From 4143b62606268ca611c5c2999cce11beaca9ceb5 Mon Sep 17 00:00:00 2001
From: nicolasestrem <103498114+nicolasestrem@users.noreply.github.com>
Date: Sun, 9 Aug 2026 21:25:40 +0200
Subject: [PATCH 1/4] docs: exclude publish-* dirs, document WPF Timeline shell
 and crash fixes

---
 .gitignore   |  2 ++
 CHANGELOG.md | 47 +++++++++++++++++++++++++++++++++++++++++------
 2 files changed, 43 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index 50124dc..a51007f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,8 @@ src/packages/
 
 # Release artifact directory used by the /release skill (a ~69 MB self-contained exe).
 publish/
+# WPF and UI test publish directories (self-contained executables, ~70 MB each).
+publish-*/
 
 # dotnet test output: .trx logs, and the crash/hang dumps --blame-hang writes, which run to
 # hundreds of megabytes each.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cb351f9..93e2b42 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,47 @@ version numbers, because that is what those releases were called.
 
 ## [Unreleased]
 
+### Added — WPF Timeline + Compare shell (side-by-side with WinForms)
+
+A new WPF application (`WinRestoreKit.Wpf`) ships alongside the existing WinForms app, implementing the
+approved Timeline + Comparison Workspace design direction. It does not replace WinForms yet; both run
+from the same solution and share the same Core engine and Application layer.
+
+**Timeline is the home experience.** Every snapshot and failed attempt on this PC appears as a card on a
+point-in-time rail, newest first. Selecting a verified snapshot opens comparison; failed and unreadable
+entries open their diagnostic reason. Arrow keys navigate the list and every custom visual exposes UI
+Automation names, roles, and states.
+
+**Compare shows evidence before restore.** Selecting a snapshot compares each module against the current
+PC and reports honest state: captured, not captured, or changed. You build a restore set by selecting
+whole modules, then move to a Confirm stage that reviews impact, warnings, and application-close
+consent before any restore starts.
+
+**Backup, Progress, and Results are migrated.** The backup workspace offers scope presets, destination,
+compression, and validation. Progress shows stage, percent, throughput, byte counts, errors, warnings,
+and a live log. Results present a severity summary with per-module outcomes.
+
+**Visual system.** Neutral Windows surfaces, one mineral-blue action colour, one restrained coral
+warning, Light/Dark/Follow-system themes, Segoe UI Variable typography, IBM Plex Mono for technical
+identifiers, 6–10 px corner radii, flat panes, and visible keyboard focus throughout. Raw icon-enum
+text (e.g. `ErrorCircle`) was eliminated at its source: status glyphs are vector paths keyed by tone,
+never text.
+
+**Application layer extraction.** Orchestration, backup presets, scope groups, run UI, snapshot
+services, and update/theme services moved from the WinForms project into a new
+`WinRestoreKit.Application` library shared by both shells. Core remains unchanged in its isolation
+guarantee: no WinForms or WPF dependency can compile against it.
+
+### Fixed — WPF crashes on snapshot creation and About navigation
+
+Two read-only property bindings in the redesigned WPF views caused `InvalidOperationException` crashes:
+
+- **About page** bound `Run.Text` to the read-only `CurrentVersion` property (TwoWay by default).
+- **Progress view** bound `ProgressBar.Value` to the read-only `Percent` property (TwoWay by default).
+
+Both are fixed with `Mode=OneWay`. Regression tests render each view through the layout dispatcher to
+prove the crash path no longer fires.
+
 ### Design
 
 - Started a three-direction visual identity and WinUI 3 Home-screen exploration around the
@@ -17,12 +58,6 @@ version numbers, because that is what those releases were called.
   calmer spacing. Logo exploration remains unselected and no runtime or backup-format behavior has
   changed.
 
-### Changed
-
-- Rebuilt the app shell and all primary views with the Industry design system: bundled Barlow, Barlow Condensed, and IBM Plex Mono typography; Voltage, Flux, and Follow system palettes; blueprint frames; icon rail navigation; and a dedicated progress view.
-- Added snapshot display names, selectable destination folders, Fast and Max archive compression, archive-backed restore discovery, live registry drift detection, rich backup progress metrics, and safe pause or cancel controls.
-- Reworked backup, restore, History, Home, and About around real manifest and module data. Existing backup folders and frozen manifest keys remain compatible.
-
 ## [0.0.1] - 2026-08-02
 ### Changed
 

From 34a9bab938400065c389a786bda053092e322813 Mon Sep 17 00:00:00 2001
From: nicolasestrem <103498114+nicolasestrem@users.noreply.github.com>
Date: Sun, 9 Aug 2026 21:26:16 +0200
Subject: [PATCH 2/4] feat: WPF Timeline + Compare shell, Application layer
 extraction, crash fixes

Add a new WPF application (WinRestoreKit.Wpf) implementing the approved
Timeline + Comparison Workspace design, running side-by-side with the
existing WinForms shell. Both share the same Core engine and a new
WinRestoreKit.Application library.

Architecture:
- WinRestoreKit.Application: orchestration, backup presets, scope groups,
  snapshot event catalog, comparison service, update/theme services extracted
  from the WinForms project and shared by both shells
- WinRestoreKit.Wpf: Timeline home, Compare/Confirm restore workflow, Backup
  workspace with presets, Progress with live metrics, Results, Advanced
  History, Settings, About, App Restore dialog
- WinRestoreKit.Core: unchanged isolation guarantee (no UI dependency)
- WinRestoreKit (WinForms): updated to reference Application layer

Visual system:
- Neutral Windows surfaces, mineral-blue actions, restrained coral warnings
- Light/Dark/Follow-system themes with shared token set (~35 colours each)
- Segoe UI Variable + IBM Plex Mono typography
- Vector status glyphs (eliminates raw ErrorCircle enum text at source)
- Full implicit control templates, visible keyboard focus, accessible names
- 6-10px radii, flat panes, no gradients/glow/blur

Fixed:
- AboutView: Run.Text bound CurrentVersion read-only (TwoWay default) -> Mode=OneWay
- ProgressWorkspaceView: ProgressBar.Value bound Percent read-only -> Mode=OneWay
- Both crash with InvalidOperationException on view render; regression tests added

Tests: 980 passed, 0 failed, 0 skipped (Release)
Build: 0 warnings, 0 errors
---
 assets/WinRestoreKit-one-pager.html           |  567 ++++++
 .../2026-08-09-backup-progress-results.md     | 1321 ++++++++++++
 .../2026-08-09-compare-confirm-restore.md     | 1812 +++++++++++++++++
 ...-timeline-compare-wpf-migration-roadmap.md |   77 +
 .../plans/2026-08-09-timeline-event-model.md  |  906 +++++++++
 ...-08-09-wpf-cutover-release-verification.md | 1407 +++++++++++++
 ...-08-09-wpf-foundation-application-shell.md | 1454 +++++++++++++
 ...08-09-timeline-compare-wpf-shell-design.md |  353 ++++
 .../AppRestore/AppRestoreService.cs           |  270 +++
 .../Backup/BackupCompletionPublisher.cs       |   44 +
 .../Backup/BackupPresets.cs                   |   13 +
 .../Backup}/ScopeGroups.cs                    |   72 +-
 .../Comparison/ComparisonState.cs             |   10 +
 .../Comparison/ModuleComparison.cs            |   27 +
 .../Comparison/SnapshotComparisonService.cs   |  261 +++
 .../Modules/BackupModuleCatalog.cs            |   14 +
 .../Modules/BackupModuleRegistration.cs       |   20 +
 .../BackupRestoreOrchestrator.cs              |   22 +-
 .../Orchestration/IRunUi.cs                   |   16 +-
 .../Orchestration/RunControl.cs               |    0
 .../Orchestration/RunCoordinator.cs           |    0
 .../Properties/AssemblyInfo.cs                |    5 +
 .../Results/RunSummary.cs                     |   17 +-
 .../Settings}/BackupRootRegistry.cs           |    0
 .../Settings/IThemeSettings.cs                |    8 +
 .../Settings/RegistryThemeSettings.cs         |   46 +
 .../Settings/ThemeMode.cs                     |    9 +
 .../Snapshots}/BackupFolders.cs               |  199 +-
 .../Snapshots/SnapshotEvent.cs                |   42 +
 .../Snapshots/SnapshotEventCatalog.cs         |  199 ++
 .../Snapshots/SnapshotEventKind.cs            |   10 +
 .../Snapshots/SnapshotPayloadPreparation.cs   |   42 +
 .../SnapshotPayloadPreparationService.cs      |   45 +
 .../Updates/IUpdateCheckService.cs            |   10 +
 .../Updates/UpdateCheckResult.cs              |   22 +
 .../Updates/UpdateCheckService.cs             |  112 +
 .../Updates/UpdateVerdict.cs                  |   10 +
 .../Updates/VersionInfo.cs                    |   27 +
 .../WinRestoreKit.Application.csproj          |   14 +
 src/WinRestoreKit.Core/Conf/AppStoreApps.cs   |   49 +-
 src/WinRestoreKit.Core/Conf/FileModule.cs     |   34 +-
 src/WinRestoreKit.Core/Conf/FolderModule.cs   |   35 +-
 src/WinRestoreKit.Core/Conf/WPowerPlans.cs    |   14 +-
 src/WinRestoreKit.Core/Results/RegFile.cs     |   43 +-
 .../Results/RestoreContents.cs                |   28 +-
 src/WinRestoreKit.Core/Results/RestoreLog.cs  |   33 +-
 .../Results/SnapshotGate.cs                   |   17 +-
 .../WinRestoreKit.Core.csproj                 |    2 +
 .../AdvancedHistoryViewModelTests.cs          |   88 +
 .../AppRestoreDialogTests.cs                  |  690 +------
 .../AppRestoreServiceTests.cs                 |  104 +
 .../ApplicationBoundaryTests.cs               |   34 +
 .../ArchiveProgressTests.cs                   |    6 +-
 .../BackupCompletionPublisherTests.cs         |   65 +
 .../BackupDestinationContainmentTests.cs      |    6 +-
 .../BackupDestinationLifecycleTests.cs        |   26 +-
 .../BackupFoldersReadTests.cs                 |   23 +-
 .../BackupModuleCatalogTests.cs               |   24 +
 .../BackupOutputPathTests.cs                  |   94 +
 .../BackupPageViewTests.cs                    |    2 +-
 src/WinRestoreKit.Tests/BackupPresetsTests.cs |   10 +-
 .../BackupResultTimelinePublicationTests.cs   |   94 +
 .../BackupWorkspaceViewModelTests.cs          |  162 ++
 .../BackupWorkspaceViewTests.cs               |   35 +
 .../ComparisonWorkspaceViewModelTests.cs      |  222 ++
 .../ConfirmViewModelTests.cs                  |  106 +
 .../FileFolderStaleArtifactTests.cs           |  104 +
 .../LockedPayloadBackupTests.cs               |    5 +-
 src/WinRestoreKit.Tests/ModuleShapeTests.cs   |   14 +-
 .../ProgressPageViewTests.cs                  |   16 +-
 .../ProgressWorkspaceViewModelTests.cs        |  181 ++
 .../RegFileValidateContentTests.cs            |   56 +
 .../RestoreConsentCancellationTests.cs        |    6 +-
 .../RestoreConsentDialogTests.cs              |   42 +
 .../RestoreContentsPayloadErrorTests.cs       |   48 +
 .../RestoreDialogOwnerTests.cs                |   64 +
 .../RestoreSetViewModelTests.cs               |   36 +
 .../ResultWorkspaceViewModelTests.cs          |   93 +
 src/WinRestoreKit.Tests/RunSummaryTests.cs    |   24 +-
 .../ScopeGroupsPrivacyTests.cs                |    3 +-
 .../ShellBackupFlowTests.cs                   |   96 +
 .../SnapshotComparisonServiceTests.cs         |  448 ++++
 .../SnapshotEventCatalogTests.cs              |  257 +++
 .../SnapshotFolderPathTests.cs                |    8 +-
 .../SnapshotGateConsentTests.cs               |   48 +
 .../SnapshotPayloadPreparationServiceTests.cs |  132 ++
 src/WinRestoreKit.Tests/SnapshotTests.cs      |   16 +-
 src/WinRestoreKit.Tests/ThemeServiceTests.cs  |   49 +
 src/WinRestoreKit.Tests/ThemeSettingsTests.cs |   31 +
 .../TimelineAccessibilityTests.cs             |  166 ++
 .../TimelineViewModelTests.cs                 |  119 ++
 .../TimelineWpfSmokeTests.cs                  |   99 +
 .../UpdateCheckVerdictTests.cs                |   51 +
 .../VersionParsingTests.cs                    |   82 +-
 .../ViewDataHelperTests.cs                    |   18 +-
 .../WPowerPlansManifestPreClearTests.cs       |   50 +
 .../WinRestoreKit.Tests.csproj                |    5 +
 .../WpfAppRestoreDialogTests.cs               |   46 +
 src/WinRestoreKit.Tests/WpfLogSinkTests.cs    |   42 +
 src/WinRestoreKit.Tests/WpfRunUiTests.cs      |   82 +
 src/WinRestoreKit.Tests/WpfShellTests.cs      |  124 ++
 src/WinRestoreKit.Tests/WpfTestHost.cs        |   90 +
 src/WinRestoreKit.Wpf/App.xaml                |   11 +
 src/WinRestoreKit.Wpf/App.xaml.cs             |   39 +
 .../Infrastructure/AsyncDelegateCommand.cs    |   45 +
 .../Infrastructure/DelegateCommand.cs         |   26 +
 .../Infrastructure/ObservableObject.cs        |   29 +
 src/WinRestoreKit.Wpf/MainWindow.xaml         |   86 +
 src/WinRestoreKit.Wpf/MainWindow.xaml.cs      |   24 +
 .../Navigation/CompareWorkflowNavigator.cs    |   82 +
 .../Navigation/ITimelineNavigator.cs          |   11 +
 .../Properties/AssemblyInfo.cs                |    3 +
 .../Resources/SnapshotEventTemplates.xaml     |  282 +++
 .../Services/CompareDialogService.cs          |   19 +
 .../Services/ExternalLinkService.cs           |    9 +
 .../Services/ICompareDialogService.cs         |   11 +
 .../Services/IExternalLinkService.cs          |    7 +
 .../Services/IRunDialogService.cs             |   12 +
 .../Services/IRunPresentation.cs              |   15 +
 .../Services/ISystemThemeDetector.cs          |    7 +
 .../Services/IThemeService.cs                 |   13 +
 .../Services/IWpfDialogService.cs             |   10 +
 .../Services/RestoreRunDialogService.cs       |   31 +
 .../Services/WindowsThemeDetector.cs          |   27 +
 .../Services/WpfAppRestoreDialog.cs           |   47 +
 .../Services/WpfDialogService.cs              |   60 +
 .../Services/WpfDispatcher.cs                 |   41 +
 src/WinRestoreKit.Wpf/Services/WpfLogSink.cs  |   49 +
 src/WinRestoreKit.Wpf/Services/WpfRunUi.cs    |  138 ++
 .../Services/WpfThemeService.cs               |   81 +
 .../Services/WpfUpdatePresenter.cs            |   62 +
 src/WinRestoreKit.Wpf/Themes/Controls.xaml    |  870 ++++++++
 src/WinRestoreKit.Wpf/Themes/Dark.xaml        |   84 +
 src/WinRestoreKit.Wpf/Themes/Light.xaml       |   84 +
 .../ViewModels/AboutViewModel.cs              |   34 +
 .../ViewModels/AppRestoreDialogViewModel.cs   |  182 ++
 .../ViewModels/BackupRunCompletion.cs         |   21 +
 .../ViewModels/BackupRunRequest.cs            |   24 +
 .../ViewModels/BackupScopeItemViewModel.cs    |   38 +
 .../ViewModels/BackupWorkspaceViewModel.cs    |  125 ++
 .../ViewModels/ComparisonFilter.cs            |    8 +
 .../ComparisonWorkspaceViewModel.cs           |  179 ++
 .../ViewModels/ConfirmViewModel.cs            |  173 ++
 .../History/AdvancedHistoryViewModel.cs       |   96 +
 .../ModuleComparisonRowViewModel.cs           |   65 +
 .../ViewModels/ModuleImpactViewModel.cs       |   27 +
 .../ViewModels/ProgressWorkspaceViewModel.cs  |  372 ++++
 .../ViewModels/RestoreSetViewModel.cs         |   47 +
 .../ViewModels/ResultWorkspaceViewModel.cs    |   55 +
 .../ViewModels/SettingsViewModel.cs           |   41 +
 .../ViewModels/ShellViewModel.cs              |  198 ++
 .../Snapshots/SnapshotEventStatus.cs          |   72 +
 .../Snapshots/SnapshotEventViewModel.cs       |   92 +
 .../ViewModels/Timeline/TimelineViewModel.cs  |  116 ++
 src/WinRestoreKit.Wpf/Views/AboutView.xaml    |   57 +
 src/WinRestoreKit.Wpf/Views/AboutView.xaml.cs |   12 +
 .../Views/AdvancedHistoryView.xaml            |  158 ++
 .../Views/AdvancedHistoryView.xaml.cs         |   20 +
 .../Views/AppRestoreDialog.xaml               |  172 ++
 .../Views/AppRestoreDialog.xaml.cs            |   53 +
 .../Views/BackupWorkspaceView.xaml            |  343 ++++
 .../Views/BackupWorkspaceView.xaml.cs         |   25 +
 .../Views/ComparisonWorkspaceView.xaml        |  564 +++++
 .../Views/ComparisonWorkspaceView.xaml.cs     |   12 +
 src/WinRestoreKit.Wpf/Views/ConfirmView.xaml  |  342 ++++
 .../Views/ConfirmView.xaml.cs                 |   26 +
 .../Views/Controls/SnapshotEventList.xaml     |   75 +
 .../Views/Controls/SnapshotEventList.xaml.cs  |   71 +
 .../Views/Dialogs/RestoreConsentDialog.xaml   |   86 +
 .../Dialogs/RestoreConsentDialog.xaml.cs      |   65 +
 .../Views/ProgressWorkspaceView.xaml          |  360 ++++
 .../Views/ProgressWorkspaceView.xaml.cs       |   12 +
 .../Views/ResultWorkspaceView.xaml            |  230 +++
 .../Views/ResultWorkspaceView.xaml.cs         |   12 +
 src/WinRestoreKit.Wpf/Views/SettingsView.xaml |   69 +
 .../Views/SettingsView.xaml.cs                |   12 +
 src/WinRestoreKit.Wpf/Views/TimelineView.xaml |   98 +
 .../Views/TimelineView.xaml.cs                |   22 +
 .../WinRestoreKit.Wpf.csproj                  |   26 +
 src/WinRestoreKit.sln                         |   44 +
 src/WinRestoreKit/Forms/RestAppsForm.cs       |  717 +------
 src/WinRestoreKit/Helpers/UpdateCheck.cs      |  138 --
 .../Helpers/WinFormsUpdatePresenter.cs        |   76 +
 src/WinRestoreKit/MainForm.cs                 |   19 +-
 src/WinRestoreKit/Program.cs                  |   71 +-
 src/WinRestoreKit/Views/AboutPageView.cs      |   20 +-
 src/WinRestoreKit/Views/BackupPageView.cs     |  117 +-
 src/WinRestoreKit/Views/BackupPresets.cs      |   39 -
 src/WinRestoreKit/Views/ProgressPageView.cs   |    4 +-
 .../Views/RestoreWizardStep2View.cs           |   12 +-
 src/WinRestoreKit/WinRestoreKit.csproj        |    1 +
 191 files changed, 20727 insertions(+), 2013 deletions(-)
 create mode 100644 assets/WinRestoreKit-one-pager.html
 create mode 100644 docs/superpowers/plans/2026-08-09-backup-progress-results.md
 create mode 100644 docs/superpowers/plans/2026-08-09-compare-confirm-restore.md
 create mode 100644 docs/superpowers/plans/2026-08-09-timeline-compare-wpf-migration-roadmap.md
 create mode 100644 docs/superpowers/plans/2026-08-09-timeline-event-model.md
 create mode 100644 docs/superpowers/plans/2026-08-09-wpf-cutover-release-verification.md
 create mode 100644 docs/superpowers/plans/2026-08-09-wpf-foundation-application-shell.md
 create mode 100644 docs/superpowers/specs/2026-08-09-timeline-compare-wpf-shell-design.md
 create mode 100644 src/WinRestoreKit.Application/AppRestore/AppRestoreService.cs
 create mode 100644 src/WinRestoreKit.Application/Backup/BackupCompletionPublisher.cs
 create mode 100644 src/WinRestoreKit.Application/Backup/BackupPresets.cs
 rename src/{WinRestoreKit/Views => WinRestoreKit.Application/Backup}/ScopeGroups.cs (75%)
 create mode 100644 src/WinRestoreKit.Application/Comparison/ComparisonState.cs
 create mode 100644 src/WinRestoreKit.Application/Comparison/ModuleComparison.cs
 create mode 100644 src/WinRestoreKit.Application/Comparison/SnapshotComparisonService.cs
 create mode 100644 src/WinRestoreKit.Application/Modules/BackupModuleCatalog.cs
 create mode 100644 src/WinRestoreKit.Application/Modules/BackupModuleRegistration.cs
 rename src/{WinRestoreKit => WinRestoreKit.Application}/Orchestration/BackupRestoreOrchestrator.cs (98%)
 rename src/{WinRestoreKit => WinRestoreKit.Application}/Orchestration/IRunUi.cs (74%)
 rename src/{WinRestoreKit => WinRestoreKit.Application}/Orchestration/RunControl.cs (100%)
 rename src/{WinRestoreKit => WinRestoreKit.Application}/Orchestration/RunCoordinator.cs (100%)
 create mode 100644 src/WinRestoreKit.Application/Properties/AssemblyInfo.cs
 rename src/{WinRestoreKit => WinRestoreKit.Application}/Results/RunSummary.cs (94%)
 rename src/{WinRestoreKit/Helpers => WinRestoreKit.Application/Settings}/BackupRootRegistry.cs (100%)
 create mode 100644 src/WinRestoreKit.Application/Settings/IThemeSettings.cs
 create mode 100644 src/WinRestoreKit.Application/Settings/RegistryThemeSettings.cs
 create mode 100644 src/WinRestoreKit.Application/Settings/ThemeMode.cs
 rename src/{WinRestoreKit/Views => WinRestoreKit.Application/Snapshots}/BackupFolders.cs (55%)
 create mode 100644 src/WinRestoreKit.Application/Snapshots/SnapshotEvent.cs
 create mode 100644 src/WinRestoreKit.Application/Snapshots/SnapshotEventCatalog.cs
 create mode 100644 src/WinRestoreKit.Application/Snapshots/SnapshotEventKind.cs
 create mode 100644 src/WinRestoreKit.Application/Snapshots/SnapshotPayloadPreparation.cs
 create mode 100644 src/WinRestoreKit.Application/Snapshots/SnapshotPayloadPreparationService.cs
 create mode 100644 src/WinRestoreKit.Application/Updates/IUpdateCheckService.cs
 create mode 100644 src/WinRestoreKit.Application/Updates/UpdateCheckResult.cs
 create mode 100644 src/WinRestoreKit.Application/Updates/UpdateCheckService.cs
 create mode 100644 src/WinRestoreKit.Application/Updates/UpdateVerdict.cs
 create mode 100644 src/WinRestoreKit.Application/Updates/VersionInfo.cs
 create mode 100644 src/WinRestoreKit.Application/WinRestoreKit.Application.csproj
 create mode 100644 src/WinRestoreKit.Tests/AdvancedHistoryViewModelTests.cs
 create mode 100644 src/WinRestoreKit.Tests/AppRestoreServiceTests.cs
 create mode 100644 src/WinRestoreKit.Tests/ApplicationBoundaryTests.cs
 create mode 100644 src/WinRestoreKit.Tests/BackupCompletionPublisherTests.cs
 create mode 100644 src/WinRestoreKit.Tests/BackupModuleCatalogTests.cs
 create mode 100644 src/WinRestoreKit.Tests/BackupOutputPathTests.cs
 create mode 100644 src/WinRestoreKit.Tests/BackupResultTimelinePublicationTests.cs
 create mode 100644 src/WinRestoreKit.Tests/BackupWorkspaceViewModelTests.cs
 create mode 100644 src/WinRestoreKit.Tests/BackupWorkspaceViewTests.cs
 create mode 100644 src/WinRestoreKit.Tests/ComparisonWorkspaceViewModelTests.cs
 create mode 100644 src/WinRestoreKit.Tests/ConfirmViewModelTests.cs
 create mode 100644 src/WinRestoreKit.Tests/FileFolderStaleArtifactTests.cs
 create mode 100644 src/WinRestoreKit.Tests/ProgressWorkspaceViewModelTests.cs
 create mode 100644 src/WinRestoreKit.Tests/RegFileValidateContentTests.cs
 create mode 100644 src/WinRestoreKit.Tests/RestoreConsentDialogTests.cs
 create mode 100644 src/WinRestoreKit.Tests/RestoreContentsPayloadErrorTests.cs
 create mode 100644 src/WinRestoreKit.Tests/RestoreDialogOwnerTests.cs
 create mode 100644 src/WinRestoreKit.Tests/RestoreSetViewModelTests.cs
 create mode 100644 src/WinRestoreKit.Tests/ResultWorkspaceViewModelTests.cs
 create mode 100644 src/WinRestoreKit.Tests/ShellBackupFlowTests.cs
 create mode 100644 src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs
 create mode 100644 src/WinRestoreKit.Tests/SnapshotEventCatalogTests.cs
 create mode 100644 src/WinRestoreKit.Tests/SnapshotGateConsentTests.cs
 create mode 100644 src/WinRestoreKit.Tests/SnapshotPayloadPreparationServiceTests.cs
 create mode 100644 src/WinRestoreKit.Tests/ThemeServiceTests.cs
 create mode 100644 src/WinRestoreKit.Tests/ThemeSettingsTests.cs
 create mode 100644 src/WinRestoreKit.Tests/TimelineAccessibilityTests.cs
 create mode 100644 src/WinRestoreKit.Tests/TimelineViewModelTests.cs
 create mode 100644 src/WinRestoreKit.Tests/TimelineWpfSmokeTests.cs
 create mode 100644 src/WinRestoreKit.Tests/UpdateCheckVerdictTests.cs
 create mode 100644 src/WinRestoreKit.Tests/WPowerPlansManifestPreClearTests.cs
 create mode 100644 src/WinRestoreKit.Tests/WpfAppRestoreDialogTests.cs
 create mode 100644 src/WinRestoreKit.Tests/WpfLogSinkTests.cs
 create mode 100644 src/WinRestoreKit.Tests/WpfRunUiTests.cs
 create mode 100644 src/WinRestoreKit.Tests/WpfShellTests.cs
 create mode 100644 src/WinRestoreKit.Tests/WpfTestHost.cs
 create mode 100644 src/WinRestoreKit.Wpf/App.xaml
 create mode 100644 src/WinRestoreKit.Wpf/App.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/Infrastructure/AsyncDelegateCommand.cs
 create mode 100644 src/WinRestoreKit.Wpf/Infrastructure/DelegateCommand.cs
 create mode 100644 src/WinRestoreKit.Wpf/Infrastructure/ObservableObject.cs
 create mode 100644 src/WinRestoreKit.Wpf/MainWindow.xaml
 create mode 100644 src/WinRestoreKit.Wpf/MainWindow.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/Navigation/CompareWorkflowNavigator.cs
 create mode 100644 src/WinRestoreKit.Wpf/Navigation/ITimelineNavigator.cs
 create mode 100644 src/WinRestoreKit.Wpf/Properties/AssemblyInfo.cs
 create mode 100644 src/WinRestoreKit.Wpf/Resources/SnapshotEventTemplates.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Services/CompareDialogService.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/ExternalLinkService.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/ICompareDialogService.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/IExternalLinkService.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/IRunDialogService.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/IRunPresentation.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/ISystemThemeDetector.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/IThemeService.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/IWpfDialogService.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/RestoreRunDialogService.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/WindowsThemeDetector.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/WpfAppRestoreDialog.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/WpfDialogService.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/WpfDispatcher.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/WpfLogSink.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/WpfRunUi.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/WpfThemeService.cs
 create mode 100644 src/WinRestoreKit.Wpf/Services/WpfUpdatePresenter.cs
 create mode 100644 src/WinRestoreKit.Wpf/Themes/Controls.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Themes/Dark.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Themes/Light.xaml
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/AboutViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/AppRestoreDialogViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/BackupRunCompletion.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/BackupRunRequest.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/BackupScopeItemViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/BackupWorkspaceViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/ComparisonFilter.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/ComparisonWorkspaceViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/ConfirmViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/History/AdvancedHistoryViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/ModuleComparisonRowViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/ModuleImpactViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/ProgressWorkspaceViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/RestoreSetViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/ResultWorkspaceViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/SettingsViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/Snapshots/SnapshotEventStatus.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/Snapshots/SnapshotEventViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/ViewModels/Timeline/TimelineViewModel.cs
