and can collide mid-run.",
+      "keepTheirs": "Use their schedule",
+      "replace": "Replace with mine",
+      "replaceForbidden": "Only a team owner or admin can change someone else's schedule.",
+      "askThem": "Copy {{email}}",
+      "emailCopied": "Email copied",
+      "copyFailed": "Could not copy the address."
+    },
+    "actionBar": {
+      "enrol": "Enrol in Cookie Bot",
+      "proRequired": "Cookie Bot requires a Pro or Team plan",
+      "noneEligible": "None of the selected profiles can be warmed remotely"
+    },
+    "actions": {
+      "enrol": "Enrol in Cookie Bot",
+      "editSchedule": "Edit schedule",
+      "runNow": "Run now",
+      "runStarted": "Run started",
+      "viewActivity": "View activity",
+      "runNotStarted": "The run did not start: {{reason}}"
+    },
+    "state": {
+      "enrolled": "Enrolled",
+      "notEnrolled": "Not enrolled",
+      "paused": "Paused",
+      "summary": "{{cadence}} at {{time}}",
+      "rowMenu": "Cookie Bot options for {{name}}",
+      "blocked": "Cannot run: {{reason}}"
+    },
+    "team": {
+      "title": "Team usage",
+      "pooled_one": "{{used}} of {{total}} h, {{count}} seat",
+      "pooled_other": "{{used}} of {{total}} h pooled across {{count}} seats",
+      "hours": "{{hours}} h",
+      "legendBot": "Cookie Bot",
+      "legendInteractive": "Interactive",
+      "columnMember": "Member",
+      "columnRuns": "Runs",
+      "columnHours": "Hours",
+      "columnShare": "Share",
+      "noActivity": "No remote sessions in this period.",
+      "soloNote": "Only your own usage so far. Invite teammates to see the pool split by member.",
+      "runsFailed": "· {{n}} failed"
+    },
+    "closeReason": {
+      "stoppedByUser": "Stopped by hand",
+      "maxDuration": "Reached the time limit",
+      "other": "Ended: {{reason}}"
+    },
+    "outcome": {
+      "notEntitled": "Not included in your plan",
+      "syncDisabled": "Cloud sync is off for this profile",
+      "encryptedSync": "End-to-end encrypted sync is not supported",
+      "proxyRequired": "No proxy or VPN attached",
+      "touchFingerprint": "Touch fingerprints are not supported",
+      "platformUnsupported": "No machine runs this profile's system",
+      "noSites": "No sites to visit",
+      "quotaExhausted": "Remote hours used up",
+      "profileLocked": "The profile was open somewhere else",
+      "noCapacity": "No machine was free",
+      "managerError": "The fleet could not start the browser",
+      "budgetExceeded": "The night's budget ran out",
+      "cancelledByUser": "Stopped by hand",
+      "unknown": "Unknown reason ({{code}})"
+    }
+  },
+  "prelaunchGate": {
+    "titleBlocked": "Launch blocked",
+    "titleWarning": "Before you launch",
+    "intro": "Review these issues with \"{{name}}\" before starting the browser.",
+    "fingerprintHeading": "Proxy exit doesn't match the fingerprint",
+    "vpnExtensionHeading": "VPN extension detected",
+    "vpnExtensionIntro": "Extensions in this profile that can reroute the browser's traffic:",
+    "vpnExtensionConfirmed": "Can change the proxy",
+    "vpnExtensionLikely": "May change the proxy",
+    "vpnExtensionExplainer": "If one of these routes your traffic elsewhere, the browser's real location will no longer match the timezone, language and geolocation this profile was created with, and Donut cannot detect that from the outside.",
+    "sourceDonut": "Managed by Donut",
+    "sourceBrowser": "Installed in the profile",
+    "measurementUnreliable": "Because a VPN extension can override the proxy, the exit check may not describe the route the browser actually takes.",
+    "scanIncompleteEncrypted": "This profile is encrypted, so only Donut-managed extensions could be checked.",
+    "scanIncompleteEphemeral": "This profile has no data yet, so only Donut-managed extensions could be checked.",
+    "scanIncompletePartial": "The extension scan was cut short, so some extensions may not be listed.",
+    "probePending": "The proxy exit hasn't been measured yet. Donut will check it while starting and stop if it doesn't match.",
+    "launchAnyway": "Launch anyway",
+    "dontBlockAgain": "Don't block again for this exact mismatch",
+    "dontWarnExtensions": "Don't warn again about these extensions",
+    "applyToRemaining": "Apply this choice to the remaining profiles",
+    "cancelledSummary": "{{cancelled}} of {{total}} launches cancelled",
+    "cancelled": "Launch cancelled",
+    "vpnExtensionEntry": " {{version}} — {{capability}}, {{source}}",
+    "scanIncompleteMissing": "This profile has not been launched yet, so only Donut-managed extensions could be checked."
  }
 }
@@ -92,7 +92,8 @@
    "window": {
      "minimize": "Minimizar",
      "maximize": "Maximizar",
-      "restore": "Restaurar"
+      "restore": "Restaurar",
+      "close": "Cerrar ventana"
    },
    "commandPalette": {
      "title": "Paleta de comandos",
@@ -199,11 +200,13 @@
    "keepDecryptedProfilesInRam": "Mantener Perfiles Descifrados en RAM",
    "keepDecryptedProfilesInRamDescription": "Conservar la copia descifrada en RAM de los perfiles protegidos por contraseña entre lanzamientos para un inicio más rápido. La copia en disco permanece cifrada en cualquier caso.",
    "privacy": {
-      "consistencyWarning": "Advertencia de consistencia de huella digital",
-      "consistencyWarningDescription": "Advertir al iniciar cuando la zona horaria o el idioma de un perfil no coincidan con su nodo de salida del proxy.",
+      "consistencyWarning": "Bloquear si la huella digital no coincide",
+      "consistencyWarningDescription": "Impide que el navegador se inicie cuando la zona horaria o el idioma de un perfil no coinciden con su nodo de salida del proxy. Aun así podrás iniciarlo.",
      "clearTraffic": "Borrar todo el historial de tráfico",
      "clearTrafficDescription": "Elimina de forma segura las estadísticas de tráfico registradas de todos los perfiles.",
-      "clearTrafficSuccess": "Historial de tráfico borrado"
+      "clearTrafficSuccess": "Historial de tráfico borrado",
+      "vpnExtensionWarning": "Aviso de extensión VPN",
+      "vpnExtensionWarningDescription": "Avisar antes de iniciar cuando un perfil contenga una extensión capaz de redirigir el tráfico del navegador."
    }
  },
  "header": {
@@ -258,7 +261,8 @@
      "emptyCreate": "Crear perfil",
      "emptyImport": "Importar perfiles",
      "emptyFilteredTitle": "No se encontraron perfiles",
-      "emptyFilteredHint": "Ningún perfil coincide con este grupo o búsqueda. Prueba otro filtro o crea uno nuevo."
+      "emptyFilteredHint": "Ningún perfil coincide con este grupo o búsqueda. Prueba otro filtro o crea uno nuevo.",
+      "bot": "Bot"
    },
    "actions": {
      "launch": "Iniciar",
@@ -344,6 +348,10 @@
      "nameDesc": "Nombre (Z–A)",
      "newest": "Más recientes primero",
      "oldest": "Más antiguos primero"
+    },
+    "remote": {
+      "runningTooltip": "Ejecutándose en una máquina remota. Deténlo para recuperar el perfil aquí.",
+      "pendingSyncTooltip": "Descargando lo que cambió la sesión remota. Disponible de nuevo cuando termine."
    }
  },
  "createProfile": {
@@ -421,6 +429,7 @@
      "deleteProxy": "Eliminar proxy",
      "cannotDelete_one": "No se puede eliminar: en uso por {{count}} perfil",
      "cannotDelete_other": "No se puede eliminar: en uso por {{count}} perfiles",
+      "cannotDelete_many": "No se puede eliminar: en uso por {{count}} perfiles",
      "syncEnabled": "Sincronización activada",
      "syncDisabled": "Sincronización desactivada",
      "updateSyncFailed": "Error al actualizar la sincronización",
@@ -460,7 +469,7 @@
      "ssCipherRequired": "Para Shadowsocks se requieren cifrado y contraseña",
      "selectType": "Selecciona el tipo de proxy",
      "saveFailed": "Error al guardar el proxy: {{error}}",
-      "vlessType": "VLESS · Vision · REALITY",
+      "vlessType": "VLESS",
      "vlessUri": "URI de VLESS",
      "vlessUriPlaceholder": "vless://…",
      "vlessUriHint": "Requiere XTLS Vision y REALITY.",
@@ -814,6 +823,7 @@
      "selectedCount_plural": "{{count}} cookies seleccionadas",
      "dialogDescription_one": "Copiar cookies de un perfil de origen a {{count}} perfil seleccionado.",
      "dialogDescription_other": "Copiar cookies de un perfil de origen a {{count}} perfiles seleccionados.",
+      "dialogDescription_many": "Copiar cookies de un perfil de origen a {{count}} perfiles seleccionados.",
      "sourceProfile": "Perfil de origen",
      "sourcePlaceholder": "Selecciona un perfil del que copiar cookies",
      "running": "(en ejecución)",
@@ -832,6 +842,7 @@
      "failedMessage": "Error al copiar las cookies: {{error}}",
      "copyButton_one": "Copiar {{count}} cookie",
      "copyButton_other": "Copiar {{count}} cookies",
+      "copyButton_many": "Copiar {{count}} cookies",
      "copyButtonEmpty": "Copiar cookies"
    },
    "success": "Cookies copiadas exitosamente",
@@ -1403,6 +1414,7 @@
      "deleteVpn": "Eliminar VPN",
      "cannotDelete_one": "No se puede eliminar: en uso por {{count}} perfil",
      "cannotDelete_other": "No se puede eliminar: en uso por {{count}} perfiles",
+      "cannotDelete_many": "No se puede eliminar: en uso por {{count}} perfiles",
      "syncCannotDisable": "No se puede desactivar la sincronización mientras esta VPN esté en uso por perfiles sincronizados",
      "deleteSuccess": "VPN eliminada correctamente",
      "deleteFailed": "Error al eliminar la VPN",
@@ -1481,6 +1493,7 @@
    "loading": "Cargando grupos...",
    "profileCount_one": "{{count}} perfil",
    "profileCount_other": "{{count}} perfiles",
+    "profileCount_many": "{{count}} perfiles",
    "groupsLabel": "Grupos",
    "profilesCol": "Perfiles",
    "syncCannotDisable": "No se puede desactivar la sincronización mientras este grupo esté en uso por perfiles sincronizados",
@@ -1498,6 +1511,7 @@
    "title": "Asignar proxy / VPN",
    "description_one": "Asigna un proxy o VPN a {{count}} perfil seleccionado.",
    "description_other": "Asigna un proxy o VPN a {{count}} perfiles seleccionados.",
+    "description_many": "Asigna un proxy o VPN a {{count}} perfiles seleccionados.",
    "selectLabel": "Proxy / VPN",
    "placeholder": "Selecciona un proxy o VPN",
    "noProxy": "Sin proxy / VPN",
@@ -1517,6 +1531,7 @@
    "title": "Asignar grupo",
    "description_one": "Asigna un grupo a {{count}} perfil seleccionado.",
    "description_other": "Asigna un grupo a {{count}} perfiles seleccionados.",
+    "description_many": "Asigna un grupo a {{count}} perfiles seleccionados.",
    "selectLabel": "Grupo",
    "placeholder": "Selecciona un grupo",
    "noGroup": "Sin grupo (Predeterminado)",
@@ -1851,7 +1866,62 @@
    "vlessConfigInvalid": "El URI de VLESS no es válido.",
    "xrayUnavailable": "Xray-core no está disponible en este sistema.",
    "xrayUnsupportedOs": "VLESS requiere macOS 12 o posterior.",
-    "xrayStartFailed": "No se pudo iniciar Xray-core."
+    "xrayStartFailed": "No se pudo iniciar Xray-core.",
+    "cloudNotSignedIn": "Inicia sesión en tu cuenta de Donut Browser para usar esto.",
+    "cloudUnreachable": "No se pudo contactar con los servidores de Donut Browser. Comprueba tu conexión e inténtalo de nuevo.",
+    "cloudRequestFailed": "La solicitud falló. Inténtalo de nuevo en un momento.",
+    "remoteRateLimited": "Demasiadas solicitudes. Espera un momento e inténtalo de nuevo.",
+    "remoteNoCapacity": "Ahora mismo no hay ninguna máquina remota libre. Inténtalo de nuevo en unos minutos.",
+    "remoteNotEntitled": "Tu plan no incluye la ejecución remota.",
+    "remoteInteractiveNotEntitled": "Tu plan incluye horas remotas solo para el Cookie Bot, no para sesiones remotas interactivas.",
+    "remoteRequiresRemoteExitNode": "El proxy de este perfil solo funciona en este ordenador (por ejemplo 127.0.0.1 o una dirección de red local). Las sesiones remotas se ejecutan en nuestros servidores, así que necesitan un proxy con dirección pública.",
+    "remoteSessionRefused": "La máquina remota rechazó esta sesión.",
+    "remoteSessionNotFound": "Esa sesión remota ya no existe.",
+    "remoteSessionConflict": "Este perfil ya está abierto en otro sitio.",
+    "remoteSyncInProgress": "Este perfil todavía se está subiendo a la sincronización en la nube. Espera a que termine e inténtalo de nuevo.",
+    "remoteHoursExhausted": "Has usado las {{used}} de tus {{granted}} horas remotas de este mes.",
+    "notTeamMember": "No perteneces a ningún equipo.",
+    "cookieBotNotEntitled": "Tu plan no incluye Cookie Bot.",
+    "cookieBotNotEnrolled": "Este perfil aún no está configurado para Cookie Bot.",
+    "cookieBotScheduleConflict": "{{email}} ya calienta este perfil a las {{time}}.",
+    "cookieBotRunInProgress": "Ya hay una ejecución en curso para este perfil.",
+    "cookieBotRunNotFound": "Esa ejecución ya no existe.",
+    "cookieBotInvalidSchedule": "Esa programación no es válida. Revisa la hora, los días y la duración.",
+    "cookieBotInvalidTimezone": "{{timezone}} no es una zona horaria que el servidor reconozca.",
+    "cookieBotInvalidPeriod": "Ese periodo no es válido. Usa un mes como 2026-08.",
+    "cookieBotSiteLimit": "Introduce entre {{min}} y {{max}} sitios, cada uno con una dirección http o https completa.",
+    "cookieBotRequiresCloudSync": "Activa primero la sincronización en la nube para este perfil: una máquina remota no tiene otra forma de obtenerlo.",
+    "cookieBotEncryptedSyncUnsupported": "Este perfil usa sincronización cifrada de extremo a extremo, que una máquina remota no puede descifrar. Cámbialo a sincronización normal.",
+    "cookieBotUnknownPlatform": "Este perfil no tiene un sistema operativo registrado, así que no se puede asignar a ninguna máquina.",
+    "cookieBotUnsupportedPlatform": "Cookie Bot no puede ejecutar perfiles de {{platform}}. Solo se admiten perfiles de Windows y macOS.",
+    "cookieBotRequiresExitNode": "Asigna primero un proxy o una VPN. Sin ninguno, la ejecución saldría desde una dirección de centro de datos, lo que daña la identidad del perfil.",
+    "cookieBotRequiresRemoteExitNode": "El proxy de este perfil solo funciona en este ordenador (por ejemplo 127.0.0.1 o una dirección de red local). Cookie Bot se ejecuta en nuestros servidores, así que necesita un proxy con dirección pública.",
+    "unknownCode": "Algo salió mal: {{code}}",
+    "cookieBotTouchFingerprintUnsupported": "Este perfil declara un dispositivo táctil, que el bot no puede controlar. Usa una huella de escritorio.",
+    "profileRunningRemotely": "Este perfil se está ejecutando en una máquina remota. Detén primero la sesión remota.",
+    "profileRemoteSyncPending": "Una sesión remota acaba de terminar. Esperando a que se descarguen sus cambios antes de abrir este perfil aquí.",
+    "profileLockedByMember": "Este perfil está siendo usado por {{email}}.",
+    "profileLockedElsewhere": "Este perfil está en uso en otro dispositivo.",
+    "profileLockUnavailable": "No se pudo comprobar si este perfil está en uso en otro lugar. Revisa tu conexión e inténtalo de nuevo.",
+    "fingerprintExitMismatch": "El nodo de salida del proxy no coincide con la huella digital de este perfil.",
+    "launchConsentExpired": "Esa confirmación ya no es válida. Vuelve a iniciar.",
+    "vpnWorkerStartFailed": "No se pudo iniciar la conexión VPN: {{detail}}",
+    "exitProbeFailed": "No se pudo contactar con el nodo de salida del proxy para comprobar su ubicación.",
+    "vlessUnsupported": {
+      "security": "Este servidor VLESS no usa REALITY. Donut solo admite VLESS con REALITY.",
+      "flow": "Este servidor VLESS no usa el flujo XTLS Vision, que Donut requiere.",
+      "transport": "Donut solo admite VLESS sobre TCP simple: este servidor usa otro transporte (como WebSocket o gRPC).",
+      "encryption": "Este servidor VLESS usa un cifrado que Donut no admite.",
+      "headerType": "Este servidor VLESS usa una ofuscación de cabecera que Donut no admite.",
+      "fingerprint": "Esta URI VLESS solicita una huella TLS que Donut no admite.",
+      "sni": "A la URI VLESS le falta el SNI (sni) necesario para REALITY.",
+      "publicKey": "A la URI VLESS le falta la clave pública de REALITY (pbk).",
+      "scheme": "Eso no es un enlace VLESS. Debe empezar por vless://.",
+      "parameter": "La URI VLESS contiene una opción que Donut no admite.",
+      "malformed": "La URI VLESS no es válida."
+    },
+    "camoufoxRemoved": "Camoufox ya no es compatible. Vuelve a crear este perfil con Wayfern.",
+    "noE2ePasswordSet": "No hay contraseña de cifrado de extremo a extremo. Establece una antes de sincronizar datos cifrados."
  },
  "rail": {
    "profiles": "Perfiles",
@@ -1870,7 +1940,9 @@
    },
    "network": "Red",
    "integrations": "Integraciones",
-    "account": "Cuenta"
+    "account": "Cuenta",
+    "cookieBot": "Cookie Bot",
+    "cookieBotRunning": "Cookie Bot: en ejecución ahora"
  },
  "pageTitle": {
    "proxies": "Red",
@@ -1881,7 +1953,8 @@
    "integrations": "Integraciones",
    "account": "Cuenta",
    "import": "Importar perfil",
-    "shortcuts": "Atajos de teclado"
+    "shortcuts": "Atajos de teclado",
+    "cookieBot": "Cookie Bot"
  },
  "encryption": {
    "required": {
@@ -1924,7 +1997,8 @@
    },
    "tabs": {
      "account": "Cuenta",
-      "selfHosted": "Autoalojado"
+      "selfHosted": "Autoalojado",
+      "teamUsage": "Uso del equipo"
    },
    "selfHosted": {
      "title": "Servidor de sincronización autoalojado",
@@ -1937,7 +2011,8 @@
    },
    "deviceOrdinal": "{{ordinal}} de {{count}}",
    "automationPrimaryOnly": "La automatización del navegador solo funciona en tu dispositivo principal (Dispositivo 1). Cierra sesión allí para usarla aquí.",
-    "automationActiveHere": "La automatización del navegador está activa en este dispositivo."
+    "automationActiveHere": "La automatización del navegador está activa en este dispositivo.",
+    "viewTeamUsage": "Ver el uso del equipo"
  },
  "shortcutsPage": {
    "title": "Atajos de teclado",
@@ -1970,7 +2045,8 @@
    "goGroups": "Ir a Grupos",
    "goIntegrations": "Ir a Integraciones",
    "goAccount": "Ir a Cuenta",
-    "goSettings": "Ir a Configuración"
+    "goSettings": "Ir a Configuración",
+    "goCookieBot": "Cookie Bot"
  },
  "closeConfirm": {
    "title": "¿Cerrar Donut Browser?",
@@ -2091,16 +2167,376 @@
    "description": "Elimina cookies, historial y caché al cerrar el navegador. Las extensiones y los marcadores se conservan."
  },
  "consistencyWarning": {
-    "title": "Discrepancia de huella digital",
-    "intro": "La salida del proxy de \"{{name}}\" no coincide con la huella digital de este perfil:",
-    "timezoneTitle": "Discrepancia de zona horaria",
    "timezoneDetail": "El nodo de salida está en {{exit}}, pero la huella digital indica {{fingerprint}}.",
-    "languageTitle": "Discrepancia de idioma",
    "languageDetail": "El país de salida es {{country}}, pero el idioma de la huella digital es {{fingerprint}}.",
    "explainer": "Una zona horaria o un idioma que no coincide con tu IP de salida es una fuerte señal anti-bot, aunque tu dispositivo real nunca se filtre. Alinea la huella digital con la ubicación del proxy para reducir el trato hostil.",
-    "dontWarnAgain": "No volver a advertir para este perfil",
    "matchToProxy": "Ajustar huella al proxy",
    "matching": "Ajustando…",
    "matchSuccess": "Huella actualizada para coincidir con el proxy. Reinicia el perfil para aplicar."
+  },
+  "cookieBot": {
+    "title": "Cookie Bot",
+    "description": "Calentamiento nocturno de perfiles en una máquina remota.",
+    "tabs": {
+      "overview": "Resumen",
+      "schedule": "Programación",
+      "activity": "Actividad",
+      "team": "Equipo"
+    },
+    "locked": {
+      "title": "Cookie Bot",
+      "hint": "Cookie Bot calienta tus perfiles por la noche en una máquina remota, así conservan sus cookies y su historial sin que tu ordenador esté encendido. Requiere un plan Pro o Team."
+    },
+    "empty": {
+      "title": "No hay perfiles inscritos",
+      "hint": "Elige un perfil y el bot lo calentará por la noche en una máquina remota. Tu ordenador puede estar apagado.",
+      "cta": "Inscribir un perfil"
+    },
+    "tonight": {
+      "label": "Esta noche",
+      "nextRun": "Próxima ejecución {{time}}",
+      "dueCount_one": "{{count}} perfil pendiente",
+      "dueCount_other": "{{count}} perfiles pendientes",
+      "dueCount_many": "{{count}} perfiles pendientes",
+      "nothingScheduled": "Nada programado"
+    },
+    "lastDay": {
+      "label": "Últimas 24 horas",
+      "none": "Aún no hay ejecuciones",
+      "ran_one": "{{count}} ejecutado",
+      "ran_other": "{{count}} ejecutados",
+      "ran_many": "{{count}} ejecutados",
+      "partial_one": "{{count}} parcial",
+      "partial_other": "{{count}} parciales",
+      "partial_many": "{{count}} parciales",
+      "failed_one": "{{count}} fallido",
+      "failed_other": "{{count}} fallidos",
+      "failed_many": "{{count}} fallidos"
+    },
+    "chart": {
+      "machineTime": "Tiempo de máquina por noche",
+      "minutes": "{{minutes}} min"
+    },
+    "hours": {
+      "label": "Horas remotas",
+      "remaining": "Quedan {{remaining}} h de {{total}}",
+      "remainingOf": "de {{total}} h",
+      "used": "{{used}} de {{total}} h usadas",
+      "resets": "Se restablece el {{date}}",
+      "exhausted": "No quedan horas remotas. Las programaciones siguen inscritas y se reanudan en el próximo ciclo.",
+      "exhaustedOn": "No quedan horas remotas. Las programaciones siguen inscritas y se reanudan el {{date}}.",
+      "estimate": "Unas {{hours}} h por semana · quedan {{remaining}} h en este ciclo",
+      "estimateOverBudget": "Necesita unas {{hours}} h por semana: solo quedan {{remaining}} h",
+      "estimateOnly": "Unas {{hours}} h por semana"
+    },
+    "enrolled": {
+      "columnProfile": "Perfil",
+      "columnCadence": "Frecuencia",
+      "columnTime": "Hora",
+      "columnNextRun": "Próxima ejecución",
+      "columnLastRun": "Última ejecución",
+      "enrolProfiles": "Inscribir perfiles",
+      "edit": "Editar programación",
+      "neverRun": "Nunca",
+      "pausedNoHours": "En pausa: sin horas",
+      "profileMissing": "Ese perfil no está en este ordenador."
+    },
+    "schedule": {
+      "empty": "Todavía no hay nada programado.",
+      "quietHours_one": "{{count}} hora libre",
+      "quietHours_other": "{{count}} horas libres",
+      "quietHours_many": "{{count}} horas libres",
+      "crowded_one": "{{count}} perfil empieza a la vez",
+      "crowded_other": "{{count}} perfiles empiezan a la vez",
+      "crowded_many": "{{count}} perfiles empiezan a la vez",
+      "unenrol": "Quitar de Cookie Bot",
+      "unenrolTitle": "¿Quitar {{name}} de Cookie Bot?",
+      "unenrolDescription": "Dejará de calentarse esta noche. Las ejecuciones anteriores se conservan en Actividad.",
+      "unenrolled": "Quitado de Cookie Bot"
+    },
+    "status": {
+      "provisioning": "Preparando una máquina",
+      "ready": "Cargando el perfil",
+      "warming": "Calentando",
+      "finished": "Finalizando",
+      "failed": "Con errores"
+    },
+    "runStatus": {
+      "pending": "En cola",
+      "running": "En ejecución",
+      "succeeded": "Completa",
+      "partial": "Parcial",
+      "failed": "Fallida",
+      "skipped": "Omitida",
+      "cancelled": "Detenida"
+    },
+    "running": {
+      "label": "En ejecución ahora",
+      "more": "+{{count}} más",
+      "stop": "Detener la ejecución",
+      "stopped": "Ejecución detenida"
+    },
+    "live": {
+      "idle": "Ahora mismo no se está ejecutando nada",
+      "streamOffline": "Las actualizaciones en vivo están sin conexión",
+      "streamOfflineDetail": "Las actualizaciones en vivo están sin conexión; reconectando. Las ejecuciones de abajo pueden estar desactualizadas.",
+      "unnamedSession": "Sesión remota",
+      "notStartedYet": "La máquina aún no ha informado de una hora de inicio.",
+      "sitesProgress": "{{visited}} de {{total}} sitios",
+      "sitesUnknown": "Sitios aún no informados",
+      "consentHandled_one": "{{count}} aviso de consentimiento gestionado",
+      "consentHandled_other": "{{count}} avisos de consentimiento gestionados",
+      "consentHandled_many": "{{count}} avisos de consentimiento gestionados",
+      "consentUnknown": "Avisos de consentimiento aún no informados",
+      "billed": "{{duration}} facturados",
+      "billedUnknown": "Tiempo facturado aún no informado",
+      "chunk": "Parte {{index}} de {{total}}"
+    },
+    "history": {
+      "title": "Ejecuciones",
+      "allProfiles": "Todos los perfiles",
+      "searchPlaceholder": "Buscar perfiles…",
+      "filterAll": "Todas las ejecuciones",
+      "filterComplete": "Completas",
+      "filterPartial": "Parciales",
+      "filterFailed": "Fallidas",
+      "columnStarted": "Inicio",
+      "columnProfile": "Perfil",
+      "columnDuration": "Duración",
+      "columnSites": "Sitios",
+      "columnStatus": "Estado",
+      "columnOperator": "Operador",
+      "empty": "Aún no hay ejecuciones.",
+      "noMatch": "Ninguna ejecución coincide con este filtro.",
+      "unknownProfile": "Perfil desconocido",
+      "outcome": "Motivo: {{reason}}",
+      "sitesVisited": "{{visited}}/{{total}}",
+      "sitesFailed_one": "No se pudo acceder a {{count}} sitio",
+      "sitesFailed_other": "No se pudo acceder a {{count}} sitios",
+      "sitesFailed_many": "No se pudo acceder a {{count}} sitios",
+      "consentHandled_one": "{{count}} aviso de consentimiento gestionado",
+      "consentHandled_other": "{{count}} avisos de consentimiento gestionados",
+      "consentHandled_many": "{{count}} avisos de consentimiento gestionados",
+      "sitesUnknown": "Sin datos"
+    },
+    "duration": {
+      "hm": "{{hours}} h {{minutes}} min",
+      "ms": "{{minutes}} min {{seconds}} s",
+      "s": "{{seconds}} s"
+    },
+    "picker": {
+      "title": "Inscribir perfiles",
+      "description": "Elige los perfiles que el bot debe calentar por la noche.",
+      "searchPlaceholder": "Buscar perfiles…",
+      "noProfiles": "Ningún perfil coincide.",
+      "alreadyEnrolled": "Inscrito",
+      "continue_one": "Continuar con {{count}}",
+      "continue_other": "Continuar con {{count}}",
+      "continue_many": "Continuar con {{count}}"
+    },
+    "enrol": {
+      "titleOne": "Inscribir {{name}}",
+      "titleCount_one": "Inscribir {{count}} perfil",
+      "titleCount_other": "Inscribir {{count}} perfiles",
+      "titleCount_many": "Inscribir {{count}} perfiles",
+      "editTitle": "Editar programación",
+      "description": "El bot abre el perfil en una máquina remota y navega por los sitios que indiques. Tu ordenador puede estar apagado.",
+      "summaryNightly": "Se ejecuta cada noche a las {{time}}, hasta {{minutes}} min cada vez.",
+      "summaryWeeknights": "Se ejecuta de lunes a viernes a las {{time}}, hasta {{minutes}} min cada vez.",
+      "summaryAlternate": "Se ejecuta una noche sí y otra no a las {{time}}, hasta {{minutes}} min cada vez.",
+      "summaryCustom_one": "Se ejecuta {{count}} noche a la semana a las {{time}}, hasta {{minutes}} min cada vez.",
+      "summaryCustom_other": "Se ejecuta {{count}} noches a la semana a las {{time}}, hasta {{minutes}} min cada vez.",
+      "summaryCustom_many": "Se ejecuta {{count}} noches a la semana a las {{time}}, hasta {{minutes}} min cada vez.",
+      "confirm": "Inscribir para esta noche",
+      "confirmSome": "Inscribir {{eligible}} de {{total}} esta noche",
+      "fixFirst": "Corrige esto primero",
+      "saving": "Inscribiendo…",
+      "saved": "Programación guardada",
+      "enrolled_one": "{{count}} perfil inscrito",
+      "enrolled_other": "{{count}} perfiles inscritos",
+      "enrolled_many": "{{count}} perfiles inscritos",
+      "adjust": "Ajustar la programación",
+      "cadenceLabel": "Frecuencia",
+      "cadenceNightly": "Cada noche",
+      "cadenceWeeknights": "Noches entre semana",
+      "cadenceAlternate": "Noches alternas",
+      "cadenceCustom_one": "{{count}} noche a la semana",
+      "cadenceCustom_other": "{{count}} noches a la semana",
+      "cadenceCustom_many": "{{count}} noches a la semana",
+      "timeLabel": "Hora de inicio",
+      "timeHint": "Local a la zona horaria de la huella de cada perfil.",
+      "maxMinutesLabel": "Minutos máximos",
+      "intensityLabel": "Profundidad",
+      "sitesLabel": "Sitios",
+      "sitesPlaceholder": "Una dirección por línea",
+      "sitesHint_one": "{{count}} sitio. Solo se visitan las páginas que indiques aquí.",
+      "sitesHint_other": "{{count}} sitios. Solo se visitan las páginas que indiques aquí.",
+      "sitesHint_many": "{{count}} sitios. Solo se visitan las páginas que indiques aquí.",
+      "sitesTooMany": "Como máximo {{max}} sitios.",
+      "presetsUnavailable": "No se pudieron cargar los ajustes de profundidad. Inténtalo de nuevo en un momento.",
+      "confirmBulkTitle_one": "¿Inscribir {{count}} perfil en Cookie Bot?",
+      "confirmBulkTitle_other": "¿Inscribir {{count}} perfiles en Cookie Bot?",
+      "confirmBulkTitle_many": "¿Inscribir {{count}} perfiles en Cookie Bot?",
+      "confirmBulkDescription_one": "Reserva una ejecución nocturna con cargo a vuestras horas remotas compartidas. La hora y los sitios se eligen a continuación.",
+      "confirmBulkDescription_other": "Reservan {{count}} ejecuciones nocturnas con cargo a vuestras horas remotas compartidas. La hora y los sitios se eligen a continuación.",
+      "confirmBulkDescription_many": "Reservan {{count}} ejecuciones nocturnas con cargo a vuestras horas remotas compartidas. La hora y los sitios se eligen a continuación.",
+      "confirmBulkButton_one": "Continuar con {{count}} perfil",
+      "confirmBulkButton_other": "Continuar con {{count}} perfiles",
+      "confirmBulkButton_many": "Continuar con {{count}} perfiles",
+      "sitesRequired": "Añade al menos un sitio.",
+      "addSitesFirst": "Añade un sitio primero",
+      "presetsMissing": "Ajustes de profundidad no disponibles",
+      "sourceOwn": "Mi propia lista",
+      "sourceCurated": "Seleccionadas",
+      "sourceSaved": "Guardadas",
+      "curatedEmpty": "Ahora mismo no hay listas seleccionadas disponibles.",
+      "curatedNote": "Una lista seleccionada que mantenemos al día. Cada perfil toma su propia muestra de ella, así que no hay dos perfiles que naveguen el mismo conjunto, y por eso la lista no llega a convertirse en una firma. Las direcciones se quedan de nuestro lado.",
+      "savedEmpty": "Todavía no has guardado nada. Escribe una lista en Mi propia lista y guárdala desde allí.",
+      "savedNote": "Los sitios se copian en la programación al guardarla, así que editar una lista más tarde no afecta a las programaciones existentes.",
+      "savedUnavailable": "No se pudieron cargar tus listas guardadas.",
+      "saveAsList": "Guardar como lista",
+      "listNamePlaceholder": "Nombra esta lista",
+      "listSaved": "Lista guardada",
+      "listRenamed": "Lista renombrada",
+      "listDeleted": "Lista eliminada",
+      "listRename": "Renombrar",
+      "listDeleteConfirm": "¿Eliminar?",
+      "templateMissing": "Esa lista guardada ya no existe. Elige otra.",
+      "templateNameTaken": "Ya tienes una lista con ese nombre.",
+      "templateNameInvalid": "Ponle a la lista un nombre de {{max}} caracteres o menos.",
+      "calendarLabel": "Cuándo se ejecuta",
+      "daysLabel": "Días de la semana",
+      "addSlot": "Añadir una hora",
+      "slotsFull": "Como máximo {{max}} horas de inicio.",
+      "removeSlot": "Quitar esta hora",
+      "pickListFirst": "Elige una lista primero",
+      "finishCalendarFirst": "Termina la programación primero",
+      "duplicateSlot": "Dos filas tienen los mismos días y la misma hora",
+      "listSites_one": "{{count}} sitio",
+      "listSites_other": "{{count}} sitios",
+      "listSites_many": "{{count}} sitios",
+      "summarySlots_one": "Se ejecuta {{count}} vez a la semana, hasta {{minutes}} min cada vez.",
+      "summarySlots_other": "Se ejecuta {{count}} veces a la semana, hasta {{minutes}} min cada vez.",
+      "summarySlots_many": "Se ejecuta {{count}} veces a la semana, hasta {{minutes}} min cada vez.",
+      "templateNameInvalidNoMax": "Ese nombre no se puede usar para una lista guardada."
+    },
+    "preset": {
+      "light": "Ligera",
+      "balanced": "Estándar",
+      "deep": "Profunda"
+    },
+    "template": {
+      "lowIntentPurchaser": "Comprador de baja intención",
+      "lowIntentPurchaserHint": "Posiciona el perfil como un comprador sensible al precio: sitios de comparación, cupones, reembolsos y reventa, llegando a las tiendas a través de agregadores en lugar de directamente."
+    },
+    "preflight": {
+      "ineligible_one": "{{count}} perfil no puede ejecutarse en remoto",
+      "ineligible_other": "{{count}} perfiles no pueden ejecutarse en remoto",
+      "ineligible_many": "{{count}} perfiles no pueden ejecutarse en remoto",
+      "reasonSync": "La sincronización está desactivada",
+      "reasonEncrypted": "Cifrado de extremo a extremo",
+      "reasonNoFingerprint": "Sin sistema operativo registrado",
+      "reasonCrossOs": "Creado para {{os}}: ninguna máquina remota coincide",
+      "reasonNoExitNode": "Sin proxy ni VPN",
+      "fixSync": "Activar la sincronización",
+      "fixEncrypted": "Abrir los ajustes de sincronización",
+      "fixProxy": "Asignar un proxy",
+      "fixFailed": "No se pudo aplicar esa corrección.",
+      "exitNodeHint": "Sin proxy ni VPN, la ejecución sale por la propia dirección del centro de datos de la flota. Horas de tráfico desde una red de alojamiento dañan la identidad del perfil más que no calentarlo en absoluto."
+    },
+    "conflict": {
+      "title": "{{email}} ya calienta este perfil a las {{time}}",
+      "detail": "Dos programaciones sobre un mismo perfil gastan horas por duplicado y pueden chocar durante la ejecución.",
+      "keepTheirs": "Usar su programación",
+      "replace": "Sustituir por la mía",
+      "replaceForbidden": "Solo el propietario o un administrador del equipo puede cambiar la programación de otra persona.",
+      "askThem": "Copiar {{email}}",
+      "emailCopied": "Correo copiado",
+      "copyFailed": "No se pudo copiar la dirección."
+    },
+    "actionBar": {
+      "enrol": "Inscribir en Cookie Bot",
+      "proRequired": "Cookie Bot requiere un plan Pro o Team",
+      "noneEligible": "Ninguno de los perfiles seleccionados se puede calentar en remoto"
+    },
+    "actions": {
+      "enrol": "Inscribir en Cookie Bot",
+      "editSchedule": "Editar programación",
+      "runNow": "Ejecutar ahora",
+      "runStarted": "Ejecución iniciada",
+      "viewActivity": "Ver la actividad",
+      "runNotStarted": "La ejecución no comenzó: {{reason}}"
+    },
+    "state": {
+      "enrolled": "Inscrito",
+      "notEnrolled": "No inscrito",
+      "paused": "En pausa",
+      "summary": "{{cadence}} a las {{time}}",
+      "rowMenu": "Opciones de Cookie Bot para {{name}}",
+      "blocked": "No puede ejecutarse: {{reason}}"
+    },
+    "team": {
+      "title": "Uso del equipo",
+      "pooled_one": "{{used}} de {{total}} h, {{count}} plaza",
+      "pooled_other": "{{used}} de {{total}} h compartidas entre {{count}} plazas",
+      "pooled_many": "{{used}} de {{total}} h compartidas entre {{count}} plazas",
+      "hours": "{{hours}} h",
+      "legendBot": "Cookie Bot",
+      "legendInteractive": "Interactivo",
+      "columnMember": "Miembro",
+      "columnRuns": "Ejecuciones",
+      "columnHours": "Horas",
+      "columnShare": "Cuota",
+      "noActivity": "No hay sesiones remotas en este periodo.",
+      "soloNote": "De momento solo tu propio uso. Invita a compañeros para ver el reparto por miembro.",
+      "runsFailed": "· {{n}} con errores"
+    },
+    "closeReason": {
+      "stoppedByUser": "Detenido a mano",
+      "maxDuration": "Alcanzó el límite de tiempo",
+      "other": "Finalizó: {{reason}}"
+    },
+    "outcome": {
+      "notEntitled": "No está incluido en tu plan",
+      "syncDisabled": "La sincronización está desactivada en este perfil",
+      "encryptedSync": "La sincronización cifrada de extremo a extremo no es compatible",
+      "proxyRequired": "Sin proxy ni VPN asignado",
+      "touchFingerprint": "Las huellas táctiles no son compatibles",
+      "platformUnsupported": "Ninguna máquina ejecuta el sistema de este perfil",
+      "noSites": "No hay sitios que visitar",
+      "quotaExhausted": "Horas remotas agotadas",
+      "profileLocked": "El perfil estaba abierto en otro lugar",
+      "noCapacity": "No había ninguna máquina libre",
+      "managerError": "La flota no pudo iniciar el navegador",
+      "budgetExceeded": "Se agotó el tiempo previsto para la noche",
+      "cancelledByUser": "Detenido a mano",
+      "unknown": "Motivo desconocido ({{code}})"
+    }
+  },
+  "prelaunchGate": {
+    "titleBlocked": "Inicio bloqueado",
+    "titleWarning": "Antes de iniciar",
+    "intro": "Revisa estos problemas de \"{{name}}\" antes de iniciar el navegador.",
+    "fingerprintHeading": "La salida del proxy no coincide con la huella digital",
+    "vpnExtensionHeading": "Extensión VPN detectada",
+    "vpnExtensionIntro": "Extensiones de este perfil que pueden redirigir el tráfico del navegador:",
+    "vpnExtensionConfirmed": "Puede cambiar el proxy",
+    "vpnExtensionLikely": "Podría cambiar el proxy",
+    "vpnExtensionExplainer": "Si alguna de ellas redirige tu tráfico a otro lugar, la ubicación real del navegador dejará de coincidir con la zona horaria, el idioma y la geolocalización con los que se creó este perfil, y Donut no puede detectarlo desde fuera.",
+    "sourceDonut": "Gestionada por Donut",
+    "sourceBrowser": "Instalada en el perfil",
+    "measurementUnreliable": "Como una extensión VPN puede anular el proxy, la comprobación de salida podría no reflejar la ruta que el navegador usa realmente.",
+    "scanIncompleteEncrypted": "Este perfil está cifrado, así que solo se pudieron comprobar las extensiones gestionadas por Donut.",
+    "scanIncompleteEphemeral": "Este perfil aún no tiene datos, así que solo se pudieron comprobar las extensiones gestionadas por Donut.",
+    "scanIncompletePartial": "El análisis de extensiones se interrumpió, así que puede que falten algunas.",
+    "probePending": "Todavía no se ha medido la salida del proxy. Donut la comprobará al iniciar y se detendrá si no coincide.",
+    "launchAnyway": "Iniciar de todos modos",
+    "dontBlockAgain": "No bloquear de nuevo por esta discrepancia exacta",
+    "dontWarnExtensions": "No volver a avisar sobre estas extensiones",
+    "applyToRemaining": "Aplicar esta decisión a los perfiles restantes",
+    "cancelledSummary": "{{cancelled}} de {{total}} inicios cancelados",
+    "cancelled": "Inicio cancelado",
+    "vpnExtensionEntry": " {{version}} — {{capability}}, {{source}}",
+    "scanIncompleteMissing": "Este perfil aún no se ha iniciado, así que solo se pudieron comprobar las extensiones gestionadas por Donut."
  }
 }
@@ -92,7 +92,8 @@
    "window": {
      "minimize": "Réduire",
      "maximize": "Agrandir",
-      "restore": "Restaurer"
+      "restore": "Restaurer",
+      "close": "Fermer la fenêtre"
    },
    "commandPalette": {
      "title": "Palette de commandes",
@@ -199,11 +200,13 @@
    "keepDecryptedProfilesInRam": "Conserver les profils déchiffrés en RAM",
    "keepDecryptedProfilesInRamDescription": "Conserver en RAM la copie déchiffrée des profils protégés par mot de passe entre les lancements pour un démarrage plus rapide. La copie sur disque reste chiffrée dans tous les cas.",
    "privacy": {
-      "consistencyWarning": "Avertissement de cohérence d'empreinte",
-      "consistencyWarningDescription": "Avertir au lancement lorsque le fuseau horaire ou la langue d'un profil ne correspond pas à son nœud de sortie proxy.",
+      "consistencyWarning": "Bloquer en cas d'empreinte incohérente",
+      "consistencyWarningDescription": "Empêche le navigateur de démarrer lorsque le fuseau horaire ou la langue d'un profil ne correspond pas à son nœud de sortie. Vous pourrez tout de même lancer.",
      "clearTraffic": "Effacer tout l'historique de trafic",
      "clearTrafficDescription": "Efface en toute sécurité les statistiques de trafic enregistrées pour chaque profil.",
-      "clearTrafficSuccess": "Historique de trafic effacé"
+      "clearTrafficSuccess": "Historique de trafic effacé",
+      "vpnExtensionWarning": "Avertissement d'extension VPN",
+      "vpnExtensionWarningDescription": "Avertir avant le lancement lorsqu'un profil contient une extension capable de rerouter le trafic du navigateur."
    }
  },
  "header": {
@@ -258,7 +261,8 @@
      "emptyCreate": "Créer un profil",
      "emptyImport": "Importer des profils",
      "emptyFilteredTitle": "Aucun profil trouvé",
-      "emptyFilteredHint": "Aucun profil ne correspond à ce groupe ou à cette recherche. Essayez un autre filtre ou créez-en un."
+      "emptyFilteredHint": "Aucun profil ne correspond à ce groupe ou à cette recherche. Essayez un autre filtre ou créez-en un.",
+      "bot": "Bot"
    },
    "actions": {
      "launch": "Lancer",
@@ -344,6 +348,10 @@
      "nameDesc": "Nom (Z–A)",
      "newest": "Plus récents d’abord",
      "oldest": "Plus anciens d’abord"
+    },
+    "remote": {
+      "runningTooltip": "En cours d'exécution sur une machine distante. Arrêtez-la pour récupérer le profil ici.",
+      "pendingSyncTooltip": "Téléchargement des modifications de la session distante. De nouveau disponible une fois terminé."
    }
  },
  "createProfile": {
@@ -421,6 +429,7 @@
      "deleteProxy": "Supprimer le proxy",
      "cannotDelete_one": "Suppression impossible : utilisé par {{count}} profil",
      "cannotDelete_other": "Suppression impossible : utilisé par {{count}} profils",
+      "cannotDelete_many": "Suppression impossible : utilisé par {{count}} profils",
      "syncEnabled": "Sync activée",
      "syncDisabled": "Sync désactivée",
      "updateSyncFailed": "Échec de la mise à jour de la sync",
@@ -460,7 +469,7 @@
      "ssCipherRequired": "Le chiffrement et le mot de passe sont requis pour Shadowsocks",
      "selectType": "Sélectionnez le type de proxy",
      "saveFailed": "Échec de la sauvegarde du proxy : {{error}}",
-      "vlessType": "VLESS · Vision · REALITY",
+      "vlessType": "VLESS",
      "vlessUri": "URI VLESS",
      "vlessUriPlaceholder": "vless://…",
      "vlessUriHint": "Nécessite XTLS Vision et REALITY.",
@@ -814,6 +823,7 @@
      "selectedCount_plural": "{{count}} cookies sélectionnés",
      "dialogDescription_one": "Copier les cookies d'un profil source vers {{count}} profil sélectionné.",
      "dialogDescription_other": "Copier les cookies d'un profil source vers {{count}} profils sélectionnés.",
+      "dialogDescription_many": "Copier les cookies d'un profil source vers {{count}} profils sélectionnés.",
      "sourceProfile": "Profil source",
      "sourcePlaceholder": "Sélectionnez un profil pour copier les cookies",
      "running": "(en cours)",
@@ -832,6 +842,7 @@
      "failedMessage": "Échec de la copie des cookies : {{error}}",
      "copyButton_one": "Copier {{count}} cookie",
      "copyButton_other": "Copier {{count}} cookies",
+      "copyButton_many": "Copier {{count}} cookies",
      "copyButtonEmpty": "Copier les cookies"
    },
    "success": "Cookies copiés avec succès",
@@ -1403,6 +1414,7 @@
      "deleteVpn": "Supprimer le VPN",
      "cannotDelete_one": "Suppression impossible : utilisé par {{count}} profil",
      "cannotDelete_other": "Suppression impossible : utilisé par {{count}} profils",
+      "cannotDelete_many": "Suppression impossible : utilisé par {{count}} profils",
      "syncCannotDisable": "La sync ne peut pas être désactivée tant que ce VPN est utilisé par des profils synchronisés",
      "deleteSuccess": "VPN supprimé avec succès",
      "deleteFailed": "Échec de la suppression du VPN",
@@ -1481,6 +1493,7 @@
    "loading": "Chargement des groupes...",
    "profileCount_one": "{{count}} profil",
    "profileCount_other": "{{count}} profils",
+    "profileCount_many": "{{count}} profils",
    "groupsLabel": "Groupes",
    "profilesCol": "Profils",
    "syncCannotDisable": "La sync ne peut pas être désactivée tant que ce groupe est utilisé par des profils synchronisés",
@@ -1498,6 +1511,7 @@
    "title": "Assigner un proxy / VPN",
    "description_one": "Assigner un proxy ou VPN à {{count}} profil sélectionné.",
    "description_other": "Assigner un proxy ou VPN à {{count}} profils sélectionnés.",
+    "description_many": "Assigner un proxy ou VPN à {{count}} profils sélectionnés.",
    "selectLabel": "Proxy / VPN",
    "placeholder": "Sélectionnez un proxy ou VPN",
    "noProxy": "Aucun proxy / VPN",
@@ -1517,6 +1531,7 @@
    "title": "Assigner un groupe",
    "description_one": "Assigner un groupe à {{count}} profil sélectionné.",
    "description_other": "Assigner un groupe à {{count}} profils sélectionnés.",
+    "description_many": "Assigner un groupe à {{count}} profils sélectionnés.",
    "selectLabel": "Groupe",
    "placeholder": "Sélectionnez un groupe",
    "noGroup": "Aucun groupe (par défaut)",
@@ -1851,7 +1866,62 @@
    "vlessConfigInvalid": "L’URI VLESS n’est pas valide.",
    "xrayUnavailable": "Xray-core n’est pas disponible sur ce système.",
    "xrayUnsupportedOs": "VLESS nécessite macOS 12 ou une version ultérieure.",
-    "xrayStartFailed": "Impossible de démarrer Xray-core."
+    "xrayStartFailed": "Impossible de démarrer Xray-core.",
+    "cloudNotSignedIn": "Connectez-vous à votre compte Donut Browser pour utiliser cette fonction.",
+    "cloudUnreachable": "Impossible de joindre les serveurs de Donut Browser. Vérifiez votre connexion et réessayez.",
+    "cloudRequestFailed": "La requête a échoué. Réessayez dans un instant.",
+    "remoteRateLimited": "Trop de requêtes. Patientez un instant et réessayez.",
+    "remoteNoCapacity": "Aucune machine distante n'est libre pour le moment. Réessayez dans quelques minutes.",
+    "remoteNotEntitled": "Votre forfait n'inclut pas l'exécution à distance.",
+    "remoteInteractiveNotEntitled": "Votre forfait inclut des heures distantes uniquement pour le Cookie Bot, pas pour les sessions distantes interactives.",
+    "remoteRequiresRemoteExitNode": "Le proxy de ce profil ne fonctionne que sur cet ordinateur (par exemple 127.0.0.1 ou une adresse de réseau local). Les sessions distantes s'exécutent sur nos hôtes et ont donc besoin d'un proxy avec une adresse publique.",
+    "remoteSessionRefused": "La machine distante a refusé cette session.",
+    "remoteSessionNotFound": "Cette session distante n'existe plus.",
+    "remoteSessionConflict": "Ce profil est déjà ouvert ailleurs.",
+    "remoteSyncInProgress": "Ce profil est encore en cours d'envoi vers la synchronisation cloud. Attendez la fin, puis réessayez.",
+    "remoteHoursExhausted": "Vous avez utilisé les {{used}} de vos {{granted}} heures distantes de ce mois.",
+    "notTeamMember": "Vous n'appartenez à aucune équipe.",
+    "cookieBotNotEntitled": "Votre forfait n'inclut pas Cookie Bot.",
+    "cookieBotNotEnrolled": "Ce profil n'est pas encore configuré pour Cookie Bot.",
+    "cookieBotScheduleConflict": "{{email}} chauffe déjà ce profil à {{time}}.",
+    "cookieBotRunInProgress": "Une exécution est déjà en cours pour ce profil.",
+    "cookieBotRunNotFound": "Cette exécution n'existe plus.",
+    "cookieBotInvalidSchedule": "Cette planification n'est pas valide. Vérifiez l'heure, les jours et la durée.",
+    "cookieBotInvalidTimezone": "{{timezone}} n'est pas un fuseau horaire reconnu par le serveur.",
+    "cookieBotInvalidPeriod": "Cette période n'est pas valide. Utilisez un mois tel que 2026-08.",
+    "cookieBotSiteLimit": "Saisissez entre {{min}} et {{max}} sites, chacun sous forme d'adresse http ou https complète.",
+    "cookieBotRequiresCloudSync": "Activez d'abord la synchronisation cloud pour ce profil : une machine distante n'a aucun autre moyen de l'obtenir.",
+    "cookieBotEncryptedSyncUnsupported": "Ce profil utilise une synchronisation chiffrée de bout en bout, qu'une machine distante ne peut pas déchiffrer. Passez-le en synchronisation normale.",
+    "cookieBotUnknownPlatform": "Ce profil n'a aucun système d'exploitation enregistré, il ne peut donc pas être associé à une machine.",
+    "cookieBotUnsupportedPlatform": "Cookie Bot ne peut pas exécuter de profils {{platform}}. Seuls les profils Windows et macOS sont pris en charge.",
+    "cookieBotRequiresExitNode": "Associez d'abord un proxy ou un VPN. Sans cela, l'exécution proviendrait d'une adresse de centre de données, ce qui abîme l'identité du profil.",
+    "cookieBotRequiresRemoteExitNode": "Le proxy de ce profil ne fonctionne que sur cet ordinateur (par exemple 127.0.0.1 ou une adresse de réseau local). Cookie Bot s'exécute sur nos hôtes et a donc besoin d'un proxy avec une adresse publique.",
+    "unknownCode": "Une erreur est survenue : {{code}}",
+    "cookieBotTouchFingerprintUnsupported": "Ce profil déclare un appareil tactile, que le bot ne peut pas piloter. Utilisez une empreinte de bureau.",
+    "profileRunningRemotely": "Ce profil s'exécute sur une machine distante. Arrêtez d'abord la session distante.",
+    "profileRemoteSyncPending": "Une session distante vient de se terminer. Ses modifications doivent être téléchargées avant d'ouvrir ce profil ici.",
+    "profileLockedByMember": "Ce profil est utilisé par {{email}}.",
+    "profileLockedElsewhere": "Ce profil est utilisé sur un autre appareil.",
+    "profileLockUnavailable": "Impossible de vérifier si ce profil est utilisé ailleurs. Vérifiez votre connexion et réessayez.",
+    "fingerprintExitMismatch": "Le nœud de sortie du proxy ne correspond pas à l'empreinte de ce profil.",
+    "launchConsentExpired": "Cette confirmation n'est plus valide. Relancez le profil.",
+    "vpnWorkerStartFailed": "Impossible de démarrer la connexion VPN : {{detail}}",
+    "exitProbeFailed": "Impossible de joindre le nœud de sortie du proxy pour vérifier sa localisation.",
+    "vlessUnsupported": {
+      "security": "Ce serveur VLESS n'utilise pas REALITY. Donut ne prend en charge que VLESS avec REALITY.",
+      "flow": "Ce serveur VLESS n'utilise pas le flux XTLS Vision, requis par Donut.",
+      "transport": "Donut ne prend en charge que VLESS sur TCP simple — ce serveur utilise un autre transport (WebSocket ou gRPC, par exemple).",
+      "encryption": "Ce serveur VLESS utilise un chiffrement non pris en charge par Donut.",
+      "headerType": "Ce serveur VLESS utilise une obfuscation d'en-tête non prise en charge par Donut.",
+      "fingerprint": "Cette URI VLESS demande une empreinte TLS non prise en charge par Donut.",
+      "sni": "Il manque le SNI (sni) nécessaire à REALITY dans l'URI VLESS.",
+      "publicKey": "Il manque la clé publique REALITY (pbk) dans l'URI VLESS.",
+      "scheme": "Ce n'est pas un lien VLESS. Il doit commencer par vless://.",
+      "parameter": "L'URI VLESS contient une option non prise en charge par Donut.",
+      "malformed": "L'URI VLESS n'est pas valide."
+    },
+    "camoufoxRemoved": "Camoufox n'est plus pris en charge. Recréez ce profil avec Wayfern.",
+    "noE2ePasswordSet": "Aucun mot de passe de chiffrement de bout en bout n'est défini. Définissez-en un avant de synchroniser des données chiffrées."
  },
  "rail": {
    "profiles": "Profils",
@@ -1870,7 +1940,9 @@
    },
    "network": "Réseau",
    "integrations": "Intégrations",
-    "account": "Compte"
+    "account": "Compte",
+    "cookieBot": "Cookie Bot",
+    "cookieBotRunning": "Cookie Bot : en cours d'exécution"
  },
  "pageTitle": {
    "proxies": "Réseau",
@@ -1881,7 +1953,8 @@
    "integrations": "Intégrations",
    "account": "Compte",
    "import": "Importer un profil",
-    "shortcuts": "Raccourcis clavier"
+    "shortcuts": "Raccourcis clavier",
+    "cookieBot": "Cookie Bot"
  },
  "encryption": {
    "required": {
@@ -1924,7 +1997,8 @@
    },
    "tabs": {
      "account": "Compte",
-      "selfHosted": "Auto-hébergé"
+      "selfHosted": "Auto-hébergé",
+      "teamUsage": "Utilisation de l'équipe"
    },
    "selfHosted": {
      "title": "Serveur de synchronisation auto-hébergé",
@@ -1937,7 +2011,8 @@
    },
    "deviceOrdinal": "{{ordinal}} sur {{count}}",
    "automationPrimaryOnly": "L'automatisation du navigateur ne fonctionne que sur votre appareil principal (Appareil 1). Déconnectez-vous là-bas pour l'utiliser ici.",
-    "automationActiveHere": "L'automatisation du navigateur est active sur cet appareil."
+    "automationActiveHere": "L'automatisation du navigateur est active sur cet appareil.",
+    "viewTeamUsage": "Voir l'utilisation de l'équipe"
  },
  "shortcutsPage": {
    "title": "Raccourcis clavier",
@@ -1970,7 +2045,8 @@
    "goGroups": "Aller à Groupes",
    "goIntegrations": "Aller à Intégrations",
    "goAccount": "Aller à Compte",
-    "goSettings": "Aller à Paramètres"
+    "goSettings": "Aller à Paramètres",
+    "goCookieBot": "Cookie Bot"
  },
  "closeConfirm": {
    "title": "Fermer Donut Browser ?",
@@ -2091,16 +2167,376 @@
    "description": "Supprime les cookies, l'historique et le cache à la fermeture du navigateur. Les extensions et les favoris sont conservés."
  },
  "consistencyWarning": {
-    "title": "Incohérence d'empreinte",
-    "intro": "La sortie du proxy de « {{name}} » ne correspond pas à l'empreinte de ce profil :",
-    "timezoneTitle": "Incohérence de fuseau horaire",
    "timezoneDetail": "Le nœud de sortie est dans {{exit}}, mais l'empreinte indique {{fingerprint}}.",
-    "languageTitle": "Incohérence de langue",
    "languageDetail": "Le pays de sortie est {{country}}, mais la langue de l'empreinte est {{fingerprint}}.",
    "explainer": "Un fuseau horaire ou une langue en désaccord avec votre IP de sortie est un signal anti-bot fort, même si votre appareil réel ne fuite jamais. Alignez l'empreinte sur l'emplacement du proxy pour réduire les traitements hostiles.",
-    "dontWarnAgain": "Ne plus avertir pour ce profil",
    "matchToProxy": "Aligner l'empreinte sur le proxy",
    "matching": "Alignement…",
    "matchSuccess": "Empreinte mise à jour pour correspondre au proxy. Relancez le profil pour l'appliquer."
+  },
+  "cookieBot": {
+    "title": "Cookie Bot",
+    "description": "Chauffe des profils la nuit sur une machine distante.",
+    "tabs": {
+      "overview": "Aperçu",
+      "schedule": "Planification",
+      "activity": "Activité",
+      "team": "Équipe"
+    },
+    "locked": {
+      "title": "Cookie Bot",
+      "hint": "Cookie Bot chauffe vos profils la nuit sur une machine distante : ils conservent leurs cookies et leur historique sans que votre ordinateur soit allumé. Nécessite un forfait Pro ou Team."
+    },
+    "empty": {
+      "title": "Aucun profil inscrit",
+      "hint": "Choisissez un profil et le bot le chauffe la nuit sur une machine distante. Votre ordinateur peut rester éteint.",
+      "cta": "Inscrire un profil"
+    },
+    "tonight": {
+      "label": "Cette nuit",
+      "nextRun": "Prochaine exécution {{time}}",
+      "dueCount_one": "{{count}} profil prévu",
+      "dueCount_other": "{{count}} profils prévus",
+      "dueCount_many": "{{count}} profils prévus",
+      "nothingScheduled": "Rien de planifié"
+    },
+    "lastDay": {
+      "label": "Dernières 24 heures",
+      "none": "Aucune exécution pour l'instant",
+      "ran_one": "{{count}} exécutée",
+      "ran_other": "{{count}} exécutées",
+      "ran_many": "{{count}} exécutées",
+      "partial_one": "{{count}} partielle",
+      "partial_other": "{{count}} partielles",
+      "partial_many": "{{count}} partielles",
+      "failed_one": "{{count}} en échec",
+      "failed_other": "{{count}} en échec",
+      "failed_many": "{{count}} en échec"
+    },
+    "chart": {
+      "machineTime": "Temps machine par nuit",
+      "minutes": "{{minutes}} min"
+    },
+    "hours": {
+      "label": "Heures distantes",
+      "remaining": "{{remaining}} h restantes sur {{total}}",
+      "remainingOf": "sur {{total}} h",
+      "used": "{{used}} h utilisées sur {{total}}",
+      "resets": "Réinitialisation le {{date}}",
+      "exhausted": "Plus d'heures distantes. Les planifications restent inscrites et reprennent au prochain cycle.",
+      "exhaustedOn": "Plus d'heures distantes. Les planifications restent inscrites et reprennent le {{date}}.",
+      "estimate": "Environ {{hours}} h par semaine · {{remaining}} h restantes sur ce cycle",
+      "estimateOverBudget": "Demande environ {{hours}} h par semaine : il ne reste que {{remaining}} h",
+      "estimateOnly": "Environ {{hours}} h par semaine"
+    },
+    "enrolled": {
+      "columnProfile": "Profil",
+      "columnCadence": "Fréquence",
+      "columnTime": "Heure",
+      "columnNextRun": "Prochaine exécution",
+      "columnLastRun": "Dernière exécution",
+      "enrolProfiles": "Inscrire des profils",
+      "edit": "Modifier la planification",
+      "neverRun": "Jamais",
+      "pausedNoHours": "En pause : plus d'heures",
+      "profileMissing": "Ce profil n'est pas sur cet ordinateur."
+    },
+    "schedule": {
+      "empty": "Rien n'est encore planifié.",
+      "quietHours_one": "{{count}} heure libre",
+      "quietHours_other": "{{count}} heures libres",
+      "quietHours_many": "{{count}} heures libres",
+      "crowded_one": "{{count}} profil démarre en même temps",
+      "crowded_other": "{{count}} profils démarrent en même temps",
+      "crowded_many": "{{count}} profils démarrent en même temps",
+      "unenrol": "Retirer de Cookie Bot",
+      "unenrolTitle": "Retirer {{name}} de Cookie Bot ?",
+      "unenrolDescription": "La chauffe s'arrête dès cette nuit. Les exécutions passées restent dans Activité.",
+      "unenrolled": "Retiré de Cookie Bot"
+    },
+    "status": {
+      "provisioning": "Préparation d'une machine",
+      "ready": "Chargement du profil",
+      "warming": "Chauffe en cours",
+      "finished": "Finalisation",
+      "failed": "En échec"
+    },
+    "runStatus": {
+      "pending": "En file d'attente",
+      "running": "En cours",
+      "succeeded": "Terminée",
+      "partial": "Partielle",
+      "failed": "En échec",
+      "skipped": "Ignorée",
+      "cancelled": "Arrêtée"
+    },
+    "running": {
+      "label": "En cours d'exécution",
+      "more": "+{{count}} de plus",
+      "stop": "Arrêter l'exécution",
+      "stopped": "Exécution arrêtée"
+    },
+    "live": {
+      "idle": "Rien ne s'exécute pour le moment",
+      "streamOffline": "Les mises à jour en direct sont hors ligne",
+      "streamOfflineDetail": "Les mises à jour en direct sont hors ligne, reconnexion en cours. Les exécutions ci-dessous peuvent être obsolètes.",
+      "unnamedSession": "Session distante",
+      "notStartedYet": "La machine n'a pas encore signalé d'heure de début.",
+      "sitesProgress": "{{visited}} sites sur {{total}}",
+      "sitesUnknown": "Sites pas encore signalés",
+      "consentHandled_one": "{{count}} bandeau de consentement traité",
+      "consentHandled_other": "{{count}} bandeaux de consentement traités",
+      "consentHandled_many": "{{count}} bandeaux de consentement traités",
+      "consentUnknown": "Bandeaux de consentement pas encore signalés",
+      "billed": "{{duration}} facturées",
+      "billedUnknown": "Temps facturé pas encore signalé",
+      "chunk": "Partie {{index}} sur {{total}}"
+    },
+    "history": {
+      "title": "Exécutions",
+      "allProfiles": "Tous les profils",
+      "searchPlaceholder": "Rechercher des profils…",
+      "filterAll": "Toutes les exécutions",
+      "filterComplete": "Terminées",
+      "filterPartial": "Partielles",
+      "filterFailed": "En échec",
+      "columnStarted": "Début",
+      "columnProfile": "Profil",
+      "columnDuration": "Durée",
+      "columnSites": "Sites",
+      "columnStatus": "Statut",
+      "columnOperator": "Opérateur",
+      "empty": "Aucune exécution pour l'instant.",
+      "noMatch": "Aucune exécution ne correspond à ce filtre.",
+      "unknownProfile": "Profil inconnu",
+      "outcome": "Raison : {{reason}}",
+      "sitesVisited": "{{visited}}/{{total}}",
+      "sitesFailed_one": "{{count}} site injoignable",
+      "sitesFailed_other": "{{count}} sites injoignables",
+      "sitesFailed_many": "{{count}} sites injoignables",
+      "consentHandled_one": "{{count}} bandeau de consentement traité",
+      "consentHandled_other": "{{count}} bandeaux de consentement traités",
+      "consentHandled_many": "{{count}} bandeaux de consentement traités",
+      "sitesUnknown": "Non communiqué"
+    },
+    "duration": {
+      "hm": "{{hours}} h {{minutes}} min",
+      "ms": "{{minutes}} min {{seconds}} s",
+      "s": "{{seconds}} s"
+    },
+    "picker": {
+      "title": "Inscrire des profils",
+      "description": "Choisissez les profils que le bot doit chauffer la nuit.",
+      "searchPlaceholder": "Rechercher des profils…",
+      "noProfiles": "Aucun profil ne correspond.",
+      "alreadyEnrolled": "Inscrit",
+      "continue_one": "Continuer avec {{count}}",
+      "continue_other": "Continuer avec {{count}}",
+      "continue_many": "Continuer avec {{count}}"
+    },
+    "enrol": {
+      "titleOne": "Inscrire {{name}}",
+      "titleCount_one": "Inscrire {{count}} profil",
+      "titleCount_other": "Inscrire {{count}} profils",
+      "titleCount_many": "Inscrire {{count}} profils",
+      "editTitle": "Modifier la planification",
+      "description": "Le bot ouvre le profil sur une machine distante et parcourt les sites que vous indiquez. Votre ordinateur peut rester éteint.",
+      "summaryNightly": "S'exécute chaque nuit à {{time}}, jusqu'à {{minutes}} min à chaque fois.",
+      "summaryWeeknights": "S'exécute du lundi au vendredi à {{time}}, jusqu'à {{minutes}} min à chaque fois.",
+      "summaryAlternate": "S'exécute une nuit sur deux à {{time}}, jusqu'à {{minutes}} min à chaque fois.",
+      "summaryCustom_one": "S'exécute {{count}} nuit par semaine à {{time}}, jusqu'à {{minutes}} min à chaque fois.",
+      "summaryCustom_other": "S'exécute {{count}} nuits par semaine à {{time}}, jusqu'à {{minutes}} min à chaque fois.",
+      "summaryCustom_many": "S'exécute {{count}} nuits par semaine à {{time}}, jusqu'à {{minutes}} min à chaque fois.",
+      "confirm": "Inscrire pour cette nuit",
+      "confirmSome": "Inscrire {{eligible}} profils sur {{total}} cette nuit",
+      "fixFirst": "Corrigez d'abord ceci",
+      "saving": "Inscription…",
+      "saved": "Planification enregistrée",
+      "enrolled_one": "{{count}} profil inscrit",
+      "enrolled_other": "{{count}} profils inscrits",
+      "enrolled_many": "{{count}} profils inscrits",
+      "adjust": "Ajuster la planification",
+      "cadenceLabel": "Fréquence",
+      "cadenceNightly": "Chaque nuit",
+      "cadenceWeeknights": "Nuits en semaine",
+      "cadenceAlternate": "Une nuit sur deux",
+      "cadenceCustom_one": "{{count}} nuit par semaine",
+      "cadenceCustom_other": "{{count}} nuits par semaine",
+      "cadenceCustom_many": "{{count}} nuits par semaine",
+      "timeLabel": "Heure de début",
+      "timeHint": "Selon le fuseau horaire de l'empreinte de chaque profil.",
+      "maxMinutesLabel": "Minutes maximum",
+      "intensityLabel": "Profondeur",
+      "sitesLabel": "Sites",
+      "sitesPlaceholder": "Une adresse par ligne",
+      "sitesHint_one": "{{count}} site. Seules les pages indiquées ici sont visitées.",
+      "sitesHint_other": "{{count}} sites. Seules les pages indiquées ici sont visitées.",
+      "sitesHint_many": "{{count}} sites. Seules les pages indiquées ici sont visitées.",
+      "sitesTooMany": "{{max}} sites au maximum.",
+      "presetsUnavailable": "Impossible de charger les préréglages de profondeur. Réessayez dans un instant.",
+      "confirmBulkTitle_one": "Inscrire {{count}} profil à Cookie Bot ?",
+      "confirmBulkTitle_other": "Inscrire {{count}} profils à Cookie Bot ?",
+      "confirmBulkTitle_many": "Inscrire {{count}} profils à Cookie Bot ?",
+      "confirmBulkDescription_one": "Cela réserve une exécution nocturne sur vos heures distantes partagées. Vous choisissez l'heure et les sites juste après.",
+      "confirmBulkDescription_other": "Cela réserve {{count}} exécutions nocturnes sur vos heures distantes partagées. Vous choisissez l'heure et les sites juste après.",
+      "confirmBulkDescription_many": "Cela réserve {{count}} exécutions nocturnes sur vos heures distantes partagées. Vous choisissez l'heure et les sites juste après.",
+      "confirmBulkButton_one": "Continuer avec {{count}} profil",
+      "confirmBulkButton_other": "Continuer avec {{count}} profils",
+      "confirmBulkButton_many": "Continuer avec {{count}} profils",
+      "sitesRequired": "Ajoutez au moins un site.",
+      "addSitesFirst": "Ajoutez d'abord un site",
+      "presetsMissing": "Préréglages de profondeur indisponibles",
+      "sourceOwn": "Ma propre liste",
+      "sourceCurated": "Sélection",
+      "sourceSaved": "Enregistrées",
+      "curatedEmpty": "Aucune liste de la sélection n'est disponible pour le moment.",
+      "curatedNote": "Une liste que nous tenons à jour. Chaque profil en tire son propre échantillon : deux profils ne parcourent donc jamais le même ensemble, ce qui empêche la liste elle-même de devenir une signature. Les adresses restent de notre côté.",
+      "savedEmpty": "Rien d'enregistré pour l'instant. Saisissez une liste dans Ma propre liste, puis enregistrez-la depuis là.",
+      "savedNote": "Les sites sont copiés dans la planification au moment de l'enregistrement : modifier une liste plus tard ne touche pas aux planifications existantes.",
+      "savedUnavailable": "Impossible de charger vos listes enregistrées.",
+      "saveAsList": "Enregistrer comme liste",
+      "listNamePlaceholder": "Nommez cette liste",
+      "listSaved": "Liste enregistrée",
+      "listRenamed": "Liste renommée",
+      "listDeleted": "Liste supprimée",
+      "listRename": "Renommer",
+      "listDeleteConfirm": "Supprimer ?",
+      "templateMissing": "Cette liste enregistrée n'existe plus. Choisissez-en une autre.",
+      "templateNameTaken": "Vous avez déjà une liste portant ce nom.",
+      "templateNameInvalid": "Donnez à la liste un nom de {{max}} caractères maximum.",
+      "calendarLabel": "Quand il s'exécute",
+      "daysLabel": "Jours de la semaine",
+      "addSlot": "Ajouter une heure",
+      "slotsFull": "{{max}} heures de départ au maximum.",
+      "removeSlot": "Retirer cette heure",
+      "pickListFirst": "Choisissez d'abord une liste",
+      "finishCalendarFirst": "Terminez d'abord la planification",
+      "duplicateSlot": "Deux lignes ont les mêmes jours et la même heure",
+      "listSites_one": "{{count}} site",
+      "listSites_other": "{{count}} sites",
+      "listSites_many": "{{count}} sites",
+      "summarySlots_one": "S'exécute {{count}} fois par semaine, jusqu'à {{minutes}} min à chaque fois.",
+      "summarySlots_other": "S'exécute {{count}} fois par semaine, jusqu'à {{minutes}} min à chaque fois.",
+      "summarySlots_many": "S'exécute {{count}} fois par semaine, jusqu'à {{minutes}} min à chaque fois.",
+      "templateNameInvalidNoMax": "Ce nom ne peut pas être utilisé pour une liste enregistrée."
+    },
+    "preset": {
+      "light": "Légère",
+      "balanced": "Standard",
+      "deep": "Approfondie"
+    },
+    "template": {
+      "lowIntentPurchaser": "Acheteur à faible intention",
+      "lowIntentPurchaserHint": "Positionne le profil comme un acheteur sensible au prix : comparateurs, coupons, cashback et revente, en arrivant chez les marchands via des agrégateurs plutôt qu'en direct."
+    },
+    "preflight": {
+      "ineligible_one": "{{count}} profil ne peut pas s'exécuter à distance",
+      "ineligible_other": "{{count}} profils ne peuvent pas s'exécuter à distance",
+      "ineligible_many": "{{count}} profils ne peuvent pas s'exécuter à distance",
+      "reasonSync": "La synchronisation est désactivée",
+      "reasonEncrypted": "Chiffré de bout en bout",
+      "reasonNoFingerprint": "Aucun système d'exploitation enregistré",
+      "reasonCrossOs": "Conçu pour {{os}} : aucune machine distante ne correspond",
+      "reasonNoExitNode": "Ni proxy ni VPN",
+      "fixSync": "Activer la synchronisation",
+      "fixEncrypted": "Ouvrir les réglages de synchronisation",
+      "fixProxy": "Associer un proxy",
+      "fixFailed": "Impossible d'appliquer ce correctif.",
+      "exitNodeHint": "Sans proxy ni VPN, l'exécution sort par l'adresse du centre de données de la flotte. Des heures de trafic depuis un réseau d'hébergement abîment l'identité du profil plus que de ne pas le chauffer du tout."
+    },
+    "conflict": {
+      "title": "{{email}} chauffe déjà ce profil à {{time}}",
+      "detail": "Deux planifications sur un même profil consomment les heures en double et peuvent entrer en collision en pleine exécution.",
+      "keepTheirs": "Garder sa planification",
+      "replace": "Remplacer par la mienne",
+      "replaceForbidden": "Seul le propriétaire ou un administrateur de l'équipe peut modifier la planification de quelqu'un d'autre.",
+      "askThem": "Copier {{email}}",
+      "emailCopied": "Adresse copiée",
+      "copyFailed": "Impossible de copier l'adresse."
+    },
+    "actionBar": {
+      "enrol": "Inscrire à Cookie Bot",
+      "proRequired": "Cookie Bot nécessite un forfait Pro ou Team",
+      "noneEligible": "Aucun des profils sélectionnés ne peut être chauffé à distance"
+    },
+    "actions": {
+      "enrol": "Inscrire à Cookie Bot",
+      "editSchedule": "Modifier la planification",
+      "runNow": "Exécuter maintenant",
+      "runStarted": "Exécution lancée",
+      "viewActivity": "Voir l'activité",
+      "runNotStarted": "L'exécution n'a pas démarré : {{reason}}"
+    },
+    "state": {
+      "enrolled": "Inscrit",
+      "notEnrolled": "Non inscrit",
+      "paused": "En pause",
+      "summary": "{{cadence}} à {{time}}",
+      "rowMenu": "Options Cookie Bot pour {{name}}",
+      "blocked": "Ne peut pas s'exécuter : {{reason}}"
+    },
+    "team": {
+      "title": "Utilisation de l'équipe",
+      "pooled_one": "{{used}} h sur {{total}}, {{count}} siège",
+      "pooled_other": "{{used}} h sur {{total}} mutualisées entre {{count}} sièges",
+      "pooled_many": "{{used}} h sur {{total}} mutualisées entre {{count}} sièges",
+      "hours": "{{hours}} h",
+      "legendBot": "Cookie Bot",
+      "legendInteractive": "Interactif",
+      "columnMember": "Membre",
+      "columnRuns": "Exécutions",
+      "columnHours": "Heures",
+      "columnShare": "Part",
+      "noActivity": "Aucune session distante sur cette période.",
+      "soloNote": "Pour l'instant, seulement votre propre utilisation. Invitez des coéquipiers pour voir la répartition par membre.",
+      "runsFailed": "· {{n}} en échec"
+    },
+    "closeReason": {
+      "stoppedByUser": "Arrêté à la main",
+      "maxDuration": "Limite de durée atteinte",
+      "other": "Terminé : {{reason}}"
+    },
+    "outcome": {
+      "notEntitled": "Non inclus dans votre offre",
+      "syncDisabled": "La synchronisation est désactivée pour ce profil",
+      "encryptedSync": "La synchronisation chiffrée de bout en bout n'est pas prise en charge",
+      "proxyRequired": "Aucun proxy ni VPN attaché",
+      "touchFingerprint": "Les empreintes tactiles ne sont pas prises en charge",
+      "platformUnsupported": "Aucune machine n'exécute le système de ce profil",
+      "noSites": "Aucun site à visiter",
+      "quotaExhausted": "Heures distantes épuisées",
+      "profileLocked": "Le profil était ouvert ailleurs",
+      "noCapacity": "Aucune machine n'était libre",
+      "managerError": "La flotte n'a pas pu démarrer le navigateur",
+      "budgetExceeded": "Le temps prévu pour la nuit est épuisé",
+      "cancelledByUser": "Arrêté à la main",
+      "unknown": "Raison inconnue ({{code}})"
+    }
+  },
+  "prelaunchGate": {
+    "titleBlocked": "Lancement bloqué",
+    "titleWarning": "Avant de lancer",
+    "intro": "Examinez ces problèmes concernant « {{name}} » avant de démarrer le navigateur.",
+    "fingerprintHeading": "La sortie du proxy ne correspond pas à l'empreinte",
+    "vpnExtensionHeading": "Extension VPN détectée",
+    "vpnExtensionIntro": "Extensions de ce profil pouvant rerouter le trafic du navigateur :",
+    "vpnExtensionConfirmed": "Peut changer le proxy",
+    "vpnExtensionLikely": "Pourrait changer le proxy",
+    "vpnExtensionExplainer": "Si l'une d'elles redirige votre trafic ailleurs, la position réelle du navigateur ne correspondra plus au fuseau horaire, à la langue et à la géolocalisation avec lesquels ce profil a été créé, et Donut ne peut pas le détecter de l'extérieur.",
+    "sourceDonut": "Gérée par Donut",
+    "sourceBrowser": "Installée dans le profil",
+    "measurementUnreliable": "Comme une extension VPN peut remplacer le proxy, la vérification de la sortie peut ne pas refléter la route réellement empruntée par le navigateur.",
+    "scanIncompleteEncrypted": "Ce profil est chiffré : seules les extensions gérées par Donut ont pu être vérifiées.",
+    "scanIncompleteEphemeral": "Ce profil n'a pas encore de données : seules les extensions gérées par Donut ont pu être vérifiées.",
+    "scanIncompletePartial": "L'analyse des extensions a été interrompue, certaines peuvent manquer.",
+    "probePending": "La sortie du proxy n'a pas encore été mesurée. Donut la vérifiera au démarrage et s'arrêtera si elle ne correspond pas.",
+    "launchAnyway": "Lancer quand même",
+    "dontBlockAgain": "Ne plus bloquer pour cette incohérence exacte",
+    "dontWarnExtensions": "Ne plus m'avertir à propos de ces extensions",
+    "applyToRemaining": "Appliquer ce choix aux profils restants",
+    "cancelledSummary": "{{cancelled}} lancements sur {{total}} annulés",
+    "cancelled": "Lancement annulé",
+    "vpnExtensionEntry": " {{version}} — {{capability}}, {{source}}",
+    "scanIncompleteMissing": "Ce profil n'a jamais été lancé : seules les extensions gérées par Donut ont pu être vérifiées."