 create mode 100644 src/WinRestoreKit.Wpf/Views/AboutView.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Views/AboutView.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/Views/AdvancedHistoryView.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Views/AdvancedHistoryView.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/Views/AppRestoreDialog.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Views/AppRestoreDialog.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/Views/BackupWorkspaceView.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Views/BackupWorkspaceView.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/Views/ConfirmView.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Views/ConfirmView.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/Views/Controls/SnapshotEventList.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Views/Controls/SnapshotEventList.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/Views/Dialogs/RestoreConsentDialog.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Views/Dialogs/RestoreConsentDialog.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/Views/ProgressWorkspaceView.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Views/ProgressWorkspaceView.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/Views/ResultWorkspaceView.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Views/ResultWorkspaceView.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/Views/SettingsView.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Views/SettingsView.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/Views/TimelineView.xaml
 create mode 100644 src/WinRestoreKit.Wpf/Views/TimelineView.xaml.cs
 create mode 100644 src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj
 delete mode 100644 src/WinRestoreKit/Helpers/UpdateCheck.cs
 create mode 100644 src/WinRestoreKit/Helpers/WinFormsUpdatePresenter.cs
 delete mode 100644 src/WinRestoreKit/Views/BackupPresets.cs

diff --git a/assets/WinRestoreKit-one-pager.html b/assets/WinRestoreKit-one-pager.html
new file mode 100644
index 0000000..3e5ddcf
--- /dev/null
+++ b/assets/WinRestoreKit-one-pager.html
@@ -0,0 +1,567 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>WinRestoreKit — Your Windows setup, saved locally</title>
+  <style>
+    :root {
+      --ink: #0b1524;
+      --paper: #f7f9fc;
+      --surface: #ffffff;
+      --blue: #3569d8;
+      --blue-dark: #1f4fae;
+      --slate: #64748a;
+      --line: #d8e0ea;
+      --soft-blue: #eaf0ff;
+      --coral: #d95e55;
+      --soft-coral: #fff0ee;
+      --green: #157a62;
+    }
+
+    * { box-sizing: border-box; }
+
+    html, body {
+      margin: 0;
+      min-height: 100%;
+      background: #dfe5ed;
+      color: var(--ink);
+      font-family: "Segoe UI Variable Text", "Segoe UI", Arial, sans-serif;
+      -webkit-font-smoothing: antialiased;
+    }
+
+    body {
+      display: grid;
+      place-items: center;
+      padding: 24px;
+    }
+
+    .sheet {
+      position: relative;
+      width: 210mm;
+      height: 297mm;
+      overflow: hidden;
+      background: var(--paper);
+      box-shadow: 0 18px 60px rgba(11, 21, 36, 0.18);
+      display: grid;
+      grid-template-rows: auto auto auto 1fr auto;
+      gap: 0;
+      padding: 13mm 14mm 10mm;
+    }
+
+    .sheet::before {
+      content: "";
+      position: absolute;
+      inset: 0 auto 0 0;
+      width: 3mm;
+      background: var(--blue);
+    }
+
+    .topbar {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      padding-bottom: 7mm;
+      border-bottom: 1px solid var(--line);
+    }
+
+    .brand {
+      display: flex;
+      align-items: center;
+      gap: 10px;
+      font-family: "Segoe UI Variable Display", "Segoe UI", sans-serif;
+      font-size: 18px;
+      font-weight: 720;
+      letter-spacing: -0.02em;
+    }
+
+    .mark {
+      width: 28px;
+      height: 28px;
+      display: grid;
+      place-items: center;
+      border-radius: 7px;
+      background: var(--ink);
+      color: #fff;
+    }
+
+    .meta {
+      display: flex;
+      gap: 14px;
+      color: var(--slate);
+      font: 650 9px/1.2 "Cascadia Mono", "Consolas", monospace;
+      letter-spacing: 0.07em;
+      text-transform: uppercase;
+    }
+
+    .hero {
+      display: grid;
+      grid-template-columns: 1.55fr 0.75fr;
+      gap: 11mm;
+      align-items: end;
+      padding: 11mm 0 8mm;
+    }
+
+    .eyebrow {
+      margin: 0 0 3mm;
+      color: var(--blue-dark);
+      font: 700 10px/1.2 "Cascadia Mono", "Consolas", monospace;
+      letter-spacing: 0.12em;
+      text-transform: uppercase;
+    }
+
+    h1 {
+      margin: 0;
+      max-width: 125mm;
+      font-family: "Segoe UI Variable Display", "Segoe UI", sans-serif;
+      font-size: 38px;
+      line-height: 0.99;
+      letter-spacing: -0.045em;
+      font-weight: 760;
+    }
+
+    .hero-copy {
+      margin: 5mm 0 0;
+      max-width: 122mm;
+      color: #39485d;
+      font-size: 15px;
+      line-height: 1.48;
+    }
+
+    .hero-copy strong { color: var(--ink); }
+
+    .local-seal {
+      align-self: stretch;
+      border: 1px solid var(--line);
+      border-radius: 12px;
+      background: var(--surface);
+      padding: 5mm;
+      display: flex;
+      flex-direction: column;
+      justify-content: space-between;
+    }
+
+    .local-seal svg {
+      width: 34px;
+      height: 34px;
+      color: var(--blue);
+    }
+
+    .seal-kicker {
+      margin-top: 8mm;
+      color: var(--green);
+      font: 700 9px/1.2 "Cascadia Mono", "Consolas", monospace;
+      letter-spacing: 0.09em;
+      text-transform: uppercase;
+    }
+
+    .seal-title {
+      margin: 1.5mm 0 0;
+      font-size: 20px;
+      line-height: 1.05;
+      font-weight: 740;
+      letter-spacing: -0.03em;
+    }
+
+    .seal-copy {
+      margin: 2.5mm 0 0;
+      color: var(--slate);
+      font-size: 10.5px;
+      line-height: 1.45;
+    }
+
+    .rail {
+      position: relative;
+      margin: 0 -3mm;
+      padding: 7mm 6mm 6mm;
+      background: var(--ink);
+      color: #fff;
+      border-radius: 14px;
+      overflow: hidden;
+    }
+
+    .rail-head {
+      display: flex;
+      align-items: baseline;
+      justify-content: space-between;
+      gap: 20px;
+      margin-bottom: 6mm;
+    }
+
+    .rail-head h2 {
+      margin: 0;
+      font-size: 18px;
+      line-height: 1.1;
+      letter-spacing: -0.025em;
+    }
+
+    .folder-name {
+      color: #aebdd1;
+      font: 600 8.5px/1.2 "Cascadia Mono", "Consolas", monospace;
+    }
+
+    .timeline {
+      position: relative;
+      display: grid;
+      grid-template-columns: repeat(4, 1fr);
+      gap: 5mm;
+    }
+
+    .timeline::before {
+      content: "";
+      position: absolute;
+      top: 7px;
+      left: 7px;
+      right: 7px;
+      height: 2px;
+      background: #40516a;
+    }
+
+    .step { position: relative; z-index: 1; }
+
+    .dot {
+      width: 16px;
+      height: 16px;
+      border: 4px solid var(--ink);
+      outline: 2px solid #6880a0;
+      border-radius: 50%;
+      background: #8da0b8;
+      margin-bottom: 3mm;
+    }
+
+    .step:nth-child(2) .dot,
+    .step:nth-child(3) .dot { background: #7aa0ff; outline-color: #7aa0ff; }
+    .step:nth-child(4) .dot { background: #5ad0ad; outline-color: #5ad0ad; }
+
+    .step b {
+      display: block;
+      font-size: 11px;
+      line-height: 1.2;
+    }
+
+    .step span {
+      display: block;
+      margin-top: 1.5mm;
+      color: #aebdd1;
+      font-size: 9px;
+      line-height: 1.35;
+    }
+
+    .body-grid {
+      min-height: 0;
+      display: grid;
+      grid-template-columns: 1.05fr 0.95fr;
+      gap: 10mm;
+      padding-top: 8mm;
+    }
+
+    h3 {
+      margin: 0 0 4mm;
+      font-size: 15px;
+      line-height: 1.2;
+      letter-spacing: -0.02em;
+    }
+
+    .feature-list {
+      display: grid;
+      gap: 4mm;
+    }
+
+    .feature {
+      display: grid;
+      grid-template-columns: 25px 1fr;
+      gap: 3mm;
+      align-items: start;
+    }
+
+    .feature-icon {
+      width: 25px;
+      height: 25px;
+      display: grid;
+      place-items: center;
+      border-radius: 7px;
+      background: var(--soft-blue);
+      color: var(--blue-dark);
+      font: 750 10px/1 "Cascadia Mono", "Consolas", monospace;
+    }
+
+    .feature b {
+      display: block;
+      font-size: 11px;
+      line-height: 1.25;
+    }
+
+    .feature p {
+      margin: 1mm 0 0;
+      color: var(--slate);
+      font-size: 9.5px;
+      line-height: 1.42;
+    }
+
+    .coverage {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 2mm;
+      margin-top: 5mm;
+    }
+
+    .coverage span {
+      padding: 1.5mm 2.5mm;
+      border: 1px solid var(--line);
+      border-radius: 999px;
+      background: var(--surface);
+      color: #3f5066;
+      font-size: 8.5px;
+      line-height: 1;
+    }
+
+    .truth-box {
+      border-top: 3px solid var(--coral);
+      border-radius: 9px;
+      background: var(--soft-coral);
+      padding: 5mm;
+    }
+
+    .truth-label {
+      color: var(--coral);
+      font: 700 8.5px/1.2 "Cascadia Mono", "Consolas", monospace;
+      letter-spacing: 0.1em;
+      text-transform: uppercase;
+    }
+
+    .truth-box h3 { margin: 2mm 0 2.5mm; }
+
+    .truth-box p {
+      margin: 0;
+      color: #60413e;
+      font-size: 9.5px;
+      line-height: 1.48;
+    }
+
+    .proofs {
+      display: grid;
+      grid-template-columns: 1fr 1fr;
+      gap: 2.5mm;
+      margin-top: 4mm;
+    }
+
+    .proof {
+      padding: 3mm;
+      border: 1px solid var(--line);
+      border-radius: 8px;
+      background: var(--surface);
+    }
+
+    .proof strong {
+      display: block;
+      color: var(--blue-dark);
+      font: 750 12px/1.1 "Segoe UI Variable Display", "Segoe UI", sans-serif;
+    }
+
+    .proof span {
+      display: block;
+      margin-top: 1mm;
+      color: var(--slate);
+      font-size: 8.5px;
+      line-height: 1.25;
+    }
+
+    .cta {
+      display: grid;
+      grid-template-columns: 1fr auto;
+      gap: 8mm;
+      align-items: center;
+      margin-top: 7mm;
+      padding-top: 5mm;
+      border-top: 1px solid var(--line);
+    }
+
+    .cta h2 {
+      margin: 0;
+      font-size: 18px;
+      line-height: 1.1;
+      letter-spacing: -0.025em;
+    }
+
+    .cta p {
+      margin: 1.5mm 0 0;
+      color: var(--slate);
+      font-size: 9px;
+      line-height: 1.35;
+    }
+
+    .download {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      padding: 3.6mm 5mm;
+      border-radius: 8px;
+      background: var(--blue);
+      color: #fff;
+      text-decoration: none;
+      font-size: 10px;
+      font-weight: 720;
+      white-space: nowrap;
+    }
+
+    .fine-print {
+      grid-column: 1 / -1;
+      margin-top: 1mm;
+      color: #7a8798;
+      font-size: 7.6px;
+      line-height: 1.35;
+    }
+
+    a:focus-visible {
+      outline: 3px solid var(--coral);
+      outline-offset: 3px;
+    }
+
+    @media (max-width: 900px) {
+      body { padding: 0; background: var(--paper); }
+      .sheet {
+        width: 100%;
+        height: auto;
+        min-height: 100vh;
+        padding: 32px 28px;
+        box-shadow: none;
+      }
+      .hero, .body-grid { grid-template-columns: 1fr; }
+      .local-seal { min-height: 180px; }
+      .timeline { grid-template-columns: 1fr 1fr; row-gap: 22px; }
+      .timeline::before { display: none; }
+      .meta { display: none; }
+      .cta { grid-template-columns: 1fr; }
+      .download { justify-self: start; }
+    }
+
+    @media (prefers-reduced-motion: no-preference) {
+      .download { transition: background-color 140ms ease, transform 140ms ease; }
+      .download:hover { background: var(--blue-dark); transform: translateY(-1px); }
+    }
+
+    @page { size: A4; margin: 0; }
+
+    @media print {
+      html, body { width: 210mm; height: 297mm; background: #fff; }
+      body { padding: 0; display: block; }
+      .sheet { box-shadow: none; }
+      .download { print-color-adjust: exact; -webkit-print-color-adjust: exact; }
+      * { print-color-adjust: exact; -webkit-print-color-adjust: exact; }
+    }
+  </style>
+</head>
+<body>
+  <main class="sheet" aria-labelledby="headline">
+    <header class="topbar">
+      <div class="brand">
+        <span class="mark" aria-hidden="true">
+          <svg viewBox="0 0 24 24" width="18" height="18" fill="none" stroke="currentColor" stroke-width="1.8">
+            <path d="M5 8.5 12 4l7 4.5v7L12 20l-7-4.5z" />
+            <path d="M8.5 12.4 11 15l4.8-5" />
+          </svg>
+        </span>
+        WinRestoreKit
+      </div>
+      <div class="meta" aria-label="Product facts">
+        <span>Windows 11 x64</span>
+        <span>Open source</span>
+        <span>MIT licence</span>
+      </div>
+    </header>
+
+    <section class="hero">
+      <div>
+        <p class="eyebrow">Back up the details that make Windows yours</p>
+        <h1 id="headline">Your Windows setup, saved locally.</h1>
+        <p class="hero-copy">
+          WinRestoreKit backs up the settings that make a PC feel familiar—then helps restore
+          <strong>only the modules you choose.</strong> No cloud account. No telemetry. No .NET install.
+        </p>
+      </div>
+
+      <aside class="local-seal" aria-label="Local by design">
+        <svg viewBox="0 0 32 32" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true">
+          <path d="M8 14v-3a8 8 0 0 1 16 0v3" />
+          <rect x="5" y="14" width="22" height="14" rx="4" />
+          <circle cx="16" cy="21" r="2" />
+          <path d="M16 23v2" />
+        </svg>
+        <div>
+          <div class="seal-kicker">Local by design</div>
+          <div class="seal-title">Your files stay with you.</div>
+          <p class="seal-copy">Each timestamped local backup includes a machine-readable manifest and log, plus copied files and registry exports in a folder or compressed payload.</p>
+        </div>
+      </aside>
+    </section>
+
+    <section class="rail" aria-labelledby="rail-title">
+      <div class="rail-head">
+        <h2 id="rail-title">A restore path you can understand</h2>
+        <span class="folder-name">backup_2026-08-09_1430</span>
+      </div>
+      <div class="timeline">
+        <div class="step"><div class="dot"></div><b>Choose</b><span>Pick a preset or select individual modules.</span></div>
+        <div class="step"><div class="dot"></div><b>Capture</b><span>Create a lightweight, timestamped local backup.</span></div>
+        <div class="step"><div class="dot"></div><b>Review</b><span>See what restore will overwrite before you consent.</span></div>
+        <div class="step"><div class="dot"></div><b>Restore</b><span>Protect the current state with a pre-restore snapshot.</span></div>
+      </div>
+    </section>
+
+    <section class="body-grid">
+      <div>
+        <h3>Back up more than a wallpaper</h3>
+        <div class="feature-list">
+          <div class="feature">
+            <div class="feature-icon">01</div>
+            <div><b>Windows personality</b><p>Taskbar, themes, visual effects, regional preferences, accessibility settings, and more.</p></div>
+          </div>
+          <div class="feature">
+            <div class="feature-icon">02</div>
+            <div><b>Devices and connections</b><p>Printers, mouse and keyboard settings, Wi-Fi credentials, mapped drives, and network configuration.</p></div>
+          </div>
+          <div class="feature">
+            <div class="feature-icon">03</div>
+            <div><b>Apps and developer tools</b><p>Selected app settings, terminal and VS Code data, SSH configuration, hosts file, and a winget package list.</p></div>
+          </div>
+          <div class="feature">
+            <div class="feature-icon">04</div>
+            <div><b>Evidence with every run</b><p>Human-readable logs plus <code>backup_manifest.json</code> record what succeeded, skipped, or failed.</p></div>
+          </div>
+        </div>
+        <div class="coverage" aria-label="Feature highlights">
+          <span>Selective modules</span><span>Presets</span><span>History timeline</span>
+          <span>Power plans</span><span>Local folders</span><span>Single executable</span>
+        </div>
+      </div>
+
+      <div>
+        <div class="truth-box">
+          <div class="truth-label">Safety without spin</div>
+          <h3>Know what restore can—and cannot—undo.</h3>
+          <p>Before changes begin, WinRestoreKit states what will be overwritten, asks for consent, and creates a pre-restore snapshot. Registry imports and folder copies are additive, so the app says plainly when restoring a snapshot cannot remove newly added values or files.</p>
+        </div>
+        <div class="proofs" aria-label="Product proof points">
+          <div class="proof"><strong>Backups stay local</strong><span>No cloud account or telemetry</span></div>
+          <div class="proof"><strong>1 executable</strong><span>Self-contained Windows download</span></div>
+          <div class="proof"><strong>Pick the scope</strong><span>Preset or module-by-module</span></div>
+          <div class="proof"><strong>Undo point</strong><span>Automatic snapshot before restore</span></div>
+        </div>
+      </div>
+    </section>
+
+    <footer class="cta">
+      <div>
+        <h2>Keep your Windows setup in your hands.</h2>
+        <p>Download the latest release or inspect the source on GitHub.</p>
+      </div>
+      <a class="download" href="https://github.com/nicolasestrem/WinRestoreKit/releases/latest">
+        Download WinRestoreKit.exe <span aria-hidden="true">→</span>
+      </a>
+      <div class="fine-print">
+        Requires Windows 11 x64 and administrator privileges. Windows 10 may work but is untested. The current binary is not code-signed, so SmartScreen may show a first-run warning. Source and licence: github.com/nicolasestrem/WinRestoreKit
+      </div>
+    </footer>
+  </main>
+</body>
+</html>
diff --git a/docs/superpowers/plans/2026-08-09-backup-progress-results.md b/docs/superpowers/plans/2026-08-09-backup-progress-results.md
new file mode 100644
index 0000000..c74eadf
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-09-backup-progress-results.md
@@ -0,0 +1,1321 @@
+# Backup, Progress, Results, and App Restore WPF Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Deliver the WPF Create Snapshot workflow from module selection through safe execution, honest results, and return to an updated Timeline, including the owner-bound app-reinstall dialog, while the WinForms application remains runnable.
+
+**Architecture:** Reuse the Foundation plan's framework-neutral `WinRestoreKit.Application` runner, run-control, and summary contracts plus the Compare/Confirm plan's module-catalog contract without modifying Core backup/restore semantics or snapshot files. WPF view models own selection, navigation, presentation, and commands; Foundation's `WpfRunUi` and `WpfLogSink` are extended and composed with the dispatcher and owner-bound dialogs. A small Application completion publisher asks the Timeline event catalog to discover retained output first and creates an in-memory failure event only when no retained event exists.
+
+**Tech Stack:** .NET 8 for Windows, WPF/XAML, MVVM (`INotifyPropertyChanged` and `ICommand`), xUnit 2.9.3, existing Core `BackupBase`/payload/manifest/logging APIs, and the existing Windows registry-backed destination registry.
+
+## Global Constraints
+
+- Execute after `2026-08-09-wpf-foundation-application-shell.md`, `2026-08-09-timeline-event-model.md`, and `2026-08-09-compare-confirm-restore.md`; this plan does not duplicate their contracts.
+- Keep `WinRestoreKit.Core` backup, restore, manifest, payload, cleanup, containment, ownership, archive, rollback, Explorer, and shutdown semantics unchanged. Do not change the snapshot format.
+- `src/WinRestoreKit.Application` references Core only; it MUST NOT reference WPF or WinForms. WPF views and view models MUST NOT parse registry exports, JSON payload text, or archive contents.
+- Preserve the six ordered scopes, their current module membership, default-selection behavior, environment-variable explicit opt-in, warning text, `BackupPresets` literal membership, destination containment protection, name validation, and `SnapshotCompression.None/Fast/Max` behavior. The default compression remains `Fast`.
+- The only admission point is `RunCoordinator.TryStart()`. A rejected second attempt must not construct a runner, replace the active workspace, install a log sink, or mutate snapshot state. Release admission with `RunCoordinator.SetRunning(false)` in the run owner's `finally` path.
+- `RunControl.Pause()`, `Resume()`, and `RequestCancellation()` retain their existing boundary-only behavior: an active module finishes; no later module starts; cancellation wakes a paused run. Never claim rollback for work already performed.
+- Disable cancellation when the runner reports the exact `BackupRestoreOrchestrator.ArchiveProgressText` value. Preserve real metric values from `ProgressMetrics`; use `N/A` where Core reports no byte measurement, never an invented estimate.
+- `RunSummary` is the sole authority for completion wording. Render `RunSeverity { Information, Warning, Error }`; do not inspect `RunControl.IsCancellationRequested` to relabel a summary. In particular, a completed `RunSummary.For(...)` remains completed after a late cancel click, while `RunSummary.Incomplete(...)` remains visibly incomplete.
+- The Foundation `IRunUi` has no `IWin32Window Owner` and no Windows Forms type. `DialogOwner` is an opaque `object` supplied by the shell solely for Core's existing app-reinstall dialog seam; Application neither casts it nor passes it into `AppRestoreService`. Its exact surface is:
+
+  ```csharp
+  internal interface IRunUi
+  {
+      object DialogOwner { get; }
+      void SetProgressText(string text);
+      void SetProgressPercent(int percent);
+      void SetProgressDetail(string groupInfo, string elapsed, string remaining,
+          string throughput, long bytesWritten, int errors, int warnings);
+      void ShowSummary(RunSummary summary, string caption,
+          IReadOnlyList<ModuleOutcome> outcomes);
+      IReadOnlyList<string> ShowConsentDialog(RestorePlan plan);
+      bool ConfirmSnapshotOverride(string text, string caption);
+      void ShowPlanCompositionError(string text, string caption);
+      void SetExplorerRestartVisible(bool visible);
+  }
+  ```
+
+- Use the Timeline plan's app-lifetime `SnapshotEventCatalog`: `IReadOnlyList<SnapshotEvent> Read()` and `void RecordSessionFailure(DateTime created, string displayName, string diagnosticReason)`. Its immutable events use `SnapshotEventKind { Verified, Partial, Failed, Unreadable }`; only `Verified` and `Partial` are restorable.
+- First re-read the catalog after a backup. Publish a session failure only when no retained recognized event corresponds to the expected backup path (for example, folder creation failed or cancellation removed the new folder). Retained partial, failed, or unreadable folders are discovered from disk and MUST NOT receive a duplicate session event. Never keep an incomplete folder merely to manufacture history.
+- The WPF shell registers Core's existing `AppStoreApps.RestoreDialog` with a callback that accepts only a live WPF `Window` owner; `AppRestoreService` has no owner argument. Source-selection/read or winget-install failures appear in the owner-bound WPF dialog or inline dialog state; never use an ownerless `MessageBox`.
+- Keep the original `src/WinRestoreKit` WinForms shell and `RestAppsForm` runnable during this phase. Port shared, non-UI app-restore logic out of the form and update the form to consume it; do not delete the form, designer, or legacy construction tests until Cutover.
+- Keep tests in `src/WinRestoreKit.Tests`. Preserve pure tests, update all `IRunUi` fakes for the Foundation interface, and use Foundation's `WpfTestHost.Run(...)` for WPF window/control construction. Do not run formatters, linters, builds, or tests while drafting this plan.
+
+## Prerequisite Interfaces
+
+Foundation supplies the Application runner/run-control/summary contracts, WPF shell/adapters, and `WpfTestHost`; Compare/Confirm supplies `BackupModuleCatalog`. Do not recreate any of them:
+
+```csharp
+// src/WinRestoreKit.Application/Modules/BackupModuleCatalog.cs (Compare/Confirm)
+public static IReadOnlyList<BackupModuleRegistration> BackupModuleCatalog.CreateAll();
+// BackupModuleRegistration exposes public BackupBase Module, string Category, string Title.
+
+// src/WinRestoreKit.Application/Orchestration/BackupRestoreOrchestrator.cs
+internal BackupRestoreOrchestrator(IRunUi ui, RunControl runControl = null);
+internal Task RunBackup(IReadOnlyList<BackupBase> modules, string destination,
+    string snapshotName, SnapshotCompression compression);
+internal Task RunRestore(IReadOnlyList<BackupBase> modules, string backupPath);
+internal string BackupOutputPath { get; private set; }
+
+// src/WinRestoreKit.Application/Results/RunSummary.cs
+internal enum RunState { Problems, Done, NothingDone, Canceled, DidNotRun }
+internal enum RunSeverity { Information, Warning, Error }
+// RunSummary retains For(IReadOnlyList<ModuleOutcome>, bool, RunVerb, string),
+// Incomplete(IReadOnlyList<ModuleOutcome>, RunVerb, string), and Canceled(RunVerb).
+// It exposes State, Severity, Headline, and Detail, maps Problems (including Incomplete)
+// and DidNotRun to Warning, and all remaining current states to Information; it contains no MessageBoxIcon.