  }
 }
@@ -92,7 +92,8 @@
    "window": {
      "minimize": "最小化",
      "maximize": "最大化",
-      "restore": "元に戻す"
+      "restore": "元に戻す",
+      "close": "ウィンドウを閉じる"
    },
    "commandPalette": {
      "title": "コマンドパレット",
@@ -199,11 +200,13 @@
    "keepDecryptedProfilesInRam": "復号済みプロファイルをRAMに保持",
    "keepDecryptedProfilesInRamDescription": "起動を高速化するため、パスワード保護されたプロファイルの復号済みコピーをRAMに保持します。ディスク上のコピーは常に暗号化されたままです。",
    "privacy": {
-      "consistencyWarning": "フィンガープリント整合性の警告",
-      "consistencyWarningDescription": "プロファイルのタイムゾーンや言語がプロキシ出口ノードと一致しない場合、起動時に警告します。",
+      "consistencyWarning": "フィンガープリント不一致時に起動をブロック",
+      "consistencyWarningDescription": "プロファイルのタイムゾーンや言語がプロキシの出口ノードと一致しない場合、ブラウザーの起動を停止します。それでも起動を選択できます。",
      "clearTraffic": "すべてのトラフィック履歴を消去",
      "clearTrafficDescription": "すべてのプロファイルの記録されたトラフィック統計を安全に消去します。",
-      "clearTrafficSuccess": "トラフィック履歴を消去しました"
+      "clearTrafficSuccess": "トラフィック履歴を消去しました",
+      "vpnExtensionWarning": "VPN拡張機能の警告",
+      "vpnExtensionWarningDescription": "ブラウザーの通信を経路変更できる拡張機能がプロファイルに含まれる場合、起動前に警告します。"
    }
  },
  "header": {
@@ -258,7 +261,8 @@
      "emptyCreate": "プロファイルを作成",
      "emptyImport": "プロファイルをインポート",
      "emptyFilteredTitle": "プロファイルが見つかりません",
-      "emptyFilteredHint": "このグループまたは検索に一致するプロファイルはありません。別のフィルターを試すか、新規作成してください。"
+      "emptyFilteredHint": "このグループまたは検索に一致するプロファイルはありません。別のフィルターを試すか、新規作成してください。",
+      "bot": "ボット"
    },
    "actions": {
      "launch": "起動",
@@ -344,6 +348,10 @@
      "nameDesc": "名前 (Z→A)",
      "newest": "新しい順",
      "oldest": "古い順"
+    },
+    "remote": {
+      "runningTooltip": "リモートマシンで実行中です。停止するとプロファイルがここに戻ります。",
+      "pendingSyncTooltip": "リモートセッションの変更をダウンロード中です。完了すると再び使用できます。"
    }
  },
  "createProfile": {
@@ -460,7 +468,7 @@
      "ssCipherRequired": "Shadowsocks には暗号とパスワードが必要です",
      "selectType": "プロキシの種類を選択",
      "saveFailed": "プロキシの保存に失敗しました: {{error}}",
-      "vlessType": "VLESS · Vision · REALITY",
+      "vlessType": "VLESS",
      "vlessUri": "VLESS URI",
      "vlessUriPlaceholder": "vless://…",
      "vlessUriHint": "XTLS Vision と REALITY が必要です。",
@@ -1851,7 +1859,62 @@
    "vlessConfigInvalid": "VLESS URI が無効です。",
    "xrayUnavailable": "このシステムでは Xray-core を利用できません。",
    "xrayUnsupportedOs": "VLESS には macOS 12 以降が必要です。",
-    "xrayStartFailed": "Xray-core を起動できませんでした。"
+    "xrayStartFailed": "Xray-core を起動できませんでした。",
+    "cloudNotSignedIn": "この機能を使うには Donut Browser アカウントにサインインしてください。",
+    "cloudUnreachable": "Donut Browser のサーバーに接続できませんでした。接続を確認してもう一度お試しください。",
+    "cloudRequestFailed": "リクエストに失敗しました。しばらくしてからもう一度お試しください。",
+    "remoteRateLimited": "リクエストが多すぎます。少し待ってからもう一度お試しください。",
+    "remoteNoCapacity": "現在空いているリモートマシンがありません。数分後にもう一度お試しください。",
+    "remoteNotEntitled": "ご利用のプランにはリモート実行が含まれていません。",
+    "remoteInteractiveNotEntitled": "ご利用のプランのリモート時間は Cookie Bot 専用で、手動のリモートセッションには使えません。",
+    "remoteRequiresRemoteExitNode": "このプロファイルのプロキシはこのコンピューター上でのみ有効です（127.0.0.1 やローカルネットワークのアドレスなど）。リモートセッションは当社のホスト上で実行されるため、公開アドレスを持つプロキシが必要です。",
+    "remoteSessionRefused": "リモートマシンがこのセッションを拒否しました。",
+    "remoteSessionNotFound": "そのリモートセッションはすでに存在しません。",
+    "remoteSessionConflict": "このプロファイルはすでに別の場所で開かれています。",
+    "remoteSyncInProgress": "このプロファイルはまだクラウド同期にアップロード中です。同期の完了を待ってからお試しください。",
+    "remoteHoursExhausted": "今月のリモート時間 {{granted}} のうち {{used}} をすべて使い切りました。",
+    "notTeamMember": "どのチームにも所属していません。",
+    "cookieBotNotEntitled": "ご利用のプランには Cookie Bot が含まれていません。",
+    "cookieBotNotEnrolled": "このプロファイルはまだ Cookie Bot 用に設定されていません。",
+    "cookieBotScheduleConflict": "{{email}} がすでにこのプロファイルを {{time}} にウォームアップしています。",
+    "cookieBotRunInProgress": "このプロファイルではすでに実行が進行中です。",
+    "cookieBotRunNotFound": "その実行はすでに存在しません。",
+    "cookieBotInvalidSchedule": "そのスケジュールは無効です。実行時刻、曜日、時間の長さを確認してください。",
+    "cookieBotInvalidTimezone": "{{timezone}} はサーバーが認識できないタイムゾーンです。",
+    "cookieBotInvalidPeriod": "その期間は無効です。2026-08 のような月を指定してください。",
+    "cookieBotSiteLimit": "サイトは {{min}} 件以上 {{max}} 件以下で、それぞれ完全な http または https のアドレスにしてください。",
+    "cookieBotRequiresCloudSync": "先にこのプロファイルのクラウド同期を有効にしてください。リモートマシンが取得する手段が他にありません。",
+    "cookieBotEncryptedSyncUnsupported": "このプロファイルはエンドツーエンド暗号化された同期を使用しており、リモートマシンでは復号できません。通常の同期に切り替えてください。",
+    "cookieBotUnknownPlatform": "このプロファイルには OS が記録されていないため、マシンを割り当てられません。",
+    "cookieBotUnsupportedPlatform": "Cookie Bot は {{platform}} のプロファイルを実行できません。対応しているのは Windows と macOS のプロファイルのみです。",
+    "cookieBotRequiresExitNode": "先にプロキシまたは VPN を設定してください。設定しないと通信がデータセンターのアドレスから出て、プロファイルの信頼性を損ないます。",
+    "cookieBotRequiresRemoteExitNode": "このプロファイルのプロキシはこのコンピューター上でのみ有効です（127.0.0.1 やローカルネットワークのアドレスなど）。Cookie Bot は当社のホスト上で実行されるため、公開アドレスを持つプロキシが必要です。",
+    "unknownCode": "エラーが発生しました: {{code}}",
+    "cookieBotTouchFingerprintUnsupported": "このプロファイルはタッチ端末を名乗っており、ボットは操作できません。デスクトップのフィンガープリントをお使いください。",
+    "profileRunningRemotely": "このプロファイルはリモートマシンで実行中です。先にリモートセッションを停止してください。",
+    "profileRemoteSyncPending": "リモートセッションが終了しました。この profile をここで開く前に、変更のダウンロードを待っています。",
+    "profileLockedByMember": "このプロファイルは {{email}} が使用中です。",
+    "profileLockedElsewhere": "このプロファイルは別のデバイスで使用中です。",
+    "profileLockUnavailable": "このプロファイルが他で使用中か確認できませんでした。接続を確認して再試行してください。",
+    "fingerprintExitMismatch": "プロキシの出口ノードがこのプロファイルのフィンガープリントと一致しません。",
+    "launchConsentExpired": "この確認は無効になりました。もう一度起動してください。",
+    "vpnWorkerStartFailed": "VPN接続を開始できませんでした: {{detail}}",
+    "exitProbeFailed": "プロキシの出口ノードに接続できず、所在地を確認できませんでした。",
+    "vlessUnsupported": {
+      "security": "このVLESSサーバーはREALITYを使用していません。DonutはREALITY付きのVLESSのみに対応しています。",
+      "flow": "このVLESSサーバーは、Donutが必要とするXTLS Visionフローを使用していません。",
+      "transport": "Donutは素のTCP上のVLESSのみに対応しています。このサーバーは別のトランスポート（WebSocketやgRPCなど）を使用しています。",
+      "encryption": "このVLESSサーバーは、Donutが対応していない暗号化設定を使用しています。",
+      "headerType": "このVLESSサーバーは、Donutが対応していないヘッダー難読化を使用しています。",
+      "fingerprint": "このVLESS URIは、Donutが対応していないTLSフィンガープリントを要求しています。",
+      "sni": "VLESS URIに、REALITYに必要なSNI（sni）がありません。",
+      "publicKey": "VLESS URIに、REALITYの公開鍵（pbk）がありません。",
+      "scheme": "これはVLESSリンクではありません。vless:// で始まる必要があります。",
+      "parameter": "VLESS URIに、Donutが対応していないオプションが含まれています。",
+      "malformed": "VLESS URIが無効です。"
+    },
+    "camoufoxRemoved": "Camoufoxはサポートされなくなりました。Wayfernでこのプロファイルを作り直してください。",
+    "noE2ePasswordSet": "エンドツーエンド暗号化のパスワードが設定されていません。暗号化データを同期する前に設定してください。"
  },
  "rail": {
    "profiles": "プロファイル",
@@ -1870,7 +1933,9 @@
    },
    "network": "ネットワーク",
    "integrations": "連携",
-    "account": "アカウント"
+    "account": "アカウント",
+    "cookieBot": "Cookie Bot",
+    "cookieBotRunning": "Cookie Bot — 実行中"
  },
  "pageTitle": {
    "proxies": "ネットワーク",
@@ -1881,7 +1946,8 @@
    "integrations": "連携",
    "account": "アカウント",
    "import": "プロファイルをインポート",
-    "shortcuts": "キーボードショートカット"
+    "shortcuts": "キーボードショートカット",
+    "cookieBot": "Cookie Bot"
  },
  "encryption": {
    "required": {
@@ -1924,7 +1990,8 @@
    },
    "tabs": {
      "account": "アカウント",
-      "selfHosted": "セルフホスト"
+      "selfHosted": "セルフホスト",
+      "teamUsage": "チームの使用状況"
    },
    "selfHosted": {
      "title": "セルフホスト同期サーバー",
@@ -1937,7 +2004,8 @@
    },
    "deviceOrdinal": "{{count}} 台中 {{ordinal}} 台目",
    "automationPrimaryOnly": "ブラウザの自動化はプライマリデバイス（デバイス1）でのみ実行できます。ここで使用するには、そのデバイスでサインアウトしてください。",
-    "automationActiveHere": "ブラウザの自動化はこのデバイスで有効です。"
+    "automationActiveHere": "ブラウザの自動化はこのデバイスで有効です。",
+    "viewTeamUsage": "チームの使用状況を表示"
  },
  "shortcutsPage": {
    "title": "キーボードショートカット",
@@ -1970,7 +2038,8 @@
    "goGroups": "グループへ移動",
    "goIntegrations": "統合へ移動",
    "goAccount": "アカウントへ移動",
-    "goSettings": "設定へ移動"
+    "goSettings": "設定へ移動",
+    "goCookieBot": "Cookie Bot"
  },
  "closeConfirm": {
    "title": "Donut Browser を閉じますか？",
@@ -2091,16 +2160,354 @@
    "description": "ブラウザを閉じるときに Cookie、履歴、キャッシュを消去します。拡張機能とブックマークは保持されます。"
  },
  "consistencyWarning": {
-    "title": "フィンガープリントの不一致",
-    "intro": "「{{name}}」のプロキシ出口がこのプロファイルのフィンガープリントと一致していません:",
-    "timezoneTitle": "タイムゾーンの不一致",
    "timezoneDetail": "出口ノードは {{exit}} にありますが、フィンガープリントは {{fingerprint}} を示しています。",
-    "languageTitle": "言語の不一致",
    "languageDetail": "出口の国は {{country}} ですが、フィンガープリントの言語は {{fingerprint}} です。",
    "explainer": "出口 IP と食い違うタイムゾーンや言語は、実際のデバイス情報が漏れていなくても強力なアンチボットシグナルになります。フィンガープリントをプロキシの場所に合わせて、警戒される扱いを減らしましょう。",
-    "dontWarnAgain": "このプロファイルでは今後警告しない",
    "matchToProxy": "フィンガープリントをプロキシに合わせる",
    "matching": "調整中…",
    "matchSuccess": "フィンガープリントをプロキシに合わせて更新しました。反映するにはプロファイルを再起動してください。"
+  },
+  "cookieBot": {
+    "title": "Cookie Bot",
+    "description": "リモートマシンで夜間にプロファイルをウォームアップします。",
+    "tabs": {
+      "overview": "概要",
+      "schedule": "スケジュール",
+      "activity": "アクティビティ",
+      "team": "チーム"
+    },
+    "locked": {
+      "title": "Cookie Bot",
+      "hint": "Cookie Bot はリモートマシンで夜間にプロファイルをウォームアップするため、お使いのコンピューターを起動していなくても Cookie と履歴が維持されます。Pro または Team プランが必要です。"
+    },
+    "empty": {
+      "title": "登録されたプロファイルはありません",
+      "hint": "プロファイルを選ぶと、ボットが夜間にリモートマシンでウォームアップします。お使いのコンピューターは電源を切っていて構いません。",
+      "cta": "プロファイルを登録"
+    },
+    "tonight": {
+      "label": "今夜",
+      "nextRun": "次回の実行 {{time}}",
+      "dueCount_one": "{{count}} 件のプロファイルが予定",
+      "dueCount_other": "{{count}} 件のプロファイルが予定",
+      "nothingScheduled": "予定はありません"
+    },
+    "lastDay": {
+      "label": "過去 24 時間",
+      "none": "実行はまだありません",
+      "ran_one": "{{count}} 件実行",
+      "ran_other": "{{count}} 件実行",
+      "partial_one": "{{count}} 件が部分完了",
+      "partial_other": "{{count}} 件が部分完了",
+      "failed_one": "{{count}} 件が失敗",
+      "failed_other": "{{count}} 件が失敗"
+    },
+    "chart": {
+      "machineTime": "1 晩あたりのマシン時間",
+      "minutes": "{{minutes}} 分"
+    },
+    "hours": {
+      "label": "リモート時間",
+      "remaining": "{{total}} 時間のうち残り {{remaining}} 時間",
+      "remainingOf": "/ {{total}} 時間",
+      "used": "{{total}} 時間のうち {{used}} 時間を使用",
+      "resets": "{{date}} にリセット",
+      "exhausted": "リモート時間を使い切りました。スケジュールは登録されたままで、次のサイクルで再開します。",
+      "exhaustedOn": "リモート時間を使い切りました。スケジュールは登録されたままで、{{date}} に再開します。",
+      "estimate": "週あたり約 {{hours}} 時間 · 今サイクルの残り {{remaining}} 時間",
+      "estimateOverBudget": "週あたり約 {{hours}} 時間が必要ですが、残りは {{remaining}} 時間のみです",
+      "estimateOnly": "週あたり約 {{hours}} 時間"
+    },
+    "enrolled": {
+      "columnProfile": "プロファイル",
+      "columnCadence": "頻度",
+      "columnTime": "時刻",
+      "columnNextRun": "次回の実行",
+      "columnLastRun": "前回の実行",
+      "enrolProfiles": "プロファイルを登録",
+      "edit": "スケジュールを編集",
+      "neverRun": "なし",
+      "pausedNoHours": "一時停止 — 時間切れ",
+      "profileMissing": "そのプロファイルはこのコンピューターにありません。"
+    },
+    "schedule": {
+      "empty": "まだ何も予定されていません。",
+      "quietHours_one": "空き時間 {{count}} 時間",
+      "quietHours_other": "空き時間 {{count}} 時間",
+      "crowded_one": "{{count}} 件のプロファイルが同時に開始",
+      "crowded_other": "{{count}} 件のプロファイルが同時に開始",
+      "unenrol": "Cookie Bot から削除",
+      "unenrolTitle": "{{name}} を Cookie Bot から削除しますか?",
+      "unenrolDescription": "今夜からウォームアップを停止します。過去の実行はアクティビティに残ります。",
+      "unenrolled": "Cookie Bot から削除しました"
+    },
+    "status": {
+      "provisioning": "マシンを準備中",
+      "ready": "プロファイルを読み込み中",
+      "warming": "ウォームアップ中",
+      "finished": "終了処理中",
+      "failed": "失敗"
+    },
+    "runStatus": {
+      "pending": "待機中",
+      "running": "実行中",
+      "succeeded": "完了",
+      "partial": "部分完了",
+      "failed": "失敗",
+      "skipped": "スキップ",
+      "cancelled": "停止"
+    },
+    "running": {
+      "label": "実行中",
+      "more": "他 {{count}} 件",
+      "stop": "実行を停止",
+      "stopped": "実行を停止しました"
+    },
+    "live": {
+      "idle": "現在実行中のものはありません",
+      "streamOffline": "ライブ更新はオフラインです",
+      "streamOfflineDetail": "ライブ更新はオフラインです。再接続しています。以下の実行は古い可能性があります。",
+      "unnamedSession": "リモートセッション",
+      "notStartedYet": "マシンから開始時刻がまだ報告されていません。",
+      "sitesProgress": "{{total}} サイト中 {{visited}} サイト",
+      "sitesUnknown": "サイトはまだ報告されていません",
+      "consentHandled_one": "同意ダイアログを {{count}} 件処理",
+      "consentHandled_other": "同意ダイアログを {{count}} 件処理",
+      "consentUnknown": "同意ダイアログはまだ報告されていません",
+      "billed": "{{duration}} を課金",
+      "billedUnknown": "課金時間はまだ報告されていません",
+      "chunk": "{{total}} 分割中 {{index}} 番目"
+    },
+    "history": {
+      "title": "実行履歴",
+      "allProfiles": "すべてのプロファイル",
+      "searchPlaceholder": "プロファイルを検索…",
+      "filterAll": "すべての実行",
+      "filterComplete": "完了",
+      "filterPartial": "部分完了",
+      "filterFailed": "失敗",
+      "columnStarted": "開始",
+      "columnProfile": "プロファイル",
+      "columnDuration": "所要時間",
+      "columnSites": "サイト",
+      "columnStatus": "ステータス",
+      "columnOperator": "実行者",
+      "empty": "実行はまだありません。",
+      "noMatch": "このフィルターに一致する実行はありません。",
+      "unknownProfile": "不明なプロファイル",
+      "outcome": "理由: {{reason}}",
+      "sitesVisited": "{{visited}}/{{total}}",
+      "sitesFailed_one": "{{count}} サイトに接続できませんでした",
+      "sitesFailed_other": "{{count}} サイトに接続できませんでした",
+      "consentHandled_one": "同意ダイアログを {{count}} 件処理",
+      "consentHandled_other": "同意ダイアログを {{count}} 件処理",
+      "sitesUnknown": "未報告"
+    },
+    "duration": {
+      "hm": "{{hours}} 時間 {{minutes}} 分",
+      "ms": "{{minutes}} 分 {{seconds}} 秒",
+      "s": "{{seconds}} 秒"
+    },
+    "picker": {
+      "title": "プロファイルを登録",
+      "description": "ボットが夜間にウォームアップするプロファイルを選びます。",
+      "searchPlaceholder": "プロファイルを検索…",
+      "noProfiles": "一致するプロファイルはありません。",
+      "alreadyEnrolled": "登録済み",
+      "continue_one": "{{count}} 件で続行",
+      "continue_other": "{{count}} 件で続行"
+    },
+    "enrol": {
+      "titleOne": "{{name}} を登録",
+      "titleCount_one": "{{count}} 件のプロファイルを登録",
+      "titleCount_other": "{{count}} 件のプロファイルを登録",
+      "editTitle": "スケジュールを編集",
+      "description": "ボットはリモートマシンでプロファイルを開き、指定したサイトを閲覧します。お使いのコンピューターは電源を切っていて構いません。",
+      "summaryNightly": "毎晩 {{time}} に、1 回あたり最大 {{minutes}} 分実行します。",
+      "summaryWeeknights": "月曜から金曜の {{time}} に、1 回あたり最大 {{minutes}} 分実行します。",
+      "summaryAlternate": "1 晩おきに {{time}} に、1 回あたり最大 {{minutes}} 分実行します。",
+      "summaryCustom_one": "週 {{count}} 晩、{{time}} に、1 回あたり最大 {{minutes}} 分実行します。",
+      "summaryCustom_other": "週 {{count}} 晩、{{time}} に、1 回あたり最大 {{minutes}} 分実行します。",
+      "confirm": "今夜から登録",
+      "confirmSome": "今夜は {{total}} 件中 {{eligible}} 件を登録",
+      "fixFirst": "先にこちらを解決してください",
+      "saving": "登録中…",
+      "saved": "スケジュールを保存しました",
+      "enrolled_one": "{{count}} 件のプロファイルを登録しました",
+      "enrolled_other": "{{count}} 件のプロファイルを登録しました",
+      "adjust": "スケジュールを調整",
+      "cadenceLabel": "頻度",
+      "cadenceNightly": "毎晩",
+      "cadenceWeeknights": "平日の夜",
+      "cadenceAlternate": "1 晩おき",
+      "cadenceCustom_one": "週 {{count}} 晩",
+      "cadenceCustom_other": "週 {{count}} 晩",
+      "timeLabel": "開始時刻",
+      "timeHint": "各プロファイルのフィンガープリントのタイムゾーン基準です。",
+      "maxMinutesLabel": "最大分数",
+      "intensityLabel": "深さ",
+      "sitesLabel": "サイト",
+      "sitesPlaceholder": "1 行に 1 つのアドレス",
+      "sitesHint_one": "{{count}} サイト。ここに記載したページのみ閲覧します。",
+      "sitesHint_other": "{{count}} サイト。ここに記載したページのみ閲覧します。",
+      "sitesTooMany": "サイトは最大 {{max}} 件までです。",
+      "presetsUnavailable": "深さのプリセットを読み込めませんでした。しばらくしてからもう一度お試しください。",
+      "confirmBulkTitle_one": "{{count}} 件のプロファイルを Cookie Bot に登録しますか?",
+      "confirmBulkTitle_other": "{{count}} 件のプロファイルを Cookie Bot に登録しますか?",
+      "confirmBulkDescription_one": "共有のリモート時間から夜間の実行を 1 件予約します。時刻とサイトは次の画面で選びます。",
+      "confirmBulkDescription_other": "共有のリモート時間から夜間の実行を {{count}} 件予約します。時刻とサイトは次の画面で選びます。",
+      "confirmBulkButton_one": "{{count}} 件のプロファイルで続行",
+      "confirmBulkButton_other": "{{count}} 件のプロファイルで続行",
+      "sitesRequired": "サイトを 1 件以上追加してください。",
+      "addSitesFirst": "先にサイトを追加してください",
+      "presetsMissing": "深さのプリセットを利用できません",
+      "sourceOwn": "自分のリスト",
+      "sourceCurated": "厳選リスト",
+      "sourceSaved": "保存済み",
+      "curatedEmpty": "現在利用できる厳選リストはありません。",
+      "curatedNote": "こちらで最新に保っている厳選リストです。プロファイルごとに異なるサンプルを抽出するため、同じ組み合わせを閲覧するプロファイルは 2 つとありません。これがリスト自体を特徴にさせない仕組みです。アドレスはサーバー側に留まります。",
+      "savedEmpty": "まだ保存されていません。「自分のリスト」でリストを入力し、そこから保存してください。",
+      "savedNote": "サイトは保存時にスケジュールへコピーされます。後からリストを編集しても既存のスケジュールは変わりません。",
+      "savedUnavailable": "保存済みのリストを読み込めませんでした。",
+      "saveAsList": "リストとして保存",
+      "listNamePlaceholder": "リスト名を入力",
+      "listSaved": "リストを保存しました",
+      "listRenamed": "リスト名を変更しました",
+      "listDeleted": "リストを削除しました",
+      "listRename": "名前を変更",
+      "listDeleteConfirm": "削除しますか？",
+      "templateMissing": "その保存済みリストは存在しません。別のものを選んでください。",
+      "templateNameTaken": "同じ名前のリストがすでにあります。",
+      "templateNameInvalid": "リスト名は {{max}} 文字以内にしてください。",
+      "calendarLabel": "実行するタイミング",
+      "daysLabel": "曜日",
+      "addSlot": "時刻を追加",
+      "slotsFull": "開始時刻は最大 {{max}} 件です。",
+      "removeSlot": "この時刻を削除",
+      "pickListFirst": "先にリストを選択",
+      "finishCalendarFirst": "先にスケジュールを完成させてください",
+      "duplicateSlot": "2 つの行の曜日と時刻が同じです",
+      "listSites_one": "{{count}} サイト",
+      "listSites_other": "{{count}} サイト",
+      "summarySlots_one": "週 {{count}} 回、1 回あたり最大 {{minutes}} 分実行します。",
+      "summarySlots_other": "週 {{count}} 回、1 回あたり最大 {{minutes}} 分実行します。",
+      "templateNameInvalidNoMax": "その名前は保存済みリストには使用できません。"
+    },
+    "preset": {
+      "light": "軽め",
+      "balanced": "標準",
+      "deep": "深め"
+    },
+    "template": {
+      "lowIntentPurchaser": "低購買意欲の買い物客",
+      "lowIntentPurchaserHint": "価格に敏感な買い手としてプロファイルを位置づけます。比較・クーポン・キャッシュバック・リセールのサイトを巡り、直接ではなく集約サイト経由で小売サイトに到達します。"
+    },
+    "preflight": {
+      "ineligible_one": "{{count}} 件のプロファイルはリモートで実行できません",
+      "ineligible_other": "{{count}} 件のプロファイルはリモートで実行できません",
+      "reasonSync": "同期がオフです",
+      "reasonEncrypted": "エンドツーエンド暗号化",
+      "reasonNoFingerprint": "記録された OS がありません",
+      "reasonCrossOs": "{{os}} 向け — 一致するリモートマシンがありません",
+      "reasonNoExitNode": "プロキシも VPN もありません",
+      "fixSync": "同期をオンにする",
+      "fixEncrypted": "同期設定を開く",
+      "fixProxy": "プロキシを割り当てる",
+      "fixFailed": "その修正を適用できませんでした。",
+      "exitNodeHint": "プロキシも VPN もない場合、通信はマシン群自身のデータセンターのアドレスから出ていきます。ホスティングネットワークからの長時間のトラフィックは、ウォームアップしない場合よりもプロファイルの信頼性を損ないます。"
+    },
+    "conflict": {
+      "title": "{{email}} がすでにこのプロファイルを {{time}} にウォームアップしています",
+      "detail": "1 つのプロファイルに 2 つのスケジュールがあると時間が二重に消費され、実行中に衝突する可能性があります。",
+      "keepTheirs": "相手のスケジュールを使う",
+      "replace": "自分のもので置き換える",
+      "replaceForbidden": "他の人のスケジュールを変更できるのはチームのオーナーまたは管理者のみです。",
+      "askThem": "{{email}} をコピー",
+      "emailCopied": "メールアドレスをコピーしました",
+      "copyFailed": "アドレスをコピーできませんでした。"
+    },
+    "actionBar": {
+      "enrol": "Cookie Bot に登録",
+      "proRequired": "Cookie Bot には Pro または Team プランが必要です",
+      "noneEligible": "選択したプロファイルはいずれもリモートでウォームアップできません"
+    },
+    "actions": {
+      "enrol": "Cookie Bot に登録",
+      "editSchedule": "スケジュールを編集",
+      "runNow": "今すぐ実行",
+      "runStarted": "実行を開始しました",
+      "viewActivity": "アクティビティを表示",
+      "runNotStarted": "実行を開始できませんでした: {{reason}}"
+    },
+    "state": {
+      "enrolled": "登録済み",
+      "notEnrolled": "未登録",
+      "paused": "一時停止",
+      "summary": "{{cadence}} {{time}}",
+      "rowMenu": "{{name}} の Cookie Bot オプション",
+      "blocked": "実行できません: {{reason}}"
+    },
+    "team": {
+      "title": "チームの使用状況",
+      "pooled_one": "{{total}} 時間中 {{used}} 時間、{{count}} シート",
+      "pooled_other": "{{total}} 時間中 {{used}} 時間を {{count}} シートで共有",
+      "hours": "{{hours}} 時間",
+      "legendBot": "Cookie Bot",
+      "legendInteractive": "対話操作",
+      "columnMember": "メンバー",
+      "columnRuns": "実行回数",
+      "columnHours": "時間",
+      "columnShare": "割合",
+      "noActivity": "この期間にリモートセッションはありません。",
+      "soloNote": "今のところ表示されるのはご自身の使用状況のみです。メンバーごとの内訳を見るにはチームメイトを招待してください。",
+      "runsFailed": "・失敗 {{n}} 件"
+    },
+    "closeReason": {
+      "stoppedByUser": "手動で停止しました",
+      "maxDuration": "時間の上限に達しました",
+      "other": "終了: {{reason}}"
+    },
+    "outcome": {
+      "notEntitled": "現在のプランには含まれていません",
+      "syncDisabled": "このプロファイルはクラウド同期がオフです",
+      "encryptedSync": "エンドツーエンド暗号化された同期には対応していません",
+      "proxyRequired": "プロキシまたは VPN が設定されていません",
+      "touchFingerprint": "タッチ端末のフィンガープリントには対応していません",
+      "platformUnsupported": "このプロファイルの OS を実行できるマシンがありません",
+      "noSites": "訪問するサイトがありません",
+      "quotaExhausted": "リモート時間を使い切りました",
+      "profileLocked": "プロファイルが別の場所で開かれていました",
+      "noCapacity": "空きマシンがありませんでした",
+      "managerError": "フリートがブラウザーを起動できませんでした",
+      "budgetExceeded": "その晩の持ち時間を使い切りました",
+      "cancelledByUser": "手動で停止しました",
+      "unknown": "不明な理由 ({{code}})"
+    }
+  },
+  "prelaunchGate": {
+    "titleBlocked": "起動をブロックしました",
+    "titleWarning": "起動する前に",
+    "intro": "ブラウザーを起動する前に、「{{name}}」に関する次の問題を確認してください。",
+    "fingerprintHeading": "プロキシの出口がフィンガープリントと一致しません",
+    "vpnExtensionHeading": "VPN拡張機能を検出しました",
+    "vpnExtensionIntro": "このプロファイル内で、ブラウザーの通信を経路変更できる拡張機能:",
+    "vpnExtensionConfirmed": "プロキシを変更できます",
+    "vpnExtensionLikely": "プロキシを変更する可能性があります",
+    "vpnExtensionExplainer": "いずれかが通信を別の経路に変えると、ブラウザーの実際の所在地は、このプロファイルの作成時に設定されたタイムゾーン・言語・位置情報と一致しなくなります。Donutは外部からそれを検出できません。",
+    "sourceDonut": "Donutが管理",
+    "sourceBrowser": "プロファイルにインストール済み",
+    "measurementUnreliable": "VPN拡張機能はプロキシを上書きできるため、出口の確認結果がブラウザーの実際の経路を表していない可能性があります。",
+    "scanIncompleteEncrypted": "このプロファイルは暗号化されているため、Donutが管理する拡張機能のみ確認できました。",
+    "scanIncompleteEphemeral": "このプロファイルにはまだデータがないため、Donutが管理する拡張機能のみ確認できました。",
+    "scanIncompletePartial": "拡張機能のスキャンが途中で終了したため、一部が表示されていない可能性があります。",
+    "probePending": "プロキシの出口はまだ測定されていません。Donutは起動中に確認し、一致しない場合は停止します。",
+    "launchAnyway": "このまま起動",
+    "dontBlockAgain": "この不一致では今後ブロックしない",
+    "dontWarnExtensions": "これらの拡張機能について今後警告しない",
+    "applyToRemaining": "この選択を残りのプロファイルにも適用",
+    "cancelledSummary": "{{total}}件中{{cancelled}}件の起動をキャンセルしました",
+    "cancelled": "起動をキャンセルしました",
+    "vpnExtensionEntry": " {{version}}（{{capability}}、{{source}}）",
+    "scanIncompleteMissing": "このプロファイルはまだ起動されていないため、Donutが管理する拡張機能のみ確認できました。"
  }
 }
@@ -92,7 +92,8 @@
    "window": {
      "minimize": "최소화",
      "maximize": "최대화",
-      "restore": "이전 크기로 복원"
+      "restore": "이전 크기로 복원",
+      "close": "창 닫기"
    },
    "commandPalette": {
      "title": "명령 팔레트",
@@ -199,11 +200,13 @@
    "keepDecryptedProfilesInRam": "복호화된 프로필을 RAM에 유지",
    "keepDecryptedProfilesInRamDescription": "비밀번호로 보호된 프로필의 복호화된 RAM 사본을 실행 사이에 유지하여 시작 속도를 높입니다. 디스크의 사본은 그대로 암호화된 상태로 유지됩니다.",
    "privacy": {
-      "consistencyWarning": "핑거프린트 일관성 경고",
-      "consistencyWarningDescription": "프로필의 시간대나 언어가 프록시 출구 노드와 일치하지 않으면 실행 시 경고합니다.",
+      "consistencyWarning": "핑거프린트 불일치 시 차단",
+      "consistencyWarningDescription": "프로필의 시간대나 언어가 프록시 출구 노드와 일치하지 않으면 브라우저 시작을 중단합니다. 그래도 실행을 선택할 수 있습니다.",
      "clearTraffic": "모든 트래픽 기록 지우기",
      "clearTrafficDescription": "모든 프로필의 기록된 트래픽 통계를 안전하게 지웁니다.",
-      "clearTrafficSuccess": "트래픽 기록이 지워졌습니다"
+      "clearTrafficSuccess": "트래픽 기록이 지워졌습니다",
+      "vpnExtensionWarning": "VPN 확장 프로그램 경고",
+      "vpnExtensionWarningDescription": "브라우저 트래픽의 경로를 바꿀 수 있는 확장 프로그램이 프로필에 있으면 실행 전에 경고합니다."
    }
  },
  "header": {
@@ -258,7 +261,8 @@
      "emptyCreate": "프로필 생성",
      "emptyImport": "프로필 가져오기",
      "emptyFilteredTitle": "프로필을 찾을 수 없습니다",
-      "emptyFilteredHint": "이 그룹 또는 검색과 일치하는 프로필이 없습니다. 다른 필터를 사용하거나 새로 만드세요."
+      "emptyFilteredHint": "이 그룹 또는 검색과 일치하는 프로필이 없습니다. 다른 필터를 사용하거나 새로 만드세요.",
+      "bot": "봇"
    },
    "actions": {
      "launch": "실행",
@@ -344,6 +348,10 @@
      "nameDesc": "이름 (Z→A)",
      "newest": "최신순",
      "oldest": "오래된순"
+    },
+    "remote": {
+      "runningTooltip": "원격 머신에서 실행 중입니다. 중지하면 프로필이 여기로 돌아옵니다.",
+      "pendingSyncTooltip": "원격 세션이 변경한 내용을 내려받는 중입니다. 완료되면 다시 사용할 수 있습니다."
    }
  },
  "createProfile": {
@@ -460,7 +468,7 @@
      "ssCipherRequired": "Shadowsocks에는 암호화와 비밀번호가 필요합니다",
      "selectType": "프록시 유형 선택",
      "saveFailed": "프록시 저장 실패: {{error}}",
-      "vlessType": "VLESS · Vision · REALITY",
+      "vlessType": "VLESS",
      "vlessUri": "VLESS URI",
      "vlessUriPlaceholder": "vless://…",
      "vlessUriHint": "XTLS Vision 및 REALITY가 필요합니다.",
@@ -1851,7 +1859,62 @@
    "vlessConfigInvalid": "VLESS URI가 올바르지 않습니다.",
    "xrayUnavailable": "이 시스템에서는 Xray-core를 사용할 수 없습니다.",
    "xrayUnsupportedOs": "VLESS를 사용하려면 macOS 12 이상이 필요합니다.",
-    "xrayStartFailed": "Xray-core를 시작할 수 없습니다."
+    "xrayStartFailed": "Xray-core를 시작할 수 없습니다.",
+    "cloudNotSignedIn": "이 기능을 사용하려면 Donut Browser 계정에 로그인하세요.",
+    "cloudUnreachable": "Donut Browser 서버에 연결하지 못했습니다. 연결 상태를 확인하고 다시 시도하세요.",
+    "cloudRequestFailed": "요청이 실패했습니다. 잠시 후 다시 시도하세요.",
+    "remoteRateLimited": "요청이 너무 많습니다. 잠시 기다렸다가 다시 시도하세요.",
+    "remoteNoCapacity": "지금은 사용 가능한 원격 머신이 없습니다. 몇 분 후에 다시 시도하세요.",
+    "remoteNotEntitled": "현재 요금제에는 원격 실행이 포함되어 있지 않습니다.",
+    "remoteInteractiveNotEntitled": "현재 플랜의 원격 시간은 Cookie Bot 전용이며, 직접 조작하는 원격 세션에는 사용할 수 없습니다.",
+    "remoteRequiresRemoteExitNode": "이 프로필의 프록시는 이 컴퓨터에서만 작동합니다(예: 127.0.0.1 또는 사설망 주소). 원격 세션은 당사 호스트에서 실행되므로 공용 주소를 가진 프록시가 필요합니다.",
+    "remoteSessionRefused": "원격 머신이 이 세션을 거부했습니다.",
+    "remoteSessionNotFound": "해당 원격 세션은 더 이상 존재하지 않습니다.",
+    "remoteSessionConflict": "이 프로필은 이미 다른 곳에서 열려 있습니다.",
+    "remoteSyncInProgress": "이 프로필은 아직 클라우드 동기화에 업로드 중입니다. 동기화가 끝난 뒤 다시 시도하세요.",
+    "remoteHoursExhausted": "이번 달 원격 시간 {{granted}}시간 중 {{used}}시간을 모두 사용했습니다.",
+    "notTeamMember": "어떤 팀에도 속해 있지 않습니다.",
+    "cookieBotNotEntitled": "현재 요금제에는 Cookie Bot이 포함되어 있지 않습니다.",
+    "cookieBotNotEnrolled": "이 프로필은 아직 Cookie Bot용으로 설정되지 않았습니다.",
+    "cookieBotScheduleConflict": "{{email}} 님이 이미 이 프로필을 {{time}}에 예열합니다.",
+    "cookieBotRunInProgress": "이 프로필에서 이미 실행이 진행 중입니다.",
+    "cookieBotRunNotFound": "해당 실행은 더 이상 존재하지 않습니다.",
+    "cookieBotInvalidSchedule": "일정이 올바르지 않습니다. 실행 시각, 요일, 시간을 확인하세요.",
+    "cookieBotInvalidTimezone": "{{timezone}}은(는) 서버가 인식하지 못하는 시간대입니다.",
+    "cookieBotInvalidPeriod": "기간이 올바르지 않습니다. 2026-08 같은 월 형식을 사용하세요.",
+    "cookieBotSiteLimit": "사이트를 {{min}}개 이상 {{max}}개 이하로, 각각 완전한 http 또는 https 주소로 입력하세요.",
+    "cookieBotRequiresCloudSync": "먼저 이 프로필의 클라우드 동기화를 켜세요. 원격 머신이 프로필을 가져올 다른 방법이 없습니다.",
+    "cookieBotEncryptedSyncUnsupported": "이 프로필은 원격 머신이 복호화할 수 없는 종단 간 암호화 동기화를 사용합니다. 일반 동기화로 전환하세요.",
+    "cookieBotUnknownPlatform": "이 프로필에는 기록된 운영체제가 없어 머신을 배정할 수 없습니다.",
+    "cookieBotUnsupportedPlatform": "Cookie Bot은 {{platform}} 프로필을 실행할 수 없습니다. Windows와 macOS 프로필만 지원합니다.",
+    "cookieBotRequiresExitNode": "먼저 프록시나 VPN을 연결하세요. 없으면 실행 트래픽이 데이터센터 주소에서 나가 프로필 신뢰도를 해칩니다.",
+    "cookieBotRequiresRemoteExitNode": "이 프로필의 프록시는 이 컴퓨터에서만 작동합니다(예: 127.0.0.1 또는 사설망 주소). Cookie Bot은 당사 호스트에서 실행되므로 공용 주소를 가진 프록시가 필요합니다.",
+    "unknownCode": "문제가 발생했습니다: {{code}}",
+    "cookieBotTouchFingerprintUnsupported": "이 프로필은 터치 기기를 표방하며, 봇이 조작할 수 없습니다. 데스크톱 지문을 사용하세요.",
+    "profileRunningRemotely": "이 프로필은 원격 머신에서 실행 중입니다. 먼저 원격 세션을 중지하세요.",
+    "profileRemoteSyncPending": "원격 세션이 방금 끝났습니다. 이 프로필을 여기서 열기 전에 변경 사항을 내려받는 중입니다.",
+    "profileLockedByMember": "이 프로필은 {{email}} 님이 사용 중입니다.",
+    "profileLockedElsewhere": "이 프로필은 다른 기기에서 사용 중입니다.",
+    "profileLockUnavailable": "이 프로필이 다른 곳에서 사용 중인지 확인할 수 없습니다. 연결을 확인한 뒤 다시 시도하세요.",
+    "fingerprintExitMismatch": "프록시 출구 노드가 이 프로필의 핑거프린트와 일치하지 않습니다.",
+    "launchConsentExpired": "해당 확인이 더 이상 유효하지 않습니다. 다시 실행해 보세요.",
+    "vpnWorkerStartFailed": "VPN 연결을 시작하지 못했습니다: {{detail}}",
+    "exitProbeFailed": "프록시 출구 노드에 연결할 수 없어 위치를 확인하지 못했습니다.",
+    "vlessUnsupported": {
+      "security": "이 VLESS 서버는 REALITY를 사용하지 않습니다. Donut은 REALITY를 사용하는 VLESS만 지원합니다.",
+      "flow": "이 VLESS 서버는 Donut이 요구하는 XTLS Vision 플로우를 사용하지 않습니다.",
+      "transport": "Donut은 일반 TCP 기반 VLESS만 지원합니다. 이 서버는 다른 전송 방식(WebSocket, gRPC 등)을 사용합니다.",
+      "encryption": "이 VLESS 서버는 Donut이 지원하지 않는 암호화 설정을 사용합니다.",
+      "headerType": "이 VLESS 서버는 Donut이 지원하지 않는 헤더 난독화를 사용합니다.",
+      "fingerprint": "이 VLESS URI는 Donut이 지원하지 않는 TLS 지문을 요청합니다.",
+      "sni": "VLESS URI에 REALITY에 필요한 SNI(sni)가 없습니다.",
+      "publicKey": "VLESS URI에 REALITY 공개 키(pbk)가 없습니다.",
+      "scheme": "VLESS 링크가 아닙니다. vless:// 로 시작해야 합니다.",
+      "parameter": "VLESS URI에 Donut이 지원하지 않는 옵션이 있습니다.",
+      "malformed": "VLESS URI가 올바르지 않습니다."
+    },
+    "camoufoxRemoved": "Camoufox는 더 이상 지원되지 않습니다. Wayfern으로 이 프로필을 다시 만드세요.",
+    "noE2ePasswordSet": "종단 간 암호화 비밀번호가 설정되지 않았습니다. 암호화된 데이터를 동기화하기 전에 설정하세요."
  },
  "rail": {
    "profiles": "프로필",
@@ -1870,7 +1933,9 @@
    },
    "network": "네트워크",
    "integrations": "통합",
-    "account": "계정"
+    "account": "계정",
+    "cookieBot": "Cookie Bot",
+    "cookieBotRunning": "Cookie Bot — 실행 중"
  },
  "pageTitle": {
    "proxies": "네트워크",
@@ -1881,7 +1946,8 @@
    "integrations": "통합",
    "account": "계정",
    "import": "프로필 가져오기",
-    "shortcuts": "키보드 단축키"
+    "shortcuts": "키보드 단축키",
+    "cookieBot": "Cookie Bot"
  },
  "encryption": {
    "required": {
@@ -1924,7 +1990,8 @@
    },
    "tabs": {
      "account": "계정",
-      "selfHosted": "자체 호스팅"
+      "selfHosted": "자체 호스팅",
+      "teamUsage": "팀 사용량"
    },
    "selfHosted": {
      "title": "자체 호스팅 동기화 서버",
@@ -1937,7 +2004,8 @@
    },
    "deviceOrdinal": "{{count}}대 중 {{ordinal}}번째",
    "automationPrimaryOnly": "브라우저 자동화는 기본 기기(기기 1)에서만 실행됩니다. 여기서 사용하려면 해당 기기에서 로그아웃하세요.",
-    "automationActiveHere": "이 기기에서 브라우저 자동화가 활성화되어 있습니다."
+    "automationActiveHere": "이 기기에서 브라우저 자동화가 활성화되어 있습니다.",
+    "viewTeamUsage": "팀 사용량 보기"
  },
  "shortcutsPage": {
    "title": "키보드 단축키",
@@ -1970,7 +2038,8 @@
    "goGroups": "그룹으로 이동",
    "goIntegrations": "통합으로 이동",
    "goAccount": "계정으로 이동",
-    "goSettings": "설정으로 이동"
+    "goSettings": "설정으로 이동",
+    "goCookieBot": "Cookie Bot"
  },
  "closeConfirm": {
    "title": "Donut Browser를 닫으시겠습니까?",
@@ -2091,16 +2160,354 @@
    "description": "브라우저를 닫을 때 쿠키, 방문 기록, 캐시를 지웁니다. 확장 프로그램과 북마크는 유지됩니다."
  },
  "consistencyWarning": {
-    "title": "핑거프린트 불일치",
-    "intro": "\"{{name}}\"의 프록시 출구가 이 프로필의 핑거프린트와 일치하지 않습니다:",
-    "timezoneTitle": "시간대 불일치",
    "timezoneDetail": "출구 노드는 {{exit}}에 있지만 핑거프린트는 {{fingerprint}}로 보고합니다.",
-    "languageTitle": "언어 불일치",
    "languageDetail": "출구 국가는 {{country}}이지만 핑거프린트 언어는 {{fingerprint}}입니다.",
    "explainer": "출구 IP와 어긋나는 시간대나 언어는 실제 기기 정보가 유출되지 않더라도 강력한 안티봇 신호가 됩니다. 핑거프린트를 프록시 위치에 맞춰 의심받는 상황을 줄이세요.",
-    "dontWarnAgain": "이 프로필에 대해 다시 경고하지 않음",
    "matchToProxy": "지문을 프록시에 맞추기",
    "matching": "맞추는 중…",
    "matchSuccess": "지문이 프록시에 맞게 업데이트되었습니다. 적용하려면 프로필을 다시 실행하세요."
+  },
+  "cookieBot": {
+    "title": "Cookie Bot",
+    "description": "원격 머신에서 밤새 프로필을 예열합니다.",
+    "tabs": {
+      "overview": "개요",
+      "schedule": "일정",
+      "activity": "활동",
+      "team": "팀"
+    },
+    "locked": {
+      "title": "Cookie Bot",
+      "hint": "Cookie Bot은 원격 머신에서 밤새 프로필을 예열해, 내 컴퓨터를 켜 두지 않아도 쿠키와 방문 기록이 유지됩니다. Pro 또는 Team 요금제가 필요합니다."
+    },
+    "empty": {
+      "title": "등록된 프로필이 없습니다",
+      "hint": "프로필을 선택하면 봇이 밤새 원격 머신에서 예열합니다. 내 컴퓨터는 꺼져 있어도 됩니다.",
+      "cta": "프로필 등록"
+    },
+    "tonight": {
+      "label": "오늘 밤",
+      "nextRun": "다음 실행 {{time}}",
+      "dueCount_one": "프로필 {{count}}개 예정",
+      "dueCount_other": "프로필 {{count}}개 예정",
+      "nothingScheduled": "예정된 작업 없음"
+    },
+    "lastDay": {
+      "label": "최근 24시간",
+      "none": "아직 실행 없음",
+      "ran_one": "{{count}}건 실행",
+      "ran_other": "{{count}}건 실행",
+      "partial_one": "{{count}}건 일부 완료",
+      "partial_other": "{{count}}건 일부 완료",
+      "failed_one": "{{count}}건 실패",
+      "failed_other": "{{count}}건 실패"
+    },
+    "chart": {
+      "machineTime": "하룻밤당 머신 시간",
+      "minutes": "{{minutes}}분"
+    },
+    "hours": {
+      "label": "원격 시간",
+      "remaining": "{{total}}시간 중 {{remaining}}시간 남음",
+      "remainingOf": "/ {{total}}시간",
+      "used": "{{total}}시간 중 {{used}}시간 사용",
+      "resets": "{{date}}에 초기화",
+      "exhausted": "남은 원격 시간이 없습니다. 일정은 그대로 등록되어 있으며 다음 주기에 재개됩니다.",
+      "exhaustedOn": "남은 원격 시간이 없습니다. 일정은 그대로 등록되어 있으며 {{date}}에 재개됩니다.",
+      "estimate": "주당 약 {{hours}}시간 · 이번 주기에 {{remaining}}시간 남음",
+      "estimateOverBudget": "주당 약 {{hours}}시간이 필요하지만 {{remaining}}시간만 남았습니다",
+      "estimateOnly": "주당 약 {{hours}}시간"
+    },
+    "enrolled": {
+      "columnProfile": "프로필",
+      "columnCadence": "주기",
+      "columnTime": "시각",
+      "columnNextRun": "다음 실행",
+      "columnLastRun": "마지막 실행",
+      "enrolProfiles": "프로필 등록",
+      "edit": "일정 편집",
+      "neverRun": "없음",
+      "pausedNoHours": "일시 중지 — 시간 소진",
+      "profileMissing": "해당 프로필은 이 컴퓨터에 없습니다."
+    },
+    "schedule": {
+      "empty": "아직 예정된 작업이 없습니다.",
+      "quietHours_one": "빈 시간 {{count}}시간",
+      "quietHours_other": "빈 시간 {{count}}시간",
+      "crowded_one": "프로필 {{count}}개가 동시에 시작",
+      "crowded_other": "프로필 {{count}}개가 동시에 시작",
+      "unenrol": "Cookie Bot에서 제거",
+      "unenrolTitle": "{{name}}을(를) Cookie Bot에서 제거할까요?",
+      "unenrolDescription": "오늘 밤부터 예열이 중단됩니다. 지난 실행 기록은 활동 탭에 남습니다.",
+      "unenrolled": "Cookie Bot에서 제거했습니다"
+    },
+    "status": {
+      "provisioning": "머신 준비 중",
+      "ready": "프로필 불러오는 중",
+      "warming": "예열 중",
+      "finished": "마무리 중",
+      "failed": "실패"
+    },
+    "runStatus": {
+      "pending": "대기 중",
+      "running": "실행 중",
+      "succeeded": "완료",
+      "partial": "일부 완료",
+      "failed": "실패",
+      "skipped": "건너뜀",
+      "cancelled": "중지됨"
+    },
+    "running": {
+      "label": "지금 실행 중",
+      "more": "+{{count}}개 더",
+      "stop": "실행 중지",
+      "stopped": "실행을 중지했습니다"
+    },
+    "live": {
+      "idle": "지금 실행 중인 작업이 없습니다",
+      "streamOffline": "실시간 업데이트가 오프라인입니다",
+      "streamOfflineDetail": "실시간 업데이트가 오프라인입니다. 다시 연결하는 중입니다. 아래 실행 내역은 최신이 아닐 수 있습니다.",
+      "unnamedSession": "원격 세션",
+      "notStartedYet": "머신이 아직 시작 시각을 보고하지 않았습니다.",
+      "sitesProgress": "{{total}}개 사이트 중 {{visited}}개",
+      "sitesUnknown": "사이트가 아직 보고되지 않았습니다",
+      "consentHandled_one": "동의 창 {{count}}개 처리",
+      "consentHandled_other": "동의 창 {{count}}개 처리",
+      "consentUnknown": "동의 창이 아직 보고되지 않았습니다",
+      "billed": "{{duration}} 청구",
+      "billedUnknown": "청구 시간이 아직 보고되지 않았습니다",
+      "chunk": "{{total}}개 중 {{index}}번째"
+    },
+    "history": {
+      "title": "실행 내역",
+      "allProfiles": "모든 프로필",
+      "searchPlaceholder": "프로필 검색…",
+      "filterAll": "모든 실행",
+      "filterComplete": "완료",
+      "filterPartial": "일부 완료",
+      "filterFailed": "실패",
+      "columnStarted": "시작",
+      "columnProfile": "프로필",
+      "columnDuration": "소요 시간",
+      "columnSites": "사이트",
+      "columnStatus": "상태",
+      "columnOperator": "실행자",
+      "empty": "아직 실행 내역이 없습니다.",
+      "noMatch": "이 필터에 해당하는 실행이 없습니다.",
+      "unknownProfile": "알 수 없는 프로필",
+      "outcome": "이유: {{reason}}",
+      "sitesVisited": "{{visited}}/{{total}}",
+      "sitesFailed_one": "사이트 {{count}}개에 접속하지 못했습니다",
+      "sitesFailed_other": "사이트 {{count}}개에 접속하지 못했습니다",
+      "consentHandled_one": "동의 창 {{count}}개 처리",
+      "consentHandled_other": "동의 창 {{count}}개 처리",
+      "sitesUnknown": "보고되지 않음"
+    },
+    "duration": {
+      "hm": "{{hours}}시간 {{minutes}}분",
+      "ms": "{{minutes}}분 {{seconds}}초",
+      "s": "{{seconds}}초"
+    },
+    "picker": {
+      "title": "프로필 등록",
+      "description": "봇이 밤새 예열할 프로필을 선택하세요.",
+      "searchPlaceholder": "프로필 검색…",
+      "noProfiles": "일치하는 프로필이 없습니다.",
+      "alreadyEnrolled": "등록됨",
+      "continue_one": "{{count}}개로 계속",
+      "continue_other": "{{count}}개로 계속"
+    },
+    "enrol": {
+      "titleOne": "{{name}} 등록",
+      "titleCount_one": "프로필 {{count}}개 등록",
+      "titleCount_other": "프로필 {{count}}개 등록",
+      "editTitle": "일정 편집",
+      "description": "봇이 원격 머신에서 프로필을 열고 지정한 사이트를 둘러봅니다. 내 컴퓨터는 꺼져 있어도 됩니다.",
+      "summaryNightly": "매일 밤 {{time}}에 회당 최대 {{minutes}}분 실행합니다.",
+      "summaryWeeknights": "월요일부터 금요일까지 {{time}}에 회당 최대 {{minutes}}분 실행합니다.",
+      "summaryAlternate": "하루 걸러 {{time}}에 회당 최대 {{minutes}}분 실행합니다.",
+      "summaryCustom_one": "주 {{count}}회 밤 {{time}}에 회당 최대 {{minutes}}분 실행합니다.",
+      "summaryCustom_other": "주 {{count}}회 밤 {{time}}에 회당 최대 {{minutes}}분 실행합니다.",
+      "confirm": "오늘 밤부터 등록",
+      "confirmSome": "오늘 밤 {{total}}개 중 {{eligible}}개 등록",
+      "fixFirst": "먼저 이 문제를 해결하세요",
+      "saving": "등록 중…",
+      "saved": "일정을 저장했습니다",
+      "enrolled_one": "프로필 {{count}}개를 등록했습니다",
+      "enrolled_other": "프로필 {{count}}개를 등록했습니다",
+      "adjust": "일정 조정",
+      "cadenceLabel": "주기",
+      "cadenceNightly": "매일 밤",
+      "cadenceWeeknights": "평일 밤",
+      "cadenceAlternate": "하루 걸러",
+      "cadenceCustom_one": "주 {{count}}회 밤",
+      "cadenceCustom_other": "주 {{count}}회 밤",
+      "timeLabel": "시작 시각",
+      "timeHint": "각 프로필 지문의 시간대 기준입니다.",
+      "maxMinutesLabel": "최대 분",
+      "intensityLabel": "깊이",
+      "sitesLabel": "사이트",
+      "sitesPlaceholder": "한 줄에 주소 하나",
+      "sitesHint_one": "사이트 {{count}}개. 여기에 적은 페이지만 방문합니다.",
+      "sitesHint_other": "사이트 {{count}}개. 여기에 적은 페이지만 방문합니다.",
+      "sitesTooMany": "사이트는 최대 {{max}}개입니다.",
+      "presetsUnavailable": "깊이 프리셋을 불러오지 못했습니다. 잠시 후 다시 시도하세요.",
+      "confirmBulkTitle_one": "프로필 {{count}}개를 Cookie Bot에 등록할까요?",
+      "confirmBulkTitle_other": "프로필 {{count}}개를 Cookie Bot에 등록할까요?",
+      "confirmBulkDescription_one": "공유 원격 시간에서 야간 실행 1건을 예약합니다. 시각과 사이트는 다음 단계에서 선택합니다.",
+      "confirmBulkDescription_other": "공유 원격 시간에서 야간 실행 {{count}}건을 예약합니다. 시각과 사이트는 다음 단계에서 선택합니다.",
+      "confirmBulkButton_one": "프로필 {{count}}개로 계속",
+      "confirmBulkButton_other": "프로필 {{count}}개로 계속",
+      "sitesRequired": "사이트를 하나 이상 추가하세요.",
+      "addSitesFirst": "사이트를 먼저 추가하세요",
+      "presetsMissing": "깊이 프리셋을 사용할 수 없습니다",
+      "sourceOwn": "내 목록",
+      "sourceCurated": "큐레이션",
+      "sourceSaved": "저장됨",
+      "curatedEmpty": "지금은 사용할 수 있는 큐레이션 목록이 없습니다.",
+      "curatedNote": "저희가 최신 상태로 관리하는 큐레이션 목록입니다. 프로필마다 서로 다른 표본을 뽑기 때문에 같은 조합을 방문하는 프로필은 없습니다. 그래서 목록 자체가 특징이 되지 않습니다. 주소는 서버에만 남습니다.",
+      "savedEmpty": "아직 저장한 것이 없습니다. 내 목록에서 목록을 입력한 뒤 거기서 저장하세요.",
+      "savedNote": "사이트는 일정을 저장할 때 복사됩니다. 나중에 목록을 수정해도 기존 일정은 그대로 유지됩니다.",
+      "savedUnavailable": "저장된 목록을 불러오지 못했습니다.",
+      "saveAsList": "목록으로 저장",
+      "listNamePlaceholder": "목록 이름",
+      "listSaved": "목록을 저장했습니다",
+      "listRenamed": "목록 이름을 변경했습니다",
+      "listDeleted": "목록을 삭제했습니다",
+      "listRename": "이름 변경",
+      "listDeleteConfirm": "삭제할까요?",
+      "templateMissing": "그 저장된 목록은 더 이상 없습니다. 다른 목록을 선택하세요.",
+      "templateNameTaken": "같은 이름의 목록이 이미 있습니다.",
+      "templateNameInvalid": "목록 이름은 {{max}}자 이하로 지어 주세요.",
+      "calendarLabel": "실행 시점",
+      "daysLabel": "요일",
+      "addSlot": "시간 추가",
+      "slotsFull": "시작 시간은 최대 {{max}}개입니다.",
+      "removeSlot": "이 시간 제거",
+      "pickListFirst": "먼저 목록을 선택하세요",
+      "finishCalendarFirst": "먼저 일정을 완성하세요",
+      "duplicateSlot": "두 행의 요일과 시간이 같습니다",
+      "listSites_one": "사이트 {{count}}개",
+      "listSites_other": "사이트 {{count}}개",
+      "summarySlots_one": "주 {{count}}회, 회당 최대 {{minutes}}분 실행합니다.",
+      "summarySlots_other": "주 {{count}}회, 회당 최대 {{minutes}}분 실행합니다.",
+      "templateNameInvalidNoMax": "저장된 목록에 그 이름은 사용할 수 없습니다."
+    },
+    "preset": {
+      "light": "가볍게",
+      "balanced": "표준",
+      "deep": "깊게"
+    },
+    "template": {
+      "lowIntentPurchaser": "구매 의향이 낮은 쇼핑객",
+      "lowIntentPurchaserHint": "가격에 민감한 구매자로 프로필을 자리매김합니다. 비교·쿠폰·캐시백·중고 거래 사이트를 이용하고, 판매점에는 직접이 아니라 집계 사이트를 거쳐 도달합니다."
+    },
+    "preflight": {
+      "ineligible_one": "프로필 {{count}}개는 원격으로 실행할 수 없습니다",
+      "ineligible_other": "프로필 {{count}}개는 원격으로 실행할 수 없습니다",
+      "reasonSync": "동기화가 꺼져 있음",
+      "reasonEncrypted": "종단 간 암호화",
+      "reasonNoFingerprint": "기록된 운영체제 없음",
+      "reasonCrossOs": "{{os}}용으로 생성됨 — 일치하는 원격 머신 없음",
+      "reasonNoExitNode": "프록시나 VPN 없음",
+      "fixSync": "동기화 켜기",
+      "fixEncrypted": "동기화 설정 열기",
+      "fixProxy": "프록시 연결",
+      "fixFailed": "해당 수정을 적용하지 못했습니다.",
+      "exitNodeHint": "프록시나 VPN이 없으면 실행 트래픽이 머신 풀 자체의 데이터센터 주소로 나갑니다. 호스팅 네트워크에서 몇 시간씩 발생하는 트래픽은 예열을 아예 하지 않는 것보다 프로필 신뢰도를 더 크게 해칩니다."
+    },
+    "conflict": {
+      "title": "{{email}} 님이 이미 이 프로필을 {{time}}에 예열합니다",
+      "detail": "한 프로필에 일정이 두 개면 시간이 두 배로 소모되고 실행 도중 충돌할 수 있습니다.",
+      "keepTheirs": "상대의 일정 사용",
+      "replace": "내 일정으로 교체",
+      "replaceForbidden": "다른 사람의 일정은 팀 소유자나 관리자만 변경할 수 있습니다.",
+      "askThem": "{{email}} 복사",
+      "emailCopied": "이메일을 복사했습니다",
+      "copyFailed": "주소를 복사하지 못했습니다."
+    },
+    "actionBar": {
+      "enrol": "Cookie Bot에 등록",
+      "proRequired": "Cookie Bot에는 Pro 또는 Team 요금제가 필요합니다",
+      "noneEligible": "선택한 프로필 중 원격으로 예열할 수 있는 것이 없습니다"
+    },
+    "actions": {
+      "enrol": "Cookie Bot에 등록",
+      "editSchedule": "일정 편집",
+      "runNow": "지금 실행",
+      "runStarted": "실행을 시작했습니다",
+      "viewActivity": "활동 보기",
+      "runNotStarted": "실행이 시작되지 않았습니다: {{reason}}"
+    },
+    "state": {
+      "enrolled": "등록됨",
+      "notEnrolled": "등록되지 않음",
+      "paused": "일시 중지",
+      "summary": "{{cadence}} {{time}}",
+      "rowMenu": "{{name}}의 Cookie Bot 옵션",
+      "blocked": "실행할 수 없음: {{reason}}"
+    },
+    "team": {
+      "title": "팀 사용량",
+      "pooled_one": "{{total}}시간 중 {{used}}시간, {{count}}석",
+      "pooled_other": "{{total}}시간 중 {{used}}시간을 {{count}}석이 공유",
+      "hours": "{{hours}}시간",
+      "legendBot": "Cookie Bot",
+      "legendInteractive": "직접 사용",
+      "columnMember": "구성원",
+      "columnRuns": "실행 횟수",
+      "columnHours": "시간",
+      "columnShare": "비중",
+      "noActivity": "이 기간에는 원격 세션이 없습니다.",
+      "soloNote": "현재는 본인 사용량만 표시됩니다. 구성원별 분배를 보려면 팀원을 초대하세요.",
+      "runsFailed": "· 실패 {{n}}회"
+    },
+    "closeReason": {
+      "stoppedByUser": "직접 중지했습니다",
+      "maxDuration": "시간 제한에 도달했습니다",
+      "other": "종료됨: {{reason}}"
+    },
+    "outcome": {
+      "notEntitled": "현재 요금제에 포함되어 있지 않습니다",
+      "syncDisabled": "이 프로필은 클라우드 동기화가 꺼져 있습니다",
+      "encryptedSync": "종단 간 암호화 동기화는 지원되지 않습니다",
+      "proxyRequired": "프록시나 VPN이 연결되어 있지 않습니다",
+      "touchFingerprint": "터치 기기 지문은 지원되지 않습니다",
+      "platformUnsupported": "이 프로필의 운영체제를 실행할 머신이 없습니다",
+      "noSites": "방문할 사이트가 없습니다",
+      "quotaExhausted": "원격 시간을 모두 사용했습니다",
+      "profileLocked": "프로필이 다른 곳에서 열려 있었습니다",
+      "noCapacity": "여유 머신이 없었습니다",
+      "managerError": "플릿이 브라우저를 시작하지 못했습니다",
+      "budgetExceeded": "그날 밤의 시간 예산이 소진되었습니다",
+      "cancelledByUser": "직접 중지했습니다",
+      "unknown": "알 수 없는 이유 ({{code}})"
+    }
+  },
+  "prelaunchGate": {
+    "titleBlocked": "실행이 차단됨",
+    "titleWarning": "실행하기 전에",
+    "intro": "브라우저를 시작하기 전에 \"{{name}}\"의 다음 문제를 확인하세요.",
+    "fingerprintHeading": "프록시 출구가 핑거프린트와 일치하지 않음",
+    "vpnExtensionHeading": "VPN 확장 프로그램 감지됨",
+    "vpnExtensionIntro": "이 프로필에서 브라우저 트래픽의 경로를 바꿀 수 있는 확장 프로그램:",
+    "vpnExtensionConfirmed": "프록시를 변경할 수 있음",
+    "vpnExtensionLikely": "프록시를 변경할 수 있음(추정)",
+    "vpnExtensionExplainer": "이 중 하나가 트래픽을 다른 곳으로 보내면 브라우저의 실제 위치가 이 프로필을 만들 때 사용한 시간대, 언어, 지리 정보와 더 이상 일치하지 않으며, Donut은 외부에서 이를 감지할 수 없습니다.",
+    "sourceDonut": "Donut이 관리",
+    "sourceBrowser": "프로필에 설치됨",
+    "measurementUnreliable": "VPN 확장 프로그램이 프록시를 덮어쓸 수 있으므로, 출구 확인 결과가 브라우저의 실제 경로와 다를 수 있습니다.",
+    "scanIncompleteEncrypted": "이 프로필은 암호화되어 있어 Donut이 관리하는 확장 프로그램만 확인할 수 있었습니다.",
+    "scanIncompleteEphemeral": "이 프로필에는 아직 데이터가 없어 Donut이 관리하는 확장 프로그램만 확인할 수 있었습니다.",
+    "scanIncompletePartial": "확장 프로그램 검사가 중단되어 일부가 표시되지 않을 수 있습니다.",
+    "probePending": "프록시 출구를 아직 측정하지 않았습니다. Donut이 시작 중에 확인하고 일치하지 않으면 중단합니다.",
+    "launchAnyway": "그래도 실행",
+    "dontBlockAgain": "이 불일치에 대해 다시 차단하지 않기",
+    "dontWarnExtensions": "이 확장 프로그램에 대해 다시 경고하지 않기",
+    "applyToRemaining": "이 선택을 나머지 프로필에 적용",
+    "cancelledSummary": "{{total}}개 중 {{cancelled}}개의 실행이 취소됨",
+    "cancelled": "실행이 취소됨",
+    "vpnExtensionEntry": " {{version}} — {{capability}}, {{source}}",
+    "scanIncompleteMissing": "이 프로필은 아직 실행된 적이 없어 Donut이 관리하는 확장 프로그램만 확인할 수 있었습니다."
  }
 }
@@ -92,7 +92,8 @@
    "window": {
      "minimize": "Minimizar",
      "maximize": "Maximizar",
-      "restore": "Restaurar"
+      "restore": "Restaurar",
+      "close": "Fechar janela"
    },
    "commandPalette": {
      "title": "Paleta de comandos",
@@ -199,11 +200,13 @@
    "keepDecryptedProfilesInRam": "Manter Perfis Descriptografados na RAM",
    "keepDecryptedProfilesInRamDescription": "Preserva a cópia descriptografada na RAM dos perfis protegidos por senha entre execuções para um início mais rápido. A cópia em disco permanece criptografada em qualquer caso.",
    "privacy": {
-      "consistencyWarning": "Aviso de consistência de impressão digital",
-      "consistencyWarningDescription": "Avisar ao iniciar quando o fuso horário ou o idioma de um perfil não corresponder ao seu nó de saída do proxy.",
+      "consistencyWarning": "Bloquear quando a impressão digital divergir",
+      "consistencyWarningDescription": "Impede que o navegador inicie quando o fuso horário ou o idioma de um perfil não corresponde ao seu nó de saída do proxy. Você ainda pode optar por iniciar.",
      "clearTraffic": "Limpar todo o histórico de tráfego",
      "clearTrafficDescription": "Apaga com segurança as estatísticas de tráfego registradas de todos os perfis.",
-      "clearTrafficSuccess": "Histórico de tráfego limpo"
+      "clearTrafficSuccess": "Histórico de tráfego limpo",
+      "vpnExtensionWarning": "Aviso de extensão VPN",
+      "vpnExtensionWarningDescription": "Avisar antes de iniciar quando um perfil contiver uma extensão capaz de redirecionar o tráfego do navegador."
    }
  },
  "header": {
@@ -258,7 +261,8 @@
      "emptyCreate": "Criar perfil",
      "emptyImport": "Importar perfis",
      "emptyFilteredTitle": "Nenhum perfil encontrado",
-      "emptyFilteredHint": "Nenhum perfil corresponde a este grupo ou pesquisa. Tente outro filtro ou crie um novo."
+      "emptyFilteredHint": "Nenhum perfil corresponde a este grupo ou pesquisa. Tente outro filtro ou crie um novo.",
+      "bot": "Bot"
    },
    "actions": {
      "launch": "Iniciar",
@@ -344,6 +348,10 @@
      "nameDesc": "Nome (Z–A)",
      "newest": "Mais recentes primeiro",
      "oldest": "Mais antigos primeiro"
+    },
+    "remote": {
+      "runningTooltip": "Em execução numa máquina remota. Pare-a para trazer o perfil de volta para aqui.",
+      "pendingSyncTooltip": "A transferir o que a sessão remota alterou. Disponível novamente quando terminar."
    }
  },
  "createProfile": {
@@ -421,6 +429,7 @@
      "deleteProxy": "Excluir proxy",
      "cannotDelete_one": "Não é possível excluir: em uso por {{count}} perfil",
      "cannotDelete_other": "Não é possível excluir: em uso por {{count}} perfis",
+      "cannotDelete_many": "Não é possível excluir: em uso por {{count}} perfis",
      "syncEnabled": "Sincronização ativada",
      "syncDisabled": "Sincronização desativada",
      "updateSyncFailed": "Falha ao atualizar a sincronização",
@@ -460,7 +469,7 @@
      "ssCipherRequired": "Cifra e senha são obrigatórias para Shadowsocks",
      "selectType": "Selecione o tipo de proxy",
      "saveFailed": "Falha ao salvar o proxy: {{error}}",
-      "vlessType": "VLESS · Vision · REALITY",
+      "vlessType": "VLESS",
      "vlessUri": "URI VLESS",
      "vlessUriPlaceholder": "vless://…",
      "vlessUriHint": "Requer XTLS Vision e REALITY.",
@@ -814,6 +823,7 @@
      "selectedCount_plural": "{{count}} cookies selecionados",
      "dialogDescription_one": "Copiar cookies de um perfil de origem para {{count}} perfil selecionado.",
      "dialogDescription_other": "Copiar cookies de um perfil de origem para {{count}} perfis selecionados.",
+      "dialogDescription_many": "Copiar cookies de um perfil de origem para {{count}} perfis selecionados.",
      "sourceProfile": "Perfil de origem",
      "sourcePlaceholder": "Selecione um perfil para copiar os cookies",
      "running": "(em execução)",
@@ -832,6 +842,7 @@
      "failedMessage": "Falha ao copiar cookies: {{error}}",
      "copyButton_one": "Copiar {{count}} cookie",
      "copyButton_other": "Copiar {{count}} cookies",
+      "copyButton_many": "Copiar {{count}} cookies",
      "copyButtonEmpty": "Copiar cookies"
    },
    "success": "Cookies copiados com sucesso",
@@ -1403,6 +1414,7 @@
      "deleteVpn": "Excluir VPN",
      "cannotDelete_one": "Não é possível excluir: em uso por {{count}} perfil",
      "cannotDelete_other": "Não é possível excluir: em uso por {{count}} perfis",
+      "cannotDelete_many": "Não é possível excluir: em uso por {{count}} perfis",
      "syncCannotDisable": "A sincronização não pode ser desativada enquanto esta VPN estiver em uso por perfis sincronizados",
      "deleteSuccess": "VPN excluída com sucesso",
      "deleteFailed": "Falha ao excluir VPN",
@@ -1481,6 +1493,7 @@
    "loading": "Carregando grupos...",
    "profileCount_one": "{{count}} perfil",
    "profileCount_other": "{{count}} perfis",
+    "profileCount_many": "{{count}} perfis",
    "groupsLabel": "Grupos",
    "profilesCol": "Perfis",
    "syncCannotDisable": "A sincronização não pode ser desativada enquanto este grupo estiver em uso por perfis sincronizados",
@@ -1498,6 +1511,7 @@
    "title": "Atribuir proxy / VPN",
    "description_one": "Atribuir um proxy ou VPN a {{count}} perfil selecionado.",
    "description_other": "Atribuir um proxy ou VPN a {{count}} perfis selecionados.",
+    "description_many": "Atribuir um proxy ou VPN a {{count}} perfis selecionados.",
    "selectLabel": "Proxy / VPN",
    "placeholder": "Selecione um proxy ou VPN",
    "noProxy": "Sem proxy / VPN",
@@ -1517,6 +1531,7 @@
    "title": "Atribuir grupo",
    "description_one": "Atribuir um grupo a {{count}} perfil selecionado.",
    "description_other": "Atribuir um grupo a {{count}} perfis selecionados.",
+    "description_many": "Atribuir um grupo a {{count}} perfis selecionados.",
    "selectLabel": "Grupo",
    "placeholder": "Selecione um grupo",
    "noGroup": "Sem grupo (Padrão)",
@@ -1851,7 +1866,62 @@
    "vlessConfigInvalid": "O URI VLESS é inválido.",
    "xrayUnavailable": "O Xray-core não está disponível neste sistema.",
    "xrayUnsupportedOs": "O VLESS requer macOS 12 ou posterior.",
-    "xrayStartFailed": "Não foi possível iniciar o Xray-core."
+    "xrayStartFailed": "Não foi possível iniciar o Xray-core.",
+    "cloudNotSignedIn": "Entre na sua conta do Donut Browser para usar este recurso.",
+    "cloudUnreachable": "Não foi possível contatar os servidores do Donut Browser. Verifique sua conexão e tente novamente.",
+    "cloudRequestFailed": "A solicitação falhou. Tente novamente em instantes.",
+    "remoteRateLimited": "Solicitações demais. Aguarde um momento e tente novamente.",
+    "remoteNoCapacity": "Nenhuma máquina remota está livre agora. Tente novamente em alguns minutos.",
+    "remoteNotEntitled": "Seu plano não inclui execução remota.",
+    "remoteInteractiveNotEntitled": "Seu plano inclui horas remotas apenas para o Cookie Bot, não para sessões remotas interativas.",
+    "remoteRequiresRemoteExitNode": "O proxy deste perfil só funciona neste computador (por exemplo 127.0.0.1 ou um endereço de rede local). As sessões remotas são executadas nos nossos servidores, por isso precisam de um proxy com endereço público.",
+    "remoteSessionRefused": "A máquina remota recusou esta sessão.",
+    "remoteSessionNotFound": "Essa sessão remota não existe mais.",
+    "remoteSessionConflict": "Este perfil já está aberto em outro lugar.",
+    "remoteSyncInProgress": "Este perfil ainda está sendo enviado para a sincronização na nuvem. Aguarde a conclusão e tente novamente.",
+    "remoteHoursExhausted": "Você usou as {{used}} de suas {{granted}} horas remotas deste mês.",
+    "notTeamMember": "Você não faz parte de nenhuma equipe.",
+    "cookieBotNotEntitled": "Seu plano não inclui o Cookie Bot.",
+    "cookieBotNotEnrolled": "Este perfil ainda não está configurado para o Cookie Bot.",
+    "cookieBotScheduleConflict": "{{email}} já aquece este perfil às {{time}}.",
+    "cookieBotRunInProgress": "Já há uma execução em andamento para este perfil.",
+    "cookieBotRunNotFound": "Essa execução não existe mais.",
+    "cookieBotInvalidSchedule": "Essa agenda não é válida. Verifique o horário, os dias e a duração.",
+    "cookieBotInvalidTimezone": "{{timezone}} não é um fuso horário reconhecido pelo servidor.",
+    "cookieBotInvalidPeriod": "Esse período não é válido. Use um mês como 2026-08.",
+    "cookieBotSiteLimit": "Introduza entre {{min}} e {{max}} sites, cada um com um endereço http ou https completo.",
+    "cookieBotRequiresCloudSync": "Ative primeiro a sincronização na nuvem para este perfil: a máquina remota não tem outra forma de obtê-lo.",
+    "cookieBotEncryptedSyncUnsupported": "Este perfil usa sincronização criptografada de ponta a ponta, que a máquina remota não consegue descriptografar. Mude para a sincronização normal.",
+    "cookieBotUnknownPlatform": "Este perfil não tem sistema operacional registrado, então não é possível associá-lo a uma máquina.",
+    "cookieBotUnsupportedPlatform": "O Cookie Bot não pode executar perfis de {{platform}}. Somente perfis Windows e macOS são suportados.",
+    "cookieBotRequiresExitNode": "Anexe primeiro um proxy ou VPN. Sem isso, a execução sairia de um endereço de data center, o que prejudica a identidade do perfil.",
+    "cookieBotRequiresRemoteExitNode": "O proxy deste perfil só funciona neste computador (por exemplo 127.0.0.1 ou um endereço de rede local). O Cookie Bot é executado nos nossos servidores, por isso precisa de um proxy com endereço público.",
+    "unknownCode": "Algo deu errado: {{code}}",
+    "cookieBotTouchFingerprintUnsupported": "Este perfil declara um dispositivo de toque, que o bot não consegue controlar. Use uma impressão digital de computador.",
+    "profileRunningRemotely": "Este perfil está em execução numa máquina remota. Pare primeiro a sessão remota.",
+    "profileRemoteSyncPending": "Uma sessão remota acabou de terminar. A aguardar a transferência das alterações antes de abrir este perfil aqui.",
+    "profileLockedByMember": "Este perfil está a ser utilizado por {{email}}.",
+    "profileLockedElsewhere": "Este perfil está a ser utilizado noutro dispositivo.",
+    "profileLockUnavailable": "Não foi possível verificar se este perfil está a ser utilizado noutro local. Verifique a ligação e tente novamente.",
+    "fingerprintExitMismatch": "O nó de saída do proxy não corresponde à impressão digital deste perfil.",
+    "launchConsentExpired": "Essa confirmação não é mais válida. Tente iniciar novamente.",
+    "vpnWorkerStartFailed": "Não foi possível iniciar a conexão VPN: {{detail}}",
+    "exitProbeFailed": "Não foi possível alcançar o nó de saída do proxy para verificar sua localização.",
+    "vlessUnsupported": {
+      "security": "Este servidor VLESS não usa REALITY. O Donut só oferece suporte a VLESS com REALITY.",
+      "flow": "Este servidor VLESS não usa o fluxo XTLS Vision, exigido pelo Donut.",
+      "transport": "O Donut só oferece suporte a VLESS sobre TCP simples — este servidor usa outro transporte (como WebSocket ou gRPC).",
+      "encryption": "Este servidor VLESS usa uma criptografia sem suporte no Donut.",
+      "headerType": "Este servidor VLESS usa uma ofuscação de cabeçalho sem suporte no Donut.",
+      "fingerprint": "Esta URI VLESS solicita uma impressão digital TLS sem suporte no Donut.",
+      "sni": "Falta na URI VLESS o SNI (sni) necessário para o REALITY.",
+      "publicKey": "Falta na URI VLESS a chave pública do REALITY (pbk).",
+      "scheme": "Isso não é um link VLESS. Ele precisa começar com vless://.",
+      "parameter": "A URI VLESS contém uma opção sem suporte no Donut.",
+      "malformed": "A URI VLESS é inválida."
+    },
+    "camoufoxRemoved": "O Camoufox não é mais compatível. Recrie este perfil com o Wayfern.",
+    "noE2ePasswordSet": "Nenhuma senha de criptografia de ponta a ponta foi definida. Defina uma antes de sincronizar dados criptografados."
  },
  "rail": {
    "profiles": "Perfis",
@@ -1870,7 +1940,9 @@
    },
    "network": "Rede",
    "integrations": "Integrações",
-    "account": "Conta"
+    "account": "Conta",
+    "cookieBot": "Cookie Bot",
+    "cookieBotRunning": "Cookie Bot: em execução agora"
  },
  "pageTitle": {
    "proxies": "Rede",
@@ -1881,7 +1953,8 @@
    "integrations": "Integrações",
    "account": "Conta",
    "import": "Importar perfil",
-    "shortcuts": "Atalhos de teclado"
+    "shortcuts": "Atalhos de teclado",
+    "cookieBot": "Cookie Bot"
  },
  "encryption": {
    "required": {
@@ -1924,7 +1997,8 @@
    },
    "tabs": {
      "account": "Conta",
-      "selfHosted": "Auto-hospedado"
+      "selfHosted": "Auto-hospedado",
+      "teamUsage": "Uso da equipe"
    },
    "selfHosted": {
      "title": "Servidor de sincronização auto-hospedado",
@@ -1937,7 +2011,8 @@
    },
    "deviceOrdinal": "{{ordinal}} de {{count}}",
    "automationPrimaryOnly": "A automação do navegador funciona apenas no seu dispositivo principal (Dispositivo 1). Saia da conta nele para usá-la aqui.",
-    "automationActiveHere": "A automação do navegador está ativa neste dispositivo."
+    "automationActiveHere": "A automação do navegador está ativa neste dispositivo.",
+    "viewTeamUsage": "Ver o uso da equipe"
  },
  "shortcutsPage": {
    "title": "Atalhos de teclado",
@@ -1970,7 +2045,8 @@
    "goGroups": "Ir para Grupos",
    "goIntegrations": "Ir para Integrações",
    "goAccount": "Ir para Conta",
-    "goSettings": "Ir para Configurações"
+    "goSettings": "Ir para Configurações",
+    "goCookieBot": "Cookie Bot"
  },
  "closeConfirm": {
    "title": "Fechar Donut Browser?",
@@ -2091,16 +2167,376 @@
    "description": "Apaga cookies, histórico e cache quando o navegador é fechado. Extensões e favoritos são mantidos."
  },
  "consistencyWarning": {
-    "title": "Divergência de impressão digital",
-    "intro": "A saída do proxy de \"{{name}}\" não corresponde à impressão digital deste perfil:",
-    "timezoneTitle": "Divergência de fuso horário",
    "timezoneDetail": "O nó de saída está em {{exit}}, mas a impressão digital indica {{fingerprint}}.",
-    "languageTitle": "Divergência de idioma",
    "languageDetail": "O país de saída é {{country}}, mas o idioma da impressão digital é {{fingerprint}}.",
    "explainer": "Um fuso horário ou idioma que não combina com seu IP de saída é um forte sinal anti-bot, mesmo que seu dispositivo real nunca vaze. Alinhe a impressão digital com a localização do proxy para reduzir tratamentos hostis.",
-    "dontWarnAgain": "Não avisar novamente para este perfil",
    "matchToProxy": "Ajustar impressão ao proxy",
    "matching": "Ajustando…",
    "matchSuccess": "Impressão digital atualizada para corresponder ao proxy. Reinicie o perfil para aplicar."
+  },
+  "cookieBot": {
+    "title": "Cookie Bot",
+    "description": "Aquecimento noturno de perfis em uma máquina remota.",
+    "tabs": {
+      "overview": "Visão geral",
+      "schedule": "Agenda",
+      "activity": "Atividade",
+      "team": "Equipe"
+    },
+    "locked": {
+      "title": "Cookie Bot",
+      "hint": "O Cookie Bot aquece seus perfis durante a noite em uma máquina remota, para que mantenham os cookies e o histórico sem o seu computador ligado. Requer um plano Pro ou Team."
+    },
+    "empty": {
+      "title": "Nenhum perfil inscrito",
+      "hint": "Escolha um perfil e o bot o aquece durante a noite em uma máquina remota. Seu computador pode ficar desligado.",
+      "cta": "Inscrever um perfil"
+    },
+    "tonight": {
+      "label": "Hoje à noite",
+      "nextRun": "Próxima execução {{time}}",
+      "dueCount_one": "{{count}} perfil pendente",
+      "dueCount_other": "{{count}} perfis pendentes",
+      "dueCount_many": "{{count}} perfis pendentes",
+      "nothingScheduled": "Nada agendado"
+    },
+    "lastDay": {
+      "label": "Últimas 24 horas",
+      "none": "Ainda sem execuções",
+      "ran_one": "{{count}} executado",
+      "ran_other": "{{count}} executados",
+      "ran_many": "{{count}} executados",
+      "partial_one": "{{count}} parcial",
+      "partial_other": "{{count}} parciais",
+      "partial_many": "{{count}} parciais",
+      "failed_one": "{{count}} com falha",
+      "failed_other": "{{count}} com falha",
+      "failed_many": "{{count}} com falha"
+    },
+    "chart": {
+      "machineTime": "Tempo de máquina por noite",
+      "minutes": "{{minutes}} min"
+    },
+    "hours": {
+      "label": "Horas remotas",
+      "remaining": "Restam {{remaining}} h de {{total}}",
+      "remainingOf": "de {{total}} h",
+      "used": "{{used}} de {{total}} h usadas",
+      "resets": "Renova em {{date}}",
+      "exhausted": "Sem horas remotas restantes. As agendas continuam inscritas e retomam no próximo ciclo.",
+      "exhaustedOn": "Sem horas remotas restantes. As agendas continuam inscritas e retomam em {{date}}.",
+      "estimate": "Cerca de {{hours}} h por semana · restam {{remaining}} h neste ciclo",
+      "estimateOverBudget": "Precisa de cerca de {{hours}} h por semana: restam apenas {{remaining}} h",
+      "estimateOnly": "Cerca de {{hours}} h por semana"
+    },
+    "enrolled": {
+      "columnProfile": "Perfil",
+      "columnCadence": "Frequência",
+      "columnTime": "Horário",
+      "columnNextRun": "Próxima execução",
+      "columnLastRun": "Última execução",
+      "enrolProfiles": "Inscrever perfis",
+      "edit": "Editar agenda",
+      "neverRun": "Nunca",
+      "pausedNoHours": "Pausado: sem horas",
+      "profileMissing": "Esse perfil não está neste computador."