+
+// src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs
+public object CurrentWorkspace { get; private set; }
+public string WorkflowLabel { get; private set; }
+public ICommand ShowTimelineCommand { get; }
+internal void ShowTimeline();
+internal void NavigateTo(object workspace, string workflowLabel);
+
+// src/WinRestoreKit.Wpf/Navigation/ITimelineNavigator.cs
+void OpenCompare(SnapshotPayloadPreparation preparation);
+void ShowSnapshotDiagnostic(SnapshotEvent snapshot);
+```
+
+## File Map
+
+| Path | Responsibility |
+| --- | --- |
+| `src/WinRestoreKit.Application/Backup/ScopeGroups.cs` | Framework-neutral six-scope catalog and immutable scope rows. |
+| `src/WinRestoreKit.Application/Backup/BackupPresets.cs` | Literal Developer machine and Minimal privacy-safe preset memberships. |
+| `src/WinRestoreKit.Application/Backup/BackupCompletionPublisher.cs` | Discover retained post-run event first; add session-only failed event only when discovery cannot represent the attempt. |
+| `src/WinRestoreKit.Application/AppRestore/AppRestoreService.cs` | Shared app-export source discovery from current payload plus public Timeline events, payload preparation/disposal, parsing, list state, winget outcome wording, and install loop. |
+| `src/WinRestoreKit.Wpf/ViewModels/BackupWorkspaceViewModel.cs` | Scope/preset/metadata selection and a validated, admitted backup request. |
+| `src/WinRestoreKit.Wpf/Infrastructure/AsyncDelegateCommand.cs` | Reusable non-reentrant `ICommand` that awaits view-model work and re-enables on completion. |
+| `src/WinRestoreKit.Wpf/Views/BackupWorkspaceView.xaml` | Accessible Create Snapshot selection UI; no backup policy or payload parsing. |
+| `src/WinRestoreKit.Wpf/ViewModels/ProgressWorkspaceViewModel.cs` | One admitted run's live metrics, logs, pause/cancel commands, and terminal summary. |
+| `src/WinRestoreKit.Wpf/ViewModels/ResultWorkspaceViewModel.cs` | Neutral summary/outcome rendering and return-to-Timeline command. |
+| `src/WinRestoreKit.Wpf/Services/WpfRunUi.cs` | Dispatcher-safe implementation of the neutral Application callback interface and owner-bound dialog bridge. |
+| `src/WinRestoreKit.Wpf/Services/WpfLogSink.cs` | Dispatcher-safe `ILogSink` that stops posting after disposal. |
+| `src/WinRestoreKit.Wpf/Services/WpfAppRestoreDialog.cs` | Core `AppStoreApps.RestoreDialog` registration and owner-bound WPF package-picker construction. |
+| `src/WinRestoreKit.Wpf/Views/AppRestoreDialog.xaml` and `.xaml.cs` | WPF package-picker dialog. |
+| `src/WinRestoreKit.Wpf/ViewModels/AppRestoreDialogViewModel.cs` | App-export/list/install/stop state without WPF payload or JSON parsing. |
+| `src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs`, `src/WinRestoreKit.Wpf/MainWindow.xaml` | Create Snapshot command, workspace data template, run availability, and return navigation. |
+| `src/WinRestoreKit/Views/BackupPageView.cs`, `src/WinRestoreKit/Forms/RestAppsForm.cs` | Still-runnable WinForms clients updated to consume moved shared selection/app-restore services; no duplicate logic. |
+| `src/WinRestoreKit.Tests/WpfTestHost.cs` | Foundation-owned deterministic STA/dispatcher helper reused by all WPF runtime tests. |
+| `src/WinRestoreKit.Tests/*Tests.cs` listed in each task | Focused regression, MVVM, dispatcher, dialog, and completion-publication coverage. |
+
+---
+
+### Task 1: Move shared backup-selection metadata and add completion publication
+
+**Files:**
+- Create: `src/WinRestoreKit.Application/Backup/ScopeGroups.cs`
+- Create: `src/WinRestoreKit.Application/Backup/BackupPresets.cs`
+- Create: `src/WinRestoreKit.Application/Backup/BackupCompletionPublisher.cs`
+- Modify: `src/WinRestoreKit/Views/BackupPageView.cs`
+- Modify: `src/WinRestoreKit.Tests/ScopeGroupsPrivacyTests.cs`
+- Modify: `src/WinRestoreKit.Tests/ViewDataHelperTests.cs`
+- Modify: `src/WinRestoreKit.Tests/BackupPresetsTests.cs`
+- Create: `src/WinRestoreKit.Tests/BackupCompletionPublisherTests.cs`
+
+**Interfaces:**
+- Consumes: `BackupModuleCatalog.CreateAll()`, `SnapshotEventCatalog.Read()`, `SnapshotEvent.CanonicalPath`, and `RunSummary.Detail`; neither `BackupFolders` nor a WPF-local root parser is used.
+- Produces: `public sealed class ScopeGroupRow`; `public static class ScopeGroups` with `public static IReadOnlyList<ScopeGroupRow> Build()`; `public static class BackupPresets` with `DeveloperMachine` and `MinimalPrivacySafeExclusions`; and `internal sealed class BackupCompletionPublisher` with `void Publish(string attemptedBackupPath, string displayName, RunSummary summary, DateTime created)`.
+
+- [ ] **Step 1: Write the failing scope, preset, and no-duplicate-event tests**
+
+  Move the existing pure scope/preset assertions away from `Views` and add completion-publication tests that pass the runner's exact attempted output path: create a recognized retained folder whose name deliberately differs from `Data.NowShort`, then use a fresh nonexistent attempted path for the session-only case.
+
+  ```csharp
+  [Fact]
+  public void Publish_RetainedPartialFolder_DoesNotAddSessionFailure()
+  {
+      using var isolation = new BackupRunIsolation();
+      string path = CreateRecognizedPartialFolder(isolation.DestinationRoot);
+      BackupRootRegistry.Remember(isolation.DestinationRoot);
+      var catalog = new SnapshotEventCatalog();
+      var publisher = new BackupCompletionPublisher(catalog);
+
+      publisher.Publish(path, "nightly", RunSummary.Incomplete(
+          Array.Empty<ModuleOutcome>(), RunVerb.Backup,
+          "Cancellation was requested. No further group was started."),
+          new DateTime(2026, 8, 9, 9, 0, 0));
+
+      SnapshotEvent discovered = Assert.Single(catalog.Read());
+      Assert.Equal(SnapshotEventKind.Partial, discovered.Kind);
+      Assert.Equal(Path.GetFullPath(path), discovered.CanonicalPath,
+          StringComparer.OrdinalIgnoreCase);
+  }
+
+  private static string CreateRecognizedPartialFolder(string root)
+  {
+      string path = Directory.CreateDirectory(Path.Combine(root, "snapshot-started-before-rollover")).FullName;
+      string manifest = BackupManifest.Compose(
+          new BackupBase[] { new DMouse() }, Array.Empty<ModuleResult>(),
+          new DateTime(2026, 8, 9, 9, 0, 0), "test-machine", "test-user", "test-build", "0.0.0");
+      File.WriteAllText(Path.Combine(path, BackupManifest.FileName), manifest);
+      return path;
+  }
+
+  [Fact]
+  public void Publish_NoRetainedRecognizedFolder_RecordsSessionFailureOnly()
+  {
+      var catalog = new SnapshotEventCatalog();
+      var publisher = new BackupCompletionPublisher(catalog);
+      var summary = RunSummary.For(Array.Empty<ModuleOutcome>(), false, RunVerb.Backup,
+          "the backup folder could not be created: access denied");
+
+      string attemptedPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N"),
+          "snapshot-attempted-before-rollover");
+      publisher.Publish(attemptedPath, "nightly", summary, new DateTime(2026, 8, 9, 9, 0, 0));
+
+      SnapshotEvent failure = Assert.Single(catalog.Read().Where(e => e.Kind == SnapshotEventKind.Failed));
+      Assert.Equal("nightly", failure.DisplayName);
+      Assert.Contains("could not be created", failure.DiagnosticReason, StringComparison.OrdinalIgnoreCase);
+      Assert.False(failure.IsRestorable);
+  }
+  ```
+
+  Keep the current literal expected scopes and type lists in `ViewDataHelperTests`; add assertions that `ScopeGroups.Build()` is directly importable from `WinRestoreKit`, not `Views`.
+
+- [ ] **Step 2: Run the focused tests to verify they fail before the move**
+
+  Run:
+
+  ```powershell
+  dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~ScopeGroupsPrivacyTests|FullyQualifiedName~ViewDataHelperTests|FullyQualifiedName~BackupPresetsTests|FullyQualifiedName~BackupCompletionPublisherTests"
+  ```
+
+  Expected: FAIL because Application `ScopeGroups`, `BackupPresets`, and `BackupCompletionPublisher` do not exist yet. Do not accept a failure caused by a stale `Views` import as evidence that the new behavior is covered.
+
+- [ ] **Step 3: Move the selection data without changing its membership or defaults**
+
+  Move the implementation from `Views/ScopeGroups.cs` into the Application file, change its namespace to `WinRestoreKit`, make the row/catalog callable by WPF, and construct registrations through the Compare/Confirm `BackupModuleCatalog` facade. Preserve exactly the current six definitions, test-all-modules-once guard, detail truncation, and current default/opt-in calculation:
+
+  ```csharp
+  public sealed class ScopeGroupRow
+  {
+      internal ScopeGroupRow(string name, string detail, bool defaultChecked,
+          bool requiresExplicitOptIn, string cautionNote, IReadOnlyList<BackupBase> modules)
+      {
+          Name = name;
+          Detail = detail;
+          DefaultChecked = defaultChecked;
+          RequiresExplicitOptIn = requiresExplicitOptIn;
+          CautionNote = cautionNote ?? string.Empty;
+          Modules = modules;
+      }
+
+      public string Name { get; }
+      public string Detail { get; }
+      public bool DefaultChecked { get; }
+      public bool RequiresExplicitOptIn { get; }
+      public string CautionNote { get; }
+      public IReadOnlyList<BackupBase> Modules { get; }
+  }
+
+  public static class ScopeGroups
+  {
+      private const int DetailLimit = 96;
+      private static readonly ScopeDefinition[] Definitions =
+      {
+          new("Explorer & shell", IsExplorerAndShell),
+          new("Power & devices", IsPowerAndDevices),
+          new("Fonts", static module => module is WFonts),
+          new("Network profiles", IsNetworkProfile),
+          new("Environment variables (unfiltered)", static module => module is EEnvironment,
+              true, static modules => modules.Single().WarningMessage),
+          new("App settings (AppData)", IsAppSetting)
+      };
+
+      public static IReadOnlyList<ScopeGroupRow> Build()
+      {
+          IReadOnlyList<BackupModuleRegistration> registrations = BackupModuleCatalog.CreateAll();
+          var modulesByScope = Definitions.ToDictionary(
+              definition => definition, _ => new List<BackupBase>());
+          foreach (BackupModuleRegistration registration in registrations)
+          {
+              ScopeDefinition match = null;
+              foreach (ScopeDefinition definition in Definitions)
+              {
+                  if (!definition.Includes(registration.Module))
+                      continue;
+                  if (match != null)
+                      throw new InvalidOperationException(
+                          $"Module '{registration.Module.GetType().FullName}' belongs to multiple backup scopes.");
+                  match = definition;
+              }
+              if (match == null)
+                  throw new InvalidOperationException(
+                      $"Module '{registration.Module.GetType().FullName}' has no backup scope.");
+              modulesByScope[match].Add(registration.Module);
+          }
+          return Definitions.Select(definition =>
+          {
+              IReadOnlyList<BackupBase> modules = modulesByScope[definition];
+              return new ScopeGroupRow(definition.Name,
+                  modules.Count == 0 ? "No supported items detected" : Truncate(modules[0].Info),
+                  !definition.RequiresExplicitOptIn && modules.Any(module => module.IsInstalled()),
+                  definition.RequiresExplicitOptIn,
+                  definition.CautionNoteFactory?.Invoke(modules) ?? string.Empty, modules);
+          }).ToList();
+      }
+
+      private static bool IsExplorerAndShell(BackupBase module) =>
+          module is WPersonalization or WVisualEffects or WTaskbar or WThemes or APinnedApps;
+      private static bool IsPowerAndDevices(BackupBase module) =>
+          module is WPowerPlans or DPrinters or DMouse or DKeyboard or DTouchpad;
+      private static bool IsNetworkProfile(BackupBase module) =>
+          module is WNetworkConf or WMappedDrives or CWiFiConf or EHosts;
+      private static bool IsAppSetting(BackupBase module) =>
+          module is WPrivacy or WAPrivacy or WTelemetry or WUpdates or WAccessibility or WRegional
+              or WOther or AppStoreApps or GGaming or ETerminal or EVSCode or ESsh
+              or EEnvironmentFiltered;
+      private static string Truncate(string value)
+      {
+          string singleLine = string.Join(" ", (value ?? string.Empty).Split(
+              (char[])null, StringSplitOptions.RemoveEmptyEntries));
+          return singleLine.Length <= DetailLimit ? singleLine :
+              singleLine.Substring(0, DetailLimit - 3).TrimEnd() + "...";
+      }
+
+      private sealed class ScopeDefinition
+      {
+          internal ScopeDefinition(string name, Func<BackupBase, bool> includes,
+              bool requiresExplicitOptIn = false,
+              Func<IReadOnlyList<BackupBase>, string> cautionNoteFactory = null)
+          {
+              Name = name; Includes = includes; RequiresExplicitOptIn = requiresExplicitOptIn;
+              CautionNoteFactory = cautionNoteFactory;
+          }
+          internal string Name { get; }
+          internal Func<BackupBase, bool> Includes { get; }
+          internal bool RequiresExplicitOptIn { get; }
+          internal Func<IReadOnlyList<BackupBase>, string> CautionNoteFactory { get; }
+      }
+  }
+  ```
+
+  `BackupPresets.cs` must keep these exact values and no UI dependency:
+
+  ```csharp
+  public static readonly IReadOnlyList<string> DeveloperMachine =
+      new[] { "ETerminal", "EVSCode", "ESsh", "EEnvironment", "EHosts" };
+  public static readonly IReadOnlyList<string> MinimalPrivacySafeExclusions =
+      new[] { "WUpdates", "EEnvironment", "EEnvironmentFiltered", "CWiFiConf" };
+  ```
+
+  Update `BackupPageView` to import these Application types and remove the old `Views` definitions; retain its form behavior so WinForms remains runnable. Do not leave an Application-to-WinForms forwarding shim.
+
+- [ ] **Step 4: Implement discovery-first completion publication**
+
+  Create a small Application-only publisher. It does not create files, write manifests, prune folders, or decide cleanup; those choices remain in `BackupRestoreOrchestrator`.
+
+  ```csharp
+  internal sealed class BackupCompletionPublisher
+  {
+      private readonly SnapshotEventCatalog catalog;
+
+      internal BackupCompletionPublisher(SnapshotEventCatalog catalog)
+          => this.catalog = catalog ?? throw new ArgumentNullException(nameof(catalog));
+
+      internal void Publish(string attemptedBackupPath, string displayName,
+          RunSummary summary, DateTime created)
+      {
+          string canonicalPath = TryCanonicalize(attemptedBackupPath);
+          bool retained = canonicalPath != null && catalog.Read().Any(snapshot =>
+              string.Equals(snapshot.CanonicalPath, canonicalPath,
+                  StringComparison.OrdinalIgnoreCase));
+
+          if (retained)
+              return;
+
+          string diagnostic = summary?.Detail;
+          if (string.IsNullOrWhiteSpace(diagnostic))
+              diagnostic = "The snapshot run ended without a retained recognizable result.";
+
+          catalog.RecordSessionFailure(created, displayName ?? string.Empty, diagnostic);
+      }
+
+      private static string TryCanonicalize(string path)
+      {
+          try { return Path.GetFullPath(path); }
+          catch (Exception) { return null; }
+      }
+  }
+  ```
+
+  The publisher intentionally permits a session event even if a completed summary cannot be reconciled to a recognizable folder: the UI reports the observable discrepancy rather than inventing a verified snapshot. It intentionally does *not* publish where `Read()` finds the exact attempted canonical path as `Verified`, `Partial`, `Failed`, or `Unreadable`. It never computes a folder name or calls `Data.NowShort`; cleanup remains solely the runner's existing responsibility.
+
+- [ ] **Step 5: Run the focused tests to verify the shared contracts pass**
+
+  Run the Step 2 command again.
+
+  Expected: PASS. The six scopes retain their exact order and module assignment; unfiltered environment variables remain unchecked with their source warning; preset names still resolve; retained partial output yields exactly its discovered event; missing output yields one non-restorable current-session failure without filesystem retention.
+
+- [ ] **Step 6: Commit the shared selection and completion layer**
+
+  ```powershell
+  git add src/WinRestoreKit.Application/Backup/ScopeGroups.cs src/WinRestoreKit.Application/Backup/BackupPresets.cs src/WinRestoreKit.Application/Backup/BackupCompletionPublisher.cs src/WinRestoreKit/Views/BackupPageView.cs src/WinRestoreKit.Tests/ScopeGroupsPrivacyTests.cs src/WinRestoreKit.Tests/ViewDataHelperTests.cs src/WinRestoreKit.Tests/BackupPresetsTests.cs src/WinRestoreKit.Tests/BackupCompletionPublisherTests.cs
+  git commit -m "feat: share backup selection and completion events"
+  ```
+
+### Task 2: Build the accessible WPF Create Snapshot selection workspace
+
+**Files:**
+- Create: `src/WinRestoreKit.Wpf/ViewModels/BackupRunRequest.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/BackupScopeItemViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/BackupWorkspaceViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/Infrastructure/AsyncDelegateCommand.cs`
+- Create: `src/WinRestoreKit.Wpf/Views/BackupWorkspaceView.xaml`
+- Create: `src/WinRestoreKit.Wpf/Views/BackupWorkspaceView.xaml.cs`
+- Modify: `src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj`
+- Modify: `src/WinRestoreKit.Wpf/MainWindow.xaml`
+- Create: `src/WinRestoreKit.Tests/BackupWorkspaceViewModelTests.cs`
+- Create: `src/WinRestoreKit.Tests/BackupWorkspaceViewTests.cs`
+
+**Interfaces:**
+- Consumes: Task 1's `ScopeGroups.Build()` and `BackupPresets`; Foundation `ObservableObject`, `DelegateCommand`, and `RunCoordinator`; Compare/Confirm `BackupModuleCatalog`; `SnapshotCompression` from Core; and Foundation `WpfTestHost`.
+- Produces: `internal sealed class BackupRunRequest` (`IReadOnlyList<BackupBase> Modules`, `string SnapshotName`, `SnapshotCompression Compression`, `string Destination`); `internal sealed class BackupWorkspaceViewModel`; and `internal Task StartAsync()` that invokes its supplied `Func<BackupRunRequest, Task>` only after local selection/destination validation.
+
+- [ ] **Step 1: Write failing VM and STA view tests**
+
+  Reuse Foundation's `WpfTestHost.Run(Action)` for each test that constructs a WPF control or window. It supplies the STA thread, pumps its dispatcher, propagates action failures, and shuts the dispatcher down; do not create a second helper.
+
+  Test observable selection behavior, not XAML implementation details:
+
+  ```csharp
+  [Fact]
+  public async Task StartAsync_SelectedScope_RequestsItsConcreteModulesAndFastCompression()
+  {
+      BackupRunRequest request = null;
+      var vm = new BackupWorkspaceViewModel(r => { request = r; return Task.CompletedTask; }, @"C:\snapshots");
+      foreach (BackupScopeItemViewModel scope in vm.Scopes) scope.IsSelected = false;
+      vm.Scopes.Single(s => s.Name == "Explorer & shell").IsSelected = true;
+
+      await vm.StartAsync();
+
+      Assert.Equal(SnapshotCompression.Fast, request.Compression);
+      Assert.Equal(new[] { typeof(WPersonalization), typeof(WVisualEffects), typeof(WTaskbar),
+          typeof(WThemes), typeof(APinnedApps) }, request.Modules.Select(m => m.GetType()));
+  }
+
+  [Fact]
+  public async Task StartAsync_EmptySelectionOrDestination_ShowsValidationAndDoesNotRequestRun()
+  {
+      int starts = 0;
+      var vm = new BackupWorkspaceViewModel(_ => { starts++; return Task.CompletedTask; }, "");
+      foreach (BackupScopeItemViewModel scope in vm.Scopes) scope.IsSelected = false;
+
+      await vm.StartAsync();
+
+      Assert.Equal(0, starts);
+      Assert.Equal("Select at least one scope with supported items.", vm.ValidationMessage);
+  }
+
+  [Fact]
+  public void View_ExposesScopeWarningsAndLabeledCompressionChoices()
+  {
+      WpfTestHost.Run(() =>
+      {
+          var view = new BackupWorkspaceView { DataContext = new BackupWorkspaceViewModel(_ => Task.CompletedTask, @"C:\snapshots") };
+          Assert.NotNull(view.FindName("CreateSnapshotButton"));
+          Assert.NotNull(view.FindName("CompressionComboBox"));
+      });
+  }
+  ```
+
+  Add cases that pin: the unfiltered environment scope begins unselected and exposes `CautionNote`; blank destination produces the exact destination message once there is a scope; presets use the Task 1 literal lists; `None`, `Fast`, and `Max` map directly to their enum values; module flattening is `Distinct()` while preserving catalog order.
+
+- [ ] **Step 2: Run the new selection tests to verify they fail**
+
+  Run:
+
+  ```powershell
+  dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~BackupWorkspaceViewModelTests|FullyQualifiedName~BackupWorkspaceViewTests"
+  ```
+
+  Expected: FAIL at compile time because the WPF workspace and request do not exist. `WpfTestHost` is already supplied by Foundation and must not be recreated.
+
+- [ ] **Step 3: Implement the selection VM with no backup execution policy**
+
+  Keep request composition in the VM, but leave name safety, containment, destination creation, ownership, archiving, manifest writing, and custom-root persistence exclusively in `BackupRestoreOrchestrator`.
+
+  ```csharp
+  internal sealed class BackupWorkspaceViewModel : ObservableObject
+  {
+      private readonly Func<BackupRunRequest, Task> startRunAsync;
+
+      internal BackupWorkspaceViewModel(Func<BackupRunRequest, Task> startRunAsync, string defaultDestination)
+      {
+          this.startRunAsync = startRunAsync ?? throw new ArgumentNullException(nameof(startRunAsync));
+          Destination = defaultDestination ?? string.Empty;
+          Compression = SnapshotCompression.Fast;
+          Scopes = new ObservableCollection<BackupScopeItemViewModel>(
+              ScopeGroups.Build().Select(scope => new BackupScopeItemViewModel(scope)));
+          StartCommand = new AsyncDelegateCommand(StartAsync, ex =>
+          {
+              ValidationMessage = ex.Message;
+              OnPropertyChanged(nameof(ValidationMessage));
+          });
+      }
+
+      public ObservableCollection<BackupScopeItemViewModel> Scopes { get; }
+      public IReadOnlyList<SnapshotCompression> CompressionOptions { get; } =
+          new[] { SnapshotCompression.None, SnapshotCompression.Fast, SnapshotCompression.Max };
+      public string SnapshotName { get; set; } = string.Empty;
+      public string Destination { get; set; }
+      public SnapshotCompression Compression { get; set; }
+      public string ValidationMessage { get; private set; }
+      public ICommand StartCommand { get; }
+
+      internal async Task StartAsync()
+      {
+          IReadOnlyList<BackupBase> modules = Scopes.Where(scope => scope.IsSelected)
+              .SelectMany(scope => scope.Modules).Distinct().ToArray();
+          if (modules.Count == 0)
+          {
+              ValidationMessage = "Select at least one scope with supported items.";
+              OnPropertyChanged(nameof(ValidationMessage));
+              return;
+          }
+          if (string.IsNullOrWhiteSpace(Destination))
+          {
+              ValidationMessage = "Choose a destination folder before capturing.";
+              OnPropertyChanged(nameof(ValidationMessage));
+              return;
+          }
+
+          ValidationMessage = null;
+          OnPropertyChanged(nameof(ValidationMessage));
+          await startRunAsync(new BackupRunRequest(modules, SnapshotName?.Trim() ?? string.Empty,
+              Compression, Destination.Trim()));
+      }
+  }
+  ```
+  If Foundation's `DelegateCommand` cannot await tasks, implement the following WPF-infrastructure command. Its `async void` method is the required `ICommand.Execute` boundary; it catches every task fault and is not a view click handler:
+
+  ```csharp
+  internal sealed class AsyncDelegateCommand : ICommand
+  {
+      private readonly Func<Task> executeAsync;
+      private readonly Action<Exception> reportFailure;
+      private bool executing;
+
+      internal AsyncDelegateCommand(Func<Task> executeAsync, Action<Exception> reportFailure = null)
+      {
+          this.executeAsync = executeAsync ?? throw new ArgumentNullException(nameof(executeAsync));
+          this.reportFailure = reportFailure;
+      }
+
+      public event EventHandler CanExecuteChanged;
+      public bool CanExecute(object parameter) => !executing;
+
+      public async void Execute(object parameter)
+      {
+          if (executing) return;
+          executing = true;
+          CanExecuteChanged?.Invoke(this, EventArgs.Empty);
+          try { await executeAsync(); }
+          catch (Exception ex) { reportFailure?.Invoke(ex); }
+          finally
+          {
+              executing = false;
+              CanExecuteChanged?.Invoke(this, EventArgs.Empty);
+          }
+      }
+  }
+  ```
+
+  Keep this command internal to WPF infrastructure; do not use an `async void` view click handler.
+  `BackupScopeItemViewModel` carries `Name`, `Detail`, `CautionNote`, computed `HasCaution`, `RequiresExplicitOptIn`, `IReadOnlyList<BackupBase> Modules`, and mutable `IsSelected` initialized from `DefaultChecked`. Implement commands for Select all, Clear, Developer machine, and Minimal privacy-safe by transforming the existing type-name lists through one tested `SelectModulesByTypeName`/exclusion routine; do not hard-code module type names in WPF.
+
+
+- [ ] **Step 4: Implement XAML for keyboard and automation parity**
+
+  Create a content view with the Foundation resource dictionaries and a named, labeled destination browser. Use `Microsoft.Win32.OpenFolderDialog` in code-behind only to set `Destination`; the binding and view model retain all selection state.
+
+  ```xml
+  <UserControl x:Class="WinRestoreKit.Wpf.Views.BackupWorkspaceView"
+               xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+               xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+               MinWidth="1024" AutomationProperties.Name="Create snapshot">
+    <Grid Margin="32">
+      <Grid.RowDefinitions>
+        <RowDefinition Height="Auto" />
+        <RowDefinition Height="*" />
+        <RowDefinition Height="Auto" />
+      </Grid.RowDefinitions>
+      <TextBlock Text="Create snapshot" Style="{StaticResource PageTitleText}" />
+      <ListBox Grid.Row="1" ItemsSource="{Binding Scopes}"
+               AutomationProperties.Name="Backup scopes">
+        <ListBox.ItemTemplate>
+          <DataTemplate>
+            <CheckBox IsChecked="{Binding IsSelected, Mode=TwoWay}"
+                      AutomationProperties.Name="{Binding Name}">
+              <StackPanel>
+                <TextBlock Text="{Binding Name}" />
+                <TextBlock Text="{Binding Detail}" />
+                <TextBlock Text="{Binding CautionNote}" Visibility="{Binding HasCaution, Converter={StaticResource BooleanToVisibilityConverter}}" />
+              </StackPanel>
+            </CheckBox>
+          </DataTemplate>
+        </ListBox.ItemTemplate>
+      </ListBox>
+      <StackPanel Grid.Row="2">
+        <TextBox Text="{Binding SnapshotName, UpdateSourceTrigger=PropertyChanged}"
+                 AutomationProperties.Name="Snapshot name" />
+        <DockPanel>
+          <TextBox Text="{Binding Destination, UpdateSourceTrigger=PropertyChanged}"
+                   AutomationProperties.Name="Destination folder" />
+          <Button Content="Browse" Click="BrowseDestination_Click" AutomationProperties.Name="Browse destination" />
+        </DockPanel>
+        <ComboBox x:Name="CompressionComboBox" ItemsSource="{Binding CompressionOptions}"
+                  SelectedItem="{Binding Compression}" AutomationProperties.Name="Compression" />
+        <TextBlock Text="{Binding ValidationMessage}" Foreground="{DynamicResource WarningBrush}" />
+        <Button x:Name="CreateSnapshotButton" Content="Create snapshot" Command="{Binding StartCommand}"
+                AutomationProperties.Name="Create snapshot" />
+      </StackPanel>
+    </Grid>
+  </UserControl>
+  ```
+
+  Ensure every preset action has a text label, focus order follows scope list then metadata then action, and the caution is textual (not color-only). Add a `DataTemplate` for `BackupWorkspaceViewModel` to `MainWindow.xaml`; do not add a permanent navigation rail.
+
+- [ ] **Step 5: Run the selection tests to verify they pass**
+
+  Re-run the Step 2 command.
+
+  Expected: PASS. The view constructs on an STA thread, controls have automation names, scope choices match the existing module catalog, validation blocks an empty request, and no test invokes backup I/O.
+
+- [ ] **Step 6: Commit the WPF selection workspace**
+
+  ```powershell
+  git add src/WinRestoreKit.Wpf/Infrastructure/AsyncDelegateCommand.cs src/WinRestoreKit.Wpf/ViewModels/BackupRunRequest.cs src/WinRestoreKit.Wpf/ViewModels/BackupScopeItemViewModel.cs src/WinRestoreKit.Wpf/ViewModels/BackupWorkspaceViewModel.cs src/WinRestoreKit.Wpf/Views/BackupWorkspaceView.xaml src/WinRestoreKit.Wpf/Views/BackupWorkspaceView.xaml.cs src/WinRestoreKit.Wpf/MainWindow.xaml src/WinRestoreKit.Tests/BackupWorkspaceViewModelTests.cs src/WinRestoreKit.Tests/BackupWorkspaceViewTests.cs
+  git commit -m "feat: add WPF snapshot selection"
+  ```
+
+### Task 3: Add dispatcher-safe run progress, logging, and neutral result rendering
+
+**Files:**
+- Modify: `src/WinRestoreKit.Wpf/Services/WpfRunUi.cs`
+- Modify: `src/WinRestoreKit.Wpf/Services/WpfLogSink.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/ProgressWorkspaceViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/ResultWorkspaceViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/Views/ProgressWorkspaceView.xaml`
+- Create: `src/WinRestoreKit.Wpf/Views/ProgressWorkspaceView.xaml.cs`
+- Create: `src/WinRestoreKit.Wpf/Views/ResultWorkspaceView.xaml`
+- Create: `src/WinRestoreKit.Wpf/Views/ResultWorkspaceView.xaml.cs`
+- Modify: `src/WinRestoreKit.Application/Orchestration/BackupRestoreOrchestrator.cs`
+- Modify: `src/WinRestoreKit.Tests/ArchiveProgressTests.cs`
+- Modify: `src/WinRestoreKit.Tests/BackupDestinationContainmentTests.cs`
+- Modify: `src/WinRestoreKit.Tests/BackupDestinationLifecycleTests.cs`
+- Modify: `src/WinRestoreKit.Tests/LockedPayloadBackupTests.cs`
+- Modify: `src/WinRestoreKit.Tests/RestoreConsentCancellationTests.cs`
+- Modify: `src/WinRestoreKit.Tests/SnapshotFolderPathTests.cs`
+- Create: `src/WinRestoreKit.Tests/WpfRunUiTests.cs`
+- Create: `src/WinRestoreKit.Tests/WpfLogSinkTests.cs`
+- Create: `src/WinRestoreKit.Tests/ProgressWorkspaceViewModelTests.cs`
+- Create: `src/WinRestoreKit.Tests/ResultWorkspaceViewModelTests.cs`
+- Create: `src/WinRestoreKit.Tests/BackupOutputPathTests.cs`
+
+**Interfaces:**
+
+- Consumes: Foundation `IRunUi`, `IRunPresentation`, `IRunDialogService`, `IWpfDialogService`, `WpfRunUi`, `WpfLogSink`, `BackupRestoreOrchestrator`, `RunControl`, `RunCoordinator`, `ProgressMetrics`, `RunSummary`, `RunSeverity`, Core `ILogSink`/`LogHelper`; Task 2 `BackupRunRequest`; and Compare/Confirm's owner-bound `RestoreRunDialogService`.
+- Produces: `BackupRestoreOrchestrator.BackupOutputPath` as the exact attempted output path; `internal sealed class ProgressWorkspaceViewModel : IRunPresentation` with `Task<RunSummary> RunBackupAsync(BackupRunRequest request)`, `Task<RunSummary> RunRestoreAsync(IReadOnlyList<BackupBase> modules, string backupPath)`, `IReadOnlyList<ModuleOutcome> Outcomes`, and `string AttemptedBackupPath`; `internal sealed class ResultWorkspaceViewModel`; and extended dispatcher-bound Foundation `WpfRunUi`/`WpfLogSink`.
+
+- [ ] **Step 1: Write failing tests for admission-independent presentation, dispatch, cancellation, and results**
+
+  Update every existing orchestration fake to remove `IWin32Window Owner` and supply the opaque shell owner explicitly:
+
+  ```csharp
+  public object DialogOwner => null;
+  ```
+
+  Add focused WPF tests. The late-cancel test must render a completed summary *after* requesting cancellation and prove that the result remains complete:
+
+  ```csharp
+  [Fact]
+  public void Result_CompletedSummaryAfterLateCancel_IsNotRelabeledIncomplete()
+  {
+      var control = new RunControl();
+      control.RequestCancellation();
+      RunSummary completed = RunSummary.For(new[] { SucceededOutcome() }, true, RunVerb.Backup);
+
+      ResultWorkspaceViewModel vm = ResultWorkspaceViewModel.From(completed,
+          new[] { SucceededOutcome() }, () => Task.CompletedTask);
+
+      Assert.Equal("Run complete", vm.StatusLabel);
+      Assert.DoesNotContain("canceled", vm.Headline, StringComparison.OrdinalIgnoreCase);
+      Assert.Equal(RunSeverity.Information, vm.Severity);
+  }
+
+  [Fact]
+  public void Result_IncompleteSummary_UsesItsActualCancellationWording()
+  {
+      RunSummary incomplete = RunSummary.Incomplete(Array.Empty<ModuleOutcome>(), RunVerb.Backup,
+          "Cancellation was requested. No further group was started.");
+
+      ResultWorkspaceViewModel vm = ResultWorkspaceViewModel.From(incomplete,
+          Array.Empty<ModuleOutcome>(), () => Task.CompletedTask);
+
+      Assert.Equal("Run canceled, incomplete", vm.StatusLabel);
+      Assert.Contains("canceled, run incomplete", vm.Headline, StringComparison.OrdinalIgnoreCase);
+      Assert.Equal(RunSeverity.Warning, vm.Severity);
+  }
+
+  [Fact]
+  public void LogSink_AfterDispose_DoesNotPostAnotherLogLine()
+  {
+      WpfTestHost.Run(() =>
+      {
+          var lines = new List<string>();
+          using var sink = new WpfLogSink(Dispatcher.CurrentDispatcher, lines.Add, () => lines.Clear());
+          sink.Append("before");
+          Dispatcher.CurrentDispatcher.Invoke(() => { }, DispatcherPriority.ApplicationIdle);
+          sink.Dispose();
+          sink.Append("after");
+          Dispatcher.CurrentDispatcher.Invoke(() => { }, DispatcherPriority.ApplicationIdle);
+          Assert.Equal(new[] { "before" }, lines);
+      });
+  }
+  ```
+
+  Add tests that `PauseCommand` changes only the requested boundary state and logs the exact pause/resume messages; confirmed cancellation disables pause/cancel and logs the exact active-group warning; archive progress disables cancel; a runner that returns without `ShowSummary` produces the existing did-not-run fallback; and `WpfRunUi.DialogOwner` returns the live `Window` when available and `null` when unavailable. The existing Compare/Confirm dialog-service tests remain the proof that consent and override calls fail closed without an owner.
+
+  Add `BackupOutputPathTests` for both existing backup overloads. The direct-path overload must set `BackupOutputPath` to the caller's `backupPath` before `RunBackupCore` validates/creates it. The destination overload must compute `backupPath = Path.Combine(destinationPath, Data.NowShort)`, assign that exact value to `BackupOutputPath` before `DestinationInsideSelectedSource`, and retain it even when validation produces a did-not-run summary. Use a deliberately pre-rollover-looking direct folder name in the test; assert equality to the supplied string, never a later `Data.NowShort` value.
+
+- [ ] **Step 2: Run the focused progress and adapter tests to verify they fail**
+
+  Run:
+
+  ```powershell
+  dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~WpfRunUiTests|FullyQualifiedName~WpfLogSinkTests|FullyQualifiedName~ProgressWorkspaceViewModelTests|FullyQualifiedName~ResultWorkspaceViewModelTests|FullyQualifiedName~ArchiveProgressTests|FullyQualifiedName~BackupDestinationContainmentTests|FullyQualifiedName~BackupDestinationLifecycleTests|FullyQualifiedName~BackupOutputPathTests|FullyQualifiedName~LockedPayloadBackupTests|FullyQualifiedName~RestoreConsentCancellationTests|FullyQualifiedName~SnapshotFolderPathTests"
+  ```
+
+  Expected: FAIL because `BackupOutputPath`, WPF progress/result workspaces, and the post-disposal log-sink behavior do not exist yet. The Foundation move has already replaced `Owner` with `DialogOwner`; a stale WinForms owner fake is a setup error, not evidence of this behavior.
+- [ ] **Step 3: Implement the dispatcher and dialog adapters**
+
+  Extend Foundation's existing `WpfLogSink` rather than replacing it: preserve its dispatcher-safe append/clear implementation and add the following disposed-state gate so no queued or later engine log line mutates the view after a run has ended:
+
+  ```csharp
+  internal sealed class WpfLogSink : ILogSink, IDisposable
+  {
+      private readonly Dispatcher dispatcher;
+      private readonly Action<string> append;
+      private readonly Action clear;
+      private int disposed;
+
+      internal WpfLogSink(Dispatcher dispatcher, Action<string> append, Action clear)
+      {
+          this.dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher));
+          this.append = append ?? throw new ArgumentNullException(nameof(append));
+          this.clear = clear ?? throw new ArgumentNullException(nameof(clear));
+      }
+
+      public void Append(string text) => Post(() => append(text ?? string.Empty));
+      public void Clear() => Post(clear);
+      public void Dispose() => Interlocked.Exchange(ref disposed, 1);
+
+      private void Post(Action action)
+      {
+          if (Volatile.Read(ref disposed) != 0 || dispatcher.HasShutdownStarted || dispatcher.HasShutdownFinished)
+              return;
+          try { dispatcher.BeginInvoke(() => { if (Volatile.Read(ref disposed) == 0) action(); }); }
+          catch (InvalidOperationException) { }
+      }
+  }
+  ```
+
+  `WpfRunUi` is extended with its Foundation constructor shape—`Dispatcher`, `IRunPresentation`, `IRunDialogService`, and `Func<Window> ownerProvider`—not a second adapter API. `ProgressWorkspaceViewModel` is the concrete `IRunPresentation`: its setters update bound values and `ShowSummary` stores the exact supplied `RunSummary`/outcomes before returning, so navigation cannot race a blank result page. `WpfRunUi.DialogOwner` returns the visible, non-closing `Window` or `null`; it does not call the app-reinstall UI itself. Fire-and-forget presentation setters use `BeginInvoke`; callbacks requiring a result and `ShowSummary` use `Dispatcher.Invoke`. It forwards dialog calls only through the supplied `IRunDialogService`, whose concrete shell implementation owns fail-closed modal behavior.
+  The owner-bound `IRunDialogService` is Compare/Confirm's `RestoreRunDialogService`; do not create another dialog interface, owner protocol, consent dialog, or snapshot-override implementation here. This task only consumes the already composed service when `RunRestoreAsync` is invoked; Compare/Confirm owns its owner validation and fail-closed behavior.
+
+  Render `RunSeverity` in the WPF service/resource layer; no `MessageBoxIcon` appears in Application, WPF VM, or XAML.
+
+- [ ] **Step 4: Implement the run VM and XAML views**
+
+  Create exactly one `RunControl` and `BackupRestoreOrchestrator` per progress VM. The caller owns admission: this VM never calls `TryStart`, `SetRunning(true)`, or `SetRunning(false)`. It always copies `runner.BackupOutputPath` to `AttemptedBackupPath`, clears the global log sink in `finally`, and returns the terminal summary to its caller.
+
+
+  ```csharp
+  internal string BackupOutputPath { get; private set; }
+
+  internal Task RunBackup(IReadOnlyList<BackupBase> selection, string backupPath)
+  {
+      BackupOutputPath = backupPath;
+      return RunBackupCore(selection, backupPath, null, SnapshotCompression, null);
+  }
+
+  internal Task RunBackup(IReadOnlyList<BackupBase> selection, string destinationPath,
+      string snapshotName, SnapshotCompression compression)
+  {
+      if (!BackupNaming.TryValidateCustomName(snapshotName, out string safeSnapshotName))
+      {
+          ui.ShowSummary(RunSummary.For(new List<ModuleOutcome>(), false, RunVerb.Backup,
+              "the snapshot name is not a safe single folder name"), "Backup",
+              new List<ModuleOutcome>());
+          return Task.CompletedTask;
+      }
+      if (!IsKnownCompression(compression))
+      {
+          ui.ShowSummary(RunSummary.For(new List<ModuleOutcome>(), false, RunVerb.Backup,
+              "the selected compression mode is not supported"), "Backup",
+              new List<ModuleOutcome>());
+          return Task.CompletedTask;
+      }
+      if (string.IsNullOrWhiteSpace(destinationPath))
+      {
+          ui.ShowSummary(RunSummary.For(new List<ModuleOutcome>(), false, RunVerb.Backup,
+              "the backup destination is empty"), "Backup", new List<ModuleOutcome>());
+          return Task.CompletedTask;
+      }
+
+      SnapshotCompression = compression;
+      string backupPath = Path.Combine(destinationPath, Data.NowShort);
+      BackupOutputPath = backupPath;
+      if (DestinationInsideSelectedSource(backupPath, selection, out string containingSource))
+      {
+          ui.ShowSummary(RunSummary.For(new List<ModuleOutcome>(), false, RunVerb.Backup,
+              "the chosen destination is inside a folder this backup would copy (" + containingSource
+              + "), which would copy the backup into itself; choose a destination outside the "
+              + "folders being backed up"), "Backup", new List<ModuleOutcome>());
+          return Task.CompletedTask;
+      }
+      return RunBackupCore(selection, backupPath, safeSnapshotName, compression, destinationPath);
+  }
+  ```
+
+  Construct each `ProgressWorkspaceViewModel` with the live WPF `Dispatcher`, `Func<Window> ownerProvider`, Compare/Confirm's `IRunDialogService`, and Foundation `IWpfDialogService`. When it starts an already admitted run, it creates exactly one `RunControl`, `WpfRunUi(dispatcher, this, runDialogService, ownerProvider)`, `BackupRestoreOrchestrator`, and `WpfLogSink`; it never calls `RunCoordinator.TryStart`, `SetRunning`, or navigates the shell. Its owner passes that factory/dispatcher in production and a deterministic test factory in VM tests.
+
+  ```csharp
+  internal async Task<RunSummary> RunBackupAsync(BackupRunRequest request)
+  {
+      LogHelper.Instance.SetSink(logSink);
+      sinkInstalled = true;
+      SetProgressText("Started snapshot " + request.SnapshotName + ".");
+      try
+      {
+          await runner.RunBackup(request.Modules, request.Destination,
+              request.SnapshotName, request.Compression);
+          if (summary == null)
+              SetSummary(RunSummary.For(Array.Empty<ModuleOutcome>(), false, RunVerb.Backup,
+                  "the backup runner returned without a result"), Array.Empty<ModuleOutcome>());
+          return summary;
+      }
+      catch (Exception ex)
+      {
+          SetSummary(RunSummary.For(Array.Empty<ModuleOutcome>(), false, RunVerb.Backup, ex.Message),
+              Array.Empty<ModuleOutcome>());
+          return summary;
+      }
+      finally
+      {
+          AttemptedBackupPath = runner.BackupOutputPath;
+          if (sinkInstalled) LogHelper.Instance.SetSink(null);
+          sinkInstalled = false;
+          logSink.Dispose();
+      }
+  }
+  ```
+
+  The restore overload follows the same lifecycle with `runner.RunRestore`; it reuses `WpfRunUi` for the Compare/Confirm plan and must not create its own restore gates. `PauseCommand` toggles only `RunControl.Pause/Resume`; its log text is exactly `Run paused. The active group will finish before pausing.` or `Run resumed. The next group may start.`. `CancelCommand` asks through Foundation's already owner-bound `IWpfDialogService.Confirm` with the existing accurate warning, then calls `RequestCancellation`, disables pause/cancel, and appends `Cancellation requested. The active group will finish before cancellation.`.
+
+  ```xml
+  <!-- ProgressWorkspaceView.xaml -->
+  <UserControl x:Class="WinRestoreKit.Wpf.Views.ProgressWorkspaceView"
+               xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+               xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
+    <Grid Margin="32">
+      <Grid.RowDefinitions><RowDefinition Height="Auto"/><RowDefinition Height="Auto"/><RowDefinition Height="*"/><RowDefinition Height="Auto"/></Grid.RowDefinitions>
+      <TextBlock Text="{Binding ProgressText}" AutomationProperties.Name="Snapshot progress status" />
+      <ProgressBar Grid.Row="1" Minimum="0" Maximum="100" Value="{Binding Percent}"
+                   AutomationProperties.Name="Snapshot progress percentage" />
+      <ListBox Grid.Row="2" ItemsSource="{Binding LogLines}" AutomationProperties.Name="Snapshot run log" />
+      <StackPanel Grid.Row="3" Orientation="Horizontal" HorizontalAlignment="Right">
+        <Button Content="{Binding PauseCaption}" Command="{Binding PauseCommand}" AutomationProperties.Name="Pause or resume snapshot" />
+        <Button Content="Cancel" Command="{Binding CancelCommand}" AutomationProperties.Name="Cancel snapshot" />
+      </StackPanel>
+    </Grid>
+  </UserControl>
+
+  <!-- ResultWorkspaceView.xaml -->
+  <UserControl x:Class="WinRestoreKit.Wpf.Views.ResultWorkspaceView"
+               xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+               xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
+    <StackPanel Margin="32">
+      <TextBlock Text="{Binding SeverityText}" AutomationProperties.Name="Run severity" />
+      <TextBlock Text="{Binding Headline}" Style="{StaticResource PageTitleText}" />
+      <TextBlock Text="{Binding Detail}" TextWrapping="Wrap" />
+      <ListBox ItemsSource="{Binding Outcomes}" AutomationProperties.Name="Module outcomes" />
+      <Button Content="Back to Timeline" Command="{Binding ReturnToTimelineCommand}"
+              AutomationProperties.Name="Back to Timeline" />
+    </StackPanel>
+  </UserControl>
+  ```
+  `ResultWorkspaceViewModel.From` derives `StatusLabel`, `Headline`, `Detail`, `Severity`, and outcome rows solely from the passed summary/outcomes. It accepts a `Func<Task>` return action and exposes it through an `AsyncDelegateCommand`. Its only special labels are exact facts already encoded in the summary: `Run canceled, no changes` for `RunState.Canceled`; `Run canceled, incomplete` for the `RunSummary.Incomplete` headline; otherwise `Run complete`. It never reads `RunControl`.
+
+  Bind progress to text, percent, elapsed/remaining, throughput, bytes, error/warning counts, an `ObservableCollection<LogLineViewModel>`, and Pause/Cancel commands. Bind results to the neutral severity icon/text, headline/detail, module outcome list, and a text-labeled `Back to Timeline` command. Give every actionable control and live log panel an AutomationProperties name. Do not replace the workspace with a giant failure banner.
+
+- [ ] **Step 5: Run the focused tests to verify the adapters and result behavior pass**
+
+  Re-run the Step 2 command.
+
+  Expected: PASS. Orchestrator regression tests compile against the `IRunUi` opaque `DialogOwner` contract with no Windows Forms type; dispatcher callbacks do not update after disposal; pause/cancel retain boundary-only wording; archive disables cancellation; summary severity/writing is neutral; a late cancellation cannot rewrite a completed outcome.
+
+- [ ] **Step 6: Commit progress, logging, and result rendering**
+
+  ```powershell
+  git add src/WinRestoreKit.Application/Orchestration/BackupRestoreOrchestrator.cs src/WinRestoreKit.Wpf/Services/WpfRunUi.cs src/WinRestoreKit.Wpf/Services/WpfLogSink.cs src/WinRestoreKit.Wpf/ViewModels/ProgressWorkspaceViewModel.cs src/WinRestoreKit.Wpf/ViewModels/ResultWorkspaceViewModel.cs src/WinRestoreKit.Wpf/Views/ProgressWorkspaceView.xaml src/WinRestoreKit.Wpf/Views/ProgressWorkspaceView.xaml.cs src/WinRestoreKit.Wpf/Views/ResultWorkspaceView.xaml src/WinRestoreKit.Wpf/Views/ResultWorkspaceView.xaml.cs src/WinRestoreKit.Tests/ArchiveProgressTests.cs src/WinRestoreKit.Tests/BackupDestinationContainmentTests.cs src/WinRestoreKit.Tests/BackupDestinationLifecycleTests.cs src/WinRestoreKit.Tests/BackupOutputPathTests.cs src/WinRestoreKit.Tests/LockedPayloadBackupTests.cs src/WinRestoreKit.Tests/RestoreConsentCancellationTests.cs src/WinRestoreKit.Tests/SnapshotFolderPathTests.cs src/WinRestoreKit.Tests/WpfRunUiTests.cs src/WinRestoreKit.Tests/WpfLogSinkTests.cs src/WinRestoreKit.Tests/ProgressWorkspaceViewModelTests.cs src/WinRestoreKit.Tests/ResultWorkspaceViewModelTests.cs
+  git commit -m "feat: add WPF run progress and results"
+  ```
+
+### Task 4: Port the app-reinstall dialog behind the WPF owner boundary
+
+**Files:**
+- Create: `src/WinRestoreKit.Application/AppRestore/AppRestoreService.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/WpfAppRestoreDialog.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/AppRestoreDialogViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/Views/AppRestoreDialog.xaml`
+- Create: `src/WinRestoreKit.Wpf/Views/AppRestoreDialog.xaml.cs`
+- Modify: `src/WinRestoreKit/Forms/RestAppsForm.cs`
+- Modify: `src/WinRestoreKit.Tests/AppRestoreDialogTests.cs`
+- Modify: `src/WinRestoreKit.Tests/RestoreDialogOwnerTests.cs`
+- Modify: `src/WinRestoreKit.Tests/ModuleShapeTests.cs`
+- Create: `src/WinRestoreKit.Tests/WpfAppRestoreDialogTests.cs`
+
+**Interfaces:**
+- Consumes: Foundation's opaque `IRunUi.DialogOwner`; Core `AppStoreApps.RestoreDialog`, `AppStoreApps.ExportPathIn`, `BackupPayload.TryPrepareForRead`, `BackupPayload.ReadScope`, `Utils.RunWingetAsync`, and `ProcessOutcome`; Timeline `SnapshotEventCatalog.Read()` and public `SnapshotEvent`.
+- Produces: `internal enum AppExportState { Ok, Absent, Unreadable }`; immutable internal `AppRestoreSource`, `AppExport`, `AppRestoreListState`, and `AppRestoreOutcome`; `internal static class AppRestoreService` with `BuildSources(string selectedRestorePath, IReadOnlyList<SnapshotEvent> snapshots)`, `ReadFromSource(string sourcePath)`, `ComposeListState(AppExport export)`, and `InstallAsync(IReadOnlyList<string> packageIdentifiers, Func<bool> stopRequested)`; and an internal WPF registration that assigns Core's existing `AppStoreApps.RestoreDialog`.
+
+- [ ] **Step 1: Write failing tests for the shared app-restore contract and WPF ownership**
+
+  Move the current pure tests for source order/deduplication, absent versus unreadable export, package parsing, list enablement, winget outcome description, and stopped/failed wording from `RestAppsForm` nested types to `AppRestoreService`. Keep the current assertions that an empty package list is `Ok`, a missing `Packages` array is unreadable, blank package identifiers are omitted, and a `ProcessOutcome.OutcomeUnknown` is never described as never started. Add a catalog-source test: the selected payload remains first, a later `Verified`/`Partial` event is added in catalog order, and `Failed`/`Unreadable` events or duplicate canonical paths do not become app-restore sources.
+
+  Test the WPF Core callback without a modal window by injecting its show action:
+
+  ```csharp
+  [Fact]
+  public void RestoreDialogCallback_PassesTheWpfWindowAndPreparedPath()
+  {
+      WpfTestHost.Run(() =>
+      {
+          var owner = new Window();
+          owner.Show();
+          Window receivedOwner = null;
+          string receivedPath = null;
+          Action<string, object> callback = WpfAppRestoreDialog.CreateCallback(
+              (actualOwner, path) => { receivedOwner = actualOwner; receivedPath = path; });
+
+          try
+          {
+              callback(@"C:\prepared", owner);
+              Assert.Same(owner, receivedOwner);
+              Assert.Equal(@"C:\prepared", receivedPath);
+          }
+          finally
+          {
+              owner.Close();
+          }
+      });
+  }
+
+  [Fact]
+  public void RestoreDialogCallback_WithoutWpfOwner_DoesNotOpenDialog()
+  {
+      Action<string, object> callback = WpfAppRestoreDialog.CreateCallback((_, _) =>
+          throw new Xunit.Sdk.XunitException("must not open"));
+      callback(@"C:\prepared", new object());
+  }
+  ```
+  Also assert that a newly constructed but hidden WPF `Window` does not invoke the show action; only a loaded, visible WPF owner may open the modal dialog.
+
+  Add a compressed-source test proving `ReadFromSource` disposes its private `BackupPayload.ReadScope` after copying package identifiers into the immutable result. Add an internal-service test whose fake installer requests stop after one package and expects `Stopped after 1 of 2 app(s). The remaining 1 were not started.`; do not kill an in-flight winget process.
+
+- [ ] **Step 2: Run the app-restore tests to verify they fail**
+
+  Run:
+
+  ```powershell
+  dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~AppRestoreDialogTests|FullyQualifiedName~RestoreDialogOwnerTests|FullyQualifiedName~ModuleShapeTests|FullyQualifiedName~WpfAppRestoreDialogTests"
+  ```
+
+  Expected: FAIL because the Application app-restore service and WPF owner port do not exist; existing tests still name the WinForms nested helper types.