+    },
+    "schedule": {
+      "empty": "Ainda não há nada agendado.",
+      "quietHours_one": "{{count}} hora livre",
+      "quietHours_other": "{{count}} horas livres",
+      "quietHours_many": "{{count}} horas livres",
+      "crowded_one": "{{count}} perfil começa ao mesmo tempo",
+      "crowded_other": "{{count}} perfis começam ao mesmo tempo",
+      "crowded_many": "{{count}} perfis começam ao mesmo tempo",
+      "unenrol": "Remover do Cookie Bot",
+      "unenrolTitle": "Remover {{name}} do Cookie Bot?",
+      "unenrolDescription": "Ele deixa de aquecer hoje à noite. As execuções anteriores permanecem em Atividade.",
+      "unenrolled": "Removido do Cookie Bot"
+    },
+    "status": {
+      "provisioning": "Preparando uma máquina",
+      "ready": "Carregando o perfil",
+      "warming": "Aquecendo",
+      "finished": "Finalizando",
+      "failed": "Com falha"
+    },
+    "runStatus": {
+      "pending": "Na fila",
+      "running": "Em execução",
+      "succeeded": "Concluída",
+      "partial": "Parcial",
+      "failed": "Com falha",
+      "skipped": "Ignorada",
+      "cancelled": "Interrompida"
+    },
+    "running": {
+      "label": "Em execução agora",
+      "more": "+{{count}} mais",
+      "stop": "Parar a execução",
+      "stopped": "Execução interrompida"
+    },
+    "live": {
+      "idle": "Nada em execução no momento",
+      "streamOffline": "As atualizações ao vivo estão offline",
+      "streamOfflineDetail": "As atualizações ao vivo estão offline; reconectando. As execuções abaixo podem estar desatualizadas.",
+      "unnamedSession": "Sessão remota",
+      "notStartedYet": "A máquina ainda não informou um horário de início.",
+      "sitesProgress": "{{visited}} de {{total}} sites",
+      "sitesUnknown": "Sites ainda não informados",
+      "consentHandled_one": "{{count}} aviso de consentimento tratado",
+      "consentHandled_other": "{{count}} avisos de consentimento tratados",
+      "consentHandled_many": "{{count}} avisos de consentimento tratados",
+      "consentUnknown": "Avisos de consentimento ainda não informados",
+      "billed": "{{duration}} cobrados",
+      "billedUnknown": "Tempo cobrado ainda não informado",
+      "chunk": "Parte {{index}} de {{total}}"
+    },
+    "history": {
+      "title": "Execuções",
+      "allProfiles": "Todos os perfis",
+      "searchPlaceholder": "Pesquisar perfis…",
+      "filterAll": "Todas as execuções",
+      "filterComplete": "Concluídas",
+      "filterPartial": "Parciais",
+      "filterFailed": "Com falha",
+      "columnStarted": "Início",
+      "columnProfile": "Perfil",
+      "columnDuration": "Duração",
+      "columnSites": "Sites",
+      "columnStatus": "Status",
+      "columnOperator": "Operador",
+      "empty": "Ainda sem execuções.",
+      "noMatch": "Nenhuma execução corresponde a este filtro.",
+      "unknownProfile": "Perfil desconhecido",
+      "outcome": "Motivo: {{reason}}",
+      "sitesVisited": "{{visited}}/{{total}}",
+      "sitesFailed_one": "Não foi possível acessar {{count}} site",
+      "sitesFailed_other": "Não foi possível acessar {{count}} sites",
+      "sitesFailed_many": "Não foi possível acessar {{count}} sites",
+      "consentHandled_one": "{{count}} aviso de consentimento tratado",
+      "consentHandled_other": "{{count}} avisos de consentimento tratados",
+      "consentHandled_many": "{{count}} avisos de consentimento tratados",
+      "sitesUnknown": "Sem dados"
+    },
+    "duration": {
+      "hm": "{{hours}} h {{minutes}} min",
+      "ms": "{{minutes}} min {{seconds}} s",
+      "s": "{{seconds}} s"
+    },
+    "picker": {
+      "title": "Inscrever perfis",
+      "description": "Escolha os perfis que o bot deve aquecer durante a noite.",
+      "searchPlaceholder": "Pesquisar perfis…",
+      "noProfiles": "Nenhum perfil corresponde.",
+      "alreadyEnrolled": "Inscrito",
+      "continue_one": "Continuar com {{count}}",
+      "continue_other": "Continuar com {{count}}",
+      "continue_many": "Continuar com {{count}}"
+    },
+    "enrol": {
+      "titleOne": "Inscrever {{name}}",
+      "titleCount_one": "Inscrever {{count}} perfil",
+      "titleCount_other": "Inscrever {{count}} perfis",
+      "titleCount_many": "Inscrever {{count}} perfis",
+      "editTitle": "Editar agenda",
+      "description": "O bot abre o perfil em uma máquina remota e navega pelos sites que você listar. Seu computador pode ficar desligado.",
+      "summaryNightly": "Executa toda noite às {{time}}, até {{minutes}} min por vez.",
+      "summaryWeeknights": "Executa de segunda a sexta às {{time}}, até {{minutes}} min por vez.",
+      "summaryAlternate": "Executa em noites alternadas às {{time}}, até {{minutes}} min por vez.",
+      "summaryCustom_one": "Executa {{count}} noite por semana às {{time}}, até {{minutes}} min por vez.",
+      "summaryCustom_other": "Executa {{count}} noites por semana às {{time}}, até {{minutes}} min por vez.",
+      "summaryCustom_many": "Executa {{count}} noites por semana às {{time}}, até {{minutes}} min por vez.",
+      "confirm": "Inscrever para hoje à noite",
+      "confirmSome": "Inscrever {{eligible}} de {{total}} hoje à noite",
+      "fixFirst": "Corrija isto primeiro",
+      "saving": "Inscrevendo…",
+      "saved": "Agenda salva",
+      "enrolled_one": "{{count}} perfil inscrito",
+      "enrolled_other": "{{count}} perfis inscritos",
+      "enrolled_many": "{{count}} perfis inscritos",
+      "adjust": "Ajustar a agenda",
+      "cadenceLabel": "Frequência",
+      "cadenceNightly": "Toda noite",
+      "cadenceWeeknights": "Noites de semana",
+      "cadenceAlternate": "Noites alternadas",
+      "cadenceCustom_one": "{{count}} noite por semana",
+      "cadenceCustom_other": "{{count}} noites por semana",
+      "cadenceCustom_many": "{{count}} noites por semana",
+      "timeLabel": "Horário de início",
+      "timeHint": "No fuso horário da impressão digital de cada perfil.",
+      "maxMinutesLabel": "Minutos máximos",
+      "intensityLabel": "Profundidade",
+      "sitesLabel": "Sites",
+      "sitesPlaceholder": "Um endereço por linha",
+      "sitesHint_one": "{{count}} site. Somente as páginas listadas aqui são visitadas.",
+      "sitesHint_other": "{{count}} sites. Somente as páginas listadas aqui são visitadas.",
+      "sitesHint_many": "{{count}} sites. Somente as páginas listadas aqui são visitadas.",
+      "sitesTooMany": "No máximo {{max}} sites.",
+      "presetsUnavailable": "Não foi possível carregar as predefinições de profundidade. Tente novamente em instantes.",
+      "confirmBulkTitle_one": "Inscrever {{count}} perfil no Cookie Bot?",
+      "confirmBulkTitle_other": "Inscrever {{count}} perfis no Cookie Bot?",
+      "confirmBulkTitle_many": "Inscrever {{count}} perfis no Cookie Bot?",
+      "confirmBulkDescription_one": "Reserva uma execução noturna nas suas horas remotas compartilhadas. Você escolhe o horário e os sites em seguida.",
+      "confirmBulkDescription_other": "Reservam {{count}} execuções noturnas nas suas horas remotas compartilhadas. Você escolhe o horário e os sites em seguida.",
+      "confirmBulkDescription_many": "Reservam {{count}} execuções noturnas nas suas horas remotas compartilhadas. Você escolhe o horário e os sites em seguida.",
+      "confirmBulkButton_one": "Continuar com {{count}} perfil",
+      "confirmBulkButton_other": "Continuar com {{count}} perfis",
+      "confirmBulkButton_many": "Continuar com {{count}} perfis",
+      "sitesRequired": "Adicione pelo menos um site.",
+      "addSitesFirst": "Adicione um site primeiro",
+      "presetsMissing": "Predefinições de profundidade indisponíveis",
+      "sourceOwn": "Minha própria lista",
+      "sourceCurated": "Selecionadas",
+      "sourceSaved": "Salvas",
+      "curatedEmpty": "Nenhuma lista selecionada está disponível no momento.",
+      "curatedNote": "Uma lista selecionada que mantemos atualizada. Cada perfil retira sua própria amostra dela, então não há dois perfis navegando pelo mesmo conjunto — é isso que impede a lista de virar uma assinatura. Os endereços ficam do nosso lado.",
+      "savedEmpty": "Nada salvo ainda. Digite uma lista em Minha própria lista e salve por lá.",
+      "savedNote": "Os sites são copiados para a programação quando você a salva, então editar uma lista depois não altera as programações existentes.",
+      "savedUnavailable": "Não foi possível carregar suas listas salvas.",
+      "saveAsList": "Salvar como lista",
+      "listNamePlaceholder": "Dê um nome a esta lista",
+      "listSaved": "Lista salva",
+      "listRenamed": "Lista renomeada",
+      "listDeleted": "Lista excluída",
+      "listRename": "Renomear",
+      "listDeleteConfirm": "Excluir?",
+      "templateMissing": "Essa lista salva não existe mais. Escolha outra.",
+      "templateNameTaken": "Você já tem uma lista com esse nome.",
+      "templateNameInvalid": "Dê à lista um nome de até {{max}} caracteres.",
+      "calendarLabel": "Quando executa",
+      "daysLabel": "Dias da semana",
+      "addSlot": "Adicionar um horário",
+      "slotsFull": "No máximo {{max}} horários de início.",
+      "removeSlot": "Remover este horário",
+      "pickListFirst": "Escolha uma lista primeiro",
+      "finishCalendarFirst": "Termine a programação primeiro",
+      "duplicateSlot": "Duas linhas têm os mesmos dias e o mesmo horário",
+      "listSites_one": "{{count}} site",
+      "listSites_other": "{{count}} sites",
+      "listSites_many": "{{count}} sites",
+      "summarySlots_one": "Executa {{count}} vez por semana, até {{minutes}} min por vez.",
+      "summarySlots_other": "Executa {{count}} vezes por semana, até {{minutes}} min por vez.",
+      "summarySlots_many": "Executa {{count}} vezes por semana, até {{minutes}} min por vez.",
+      "templateNameInvalidNoMax": "Esse nome não pode ser usado para uma lista salva."
+    },
+    "preset": {
+      "light": "Leve",
+      "balanced": "Padrão",
+      "deep": "Profunda"
+    },
+    "template": {
+      "lowIntentPurchaser": "Comprador de baixa intenção",
+      "lowIntentPurchaserHint": "Posiciona o perfil como um comprador sensível a preço: sites de comparação, cupons, cashback e revenda, chegando às lojas por agregadores em vez de diretamente."
+    },
+    "preflight": {
+      "ineligible_one": "{{count}} perfil não pode ser executado remotamente",
+      "ineligible_other": "{{count}} perfis não podem ser executados remotamente",
+      "ineligible_many": "{{count}} perfis não podem ser executados remotamente",
+      "reasonSync": "A sincronização está desativada",
+      "reasonEncrypted": "Criptografado de ponta a ponta",
+      "reasonNoFingerprint": "Sem sistema operacional registrado",
+      "reasonCrossOs": "Criado para {{os}}: nenhuma máquina remota corresponde",
+      "reasonNoExitNode": "Sem proxy nem VPN",
+      "fixSync": "Ativar a sincronização",
+      "fixEncrypted": "Abrir as configurações de sincronização",
+      "fixProxy": "Anexar um proxy",
+      "fixFailed": "Não foi possível aplicar essa correção.",
+      "exitNodeHint": "Sem proxy nem VPN, a execução sai pelo próprio endereço do data center da frota. Horas de tráfego vindo de uma rede de hospedagem danificam a identidade do perfil mais do que não aquecê-lo."
+    },
+    "conflict": {
+      "title": "{{email}} já aquece este perfil às {{time}}",
+      "detail": "Duas agendas no mesmo perfil gastam horas em dobro e podem colidir durante a execução.",
+      "keepTheirs": "Usar a agenda dessa pessoa",
+      "replace": "Substituir pela minha",
+      "replaceForbidden": "Somente o proprietário ou um administrador da equipe pode alterar a agenda de outra pessoa.",
+      "askThem": "Copiar {{email}}",
+      "emailCopied": "E-mail copiado",
+      "copyFailed": "Não foi possível copiar o endereço."
+    },
+    "actionBar": {
+      "enrol": "Inscrever no Cookie Bot",
+      "proRequired": "O Cookie Bot requer um plano Pro ou Team",
+      "noneEligible": "Nenhum dos perfis selecionados pode ser aquecido remotamente"
+    },
+    "actions": {
+      "enrol": "Inscrever no Cookie Bot",
+      "editSchedule": "Editar agenda",
+      "runNow": "Executar agora",
+      "runStarted": "Execução iniciada",
+      "viewActivity": "Ver a atividade",
+      "runNotStarted": "A execução não começou: {{reason}}"
+    },
+    "state": {
+      "enrolled": "Inscrito",
+      "notEnrolled": "Não inscrito",
+      "paused": "Pausado",
+      "summary": "{{cadence}} às {{time}}",
+      "rowMenu": "Opções do Cookie Bot para {{name}}",
+      "blocked": "Não pode executar: {{reason}}"
+    },
+    "team": {
+      "title": "Uso da equipe",
+      "pooled_one": "{{used}} de {{total}} h, {{count}} assento",
+      "pooled_other": "{{used}} de {{total}} h compartilhadas entre {{count}} assentos",
+      "pooled_many": "{{used}} de {{total}} h compartilhadas entre {{count}} assentos",
+      "hours": "{{hours}} h",
+      "legendBot": "Cookie Bot",
+      "legendInteractive": "Interativo",
+      "columnMember": "Membro",
+      "columnRuns": "Execuções",
+      "columnHours": "Horas",
+      "columnShare": "Parcela",
+      "noActivity": "Nenhuma sessão remota neste período.",
+      "soloNote": "Por enquanto, apenas o seu uso. Convide colegas para ver a divisão por membro.",
+      "runsFailed": "· {{n}} com falha"
+    },
+    "closeReason": {
+      "stoppedByUser": "Parado à mão",
+      "maxDuration": "Atingiu o limite de tempo",
+      "other": "Terminou: {{reason}}"
+    },
+    "outcome": {
+      "notEntitled": "Não está incluído no seu plano",
+      "syncDisabled": "A sincronização está desligada neste perfil",
+      "encryptedSync": "A sincronização com criptografia ponta a ponta não é suportada",
+      "proxyRequired": "Sem proxy nem VPN associado",
+      "touchFingerprint": "Impressões digitais de toque não são suportadas",
+      "platformUnsupported": "Nenhuma máquina executa o sistema deste perfil",
+      "noSites": "Nenhum site para visitar",
+      "quotaExhausted": "Horas remotas esgotadas",
+      "profileLocked": "O perfil estava aberto noutro lugar",
+      "noCapacity": "Nenhuma máquina estava livre",
+      "managerError": "A frota não conseguiu iniciar o navegador",
+      "budgetExceeded": "O tempo previsto para a noite acabou",
+      "cancelledByUser": "Parado à mão",
+      "unknown": "Motivo desconhecido ({{code}})"
+    }
+  },
+  "prelaunchGate": {
+    "titleBlocked": "Inicialização bloqueada",
+    "titleWarning": "Antes de iniciar",
+    "intro": "Revise estes problemas de \"{{name}}\" antes de iniciar o navegador.",
+    "fingerprintHeading": "A saída do proxy não corresponde à impressão digital",
+    "vpnExtensionHeading": "Extensão VPN detectada",
+    "vpnExtensionIntro": "Extensões neste perfil que podem redirecionar o tráfego do navegador:",
+    "vpnExtensionConfirmed": "Pode alterar o proxy",
+    "vpnExtensionLikely": "Talvez altere o proxy",
+    "vpnExtensionExplainer": "Se alguma delas redirecionar seu tráfego, a localização real do navegador deixará de corresponder ao fuso horário, ao idioma e à geolocalização com que este perfil foi criado, e o Donut não consegue detectar isso de fora.",
+    "sourceDonut": "Gerenciada pelo Donut",
+    "sourceBrowser": "Instalada no perfil",
+    "measurementUnreliable": "Como uma extensão VPN pode substituir o proxy, a verificação de saída pode não refletir a rota que o navegador realmente usa.",
+    "scanIncompleteEncrypted": "Este perfil está criptografado, portanto só foi possível verificar as extensões gerenciadas pelo Donut.",
+    "scanIncompleteEphemeral": "Este perfil ainda não tem dados, portanto só foi possível verificar as extensões gerenciadas pelo Donut.",
+    "scanIncompletePartial": "A verificação de extensões foi interrompida, então algumas podem não estar listadas.",
+    "probePending": "A saída do proxy ainda não foi medida. O Donut vai verificá-la durante a inicialização e parar se não corresponder.",
+    "launchAnyway": "Iniciar mesmo assim",
+    "dontBlockAgain": "Não bloquear novamente para esta divergência exata",
+    "dontWarnExtensions": "Não avisar novamente sobre estas extensões",
+    "applyToRemaining": "Aplicar esta escolha aos perfis restantes",
+    "cancelledSummary": "{{cancelled}} de {{total}} inicializações canceladas",
+    "cancelled": "Inicialização cancelada",
+    "vpnExtensionEntry": " {{version}} — {{capability}}, {{source}}",
+    "scanIncompleteMissing": "Este perfil ainda não foi iniciado, portanto só foi possível verificar as extensões gerenciadas pelo Donut."
  }
 }
@@ -92,7 +92,8 @@
    "window": {
      "minimize": "Свернуть",
      "maximize": "Развернуть",
-      "restore": "Восстановить"
+      "restore": "Восстановить",
+      "close": "Закрыть окно"
    },
    "commandPalette": {
      "title": "Палитра команд",
@@ -199,11 +200,13 @@
    "keepDecryptedProfilesInRam": "Хранить расшифрованные профили в ОЗУ",
    "keepDecryptedProfilesInRamDescription": "Сохранять расшифрованную копию защищённых паролем профилей в ОЗУ между запусками для ускорения старта. Копия на диске в любом случае остаётся зашифрованной.",
    "privacy": {
-      "consistencyWarning": "Предупреждение о согласованности отпечатка",
-      "consistencyWarningDescription": "Предупреждать при запуске, если часовой пояс или язык профиля не совпадает с выходным узлом прокси.",
+      "consistencyWarning": "Блокировать при несовпадении отпечатка",
+      "consistencyWarningDescription": "Не запускать браузер, если часовой пояс или язык профиля не совпадают с выходным узлом прокси. Запустить всё равно можно вручную.",
      "clearTraffic": "Очистить всю историю трафика",
      "clearTrafficDescription": "Безопасно удаляет записанную статистику трафика для всех профилей.",
-      "clearTrafficSuccess": "История трафика очищена"
+      "clearTrafficSuccess": "История трафика очищена",
+      "vpnExtensionWarning": "Предупреждение о VPN-расширении",
+      "vpnExtensionWarningDescription": "Предупреждать перед запуском, если в профиле есть расширение, способное перенаправить трафик браузера."
    }
  },
  "header": {
@@ -258,7 +261,8 @@
      "emptyCreate": "Создать профиль",
      "emptyImport": "Импортировать профили",
      "emptyFilteredTitle": "Профили не найдены",
-      "emptyFilteredHint": "Нет профилей для этой группы или запроса. Попробуйте другой фильтр или создайте профиль."
+      "emptyFilteredHint": "Нет профилей для этой группы или запроса. Попробуйте другой фильтр или создайте профиль.",
+      "bot": "Бот"
    },
    "actions": {
      "launch": "Запустить",
@@ -344,6 +348,10 @@
      "nameDesc": "Имя (Я–А)",
      "newest": "Сначала новые",
      "oldest": "Сначала старые"
+    },
+    "remote": {
+      "runningTooltip": "Выполняется на удалённой машине. Остановите, чтобы вернуть профиль сюда.",
+      "pendingSyncTooltip": "Загружаются изменения удалённого сеанса. Профиль снова будет доступен по завершении."
    }
  },
  "createProfile": {
@@ -420,7 +428,9 @@
      "editProxy": "Редактировать прокси",
      "deleteProxy": "Удалить прокси",
      "cannotDelete_one": "Невозможно удалить: используется {{count}} профилем",
+      "cannotDelete_few": "Невозможно удалить: используется {{count}} профилями",
      "cannotDelete_other": "Невозможно удалить: используется {{count}} профилями",
+      "cannotDelete_many": "Невозможно удалить: используется {{count}} профилями",
      "syncEnabled": "Синхронизация включена",
      "syncDisabled": "Синхронизация отключена",
      "updateSyncFailed": "Не удалось обновить синхронизацию",
@@ -460,7 +470,7 @@
      "ssCipherRequired": "Для Shadowsocks требуется шифр и пароль",
      "selectType": "Выберите тип прокси",
      "saveFailed": "Не удалось сохранить прокси: {{error}}",
-      "vlessType": "VLESS · Vision · REALITY",
+      "vlessType": "VLESS",
      "vlessUri": "URI VLESS",
      "vlessUriPlaceholder": "vless://…",
      "vlessUriHint": "Требуются XTLS Vision и REALITY.",
@@ -813,7 +823,9 @@
      "selectedCount": "Выбрано {{count}} cookie",
      "selectedCount_plural": "Выбрано {{count}} cookie",
      "dialogDescription_one": "Копировать cookies из исходного профиля в {{count}} выбранный профиль.",
+      "dialogDescription_few": "Копировать cookies из исходного профиля в {{count}} выбранных профиля.",
      "dialogDescription_other": "Копировать cookies из исходного профиля в {{count}} выбранных профилей.",
+      "dialogDescription_many": "Копировать cookies из исходного профиля в {{count}} выбранных профилей.",
      "sourceProfile": "Исходный профиль",
      "sourcePlaceholder": "Выберите профиль для копирования cookies",
      "running": "(запущен)",
@@ -831,7 +843,9 @@
      "successMessage": "Скопировано {{copied}} cookies ({{replaced}} заменено)",
      "failedMessage": "Не удалось скопировать cookies: {{error}}",
      "copyButton_one": "Скопировать {{count}} cookie",
+      "copyButton_few": "Скопировать {{count}} cookies",
      "copyButton_other": "Скопировать {{count}} cookies",
+      "copyButton_many": "Скопировать {{count}} cookies",
      "copyButtonEmpty": "Скопировать cookies"
    },
    "success": "Cookie успешно скопированы",
@@ -1402,7 +1416,9 @@
      "editVpn": "Редактировать VPN",
      "deleteVpn": "Удалить VPN",
      "cannotDelete_one": "Невозможно удалить: используется {{count}} профилем",
+      "cannotDelete_few": "Невозможно удалить: используется {{count}} профилями",
      "cannotDelete_other": "Невозможно удалить: используется {{count}} профилями",
+      "cannotDelete_many": "Невозможно удалить: используется {{count}} профилями",
      "syncCannotDisable": "Нельзя отключить синхронизацию, пока этот VPN используется синхронизированными профилями",
      "deleteSuccess": "VPN успешно удален",
      "deleteFailed": "Не удалось удалить VPN",
@@ -1480,7 +1496,9 @@
    "noGroups": "Групп еще нет. Создайте первую группу, используя кнопку выше.",
    "loading": "Загрузка групп...",
    "profileCount_one": "{{count}} профиль",
+    "profileCount_few": "{{count}} профиля",
    "profileCount_other": "{{count}} профилей",
+    "profileCount_many": "{{count}} профилей",
    "groupsLabel": "Группы",
    "profilesCol": "Профили",
    "syncCannotDisable": "Нельзя отключить синхронизацию, пока эта группа используется синхронизированными профилями",
@@ -1497,7 +1515,9 @@
  "proxyAssignment": {
    "title": "Назначить прокси / VPN",
    "description_one": "Назначить прокси или VPN для {{count}} выбранного профиля.",
+    "description_few": "Назначить прокси или VPN для {{count}} выбранных профилей.",
    "description_other": "Назначить прокси или VPN для {{count}} выбранных профилей.",
+    "description_many": "Назначить прокси или VPN для {{count}} выбранных профилей.",
    "selectLabel": "Прокси / VPN",
    "placeholder": "Выберите прокси или VPN",
    "noProxy": "Без прокси / VPN",
@@ -1516,7 +1536,9 @@
  "groupAssignment": {
    "title": "Назначить группу",
    "description_one": "Назначить группу для {{count}} выбранного профиля.",
+    "description_few": "Назначить группу для {{count}} выбранных профилей.",
    "description_other": "Назначить группу для {{count}} выбранных профилей.",
+    "description_many": "Назначить группу для {{count}} выбранных профилей.",
    "selectLabel": "Группа",
    "placeholder": "Выберите группу",
    "noGroup": "Без группы (по умолчанию)",
@@ -1851,7 +1873,62 @@
    "vlessConfigInvalid": "URI VLESS недействителен.",
    "xrayUnavailable": "Xray-core недоступен в этой системе.",
    "xrayUnsupportedOs": "Для VLESS требуется macOS 12 или новее.",
-    "xrayStartFailed": "Не удалось запустить Xray-core."
+    "xrayStartFailed": "Не удалось запустить Xray-core.",
+    "cloudNotSignedIn": "Войдите в аккаунт Donut Browser, чтобы использовать эту функцию.",
+    "cloudUnreachable": "Не удалось связаться с серверами Donut Browser. Проверьте подключение и попробуйте снова.",
+    "cloudRequestFailed": "Запрос не удался. Попробуйте ещё раз через минуту.",
+    "remoteRateLimited": "Слишком много запросов. Подождите немного и попробуйте снова.",
+    "remoteNoCapacity": "Сейчас нет свободных удалённых машин. Попробуйте через несколько минут.",
+    "remoteNotEntitled": "Ваш тариф не включает удалённый запуск.",
+    "remoteInteractiveNotEntitled": "В вашем тарифе удалённые часы доступны только для Cookie Bot, но не для интерактивных удалённых сессий.",
+    "remoteRequiresRemoteExitNode": "Прокси этого профиля работает только на этом компьютере (например, 127.0.0.1 или адрес локальной сети). Удалённые сессии выполняются на наших хостах, поэтому нужен прокси с публичным адресом.",
+    "remoteSessionRefused": "Удалённая машина отклонила эту сессию.",
+    "remoteSessionNotFound": "Этой удалённой сессии больше не существует.",
+    "remoteSessionConflict": "Этот профиль уже открыт в другом месте.",
+    "remoteSyncInProgress": "Профиль ещё загружается в облачную синхронизацию. Дождитесь окончания и попробуйте снова.",
+    "remoteHoursExhausted": "Вы израсходовали все {{used}} из {{granted}} удалённых часов в этом месяце.",
+    "notTeamMember": "Вы не состоите в команде.",
+    "cookieBotNotEntitled": "Ваш тариф не включает Cookie Bot.",
+    "cookieBotNotEnrolled": "Этот профиль ещё не настроен для Cookie Bot.",
+    "cookieBotScheduleConflict": "{{email}} уже прогревает этот профиль в {{time}}.",
+    "cookieBotRunInProgress": "Для этого профиля уже выполняется запуск.",
+    "cookieBotRunNotFound": "Этого запуска больше не существует.",
+    "cookieBotInvalidSchedule": "Это расписание некорректно. Проверьте время, дни и длительность.",
+    "cookieBotInvalidTimezone": "{{timezone}} — часовой пояс, который сервер не распознаёт.",
+    "cookieBotInvalidPeriod": "Некорректный период. Укажите месяц, например 2026-08.",
+    "cookieBotSiteLimit": "Укажите от {{min}} до {{max}} сайтов, каждый — полным адресом http или https.",
+    "cookieBotRequiresCloudSync": "Сначала включите облачную синхронизацию для этого профиля: иначе удалённая машина не сможет его получить.",
+    "cookieBotEncryptedSyncUnsupported": "Этот профиль использует сквозное шифрование синхронизации, которое удалённая машина не может расшифровать. Переключите его на обычную синхронизацию.",
+    "cookieBotUnknownPlatform": "Для этого профиля не записана операционная система, поэтому подобрать машину невозможно.",
+    "cookieBotUnsupportedPlatform": "Cookie Bot не может запускать профили {{platform}}. Поддерживаются только профили Windows и macOS.",
+    "cookieBotRequiresExitNode": "Сначала назначьте прокси или VPN. Без них трафик пойдёт с адреса дата-центра, а это вредит репутации профиля.",
+    "cookieBotRequiresRemoteExitNode": "Прокси этого профиля работает только на этом компьютере (например, 127.0.0.1 или адрес локальной сети). Cookie Bot выполняется на наших хостах, поэтому нужен прокси с публичным адресом.",
+    "unknownCode": "Что-то пошло не так: {{code}}",
+    "cookieBotTouchFingerprintUnsupported": "Этот профиль выдаёт себя за сенсорное устройство, которым бот управлять не может. Используйте настольный отпечаток.",
+    "profileRunningRemotely": "Этот профиль запущен на удалённой машине. Сначала остановите удалённый сеанс.",
+    "profileRemoteSyncPending": "Удалённый сеанс только что завершился. Дождитесь загрузки его изменений, прежде чем открывать профиль здесь.",
+    "profileLockedByMember": "Этот профиль используется пользователем {{email}}.",
+    "profileLockedElsewhere": "Этот профиль используется на другом устройстве.",
+    "profileLockUnavailable": "Не удалось проверить, используется ли профиль где-то ещё. Проверьте подключение и попробуйте снова.",
+    "fingerprintExitMismatch": "Выходной узел прокси не совпадает с отпечатком этого профиля.",
+    "launchConsentExpired": "Это подтверждение больше не действует. Запустите профиль ещё раз.",
+    "vpnWorkerStartFailed": "Не удалось запустить VPN-подключение: {{detail}}",
+    "exitProbeFailed": "Не удалось связаться с выходным узлом прокси, чтобы определить его местоположение.",
+    "vlessUnsupported": {
+      "security": "Этот сервер VLESS не использует REALITY. Donut поддерживает только VLESS с REALITY.",
+      "flow": "Этот сервер VLESS не использует поток XTLS Vision, который требуется Donut.",
+      "transport": "Donut поддерживает VLESS только поверх обычного TCP — этот сервер использует другой транспорт (например, WebSocket или gRPC).",
+      "encryption": "Этот сервер VLESS использует шифрование, которое Donut не поддерживает.",
+      "headerType": "Этот сервер VLESS использует обфускацию заголовков, которую Donut не поддерживает.",
+      "fingerprint": "Этот VLESS URI запрашивает отпечаток TLS, который Donut не поддерживает.",
+      "sni": "В VLESS URI отсутствует SNI (sni), необходимый для REALITY.",
+      "publicKey": "В VLESS URI отсутствует открытый ключ REALITY (pbk).",
+      "scheme": "Это не ссылка VLESS. Она должна начинаться с vless://.",
+      "parameter": "VLESS URI содержит параметр, который Donut не поддерживает.",
+      "malformed": "VLESS URI недействителен."
+    },
+    "camoufoxRemoved": "Camoufox больше не поддерживается. Создайте этот профиль заново с Wayfern.",
+    "noE2ePasswordSet": "Пароль сквозного шифрования не задан. Задайте его перед синхронизацией зашифрованных данных."
  },
  "rail": {
    "profiles": "Профили",
@@ -1870,7 +1947,9 @@
    },
    "network": "Сеть",
    "integrations": "Интеграции",
-    "account": "Аккаунт"
+    "account": "Аккаунт",
+    "cookieBot": "Cookie Bot",
+    "cookieBotRunning": "Cookie Bot — сейчас работает"
  },
  "pageTitle": {
    "proxies": "Сеть",
@@ -1881,7 +1960,8 @@
    "integrations": "Интеграции",
    "account": "Аккаунт",
    "import": "Импорт профиля",
-    "shortcuts": "Сочетания клавиш"
+    "shortcuts": "Сочетания клавиш",
+    "cookieBot": "Cookie Bot"
  },
  "encryption": {
    "required": {
@@ -1924,7 +2004,8 @@
    },
    "tabs": {
      "account": "Аккаунт",
-      "selfHosted": "Свой сервер"
+      "selfHosted": "Свой сервер",
+      "teamUsage": "Использование командой"
    },
    "selfHosted": {
      "title": "Свой сервер синхронизации",
@@ -1937,7 +2018,8 @@
    },
    "deviceOrdinal": "{{ordinal}} из {{count}}",
    "automationPrimaryOnly": "Автоматизация браузера работает только на вашем основном устройстве (Устройство 1). Выйдите из аккаунта на нём, чтобы использовать её здесь.",
-    "automationActiveHere": "Автоматизация браузера активна на этом устройстве."
+    "automationActiveHere": "Автоматизация браузера активна на этом устройстве.",
+    "viewTeamUsage": "Посмотреть использование командой"
  },
  "shortcutsPage": {
    "title": "Сочетания клавиш",
@@ -1970,7 +2052,8 @@
    "goGroups": "Перейти к Группам",
    "goIntegrations": "Перейти к Интеграциям",
    "goAccount": "Перейти к Аккаунту",
-    "goSettings": "Перейти к Настройкам"
+    "goSettings": "Перейти к Настройкам",
+    "goCookieBot": "Cookie Bot"
  },
  "closeConfirm": {
    "title": "Закрыть Donut Browser?",
@@ -2091,16 +2174,398 @@
    "description": "Удаляет cookie, историю и кэш при закрытии браузера. Расширения и закладки сохраняются."
  },
  "consistencyWarning": {
-    "title": "Несовпадение отпечатка",
-    "intro": "Выходной узел прокси для «{{name}}» не соответствует отпечатку этого профиля:",
-    "timezoneTitle": "Несовпадение часового пояса",
    "timezoneDetail": "Выходной узел находится в {{exit}}, но отпечаток сообщает {{fingerprint}}.",
-    "languageTitle": "Несовпадение языка",
    "languageDetail": "Страна выхода — {{country}}, но язык отпечатка — {{fingerprint}}.",
    "explainer": "Часовой пояс или язык, не совпадающий с выходным IP, — сильный антибот-сигнал, даже если данные вашего реального устройства никогда не утекают. Приведите отпечаток в соответствие с расположением прокси, чтобы снизить враждебное отношение.",
-    "dontWarnAgain": "Больше не предупреждать для этого профиля",
    "matchToProxy": "Подогнать отпечаток под прокси",
    "matching": "Подгонка…",
    "matchSuccess": "Отпечаток обновлён под прокси. Перезапустите профиль, чтобы применить."
+  },
+  "cookieBot": {
+    "title": "Cookie Bot",
+    "description": "Ночной прогрев профилей на удалённой машине.",
+    "tabs": {
+      "overview": "Обзор",
+      "schedule": "Расписание",
+      "activity": "Активность",
+      "team": "Команда"
+    },
+    "locked": {
+      "title": "Cookie Bot",
+      "hint": "Cookie Bot прогревает ваши профили ночью на удалённой машине, чтобы они сохраняли cookies и историю, пока ваш компьютер выключен. Требуется тариф Pro или Team."
+    },
+    "empty": {
+      "title": "Нет подключённых профилей",
+      "hint": "Выберите профиль, и бот будет прогревать его ночью на удалённой машине. Ваш компьютер может быть выключен.",
+      "cta": "Подключить профиль"
+    },
+    "tonight": {
+      "label": "Сегодня ночью",
+      "nextRun": "Следующий запуск в {{time}}",
+      "dueCount_one": "{{count}} профиль в очереди",
+      "dueCount_few": "{{count}} профиля в очереди",
+      "dueCount_other": "{{count}} профилей в очереди",
+      "dueCount_many": "{{count}} профилей в очереди",
+      "nothingScheduled": "Ничего не запланировано"
+    },
+    "lastDay": {
+      "label": "Последние 24 часа",
+      "none": "Запусков пока нет",
+      "ran_one": "{{count}} выполнен",
+      "ran_few": "{{count}} выполнено",
+      "ran_other": "{{count}} выполнено",
+      "ran_many": "{{count}} выполнено",
+      "partial_one": "{{count}} частичный",
+      "partial_few": "{{count}} частичных",
+      "partial_other": "{{count}} частичных",
+      "partial_many": "{{count}} частичных",
+      "failed_one": "{{count}} с ошибкой",
+      "failed_few": "{{count}} с ошибками",
+      "failed_other": "{{count}} с ошибками",
+      "failed_many": "{{count}} с ошибками"
+    },
+    "chart": {
+      "machineTime": "Машинное время за ночь",
+      "minutes": "{{minutes}} мин"
+    },
+    "hours": {
+      "label": "Удалённые часы",
+      "remaining": "Осталось {{remaining}} ч из {{total}}",
+      "remainingOf": "из {{total}} ч",
+      "used": "Использовано {{used}} из {{total}} ч",
+      "resets": "Обновление {{date}}",
+      "exhausted": "Удалённые часы закончились. Расписания остаются подключёнными и возобновятся в следующем цикле.",
+      "exhaustedOn": "Удалённые часы закончились. Расписания остаются подключёнными и возобновятся {{date}}.",
+      "estimate": "Около {{hours}} ч в неделю · осталось {{remaining}} ч в этом цикле",
+      "estimateOverBudget": "Нужно около {{hours}} ч в неделю — осталось всего {{remaining}} ч",
+      "estimateOnly": "Около {{hours}} ч в неделю"
+    },
+    "enrolled": {
+      "columnProfile": "Профиль",
+      "columnCadence": "Периодичность",
+      "columnTime": "Время",
+      "columnNextRun": "Следующий запуск",
+      "columnLastRun": "Последний запуск",
+      "enrolProfiles": "Подключить профили",
+      "edit": "Изменить расписание",
+      "neverRun": "Никогда",
+      "pausedNoHours": "Приостановлено — часы закончились",
+      "profileMissing": "Этого профиля нет на этом компьютере."
+    },
+    "schedule": {
+      "empty": "Пока ничего не запланировано.",
+      "quietHours_one": "{{count}} свободный час",
+      "quietHours_few": "{{count}} свободных часа",
+      "quietHours_other": "{{count}} свободных часов",
+      "quietHours_many": "{{count}} свободных часов",
+      "crowded_one": "{{count}} профиль стартует одновременно",
+      "crowded_few": "{{count}} профиля стартуют одновременно",
+      "crowded_other": "{{count}} профилей стартуют одновременно",
+      "crowded_many": "{{count}} профилей стартуют одновременно",
+      "unenrol": "Убрать из Cookie Bot",
+      "unenrolTitle": "Убрать {{name}} из Cookie Bot?",
+      "unenrolDescription": "Прогрев прекратится уже этой ночью. Прошлые запуски останутся во вкладке «Активность».",
+      "unenrolled": "Убрано из Cookie Bot"
+    },
+    "status": {
+      "provisioning": "Готовим машину",
+      "ready": "Загружаем профиль",
+      "warming": "Прогрев",
+      "finished": "Завершение",
+      "failed": "Сбой"
+    },
+    "runStatus": {
+      "pending": "В очереди",
+      "running": "Выполняется",
+      "succeeded": "Завершён",
+      "partial": "Частично",
+      "failed": "Ошибка",
+      "skipped": "Пропущен",
+      "cancelled": "Остановлен"
+    },
+    "running": {
+      "label": "Сейчас выполняется",
+      "more": "+{{count}} ещё",
+      "stop": "Остановить запуск",
+      "stopped": "Запуск остановлен"
+    },
+    "live": {
+      "idle": "Сейчас ничего не выполняется",
+      "streamOffline": "Обновления в реальном времени недоступны",
+      "streamOfflineDetail": "Обновления в реальном времени недоступны — переподключаемся. Данные ниже могут быть устаревшими.",
+      "unnamedSession": "Удалённая сессия",
+      "notStartedYet": "Машина ещё не сообщила время начала.",
+      "sitesProgress": "{{visited}} из {{total}} сайтов",
+      "sitesUnknown": "Сайты ещё не переданы",
+      "consentHandled_one": "Обработан {{count}} баннер согласия",
+      "consentHandled_few": "Обработано {{count}} баннера согласия",
+      "consentHandled_other": "Обработано {{count}} баннеров согласия",
+      "consentHandled_many": "Обработано {{count}} баннеров согласия",
+      "consentUnknown": "Баннеры согласия ещё не переданы",
+      "billed": "Начислено {{duration}}",
+      "billedUnknown": "Оплачиваемое время ещё не передано",
+      "chunk": "Часть {{index}} из {{total}}"
+    },
+    "history": {
+      "title": "Запуски",
+      "allProfiles": "Все профили",
+      "searchPlaceholder": "Поиск профилей…",
+      "filterAll": "Все запуски",
+      "filterComplete": "Завершённые",
+      "filterPartial": "Частичные",
+      "filterFailed": "С ошибкой",
+      "columnStarted": "Начало",
+      "columnProfile": "Профиль",
+      "columnDuration": "Длительность",
+      "columnSites": "Сайты",
+      "columnStatus": "Статус",
+      "columnOperator": "Оператор",
+      "empty": "Запусков пока нет.",
+      "noMatch": "Нет запусков по этому фильтру.",
+      "unknownProfile": "Неизвестный профиль",
+      "outcome": "Причина: {{reason}}",
+      "sitesVisited": "{{visited}}/{{total}}",
+      "sitesFailed_one": "{{count}} сайт недоступен",
+      "sitesFailed_few": "{{count}} сайта недоступно",
+      "sitesFailed_other": "{{count}} сайтов недоступно",
+      "sitesFailed_many": "{{count}} сайтов недоступно",
+      "consentHandled_one": "Обработан {{count}} баннер согласия",
+      "consentHandled_few": "Обработано {{count}} баннера согласия",
+      "consentHandled_other": "Обработано {{count}} баннеров согласия",
+      "consentHandled_many": "Обработано {{count}} баннеров согласия",
+      "sitesUnknown": "Нет данных"
+    },
+    "duration": {
+      "hm": "{{hours}} ч {{minutes}} мин",
+      "ms": "{{minutes}} мин {{seconds}} с",
+      "s": "{{seconds}} с"
+    },
+    "picker": {
+      "title": "Подключить профили",
+      "description": "Выберите профили, которые бот будет прогревать ночью.",
+      "searchPlaceholder": "Поиск профилей…",
+      "noProfiles": "Подходящих профилей нет.",
+      "alreadyEnrolled": "Подключён",
+      "continue_one": "Продолжить с {{count}}",
+      "continue_few": "Продолжить с {{count}}",
+      "continue_other": "Продолжить с {{count}}",
+      "continue_many": "Продолжить с {{count}}"
+    },
+    "enrol": {
+      "titleOne": "Подключить {{name}}",
+      "titleCount_one": "Подключить {{count}} профиль",
+      "titleCount_few": "Подключить {{count}} профиля",
+      "titleCount_other": "Подключить {{count}} профилей",
+      "titleCount_many": "Подключить {{count}} профилей",
+      "editTitle": "Изменить расписание",
+      "description": "Бот открывает профиль на удалённой машине и просматривает указанные вами сайты. Ваш компьютер может быть выключен.",
+      "summaryNightly": "Запускается каждую ночь в {{time}}, не дольше {{minutes}} мин за раз.",
+      "summaryWeeknights": "Запускается с понедельника по пятницу в {{time}}, не дольше {{minutes}} мин за раз.",
+      "summaryAlternate": "Запускается через ночь в {{time}}, не дольше {{minutes}} мин за раз.",
+      "summaryCustom_one": "Запускается {{count}} ночь в неделю в {{time}}, не дольше {{minutes}} мин за раз.",
+      "summaryCustom_few": "Запускается {{count}} ночи в неделю в {{time}}, не дольше {{minutes}} мин за раз.",
+      "summaryCustom_other": "Запускается {{count}} ночей в неделю в {{time}}, не дольше {{minutes}} мин за раз.",
+      "summaryCustom_many": "Запускается {{count}} ночей в неделю в {{time}}, не дольше {{minutes}} мин за раз.",
+      "confirm": "Подключить на эту ночь",
+      "confirmSome": "Подключить {{eligible}} из {{total}} на эту ночь",
+      "fixFirst": "Сначала исправьте это",
+      "saving": "Подключаем…",
+      "saved": "Расписание сохранено",
+      "enrolled_one": "Подключён {{count}} профиль",
+      "enrolled_few": "Подключено {{count}} профиля",
+      "enrolled_other": "Подключено {{count}} профилей",
+      "enrolled_many": "Подключено {{count}} профилей",
+      "adjust": "Настроить расписание",
+      "cadenceLabel": "Периодичность",
+      "cadenceNightly": "Каждую ночь",
+      "cadenceWeeknights": "По будним ночам",
+      "cadenceAlternate": "Через ночь",
+      "cadenceCustom_one": "{{count}} ночь в неделю",
+      "cadenceCustom_few": "{{count}} ночи в неделю",
+      "cadenceCustom_other": "{{count}} ночей в неделю",
+      "cadenceCustom_many": "{{count}} ночей в неделю",
+      "timeLabel": "Время начала",
+      "timeHint": "По часовому поясу отпечатка каждого профиля.",
+      "maxMinutesLabel": "Максимум минут",
+      "intensityLabel": "Глубина",
+      "sitesLabel": "Сайты",
+      "sitesPlaceholder": "По одному адресу в строке",
+      "sitesHint_one": "{{count}} сайт. Посещаются только указанные здесь страницы.",
+      "sitesHint_few": "{{count}} сайта. Посещаются только указанные здесь страницы.",
+      "sitesHint_other": "{{count}} сайтов. Посещаются только указанные здесь страницы.",
+      "sitesHint_many": "{{count}} сайтов. Посещаются только указанные здесь страницы.",
+      "sitesTooMany": "Не более {{max}} сайтов.",
+      "presetsUnavailable": "Не удалось загрузить пресеты глубины. Попробуйте ещё раз через минуту.",
+      "confirmBulkTitle_one": "Подключить {{count}} профиль к Cookie Bot?",
+      "confirmBulkTitle_few": "Подключить {{count}} профиля к Cookie Bot?",
+      "confirmBulkTitle_other": "Подключить {{count}} профилей к Cookie Bot?",
+      "confirmBulkTitle_many": "Подключить {{count}} профилей к Cookie Bot?",
+      "confirmBulkDescription_one": "Это резервирует ночной запуск за счёт общих удалённых часов. Время и сайты вы выберете дальше.",
+      "confirmBulkDescription_few": "Это резервирует {{count}} ночных запуска за счёт общих удалённых часов. Время и сайты вы выберете дальше.",
+      "confirmBulkDescription_other": "Это резервирует {{count}} ночных запусков за счёт общих удалённых часов. Время и сайты вы выберете дальше.",
+      "confirmBulkDescription_many": "Это резервирует {{count}} ночных запусков за счёт общих удалённых часов. Время и сайты вы выберете дальше.",
+      "confirmBulkButton_one": "Продолжить с {{count}} профилем",
+      "confirmBulkButton_few": "Продолжить с {{count}} профилями",
+      "confirmBulkButton_other": "Продолжить с {{count}} профилями",
+      "confirmBulkButton_many": "Продолжить с {{count}} профилями",
+      "sitesRequired": "Добавьте хотя бы один сайт.",
+      "addSitesFirst": "Сначала добавьте сайт",
+      "presetsMissing": "Пресеты глубины недоступны",
+      "sourceOwn": "Свой список",
+      "sourceCurated": "Подборки",
+      "sourceSaved": "Сохранённые",
+      "curatedEmpty": "Сейчас нет доступных подборок.",
+      "curatedNote": "Подборка, которую мы поддерживаем в актуальном состоянии. Каждый профиль берёт из неё свою выборку, поэтому два профиля не обходят один и тот же набор — именно это не даёт списку стать приметой. Адреса остаются на нашей стороне.",
+      "savedEmpty": "Пока ничего не сохранено. Введите список в разделе «Свой список» и сохраните его оттуда.",
+      "savedNote": "Сайты копируются в расписание при сохранении, поэтому правка списка позже не меняет уже созданные расписания.",
+      "savedUnavailable": "Не удалось загрузить сохранённые списки.",
+      "saveAsList": "Сохранить как список",
+      "listNamePlaceholder": "Название списка",
+      "listSaved": "Список сохранён",
+      "listRenamed": "Список переименован",
+      "listDeleted": "Список удалён",
+      "listRename": "Переименовать",
+      "listDeleteConfirm": "Удалить?",
+      "templateMissing": "Этого сохранённого списка больше нет. Выберите другой.",
+      "templateNameTaken": "Список с таким названием уже есть.",
+      "templateNameInvalid": "Название списка — не длиннее {{max}} символов.",
+      "calendarLabel": "Когда запускать",
+      "daysLabel": "Дни недели",
+      "addSlot": "Добавить время",
+      "slotsFull": "Не больше {{max}} времён запуска.",
+      "removeSlot": "Убрать это время",
+      "pickListFirst": "Сначала выберите список",
+      "finishCalendarFirst": "Сначала заполните расписание",
+      "duplicateSlot": "Две строки повторяют одни и те же дни и время",
+      "listSites_one": "{{count}} сайт",
+      "listSites_few": "{{count}} сайта",
+      "listSites_other": "{{count}} сайтов",
+      "listSites_many": "{{count}} сайтов",
+      "summarySlots_one": "Запускается {{count}} раз в неделю, не дольше {{minutes}} мин за раз.",
+      "summarySlots_few": "Запускается {{count}} раза в неделю, не дольше {{minutes}} мин за раз.",
+      "summarySlots_other": "Запускается {{count}} раз в неделю, не дольше {{minutes}} мин за раз.",
+      "summarySlots_many": "Запускается {{count}} раз в неделю, не дольше {{minutes}} мин за раз.",
+      "templateNameInvalidNoMax": "Это имя нельзя использовать для сохранённого списка."
+    },
+    "preset": {
+      "light": "Лёгкая",
+      "balanced": "Стандартная",
+      "deep": "Глубокая"
+    },
+    "template": {
+      "lowIntentPurchaser": "Покупатель с низким намерением",
+      "lowIntentPurchaserHint": "Позиционирует профиль как чувствительного к цене покупателя: сравнение цен, купоны, кэшбэк и перепродажа, а к магазинам — через агрегаторы, а не напрямую."
+    },
+    "preflight": {
+      "ineligible_one": "{{count}} профиль нельзя запустить удалённо",
+      "ineligible_few": "{{count}} профиля нельзя запустить удалённо",
+      "ineligible_other": "{{count}} профилей нельзя запустить удалённо",
+      "ineligible_many": "{{count}} профилей нельзя запустить удалённо",
+      "reasonSync": "Синхронизация отключена",
+      "reasonEncrypted": "Сквозное шифрование",
+      "reasonNoFingerprint": "Операционная система не записана",
+      "reasonCrossOs": "Создан для {{os}} — подходящей удалённой машины нет",
+      "reasonNoExitNode": "Нет прокси или VPN",
+      "fixSync": "Включить синхронизацию",
+      "fixEncrypted": "Открыть настройки синхронизации",
+      "fixProxy": "Назначить прокси",
+      "fixFailed": "Не удалось применить это исправление.",
+      "exitNodeHint": "Без прокси или VPN трафик выходит с собственного адреса дата-центра нашего парка машин. Часы трафика из хостинговой сети вредят репутации профиля сильнее, чем полный отказ от прогрева."
+    },
+    "conflict": {
+      "title": "{{email}} уже прогревает этот профиль в {{time}}",
+      "detail": "Два расписания на одном профиле расходуют часы дважды и могут столкнуться прямо во время запуска.",
+      "keepTheirs": "Оставить их расписание",
+      "replace": "Заменить моим",
+      "replaceForbidden": "Менять чужое расписание может только владелец команды или администратор.",
+      "askThem": "Скопировать {{email}}",
+      "emailCopied": "Адрес скопирован",
+      "copyFailed": "Не удалось скопировать адрес."
+    },
+    "actionBar": {
+      "enrol": "Подключить к Cookie Bot",
+      "proRequired": "Для Cookie Bot нужен тариф Pro или Team",
+      "noneEligible": "Ни один из выбранных профилей нельзя прогреть удалённо"
+    },
+    "actions": {
+      "enrol": "Подключить к Cookie Bot",
+      "editSchedule": "Изменить расписание",
+      "runNow": "Запустить сейчас",
+      "runStarted": "Запуск начат",
+      "viewActivity": "Посмотреть активность",
+      "runNotStarted": "Запуск не начался: {{reason}}"
+    },
+    "state": {
+      "enrolled": "Подключён",
+      "notEnrolled": "Не подключён",
+      "paused": "Приостановлен",
+      "summary": "{{cadence}} в {{time}}",
+      "rowMenu": "Параметры Cookie Bot для {{name}}",
+      "blocked": "Не может запуститься: {{reason}}"
+    },
+    "team": {
+      "title": "Использование командой",
+      "pooled_one": "{{used}} из {{total}} ч, {{count}} место",
+      "pooled_few": "{{used}} из {{total}} ч на {{count}} места",
+      "pooled_other": "{{used}} из {{total}} ч на {{count}} мест",
+      "pooled_many": "{{used}} из {{total}} ч на {{count}} мест",
+      "hours": "{{hours}} ч",
+      "legendBot": "Cookie Bot",
+      "legendInteractive": "Интерактивно",
+      "columnMember": "Участник",
+      "columnRuns": "Запуски",
+      "columnHours": "Часы",
+      "columnShare": "Доля",
+      "noActivity": "За этот период удалённых сессий нет.",
+      "soloNote": "Пока показано только ваше использование. Пригласите коллег, чтобы увидеть распределение по участникам.",
+      "runsFailed": "· с ошибкой: {{n}}"
+    },
+    "closeReason": {
+      "stoppedByUser": "Остановлено вручную",
+      "maxDuration": "Достигнут предел времени",
+      "other": "Завершено: {{reason}}"
+    },
+    "outcome": {
+      "notEntitled": "Не входит в ваш тариф",
+      "syncDisabled": "Для этого профиля отключена облачная синхронизация",
+      "encryptedSync": "Сквозное шифрование синхронизации не поддерживается",
+      "proxyRequired": "Не назначены ни прокси, ни VPN",
+      "touchFingerprint": "Сенсорные отпечатки не поддерживаются",
+      "platformUnsupported": "Нет машины с системой этого профиля",
+      "noSites": "Нет сайтов для посещения",
+      "quotaExhausted": "Удалённые часы израсходованы",
+      "profileLocked": "Профиль был открыт в другом месте",
+      "noCapacity": "Свободных машин не было",
+      "managerError": "Флот не смог запустить браузер",
+      "budgetExceeded": "Отведённое на ночь время закончилось",
+      "cancelledByUser": "Остановлено вручную",
+      "unknown": "Неизвестная причина ({{code}})"
+    }
+  },
+  "prelaunchGate": {
+    "titleBlocked": "Запуск заблокирован",
+    "titleWarning": "Перед запуском",
+    "intro": "Проверьте эти проблемы профиля «{{name}}» перед запуском браузера.",
+    "fingerprintHeading": "Выходной узел прокси не совпадает с отпечатком",
+    "vpnExtensionHeading": "Обнаружено VPN-расширение",
+    "vpnExtensionIntro": "Расширения в этом профиле, способные перенаправить трафик браузера:",
+    "vpnExtensionConfirmed": "Может изменить прокси",
+    "vpnExtensionLikely": "Возможно, изменит прокси",
+    "vpnExtensionExplainer": "Если одно из них направит трафик в другое место, реальное местоположение браузера перестанет совпадать с часовым поясом, языком и геолокацией, с которыми создавался профиль, а Donut не сможет это обнаружить извне.",
+    "sourceDonut": "Управляется Donut",
+    "sourceBrowser": "Установлено в профиле",
+    "measurementUnreliable": "Поскольку VPN-расширение может переопределить прокси, проверка выходного узла может не отражать реальный маршрут браузера.",
+    "scanIncompleteEncrypted": "Профиль зашифрован, поэтому удалось проверить только расширения, управляемые Donut.",
+    "scanIncompleteEphemeral": "В профиле ещё нет данных, поэтому удалось проверить только расширения, управляемые Donut.",
+    "scanIncompletePartial": "Проверка расширений была прервана, поэтому некоторые могут отсутствовать в списке.",
+    "probePending": "Выходной узел прокси ещё не измерен. Donut проверит его при запуске и остановится, если он не совпадёт.",
+    "launchAnyway": "Всё равно запустить",
+    "dontBlockAgain": "Больше не блокировать при этом несовпадении",
+    "dontWarnExtensions": "Больше не предупреждать об этих расширениях",
+    "applyToRemaining": "Применить этот выбор к остальным профилям",
+    "cancelledSummary": "Отменено запусков: {{cancelled}} из {{total}}",
+    "cancelled": "Запуск отменён",
+    "vpnExtensionEntry": " {{version}} — {{capability}}, {{source}}",
+    "scanIncompleteMissing": "Профиль ещё ни разу не запускался, поэтому удалось проверить только расширения, управляемые Donut."
  }
 }
@@ -92,7 +92,8 @@
    "window": {
      "minimize": "Küçült",
      "maximize": "Büyüt",
-      "restore": "Geri Yükle"
+      "restore": "Geri Yükle",
+      "close": "Pencereyi kapat"
    },
    "commandPalette": {
      "title": "Komut Paleti",
@@ -199,11 +200,13 @@
    "keepDecryptedProfilesInRam": "Şifresi Çözülmüş Profilleri RAM'de Tut",
    "keepDecryptedProfilesInRamDescription": "Daha hızlı başlatma için parola korumalı profillerin şifresi çözülmüş RAM kopyasını başlatmalar arasında koruyun. Diskteki kopya her durumda şifreli kalır.",
    "privacy": {
-      "consistencyWarning": "Parmak izi tutarlılık uyarısı",
-      "consistencyWarningDescription": "Bir profilin saat dilimi veya dili proxy çıkış düğümüyle eşleşmediğinde başlatma sırasında uyar.",
+      "consistencyWarning": "Parmak izi uyuşmazlığında engelle",
+      "consistencyWarningDescription": "Bir profilin saat dilimi veya dili proxy çıkış düğümüyle eşleşmediğinde tarayıcının başlamasını durdurur. Yine de başlatmayı seçebilirsiniz.",
      "clearTraffic": "Tüm trafik geçmişini temizle",
      "clearTrafficDescription": "Tüm profillerin kayıtlı trafik istatistiklerini güvenli bir şekilde siler.",
-      "clearTrafficSuccess": "Trafik geçmişi temizlendi"
+      "clearTrafficSuccess": "Trafik geçmişi temizlendi",
+      "vpnExtensionWarning": "VPN uzantısı uyarısı",
+      "vpnExtensionWarningDescription": "Bir profil, tarayıcı trafiğini yeniden yönlendirebilecek bir uzantı içerdiğinde başlatmadan önce uyarır."
    }
  },
  "header": {
@@ -258,7 +261,8 @@
      "emptyCreate": "Profil oluştur",
      "emptyImport": "Profilleri içe aktar",
      "emptyFilteredTitle": "Profil bulunamadı",
-      "emptyFilteredHint": "Bu grup veya aramayla eşleşen profil yok. Başka bir filtre deneyin veya yeni bir profil oluşturun."
+      "emptyFilteredHint": "Bu grup veya aramayla eşleşen profil yok. Başka bir filtre deneyin veya yeni bir profil oluşturun.",
+      "bot": "Bot"
    },
    "actions": {
      "launch": "Başlat",
@@ -344,6 +348,10 @@
      "nameDesc": "Ad (Z–A)",
      "newest": "Önce en yeni",
      "oldest": "Önce en eski"
+    },
+    "remote": {
+      "runningTooltip": "Uzak bir makinede çalışıyor. Profili buraya geri getirmek için durdurun.",
+      "pendingSyncTooltip": "Uzak oturumun değiştirdikleri indiriliyor. Bittiğinde yeniden kullanılabilir olacak."
    }
  },
  "createProfile": {
@@ -460,7 +468,7 @@
      "ssCipherRequired": "Shadowsocks için şifreleme algoritması ve parola zorunludur",
      "selectType": "Proxy türünü seçin",
      "saveFailed": "Proxy kaydedilemedi: {{error}}",
-      "vlessType": "VLESS · Vision · REALITY",
+      "vlessType": "VLESS",
      "vlessUri": "VLESS URI'si",
      "vlessUriPlaceholder": "vless://…",
      "vlessUriHint": "XTLS Vision ve REALITY gerektirir.",
@@ -1851,7 +1859,62 @@
    "vlessConfigInvalid": "VLESS URI'si geçersiz.",
    "xrayUnavailable": "Xray-core bu sistemde kullanılamıyor.",
    "xrayUnsupportedOs": "VLESS için macOS 12 veya sonraki bir sürüm gerekir.",
-    "xrayStartFailed": "Xray-core başlatılamadı."
+    "xrayStartFailed": "Xray-core başlatılamadı.",
+    "cloudNotSignedIn": "Bunu kullanmak için Donut Browser hesabınıza giriş yapın.",
+    "cloudUnreachable": "Donut Browser sunucularına ulaşılamadı. Bağlantınızı kontrol edip tekrar deneyin.",
+    "cloudRequestFailed": "İstek başarısız oldu. Birazdan tekrar deneyin.",
+    "remoteRateLimited": "Çok fazla istek. Biraz bekleyip tekrar deneyin.",
+    "remoteNoCapacity": "Şu anda boş uzak makine yok. Birkaç dakika sonra tekrar deneyin.",
+    "remoteNotEntitled": "Planınız uzaktan çalıştırmayı içermiyor.",
+    "remoteInteractiveNotEntitled": "Planınızdaki uzak saatler yalnızca Cookie Bot için geçerlidir, elle kullanılan uzak oturumlar için değil.",
+    "remoteRequiresRemoteExitNode": "Bu profilin proxy'si yalnızca bu bilgisayarda çalışır (örneğin 127.0.0.1 veya yerel ağ adresi). Uzak oturumlar bizim sunucularımızda çalıştığı için genel bir adrese sahip bir proxy gerekir.",
+    "remoteSessionRefused": "Uzak makine bu oturumu reddetti.",
+    "remoteSessionNotFound": "Bu uzak oturum artık mevcut değil.",
+    "remoteSessionConflict": "Bu profil başka bir yerde zaten açık.",
+    "remoteSyncInProgress": "Bu profil hâlâ buluta yükleniyor. Eşitleme bitince tekrar deneyin.",
+    "remoteHoursExhausted": "Bu ayki {{granted}} uzak saatinizin {{used}} saatinin tamamını kullandınız.",
+    "notTeamMember": "Herhangi bir ekibin üyesi değilsiniz.",
+    "cookieBotNotEntitled": "Planınız Cookie Bot'u içermiyor.",
+    "cookieBotNotEnrolled": "Bu profil henüz Cookie Bot için ayarlanmadı.",
+    "cookieBotScheduleConflict": "{{email}} bu profili zaten {{time}} saatinde ısıtıyor.",
+    "cookieBotRunInProgress": "Bu profil için zaten devam eden bir çalışma var.",
+    "cookieBotRunNotFound": "Bu çalışma artık mevcut değil.",
+    "cookieBotInvalidSchedule": "Bu zamanlama geçerli değil. Çalışma saatini, günleri ve süreyi kontrol edin.",
+    "cookieBotInvalidTimezone": "{{timezone}}, sunucunun tanıdığı bir saat dilimi değil.",
+    "cookieBotInvalidPeriod": "Bu dönem geçerli değil. 2026-08 gibi bir ay kullanın.",
+    "cookieBotSiteLimit": "En az {{min}}, en çok {{max}} site girin; her biri tam http veya https adresi olsun.",
+    "cookieBotRequiresCloudSync": "Önce bu profil için bulut eşitlemeyi açın: uzak makinenin profili almasının başka yolu yok.",
+    "cookieBotEncryptedSyncUnsupported": "Bu profil, uzak makinenin çözemeyeceği uçtan uca şifreli eşitleme kullanıyor. Normal eşitlemeye geçirin.",
+    "cookieBotUnknownPlatform": "Bu profilde kayıtlı bir işletim sistemi yok, bu yüzden bir makineyle eşleştirilemiyor.",
+    "cookieBotUnsupportedPlatform": "Cookie Bot, {{platform}} profillerini çalıştıramaz. Yalnızca Windows ve macOS profilleri desteklenir.",
+    "cookieBotRequiresExitNode": "Önce bir proxy veya VPN ekleyin. Aksi hâlde çalışma bir veri merkezi adresinden çıkar ve bu, profilin kimliğine zarar verir.",
+    "cookieBotRequiresRemoteExitNode": "Bu profilin proxy'si yalnızca bu bilgisayarda çalışır (örneğin 127.0.0.1 veya yerel ağ adresi). Cookie Bot bizim sunucularımızda çalıştığı için genel bir adrese sahip bir proxy gerekir.",
+    "unknownCode": "Bir sorun oluştu: {{code}}",
+    "cookieBotTouchFingerprintUnsupported": "Bu profil dokunmatik bir cihaz olduğunu bildiriyor ve bot bunu süremez. Masaüstü parmak izi kullanın.",
+    "profileRunningRemotely": "Bu profil uzak bir makinede çalışıyor. Önce uzak oturumu durdurun.",
+    "profileRemoteSyncPending": "Uzak oturum az önce bitti. Bu profili burada açmadan önce değişikliklerinin inmesi bekleniyor.",
+    "profileLockedByMember": "Bu profil {{email}} tarafından kullanılıyor.",
+    "profileLockedElsewhere": "Bu profil başka bir cihazda kullanılıyor.",
+    "profileLockUnavailable": "Bu profilin başka bir yerde kullanılıp kullanılmadığı denetlenemedi. Bağlantınızı kontrol edip yeniden deneyin.",
+    "fingerprintExitMismatch": "Proxy çıkış düğümü bu profilin parmak iziyle eşleşmiyor.",
+    "launchConsentExpired": "Bu onay artık geçerli değil. Yeniden başlatmayı deneyin.",
+    "vpnWorkerStartFailed": "VPN bağlantısı başlatılamadı: {{detail}}",
+    "exitProbeFailed": "Konumunu denetlemek için proxy çıkış düğümüne ulaşılamadı.",
+    "vlessUnsupported": {
+      "security": "Bu VLESS sunucusu REALITY kullanmıyor. Donut yalnızca REALITY ile VLESS'i destekler.",
+      "flow": "Bu VLESS sunucusu, Donut'ın gerektirdiği XTLS Vision akışını kullanmıyor.",
+      "transport": "Donut yalnızca düz TCP üzerinden VLESS'i destekler — bu sunucu farklı bir taşıma (WebSocket veya gRPC gibi) kullanıyor.",
+      "encryption": "Bu VLESS sunucusu, Donut'ın desteklemediği bir şifreleme kullanıyor.",
+      "headerType": "Bu VLESS sunucusu, Donut'ın desteklemediği bir başlık gizlemesi kullanıyor.",
+      "fingerprint": "Bu VLESS URI'si, Donut'ın desteklemediği bir TLS parmak izi istiyor.",
+      "sni": "VLESS URI'sinde REALITY için gereken SNI (sni) eksik.",
+      "publicKey": "VLESS URI'sinde REALITY genel anahtarı (pbk) eksik.",
+      "scheme": "Bu bir VLESS bağlantısı değil. vless:// ile başlamalı.",
+      "parameter": "VLESS URI'si, Donut'ın desteklemediği bir seçenek içeriyor.",
+      "malformed": "VLESS URI'si geçersiz."
+    },
+    "camoufoxRemoved": "Camoufox artık desteklenmiyor. Bu profili Wayfern ile yeniden oluşturun.",
+    "noE2ePasswordSet": "Uçtan uca şifreleme parolası ayarlanmamış. Şifreli veriyi eşitlemeden önce bir parola belirleyin."
  },
  "rail": {
    "profiles": "Profiller",
@@ -1870,7 +1933,9 @@
    },
    "network": "Ağ",
    "integrations": "Entegrasyonlar",
-    "account": "Hesap"
+    "account": "Hesap",
+    "cookieBot": "Cookie Bot",
+    "cookieBotRunning": "Cookie Bot — şu anda çalışıyor"
  },
  "pageTitle": {
    "proxies": "Ağ",
@@ -1881,7 +1946,8 @@
    "integrations": "Entegrasyonlar",
    "account": "Hesap",
    "import": "Profil içe aktar",
-    "shortcuts": "Klavye kısayolları"
+    "shortcuts": "Klavye kısayolları",
+    "cookieBot": "Cookie Bot"
  },
  "encryption": {
    "required": {
@@ -1924,7 +1990,8 @@
    },
    "tabs": {
      "account": "Hesap",
-      "selfHosted": "Kendi sunucunuz"
+      "selfHosted": "Kendi sunucunuz",
+      "teamUsage": "Ekip kullanımı"
    },
    "selfHosted": {
      "title": "Kendi eşitleme sunucunuz",
@@ -1937,7 +2004,8 @@
    },
    "deviceOrdinal": "{{ordinal}} / {{count}}",
    "automationPrimaryOnly": "Tarayıcı otomasyonu yalnızca birincil cihazınızda (Cihaz 1) çalışır. Burada kullanmak için oradaki oturumu kapatın.",
-    "automationActiveHere": "Tarayıcı otomasyonu bu cihazda etkin."
+    "automationActiveHere": "Tarayıcı otomasyonu bu cihazda etkin.",
+    "viewTeamUsage": "Ekip kullanımını görüntüle"
  },
  "shortcutsPage": {
    "title": "Klavye kısayolları",
@@ -1970,7 +2038,8 @@
    "goGroups": "Gruplar'a git",
    "goIntegrations": "Entegrasyonlar'a git",
    "goAccount": "Hesap'a git",
-    "goSettings": "Ayarlar'a git"
+    "goSettings": "Ayarlar'a git",
+    "goCookieBot": "Cookie Bot"
  },
  "closeConfirm": {
    "title": "Donut Browser kapatılsın mı?",
@@ -2091,16 +2160,354 @@
    "description": "Tarayıcı kapanırken çerezleri, geçmişi ve önbelleği siler. Uzantılar ve yer imleri korunur."
  },
  "consistencyWarning": {
-    "title": "Parmak izi uyuşmazlığı",
-    "intro": "\"{{name}}\" için proxy çıkışı bu profilin parmak iziyle eşleşmiyor:",
-    "timezoneTitle": "Saat dilimi uyuşmazlığı",
    "timezoneDetail": "Çıkış düğümü {{exit}} konumunda, ancak parmak izi {{fingerprint}} bildiriyor.",
-    "languageTitle": "Dil uyuşmazlığı",
    "languageDetail": "Çıkış ülkesi {{country}}, ancak parmak izi dili {{fingerprint}}.",
    "explainer": "Çıkış IP'nizle uyuşmayan bir saat dilimi veya dil, gerçek cihazınız hiç sızdırmasa bile güçlü bir anti-bot sinyalidir. Şüpheli muameleyi azaltmak için parmak izini proxy konumuyla hizalayın.",
-    "dontWarnAgain": "Bu profil için bir daha uyarma",
    "matchToProxy": "Parmak izini proxy'ye eşle",
    "matching": "Eşleniyor…",
    "matchSuccess": "Parmak izi proxy'ye uyacak şekilde güncellendi. Uygulamak için profili yeniden başlatın."
+  },
+  "cookieBot": {
+    "title": "Cookie Bot",
+    "description": "Uzak bir makinede gece boyunca profil ısıtma.",
+    "tabs": {
+      "overview": "Genel bakış",
+      "schedule": "Zamanlama",
+      "activity": "Etkinlik",
+      "team": "Ekip"
+    },
+    "locked": {
+      "title": "Cookie Bot",
+      "hint": "Cookie Bot, profillerinizi gece boyunca uzak bir makinede ısıtır; böylece bilgisayarınız açık olmadan çerezlerini ve geçmişlerini korurlar. Pro veya Team planı gerekir."
+    },
+    "empty": {
+      "title": "Kayıtlı profil yok",
+      "hint": "Bir profil seçin, bot onu gece boyunca uzak bir makinede ısıtsın. Bilgisayarınız kapalı olabilir.",
+      "cta": "Profil kaydet"
+    },
+    "tonight": {
+      "label": "Bu gece",
+      "nextRun": "Sonraki çalışma {{time}}",
+      "dueCount_one": "{{count}} profil sırada",
+      "dueCount_other": "{{count}} profil sırada",
+      "nothingScheduled": "Zamanlanmış bir şey yok"
+    },
+    "lastDay": {
+      "label": "Son 24 saat",
+      "none": "Henüz çalışma yok",
+      "ran_one": "{{count}} çalıştı",
+      "ran_other": "{{count}} çalıştı",
+      "partial_one": "{{count}} kısmi",
+      "partial_other": "{{count}} kısmi",
+      "failed_one": "{{count}} başarısız",
+      "failed_other": "{{count}} başarısız"
+    },
+    "chart": {
+      "machineTime": "Gece başına makine süresi",
+      "minutes": "{{minutes}} dk"
+    },
+    "hours": {
+      "label": "Uzak saatler",
+      "remaining": "{{total}} saatin {{remaining}} saati kaldı",
+      "remainingOf": "/ {{total}} sa",
+      "used": "{{total}} saatin {{used}} saati kullanıldı",
+      "resets": "{{date}} tarihinde sıfırlanır",
+      "exhausted": "Uzak saat kalmadı. Zamanlamalar kayıtlı kalır ve sonraki döngüde devam eder.",
+      "exhaustedOn": "Uzak saat kalmadı. Zamanlamalar kayıtlı kalır ve {{date}} tarihinde devam eder.",
+      "estimate": "Haftada yaklaşık {{hours}} sa · bu döngüde {{remaining}} sa kaldı",
+      "estimateOverBudget": "Haftada yaklaşık {{hours}} sa gerekiyor — yalnızca {{remaining}} sa kaldı",
+      "estimateOnly": "Haftada yaklaşık {{hours}} sa"
+    },
+    "enrolled": {
+      "columnProfile": "Profil",
+      "columnCadence": "Sıklık",
+      "columnTime": "Saat",
+      "columnNextRun": "Sonraki çalışma",
+      "columnLastRun": "Son çalışma",
+      "enrolProfiles": "Profilleri kaydet",
+      "edit": "Zamanlamayı düzenle",
+      "neverRun": "Hiç",
+      "pausedNoHours": "Duraklatıldı — saat kalmadı",
+      "profileMissing": "Bu profil bu bilgisayarda değil."
+    },
+    "schedule": {
+      "empty": "Henüz hiçbir şey zamanlanmadı.",
+      "quietHours_one": "{{count}} boş saat",
+      "quietHours_other": "{{count}} boş saat",
+      "crowded_one": "{{count}} profil aynı anda başlıyor",
+      "crowded_other": "{{count}} profil aynı anda başlıyor",
+      "unenrol": "Cookie Bot'tan çıkar",
+      "unenrolTitle": "{{name}} Cookie Bot'tan çıkarılsın mı?",
+      "unenrolDescription": "Bu gece ısıtma duracak. Geçmiş çalışmalar Etkinlik sekmesinde kalır.",
+      "unenrolled": "Cookie Bot'tan çıkarıldı"
+    },
+    "status": {
+      "provisioning": "Makine hazırlanıyor",
+      "ready": "Profil yükleniyor",
+      "warming": "Isıtılıyor",
+      "finished": "Tamamlanıyor",
+      "failed": "Başarısız"
+    },
+    "runStatus": {
+      "pending": "Sırada",
+      "running": "Çalışıyor",
+      "succeeded": "Tamamlandı",
+      "partial": "Kısmi",
+      "failed": "Başarısız",
+      "skipped": "Atlandı",
+      "cancelled": "Durduruldu"
+    },
+    "running": {
+      "label": "Şu anda çalışıyor",
+      "more": "+{{count}} daha",
+      "stop": "Çalışmayı durdur",
+      "stopped": "Çalışma durduruldu"
+    },
+    "live": {
+      "idle": "Şu anda çalışan bir şey yok",
+      "streamOffline": "Canlı güncellemeler çevrimdışı",
+      "streamOfflineDetail": "Canlı güncellemeler çevrimdışı — yeniden bağlanılıyor. Aşağıdaki çalışmalar güncel olmayabilir.",
+      "unnamedSession": "Uzak oturum",
+      "notStartedYet": "Makine henüz bir başlangıç saati bildirmedi.",
+      "sitesProgress": "{{total}} sitenin {{visited}} tanesi",
+      "sitesUnknown": "Siteler henüz bildirilmedi",
+      "consentHandled_one": "{{count}} çerez izni istemi işlendi",
+      "consentHandled_other": "{{count}} çerez izni istemi işlendi",
+      "consentUnknown": "Çerez izni istemleri henüz bildirilmedi",
+      "billed": "{{duration}} faturalandırıldı",
+      "billedUnknown": "Faturalandırılan süre henüz bildirilmedi",
+      "chunk": "{{total}} bölümden {{index}}."
+    },
+    "history": {
+      "title": "Çalışmalar",
+      "allProfiles": "Tüm profiller",
+      "searchPlaceholder": "Profillerde ara…",
+      "filterAll": "Tüm çalışmalar",
+      "filterComplete": "Tamamlanan",
+      "filterPartial": "Kısmi",
+      "filterFailed": "Başarısız",
+      "columnStarted": "Başlangıç",
+      "columnProfile": "Profil",
+      "columnDuration": "Süre",
+      "columnSites": "Siteler",
+      "columnStatus": "Durum",
+      "columnOperator": "Operatör",
+      "empty": "Henüz çalışma yok.",
+      "noMatch": "Bu filtreye uyan çalışma yok.",
+      "unknownProfile": "Bilinmeyen profil",
+      "outcome": "Neden: {{reason}}",
+      "sitesVisited": "{{visited}}/{{total}}",
+      "sitesFailed_one": "{{count}} siteye ulaşılamadı",
+      "sitesFailed_other": "{{count}} siteye ulaşılamadı",
+      "consentHandled_one": "{{count}} çerez izni istemi işlendi",
+      "consentHandled_other": "{{count}} çerez izni istemi işlendi",
+      "sitesUnknown": "Bildirilmedi"
+    },
+    "duration": {
+      "hm": "{{hours}} sa {{minutes}} dk",
+      "ms": "{{minutes}} dk {{seconds}} sn",
+      "s": "{{seconds}} sn"
+    },
+    "picker": {
+      "title": "Profilleri kaydet",
+      "description": "Botun gece boyunca ısıtacağı profilleri seçin.",
+      "searchPlaceholder": "Profillerde ara…",
+      "noProfiles": "Eşleşen profil yok.",
+      "alreadyEnrolled": "Kayıtlı",
+      "continue_one": "{{count}} ile devam et",
+      "continue_other": "{{count}} ile devam et"
+    },
+    "enrol": {
+      "titleOne": "{{name}} profilini kaydet",
+      "titleCount_one": "{{count}} profili kaydet",
+      "titleCount_other": "{{count}} profili kaydet",
+      "editTitle": "Zamanlamayı düzenle",
+      "description": "Bot, profili uzak bir makinede açar ve listelediğiniz siteleri gezer. Bilgisayarınız kapalı olabilir.",
+      "summaryNightly": "Her gece {{time}} saatinde, her seferinde en fazla {{minutes}} dk çalışır.",
+      "summaryWeeknights": "Pazartesiden cumaya {{time}} saatinde, her seferinde en fazla {{minutes}} dk çalışır.",
+      "summaryAlternate": "Gün aşırı {{time}} saatinde, her seferinde en fazla {{minutes}} dk çalışır.",
+      "summaryCustom_one": "Haftada {{count}} gece {{time}} saatinde, her seferinde en fazla {{minutes}} dk çalışır.",
+      "summaryCustom_other": "Haftada {{count}} gece {{time}} saatinde, her seferinde en fazla {{minutes}} dk çalışır.",
+      "confirm": "Bu gece için kaydet",
+      "confirmSome": "Bu gece {{total}} profilden {{eligible}} tanesini kaydet",
+      "fixFirst": "Önce bunları düzeltin",
+      "saving": "Kaydediliyor…",
+      "saved": "Zamanlama kaydedildi",
+      "enrolled_one": "{{count}} profil kaydedildi",
+      "enrolled_other": "{{count}} profil kaydedildi",
+      "adjust": "Zamanlamayı ayarla",
+      "cadenceLabel": "Sıklık",
+      "cadenceNightly": "Her gece",
+      "cadenceWeeknights": "Hafta içi geceler",
+      "cadenceAlternate": "Gün aşırı",
+      "cadenceCustom_one": "Haftada {{count}} gece",
+      "cadenceCustom_other": "Haftada {{count}} gece",
+      "timeLabel": "Başlangıç saati",
+      "timeHint": "Her profilin parmak izi saat dilimine göre.",
+      "maxMinutesLabel": "En fazla dakika",
+      "intensityLabel": "Derinlik",
+      "sitesLabel": "Siteler",
+      "sitesPlaceholder": "Her satıra bir adres",
+      "sitesHint_one": "{{count}} site. Yalnızca burada listelediğiniz sayfalar ziyaret edilir.",
+      "sitesHint_other": "{{count}} site. Yalnızca burada listelediğiniz sayfalar ziyaret edilir.",
+      "sitesTooMany": "En fazla {{max}} site.",
+      "presetsUnavailable": "Derinlik ön ayarları yüklenemedi. Birazdan tekrar deneyin.",
+      "confirmBulkTitle_one": "{{count}} profil Cookie Bot'a kaydedilsin mi?",
+      "confirmBulkTitle_other": "{{count}} profil Cookie Bot'a kaydedilsin mi?",
+      "confirmBulkDescription_one": "Bu, ortak uzak saatlerinizden bir gecelik çalışma ayırır. Saati ve siteleri sonraki adımda seçersiniz.",
+      "confirmBulkDescription_other": "Bu, ortak uzak saatlerinizden {{count}} gecelik çalışma ayırır. Saati ve siteleri sonraki adımda seçersiniz.",
+      "confirmBulkButton_one": "{{count}} profille devam et",
+      "confirmBulkButton_other": "{{count}} profille devam et",
+      "sitesRequired": "En az bir site ekleyin.",
+      "addSitesFirst": "Önce bir site ekleyin",
+      "presetsMissing": "Derinlik ön ayarları kullanılamıyor",
+      "sourceOwn": "Kendi listem",
+      "sourceCurated": "Seçilmiş",
+      "sourceSaved": "Kayıtlı",
+      "curatedEmpty": "Şu anda kullanılabilir seçilmiş liste yok.",
+      "curatedNote": "Güncel tuttuğumuz seçilmiş bir liste. Her profil kendi örneklemini alır, bu yüzden iki profil aynı kümeyi gezmez — listenin kendisinin bir imzaya dönüşmesini engelleyen şey budur. Adresler bizim tarafımızda kalır.",
+      "savedEmpty": "Henüz kaydedilmiş bir şey yok. Kendi listem sekmesinde bir liste yazıp oradan kaydedin.",
+      "savedNote": "Siteler programı kaydettiğinizde programa kopyalanır; listeyi sonradan düzenlemeniz mevcut programları etkilemez.",
+      "savedUnavailable": "Kayıtlı listeleriniz yüklenemedi.",
+      "saveAsList": "Liste olarak kaydet",
+      "listNamePlaceholder": "Bu listeye bir ad verin",
+      "listSaved": "Liste kaydedildi",
+      "listRenamed": "Liste yeniden adlandırıldı",
+      "listDeleted": "Liste silindi",
+      "listRename": "Yeniden adlandır",
+      "listDeleteConfirm": "Silinsin mi?",
+      "templateMissing": "O kayıtlı liste artık yok. Başka birini seçin.",
+      "templateNameTaken": "Bu ada sahip bir listeniz zaten var.",
+      "templateNameInvalid": "Listeye en fazla {{max}} karakterlik bir ad verin.",
+      "calendarLabel": "Ne zaman çalışır",
+      "daysLabel": "Haftanın günleri",
+      "addSlot": "Saat ekle",
+      "slotsFull": "En fazla {{max}} başlangıç saati.",
+      "removeSlot": "Bu saati kaldır",
+      "pickListFirst": "Önce bir liste seçin",
+      "finishCalendarFirst": "Önce programı tamamlayın",
+      "duplicateSlot": "İki satırın günleri ve saati aynı",
+      "listSites_one": "{{count}} site",
+      "listSites_other": "{{count}} site",
+      "summarySlots_one": "Haftada {{count}} kez, her seferinde en fazla {{minutes}} dk çalışır.",
+      "summarySlots_other": "Haftada {{count}} kez, her seferinde en fazla {{minutes}} dk çalışır.",
+      "templateNameInvalidNoMax": "Bu ad kayıtlı bir liste için kullanılamaz."
+    },
+    "preset": {
+      "light": "Hafif",
+      "balanced": "Standart",
+      "deep": "Derin"
+    },
+    "template": {
+      "lowIntentPurchaser": "Düşük niyetli alıcı",
+      "lowIntentPurchaserHint": "Profili fiyata duyarlı bir alıcı olarak konumlar: karşılaştırma, kupon, nakit iade ve ikinci el siteleri; mağazalara doğrudan değil toplayıcılar üzerinden ulaşır."
+    },
+    "preflight": {
+      "ineligible_one": "{{count}} profil uzaktan çalıştırılamıyor",
+      "ineligible_other": "{{count}} profil uzaktan çalıştırılamıyor",
+      "reasonSync": "Eşitleme kapalı",
+      "reasonEncrypted": "Uçtan uca şifreli",
+      "reasonNoFingerprint": "Kayıtlı işletim sistemi yok",
+      "reasonCrossOs": "{{os}} için oluşturuldu — eşleşen uzak makine yok",
+      "reasonNoExitNode": "Proxy veya VPN yok",
+      "fixSync": "Eşitlemeyi aç",
+      "fixEncrypted": "Eşitleme ayarlarını aç",
+      "fixProxy": "Bir proxy ata",
+      "fixFailed": "Bu düzeltme uygulanamadı.",
+      "exitNodeHint": "Proxy veya VPN olmadan çalışma, filonun kendi veri merkezi adresinden çıkar. Bir barındırma ağından saatlerce gelen trafik, profilin kimliğine hiç ısıtmamaktan daha çok zarar verir."
+    },
+    "conflict": {
+      "title": "{{email}} bu profili zaten {{time}} saatinde ısıtıyor",
+      "detail": "Tek bir profildeki iki zamanlama saatleri iki kez harcar ve çalışma sırasında çakışabilir.",
+      "keepTheirs": "Onun zamanlamasını kullan",
+      "replace": "Benimkiyle değiştir",
+      "replaceForbidden": "Başkasının zamanlamasını yalnızca ekip sahibi veya yöneticisi değiştirebilir.",
+      "askThem": "{{email}} adresini kopyala",
+      "emailCopied": "E-posta kopyalandı",
+      "copyFailed": "Adres kopyalanamadı."
+    },
+    "actionBar": {
+      "enrol": "Cookie Bot'a kaydet",
+      "proRequired": "Cookie Bot için Pro veya Team planı gerekir",
+      "noneEligible": "Seçili profillerin hiçbiri uzaktan ısıtılamaz"
+    },
+    "actions": {
+      "enrol": "Cookie Bot'a kaydet",
+      "editSchedule": "Zamanlamayı düzenle",
+      "runNow": "Şimdi çalıştır",
+      "runStarted": "Çalışma başlatıldı",
+      "viewActivity": "Etkinliği görüntüle",
+      "runNotStarted": "Çalışma başlamadı: {{reason}}"
+    },
+    "state": {
+      "enrolled": "Kayıtlı",
+      "notEnrolled": "Kayıtlı değil",
+      "paused": "Duraklatıldı",
+      "summary": "{{cadence}}, {{time}}",
+      "rowMenu": "{{name}} için Cookie Bot seçenekleri",
+      "blocked": "Çalışamıyor: {{reason}}"
+    },
+    "team": {
+      "title": "Ekip kullanımı",
+      "pooled_one": "{{total}} saatin {{used}} saati, {{count}} koltuk",
+      "pooled_other": "{{total}} saatin {{used}} saati, {{count}} koltuk arasında ortak",
+      "hours": "{{hours}} sa",
+      "legendBot": "Cookie Bot",
+      "legendInteractive": "Etkileşimli",
+      "columnMember": "Üye",
+      "columnRuns": "Çalışmalar",
+      "columnHours": "Saat",
+      "columnShare": "Pay",
+      "noActivity": "Bu dönemde uzak oturum yok.",
+      "soloNote": "Şimdilik yalnızca kendi kullanımınız. Havuzun üyelere göre dağılımını görmek için ekip arkadaşlarınızı davet edin.",
+      "runsFailed": "· {{n}} başarısız"
+    },
+    "closeReason": {
+      "stoppedByUser": "Elle durduruldu",
+      "maxDuration": "Süre sınırına ulaşıldı",
+      "other": "Sona erdi: {{reason}}"
+    },
+    "outcome": {
+      "notEntitled": "Planınıza dahil değil",
+      "syncDisabled": "Bu profilde bulut eşitlemesi kapalı",
+      "encryptedSync": "Uçtan uca şifreli eşitleme desteklenmiyor",
+      "proxyRequired": "Bağlı proxy veya VPN yok",
+      "touchFingerprint": "Dokunmatik parmak izleri desteklenmiyor",
+      "platformUnsupported": "Bu profilin sistemini çalıştıran makine yok",
+      "noSites": "Ziyaret edilecek site yok",
+      "quotaExhausted": "Uzak saatler tükendi",
+      "profileLocked": "Profil başka bir yerde açıktı",
+      "noCapacity": "Boş makine yoktu",
+      "managerError": "Filo tarayıcıyı başlatamadı",
+      "budgetExceeded": "Gecenin süresi doldu",
+      "cancelledByUser": "Elle durduruldu",
+      "unknown": "Bilinmeyen neden ({{code}})"
+    }
+  },
+  "prelaunchGate": {
+    "titleBlocked": "Başlatma engellendi",
+    "titleWarning": "Başlatmadan önce",
+    "intro": "Tarayıcıyı başlatmadan önce \"{{name}}\" ile ilgili şu sorunları inceleyin.",
+    "fingerprintHeading": "Proxy çıkışı parmak iziyle eşleşmiyor",
+    "vpnExtensionHeading": "VPN uzantısı algılandı",
+    "vpnExtensionIntro": "Bu profildeki, tarayıcı trafiğini yeniden yönlendirebilecek uzantılar:",
+    "vpnExtensionConfirmed": "Proxy'yi değiştirebilir",
+    "vpnExtensionLikely": "Proxy'yi değiştirebilir (olası)",
+    "vpnExtensionExplainer": "Bunlardan biri trafiğinizi başka bir yere yönlendirirse, tarayıcının gerçek konumu artık bu profilin oluşturulduğu saat dilimi, dil ve coğrafi konumla eşleşmez ve Donut bunu dışarıdan algılayamaz.",
+    "sourceDonut": "Donut tarafından yönetiliyor",
+    "sourceBrowser": "Profile yüklenmiş",
+    "measurementUnreliable": "Bir VPN uzantısı proxy'yi geçersiz kılabileceğinden, çıkış kontrolü tarayıcının gerçekte kullandığı rotayı yansıtmayabilir.",
+    "scanIncompleteEncrypted": "Bu profil şifreli olduğundan yalnızca Donut tarafından yönetilen uzantılar denetlenebildi.",
+    "scanIncompleteEphemeral": "Bu profilde henüz veri olmadığından yalnızca Donut tarafından yönetilen uzantılar denetlenebildi.",
+    "scanIncompletePartial": "Uzantı taraması yarıda kesildi, bu nedenle bazıları listelenmemiş olabilir.",
+    "probePending": "Proxy çıkışı henüz ölçülmedi. Donut başlatma sırasında kontrol edecek ve eşleşmezse duracak.",
+    "launchAnyway": "Yine de başlat",
+    "dontBlockAgain": "Bu tam uyuşmazlık için bir daha engelleme",
+    "dontWarnExtensions": "Bu uzantılar için bir daha uyarma",
+    "applyToRemaining": "Bu seçimi kalan profillere uygula",
+    "cancelledSummary": "{{total}} başlatmadan {{cancelled}} tanesi iptal edildi",
+    "cancelled": "Başlatma iptal edildi",
+    "vpnExtensionEntry": " {{version}} — {{capability}}, {{source}}",
+    "scanIncompleteMissing": "Bu profil henüz başlatılmadığından yalnızca Donut tarafından yönetilen uzantılar denetlenebildi."