+
+- [ ] **Step 3: Move all non-UI app-restore behavior into Application**
+
+  Create immutable WPF-safe data contracts and move the current `RestAppsForm` parsing, source-deduplication, list-enable, problem-routing, winget-description, and outcome-composition logic into this one Application service. Its internal entry points expose no `ProcessOutcome` or payload scope; the one installer overload that accepts a process delegate remains internal solely for the Application friend test assembly to cover all outcome branches deterministically:
+
+  ```csharp
+  internal enum AppExportState { Ok, Absent, Unreadable }
+
+  internal enum AppRestoreProblemRouting { None, ShowNow, Defer }
+
+  internal sealed class AppRestoreSource
+  {
+      internal AppRestoreSource(string path, string displayName, bool isSelectedRestoreSource)
+      {
+          Path = path ?? string.Empty;
+          DisplayName = displayName ?? string.Empty;
+          IsSelectedRestoreSource = isSelectedRestoreSource;
+      }
+      public string Path { get; }
+      public string DisplayName { get; }
+      public bool IsSelectedRestoreSource { get; }
+  }
+
+  internal sealed class AppExport
+  {
+      private AppExport(AppExportState state, IReadOnlyList<string> packageIdentifiers, string message)
+      {
+          State = state;
+          PackageIdentifiers = packageIdentifiers ?? Array.Empty<string>();
+          Message = message ?? string.Empty;
+      }
+      internal AppExportState State { get; }
+      internal IReadOnlyList<string> PackageIdentifiers { get; }
+      internal string Message { get; }
+      internal bool IsProblem => State == AppExportState.Unreadable;
+      internal static AppExport Ok(IReadOnlyList<string> ids, string message) => new(AppExportState.Ok, ids, message);
+      internal static AppExport Absent(string message) => new(AppExportState.Absent, null, message);
+      internal static AppExport Unreadable(string message) => new(AppExportState.Unreadable, null, message);
+  }
+
+  internal sealed class AppRestoreListState
+  {
+      internal AppRestoreListState(IReadOnlyList<string> items, bool installEnabled)
+      {
+          Items = items ?? Array.Empty<string>();
+          InstallEnabled = installEnabled;
+      }
+      internal IReadOnlyList<string> Items { get; }
+      internal bool InstallEnabled { get; }
+  }
+
+  internal sealed class AppRestoreOutcome
+  {
+      internal AppRestoreOutcome(string caption, string text, RunSeverity severity)
+          => (Caption, Text, Severity) = (caption ?? string.Empty, text ?? string.Empty, severity);
+      internal string Caption { get; }
+      internal string Text { get; }
+      internal RunSeverity Severity { get; }
+  }
+
+  internal static class AppRestoreService
+  {
+      internal static IReadOnlyList<AppRestoreSource> BuildSources(
+          string selectedRestorePath, IReadOnlyList<SnapshotEvent> snapshots)
+      {
+          var sources = new List<AppRestoreSource>();
+          AddDistinct(sources, selectedRestorePath, "Selected restore source", true);
+          foreach (SnapshotEvent snapshot in snapshots ?? Array.Empty<SnapshotEvent>())
+          {
+              if (!snapshot.IsRestorable)
+                  continue;
+              AddDistinct(sources, snapshot.CanonicalPath, snapshot.DisplayName, false);
+          }
+          return sources;
+      }
+
+      private static void AddDistinct(List<AppRestoreSource> sources, string path,
+          string displayName, bool isSelectedRestoreSource)
+      {
+          if (string.IsNullOrWhiteSpace(path))
+              return;
+          string canonicalPath;
+          try { canonicalPath = Path.GetFullPath(path); }
+          catch (Exception) { return; }
+          if (sources.Any(source => string.Equals(source.Path, canonicalPath,
+              StringComparison.OrdinalIgnoreCase)))
+              return;
+          sources.Add(new AppRestoreSource(canonicalPath, displayName, isSelectedRestoreSource));
+      }
+
+      internal static AppRestoreListState ComposeListState(AppExport export) =>
+          export == null
+              ? new AppRestoreListState(null, false)
+              : new AppRestoreListState(export.PackageIdentifiers,
+                  export.PackageIdentifiers.Count > 0);
+
+      internal static AppRestoreProblemRouting RouteProblem(AppExport export, bool windowShown)
+      {
+          if (export == null || !export.IsProblem)
+              return AppRestoreProblemRouting.None;
+          return windowShown ? AppRestoreProblemRouting.ShowNow : AppRestoreProblemRouting.Defer;
+      }
+
+      internal static AppExport ReadFromSource(string sourcePath)
+      {
+          if (!BackupPayload.TryPrepareForRead(sourcePath, out BackupPayload.ReadScope scope, out string error))
+              return AppExport.Unreadable("Could not prepare the app export source: " + error);
+          using (scope)
+              return ReadExport(AppStoreApps.ExportPathIn(scope.Path));
+      }
+
+      internal static Task<AppRestoreOutcome> InstallAsync(
+          IReadOnlyList<string> packageIdentifiers, Func<bool> stopRequested)
+          => InstallAsync(packageIdentifiers, id => Utils.RunWingetAsync(true, "install",
+              "--id", id, "--accept-source-agreements", "--accept-package-agreements"), stopRequested);
+
+      internal static async Task<AppRestoreOutcome> InstallAsync(
+          IReadOnlyList<string> packageIdentifiers,
+          Func<string, Task<ProcessOutcome>> installOneAsync, Func<bool> stopRequested)
+      {
+          string[] requested = (packageIdentifiers ?? Array.Empty<string>())
+              .Where(id => !string.IsNullOrWhiteSpace(id)).ToArray();
+          var failures = new List<string>();
+          int attempted = 0;
+
+          foreach (string id in requested)
+          {
+              if (stopRequested?.Invoke() == true)
+                  break;
+              attempted++;
+              string reason = Describe(await installOneAsync(id));
+              if (reason != null)
+                  failures.Add(id + ": " + reason);
+          }
+
+          return ComposeOutcome(requested.Length, attempted, failures);
+      }
+  }
+  ```
+  Move `RestAppsForm.AppExport.Read` and `Parse` verbatim in behavior into `ReadFromSource`: only `FileNotFoundException` maps to `Absent`; every other read failure maps to `Unreadable`; empty JSON, malformed JSON, or a missing `Sources[0].Packages` array maps to `Unreadable`; nonblank `PackageIdentifier` values stay in file order. `ComposeListState` enables installation only when there is at least one identifier. `Describe` and `ComposeOutcome` retain the existing exact wording, but `AppRestoreOutcome` carries `Caption`, `Text`, and `RunSeverity` instead of `MessageBoxIcon`: no selected apps, stopped-without-failures, and complete installs are `Information`; stopped-with-failures and completed failures are `Warning`.
+
+  Update `RestAppsForm` to consume this service for source list (passing `new SnapshotEventCatalog().Read()`), parser/list state, descriptions, and final outcome. Retain its WinForms presentation and user-close behavior; leave `Program.RegisterUiSeams()` as the WinForms-specific `AppStoreApps.RestoreDialog` registration that opens the form. Delete the form's nested business types and helper copies. Application orchestration remains UI-agnostic and forwards only `IRunUi.DialogOwner` to Core's existing `AppStoreApps.RestoreAsync`.
+
+- [ ] **Step 4: Implement the owner-bound WPF dialog**
+
+  Register the WPF shell callback once while composing the app-lifetime `SnapshotEventCatalog`, before any restore can be admitted. It retains Core's established `Action<string, object>` seam, rejects non-WPF owners, and invokes its modal dialog on the owner dispatcher:
+
+  ```csharp
+  internal sealed class WpfAppRestoreDialog
+  {
+      private readonly SnapshotEventCatalog catalog;
+
+      internal WpfAppRestoreDialog(SnapshotEventCatalog catalog)
+          => this.catalog = catalog ?? throw new ArgumentNullException(nameof(catalog));
+
+      internal static void Register(SnapshotEventCatalog catalog)
+      {
+          var dialog = new WpfAppRestoreDialog(catalog);
+          AppStoreApps.RestoreDialog = CreateCallback(dialog.Show);
+      }
+
+      internal static Action<string, object> CreateCallback(Action<Window, string> show)
+      {
+          return (path, owner) =>
+          {
+              if (owner is not Window window || !window.IsLoaded || !window.IsVisible ||
+                  window.Dispatcher.HasShutdownStarted || window.Dispatcher.HasShutdownFinished)
+                  return;
+              Action open = () => show(window, path);
+              if (window.Dispatcher.CheckAccess()) open();
+              else window.Dispatcher.Invoke(open);
+          };
+      }
+
+      internal void Show(Window owner, string payloadPath)
+      {
+          var dialog = new AppRestoreDialog(payloadPath, catalog.Read()) { Owner = owner };
+          dialog.ShowDialog();
+      }
+  }
+  ```
+
+  `AppRestoreDialog` has `ShowInTaskbar="False"` and `WindowStartupLocation="CenterOwner"`. Its VM calls `AppRestoreService.BuildSources(payloadPath, snapshots)` and `ReadFromSource`; it receives only `AppRestoreSource`/immutable parsed values and never reads JSON, archives, registry keys, or `BackupFolders`. The dialog shows selected restore source first, a labeled source chooser, checkbox package rows, `Install selected apps`, and a text-labeled cancel/stop action. During install it disables source/package/install controls. Stop sets the VM flag, changes the action to the exact `Stopping after the current app (or its timeout)`, and lets the Application service finish the active package before the next boundary. A user-requested close while installing requests the same stop and defers close until the loop completes; dispatcher shutdown or owner teardown is never vetoed. Owner-bound unreadable-export/final outcome dialogs use the visible app-restore window; if it is no longer visible, append the message to `LogHelper` instead.
+
+  ```xml
+  <Window x:Class="WinRestoreKit.Wpf.Views.AppRestoreDialog"
+          ShowInTaskbar="False" WindowStartupLocation="CenterOwner"
+          Title="Reinstall apps" AutomationProperties.Name="Reinstall apps">
+    <Grid Margin="24">
+      <Grid.RowDefinitions><RowDefinition Height="Auto"/><RowDefinition Height="*"/><RowDefinition Height="Auto"/></Grid.RowDefinitions>
+      <ComboBox ItemsSource="{Binding Sources}" SelectedItem="{Binding SelectedSource}"
+                DisplayMemberPath="DisplayName" AutomationProperties.Name="App backup source" />
+      <ListBox Grid.Row="1" ItemsSource="{Binding Packages}" AutomationProperties.Name="Apps to install">
+        <ListBox.ItemTemplate>
+          <DataTemplate><CheckBox Content="{Binding Identifier}" IsChecked="{Binding IsSelected, Mode=TwoWay}" /></DataTemplate>
+        </ListBox.ItemTemplate>
+      </ListBox>
+      <StackPanel Grid.Row="2" Orientation="Horizontal" HorizontalAlignment="Right">
+        <Button Content="Install selected apps" Command="{Binding InstallCommand}" />
+        <Button Content="{Binding StopCaption}" Command="{Binding StopOrCloseCommand}" />
+      </StackPanel>
+    </Grid>
+  </Window>
+  ```
+
+- [ ] **Step 5: Run the app-restore tests to verify they pass**
+
+  Re-run the Step 2 command.
+
+  Expected: PASS. Existing parser/winget facts are preserved in Application, compressed source preparation disposes its temporary scope, only a WPF `Window` owner invokes the registered Core callback, the callback preserves that owner and prepared path, and stop wording remains honest about work not started.
+
+- [ ] **Step 6: Commit the app-restore dialog port**
+
+  ```powershell
+  git add src/WinRestoreKit.Application/AppRestore/AppRestoreService.cs src/WinRestoreKit.Wpf/Services/WpfAppRestoreDialog.cs src/WinRestoreKit.Wpf/ViewModels/AppRestoreDialogViewModel.cs src/WinRestoreKit.Wpf/Views/AppRestoreDialog.xaml src/WinRestoreKit.Wpf/Views/AppRestoreDialog.xaml.cs src/WinRestoreKit/Forms/RestAppsForm.cs src/WinRestoreKit.Tests/AppRestoreDialogTests.cs src/WinRestoreKit.Tests/RestoreDialogOwnerTests.cs src/WinRestoreKit.Tests/ModuleShapeTests.cs src/WinRestoreKit.Tests/WpfAppRestoreDialogTests.cs
+  git commit -m "feat: port app restore dialog to WPF"
+  ```
+
+### Task 5: Wire Create Snapshot through admission, results, event publication, and Timeline return
+
+**Files:**
+- Modify: `src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs`
+- Modify: `src/WinRestoreKit.Wpf/MainWindow.xaml`
+- Modify: `src/WinRestoreKit.Wpf/ViewModels/BackupWorkspaceViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/BackupRunCompletion.cs`
+- Create: `src/WinRestoreKit.Tests/ShellBackupFlowTests.cs`
+- Create: `src/WinRestoreKit.Tests/BackupResultTimelinePublicationTests.cs`
+- Modify: `src/WinRestoreKit.Tests/RunCoordinatorTests.cs`
+- Modify: `src/WinRestoreKit.Tests/ProgressPageViewTests.cs`
+
+**Interfaces:**
+- Consumes: Tasks 1–4; Foundation `ShellViewModel.NavigateTo`, `ShowTimeline`, `RunCoordinator`; Timeline `SnapshotEventCatalog` and `TimelineViewModel.RefreshAsync(CancellationToken)`; no new competing global navigation service.
+- Produces: `internal sealed class BackupRunCompletion` (`RunSummary Summary`, `IReadOnlyList<ModuleOutcome> Outcomes`, `string AttemptedBackupPath`); a testable `Func<BackupRunRequest, Task<BackupRunCompletion>>` shell seam; and the end-to-end `Create snapshot → BackupWorkspaceViewModel → ProgressWorkspaceViewModel → ResultWorkspaceViewModel → refreshed Timeline` sequence.
+
+- [ ] **Step 1: Write failing host-flow and publication tests**
+
+  Test atomic admission and navigation without executing a real backup by supplying the shell's explicit run delegate:
+
+  ```csharp
+  [Fact]
+  public async Task CreateSnapshot_AdmitsOneRun_ShowsResult_ThenRefreshesTimeline()
+  {
+      using var isolation = new BackupRunIsolation();
+      BackupRootRegistry.Remember(isolation.DestinationRoot);
+      RunCoordinator.SetRunning(false);
+      int refreshes = 0;
+      RunSummary summary = RunSummary.For(new[] { SucceededOutcome() }, true, RunVerb.Backup);
+      var shell = ShellViewModel.ForTest(
+          _ => Task.FromResult(new BackupRunCompletion(summary, new[] { SucceededOutcome() },
+              @"C:\snapshots\snapshot-started-before-rollover")),
+          new SnapshotEventCatalog(),
+          () => { refreshes++; return Task.CompletedTask; });
+
+      shell.CreateSnapshotCommand.Execute(null);
+      var selection = Assert.IsType<BackupWorkspaceViewModel>(shell.CurrentWorkspace);
+      await selection.StartAsync();
+
+      Assert.IsType<ResultWorkspaceViewModel>(shell.CurrentWorkspace);
+      Assert.False(RunCoordinator.IsRunning);
+      Assert.Equal(1, refreshes);
+      ((ResultWorkspaceViewModel)shell.CurrentWorkspace).ReturnToTimelineCommand.Execute(null);
+      Assert.Equal(1, refreshes);
+  }
+  ```
+
+  Add a second concurrent-start test that pre-sets `RunCoordinator` true, invokes `StartAsync`, and proves the workspace remains selection, no log sink/run factory is used, and its visible message is `Another backup or restore is already running.`. Add a completion-publication test for a canceled-new-folder cleanup: after the runner's `Incomplete` summary and no retained recognized path, the Timeline read contains one current-session non-restorable `Failed` event; when the retained path is discovered as Partial, only the persisted Partial event exists.
+
+  Retain the old `ProgressPageViewTests` while WinForms is still present, but migrate their `IRunUi` fakes to Foundation's opaque `DialogOwner` contract. The equivalent new tests are the WPF result/view-model tests from Task 3; do not delete the WinForms construction test in this phase.
+
+- [ ] **Step 2: Run the host-flow tests to verify they fail**
+
+  Run:
+
+  ```powershell
+  dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~ShellBackupFlowTests|FullyQualifiedName~BackupResultTimelinePublicationTests|FullyQualifiedName~RunCoordinatorTests|FullyQualifiedName~ProgressPageViewTests"
+  ```
+
+  Expected: FAIL because `CreateSnapshotCommand` has not been wired, no injected run seam is available for the test, and Timeline is not refreshed/published after result completion.
+
+- [ ] **Step 3: Add the one WPF backup flow to ShellViewModel**
+
+  Add a real command to the compact top bar; it is unavailable while a run is active. Opening the selection workspace is not run admission. The start callback performs the only admission attempt and owns release in one `finally`:
+
+  ```csharp
+  private async Task StartBackupAsync(BackupRunRequest request)
+  {
+      if (!RunCoordinator.TryStart())
+      {
+          backupWorkspace?.ReportAdmissionRejected("Another backup or restore is already running.");
+          return;
+      }
+
+      BackupRunCompletion completion;
+      try
+      {
+          completion = await runBackupAsync(request);
+      }
+      finally
+      {
+          RunCoordinator.SetRunning(false);
+      }
+
+      completionPublisher.Publish(completion.AttemptedBackupPath, request.SnapshotName,
+          completion.Summary, DateTime.Now);
+      await timelineWorkspace.RefreshAsync();
+      NavigateTo(new ResultWorkspaceViewModel(completion.Summary, completion.Outcomes,
+          ReturnToTimelineAsync), "Snapshot result");
+  }
+
+  private async Task<BackupRunCompletion> RunWpfBackupAsync(BackupRunRequest request)
+  {
+      var progress = new ProgressWorkspaceViewModel(dispatcher, ownerProvider,
+          runDialogService, dialogs);
+      NavigateTo(progress, "Creating snapshot");
+      RunSummary summary = await progress.RunBackupAsync(request);
+      return new BackupRunCompletion(summary, progress.Outcomes, progress.AttemptedBackupPath);
+  }
+
+  private Task ReturnToTimelineAsync()
+  {
+      ShowTimeline();
+      return Task.CompletedTask;
+  }
+  ```
+
+  In the production `ShellViewModel` composition constructor, create the one app-lifetime `SnapshotEventCatalog`, call `WpfAppRestoreDialog.Register(snapshotEventCatalog)` before accepting restore navigation, then initialize `runBackupAsync` to `RunWpfBackupAsync`. Its internal `ForTest` constructor accepts the run delegate and async Timeline-refresh delegate without registering the Core static callback, so host-flow tests have no disk or WPF-window dependency. `RunCoordinator.RunningChanged` marshals through the WPF dispatcher before it calls `CreateSnapshotCommand.RaiseCanExecuteChanged()`; inactive presentation is a convenience, never race prevention.
+
+  Add `CreateSnapshotCommand` to `MainWindow.xaml`'s top command bar with text and an automation name. It must open only the selection page—not start writes—and must not introduce a permanent sidebar.
+
+- [ ] **Step 4: Publish and return without retaining output or inventing snapshot state**
+
+  Call Task 1's publisher once per terminal backup before showing results, passing `completion.AttemptedBackupPath` copied from the runner's `BackupOutputPath`. The publisher canonicalizes that exact attempted path and calls `SnapshotEventCatalog.Read()`; when it sees an event there, regardless of `Verified`, `Partial`, `Failed`, or `Unreadable`, it leaves discovery as the sole event source. When no recognized retained event exists, it calls `RecordSessionFailure` with the terminal summary's real detail. It must never construct a path or call `Data.NowShort` after the run ends.
+
+  After publication, await the Timeline plan's `TimelineViewModel.RefreshAsync(CancellationToken cancellationToken = default)` once before showing the result. That method rereads the app-lifetime catalog and replaces its observable event collection; returning from the result only calls `ShowTimeline()` and does not open Compare automatically.
+
+- [ ] **Step 5: Run the host-flow tests to verify they pass**
+
+  Re-run the Step 2 command.
+
+
+  Expected: PASS. Exactly one run gains admission, a rejected second request leaves the active UI untouched, the completed/partial/failed display comes from the runner summary, Timeline receives a session failure only when disk cannot represent the attempt, and Back to Timeline shows the already refreshed one shared event model.
+
+- [ ] **Step 6: Perform the required real Windows smoke path while WinForms remains runnable**
+
+  Run the WPF application from a Windows desktop:
+
+  ```powershell
+  dotnet run --project src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj
+  ```
+
+  Expected: the Timeline home opens with the compact top bar and enabled **Create snapshot** when idle. Select **Create snapshot**; verify the six scopes, environment warning, preset buttons, destination browse, and None/Fast/Max choices are keyboard-reachable. Choose a safe empty destination outside every selected folder, capture one small supported scope, and observe Progress metrics/logs, pause/resume at a module boundary, and the archive phase disabling Cancel. Complete the capture; verify Result wording matches the actual summary; choose **Back to Timeline**; the new verified snapshot appears as selectable. Repeat with a deliberately canceled run only when a safe test destination is used: verify the result says incomplete only if the engine gave `RunSummary.Incomplete`, and Timeline shows either the discovered retained state or one session-only diagnostic failure—never a fabricated verified snapshot.
+
+  Then start the legacy application without deleting or modifying it:
+
+  ```powershell
+  dotnet run --project src/WinRestoreKit/WinRestoreKit.csproj
+  ```
+
+  Expected: WinForms still constructs and exposes its existing backup/progress flow. Do not run a concurrent backup from both shells; close it after confirming startup. This is side-by-side migration verification, not final cutover or publish verification.
+
+- [ ] **Step 7: Commit the integrated WPF flow**
+
+  ```powershell
+  git add src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs src/WinRestoreKit.Wpf/MainWindow.xaml src/WinRestoreKit.Wpf/ViewModels/BackupWorkspaceViewModel.cs src/WinRestoreKit.Wpf/ViewModels/BackupRunCompletion.cs src/WinRestoreKit.Tests/ShellBackupFlowTests.cs src/WinRestoreKit.Tests/BackupResultTimelinePublicationTests.cs src/WinRestoreKit.Tests/RunCoordinatorTests.cs src/WinRestoreKit.Tests/ProgressPageViewTests.cs
+  git commit -m "feat: complete WPF snapshot workflow"
+  ```
+
+## Final Verification Checklist
+
+- [ ] Run the focused commands from Tasks 1–5 and confirm each expected outcome, including Core-backed destination containment, archive, ownership, run-control, and summary regressions.
+- [ ] Run the full existing test suite only after all focused tests and the WPF smoke path succeed:
+
+  ```powershell
+  dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj
+  ```
+
+  Expected: PASS. Existing Core/module/payload/manifest/orchestration behavior remains covered; no test depends on `IWin32Window Owner` or `MessageBoxIcon` in Application contracts.
+
+- [ ] On a real Windows desktop, perform the Task 5 WPF smoke path and confirm the owner-bound app-reinstall dialog opens over the WPF owner, supports a selected source plus alternate discovered source, reports unreadable exports honestly, and asks to stop only after the current app.
+- [ ] Confirm WPF has no registry/payload parsing code: `AppRestoreService` is the sole app-export/payload preparation implementation; selection, progress, results, and XAML only bind structured values.
+- [ ] Confirm both WPF and WinForms remain runnable, there is no publish command, no removal of WinForms files, and no shipping-identity change in this plan. Those are Cutover work.
diff --git a/docs/superpowers/plans/2026-08-09-compare-confirm-restore.md b/docs/superpowers/plans/2026-08-09-compare-confirm-restore.md
new file mode 100644
index 0000000..b516f1d
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-09-compare-confirm-restore.md
@@ -0,0 +1,1812 @@
+# Compare, Confirm, and Restore Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Let a user compare any Timeline-selected verified or partial snapshot with the current PC, select only whole modules with usable captured artifacts, and start the unchanged safe restore pipeline through owner-bound WPF confirmation dialogs.
+
+**Architecture:** Keep all comparison evidence and module catalog projection in framework-neutral `WinRestoreKit.Application`; WPF consumes immutable evidence records and never reads manifests, payloads, registry exports, or artifacts. The Timeline transfers its prepared read scope to the Compare navigator; the workspace owns it until comparison completes or is cancelled, then disposes it. Confirm is a WPF presentation of declared restore impacts, while the existing Application `BackupRestoreOrchestrator` remains the sole authority for `RestorePlan`, `RestoreScope`, `SnapshotGate`, `RestoreDispatch`, result logging, and `ExplorerRestartPrompt`.
+
+**Tech Stack:** .NET 8 for Windows, C#, WPF/MVVM, `System.Threading`, xUnit 2.9.3, and the existing `WinRestoreKit.Core` restore contracts.
+
+## Global Constraints
+
+- Execute this plan after `2026-08-09-wpf-foundation-application-shell.md` and `2026-08-09-timeline-event-model.md`; do not cover backup creation, results migration, or final project cutover here.
+- Windows/.NET 8 only; preserve `WinRestoreKit.Core` backup/restore semantics and the on-disk snapshot and manifest formats.
+- `WinRestoreKit.Application` references neither WinForms nor WPF. It may use Core internals only through the Foundation-provided friend assembly relationship; WPF consumes Application public contracts rather than Core internal catalog or manifest types.
+- Keep WinForms runnable during this stage. Do not delete or alter the existing WinForms restore wizard/forms except for moving a duplicate test only when the WPF test covers the new Application behavior.
+- The four comparison states are exactly `ComparisonState { Changed, Same, Unavailable, NotCaptured }`. Do not replace `Unavailable` with `Same`, omit it from the default view, or invent before/after values.
+- Use manifest evidence before `BackupBase.HasArtifactIn(preparedPayloadPath)`, with the exact `RestoreContents` precedence: manifest `Succeeded` proves an artifact; manifest `Skipped` or `Failed` proves none; only an absent/silent/unknown manifest entry reaches `HasArtifactIn`. A `false` probe becomes `NotCaptured`; a `null` probe becomes `NotCaptured` when a manifest exists (its silence says the module was not in that run), but remains usable when no manifest exists—the same `RestoreContents` legacy fallback—so the subsequent drift result determines `Changed`, `Same`, or `Unavailable`. A thrown artifact probe is `Unavailable` for that module.
+- After a usable artifact is established, map `BackupBase.HasDriftedFrom(preparedPayloadPath)` `true` to `Changed`, `false` to `Same`, and `null` or an exception to `Unavailable`. One module error must log and affect only that row.
+- Comparison is read-only. It must not call `Backup`, `Restore`, `RestoreScope.HasBackup`, or write in the selected snapshot directory. A compressed read scope is temporary and must be disposed exactly once after every success, error, cancellation, or discarded snapshot selection.
+- Comparison runs at a bounded concurrency of four probes, honours cancellation before starting pending work, awaits already-running workers before releasing the payload, and preserves catalog order even when results complete out of order.
+- Restore selection is whole-module only. A row may enter the restore set only when `ModuleComparison.HasUsableArtifact` is true; an `Unavailable` comparison with a proven readable artifact remains selectable but must remain visibly unavailable.
+- The default filter is **All modules**. **Changed only** is an optional view filter applied after evidence arrives; it must not mutate comparison results or the restore set.
+- Changing to a different Timeline snapshot when the restore set is non-empty requires an owner-bound, default-cancel discard confirmation. Accepting clears the set before constructing the new workspace; declining disposes the incoming payload and keeps the old snapshot and set unchanged.
+- Do not create a semantic comparison-provider contract in this stage. Core has no current verified semantic values or item-level restore contract; the tray shows only captured-artifact evidence and existing `BackupBase` restore declarations.
+- Confirm shows only existing impacts: `RestoreTargets`, `ProcessesToCloseBeforeRestore`, `WarningMessage`, `RequiresExplorerRestart`, and `RestorePlan.FidelityCaveat`. Do not add a reboot field or infer a sign-out field by parsing warning text; display an existing warning verbatim when present.
+- The mandatory partial/failed pre-restore-snapshot decision remains at the existing `SnapshotGate` point immediately before restore writes. `IRunDialogService.ConfirmSnapshotOverride` must show an owner-bound Yes/No dialog whose default is No; WPF must never pre-answer or bypass it.
+- The Foundation move replaces `RunSummary.Icon` with `RunSeverity { Information, Warning, Error }` and replaces the WinForms-only owner with `IRunUi.DialogOwner` of type `object`. WPF supplies its main `Window` through that property for the existing Core `AppStoreApps.RestoreAsync(path, ui.DialogOwner)` / `RestoreDialog : Action<string, object>` seam; do not add a duplicate shell app-restore dialog abstraction or compatibility overload.
+- Keep tests in `src/WinRestoreKit.Tests`; use Foundation's `WpfTestHost.Run(...)` STA helper for every test that constructs a WPF `Window`, `UserControl`, or dialog.
+
+---
+
+## File and Interface Map
+
+### Inputs from earlier plans
+
+```csharp
+// src/WinRestoreKit.Application/Snapshots/SnapshotEventKind.cs
+public enum SnapshotEventKind { Verified, Partial, Failed, Unreadable }
+
+// src/WinRestoreKit.Application/Snapshots/SnapshotEvent.cs
+public sealed class SnapshotEvent
+{
+    public SnapshotEventKind Kind { get; }
+    public DateTime Created { get; }
+    public string DisplayName { get; }
+    public string CanonicalPath { get; }
+    public string DiagnosticReason { get; }
+    public string MachineName { get; }
+    public long SizeBytes { get; }
+    public bool IsSizeComplete { get; }
+    public bool IsRestorable { get; } // true only for Verified and Partial
+    internal ManifestData Manifest { get; }
+}
+
+// src/WinRestoreKit.Application/Snapshots/SnapshotPayloadPreparationService.cs
+public Task<SnapshotPayloadPreparation> PrepareAsync(
+    SnapshotEvent snapshot, CancellationToken cancellationToken);
+
+// SnapshotPayloadPreparation is IDisposable. Error != null means no usable payload;
+// disposing it releases the Core BackupPayload.ReadScope, including temporary extraction.