  }
 }
@@ -92,7 +92,8 @@
    "window": {
      "minimize": "Thu nhỏ",
      "maximize": "Phóng to",
-      "restore": "Khôi phục"
+      "restore": "Khôi phục",
+      "close": "Đóng cửa sổ"
    },
    "commandPalette": {
      "title": "Bảng lệnh",
@@ -199,11 +200,13 @@
    "keepDecryptedProfilesInRam": "Giữ hồ sơ đã giải mã trong RAM",
    "keepDecryptedProfilesInRamDescription": "Giữ bản sao đã giải mã trong RAM của hồ sơ được bảo vệ bằng mật khẩu giữa các lần khởi chạy để khởi động nhanh hơn. Bản sao trên ổ đĩa vẫn được mã hóa.",
    "privacy": {
-      "consistencyWarning": "Cảnh báo nhất quán vân tay",
-      "consistencyWarningDescription": "Cảnh báo khi khởi chạy nếu múi giờ hoặc ngôn ngữ của hồ sơ không khớp với nút thoát proxy.",
+      "consistencyWarning": "Chặn khi dấu vân tay không khớp",
+      "consistencyWarningDescription": "Ngăn trình duyệt khởi động khi múi giờ hoặc ngôn ngữ của hồ sơ không khớp với nút thoát của proxy. Bạn vẫn có thể chọn khởi chạy.",
      "clearTraffic": "Xóa toàn bộ lịch sử lưu lượng",
      "clearTrafficDescription": "Xóa an toàn số liệu thống kê lưu lượng đã ghi của mọi hồ sơ.",
-      "clearTrafficSuccess": "Đã xóa lịch sử lưu lượng"
+      "clearTrafficSuccess": "Đã xóa lịch sử lưu lượng",
+      "vpnExtensionWarning": "Cảnh báo tiện ích VPN",
+      "vpnExtensionWarningDescription": "Cảnh báo trước khi khởi chạy khi hồ sơ có tiện ích có thể định tuyến lại lưu lượng của trình duyệt."
    }
  },
  "header": {
@@ -258,7 +261,8 @@
      "emptyCreate": "Tạo hồ sơ",
      "emptyImport": "Nhập hồ sơ",
      "emptyFilteredTitle": "Không tìm thấy hồ sơ",
-      "emptyFilteredHint": "Không có hồ sơ nào khớp với nhóm hoặc tìm kiếm này. Hãy thử bộ lọc khác hoặc tạo mới."
+      "emptyFilteredHint": "Không có hồ sơ nào khớp với nhóm hoặc tìm kiếm này. Hãy thử bộ lọc khác hoặc tạo mới.",
+      "bot": "Bot"
    },
    "actions": {
      "launch": "Khởi chạy",
@@ -344,6 +348,10 @@
      "nameDesc": "Tên (Z–A)",
      "newest": "Mới nhất trước",
      "oldest": "Cũ nhất trước"
+    },
+    "remote": {
+      "runningTooltip": "Đang chạy trên máy từ xa. Dừng lại để đưa hồ sơ về đây.",
+      "pendingSyncTooltip": "Đang tải về những gì phiên từ xa đã thay đổi. Sẽ dùng lại được khi hoàn tất."
    }
  },
  "createProfile": {
@@ -460,7 +468,7 @@
      "ssCipherRequired": "Cipher và mật khẩu là bắt buộc cho Shadowsocks",
      "selectType": "Chọn loại proxy",
      "saveFailed": "Lưu proxy thất bại: {{error}}",
-      "vlessType": "VLESS · Vision · REALITY",
+      "vlessType": "VLESS",
      "vlessUri": "URI VLESS",
      "vlessUriPlaceholder": "vless://…",
      "vlessUriHint": "Yêu cầu XTLS Vision và REALITY.",
@@ -1479,8 +1487,8 @@
    "createGroup": "Tạo nhóm",
    "noGroups": "Chưa tạo nhóm nào. Tạo nhóm đầu tiên bằng nút phía trên.",
    "loading": "Đang tải nhóm...",
-    "profileCount_one": "{{count}} profile",
-    "profileCount_other": "{{count}} profile",
+    "profileCount_one": "{{count}} hồ sơ",
+    "profileCount_other": "{{count}} hồ sơ",
    "groupsLabel": "Nhóm",
    "profilesCol": "Profile",
    "syncCannotDisable": "Không thể tắt đồng bộ khi nhóm này được sử dụng bởi profile đã đồng bộ",
@@ -1851,7 +1859,62 @@
    "vlessConfigInvalid": "URI VLESS không hợp lệ.",
    "xrayUnavailable": "Xray-core không khả dụng trên hệ thống này.",
    "xrayUnsupportedOs": "VLESS yêu cầu macOS 12 trở lên.",
-    "xrayStartFailed": "Không thể khởi động Xray-core."
+    "xrayStartFailed": "Không thể khởi động Xray-core.",
+    "cloudNotSignedIn": "Hãy đăng nhập tài khoản Donut Browser để dùng tính năng này.",
+    "cloudUnreachable": "Không kết nối được tới máy chủ Donut Browser. Hãy kiểm tra kết nối và thử lại.",
+    "cloudRequestFailed": "Yêu cầu thất bại. Hãy thử lại sau giây lát.",
+    "remoteRateLimited": "Quá nhiều yêu cầu. Hãy đợi một lát rồi thử lại.",
+    "remoteNoCapacity": "Hiện không có máy từ xa nào rảnh. Hãy thử lại sau vài phút.",
+    "remoteNotEntitled": "Gói của bạn không bao gồm chạy từ xa.",
+    "remoteInteractiveNotEntitled": "Gói của bạn chỉ bao gồm giờ từ xa cho Cookie Bot, không dùng cho phiên từ xa thao tác trực tiếp.",
+    "remoteRequiresRemoteExitNode": "Proxy của hồ sơ này chỉ hoạt động trên máy tính này (ví dụ 127.0.0.1 hoặc địa chỉ mạng nội bộ). Phiên từ xa chạy trên máy chủ của chúng tôi nên cần proxy có địa chỉ công khai.",
+    "remoteSessionRefused": "Máy từ xa đã từ chối phiên này.",
+    "remoteSessionNotFound": "Phiên từ xa đó không còn tồn tại.",
+    "remoteSessionConflict": "Hồ sơ này đang được mở ở nơi khác.",
+    "remoteSyncInProgress": "Hồ sơ này vẫn đang tải lên đồng bộ đám mây. Hãy đợi đồng bộ xong rồi thử lại.",
+    "remoteHoursExhausted": "Bạn đã dùng hết {{used}} trong {{granted}} giờ từ xa của tháng này.",
+    "notTeamMember": "Bạn không thuộc nhóm nào.",
+    "cookieBotNotEntitled": "Gói của bạn không bao gồm Cookie Bot.",
+    "cookieBotNotEnrolled": "Hồ sơ này chưa được thiết lập cho Cookie Bot.",
+    "cookieBotScheduleConflict": "{{email}} đã làm ấm hồ sơ này lúc {{time}}.",
+    "cookieBotRunInProgress": "Đã có một lần chạy đang diễn ra cho hồ sơ này.",
+    "cookieBotRunNotFound": "Lần chạy đó không còn tồn tại.",
+    "cookieBotInvalidSchedule": "Lịch chạy đó không hợp lệ. Hãy kiểm tra giờ chạy, các ngày và thời lượng.",
+    "cookieBotInvalidTimezone": "{{timezone}} không phải múi giờ mà máy chủ nhận diện được.",
+    "cookieBotInvalidPeriod": "Kỳ đó không hợp lệ. Hãy dùng dạng tháng như 2026-08.",
+    "cookieBotSiteLimit": "Nhập từ {{min}} đến {{max}} trang, mỗi trang là một địa chỉ http hoặc https đầy đủ.",
+    "cookieBotRequiresCloudSync": "Hãy bật đồng bộ đám mây cho hồ sơ này trước: máy từ xa không có cách nào khác để lấy hồ sơ.",
+    "cookieBotEncryptedSyncUnsupported": "Hồ sơ này dùng đồng bộ mã hóa đầu cuối mà máy từ xa không giải mã được. Hãy chuyển sang đồng bộ thường.",
+    "cookieBotUnknownPlatform": "Hồ sơ này chưa ghi nhận hệ điều hành nên không thể ghép với máy nào.",
+    "cookieBotUnsupportedPlatform": "Cookie Bot không chạy được hồ sơ {{platform}}. Chỉ hỗ trợ hồ sơ Windows và macOS.",
+    "cookieBotRequiresExitNode": "Hãy gán proxy hoặc VPN trước. Nếu không, lần chạy sẽ đi ra từ địa chỉ trung tâm dữ liệu, gây hại cho danh tính hồ sơ.",
+    "cookieBotRequiresRemoteExitNode": "Proxy của hồ sơ này chỉ hoạt động trên máy tính này (ví dụ 127.0.0.1 hoặc địa chỉ mạng nội bộ). Cookie Bot chạy trên máy chủ của chúng tôi nên cần proxy có địa chỉ công khai.",
+    "unknownCode": "Đã xảy ra lỗi: {{code}}",
+    "cookieBotTouchFingerprintUnsupported": "Hồ sơ này khai báo là thiết bị cảm ứng, bot không điều khiển được. Hãy dùng vân tay máy tính để bàn.",
+    "profileRunningRemotely": "Hồ sơ này đang chạy trên máy từ xa. Hãy dừng phiên từ xa trước.",
+    "profileRemoteSyncPending": "Một phiên từ xa vừa kết thúc. Đang chờ tải các thay đổi về trước khi mở hồ sơ này tại đây.",
+    "profileLockedByMember": "Hồ sơ này đang được {{email}} sử dụng.",
+    "profileLockedElsewhere": "Hồ sơ này đang được sử dụng trên thiết bị khác.",
+    "profileLockUnavailable": "Không thể kiểm tra hồ sơ này có đang được dùng ở nơi khác hay không. Hãy kiểm tra kết nối và thử lại.",
+    "fingerprintExitMismatch": "Nút thoát của proxy không khớp với dấu vân tay của hồ sơ này.",
+    "launchConsentExpired": "Xác nhận đó không còn hiệu lực. Hãy thử khởi chạy lại.",
+    "vpnWorkerStartFailed": "Không thể khởi động kết nối VPN: {{detail}}",
+    "exitProbeFailed": "Không thể kết nối tới nút thoát của proxy để kiểm tra vị trí.",
+    "vlessUnsupported": {
+      "security": "Máy chủ VLESS này không dùng REALITY. Donut chỉ hỗ trợ VLESS kèm REALITY.",
+      "flow": "Máy chủ VLESS này không dùng luồng XTLS Vision mà Donut yêu cầu.",
+      "transport": "Donut chỉ hỗ trợ VLESS trên TCP thuần — máy chủ này dùng phương thức truyền khác (như WebSocket hoặc gRPC).",
+      "encryption": "Máy chủ VLESS này dùng thiết lập mã hóa mà Donut không hỗ trợ.",
+      "headerType": "Máy chủ VLESS này dùng cách che giấu tiêu đề mà Donut không hỗ trợ.",
+      "fingerprint": "URI VLESS này yêu cầu một dấu vân tay TLS mà Donut không hỗ trợ.",
+      "sni": "URI VLESS thiếu SNI (sni) cần cho REALITY.",
+      "publicKey": "URI VLESS thiếu khóa công khai REALITY (pbk).",
+      "scheme": "Đây không phải liên kết VLESS. Nó phải bắt đầu bằng vless://.",
+      "parameter": "URI VLESS chứa một tùy chọn mà Donut không hỗ trợ.",
+      "malformed": "URI VLESS không hợp lệ."
+    },
+    "camoufoxRemoved": "Camoufox không còn được hỗ trợ. Hãy tạo lại hồ sơ này bằng Wayfern.",
+    "noE2ePasswordSet": "Chưa đặt mật khẩu mã hóa đầu cuối. Hãy đặt trước khi đồng bộ dữ liệu đã mã hóa."
  },
  "rail": {
    "profiles": "Profile",
@@ -1870,7 +1933,9 @@
    },
    "network": "Mạng",
    "integrations": "Tích hợp",
-    "account": "Tài khoản"
+    "account": "Tài khoản",
+    "cookieBot": "Cookie Bot",
+    "cookieBotRunning": "Cookie Bot — đang chạy"
  },
  "pageTitle": {
    "proxies": "Mạng",
@@ -1881,7 +1946,8 @@
    "integrations": "Tích hợp",
    "account": "Tài khoản",
    "import": "Nhập profile",
-    "shortcuts": "Phím tắt"
+    "shortcuts": "Phím tắt",
+    "cookieBot": "Cookie Bot"
  },
  "encryption": {
    "required": {
@@ -1924,7 +1990,8 @@
    },
    "tabs": {
      "account": "Tài khoản",
-      "selfHosted": "Tự lưu trữ"
+      "selfHosted": "Tự lưu trữ",
+      "teamUsage": "Mức dùng của nhóm"
    },
    "selfHosted": {
      "title": "Máy chủ đồng bộ tự lưu trữ",
@@ -1937,7 +2004,8 @@
    },
    "deviceOrdinal": "{{ordinal}} trên {{count}}",
    "automationPrimaryOnly": "Tự động hóa trình duyệt chỉ chạy trên thiết bị chính của bạn (Thiết bị 1). Đăng xuất ở đó để sử dụng tại đây.",
-    "automationActiveHere": "Tự động hóa trình duyệt đang hoạt động trên thiết bị này."
+    "automationActiveHere": "Tự động hóa trình duyệt đang hoạt động trên thiết bị này.",
+    "viewTeamUsage": "Xem mức dùng của nhóm"
  },
  "shortcutsPage": {
    "title": "Phím tắt",
@@ -1970,7 +2038,8 @@
    "goGroups": "Đi đến Nhóm",
    "goIntegrations": "Đi đến Tích hợp",
    "goAccount": "Đi đến Tài khoản",
-    "goSettings": "Đi đến Cài đặt"
+    "goSettings": "Đi đến Cài đặt",
+    "goCookieBot": "Cookie Bot"
  },
  "closeConfirm": {
    "title": "Đóng Donut Browser?",
@@ -2091,16 +2160,354 @@
    "description": "Xóa cookie, lịch sử và bộ nhớ đệm khi trình duyệt đóng. Tiện ích mở rộng và dấu trang được giữ lại."
  },
  "consistencyWarning": {
-    "title": "Vân tay không khớp",
-    "intro": "Điểm thoát proxy của \"{{name}}\" không khớp với vân tay của hồ sơ này:",
-    "timezoneTitle": "Múi giờ không khớp",
    "timezoneDetail": "Nút thoát nằm ở {{exit}} nhưng vân tay báo là {{fingerprint}}.",
-    "languageTitle": "Ngôn ngữ không khớp",
    "languageDetail": "Quốc gia thoát là {{country}} nhưng ngôn ngữ của vân tay là {{fingerprint}}.",
    "explainer": "Múi giờ hoặc ngôn ngữ không khớp với IP thoát là một tín hiệu chống bot rất mạnh, dù thiết bị thật của bạn không bao giờ bị lộ. Hãy căn chỉnh vân tay theo vị trí proxy để giảm bị đối xử khắt khe.",
-    "dontWarnAgain": "Không cảnh báo lại cho hồ sơ này",
    "matchToProxy": "Khớp vân tay với proxy",
    "matching": "Đang khớp…",
    "matchSuccess": "Đã cập nhật vân tay để khớp với proxy. Khởi động lại hồ sơ để áp dụng."
+  },
+  "cookieBot": {
+    "title": "Cookie Bot",
+    "description": "Làm ấm hồ sơ qua đêm trên máy từ xa.",
+    "tabs": {
+      "overview": "Tổng quan",
+      "schedule": "Lịch chạy",
+      "activity": "Hoạt động",
+      "team": "Nhóm"
+    },
+    "locked": {
+      "title": "Cookie Bot",
+      "hint": "Cookie Bot làm ấm hồ sơ của bạn qua đêm trên máy từ xa, giúp chúng giữ được cookie và lịch sử mà không cần bật máy tính của bạn. Cần gói Pro hoặc Team."
+    },
+    "empty": {
+      "title": "Chưa có hồ sơ nào được đăng ký",
+      "hint": "Chọn một hồ sơ và bot sẽ làm ấm nó qua đêm trên máy từ xa. Máy tính của bạn có thể tắt.",
+      "cta": "Đăng ký một hồ sơ"
+    },
+    "tonight": {
+      "label": "Đêm nay",
+      "nextRun": "Lần chạy tới lúc {{time}}",
+      "dueCount_one": "{{count}} hồ sơ đến hạn",
+      "dueCount_other": "{{count}} hồ sơ đến hạn",
+      "nothingScheduled": "Chưa lên lịch gì"
+    },
+    "lastDay": {
+      "label": "24 giờ qua",
+      "none": "Chưa có lần chạy nào",
+      "ran_one": "{{count}} đã chạy",
+      "ran_other": "{{count}} đã chạy",
+      "partial_one": "{{count}} một phần",
+      "partial_other": "{{count}} một phần",
+      "failed_one": "{{count}} thất bại",
+      "failed_other": "{{count}} thất bại"
+    },
+    "chart": {
+      "machineTime": "Thời gian máy mỗi đêm",
+      "minutes": "{{minutes}} phút"
+    },
+    "hours": {
+      "label": "Giờ từ xa",
+      "remaining": "Còn {{remaining}} giờ trong {{total}}",
+      "remainingOf": "trên {{total}} giờ",
+      "used": "Đã dùng {{used}} trong {{total}} giờ",
+      "resets": "Đặt lại vào {{date}}",
+      "exhausted": "Đã hết giờ từ xa. Các lịch chạy vẫn được giữ và sẽ tiếp tục ở chu kỳ sau.",
+      "exhaustedOn": "Đã hết giờ từ xa. Các lịch chạy vẫn được giữ và sẽ tiếp tục vào {{date}}.",
+      "estimate": "Khoảng {{hours}} giờ mỗi tuần · còn {{remaining}} giờ trong chu kỳ này",
+      "estimateOverBudget": "Cần khoảng {{hours}} giờ mỗi tuần — chỉ còn {{remaining}} giờ",
+      "estimateOnly": "Khoảng {{hours}} giờ mỗi tuần"
+    },
+    "enrolled": {
+      "columnProfile": "Hồ sơ",
+      "columnCadence": "Tần suất",
+      "columnTime": "Giờ",
+      "columnNextRun": "Lần chạy tới",
+      "columnLastRun": "Lần chạy trước",
+      "enrolProfiles": "Đăng ký hồ sơ",
+      "edit": "Sửa lịch chạy",
+      "neverRun": "Chưa bao giờ",
+      "pausedNoHours": "Tạm dừng — hết giờ",
+      "profileMissing": "Hồ sơ đó không có trên máy tính này."
+    },
+    "schedule": {
+      "empty": "Chưa có gì được lên lịch.",
+      "quietHours_one": "{{count}} giờ trống",
+      "quietHours_other": "{{count}} giờ trống",
+      "crowded_one": "{{count}} hồ sơ khởi động cùng lúc",
+      "crowded_other": "{{count}} hồ sơ khởi động cùng lúc",
+      "unenrol": "Gỡ khỏi Cookie Bot",
+      "unenrolTitle": "Gỡ {{name}} khỏi Cookie Bot?",
+      "unenrolDescription": "Việc làm ấm sẽ dừng ngay đêm nay. Các lần chạy trước vẫn nằm trong tab Hoạt động.",
+      "unenrolled": "Đã gỡ khỏi Cookie Bot"
+    },
+    "status": {
+      "provisioning": "Đang chuẩn bị máy",
+      "ready": "Đang tải hồ sơ",
+      "warming": "Đang làm ấm",
+      "finished": "Đang kết thúc",
+      "failed": "Thất bại"
+    },
+    "runStatus": {
+      "pending": "Trong hàng đợi",
+      "running": "Đang chạy",
+      "succeeded": "Hoàn tất",
+      "partial": "Một phần",
+      "failed": "Thất bại",
+      "skipped": "Đã bỏ qua",
+      "cancelled": "Đã dừng"
+    },
+    "running": {
+      "label": "Đang chạy",
+      "more": "+{{count}} nữa",
+      "stop": "Dừng lần chạy",
+      "stopped": "Đã dừng lần chạy"
+    },
+    "live": {
+      "idle": "Hiện không có gì đang chạy",
+      "streamOffline": "Cập nhật trực tiếp đang ngoại tuyến",
+      "streamOfflineDetail": "Cập nhật trực tiếp đang ngoại tuyến — đang kết nối lại. Các lần chạy bên dưới có thể đã cũ.",
+      "unnamedSession": "Phiên từ xa",
+      "notStartedYet": "Máy chưa báo về thời điểm bắt đầu.",
+      "sitesProgress": "{{visited}} trong {{total}} trang",
+      "sitesUnknown": "Chưa có báo cáo về các trang",
+      "consentHandled_one": "Đã xử lý {{count}} hộp thoại đồng ý",
+      "consentHandled_other": "Đã xử lý {{count}} hộp thoại đồng ý",
+      "consentUnknown": "Chưa có báo cáo về hộp thoại đồng ý",
+      "billed": "Đã tính {{duration}}",
+      "billedUnknown": "Chưa có báo cáo về thời gian tính phí",
+      "chunk": "Phần {{index}} trên {{total}}"
+    },
+    "history": {
+      "title": "Lần chạy",
+      "allProfiles": "Tất cả hồ sơ",
+      "searchPlaceholder": "Tìm hồ sơ…",
+      "filterAll": "Tất cả lần chạy",
+      "filterComplete": "Hoàn tất",
+      "filterPartial": "Một phần",
+      "filterFailed": "Thất bại",
+      "columnStarted": "Bắt đầu",
+      "columnProfile": "Hồ sơ",
+      "columnDuration": "Thời lượng",
+      "columnSites": "Trang",
+      "columnStatus": "Trạng thái",
+      "columnOperator": "Người vận hành",
+      "empty": "Chưa có lần chạy nào.",
+      "noMatch": "Không có lần chạy nào khớp bộ lọc này.",
+      "unknownProfile": "Hồ sơ không xác định",
+      "outcome": "Lý do: {{reason}}",
+      "sitesVisited": "{{visited}}/{{total}}",
+      "sitesFailed_one": "Không truy cập được {{count}} trang",
+      "sitesFailed_other": "Không truy cập được {{count}} trang",
+      "consentHandled_one": "Đã xử lý {{count}} hộp thoại đồng ý",
+      "consentHandled_other": "Đã xử lý {{count}} hộp thoại đồng ý",
+      "sitesUnknown": "Chưa có số liệu"
+    },
+    "duration": {
+      "hm": "{{hours}} giờ {{minutes}} phút",
+      "ms": "{{minutes}} phút {{seconds}} giây",
+      "s": "{{seconds}} giây"
+    },
+    "picker": {
+      "title": "Đăng ký hồ sơ",
+      "description": "Chọn các hồ sơ mà bot sẽ làm ấm qua đêm.",
+      "searchPlaceholder": "Tìm hồ sơ…",
+      "noProfiles": "Không có hồ sơ nào khớp.",
+      "alreadyEnrolled": "Đã đăng ký",
+      "continue_one": "Tiếp tục với {{count}}",
+      "continue_other": "Tiếp tục với {{count}}"
+    },
+    "enrol": {
+      "titleOne": "Đăng ký {{name}}",
+      "titleCount_one": "Đăng ký {{count}} hồ sơ",
+      "titleCount_other": "Đăng ký {{count}} hồ sơ",
+      "editTitle": "Sửa lịch chạy",
+      "description": "Bot mở hồ sơ trên máy từ xa và duyệt các trang bạn liệt kê. Máy tính của bạn có thể tắt.",
+      "summaryNightly": "Chạy mỗi đêm lúc {{time}}, tối đa {{minutes}} phút mỗi lần.",
+      "summaryWeeknights": "Chạy từ thứ Hai đến thứ Sáu lúc {{time}}, tối đa {{minutes}} phút mỗi lần.",
+      "summaryAlternate": "Chạy cách đêm lúc {{time}}, tối đa {{minutes}} phút mỗi lần.",
+      "summaryCustom_one": "Chạy {{count}} đêm mỗi tuần lúc {{time}}, tối đa {{minutes}} phút mỗi lần.",
+      "summaryCustom_other": "Chạy {{count}} đêm mỗi tuần lúc {{time}}, tối đa {{minutes}} phút mỗi lần.",
+      "confirm": "Đăng ký cho đêm nay",
+      "confirmSome": "Đăng ký {{eligible}} trong {{total}} cho đêm nay",
+      "fixFirst": "Hãy khắc phục những mục này trước",
+      "saving": "Đang đăng ký…",
+      "saved": "Đã lưu lịch chạy",
+      "enrolled_one": "Đã đăng ký {{count}} hồ sơ",
+      "enrolled_other": "Đã đăng ký {{count}} hồ sơ",
+      "adjust": "Điều chỉnh lịch chạy",
+      "cadenceLabel": "Tần suất",
+      "cadenceNightly": "Mỗi đêm",
+      "cadenceWeeknights": "Đêm trong tuần",
+      "cadenceAlternate": "Cách đêm",
+      "cadenceCustom_one": "{{count}} đêm mỗi tuần",
+      "cadenceCustom_other": "{{count}} đêm mỗi tuần",
+      "timeLabel": "Giờ bắt đầu",
+      "timeHint": "Theo múi giờ trong dấu vân tay của từng hồ sơ.",
+      "maxMinutesLabel": "Số phút tối đa",
+      "intensityLabel": "Độ sâu",
+      "sitesLabel": "Trang web",
+      "sitesPlaceholder": "Mỗi dòng một địa chỉ",
+      "sitesHint_one": "{{count}} trang. Chỉ những trang bạn liệt kê ở đây mới được truy cập.",
+      "sitesHint_other": "{{count}} trang. Chỉ những trang bạn liệt kê ở đây mới được truy cập.",
+      "sitesTooMany": "Tối đa {{max}} trang.",
+      "presetsUnavailable": "Không tải được các mức độ sâu định sẵn. Hãy thử lại sau giây lát.",
+      "confirmBulkTitle_one": "Đăng ký {{count}} hồ sơ vào Cookie Bot?",
+      "confirmBulkTitle_other": "Đăng ký {{count}} hồ sơ vào Cookie Bot?",
+      "confirmBulkDescription_one": "Việc này đặt trước một lần chạy đêm, trừ vào quỹ giờ từ xa dùng chung. Bạn sẽ chọn giờ và các trang ở bước tiếp theo.",
+      "confirmBulkDescription_other": "Việc này đặt trước {{count}} lần chạy đêm, trừ vào quỹ giờ từ xa dùng chung. Bạn sẽ chọn giờ và các trang ở bước tiếp theo.",
+      "confirmBulkButton_one": "Tiếp tục với {{count}} hồ sơ",
+      "confirmBulkButton_other": "Tiếp tục với {{count}} hồ sơ",
+      "sitesRequired": "Hãy thêm ít nhất một trang.",
+      "addSitesFirst": "Hãy thêm một trang trước",
+      "presetsMissing": "Không có cài đặt sẵn về độ sâu",
+      "sourceOwn": "Danh sách của tôi",
+      "sourceCurated": "Tuyển chọn",
+      "sourceSaved": "Đã lưu",
+      "curatedEmpty": "Hiện không có danh sách tuyển chọn nào.",
+      "curatedNote": "Danh sách tuyển chọn do chúng tôi cập nhật. Mỗi hồ sơ lấy một mẫu riêng từ đó, nên không hồ sơ nào duyệt cùng một tập trang — chính điều này khiến danh sách không trở thành dấu hiệu nhận dạng. Các địa chỉ vẫn nằm ở phía chúng tôi.",
+      "savedEmpty": "Chưa lưu gì cả. Hãy nhập danh sách ở mục Danh sách của tôi rồi lưu từ đó.",
+      "savedNote": "Các trang được sao chép vào lịch khi bạn lưu, nên sửa danh sách sau này không ảnh hưởng tới các lịch đã có.",
+      "savedUnavailable": "Không tải được các danh sách đã lưu của bạn.",
+      "saveAsList": "Lưu thành danh sách",
+      "listNamePlaceholder": "Đặt tên cho danh sách",
+      "listSaved": "Đã lưu danh sách",
+      "listRenamed": "Đã đổi tên danh sách",
+      "listDeleted": "Đã xóa danh sách",
+      "listRename": "Đổi tên",
+      "listDeleteConfirm": "Xóa?",
+      "templateMissing": "Danh sách đã lưu đó không còn nữa. Hãy chọn danh sách khác.",
+      "templateNameTaken": "Bạn đã có một danh sách trùng tên.",
+      "templateNameInvalid": "Đặt tên danh sách tối đa {{max}} ký tự.",
+      "calendarLabel": "Thời điểm chạy",
+      "daysLabel": "Các ngày trong tuần",
+      "addSlot": "Thêm một giờ",
+      "slotsFull": "Tối đa {{max}} giờ bắt đầu.",
+      "removeSlot": "Bỏ giờ này",
+      "pickListFirst": "Chọn một danh sách trước",
+      "finishCalendarFirst": "Hoàn tất lịch trước",
+      "duplicateSlot": "Hai hàng có cùng ngày và giờ",
+      "listSites_one": "{{count}} trang",
+      "listSites_other": "{{count}} trang",
+      "summarySlots_one": "Chạy {{count}} lần mỗi tuần, tối đa {{minutes}} phút mỗi lần.",
+      "summarySlots_other": "Chạy {{count}} lần mỗi tuần, tối đa {{minutes}} phút mỗi lần.",
+      "templateNameInvalidNoMax": "Không thể dùng tên đó cho danh sách đã lưu."
+    },
+    "preset": {
+      "light": "Nhẹ",
+      "balanced": "Tiêu chuẩn",
+      "deep": "Sâu"
+    },
+    "template": {
+      "lowIntentPurchaser": "Người mua ít ý định",
+      "lowIntentPurchaserHint": "Định vị hồ sơ như một người mua nhạy cảm về giá: các trang so sánh, mã giảm giá, hoàn tiền và mua bán lại, đến với người bán qua trang tổng hợp thay vì trực tiếp."
+    },
+    "preflight": {
+      "ineligible_one": "{{count}} hồ sơ không chạy từ xa được",
+      "ineligible_other": "{{count}} hồ sơ không chạy từ xa được",
+      "reasonSync": "Đồng bộ đang tắt",
+      "reasonEncrypted": "Mã hóa đầu cuối",
+      "reasonNoFingerprint": "Chưa ghi nhận hệ điều hành",
+      "reasonCrossOs": "Tạo cho {{os}} — không có máy từ xa phù hợp",
+      "reasonNoExitNode": "Không có proxy hoặc VPN",
+      "fixSync": "Bật đồng bộ",
+      "fixEncrypted": "Mở cài đặt đồng bộ",
+      "fixProxy": "Gán một proxy",
+      "fixFailed": "Không áp dụng được cách khắc phục đó.",
+      "exitNodeHint": "Không có proxy hoặc VPN, lần chạy sẽ đi ra từ chính địa chỉ trung tâm dữ liệu của hệ thống máy. Nhiều giờ lưu lượng từ một mạng lưu trữ gây hại cho danh tính hồ sơ hơn cả việc không làm ấm."
+    },
+    "conflict": {
+      "title": "{{email}} đã làm ấm hồ sơ này lúc {{time}}",
+      "detail": "Hai lịch chạy trên cùng một hồ sơ tiêu tốn giờ gấp đôi và có thể xung đột giữa chừng.",
+      "keepTheirs": "Dùng lịch của họ",
+      "replace": "Thay bằng lịch của tôi",
+      "replaceForbidden": "Chỉ chủ sở hữu hoặc quản trị viên nhóm mới đổi được lịch của người khác.",
+      "askThem": "Sao chép {{email}}",
+      "emailCopied": "Đã sao chép email",
+      "copyFailed": "Không sao chép được địa chỉ."
+    },
+    "actionBar": {
+      "enrol": "Đăng ký vào Cookie Bot",
+      "proRequired": "Cookie Bot cần gói Pro hoặc Team",
+      "noneEligible": "Không hồ sơ nào đã chọn có thể làm ấm từ xa"
+    },
+    "actions": {
+      "enrol": "Đăng ký vào Cookie Bot",
+      "editSchedule": "Sửa lịch chạy",
+      "runNow": "Chạy ngay",
+      "runStarted": "Đã bắt đầu chạy",
+      "viewActivity": "Xem hoạt động",
+      "runNotStarted": "Lượt chạy chưa bắt đầu: {{reason}}"
+    },
+    "state": {
+      "enrolled": "Đã đăng ký",
+      "notEnrolled": "Chưa đăng ký",
+      "paused": "Tạm dừng",
+      "summary": "{{cadence}} lúc {{time}}",
+      "rowMenu": "Tùy chọn Cookie Bot cho {{name}}",
+      "blocked": "Không thể chạy: {{reason}}"
+    },
+    "team": {
+      "title": "Mức dùng của nhóm",
+      "pooled_one": "{{used}} trong {{total}} giờ, {{count}} chỗ",
+      "pooled_other": "{{used}} trong {{total}} giờ dùng chung cho {{count}} chỗ",
+      "hours": "{{hours}} giờ",
+      "legendBot": "Cookie Bot",
+      "legendInteractive": "Tương tác",
+      "columnMember": "Thành viên",
+      "columnRuns": "Lần chạy",
+      "columnHours": "Giờ",
+      "columnShare": "Tỷ lệ",
+      "noActivity": "Không có phiên từ xa nào trong kỳ này.",
+      "soloNote": "Hiện chỉ có mức dùng của bạn. Mời đồng đội để xem quỹ giờ chia theo từng thành viên.",
+      "runsFailed": "· {{n}} thất bại"
+    },
+    "closeReason": {
+      "stoppedByUser": "Đã dừng thủ công",
+      "maxDuration": "Đã đạt giới hạn thời gian",
+      "other": "Đã kết thúc: {{reason}}"
+    },
+    "outcome": {
+      "notEntitled": "Không có trong gói của bạn",
+      "syncDisabled": "Hồ sơ này đang tắt đồng bộ đám mây",
+      "encryptedSync": "Không hỗ trợ đồng bộ mã hoá đầu cuối",
+      "proxyRequired": "Chưa gắn proxy hoặc VPN",
+      "touchFingerprint": "Không hỗ trợ vân tay thiết bị cảm ứng",
+      "platformUnsupported": "Không có máy nào chạy hệ điều hành của hồ sơ này",
+      "noSites": "Không có trang nào để truy cập",
+      "quotaExhausted": "Đã dùng hết số giờ từ xa",
+      "profileLocked": "Hồ sơ đang mở ở nơi khác",
+      "noCapacity": "Không có máy nào rảnh",
+      "managerError": "Cụm máy không khởi động được trình duyệt",
+      "budgetExceeded": "Đã hết thời lượng dành cho đêm nay",
+      "cancelledByUser": "Đã dừng thủ công",
+      "unknown": "Lý do không xác định ({{code}})"
+    }
+  },
+  "prelaunchGate": {
+    "titleBlocked": "Đã chặn khởi chạy",
+    "titleWarning": "Trước khi khởi chạy",
+    "intro": "Hãy xem lại các vấn đề của \"{{name}}\" trước khi khởi động trình duyệt.",
+    "fingerprintHeading": "Điểm ra của proxy không khớp với dấu vân tay",
+    "vpnExtensionHeading": "Đã phát hiện tiện ích VPN",
+    "vpnExtensionIntro": "Các tiện ích trong hồ sơ này có thể định tuyến lại lưu lượng của trình duyệt:",
+    "vpnExtensionConfirmed": "Có thể thay đổi proxy",
+    "vpnExtensionLikely": "Có khả năng thay đổi proxy",
+    "vpnExtensionExplainer": "Nếu một trong số đó chuyển lưu lượng của bạn đi nơi khác, vị trí thực của trình duyệt sẽ không còn khớp với múi giờ, ngôn ngữ và vị trí địa lý mà hồ sơ này được tạo ra, và Donut không thể phát hiện điều đó từ bên ngoài.",
+    "sourceDonut": "Do Donut quản lý",
+    "sourceBrowser": "Đã cài trong hồ sơ",
+    "measurementUnreliable": "Vì tiện ích VPN có thể ghi đè proxy, kết quả kiểm tra điểm ra có thể không phản ánh tuyến đường mà trình duyệt thực sự dùng.",
+    "scanIncompleteEncrypted": "Hồ sơ này được mã hóa nên chỉ có thể kiểm tra các tiện ích do Donut quản lý.",
+    "scanIncompleteEphemeral": "Hồ sơ này chưa có dữ liệu nên chỉ có thể kiểm tra các tiện ích do Donut quản lý.",
+    "scanIncompletePartial": "Quá trình quét tiện ích bị ngắt giữa chừng nên có thể thiếu một số tiện ích.",
+    "probePending": "Điểm ra của proxy chưa được đo. Donut sẽ kiểm tra trong lúc khởi động và dừng lại nếu không khớp.",
+    "launchAnyway": "Vẫn khởi chạy",
+    "dontBlockAgain": "Không chặn lại với đúng sai lệch này",
+    "dontWarnExtensions": "Không cảnh báo lại về các tiện ích này",
+    "applyToRemaining": "Áp dụng lựa chọn này cho các hồ sơ còn lại",
+    "cancelledSummary": "Đã hủy {{cancelled}} trên {{total}} lượt khởi chạy",
+    "cancelled": "Đã hủy khởi chạy",
+    "vpnExtensionEntry": " {{version}} — {{capability}}, {{source}}",
+    "scanIncompleteMissing": "Hồ sơ này chưa từng được khởi chạy nên chỉ có thể kiểm tra các tiện ích do Donut quản lý."
  }
 }
@@ -92,7 +92,8 @@
    "window": {
      "minimize": "最小化",
      "maximize": "最大化",
-      "restore": "还原"
+      "restore": "还原",
+      "close": "关闭窗口"
    },
    "commandPalette": {
      "title": "命令面板",
@@ -199,11 +200,13 @@
    "keepDecryptedProfilesInRam": "在内存中保留已解密的配置文件",
    "keepDecryptedProfilesInRamDescription": "在启动之间保留密码保护配置文件的已解密内存副本,以便更快地启动。无论如何磁盘上的副本始终保持加密。",
    "privacy": {
-      "consistencyWarning": "指纹一致性警告",
-      "consistencyWarningDescription": "当配置文件的时区或语言与其代理出口节点不匹配时,在启动时发出警告。",
+      "consistencyWarning": "指纹不匹配时阻止启动",
+      "consistencyWarningDescription": "当配置文件的时区或语言与其代理出口节点不一致时，阻止浏览器启动。你仍可以选择启动。",
      "clearTraffic": "清除所有流量历史",
      "clearTrafficDescription": "安全清除所有配置文件的已记录流量统计数据。",
-      "clearTrafficSuccess": "流量历史已清除"
+      "clearTrafficSuccess": "流量历史已清除",
+      "vpnExtensionWarning": "VPN 扩展警告",
+      "vpnExtensionWarningDescription": "当配置文件中存在可改变浏览器流量路径的扩展时，在启动前发出警告。"
    }
  },
  "header": {
@@ -258,7 +261,8 @@
      "emptyCreate": "创建配置文件",
      "emptyImport": "导入配置文件",
      "emptyFilteredTitle": "未找到配置文件",
-      "emptyFilteredHint": "没有符合此分组或搜索的配置文件。请尝试其他筛选条件或新建一个。"
+      "emptyFilteredHint": "没有符合此分组或搜索的配置文件。请尝试其他筛选条件或新建一个。",
+      "bot": "机器人"
    },
    "actions": {
      "launch": "启动",
@@ -344,6 +348,10 @@
      "nameDesc": "名称 (Z–A)",
      "newest": "最新优先",
      "oldest": "最早优先"
+    },
+    "remote": {
+      "runningTooltip": "正在远程计算机上运行。停止后配置文件会回到本机。",
+      "pendingSyncTooltip": "正在下载远程会话所做的更改。完成后即可再次使用。"
    }
  },
  "createProfile": {
@@ -460,7 +468,7 @@
      "ssCipherRequired": "Shadowsocks 需要密码学和密码",
      "selectType": "选择代理类型",
      "saveFailed": "保存代理失败: {{error}}",
-      "vlessType": "VLESS · Vision · REALITY",
+      "vlessType": "VLESS",
      "vlessUri": "VLESS URI",
      "vlessUriPlaceholder": "vless://…",
      "vlessUriHint": "需要 XTLS Vision 和 REALITY。",
@@ -1851,7 +1859,62 @@
    "vlessConfigInvalid": "VLESS URI 无效。",
    "xrayUnavailable": "此系统无法使用 Xray-core。",
    "xrayUnsupportedOs": "VLESS 需要 macOS 12 或更高版本。",
-    "xrayStartFailed": "无法启动 Xray-core。"
+    "xrayStartFailed": "无法启动 Xray-core。",
+    "cloudNotSignedIn": "请先登录你的 Donut Browser 账号再使用此功能。",
+    "cloudUnreachable": "无法连接 Donut Browser 服务器。请检查网络后重试。",
+    "cloudRequestFailed": "请求失败。请稍后再试。",
+    "remoteRateLimited": "请求过于频繁。请稍候再试。",
+    "remoteNoCapacity": "当前没有空闲的远程机器。请几分钟后再试。",
+    "remoteNotEntitled": "你的套餐不包含远程运行。",
+    "remoteInteractiveNotEntitled": "您的套餐中的远程时长仅供 Cookie Bot 使用，不能用于手动远程会话。",
+    "remoteRequiresRemoteExitNode": "此配置文件的代理仅在本机可用（例如 127.0.0.1 或局域网地址）。远程会话在我们的主机上运行，因此需要具有公网地址的代理。",
+    "remoteSessionRefused": "远程机器拒绝了此会话。",
+    "remoteSessionNotFound": "该远程会话已不存在。",
+    "remoteSessionConflict": "此配置文件已在别处打开。",
+    "remoteSyncInProgress": "此配置文件仍在上传到云同步。请等待同步完成后重试。",
+    "remoteHoursExhausted": "本月 {{granted}} 小时远程时长已全部用完（已用 {{used}}）。",
+    "notTeamMember": "你不属于任何团队。",
+    "cookieBotNotEntitled": "你的套餐不包含 Cookie Bot。",
+    "cookieBotNotEnrolled": "此配置文件尚未为 Cookie Bot 配置。",
+    "cookieBotScheduleConflict": "{{email}} 已在 {{time}} 养这个配置文件。",
+    "cookieBotRunInProgress": "此配置文件已有一次运行正在进行。",
+    "cookieBotRunNotFound": "该运行记录已不存在。",
+    "cookieBotInvalidSchedule": "该计划无效。请检查运行时间、日期和时长。",
+    "cookieBotInvalidTimezone": "{{timezone}} 不是服务器可识别的时区。",
+    "cookieBotInvalidPeriod": "该周期无效。请使用类似 2026-08 的月份。",
+    "cookieBotSiteLimit": "请输入 {{min}} 到 {{max}} 个网站，每个都要是完整的 http 或 https 地址。",
+    "cookieBotRequiresCloudSync": "请先为此配置文件开启云同步：远程机器没有其他方式获取它。",
+    "cookieBotEncryptedSyncUnsupported": "此配置文件使用端到端加密同步，远程机器无法解密。请改为常规同步。",
+    "cookieBotUnknownPlatform": "此配置文件没有记录操作系统，无法匹配到机器。",
+    "cookieBotUnsupportedPlatform": "Cookie Bot 无法运行 {{platform}} 配置文件。仅支持 Windows 和 macOS 配置文件。",
+    "cookieBotRequiresExitNode": "请先绑定代理或 VPN。否则运行会从数据中心地址发出，损害配置文件的身份。",
+    "cookieBotRequiresRemoteExitNode": "此配置文件的代理仅在本机可用（例如 127.0.0.1 或局域网地址）。Cookie Bot 在我们的主机上运行，因此需要具有公网地址的代理。",
+    "unknownCode": "出现问题: {{code}}",
+    "cookieBotTouchFingerprintUnsupported": "该配置文件声称是触摸设备，机器人无法操作。请使用桌面端指纹。",
+    "profileRunningRemotely": "该配置文件正在远程计算机上运行。请先停止远程会话。",
+    "profileRemoteSyncPending": "远程会话刚刚结束。正在等待其更改下载完成后才能在此打开该配置文件。",
+    "profileLockedByMember": "该配置文件正在被 {{email}} 使用。",
+    "profileLockedElsewhere": "该配置文件正在另一台设备上使用。",
+    "profileLockUnavailable": "无法检查该配置文件是否正在别处使用。请检查网络连接后重试。",
+    "fingerprintExitMismatch": "代理出口节点与此配置文件的指纹不匹配。",
+    "launchConsentExpired": "该确认已失效。请重新启动。",
+    "vpnWorkerStartFailed": "无法启动 VPN 连接：{{detail}}",
+    "exitProbeFailed": "无法连接代理出口节点以检查其位置。",
+    "vlessUnsupported": {
+      "security": "此 VLESS 服务器未使用 REALITY。Donut 仅支持搭配 REALITY 的 VLESS。",
+      "flow": "此 VLESS 服务器未使用 Donut 所需的 XTLS Vision 流控。",
+      "transport": "Donut 仅支持基于普通 TCP 的 VLESS —— 此服务器使用了其他传输方式（如 WebSocket 或 gRPC）。",
+      "encryption": "此 VLESS 服务器使用了 Donut 不支持的加密设置。",
+      "headerType": "此 VLESS 服务器使用了 Donut 不支持的头部混淆。",
+      "fingerprint": "此 VLESS URI 请求了 Donut 不支持的 TLS 指纹。",
+      "sni": "VLESS URI 缺少 REALITY 所需的 SNI（sni）。",
+      "publicKey": "VLESS URI 缺少 REALITY 公钥（pbk）。",
+      "scheme": "这不是 VLESS 链接，必须以 vless:// 开头。",
+      "parameter": "VLESS URI 含有 Donut 不支持的选项。",
+      "malformed": "VLESS URI 无效。"
+    },
+    "camoufoxRemoved": "Camoufox 已不再受支持。请使用 Wayfern 重新创建此配置文件。",
+    "noE2ePasswordSet": "尚未设置端到端加密密码。请先设置后再同步加密数据。"
  },
  "rail": {
    "profiles": "配置文件",
@@ -1870,7 +1933,9 @@
    },
    "network": "网络",
    "integrations": "集成",
-    "account": "账号"
+    "account": "账号",
+    "cookieBot": "Cookie Bot",
+    "cookieBotRunning": "Cookie Bot — 正在运行"
  },
  "pageTitle": {
    "proxies": "网络",
@@ -1881,7 +1946,8 @@
    "integrations": "集成",
    "account": "账户",
    "import": "导入配置文件",
-    "shortcuts": "键盘快捷键"
+    "shortcuts": "键盘快捷键",
+    "cookieBot": "Cookie Bot"
  },
  "encryption": {
    "required": {
@@ -1924,7 +1990,8 @@
    },
    "tabs": {
      "account": "账户",
-      "selfHosted": "自托管"
+      "selfHosted": "自托管",
+      "teamUsage": "团队用量"
    },
    "selfHosted": {
      "title": "自托管同步服务器",
@@ -1937,7 +2004,8 @@
    },
    "deviceOrdinal": "第 {{ordinal}} 台，共 {{count}} 台",
    "automationPrimaryOnly": "浏览器自动化仅在您的主设备（设备 1）上运行。请在该设备上退出登录，才能在此设备上使用。",
-    "automationActiveHere": "浏览器自动化已在此设备上启用。"
+    "automationActiveHere": "浏览器自动化已在此设备上启用。",
+    "viewTeamUsage": "查看团队用量"
  },
  "shortcutsPage": {
    "title": "键盘快捷键",
@@ -1970,7 +2038,8 @@
    "goGroups": "转到分组",
    "goIntegrations": "转到集成",
    "goAccount": "转到账户",
-    "goSettings": "转到设置"
+    "goSettings": "转到设置",
+    "goCookieBot": "Cookie Bot"
  },
  "closeConfirm": {
    "title": "关闭 Donut Browser？",
@@ -2091,16 +2160,354 @@
    "description": "浏览器关闭时清除 Cookie、历史记录和缓存。扩展和书签将被保留。"
  },
  "consistencyWarning": {
-    "title": "指纹不匹配",
-    "intro": "「{{name}}」的代理出口与此配置文件的指纹不匹配:",
-    "timezoneTitle": "时区不匹配",
    "timezoneDetail": "出口节点位于 {{exit}},但指纹报告为 {{fingerprint}}。",
-    "languageTitle": "语言不匹配",
    "languageDetail": "出口国家/地区为 {{country}},但指纹语言为 {{fingerprint}}。",
    "explainer": "时区或语言与出口 IP 不一致是强烈的反机器人信号,即使您的真实设备信息从未泄露。请让指纹与代理位置保持一致,以减少被针对的风险。",
-    "dontWarnAgain": "不再为此配置文件发出警告",
    "matchToProxy": "将指纹匹配到代理",
    "matching": "匹配中…",
    "matchSuccess": "指纹已更新以匹配代理。重新启动配置文件以生效。"
+  },
+  "cookieBot": {
+    "title": "Cookie Bot",
+    "description": "在远程机器上通宵养号。",
+    "tabs": {
+      "overview": "概览",
+      "schedule": "计划",
+      "activity": "活动",
+      "team": "团队"
+    },
+    "locked": {
+      "title": "Cookie Bot",
+      "hint": "Cookie Bot 在远程机器上通宵养号，无需开着你的电脑也能保住 Cookie 和历史记录。需要 Pro 或 Team 套餐。"
+    },
+    "empty": {
+      "title": "尚未加入任何配置文件",
+      "hint": "选一个配置文件，机器人会在远程机器上通宵养号。你的电脑可以关机。",
+      "cta": "加入一个配置文件"
+    },
+    "tonight": {
+      "label": "今晚",
+      "nextRun": "下次运行 {{time}}",
+      "dueCount_one": "{{count}} 个配置文件待运行",
+      "dueCount_other": "{{count}} 个配置文件待运行",
+      "nothingScheduled": "没有安排"
+    },
+    "lastDay": {
+      "label": "最近 24 小时",
+      "none": "还没有运行记录",
+      "ran_one": "{{count}} 次运行",
+      "ran_other": "{{count}} 次运行",
+      "partial_one": "{{count}} 次部分完成",
+      "partial_other": "{{count}} 次部分完成",
+      "failed_one": "{{count}} 次失败",
+      "failed_other": "{{count}} 次失败"
+    },
+    "chart": {
+      "machineTime": "每晚机器时长",
+      "minutes": "{{minutes}} 分钟"
+    },
+    "hours": {
+      "label": "远程时长",
+      "remaining": "{{total}} 小时中还剩 {{remaining}} 小时",
+      "remainingOf": "/ {{total}} 小时",
+      "used": "{{total}} 小时中已用 {{used}} 小时",
+      "resets": "{{date}} 重置",
+      "exhausted": "远程时长已用完。计划仍然保留，将在下个周期恢复。",
+      "exhaustedOn": "远程时长已用完。计划仍然保留，将于 {{date}} 恢复。",
+      "estimate": "每周约 {{hours}} 小时 · 本周期还剩 {{remaining}} 小时",
+      "estimateOverBudget": "每周约需 {{hours}} 小时，但只剩 {{remaining}} 小时",
+      "estimateOnly": "每周约 {{hours}} 小时"
+    },
+    "enrolled": {
+      "columnProfile": "配置文件",
+      "columnCadence": "频率",
+      "columnTime": "时间",
+      "columnNextRun": "下次运行",
+      "columnLastRun": "上次运行",
+      "enrolProfiles": "加入配置文件",
+      "edit": "编辑计划",
+      "neverRun": "从未",
+      "pausedNoHours": "已暂停 — 时长用尽",
+      "profileMissing": "该配置文件不在这台电脑上。"
+    },
+    "schedule": {
+      "empty": "还没有任何安排。",
+      "quietHours_one": "{{count}} 个空闲小时",
+      "quietHours_other": "{{count}} 个空闲小时",
+      "crowded_one": "{{count}} 个配置文件同时开始",
+      "crowded_other": "{{count}} 个配置文件同时开始",
+      "unenrol": "从 Cookie Bot 移除",
+      "unenrolTitle": "将 {{name}} 从 Cookie Bot 移除？",
+      "unenrolDescription": "今晚起停止养号。以往的运行记录仍保留在“活动”中。",
+      "unenrolled": "已从 Cookie Bot 移除"
+    },
+    "status": {
+      "provisioning": "正在准备机器",
+      "ready": "正在加载配置文件",
+      "warming": "养号中",
+      "finished": "正在收尾",
+      "failed": "失败"
+    },
+    "runStatus": {
+      "pending": "排队中",
+      "running": "运行中",
+      "succeeded": "已完成",
+      "partial": "部分完成",
+      "failed": "失败",
+      "skipped": "已跳过",
+      "cancelled": "已停止"
+    },
+    "running": {
+      "label": "正在运行",
+      "more": "另有 {{count}} 个",
+      "stop": "停止运行",
+      "stopped": "运行已停止"
+    },
+    "live": {
+      "idle": "当前没有任务在运行",
+      "streamOffline": "实时更新已离线",
+      "streamOfflineDetail": "实时更新已离线，正在重新连接。下方的运行记录可能不是最新的。",
+      "unnamedSession": "远程会话",
+      "notStartedYet": "机器尚未报告开始时间。",
+      "sitesProgress": "{{total}} 个网站中的 {{visited}} 个",
+      "sitesUnknown": "尚未报告网站信息",
+      "consentHandled_one": "已处理 {{count}} 个同意提示",
+      "consentHandled_other": "已处理 {{count}} 个同意提示",
+      "consentUnknown": "尚未报告同意提示",
+      "billed": "已计费 {{duration}}",
+      "billedUnknown": "尚未报告计费时长",
+      "chunk": "第 {{index}} 段，共 {{total}} 段"
+    },
+    "history": {
+      "title": "运行记录",
+      "allProfiles": "所有配置文件",
+      "searchPlaceholder": "搜索配置文件…",
+      "filterAll": "全部运行",
+      "filterComplete": "已完成",
+      "filterPartial": "部分完成",
+      "filterFailed": "失败",
+      "columnStarted": "开始",
+      "columnProfile": "配置文件",
+      "columnDuration": "时长",
+      "columnSites": "网站",
+      "columnStatus": "状态",
+      "columnOperator": "操作者",
+      "empty": "还没有运行记录。",
+      "noMatch": "没有符合此筛选条件的运行。",
+      "unknownProfile": "未知配置文件",
+      "outcome": "原因：{{reason}}",
+      "sitesVisited": "{{visited}}/{{total}}",
+      "sitesFailed_one": "{{count}} 个网站无法访问",
+      "sitesFailed_other": "{{count}} 个网站无法访问",
+      "consentHandled_one": "已处理 {{count}} 个同意提示",
+      "consentHandled_other": "已处理 {{count}} 个同意提示",
+      "sitesUnknown": "暂无数据"
+    },
+    "duration": {
+      "hm": "{{hours}} 小时 {{minutes}} 分",
+      "ms": "{{minutes}} 分 {{seconds}} 秒",
+      "s": "{{seconds}} 秒"
+    },
+    "picker": {
+      "title": "加入配置文件",
+      "description": "选择机器人应在夜间养号的配置文件。",
+      "searchPlaceholder": "搜索配置文件…",
+      "noProfiles": "没有匹配的配置文件。",
+      "alreadyEnrolled": "已加入",
+      "continue_one": "继续（{{count}} 个）",
+      "continue_other": "继续（{{count}} 个）"
+    },
+    "enrol": {
+      "titleOne": "加入 {{name}}",
+      "titleCount_one": "加入 {{count}} 个配置文件",
+      "titleCount_other": "加入 {{count}} 个配置文件",
+      "editTitle": "编辑计划",
+      "description": "机器人会在远程机器上打开配置文件，浏览你列出的网站。你的电脑可以关机。",
+      "summaryNightly": "每晚 {{time}} 运行，每次最多 {{minutes}} 分钟。",
+      "summaryWeeknights": "周一至周五 {{time}} 运行，每次最多 {{minutes}} 分钟。",
+      "summaryAlternate": "隔晚 {{time}} 运行，每次最多 {{minutes}} 分钟。",
+      "summaryCustom_one": "每周 {{count}} 晚，于 {{time}} 运行，每次最多 {{minutes}} 分钟。",
+      "summaryCustom_other": "每周 {{count}} 晚，于 {{time}} 运行，每次最多 {{minutes}} 分钟。",
+      "confirm": "今晚起加入",
+      "confirmSome": "今晚加入 {{total}} 个中的 {{eligible}} 个",
+      "fixFirst": "请先解决这些问题",
+      "saving": "正在加入…",
+      "saved": "计划已保存",
+      "enrolled_one": "已加入 {{count}} 个配置文件",
+      "enrolled_other": "已加入 {{count}} 个配置文件",
+      "adjust": "调整计划",
+      "cadenceLabel": "频率",
+      "cadenceNightly": "每晚",
+      "cadenceWeeknights": "工作日夜间",
+      "cadenceAlternate": "隔晚一次",
+      "cadenceCustom_one": "每周 {{count}} 晚",
+      "cadenceCustom_other": "每周 {{count}} 晚",
+      "timeLabel": "开始时间",
+      "timeHint": "按各配置文件指纹所在时区计算。",
+      "maxMinutesLabel": "最长分钟数",
+      "intensityLabel": "深度",
+      "sitesLabel": "网站",
+      "sitesPlaceholder": "每行一个网址",
+      "sitesHint_one": "{{count}} 个网站。只会访问你在这里列出的页面。",
+      "sitesHint_other": "{{count}} 个网站。只会访问你在这里列出的页面。",
+      "sitesTooMany": "最多 {{max}} 个网站。",
+      "presetsUnavailable": "无法加载深度预设。请稍后再试。",
+      "confirmBulkTitle_one": "将 {{count}} 个配置文件加入 Cookie Bot？",
+      "confirmBulkTitle_other": "将 {{count}} 个配置文件加入 Cookie Bot？",
+      "confirmBulkDescription_one": "这会占用共享远程时长预订一次夜间运行。时间和网站将在下一步选择。",
+      "confirmBulkDescription_other": "这会占用共享远程时长预订 {{count}} 次夜间运行。时间和网站将在下一步选择。",
+      "confirmBulkButton_one": "继续（{{count}} 个配置文件）",
+      "confirmBulkButton_other": "继续（{{count}} 个配置文件）",
+      "sitesRequired": "请至少添加一个网站。",
+      "addSitesFirst": "请先添加网站",
+      "presetsMissing": "深度预设不可用",
+      "sourceOwn": "我的列表",
+      "sourceCurated": "精选",
+      "sourceSaved": "已保存",
+      "curatedEmpty": "目前没有可用的精选列表。",
+      "curatedNote": "由我们持续维护的精选列表。每个配置文件都会从中抽取各自的样本，因此不会有两个配置文件浏览同一组网站——这正是让列表本身不会变成特征的原因。地址只保留在我们这边。",
+      "savedEmpty": "还没有保存任何内容。请在“我的列表”中输入列表，然后从那里保存。",
+      "savedNote": "保存计划时会把网站复制到计划中，因此以后编辑列表不会影响已有的计划。",
+      "savedUnavailable": "无法加载你保存的列表。",
+      "saveAsList": "保存为列表",
+      "listNamePlaceholder": "为该列表命名",
+      "listSaved": "已保存列表",
+      "listRenamed": "已重命名列表",
+      "listDeleted": "已删除列表",
+      "listRename": "重命名",
+      "listDeleteConfirm": "删除？",
+      "templateMissing": "该保存的列表已不存在。请另选一个。",
+      "templateNameTaken": "你已经有同名的列表。",
+      "templateNameInvalid": "列表名称不超过 {{max}} 个字符。",
+      "calendarLabel": "运行时间",
+      "daysLabel": "星期",
+      "addSlot": "添加时间",
+      "slotsFull": "最多 {{max}} 个开始时间。",
+      "removeSlot": "移除此时间",
+      "pickListFirst": "请先选择列表",
+      "finishCalendarFirst": "请先完成计划",
+      "duplicateSlot": "有两行的星期和时间相同",
+      "listSites_one": "{{count}} 个网站",
+      "listSites_other": "{{count}} 个网站",
+      "summarySlots_one": "每周运行 {{count}} 次，每次最多 {{minutes}} 分钟。",
+      "summarySlots_other": "每周运行 {{count}} 次，每次最多 {{minutes}} 分钟。",
+      "templateNameInvalidNoMax": "该名称不能用于已保存的列表。"
+    },
+    "preset": {
+      "light": "轻度",
+      "balanced": "标准",
+      "deep": "深度"
+    },
+    "template": {
+      "lowIntentPurchaser": "低购买意向买家",
+      "lowIntentPurchaserHint": "把配置文件定位为对价格敏感的买家：比价、优惠券、返现和二手转卖网站，并通过聚合站点而非直接访问零售商。"
+    },
+    "preflight": {
+      "ineligible_one": "{{count}} 个配置文件无法远程运行",
+      "ineligible_other": "{{count}} 个配置文件无法远程运行",
+      "reasonSync": "同步已关闭",
+      "reasonEncrypted": "端到端加密",
+      "reasonNoFingerprint": "没有记录操作系统",
+      "reasonCrossOs": "为 {{os}} 创建 — 没有匹配的远程机器",
+      "reasonNoExitNode": "没有代理或 VPN",
+      "fixSync": "开启同步",
+      "fixEncrypted": "打开同步设置",
+      "fixProxy": "绑定代理",
+      "fixFailed": "无法应用该修复。",
+      "exitNodeHint": "没有代理或 VPN 时，流量会从机器集群自己的数据中心地址发出。来自托管网络的长时间流量对配置文件身份的损害，比完全不养号还要大。"
+    },
+    "conflict": {
+      "title": "{{email}} 已在 {{time}} 养这个配置文件",
+      "detail": "同一个配置文件上有两份计划会重复消耗时长，并可能在运行中冲突。",
+      "keepTheirs": "使用对方的计划",
+      "replace": "用我的替换",
+      "replaceForbidden": "只有团队所有者或管理员才能更改他人的计划。",
+      "askThem": "复制 {{email}}",
+      "emailCopied": "已复制邮箱",
+      "copyFailed": "无法复制该地址。"
+    },
+    "actionBar": {
+      "enrol": "加入 Cookie Bot",
+      "proRequired": "Cookie Bot 需要 Pro 或 Team 套餐",
+      "noneEligible": "所选配置文件都无法远程养号"
+    },
+    "actions": {
+      "enrol": "加入 Cookie Bot",
+      "editSchedule": "编辑计划",
+      "runNow": "立即运行",
+      "runStarted": "已开始运行",
+      "viewActivity": "查看活动",
+      "runNotStarted": "运行未开始：{{reason}}"
+    },
+    "state": {
+      "enrolled": "已加入",
+      "notEnrolled": "未加入",
+      "paused": "已暂停",
+      "summary": "{{cadence}} {{time}}",
+      "rowMenu": "{{name}} 的 Cookie Bot 选项",
+      "blocked": "无法运行：{{reason}}"
+    },
+    "team": {
+      "title": "团队用量",
+      "pooled_one": "{{total}} 小时中已用 {{used}} 小时，{{count}} 个席位",
+      "pooled_other": "{{total}} 小时中已用 {{used}} 小时，由 {{count}} 个席位共享",
+      "hours": "{{hours}} 小时",
+      "legendBot": "Cookie Bot",
+      "legendInteractive": "手动使用",
+      "columnMember": "成员",
+      "columnRuns": "运行次数",
+      "columnHours": "时长",
+      "columnShare": "占比",
+      "noActivity": "此期间没有远程会话。",
+      "soloNote": "目前只显示你自己的用量。邀请队友后可按成员查看时长分配。",
+      "runsFailed": "· {{n}} 次失败"
+    },
+    "closeReason": {
+      "stoppedByUser": "已手动停止",
+      "maxDuration": "已达时间上限",
+      "other": "已结束：{{reason}}"
+    },
+    "outcome": {
+      "notEntitled": "当前套餐不包含此功能",
+      "syncDisabled": "该配置文件已关闭云同步",
+      "encryptedSync": "不支持端到端加密同步",
+      "proxyRequired": "未绑定代理或 VPN",
+      "touchFingerprint": "不支持触摸设备指纹",
+      "platformUnsupported": "没有机器可运行该配置文件的系统",
+      "noSites": "没有要访问的网站",
+      "quotaExhausted": "远程时长已用完",
+      "profileLocked": "该配置文件已在别处打开",
+      "noCapacity": "没有空闲机器",
+      "managerError": "机器集群未能启动浏览器",
+      "budgetExceeded": "当晚的时长预算已用完",
+      "cancelledByUser": "已手动停止",
+      "unknown": "未知原因（{{code}}）"
+    }
+  },
+  "prelaunchGate": {
+    "titleBlocked": "启动已阻止",
+    "titleWarning": "启动前请注意",
+    "intro": "启动浏览器前，请检查“{{name}}”的以下问题。",
+    "fingerprintHeading": "代理出口与指纹不匹配",
+    "vpnExtensionHeading": "检测到 VPN 扩展",
+    "vpnExtensionIntro": "此配置文件中可能改变浏览器流量路径的扩展：",
+    "vpnExtensionConfirmed": "可以更改代理",
+    "vpnExtensionLikely": "可能会更改代理",
+    "vpnExtensionExplainer": "如果其中之一将流量转发到别处，浏览器的真实位置将不再与创建此配置文件时使用的时区、语言和地理位置一致，而 Donut 无法从外部察觉。",
+    "sourceDonut": "由 Donut 管理",
+    "sourceBrowser": "已安装在配置文件中",
+    "measurementUnreliable": "由于 VPN 扩展可以覆盖代理设置，出口检测结果可能并非浏览器实际使用的线路。",
+    "scanIncompleteEncrypted": "此配置文件已加密，因此只能检查由 Donut 管理的扩展。",
+    "scanIncompleteEphemeral": "此配置文件尚无数据，因此只能检查由 Donut 管理的扩展。",
+    "scanIncompletePartial": "扩展扫描被中断，可能有部分扩展未列出。",
+    "probePending": "尚未测量代理出口。Donut 会在启动过程中检查，如不匹配则停止。",
+    "launchAnyway": "仍要启动",
+    "dontBlockAgain": "不再因这一完全相同的不匹配而阻止",
+    "dontWarnExtensions": "不再就这些扩展发出警告",
+    "applyToRemaining": "将此选择应用于其余配置文件",
+    "cancelledSummary": "已取消 {{total}} 次启动中的 {{cancelled}} 次",
+    "cancelled": "已取消启动",
+    "vpnExtensionEntry": " {{version}} — {{capability}}、{{source}}",
+    "scanIncompleteMissing": "此配置文件尚未启动过，因此只能检查由 Donut 管理的扩展。"
  }
 }
@@ -67,6 +67,61 @@ export type BackendErrorCode =
  | "XRAY_UNAVAILABLE"
  | "XRAY_UNSUPPORTED_OS"
  | "XRAY_START_FAILED"
+  | "CLOUD_NOT_SIGNED_IN"
+  | "CLOUD_UNREACHABLE"
+  | "CLOUD_REQUEST_FAILED"
+  | "REMOTE_RATE_LIMITED"
+  | "REMOTE_NO_CAPACITY"
+  | "REMOTE_NOT_ENTITLED"
+  | "REMOTE_INTERACTIVE_NOT_ENTITLED"
+  // The profile's exit only resolves on this computer, so a leased host cannot
+  // use it. Its own code rather than the Cookie Bot's twin: the two refusals
+  // name different features, and a user told their "Cookie Bot" needs a public
+  // proxy while they were opening a browser by hand cannot act on that.
+  | "REMOTE_REQUIRES_REMOTE_EXIT_NODE"
+  | "REMOTE_SESSION_REFUSED"
+  | "REMOTE_SESSION_NOT_FOUND"
+  | "REMOTE_SESSION_CONFLICT"
+  | "REMOTE_SYNC_IN_PROGRESS"
+  | "REMOTE_HOURS_EXHAUSTED"
+  | "PROFILE_RUNNING_REMOTELY"
+  | "PROFILE_REMOTE_SYNC_PENDING"
+  | "PROFILE_LOCKED_BY_MEMBER"
+  | "PROFILE_LOCKED_ELSEWHERE"
+  | "PROFILE_LOCK_UNAVAILABLE"
+  | "NOT_TEAM_MEMBER"
+  | "COOKIE_BOT_NOT_ENTITLED"
+  | "COOKIE_BOT_NOT_ENROLLED"
+  | "COOKIE_BOT_SCHEDULE_CONFLICT"
+  | "COOKIE_BOT_RUN_IN_PROGRESS"
+  | "COOKIE_BOT_RUN_NOT_FOUND"
+  | "COOKIE_BOT_INVALID_SCHEDULE"
+  | "COOKIE_BOT_INVALID_TIMEZONE"
+  | "COOKIE_BOT_INVALID_PERIOD"
+  | "COOKIE_BOT_SITE_LIMIT"
+  | "COOKIE_BOT_REQUIRES_CLOUD_SYNC"
+  | "COOKIE_BOT_ENCRYPTED_SYNC_UNSUPPORTED"
+  | "COOKIE_BOT_UNKNOWN_PLATFORM"
+  | "COOKIE_BOT_UNSUPPORTED_PLATFORM"
+  | "COOKIE_BOT_REQUIRES_EXIT_NODE"
+  // The profile HAS an exit, but only this machine can reach it (127.0.0.1, a
+  // LAN address, a `.local` name). Its own code because the fix is different:
+  // "attach a proxy" is unactionable advice for someone whose proxy is plainly
+  // attached.
+  | "COOKIE_BOT_REQUIRES_REMOTE_EXIT_NODE"
+  // The server's own names for two refusals it throws from `putSchedule`,
+  // `updateProfileState` and `runNow`. `COOKIE_BOT_REQUIRES_PROXY` is the
+  // server-side twin of the local `COOKIE_BOT_REQUIRES_EXIT_NODE` precondition;
+  // without a case here the single most important refusal in the feature
+  // rendered as the raw machine identifier.
+  | "COOKIE_BOT_REQUIRES_PROXY"
+  | "COOKIE_BOT_TOUCH_FINGERPRINT_UNSUPPORTED"
+  | "FINGERPRINT_EXIT_MISMATCH"
+  | "LAUNCH_CONSENT_EXPIRED"
+  | "VPN_WORKER_START_FAILED"
+  | "EXIT_PROBE_FAILED"
+  | "CAMOUFOX_REMOVED"
+  | "NO_E2E_PASSWORD_SET"
  | "INTERNAL_ERROR";

 export interface BackendError {
@@ -246,8 +301,29 @@ export function translateBackendError(t: TFunction, err: unknown): string {
      return t("backendErrors.mcpAgentRemoveFailed", {
        detail: parsed.params?.detail ?? "",
      });
-    case "VLESS_CONFIG_INVALID":
+    // Donut supports exactly one VLESS shape (REALITY + XTLS Vision over TCP),
+    // so most rejections mean "your server is a kind we do not support", not
+    // "you mistyped". Name the unsupported part instead of implying a typo.
+    case "VLESS_CONFIG_INVALID": {
+      const reason = parsed.params?.reason;
+      const known = [
+        "security",
+        "flow",
+        "transport",
+        "encryption",
+        "headerType",
+        "fingerprint",
+        "sni",
+        "publicKey",
+        "scheme",
+        "parameter",
+        "malformed",
+      ];
+      if (reason && known.includes(reason)) {
+        return t(`backendErrors.vlessUnsupported.${reason}`);
+      }
      return t("backendErrors.vlessConfigInvalid");
+    }
    case "XRAY_UNAVAILABLE":
      return t("backendErrors.xrayUnavailable");
    case "XRAY_UNSUPPORTED_OS":
@@ -256,12 +332,129 @@ export function translateBackendError(t: TFunction, err: unknown): string {
      return t("backendErrors.xrayStartFailed");
    case "CLEAR_ON_CLOSE_UNAVAILABLE":
      return t("backendErrors.clearOnCloseUnavailable");
+    case "CLOUD_NOT_SIGNED_IN":
+      return t("backendErrors.cloudNotSignedIn");
+    case "CLOUD_UNREACHABLE":
+      return t("backendErrors.cloudUnreachable");
+    case "CLOUD_REQUEST_FAILED":
+      return t("backendErrors.cloudRequestFailed");
+    case "REMOTE_RATE_LIMITED":
+      return t("backendErrors.remoteRateLimited");
+    case "REMOTE_NO_CAPACITY":
+      return t("backendErrors.remoteNoCapacity");
+    case "REMOTE_NOT_ENTITLED":
+      return t("backendErrors.remoteNotEntitled");
+    // Distinct from the above: the plan HAS remote hours, it just may not spend
+    // them by hand (solo funds a nightly Cookie Bot only). Telling such a user
+    // "your plan does not include remote execution" while their bot visibly
+    // runs every night is the confusing case this code exists to avoid.
+    case "REMOTE_INTERACTIVE_NOT_ENTITLED":
+      return t("backendErrors.remoteInteractiveNotEntitled");
+    case "REMOTE_REQUIRES_REMOTE_EXIT_NODE":
+      return t("backendErrors.remoteRequiresRemoteExitNode");
+    case "REMOTE_SESSION_REFUSED":
+      return t("backendErrors.remoteSessionRefused");
+    case "REMOTE_SESSION_NOT_FOUND":
+      return t("backendErrors.remoteSessionNotFound");
+    case "REMOTE_SESSION_CONFLICT":
+      return t("backendErrors.remoteSessionConflict");
+    case "REMOTE_SYNC_IN_PROGRESS":
+      return t("backendErrors.remoteSyncInProgress");
+    case "REMOTE_HOURS_EXHAUSTED":
+      return t("backendErrors.remoteHoursExhausted", {
+        granted: parsed.params?.granted ?? "0",
+        used: parsed.params?.used ?? "0",
+      });
+    case "PROFILE_RUNNING_REMOTELY":
+      return t("backendErrors.profileRunningRemotely");
+    case "PROFILE_REMOTE_SYNC_PENDING":
+      return t("backendErrors.profileRemoteSyncPending");
+    case "PROFILE_LOCKED_BY_MEMBER":
+      return t("backendErrors.profileLockedByMember", {
+        email: parsed.params?.email ?? "",
+      });
+    case "PROFILE_LOCKED_ELSEWHERE":
+      return t("backendErrors.profileLockedElsewhere");
+    case "PROFILE_LOCK_UNAVAILABLE":
+      return t("backendErrors.profileLockUnavailable");
+    case "NOT_TEAM_MEMBER":
+      return t("backendErrors.notTeamMember");
+    case "COOKIE_BOT_NOT_ENTITLED":
+      return t("backendErrors.cookieBotNotEntitled");
+    case "COOKIE_BOT_NOT_ENROLLED":
+      return t("backendErrors.cookieBotNotEnrolled");
+    case "COOKIE_BOT_SCHEDULE_CONFLICT":
+      return t("backendErrors.cookieBotScheduleConflict", {
+        email: parsed.params?.email ?? "",
+        time: parsed.params?.time ?? "",
+      });
+    case "COOKIE_BOT_RUN_IN_PROGRESS":
+      return t("backendErrors.cookieBotRunInProgress");
+    case "COOKIE_BOT_RUN_NOT_FOUND":
+      return t("backendErrors.cookieBotRunNotFound");
+    case "COOKIE_BOT_INVALID_SCHEDULE":
+      return t("backendErrors.cookieBotInvalidSchedule");
+    case "COOKIE_BOT_INVALID_TIMEZONE":
+      return t("backendErrors.cookieBotInvalidTimezone", {
+        timezone: parsed.params?.timezone ?? "",
+      });
+    case "COOKIE_BOT_INVALID_PERIOD":
+      return t("backendErrors.cookieBotInvalidPeriod");
+    case "COOKIE_BOT_SITE_LIMIT":
+      // The server sends both bounds. Defaulting `min` to 1 was not the
+      // problem — the message never mentioned a minimum at all, so a user who
+      // submitted no sites was told about a maximum they had not reached.
+      return t("backendErrors.cookieBotSiteLimit", {
+        min: parsed.params?.min ?? "1",
+        max: parsed.params?.max ?? "40",
+      });
+    case "COOKIE_BOT_REQUIRES_CLOUD_SYNC":
+      return t("backendErrors.cookieBotRequiresCloudSync");
+    case "COOKIE_BOT_ENCRYPTED_SYNC_UNSUPPORTED":
+      return t("backendErrors.cookieBotEncryptedSyncUnsupported");
+    case "COOKIE_BOT_UNKNOWN_PLATFORM":
+      return t("backendErrors.cookieBotUnknownPlatform");
+    case "COOKIE_BOT_UNSUPPORTED_PLATFORM":
+      return t("backendErrors.cookieBotUnsupportedPlatform", {
+        platform: parsed.params?.platform ?? "",
+      });
+    case "COOKIE_BOT_REQUIRES_EXIT_NODE":
+    // One condition, two names: the desktop refuses it locally as
+    // REQUIRES_EXIT_NODE and the server refuses it as REQUIRES_PROXY. Both
+    // resolve to the one sentence a user can act on.
+    case "COOKIE_BOT_REQUIRES_PROXY":
+      return t("backendErrors.cookieBotRequiresExitNode");
+    case "COOKIE_BOT_REQUIRES_REMOTE_EXIT_NODE":
+      return t("backendErrors.cookieBotRequiresRemoteExitNode");
+    case "COOKIE_BOT_TOUCH_FINGERPRINT_UNSUPPORTED":
+      return t("backendErrors.cookieBotTouchFingerprintUnsupported");
+    // The launch gate's block. The dialog renders the mismatch detail from
+    // `params` itself; this string is the fallback for anywhere that only has
+    // room for one sentence.
+    case "FINGERPRINT_EXIT_MISMATCH":
+      return t("backendErrors.fingerprintExitMismatch");
+    case "LAUNCH_CONSENT_EXPIRED":
+      return t("backendErrors.launchConsentExpired");
+    case "VPN_WORKER_START_FAILED":
+      return t("backendErrors.vpnWorkerStartFailed", {
+        detail: parsed.params?.detail ?? "",
+      });
+    case "EXIT_PROBE_FAILED":
+      return t("backendErrors.exitProbeFailed");
+    case "CAMOUFOX_REMOVED":
+      return t("backendErrors.camoufoxRemoved");
+    case "NO_E2E_PASSWORD_SET":
+      return t("backendErrors.noE2ePasswordSet");
    case "INTERNAL_ERROR":
      return t("backendErrors.internal", {
        detail: parsed.params?.detail ?? "",
      });
    default:
-      return err instanceof Error ? err.message : String(err);
+      // The payload parsed as a structured error but carries a code this build
+      // does not know: the server can add codes faster than the desktop ships.
+      // Returning the raw message here would render the literal JSON to the
+      // user, so show a translated line that still names the code for support.
+      return t("backendErrors.unknownCode", { code: String(parsed.code) });
  }
 }

@@ -0,0 +1,65 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { SCHEDULE_BOUNDS } from "./cookie-bot-limits.ts";
+
+/**
+ * The enrolment form validates against bounds that belong to the server. This
+ * file is the tripwire for that mirror.
+ *
+ * The platform list (`BOT_PLATFORMS`) and the preflight refusals are both
+ * pinned — one by a cross-referenced comment in `cookie_bot.rs`, the other by
+ * tests beside it. These four numbers were not pinned by anything, so infra
+ * could widen `max_minutes` to 180 and the desktop would go on refusing 150
+ * with no field-level explanation, or cap sites at 25 and let a user fill a
+ * form the PUT answers with `COOKIE_BOT_INVALID_SCHEDULE`.
+ */
+
+test("the mirrored bounds are exactly what the server enforces", () => {
+  // Read off `validateScheduleBody` / `normaliseSites` and the constants in
+  // donutbrowser-infra's apps/backend/src/cookie-bot/cookie-bot-schedule.ts.
+  // Changing a number here without changing it there is the bug.
+  assert.deepEqual(
+    { ...SCHEDULE_BOUNDS },
+    { minMaxMinutes: 5, maxMaxMinutes: 120, minSites: 1, maxSites: 40 },
+  );
+});
+
+test("the bounds describe a range a user can actually satisfy", () => {
+  assert.ok(
+    SCHEDULE_BOUNDS.minMaxMinutes < SCHEDULE_BOUNDS.maxMaxMinutes,
+    "an empty minute range would disable every enrolment",
+  );
+  assert.ok(
+    SCHEDULE_BOUNDS.minSites >= 1,
+    "the bot browses declared sites only, so at least one is required",
+  );
+  assert.ok(SCHEDULE_BOUNDS.minSites <= SCHEDULE_BOUNDS.maxSites);
+});
+
+test("the enrolment form takes its bounds from here, not from its own literals", () => {
+  const source = readFileSync(
+    fileURLToPath(
+      new URL("../components/cookie-bot-enrol-dialog.tsx", import.meta.url),
+    ),
+    "utf8",
+  );
+  assert.match(
+    source,
+    /from "@\/lib\/cookie-bot-limits"/,
+    "the dialog must import the shared bounds",
+  );
+  for (const name of [
+    "MIN_MAX_MINUTES",
+    "MAX_MAX_MINUTES",
+    "MIN_SITES",
+    "MAX_SITES",
+  ]) {
+    assert.doesNotMatch(
+      source,
+      new RegExp(`const ${name}\\s*=\\s*\\d`),
+      `${name} must be derived from SCHEDULE_BOUNDS, not re-declared as a literal`,
+    );
+  }
+});
@@ -0,0 +1,32 @@
+/**
+ * The server's schedule bounds, mirrored for form validation.
+ *
+ * These numbers are NOT the client's to choose. They belong to
+ * `validateScheduleBody` and `normaliseSites` in donutbrowser-infra's
+ * `apps/backend/src/cookie-bot/cookie-bot.service.ts`, which refuses anything
+ * outside them with `COOKIE_BOT_INVALID_SCHEDULE` or `COOKIE_BOT_SITE_LIMIT`.
+ * They are mirrored here only so the enrolment form can refuse a value before
+ * it costs a round trip, and so the reason lands on the field rather than in a
+ * toast that names no field at all.
+ *
+ * Kept in a module of their own, with no imports, so `cookie-bot-limits.test.mjs`
+ * can pin them. A bound widened server-side (`max_minutes` to 180, sites capped
+ * at 25) then shows up as a failing assertion instead of as a form that blocks
+ * a legal value or accepts an illegal one.
+ *
+ * @see cookie-bot-limits.test.mjs — the tripwire.
+ */
+export const SCHEDULE_BOUNDS = {
+  /** `MIN_MAX_MINUTES` in cookie-bot-schedule.ts. */
+  minMaxMinutes: 5,
+  /** `MAX_MAX_MINUTES` in cookie-bot-schedule.ts. */
+  maxMaxMinutes: 120,
+  /**
+   * v1 browses the user's declared sites and nothing else, so an enrolment
+   * with none is one the server cannot act on. `normaliseSites` rejects an
+   * empty list.
+   */
+  minSites: 1,
+  /** `MAX_SITES` in cookie-bot-schedule.ts. */
+  maxSites: 40,
+} as const;
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
zhom	3b1feb3f1b	chore: version bump	2026-08-08 16:35:46 +04:00
github-actions[bot]GitHubgithub-actions[bot] <github-actions[bot]@users.noreply.github.com>	bc2b93d902	docs: update CHANGELOG.md and README.md for v0.29.0 [skip ci] (#539 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-08-08 12:26:50 +00:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	5c24e84eaf	ci(deps): bump the github-actions group with 3 updates (#538 ) Bumps the github-actions group with 3 updates: [pnpm/action-setup](https://github.com/pnpm/action-setup), [anomalyco/opencode/github](https://github.com/anomalyco/opencode) and [crate-ci/typos](https://github.com/crate-ci/typos). Updates `pnpm/action-setup` from 6.0.9 to 6.0.10 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](https://github.com/pnpm/action-setup/compare/0ebf47130e4866e96fce0953f49152a61190b271...0977fd99725f1db4007ccb2928dbb4e90d06cc86) Updates `anomalyco/opencode/github` from 1.18.9 to 1.18.14 - [Release notes](https://github.com/anomalyco/opencode/releases) - [Commits](https://github.com/anomalyco/opencode/compare/4da7bb44c84e013fa53e9c5d02ac753d1435c81a...65cf14df16c191f3e9684f0d9a8bae69103ced6d) Updates `crate-ci/typos` from 1.48.0 to 1.49.0 - [Release notes](https://github.com/crate-ci/typos/releases) - [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md) - [Commits](https://github.com/crate-ci/typos/compare/bee27e3a4fd1ea2111cf90ab89cd076c870fce14...8a48f81b6c64dcfea44b3633223084c4be58ac5f) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: anomalyco/opencode/github dependency-version: 1.18.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: crate-ci/typos dependency-version: 1.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-08 09:08:52 +00:00
zhom	ffbbaa732a	chore: linting	2026-08-07 06:16:00 -07:00
zhom	f12a84e18f	refactor: cleanup	2026-08-06 14:39:53 -07:00
zhom	39bbdcb547	feat: prevent launch with inconsistent geodata	2026-08-05 21:39:10 -07:00
zhom	29cb83d063	refactor: cleanup	2026-08-03 18:44:24 +04:00
zhom	7d82a25107	feat: cookie bot	2026-08-03 07:57:45 +04:00
zhom	04b9617631	chore: linting	2026-08-02 10:03:45 +04:00