+
+// src/WinRestoreKit.Wpf/Navigation/ITimelineNavigator.cs
+internal interface ITimelineNavigator
+{
+    void OpenCompare(SnapshotPayloadPreparation preparation);
+    void ShowSnapshotDiagnostic(SnapshotEvent snapshot);
+}
+```
+
+```csharp
+// Foundation-owned, in namespace WinRestoreKit.
+internal interface IRunUi
+{
+    void SetProgressText(string text);
+    void SetProgressPercent(int percent);
+    void SetProgressDetail(string groupInfo, string elapsed, string remaining,
+                           string throughput, long bytesWritten, int errors, int warnings);
+    void ShowSummary(RunSummary summary, string caption,
+                     IReadOnlyList<ModuleOutcome> outcomes);
+    object DialogOwner { get; }
+    IReadOnlyList<string> ShowConsentDialog(RestorePlan plan); // null = cancel
+    bool ConfirmSnapshotOverride(string text, string caption); // false = do not continue
+    void ShowPlanCompositionError(string text, string caption);
+    void SetExplorerRestartVisible(bool visible);
+}
+
+internal sealed class BackupRestoreOrchestrator
+{
+    internal BackupRestoreOrchestrator(IRunUi ui, RunControl runControl = null);
+    internal Task RunRestore(IReadOnlyList<BackupBase> modules, string backupPath);
+}
+
+// src/WinRestoreKit.Wpf/Services/IRunPresentation.cs
+internal interface IRunPresentation
+{
+    void SetProgressText(string text);
+    void SetProgressPercent(int percent);
+    void SetProgressDetail(string groupInfo, string elapsed, string remaining,
+                           string throughput, long bytesWritten, int errors, int warnings);
+    void ShowSummary(RunSummary summary, string caption, IReadOnlyList<ModuleOutcome> outcomes);
+    void SetExplorerRestartVisible(bool visible);
+}
+
+// src/WinRestoreKit.Wpf/Services/IRunDialogService.cs
+internal interface IRunDialogService
+{
+    IReadOnlyList<string> ShowRestoreConsent(RestorePlan plan);
+    bool ConfirmSnapshotOverride(string text, string caption);
+    void ShowPlanCompositionError(string text, string caption);
+}
+
+// src/WinRestoreKit.Wpf/Services/WpfRunUi.cs
+internal WpfRunUi(Dispatcher dispatcher, IRunPresentation presentation,
+                  IRunDialogService dialogs, Func<Window> ownerProvider);
+```
+
+```csharp
+// Foundation-owned: src/WinRestoreKit.Wpf/Infrastructure/DelegateCommand.cs
+internal sealed class DelegateCommand : ICommand
+{
+    internal DelegateCommand(Action<object> execute, Predicate<object> canExecute = null);
+    public bool CanExecute(object parameter);
+    public void Execute(object parameter);
+    public event EventHandler CanExecuteChanged;
+    internal void RaiseCanExecuteChanged();
+}
+```
+
+Use this command and the adjacent Foundation `ObservableObject` from every Compare/Confirm ViewModel. Command delegates start a ViewModel-owned `async Task` wrapper that catches/reports its own errors; do not introduce another relay/async-command base type.
+
+### Files created by this plan
+
+| File | Responsibility |
+| --- | --- |
+| `src/WinRestoreKit.Application/Modules/BackupModuleRegistration.cs` | Public, immutable application projection of a registered Core module and its category. |
+| `src/WinRestoreKit.Application/Modules/BackupModuleCatalog.cs` | Produces catalog-order module projections without exposing Core's internal `ModuleCatalog`/`ModuleRegistration`. |
+| `src/WinRestoreKit.Application/Comparison/ComparisonState.cs` | The four immutable evidence-state names. |
+| `src/WinRestoreKit.Application/Comparison/ModuleComparison.cs` | Immutable per-module artifact and drift evidence consumed by WPF. |
+| `src/WinRestoreKit.Application/Comparison/SnapshotComparisonService.cs` | Read-only manifest-first, cancellable, bounded-concurrency snapshot comparison. |
+| `src/WinRestoreKit.Wpf/ViewModels/ComparisonFilter.cs` | UI-only `All` / `ChangedOnly` filtering mode. |
+| `src/WinRestoreKit.Wpf/ViewModels/ModuleImpactViewModel.cs` | Direct projection of existing restore targets, process requirements, Explorer flag, and warning text. |
+| `src/WinRestoreKit.Wpf/ViewModels/ModuleComparisonRowViewModel.cs` | One ordered comparison row, its evidence state, detail data, and restore-set action. |
+| `src/WinRestoreKit.Wpf/ViewModels/RestoreSetViewModel.cs` | In-memory, whole-module restore selection with no persistence. |
+| `src/WinRestoreKit.Wpf/ViewModels/ComparisonWorkspaceViewModel.cs` | Compare lifecycle, filtering, cancellation, selected detail tray, and scope ownership. |
+| `src/WinRestoreKit.Wpf/ViewModels/ConfirmViewModel.cs` | Selected-module impact groups, restore launch, progress/result presentation, and cancellation request. |
+| `src/WinRestoreKit.Wpf/Navigation/CompareWorkflowNavigator.cs` | `ITimelineNavigator` implementation that owns snapshot replacement/discard behavior and shell transitions. |
+| `src/WinRestoreKit.Wpf/Services/RestoreRunDialogService.cs` | Owner-bound implementation of the Foundation `IRunDialogService` for restore-specific dialogs. |
+| `src/WinRestoreKit.Wpf/Services/ICompareDialogService.cs` | Typed, testable compare navigation dialogs: discard restore set and display a snapshot diagnostic. |
+| `src/WinRestoreKit.Wpf/Services/CompareDialogService.cs` | Main-window-owned WPF implementation of `ICompareDialogService`; its explicit owner is passed to every modal diagnostic and discard confirmation. |
+| `src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml` and `.xaml.cs` | Accessible All/Changed-only workspace, ordered rows, temporary detail tray, and restore-set action. |
+| `src/WinRestoreKit.Wpf/Views/ConfirmView.xaml` and `.xaml.cs` | Impact-grouped confirmation screen and restore/progress controls. |
+| `src/WinRestoreKit.Wpf/Views/Dialogs/RestoreConsentDialog.xaml` and `.xaml.cs` | Owner-bound final consent dialog built from the actual `RestorePlan` created by the orchestrator. |
+| `src/WinRestoreKit.Tests/BackupModuleCatalogTests.cs` | Application projection order/category regression coverage. |
+| `src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs` | Pure comparison state, precedence, isolation, ordering, cancellation, and cleanup tests. |
+| `src/WinRestoreKit.Tests/RestoreSetViewModelTests.cs` | Whole-module restore-set rules. |
+| `src/WinRestoreKit.Tests/ComparisonWorkspaceViewModelTests.cs` | Filter, row-order, detail tray, and cancellation/selection behavior. |
+| `src/WinRestoreKit.Tests/ConfirmViewModelTests.cs` | Existing-impact grouping and real orchestrator-entry coverage. |
+| `src/WinRestoreKit.Tests/RestoreConsentDialogTests.cs` | STA WPF construction, default-safe consent, and modal owner wiring. |
+
+### Files modified by this plan
+
+| File | Change |
+| --- | --- |
+| `src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs` | Replace the Foundation-only Timeline placeholder with a `CurrentWorkflow` host and explicit Timeline/Compare/Confirm transitions. |
+| `src/WinRestoreKit.Wpf/MainWindow.xaml` | Add data templates for Timeline, Compare, and Confirm view models; retain the compact Foundation shell chrome. |
+| `src/WinRestoreKit.Wpf/MainWindow.xaml.cs` | Compose `CompareWorkflowNavigator` with the main window as the dialog owner and supply it to the Timeline view model. |
+
+### Contracts produced for later plans
+
+```csharp
+// src/WinRestoreKit.Application/Modules/BackupModuleRegistration.cs
+public sealed class BackupModuleRegistration
+{
+    public BackupBase Module { get; }
+    public string Category { get; }
+    public string Title { get; }
+}
+
+// src/WinRestoreKit.Application/Modules/BackupModuleCatalog.cs
+public static class BackupModuleCatalog
+{
+    public static IReadOnlyList<BackupModuleRegistration> CreateAll();
+}
+
+// src/WinRestoreKit.Application/Comparison/ComparisonState.cs
+public enum ComparisonState { Changed, Same, Unavailable, NotCaptured }
+
+// src/WinRestoreKit.Application/Comparison/ModuleComparison.cs
+public sealed class ModuleComparison
+{
+    public BackupBase Module { get; }
+    public ComparisonState State { get; }
+    public bool HasUsableArtifact { get; }
+    public string ArtifactSummary { get; }
+    public string Reason { get; }
+}
+
+// src/WinRestoreKit.Application/Comparison/SnapshotComparisonService.cs
+public sealed class SnapshotComparisonService
+{
+    public Task<IReadOnlyList<ModuleComparison>> CompareAsync(
+        SnapshotEvent snapshot, IReadOnlyList<BackupBase> modules,
+        CancellationToken cancellationToken);
+}
+```
+
+The service also has one **internal** overload accepting the Timeline-owned `SnapshotPayloadPreparation` and `IProgress<ComparisonProgress>`. It is a resource-ownership handoff, not a compatibility overload: the public exact signature creates/disposes its own preparation, while WPF uses the supplied scope so Timeline extraction is neither duplicated nor leaked.
+
+---
+
+### Task 1: Expose the module catalog to framework-neutral consumers
+
+**Files:**
+- Create: `src/WinRestoreKit.Application/Modules/BackupModuleRegistration.cs`
+- Create: `src/WinRestoreKit.Application/Modules/BackupModuleCatalog.cs`
+- Test: `src/WinRestoreKit.Tests/BackupModuleCatalogTests.cs`
+
+**Interfaces:**
+- Consumes: Core-internal `Conf.ModuleCatalog.CreateAll()` and `ModuleRegistration.Module`/`Category`, accessed only within the Foundation-created `WinRestoreKit.Application` friend assembly.
+- Produces: `BackupModuleCatalog.CreateAll()` returning one immutable `BackupModuleRegistration` per registered module, in the exact Core catalog order, with its existing category and `BackupBase.Title`.
+
+- [ ] **Step 1: Write the failing catalog-projection test**
+
+```csharp
+[Fact]
+public void CreateAll_PreservesCoreCatalogOrderCategoryAndTitle()
+{
+    IReadOnlyList<BackupModuleRegistration> actual = BackupModuleCatalog.CreateAll();
+    IReadOnlyList<ModuleRegistration> core = ModuleCatalog.CreateAll();
+
+    Assert.Equal(core.Count, actual.Count);
+    for (int index = 0; index < core.Count; index++)
+    {
+        Assert.Same(core[index].Module.GetType(), actual[index].Module.GetType());
+        Assert.Equal(core[index].Category, actual[index].Category);
+        Assert.Equal(core[index].Module.Title, actual[index].Title);
+    }
+}
+```
+
+- [ ] **Step 2: Run the test to verify it fails because the public Application catalog does not exist**
+
+Run:
+
+```powershell
+dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~BackupModuleCatalogTests"
+```
+
+Expected: compilation fails because `BackupModuleCatalog` and `BackupModuleRegistration` are undefined.
+
+- [ ] **Step 3: Add the immutable projection and order-preserving wrapper**
+
+```csharp
+// BackupModuleRegistration.cs
+namespace WinRestoreKit;
+
+public sealed class BackupModuleRegistration
+{
+    internal BackupModuleRegistration(BackupBase module, string category)
+    {
+        Module = module ?? throw new ArgumentNullException(nameof(module));
+        Category = category ?? string.Empty;
+        Title = module.Title ?? string.Empty;
+    }
+
+    public BackupBase Module { get; }
+    public string Category { get; }
+    public string Title { get; }
+}
+
+// BackupModuleCatalog.cs
+namespace WinRestoreKit;
+
+public static class BackupModuleCatalog
+{
+    public static IReadOnlyList<BackupModuleRegistration> CreateAll()
+        => ModuleCatalog.CreateAll()
+            .Select(entry => new BackupModuleRegistration(entry.Module, entry.Category))
+            .ToArray();
+}
+```
+
+Add the required `using Conf;`, `System`, `System.Collections.Generic`, and `System.Linq` directives rather than widening Core types or copying the catalog into WPF.
+
+- [ ] **Step 4: Run the focused test and verify the Core and Application catalog rows match**
+
+Run:
+
+```powershell
+dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~BackupModuleCatalogTests"
+```
+
+Expected: PASS; every module count, CLR type, category, and title matches the existing Core catalog in source order.
+
+- [ ] **Step 5: Commit the independently usable catalog facade**
+
+```powershell
+git add src/WinRestoreKit.Application/Modules/BackupModuleRegistration.cs src/WinRestoreKit.Application/Modules/BackupModuleCatalog.cs src/WinRestoreKit.Tests/BackupModuleCatalogTests.cs
+git commit -m "feat: expose application module catalog"
+```
+
+### Task 2: Define immutable evidence records and a manifest-first comparison service
+
+**Files:**
+- Create: `src/WinRestoreKit.Application/Comparison/ComparisonState.cs`
+- Create: `src/WinRestoreKit.Application/Comparison/ModuleComparison.cs`
+- Create: `src/WinRestoreKit.Application/Comparison/SnapshotComparisonService.cs`
+- Test: `src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs`
+
+**Interfaces:**
+- Consumes: `SnapshotEvent` and its Application-internal parsed manifest; `SnapshotPayloadPreparationService`; `BackupBase.HasArtifactIn(string)`; `BackupBase.HasDriftedFrom(string)`; `BackupManifest.StateSucceeded`, `StateSkipped`, and `StateFailed`.
+- Produces: immutable, catalog-indexed `ModuleComparison` rows and the exact public `SnapshotComparisonService.CompareAsync(SnapshotEvent, IReadOnlyList<BackupBase>, CancellationToken)` signature.
+- Invariant: a row can be restorable only when `HasUsableArtifact` is true. `ComparisonState.Unavailable` may still have a usable artifact when only the live drift probe is indeterminate; it must not be silently classified as `Same`.
+
+- [ ] **Step 1: Write failing state, precedence, and mapping tests**
+
+```csharp
+[Theory]
+[InlineData(true, ComparisonState.Changed)]
+[InlineData(false, ComparisonState.Same)]
+public async Task CompareAsync_ManifestSucceeded_MapsDriftWithoutArtifactProbe(
+    bool drifted, ComparisonState expected)
+{
+    ProbeModule module = new("Display", artifact: false, drifted: drifted);
+    SnapshotEvent snapshot = Snapshot(Succeeded(module));
+
+    ModuleComparison row = Assert.Single(await new SnapshotComparisonService()
+        .CompareAsync(snapshot, new[] { (BackupBase)module }, CancellationToken.None));
+
+    Assert.Equal(expected, row.State);
+    Assert.True(row.HasUsableArtifact);
+    Assert.Equal(0, module.ArtifactProbeCount);
+}
+
+[Theory]
+[InlineData(BackupManifest.StateSkipped)]
+[InlineData(BackupManifest.StateFailed)]
+public async Task CompareAsync_ManifestStatesWithoutArtifact_AreNotCaptured(string state)
+{
+    ProbeModule module = new("Fonts", artifact: true, drifted: true);
+
+    ModuleComparison row = Assert.Single(await new SnapshotComparisonService()
+        .CompareAsync(Snapshot(Entry(module, state)), new[] { (BackupBase)module }, CancellationToken.None));
+
+    Assert.Equal(ComparisonState.NotCaptured, row.State);
+    Assert.False(row.HasUsableArtifact);
+    Assert.Equal(0, module.ArtifactProbeCount);
+    Assert.Equal(0, module.DriftProbeCount);
+}
+
+[Fact]
+public async Task CompareAsync_ManifestSilentIndeterminateArtifact_IsNotCaptured()
+{
+    ProbeModule module = new("Terminal", artifact: null, drifted: false);
+
+    ModuleComparison row = Assert.Single(await new SnapshotComparisonService()
+        .CompareAsync(Snapshot(manifest: Manifest(EntryForDifferentModule())),
+                      new[] { (BackupBase)module }, CancellationToken.None));
+
+    Assert.Equal(ComparisonState.NotCaptured, row.State);
+    Assert.False(row.HasUsableArtifact);
+    Assert.Equal(0, module.DriftProbeCount);
+}
+
+[Fact]
+public async Task CompareAsync_NoManifestIndeterminateArtifact_UsesRestoreContentsFallback()
+{
+    ProbeModule module = new("Legacy", artifact: null, drifted: false);
+
+    ModuleComparison row = Assert.Single(await new SnapshotComparisonService()
+        .CompareAsync(Snapshot(manifest: null), new[] { (BackupBase)module }, CancellationToken.None));
+
+    Assert.Equal(ComparisonState.Same, row.State);
+    Assert.True(row.HasUsableArtifact);
+    Assert.Equal(1, module.DriftProbeCount);
+}
+```
+
+In this test file, construct `SnapshotEvent` through Timeline's internal constructor under the Application-to-Tests friendship, create a real temporary backup folder for every snapshot, and use private `BackupBase` fakes only to observe the existing virtual probe seams. Do not use fake semantic values or add a semantic-provider interface.
+
+- [ ] **Step 2: Run the tests to verify the comparison types and service are missing**
+
+Run:
+
+```powershell
+dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~SnapshotComparisonServiceTests"
+```
+
+Expected: compilation fails because `ComparisonState`, `ModuleComparison`, and `SnapshotComparisonService` do not exist.
+
+- [ ] **Step 3: Add the state and immutable evidence record**
+
+```csharp
+namespace WinRestoreKit;
+
+public enum ComparisonState
+{
+    Changed,
+    Same,
+    Unavailable,
+    NotCaptured
+}
+
+public sealed class ModuleComparison
+{
+    internal ModuleComparison(BackupBase module, ComparisonState state,
+                              bool hasUsableArtifact, string artifactSummary, string reason)
+    {
+        Module = module ?? throw new ArgumentNullException(nameof(module));
+        State = state;
+        HasUsableArtifact = hasUsableArtifact;
+        ArtifactSummary = artifactSummary ?? string.Empty;
+        Reason = reason ?? string.Empty;
+    }
+
+    public BackupBase Module { get; }
+    public ComparisonState State { get; }
+    public bool HasUsableArtifact { get; }
+    public string ArtifactSummary { get; }
+    public string Reason { get; }
+}
+```
+
+Keep construction internal so WPF can render evidence but cannot manufacture comparison results. The Tests assembly accesses it through Application's existing `InternalsVisibleTo` attribute.
+
+- [ ] **Step 4: Implement exact manifest-first presence and drift mapping**
+
+```csharp
+private static ModuleComparison CompareOne(BackupBase module, string payloadPath,
+                                           ManifestData manifest)
+{
+    ManifestModule entry = FindManifestEntry(manifest, module.GetType().Name);
+
+    if (entry?.State == BackupManifest.StateSkipped || entry?.State == BackupManifest.StateFailed)
+    {
+        return new ModuleComparison(module, ComparisonState.NotCaptured, false,
+            "The snapshot manifest records no usable artifact for this module.",
+            string.IsNullOrWhiteSpace(entry.Reason) ? entry.State : entry.Reason);
+    }
+
+    bool usableArtifact;
+    string artifactSummary;
+    if (entry?.State == BackupManifest.StateSucceeded)
+    {
+        usableArtifact = true;
+        artifactSummary = "The snapshot manifest records this module as captured.";
+    }
+    else
+    {
+        bool? probe;
+        try { probe = module.HasArtifactIn(payloadPath); }
+        catch (Exception ex)
+        {
+            LogHelper.Instance.LogMessage("Comparison artifact probe failed for " + module.Title + ": " + ex.Message);
+            return new ModuleComparison(module, ComparisonState.Unavailable, false,
+                "Artifact presence could not be determined.", ex.Message);
+        }
+
+        if (probe == false)
+            return new ModuleComparison(module, ComparisonState.NotCaptured, false,
+                "The module proved that this snapshot has no restore artifact.", string.Empty);
+        if (!probe.HasValue)
+        {
+            if (manifest != null)
+                return new ModuleComparison(module, ComparisonState.NotCaptured, false,
+                    "The manifest does not record this module and the module cannot prove an artifact.",
+                    string.Empty);
+
+            // Preserve RestoreContents' no-manifest fallback; drift remains explicit below.
+            usableArtifact = true;
+            artifactSummary = "No manifest is available and the module cannot disprove a legacy artifact.";
+        }
+        else
+        {
+            usableArtifact = true;
+            artifactSummary = "The module verified a captured artifact.";
+        }
+
+    }
+
+    try
+    {
+        bool? drifted = module.HasDriftedFrom(payloadPath);
+        if (drifted == true)
+            return new ModuleComparison(module, ComparisonState.Changed, usableArtifact, artifactSummary,
+                "Core confirmed that current state differs from the snapshot.");
+        if (drifted == false)
+            return new ModuleComparison(module, ComparisonState.Same, usableArtifact, artifactSummary,
+                "Core confirmed that current state matches the snapshot.");
+        return new ModuleComparison(module, ComparisonState.Unavailable, usableArtifact, artifactSummary,
+            "Core could not establish a trustworthy live comparison.");
+    }
+    catch (Exception ex)
+    {
+        LogHelper.Instance.LogMessage("Comparison drift probe failed for " + module.Title + ": " + ex.Message);
+        return new ModuleComparison(module, ComparisonState.Unavailable, usableArtifact, artifactSummary,
+            ex.Message);
+    }
+}
+```
+
+`FindManifestEntry` must match exact CLR type name with `StringComparison.Ordinal`, just as `RestoreContents` does. Treat every manifest state other than the three named states as silent and call `HasArtifactIn`; never claim a future/unknown state means captured.
+
+- [ ] **Step 5: Add the two ownership entry points without duplicating payload extraction**
+
+```csharp
+public sealed class SnapshotComparisonService
+{
+    public async Task<IReadOnlyList<ModuleComparison>> CompareAsync(
+        SnapshotEvent snapshot, IReadOnlyList<BackupBase> modules,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(snapshot);
+        if (!snapshot.IsRestorable)
+            throw new ArgumentException("Only a verified or partial snapshot can be compared.", nameof(snapshot));
+
+        using SnapshotPayloadPreparation preparation = await new SnapshotPayloadPreparationService()
+            .PrepareAsync(snapshot, cancellationToken).ConfigureAwait(false);
+        return await CompareAsync(preparation, modules, cancellationToken, progress: null)
+            .ConfigureAwait(false);
+    }
+
+    internal Task<IReadOnlyList<ModuleComparison>> CompareAsync(
+        SnapshotPayloadPreparation preparation, IReadOnlyList<BackupBase> modules,
+        CancellationToken cancellationToken, IProgress<ComparisonProgress> progress)
+    {
+        ArgumentNullException.ThrowIfNull(preparation);
+        // This overload never disposes preparation: the Timeline navigator transferred ownership
+        // to the WPF workspace, which disposes it only after this returned task has settled.
+        return ComparePreparedAsync(preparation, modules, cancellationToken, progress);
+    }
+}
+```
+
+When `preparation.Error` is non-empty, return `NotCaptured` only for manifest `Skipped`/`Failed` rows; every other module becomes `Unavailable` with that exact preparation error and `HasUsableArtifact == false`. This exposes a missing/corrupt payload as a real disabled comparison/restore condition rather than treating the snapshot as empty.
+
+- [ ] **Step 6: Run the mapping suite and verify every evidence state is honest**
+
+Run:
+
+```powershell
+dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~SnapshotComparisonServiceTests"
+```
+
+Expected: PASS; manifest-success rows bypass `HasArtifactIn`, skipped/failed rows are `NotCaptured`, proven absence is `NotCaptured`, a silent manifest plus indeterminate artifact is `NotCaptured`, no-manifest indeterminacy preserves the `RestoreContents` fallback and remains subject to drift, and throwing artifact or drift probes are `Unavailable` without producing a false `Same` row.
+
+- [ ] **Step 7: Commit the evidence model and basic service behavior**
+
+```powershell
+git add src/WinRestoreKit.Application/Comparison/ComparisonState.cs src/WinRestoreKit.Application/Comparison/ModuleComparison.cs src/WinRestoreKit.Application/Comparison/SnapshotComparisonService.cs src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs
+git commit -m "feat: compare selected snapshot modules"
+```
+
+### Task 3: Make comparison bounded, ordered, cancellable, and cleanup-safe
+
+**Files:**
+- Modify: `src/WinRestoreKit.Application/Comparison/SnapshotComparisonService.cs`
+- Modify: `src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs`
+
+**Interfaces:**
+- Consumes: Task 2 comparison records and Timeline's disposable `SnapshotPayloadPreparation`.
+- Produces: `internal ComparisonProgress(int ordinal, ModuleComparison comparison)` and the existing public comparison method, now with bounded worker scheduling and proven cleanup.
+- Invariant: `Task.WhenAll` result position and progress `Ordinal` equal the input catalog position. Cancellation waits for all in-flight synchronous `BackupBase` probes to finish before the caller can dispose the prepared payload.
+
+- [ ] **Step 1: Add failing isolation, order, concurrency, cancellation, and extraction-cleanup tests**
+
+```csharp
+[Fact]
+public async Task CompareAsync_OneThrowingModule_DoesNotAbortLaterCatalogRows()
+{
+    ProbeModule broken = new("Broken", artifact: true, drifted: null) { ThrowOnDrift = true };
+    ProbeModule same = new("Same", artifact: true, drifted: false);
+
+    IReadOnlyList<ModuleComparison> rows = await Compare(new[] { broken, same });
+
+    Assert.Collection(rows,
+        row => Assert.Equal(ComparisonState.Unavailable, row.State),
+        row => Assert.Equal(ComparisonState.Same, row.State));
+}
+
+[Fact]
+public async Task CompareAsync_BoundsProbeConcurrencyAndReturnsCatalogOrder()
+{
+    ConcurrentProbeModule[] modules = Enumerable.Range(0, 9)
+        .Select(index => new ConcurrentProbeModule("Module " + index)).ToArray();
+
+    IReadOnlyList<ModuleComparison> rows = await Compare(modules);
+
+    Assert.True(ConcurrentProbeModule.MaximumObserved <= 4);
+    Assert.Equal(modules.Select(module => module.Title), rows.Select(row => row.Module.Title));
+}
+
+[Fact]
+public async Task CompareAsync_CancellationWaitsForWorkersThenDeletesCompressedExtraction()
+{
+    string backup = CreateCompressedBackupWithArtifact();
+    BlockingProbeModule module = new("Blocking");
+    using CancellationTokenSource cancellation = new();
+    SnapshotComparisonService service = new();
+
+    Task<IReadOnlyList<ModuleComparison>> task = service.CompareAsync(
+        Snapshot(backup, manifest: null), new[] { (BackupBase)module }, cancellation.Token);
+    await module.Started.Task;
+    cancellation.Cancel();
+    module.Release.Set();
+
+    await Assert.ThrowsAsync<OperationCanceledException>(() => task);
+    Assert.Empty(Directory.EnumerateDirectories(Path.Combine(Path.GetTempPath(), "WinRestoreKit"),
+        "payload-*", SearchOption.TopDirectoryOnly));
+}
+```
+
+The cleanup test must use a real `payload.zip`, wait until the fake's synchronous `HasDriftedFrom` starts, cancel, release it, and only then assert extraction cleanup. It must not assume cancellation can interrupt module code that does not accept a token.
+
+- [ ] **Step 2: Run the focused suite and verify the missing bounded/cancellation behavior fails**
+
+Run:
+
+```powershell
+dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~SnapshotComparisonServiceTests"
+```
+
+Expected: FAIL because workers are not yet bounded/cancellation-aware and the compressed temporary extraction lifetime is not proved.
+
+- [ ] **Step 3: Implement four-worker scheduling, indexed progress, and cancellation settlement**
+
+```csharp
+internal readonly struct ComparisonProgress
+{
+    internal ComparisonProgress(int ordinal, ModuleComparison comparison)
+    {
+        Ordinal = ordinal;
+        Comparison = comparison;
+    }
+
+    internal int Ordinal { get; }
+    internal ModuleComparison Comparison { get; }
+}
+
+private const int MaximumConcurrentProbes = 4;
+
+private async Task<IReadOnlyList<ModuleComparison>> ComparePreparedAsync(
+    SnapshotPayloadPreparation preparation, IReadOnlyList<BackupBase> modules,
+    CancellationToken cancellationToken, IProgress<ComparisonProgress> progress)
+{
+    BackupBase[] catalog = (modules ?? Array.Empty<BackupBase>())
+        .Where(module => module != null).ToArray();
+
+    if (!string.IsNullOrWhiteSpace(preparation.Error))
+        return PayloadFailureRows(catalog, preparation.Snapshot.Manifest, preparation.Error);
+
+    using SemaphoreSlim gate = new(MaximumConcurrentProbes, MaximumConcurrentProbes);
+    Task<ModuleComparison>[] workers = catalog.Select((module, ordinal) =>
+        CompareAtOrdinalAsync(module, ordinal, preparation.Path, preparation.Snapshot.Manifest,
+                              gate, cancellationToken, progress)).ToArray();
+
+    try
+    {
+        return await Task.WhenAll(workers).ConfigureAwait(false);
+    }
+    finally
+    {
+        // Await active Task.Run probes before allowing the caller's finally/using to remove the
+        // prepared payload. Suppress their already-reported exceptions while preserving cancellation.
+        await Task.WhenAll(workers.Select(ObserveCompletionAsync)).ConfigureAwait(false);
+    }
+}
+
+private static async Task<ModuleComparison> CompareAtOrdinalAsync(
+    BackupBase module, int ordinal, string payloadPath, ManifestData manifest,
+    SemaphoreSlim gate, CancellationToken token, IProgress<ComparisonProgress> progress)
+{
+    bool enteredGate = false;
+    try
+    {
+        await gate.WaitAsync(token).ConfigureAwait(false);
+        enteredGate = true;
+        token.ThrowIfCancellationRequested();
+        ModuleComparison row = await Task.Run(() => CompareOne(module, payloadPath, manifest), token)
+            .ConfigureAwait(false);
+        progress?.Report(new ComparisonProgress(ordinal, row));
+        return row;
+    }
+    finally
+    {
+        if (enteredGate)
+            gate.Release();
+    }
+}
+
+private static async Task ObserveCompletionAsync(Task task)
+{
+    try { await task.ConfigureAwait(false); }
+    catch (OperationCanceledException) { }
+    catch (Exception) { }
+}
+```
+
+Do not use `Parallel.ForEach`, an unbounded `Task.Run` fan-out, `Task.WaitAll`, or a continuation that disposes the scope independently. `Task.WhenAll` preserves the task-array order; `ComparisonProgress.Ordinal` lets WPF update the matching already-created row without sorting completion order.
+
+- [ ] **Step 4: Run the focused suite and verify cancellation and cleanup pass**
+
+Run:
+
+```powershell
+dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~SnapshotComparisonServiceTests"
+```
+
+Expected: PASS; no more than four probes run at once, one broken module leaves later evidence intact, cancellation is observed, and the temporary archive extraction is removed only after active workers settle.
+
+- [ ] **Step 5: Commit the operational comparison guarantees**
+
+```powershell
+git add src/WinRestoreKit.Application/Comparison/SnapshotComparisonService.cs src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs
+git commit -m "feat: make snapshot comparison cancellable"
+```
+
+### Task 4: Build the WPF Compare workspace, restore set, and safe snapshot replacement
+
+**Files:**
+- Create: `src/WinRestoreKit.Wpf/ViewModels/ComparisonFilter.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/ModuleImpactViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/ModuleComparisonRowViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/RestoreSetViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/ComparisonWorkspaceViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/Navigation/CompareWorkflowNavigator.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/ICompareDialogService.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/CompareDialogService.cs`
+- Create: `src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml`
+- Create: `src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml.cs`
+- Modify: `src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs`
+- Modify: `src/WinRestoreKit.Wpf/MainWindow.xaml`
+- Modify: `src/WinRestoreKit.Wpf/MainWindow.xaml.cs`
+- Test: `src/WinRestoreKit.Tests/RestoreSetViewModelTests.cs`
+- Test: `src/WinRestoreKit.Tests/ComparisonWorkspaceViewModelTests.cs`
+
+**Interfaces:**
+- Consumes: `ITimelineNavigator.OpenCompare(SnapshotPayloadPreparation)`, `BackupModuleCatalog.CreateAll()`, Task 3's internal prepared-payload comparison overload, and Timeline's `SnapshotEvent` restorable/diagnostic facts.
+- Produces: WPF `ComparisonWorkspaceViewModel` with `Rows`, `VisibleRows`, `RestoreSet`, `SelectedRow`, `SelectedFilter`, `StartAsync`, `CancelAsync`, and `ContinueToConfirmCommand`; `CompareWorkflowNavigator` implements the exact Timeline navigation seam and owns the Confirm transition.
+- Invariant: `RestoreSet` holds `BackupBase` references only in memory. It neither serializes values nor interprets an `Unavailable` row as `Same`.
+- Produces for Task 6: `CompareWorkflowNavigator.CurrentWorkspace` and `Task PendingTransition`, an internal settled-transition observation seam; Timeline continues to call only `void OpenCompare(...)`.
+- [ ] **Step 1: Write failing restore-set and workspace behavior tests under STA**
+
+```csharp
+[Fact]
+public void RestoreSet_OnlyAcceptsRowsWithUsableArtifacts()
+{
+    WpfTestHost.Run(() =>
+    {
+        RestoreSetViewModel restoreSet = new();
+        ModuleComparison unavailableButUsable = Comparison("Terminal", ComparisonState.Unavailable, true);
+        ModuleComparison absent = Comparison("Fonts", ComparisonState.NotCaptured, false);
+
+        restoreSet.Add(unavailableButUsable);
+        restoreSet.Add(absent);
+
+        Assert.Single(restoreSet.Modules);
+        Assert.Same(unavailableButUsable.Module, restoreSet.Modules[0]);
+        Assert.False(restoreSet.Contains(absent.Module));
+    });
+}
+
+[Fact]
+public void Workspace_DefaultsToAllAndChangedOnlyDoesNotChangeRestoreSet()
+{
+    WpfTestHost.Run(() =>
+    {
+        ComparisonWorkspaceViewModel workspace = LoadedWorkspace(
+            Comparison("Changed", ComparisonState.Changed, true),
+            Comparison("Same", ComparisonState.Same, true),
+            Comparison("Unknown", ComparisonState.Unavailable, true),
+            Comparison("Absent", ComparisonState.NotCaptured, false));
+
+        Assert.Equal(ComparisonFilter.All, workspace.SelectedFilter);
+        Assert.Equal(4, workspace.VisibleRows.Count);
+        workspace.RestoreSet.Add(workspace.Rows[2].Comparison);
+
+        workspace.SelectedFilter = ComparisonFilter.ChangedOnly;
+
+        Assert.Single(workspace.VisibleRows);
+        Assert.Equal("Changed", workspace.VisibleRows[0].Title);
+        Assert.True(workspace.RestoreSet.Contains(workspace.Rows[2].Comparison.Module));
+    });
+}
+
+[Fact]
+public void Workspace_SelectedRowExposesOnlyDeclaredImpacts()
+{
+    WpfTestHost.Run(() =>
+    {
+        ComparisonWorkspaceViewModel workspace = LoadedWorkspace(ComparisonWithDeclaredImpacts());
+        workspace.SelectedRow = workspace.Rows[0];
+
+        Assert.True(workspace.IsDetailTrayOpen);
+        Assert.Equal("Settings", workspace.SelectedRow.Category);
+        Assert.Contains(workspace.SelectedRow.Impact.Targets,
+            item => item.Kind == RestoreTargetKind.RegistryKey);
+        Assert.Contains(workspace.SelectedRow.Impact.Processes,
+            item => item.NeedsConsent && item.DisplayName == "Visual Studio Code");
+        Assert.True(workspace.SelectedRow.Impact.RequiresExplorerRestart);
+        Assert.Equal("Existing module warning.", workspace.SelectedRow.Impact.WarningMessage);
+    });
+}
+
+[Fact]
+public void Workspace_ContinueToConfirmUsesTheCurrentWholeModuleRestoreSet()
+{
+    WpfTestHost.Run(() =>
+    {
+        SnapshotEvent receivedSnapshot = null;
+        IReadOnlyList<BackupBase> receivedModules = null;
+        ComparisonWorkspaceViewModel workspace = LoadedWorkspace(
+            (snapshot, modules) => { receivedSnapshot = snapshot; receivedModules = modules; },
+            Comparison("Changed", ComparisonState.Changed, true));
+        workspace.RestoreSet.Add(workspace.Rows[0].Comparison);
+
+        workspace.ContinueToConfirmCommand.Execute(null);
+
+        Assert.Same(workspace.Snapshot, receivedSnapshot);
+        Assert.Single(receivedModules);
+        Assert.Same(workspace.Rows[0].Comparison.Module, receivedModules[0]);
+    });
+}
+```
+
+Use a small `BackupBase` test module whose overrides return actual `RestoreTarget` and `RestoreCloseRequirement` objects. The assertions must inspect those values directly; do not create guessed values such as “reboot required.” Extend `LoadedWorkspace` to accept the optional `Action<SnapshotEvent, IReadOnlyList<BackupBase>>` callback passed to the workspace constructor; its normal test overload passes a no-op action.
+
+- [ ] **Step 2: Run the tests to verify the ViewModels and WPF host are absent**
+
+Run:
+
+```powershell
+dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~RestoreSetViewModelTests|FullyQualifiedName~ComparisonWorkspaceViewModelTests"
+```
+
+Expected: compilation fails because the Compare ViewModels and `WpfTestHost`-consuming test surface do not yet exist.
+
+- [ ] **Step 3: Implement whole-module restore selection and direct impact projection**
+
+```csharp
+internal sealed class RestoreSetViewModel : ObservableObject
+{
+    private readonly ObservableCollection<BackupBase> modules = new();
+
+    public ReadOnlyObservableCollection<BackupBase> Modules { get; }
+
+    internal RestoreSetViewModel()
+        => Modules = new ReadOnlyObservableCollection<BackupBase>(modules);
+
+    internal bool Contains(BackupBase module) => modules.Contains(module);
+    public bool HasItems => modules.Count != 0;
+
+    internal void Add(ModuleComparison comparison)
+    {
+        if (comparison == null || !comparison.HasUsableArtifact || modules.Contains(comparison.Module))
+            return;
+        modules.Add(comparison.Module);
+        OnPropertyChanged(nameof(HasItems));
+    }
+
+    internal void Remove(BackupBase module)
+    {
+        if (modules.Remove(module))
+            OnPropertyChanged(nameof(HasItems));
+    }
+
+    internal void Clear()
+    {
+        if (modules.Count == 0)
+            return;
+        modules.Clear();
+        OnPropertyChanged(nameof(HasItems));
+    }
+}
+
+internal sealed class ModuleImpactViewModel
+{
+    internal ModuleImpactViewModel(BackupBase module)
+    {
+        Targets = (module.RestoreTargets ?? Array.Empty<RestoreTarget>()).ToArray();
+        Processes = (module.ProcessesToCloseBeforeRestore ?? Array.Empty<RestoreCloseRequirement>())
+            .Where(requirement => requirement != null).ToArray();
+        RequiresExplorerRestart = module.RequiresExplorerRestart;
+        WarningMessage = module.WarningMessage ?? string.Empty;
+    }
+
+    public IReadOnlyList<RestoreTarget> Targets { get; }
+    public IReadOnlyList<RestoreCloseRequirement> Processes { get; }
+    public bool RequiresExplorerRestart { get; }
+    public string WarningMessage { get; }
+}
+
+internal enum ComparisonFilter { All, ChangedOnly }
+
+internal sealed class ModuleComparisonRowViewModel : ObservableObject
+{
+    private readonly RestoreSetViewModel restoreSet;
+
+    internal ModuleComparisonRowViewModel(BackupModuleRegistration registration,
+                                          RestoreSetViewModel restoreSet)
+    {
+        Registration = registration ?? throw new ArgumentNullException(nameof(registration));
+        this.restoreSet = restoreSet ?? throw new ArgumentNullException(nameof(restoreSet));
+        Impact = new ModuleImpactViewModel(registration.Module);
+        ToggleRestoreSetCommand = new DelegateCommand(_ => ToggleRestoreSet(), _ => CanChangeRestoreSet);
+    }
+
+    internal BackupModuleRegistration Registration { get; }
+    internal ModuleComparison Comparison { get; private set; }
+    public string Title => Registration.Title;
+    public string Category => Registration.Category;
+    public ModuleImpactViewModel Impact { get; }
+    public bool IsChecking => Comparison == null;
+    public bool CanChangeRestoreSet => Comparison?.HasUsableArtifact == true;
+    public bool IsInRestoreSet => restoreSet.Contains(Registration.Module);
+    public string StateLabel => IsChecking ? "Checking" : Comparison.State.ToString();
+    public string ArtifactSummary => IsChecking ? "Comparison has not finished." : Comparison.ArtifactSummary;
+    public string Reason => Comparison?.Reason ?? string.Empty;
+    public string RestoreActionLabel => IsInRestoreSet ? "Remove from restore" : "Add to restore";
+    public DelegateCommand ToggleRestoreSetCommand { get; }
+
+    internal void Apply(ModuleComparison comparison)
+    {
+        Comparison = comparison ?? throw new ArgumentNullException(nameof(comparison));
+        OnPropertyChanged(nameof(IsChecking));
+        OnPropertyChanged(nameof(StateLabel));
+        OnPropertyChanged(nameof(ArtifactSummary));
+        OnPropertyChanged(nameof(Reason));
+        OnPropertyChanged(nameof(CanChangeRestoreSet));
+        ToggleRestoreSetCommand.RaiseCanExecuteChanged();
+    }
+
+    private void ToggleRestoreSet()
+    {
+        if (!CanChangeRestoreSet)
+            return;
+        if (IsInRestoreSet)
+            restoreSet.Remove(Registration.Module);
+        else
+            restoreSet.Add(Comparison);
+        OnPropertyChanged(nameof(IsInRestoreSet));
+        OnPropertyChanged(nameof(RestoreActionLabel));
+    }
+}
+```
+
+Keep `RestoreTarget` values typed in the view model and bind their existing `Kind` and `Path`; do not repeat `RestorePlan` wording or parse `WarningMessage` to manufacture impact categories.
+
+- [ ] **Step 4: Implement workspace ownership, ordered streaming, and filtering**
+
+```csharp
+internal sealed class ComparisonWorkspaceViewModel : ObservableObject
+{
+    private readonly IReadOnlyList<BackupModuleRegistration> registrations;
+    private readonly SnapshotComparisonService comparisonService;
+    private readonly CancellationTokenSource comparisonCancellation = new();
+    private Task comparisonTask;
+    private ComparisonFilter selectedFilter = ComparisonFilter.All;
+    private ModuleComparisonRowViewModel selectedRow;
+    private readonly Action<SnapshotEvent, IReadOnlyList<BackupBase>> showConfirm;
+
+    internal ComparisonWorkspaceViewModel(SnapshotEvent snapshot,
+        IReadOnlyList<BackupModuleRegistration> registrations,
+        SnapshotComparisonService comparisonService,
+        Action<SnapshotEvent, IReadOnlyList<BackupBase>> showConfirm)
+    {
+        Snapshot = snapshot ?? throw new ArgumentNullException(nameof(snapshot));
+        this.registrations = registrations ?? throw new ArgumentNullException(nameof(registrations));
+        this.comparisonService = comparisonService ?? throw new ArgumentNullException(nameof(comparisonService));
+        this.showConfirm = showConfirm ?? throw new ArgumentNullException(nameof(showConfirm));
+        Rows = new ObservableCollection<ModuleComparisonRowViewModel>();
+        VisibleRows = new ObservableCollection<ModuleComparisonRowViewModel>();
+        RestoreSet = new RestoreSetViewModel();
+        RestoreSet.PropertyChanged += (_, e) =>
+        {
+            if (e.PropertyName == nameof(RestoreSet.HasItems))
+            {
+                OnPropertyChanged(nameof(CanContinueToConfirm));
+                ContinueToConfirmCommand.RaiseCanExecuteChanged();
+            }
+        };
+        ContinueToConfirmCommand = new DelegateCommand(_ => ContinueToConfirm(), _ => CanContinueToConfirm);
+    }
+
+    public SnapshotEvent Snapshot { get; }
+    public ObservableCollection<ModuleComparisonRowViewModel> Rows { get; }
+    public ObservableCollection<ModuleComparisonRowViewModel> VisibleRows { get; }
+    public RestoreSetViewModel RestoreSet { get; }
+    public bool IsComparing { get; private set; }
+    public string ComparisonStatus { get; private set; } = string.Empty;
+    public ComparisonFilter SelectedFilter
+    {
+        get => selectedFilter;
+        set { selectedFilter = value; OnPropertyChanged(); OnPropertyChanged(nameof(IsAllFilter)); OnPropertyChanged(nameof(IsChangedOnlyFilter)); RefreshVisibleRows(); }
+    }
+    public bool IsAllFilter
+    {
+        get => SelectedFilter == ComparisonFilter.All;
+        set { if (value) SelectedFilter = ComparisonFilter.All; }
+    }
+    public bool IsChangedOnlyFilter
+    {
+        get => SelectedFilter == ComparisonFilter.ChangedOnly;
+        set { if (value) SelectedFilter = ComparisonFilter.ChangedOnly; }
+    }
+    public ModuleComparisonRowViewModel SelectedRow
+    {
+        get => selectedRow;
+        set { selectedRow = value; OnPropertyChanged(); OnPropertyChanged(nameof(IsDetailTrayOpen)); }
+    }
+    public bool IsDetailTrayOpen => SelectedRow != null;
+    public bool CanContinueToConfirm => RestoreSet.HasItems && !IsComparing;
+    public DelegateCommand ContinueToConfirmCommand { get; }
+
+    internal Task StartAsync(SnapshotPayloadPreparation preparation)
+        => comparisonTask ??= StartCoreAsync(preparation);
+
+    private async Task StartCoreAsync(SnapshotPayloadPreparation preparation)
+    {
+        ArgumentNullException.ThrowIfNull(preparation);
+        Rows.Clear();
+        foreach (BackupModuleRegistration registration in registrations)
+            Rows.Add(new ModuleComparisonRowViewModel(registration, RestoreSet));
+        RefreshVisibleRows();
+
+        IsComparing = true;
+        OnPropertyChanged(nameof(IsComparing));
+        OnPropertyChanged(nameof(CanContinueToConfirm));
+        ContinueToConfirmCommand.RaiseCanExecuteChanged();
+        try
+        {
+            IProgress<ComparisonProgress> progress = new Progress<ComparisonProgress>(item =>
+            {
+                Rows[item.Ordinal].Apply(item.Comparison);
+                RefreshVisibleRows();
+            });
+            await comparisonService.CompareAsync(preparation,
+                registrations.Select(registration => registration.Module).ToArray(),
+                comparisonCancellation.Token, progress);
+        }
+        catch (OperationCanceledException) when (comparisonCancellation.IsCancellationRequested)
+        {
+            ComparisonStatus = "Comparison canceled.";
+        }
+        finally
+        {
+            IsComparing = false;
+            OnPropertyChanged(nameof(IsComparing));
+            OnPropertyChanged(nameof(CanContinueToConfirm));
+            ContinueToConfirmCommand.RaiseCanExecuteChanged();
+            preparation.Dispose();
+            RefreshVisibleRows();
+        }
+    }
+
+    internal async Task CancelAsync()
+    {
+        comparisonCancellation.Cancel();
+        if (comparisonTask != null)
+            await comparisonTask;
+    }
+
+    private void ContinueToConfirm()
+    {
+        if (CanContinueToConfirm)
+            showConfirm(Snapshot, RestoreSet.Modules.ToArray());
+    }
+
+    private void RefreshVisibleRows()
+    {
+        VisibleRows.Clear();
+        foreach (ModuleComparisonRowViewModel row in Rows)
+            if (SelectedFilter == ComparisonFilter.All ||
+                row.Comparison?.State == ComparisonState.Changed)
+                VisibleRows.Add(row);
+    }
+}
+```
+
+Set `SelectedFilter = ComparisonFilter.All` in the constructor. `Rows` is created once in catalog order before any result is reported; each progress update replaces only the matching ordinal's checking placeholder, so a completion race cannot reorder the list. `CancelAsync` must be awaited by the navigator before it discards a workspace; do not call `Dispose` from a continuation while a probe can still read the payload.
+
+- [ ] **Step 5: Implement the Timeline navigator and snapshot-change confirmation**
+
+```csharp
+internal interface ICompareDialogService
+{
+    bool ConfirmDiscardRestoreSet(Window owner, SnapshotEvent current, SnapshotEvent incoming);
+    void ShowSnapshotDiagnostic(Window owner, SnapshotEvent snapshot);
+}
+
+internal sealed class CompareDialogService : ICompareDialogService
+{
+    public bool ConfirmDiscardRestoreSet(Window owner, SnapshotEvent current, SnapshotEvent incoming)
+        => MessageBox.Show(owner,
+            "Changing from \"" + current.DisplayName + "\" to \"" + incoming.DisplayName +
+            "\" clears the selected restore modules. Change snapshot?",
+            "Change snapshot", MessageBoxButton.YesNo, MessageBoxImage.Warning,
+            MessageBoxResult.No) == MessageBoxResult.Yes;
+
+    public void ShowSnapshotDiagnostic(Window owner, SnapshotEvent snapshot)
+        => MessageBox.Show(owner, snapshot.DiagnosticReason, "Snapshot diagnostic",
+            MessageBoxButton.OK, MessageBoxImage.Error);
+}
+
+internal sealed class CompareWorkflowNavigator : ITimelineNavigator
+{
+    private readonly ShellViewModel shell;
+    private readonly Window owner;
+    private readonly ICompareDialogService dialogs;
+    private ComparisonWorkspaceViewModel currentWorkspace;
+
+    internal CompareWorkflowNavigator(ShellViewModel shell, Window owner, ICompareDialogService dialogs)
+    {
+        this.shell = shell ?? throw new ArgumentNullException(nameof(shell));
+        this.owner = owner ?? throw new ArgumentNullException(nameof(owner));
+        this.dialogs = dialogs ?? throw new ArgumentNullException(nameof(dialogs));
+    }
+
+    internal Task PendingTransition { get; private set; } = Task.CompletedTask;
+    internal ComparisonWorkspaceViewModel CurrentWorkspace => currentWorkspace;
+
+    public void OpenCompare(SnapshotPayloadPreparation incoming)
+    {
+        if (string.Equals(currentWorkspace?.Snapshot.CanonicalPath, incoming.Snapshot.CanonicalPath,
+                          StringComparison.OrdinalIgnoreCase))
+        {
+            incoming.Dispose();
+            return;
+        }
+
+        if (currentWorkspace?.RestoreSet.HasItems == true &&
+            !dialogs.ConfirmDiscardRestoreSet(owner, currentWorkspace.Snapshot, incoming.Snapshot))
+        {
+            incoming.Dispose();
+            return;
+        }
+
+        PendingTransition = ReplaceWorkspaceAsync(incoming);
+    }
+
+    public void ShowSnapshotDiagnostic(SnapshotEvent snapshot)
+        => dialogs.ShowSnapshotDiagnostic(owner, snapshot);
+
+    private async Task ReplaceWorkspaceAsync(SnapshotPayloadPreparation incoming)
+    {
+        bool ownershipTransferred = false;
+        try
+        {
+            if (currentWorkspace != null)
+                await currentWorkspace.CancelAsync();
+            currentWorkspace?.RestoreSet.Clear();
+
+            currentWorkspace = new ComparisonWorkspaceViewModel(incoming.Snapshot,
+                BackupModuleCatalog.CreateAll(), new SnapshotComparisonService(), ShowConfirm);
+            ownershipTransferred = true;
+            shell.ShowCompare(currentWorkspace);
+            await currentWorkspace.StartAsync(incoming);
+        }
+        catch (Exception ex)
+        {
+            if (!ownershipTransferred)
+                incoming.Dispose();
+            shell.ShowInlineWorkflowError("Comparison could not start: " + ex.Message);
+        }
+    }
+
+    private void ShowConfirm(SnapshotEvent snapshot, IReadOnlyList<BackupBase> modules)
+    {
+        ConfirmViewModel confirm = new(snapshot, modules, () => shell.ShowCompare(currentWorkspace));
+        shell.ShowConfirm(confirm);
+    }
+}
+```
+
+`ConfirmDiscardRestoreSet` must be a modal WPF dialog with the main window owner, **Cancel** as its default, and text that names both snapshot display names. Accepting clears the old in-memory set only after the user approves; rejecting leaves the old workspace/set untouched and releases only the incoming scope. The fire-and-forget interface boundary is contained here because Timeline's established `ITimelineNavigator` is `void`; `ReplaceWorkspaceAsync` catches every exception and renders it inline rather than allowing an unobserved task failure.
+
+Add `ShellViewModel.CurrentWorkflow`, `ShowTimeline()`, `ShowCompare(ComparisonWorkspaceViewModel)`, and `ShowConfirm(ConfirmViewModel)`, then bind `MainWindow`'s central `ContentControl` through explicit DataTemplates. `MainWindow` constructs `CompareWorkflowNavigator` with itself as `owner` and passes it to Timeline's view-model composition; the ViewModel itself never discovers or stores a WPF `Window`.
+
+- [ ] **Step 6: Add accessible Compare XAML with All as the default visible filter**
+
+```xml
+<UserControl x:Class="WinRestoreKit.Wpf.Views.ComparisonWorkspaceView"
+             AutomationProperties.Name="Snapshot comparison workspace"
+             AutomationProperties.AutomationId="ComparisonWorkspace">
+  <Grid>
+    <Grid.RowDefinitions>
+      <RowDefinition Height="Auto" />
+      <RowDefinition Height="Auto" />
+      <RowDefinition Height="*" />
+    </Grid.RowDefinitions>
+    <StackPanel Orientation="Horizontal" Margin="0,0,0,12">
+      <RadioButton Content="All modules" GroupName="ComparisonFilter"
+                   IsChecked="{Binding IsAllFilter, Mode=TwoWay}"
+                   AutomationProperties.Name="Show all compared modules"
+                   AutomationProperties.AutomationId="CompareFilterAll" />
+      <RadioButton Content="Changed only" GroupName="ComparisonFilter" Margin="16,0,0,0"
+                   IsChecked="{Binding IsChangedOnlyFilter, Mode=TwoWay}"
+                   AutomationProperties.Name="Show only changed modules"
+                   AutomationProperties.AutomationId="CompareFilterChanged" />
+      <TextBlock Text="{Binding ComparisonStatus}" Margin="16,0,0,0" />
+    </StackPanel>
+    <StackPanel Grid.Row="1" Orientation="Horizontal" Margin="0,0,0,12">
+      <ListBox ItemsSource="{Binding RestoreSet.Modules}" MinWidth="220"
+               AutomationProperties.Name="Modules selected for restore"
+               AutomationProperties.AutomationId="RestoreSetList">
+        <ListBox.ItemTemplate><DataTemplate>
+          <TextBlock Text="{Binding Title}" />
+        </DataTemplate></ListBox.ItemTemplate>
+      </ListBox>
+      <Button Content="Continue to confirm" Command="{Binding ContinueToConfirmCommand}"
+              IsEnabled="{Binding CanContinueToConfirm}" Margin="12,0,0,0"
+              AutomationProperties.Name="Review selected modules before restore"
+              AutomationProperties.AutomationId="CompareContinueToConfirmButton" />
+    </StackPanel>
+    <Grid Grid.Row="2">
+      <Grid.ColumnDefinitions><ColumnDefinition /><ColumnDefinition Width="360" /></Grid.ColumnDefinitions>
+      <ListBox ItemsSource="{Binding VisibleRows}" SelectedItem="{Binding SelectedRow}"
+               AutomationProperties.Name="Compared modules"
+               AutomationProperties.AutomationId="CompareModuleList">
+        <ListBox.ItemTemplate>
+          <DataTemplate>
+            <Grid Margin="8"><Grid.ColumnDefinitions><ColumnDefinition Width="130" /><ColumnDefinition /><ColumnDefinition Width="Auto" /></Grid.ColumnDefinitions>
+              <TextBlock Text="{Binding StateLabel}" />
+              <StackPanel Grid.Column="1"><TextBlock Text="{Binding Title}" FontWeight="SemiBold" /><TextBlock Text="{Binding ArtifactSummary}" TextWrapping="Wrap" /></StackPanel>
+              <Button Grid.Column="2" Content="{Binding RestoreActionLabel}"
+                      Command="{Binding ToggleRestoreSetCommand}" IsEnabled="{Binding CanChangeRestoreSet}"
+                      AutomationProperties.Name="{Binding RestoreActionAutomationName}" />
+            </Grid>
+          </DataTemplate>
+        </ListBox.ItemTemplate>
+      </ListBox>
+      <Border Grid.Column="1" Visibility="{Binding IsDetailTrayOpen, Converter={StaticResource BooleanToVisibilityConverter}}"
+              AutomationProperties.Name="Selected module details">
+        <ScrollViewer><StackPanel DataContext="{Binding SelectedRow}">
+          <TextBlock Text="{Binding Title}" FontWeight="SemiBold" />
+          <TextBlock Text="{Binding Category}" />
+          <TextBlock Text="{Binding StateLabel}" />
+          <TextBlock Text="{Binding ArtifactSummary}" TextWrapping="Wrap" />
+          <TextBlock Text="{Binding Reason}" TextWrapping="Wrap" />
+          <ItemsControl ItemsSource="{Binding Impact.Targets}" />
+          <ItemsControl ItemsSource="{Binding Impact.Processes}" />
+          <TextBlock Text="Explorer restart may be offered after successful writes."
+                     Visibility="{Binding Impact.RequiresExplorerRestart, Converter={StaticResource BooleanToVisibilityConverter}}" />
+          <TextBlock Text="{Binding Impact.WarningMessage}" TextWrapping="Wrap" />
+          <Button Content="{Binding RestoreActionLabel}" Command="{Binding ToggleRestoreSetCommand}"
+                  IsEnabled="{Binding CanChangeRestoreSet}" />
+        </StackPanel></ScrollViewer>
+      </Border>
+    </Grid>
+  </Grid>
+</UserControl>
+```
+
+Provide item templates that render each existing `RestoreTarget.Kind` and `RestoreTarget.Path`, plus each existing `RestoreCloseRequirement.DisplayName` and `NeedsConsent` value. A row in its checking phase is labelled “Checking”; after comparison it has exactly one of the four required evidence states. Do not show a semantic before/after column, reboot line, or parsed registry/payload text.
+
+- [ ] **Step 7: Run the STA ViewModel suite and verify visible selection behavior**
+
+Run:
+
+```powershell
+dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~RestoreSetViewModelTests|FullyQualifiedName~ComparisonWorkspaceViewModelTests"
+```
+
+Expected: PASS; all four rows are visible by default, Changed only reduces only the view, usable-but-unavailable evidence may be selected as a whole module, NotCaptured cannot be selected, and the detail model contains only declared Core impacts.
+
+- [ ] **Step 8: Commit the Compare workspace and safe selection lifecycle**
+
+```powershell
+git add src/WinRestoreKit.Wpf/ViewModels src/WinRestoreKit.Wpf/Navigation/CompareWorkflowNavigator.cs src/WinRestoreKit.Wpf/Services/ICompareDialogService.cs src/WinRestoreKit.Wpf/Services/CompareDialogService.cs src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml.cs src/WinRestoreKit.Wpf/MainWindow.xaml src/WinRestoreKit.Wpf/MainWindow.xaml.cs src/WinRestoreKit.Tests/RestoreSetViewModelTests.cs src/WinRestoreKit.Tests/ComparisonWorkspaceViewModelTests.cs
+git commit -m "feat: add WPF snapshot comparison workspace"
+```
+
+### Task 5: Add Confirm, owner-bound consent, and the unchanged restore pipeline
+
+**Files:**
+- Create: `src/WinRestoreKit.Wpf/ViewModels/ConfirmViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/RestoreRunDialogService.cs`
+- Create: `src/WinRestoreKit.Wpf/Views/ConfirmView.xaml`
+- Create: `src/WinRestoreKit.Wpf/Views/ConfirmView.xaml.cs`
+- Create: `src/WinRestoreKit.Wpf/Views/Dialogs/RestoreConsentDialog.xaml`
+- Create: `src/WinRestoreKit.Wpf/Views/Dialogs/RestoreConsentDialog.xaml.cs`
+- Modify: `src/WinRestoreKit.Wpf/Navigation/CompareWorkflowNavigator.cs`
+- Modify: `src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs`
+- Modify: `src/WinRestoreKit.Tests/WpfTestHost.cs`
+- Test: `src/WinRestoreKit.Tests/ConfirmViewModelTests.cs`
+- Test: `src/WinRestoreKit.Tests/RestoreConsentDialogTests.cs`
+
+**Interfaces:**
+- Consumes: `RestoreSetViewModel.Modules`; existing `RestoreTargets`, `ProcessesToCloseBeforeRestore`, `WarningMessage`, `RequiresExplorerRestart`, `RestorePlan.FidelityCaveat`; Foundation's `IRunPresentation`, `IRunDialogService`, `WpfRunUi`, `WpfLogSink`, `RunCoordinator`, `RunControl`, and moved `BackupRestoreOrchestrator`.
+- Produces: a Confirm screen that presents selected modules grouped by existing process/Explorer impact and starts the original restore flow; a final WPF consent dialog returned through `IRunUi.ShowConsentDialog`.
+- Invariant: Confirm must not independently create a `RestorePlan`, pre-create a snapshot folder, close a process, evaluate a snapshot decision, or call a module's `Restore*` member. Only the orchestrator does those operations, in its existing order.
+
+- [ ] **Step 1: Write failing Confirm and dialog tests**
+
+```csharp
+[Fact]
+public void Confirm_GroupsOnlyExistingProcessAndExplorerImpacts()
+{
+    WpfTestHost.Run(() =>
+    {
+        ConfirmViewModel viewModel = new ConfirmViewModel(
+            SnapshotEventForTemporaryFolder(),
+            new[] { ModuleWithConsentProcess(), ModuleWithExplorerRestartAndWarning() });
+
+        Assert.Equal(RestorePlan.FidelityCaveat, viewModel.FidelityCaveat);
+        Assert.Contains(viewModel.ConsentProcesses, item => item.DisplayName == "Visual Studio Code");
+        Assert.Contains(viewModel.ExplorerRestartModules, item => item.Title == "Taskbar");
+        Assert.Contains(viewModel.ModuleWarnings, item => item.Text == "Existing sign-out warning.");
+    });
+}
+
+[Fact]
+public void RestoreConsentDialog_IsOwnerBoundAndDefaultsToNoConsentedProcesses()
+{
+    WpfTestHost.Run(() =>
+    {
+        Window owner = new Window();
+        RestoreConsentDialog dialog = RestoreConsentDialog.Create(owner, PlanWithOneConsentEntry());
+
+        Assert.Same(owner, dialog.Owner);
+        Assert.Empty(dialog.ConsentedProcessNames);
+        Assert.False(dialog.DialogResult == true);
+        dialog.Close();
+        owner.Close();
+    });
+}
+
+[Fact]
+public async Task Confirm_StartRestore_InvokesExistingOrchestratorWithSelectedSource()
+{
+    await WpfTestHost.RunAsync(async () =>
+    {
+        string source = CreateTemporarySnapshotFolder();
+        CancelingRunDialogService dialogs = new();
+        ConfirmViewModel viewModel = AttachedConfirm(SnapshotFor(source), new[] { new TestModule() }, dialogs);
+
+        await viewModel.StartRestoreAsync();
+
+        Assert.Equal(Path.GetFullPath(source), dialogs.LastRestorePlan.RestoreSourcePath);
+        Assert.Single(dialogs.LastRestorePlan.Modules);
+        Assert.Contains("canceled", viewModel.Summary.Headline, StringComparison.OrdinalIgnoreCase);
+        Assert.False(RunCoordinator.IsRunning);
+    });
+}
+```
+
+Make the Test dialog service record the supplied plan in `LastRestorePlan` and return `null` from `ShowRestoreConsent`. The real orchestrator then reaches its existing safe cancellation branch after composing a genuine `RestorePlan`, without writing or restoring anything. Add this asynchronous STA helper to the Foundation-created test host; it must pump the owning WPF dispatcher until the delegate finishes and rethrow its original exception:
+
+```csharp
+internal static Task RunAsync(Func<Task> action)
+{
+    TaskCompletionSource<object> completion =
+        new(TaskCreationOptions.RunContinuationsAsynchronously);
+    Thread thread = new(() =>
+    {
+        Dispatcher dispatcher = Dispatcher.CurrentDispatcher;
+        dispatcher.BeginInvoke(new Action(async () =>
+        {
+            try
+            {
+                await action();
+                completion.TrySetResult(null);
+            }
+            catch (Exception ex)
+            {
+                completion.TrySetException(ex);
+            }
+            finally
+            {
+                dispatcher.BeginInvokeShutdown(DispatcherPriority.Background);
+            }
+        }));
+        Dispatcher.Run();
+    });
+
+    thread.SetApartmentState(ApartmentState.STA);
+    thread.Start();
+    return completion.Task;
+}
+```
+
+- [ ] **Step 2: Run the tests to verify Confirm and WPF consent do not yet exist**
+
+Run:
+
+```powershell
+dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~ConfirmViewModelTests|FullyQualifiedName~RestoreConsentDialogTests"
+```
+
+Expected: compilation fails because the Confirm view model, WPF dialog, and owner-bound dialog service are undefined.
+
+- [ ] **Step 3: Implement impact grouping without inventing machine-state metadata**
+
+```csharp
+internal sealed class Notice
+{
+    internal Notice(string title, string text) { Title = title; Text = text; }
+    public string Title { get; }
+    public string Text { get; }
+}
+
+internal sealed class ConfirmViewModel : ObservableObject, IRunPresentation
+{
+    private Dispatcher dispatcher;
+    private IRunDialogService dialogService;
+    private Func<Window> ownerProvider;
+    private RunControl activeControl;
+    private bool isRestoring;
+    private readonly Action backToCompare;
+    private readonly ObservableCollection<string> logLines = new();
+
+    internal ConfirmViewModel(SnapshotEvent snapshot, IReadOnlyList<BackupBase> modules,
+                              Action backToCompare = null)
+    {
+        Snapshot = snapshot ?? throw new ArgumentNullException(nameof(snapshot));
+        Modules = modules?.Where(module => module != null).ToArray() ?? Array.Empty<BackupBase>();
+        this.backToCompare = backToCompare;
+        LogLines = new ReadOnlyObservableCollection<string>(logLines);
+        FidelityCaveat = RestorePlan.FidelityCaveat;
+        ConsentProcesses = Modules.SelectMany(module => module.ProcessesToCloseBeforeRestore ?? Array.Empty<RestoreCloseRequirement>())
+            .Where(requirement => requirement != null && requirement.NeedsConsent)
+            .GroupBy(requirement => requirement.ProcessName, StringComparer.OrdinalIgnoreCase)
+            .Select(group => group.First()).ToArray();
+        InformationalProcesses = Modules.SelectMany(module => module.ProcessesToCloseBeforeRestore ?? Array.Empty<RestoreCloseRequirement>())
+            .Where(requirement => requirement != null && !requirement.NeedsConsent)
+            .GroupBy(requirement => requirement.ProcessName, StringComparer.OrdinalIgnoreCase)
+            .Select(group => group.First()).ToArray();
+        ExplorerRestartModules = Modules.Where(module => module.RequiresExplorerRestart).ToArray();
+        ModuleWarnings = Modules.Where(module => !string.IsNullOrWhiteSpace(module.WarningMessage))
+            .Select(module => new Notice(module.Title, module.WarningMessage)).ToArray();
+
+        StartRestoreCommand = new DelegateCommand(_ => _ = StartFromCommandAsync(), _ => CanStartRestore);
+        CancelRestoreCommand = new DelegateCommand(_ => activeControl?.RequestCancellation(), _ => IsRestoring);
+        BackToCompareCommand = new DelegateCommand(_ => this.backToCompare?.Invoke(), _ => CanNavigate);
+    }
+
+    public SnapshotEvent Snapshot { get; }
+    public IReadOnlyList<BackupBase> Modules { get; }
+    public IReadOnlyList<RestoreCloseRequirement> ConsentProcesses { get; }
+    public IReadOnlyList<RestoreCloseRequirement> InformationalProcesses { get; }
+    public IReadOnlyList<BackupBase> ExplorerRestartModules { get; }
+    public IReadOnlyList<Notice> ModuleWarnings { get; }
+    public string FidelityCaveat { get; }
+    public bool IsSourcePartial => Snapshot.Kind == SnapshotEventKind.Partial;
+    public bool IsRestoring
+    {
+        get => isRestoring;
+        private set { isRestoring = value; OnPropertyChanged(); OnPropertyChanged(nameof(CanStartRestore)); OnPropertyChanged(nameof(CanNavigate)); StartRestoreCommand.RaiseCanExecuteChanged(); CancelRestoreCommand.RaiseCanExecuteChanged(); BackToCompareCommand.RaiseCanExecuteChanged(); }
+    }
+    public bool CanStartRestore => Modules.Count != 0 && !IsRestoring && dialogService != null && ownerProvider != null;
+    public bool CanNavigate => !IsRestoring;
+    public string ProgressText { get; private set; } = string.Empty;
+    public RunSummary Summary { get; private set; }
+    public DelegateCommand StartRestoreCommand { get; }
+    public DelegateCommand CancelRestoreCommand { get; }
+    public DelegateCommand BackToCompareCommand { get; }
+    public ReadOnlyObservableCollection<string> LogLines { get; }
+
+    internal void AttachRunSurfaces(Dispatcher dispatcher, Func<Window> ownerProvider,
+                                    IRunDialogService dialogs)
+    {
+        this.dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher));
+        this.ownerProvider = ownerProvider ?? throw new ArgumentNullException(nameof(ownerProvider));
+        dialogService = dialogs ?? throw new ArgumentNullException(nameof(dialogs));
+        OnPropertyChanged(nameof(CanStartRestore));
+        StartRestoreCommand.RaiseCanExecuteChanged();
+    }
+
+    private async Task StartFromCommandAsync()
+    {
+        try { await StartRestoreAsync(); }
+        catch (Exception ex) { ProgressText = "Restore could not start: " + ex.Message; OnPropertyChanged(nameof(ProgressText)); }
+    }
+
+    private void AppendLog(string text) => logLines.Add(text ?? string.Empty);
+    private void ClearLog() => logLines.Clear();
+
+    public void SetProgressText(string text) { ProgressText = text ?? string.Empty; OnPropertyChanged(nameof(ProgressText)); }
+    public void SetProgressPercent(int percent) { }
+    public void SetProgressDetail(string groupInfo, string elapsed, string remaining, string throughput, long bytesWritten, int errors, int warnings) { }
+    public void ShowSummary(RunSummary summary, string caption, IReadOnlyList<ModuleOutcome> outcomes)
+    { Summary = summary; OnPropertyChanged(nameof(Summary)); }
+    public void SetExplorerRestartVisible(bool visible) { ExplorerRestartVisible = visible; OnPropertyChanged(nameof(ExplorerRestartVisible)); }
+    public bool ExplorerRestartVisible { get; private set; }
+    
+}
+```
+
+Do not define a reboot collection, enum, label, or view-model property. Show a warning text only as the module supplied it, including an existing sign-out warning.
+
+- [ ] **Step 4: Implement owner-bound final dialogs and default-no snapshot override**
+
+```csharp
+internal sealed class RestoreRunDialogService : IRunDialogService
+{
+    private readonly Window owner;
+
+    internal RestoreRunDialogService(Window owner)
+        => this.owner = owner ?? throw new ArgumentNullException(nameof(owner));
+
+    public IReadOnlyList<string> ShowRestoreConsent(RestorePlan plan)
+    {
+        RestoreConsentDialog dialog = RestoreConsentDialog.Create(owner, plan);
+        return dialog.ShowDialog() == true ? dialog.ConsentedProcessNames : null;
+    }
+
+    public bool ConfirmSnapshotOverride(string text, string caption)
+        => MessageBox.Show(owner, text, caption, MessageBoxButton.YesNo,
+                           MessageBoxImage.Warning, MessageBoxResult.No) == MessageBoxResult.Yes;
+
+    public void ShowPlanCompositionError(string text, string caption)
+        => MessageBox.Show(owner, text, caption, MessageBoxButton.OK, MessageBoxImage.Error);
+}
+```
+
+```csharp
+internal sealed class ConsentChoice : ObservableObject
+{
+    internal ConsentChoice(RestoreConsentEntry entry) => Entry = entry;
+    internal RestoreConsentEntry Entry { get; }
+    public string Label => Entry.Label;
+    public bool IsSelected { get; set; }
+}
+
+internal sealed partial class RestoreConsentDialog : Window
+{
+    private readonly RestorePlan plan;
+
+    internal static RestoreConsentDialog Create(Window owner, RestorePlan plan)
+        => new RestoreConsentDialog(plan) { Owner = owner ?? throw new ArgumentNullException(nameof(owner)) };
+
+    internal RestoreConsentDialog(RestorePlan plan)
+    {
+        this.plan = plan ?? throw new ArgumentNullException(nameof(plan));
+        ConsentChoices = new ObservableCollection<ConsentChoice>(
+            this.plan.ConsentEntries.Select(entry => new ConsentChoice(entry)));
+        InitializeComponent();
+        DataContext = this;
+    }
+
+    public string ConfirmationText => plan.ConfirmationText;
+    public string FidelityCaveat => RestorePlan.FidelityCaveat;
+    public IReadOnlyList<string> InformationalCloseLines => plan.InformationalCloseLines;
+    public ObservableCollection<ConsentChoice> ConsentChoices { get; }
+    public IReadOnlyList<string> ConsentedProcessNames
+        => ConsentChoices.Where(choice => choice.IsSelected)
+            .Select(choice => choice.Entry.ProcessName).ToArray();
+
+    private void Restore_Click(object sender, RoutedEventArgs e) => DialogResult = true;
+}
+```
+
+`RestoreConsentDialog.Create` must set `Owner = owner`; all `RestoreConsentEntry` checkboxes start unchecked; its Cancel button has `IsCancel="True"`; and its Restore button sets `DialogResult = true` only after explicit click. `ShowRestoreConsent` returns `null` for Escape, close, or Cancel, preserving the orchestrator's cancellation behavior. The final dialog renders the actual `RestorePlan.ConfirmationText`, `FidelityCaveat`, `ConsentEntries`, and `InformationalCloseLines` generated after the real pre-restore snapshot destination is chosen.
+
+- [ ] **Step 5: Implement WPF launch using the existing orchestration sequence**
+
+```csharp
+internal async Task StartRestoreAsync()
+{
+    if (Modules.Count == 0 || IsRestoring || dialogService == null || ownerProvider == null || !RunCoordinator.TryStart())
+        return;
+
+    activeControl = new RunControl();
+    bool logSinkInstalled = false;
+    try
+    {
+        WpfLogSink logSink = new(dispatcher, AppendLog, ClearLog);
+        WpfRunUi runUi = new(dispatcher, this, dialogService, ownerProvider);
+        LogHelper.Instance.SetSink(logSink);
+        logSinkInstalled = true;
+        IsRestoring = true;
+
+        await new BackupRestoreOrchestrator(runUi, activeControl)
+            .RunRestore(Modules, Snapshot.CanonicalPath);
+    }
+    catch (Exception ex)
+    {
+        ShowSummary(RunSummary.For(Array.Empty<ModuleOutcome>(), false, RunVerb.Restore, ex.Message),
+                    "Restore", Array.Empty<ModuleOutcome>());
+    }
+    finally
+    {
+        if (logSinkInstalled)
+            LogHelper.Instance.SetSink(null);
+        activeControl?.Dispose();
+        activeControl = null;
+        IsRestoring = false;
+        RunCoordinator.SetRunning(false);
+    }
+}
+```
+
+Wire the visible Cancel action to `activeControl.RequestCancellation()` while `IsRestoring` is true. The method must pass the original selected snapshot directory, not an extracted comparison path, because `RunRestore` owns its own `BackupPayload.TryPrepareForRead` scope. Never call `SnapshotGate`, `RestoreScope.For`, `RestoreDispatch.Decide`, or `ExplorerRestartPrompt.IsNeeded` from WPF: the orchestrator invokes them in the retained safe order and reaches the owner-bound `ConfirmSnapshotOverride` exactly when `SnapshotDecision.RequiresOverride` is true.
+
+- [ ] **Step 6: Add accessible Confirm and consent XAML**
+
+```xml
+<!-- ConfirmView.xaml -->
+<UserControl x:Class="WinRestoreKit.Wpf.Views.ConfirmView"
+             AutomationProperties.Name="Confirm restore">
+  <Grid>
+    <Grid.RowDefinitions><RowDefinition Height="*"/><RowDefinition Height="Auto"/></Grid.RowDefinitions>
+    <ScrollViewer><StackPanel>
+      <TextBlock Text="Review restore impact" FontSize="24" FontWeight="SemiBold" />
+      <ItemsControl ItemsSource="{Binding Modules}" AutomationProperties.Name="Modules selected for restore" />
+      <ItemsControl ItemsSource="{Binding ConsentProcesses}" AutomationProperties.Name="Applications requiring consent to close" />
+      <ItemsControl ItemsSource="{Binding InformationalProcesses}" AutomationProperties.Name="Applications that will restart themselves" />
+      <ItemsControl ItemsSource="{Binding ExplorerRestartModules}" AutomationProperties.Name="Modules that may offer Explorer restart" />
+      <ItemsControl ItemsSource="{Binding ModuleWarnings}" AutomationProperties.Name="Existing module warnings" />
+      <TextBlock Text="{Binding FidelityCaveat}" TextWrapping="Wrap" />
+      <TextBlock Text="{Binding ProgressText}" TextWrapping="Wrap" />
+      <TextBlock Text="{Binding Summary.Headline}" FontWeight="SemiBold" />
+      <TextBlock Text="{Binding Summary.Detail}" TextWrapping="Wrap" />
+    </StackPanel></ScrollViewer>
+    <StackPanel Grid.Row="1" Orientation="Horizontal" HorizontalAlignment="Right">
+      <Button Content="Back to compare" Command="{Binding BackToCompareCommand}" IsEnabled="{Binding CanNavigate}" />
+      <Button Content="Cancel restore" Command="{Binding CancelRestoreCommand}" IsEnabled="{Binding IsRestoring}" Margin="8,0,0,0" />
+      <Button Content="Continue to restore" Command="{Binding StartRestoreCommand}"
+              IsEnabled="{Binding CanStartRestore}" Margin="8,0,0,0"
+              AutomationProperties.Name="Continue to final restore consent"
+              AutomationProperties.AutomationId="ConfirmRestoreButton" />
+    </StackPanel>
+  </Grid>
+</UserControl>
+
+<!-- RestoreConsentDialog.xaml -->
+<Window x:Class="WinRestoreKit.Wpf.Views.Dialogs.RestoreConsentDialog"
+        Title="Restore" WindowStartupLocation="CenterOwner"
+        AutomationProperties.Name="Restore consent">
+  <Grid Margin="24">
+    <Grid.RowDefinitions><RowDefinition Height="*"/><RowDefinition Height="Auto"/></Grid.RowDefinitions>
+    <ScrollViewer><StackPanel>
+      <TextBlock Text="{Binding ConfirmationText}" TextWrapping="Wrap" />
+      <TextBlock Text="{Binding FidelityCaveat}" TextWrapping="Wrap" Margin="0,12,0,0" />
+      <ItemsControl ItemsSource="{Binding ConsentChoices}"
+                    AutomationProperties.Name="Applications you agree to close">
+        <ItemsControl.ItemTemplate><DataTemplate>
+          <CheckBox Content="{Binding Label}" IsChecked="{Binding IsSelected, Mode=TwoWay}" />
+        </DataTemplate></ItemsControl.ItemTemplate>
+      </ItemsControl>
+      <ItemsControl ItemsSource="{Binding InformationalCloseLines}"
+                    AutomationProperties.Name="Applications that may close without consent">
+        <ItemsControl.ItemTemplate><DataTemplate>
+          <TextBlock Text="{Binding}" TextWrapping="Wrap" />
+        </DataTemplate></ItemsControl.ItemTemplate>
+      </ItemsControl>
+    </StackPanel></ScrollViewer>
+    <StackPanel Grid.Row="1" Orientation="Horizontal" HorizontalAlignment="Right">
+      <Button Content="Cancel" IsCancel="True" />
+      <Button Content="Restore" IsDefault="False" Click="Restore_Click" Margin="8,0,0,0"
+              AutomationProperties.Name="Confirm restore" />
+    </StackPanel>
+  </Grid>
+</Window>
+```
+
+```csharp
+// ConfirmView.xaml.cs; invoked from Loaded after the view has a real main-window owner.
+private void ConfirmView_Loaded(object sender, RoutedEventArgs e)
+{
+    if (DataContext is not ConfirmViewModel viewModel)
+        return;
+
+    Window owner = Window.GetWindow(this)
+        ?? throw new InvalidOperationException("Confirm must be hosted in a Window.");
+    viewModel.AttachRunSurfaces(Dispatcher, () => Window.GetWindow(this),
+        new RestoreRunDialogService(owner));
+}
+```
+
+This code-behind performs only WPF owner composition. `RestoreRunDialogService` retains the owner for WPF modal dialogs, while Foundation's `WpfRunUi` invokes the supplied live `Func<Window>` and exposes its opaque result through `IRunUi.DialogOwner` to the retained Core `AppStoreApps.RestoreAsync(path, ui.DialogOwner)` / `RestoreDialog` callback seam; it contains no restore policy or data access.
+
+The Confirm view's primary button is intentionally not the final modal consent. Clicking it lets the orchestrator compose the exact plan and opens `RestoreConsentDialog`, where the user explicitly clicks Restore. This keeps the existing partial pre-restore-snapshot consent after `SnapshotGate` at its mandatory point immediately before writes.
+
+- [ ] **Step 7: Run the focused Confirm/dialog tests and verify the safe orchestrator path**
+
+Run:
+
+```powershell
+dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~ConfirmViewModelTests|FullyQualifiedName~RestoreConsentDialogTests|FullyQualifiedName~RestoreConsentCancellationTests"
+```
+
+Expected: PASS; the final dialog is owned by the active WPF window with no preselected consent, only declared Core impacts are shown, and a final-dialog cancellation produces the existing no-changes restore summary through `BackupRestoreOrchestrator`.
+
+- [ ] **Step 8: Commit Confirm and owner-bound restore consent**
+
+```powershell
+git add src/WinRestoreKit.Wpf/ViewModels/ConfirmViewModel.cs src/WinRestoreKit.Wpf/Services/RestoreRunDialogService.cs src/WinRestoreKit.Wpf/Views/ConfirmView.xaml src/WinRestoreKit.Wpf/Views/ConfirmView.xaml.cs src/WinRestoreKit.Wpf/Views/Dialogs/RestoreConsentDialog.xaml src/WinRestoreKit.Wpf/Views/Dialogs/RestoreConsentDialog.xaml.cs src/WinRestoreKit.Wpf/Navigation/CompareWorkflowNavigator.cs src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs src/WinRestoreKit.Tests/WpfTestHost.cs src/WinRestoreKit.Tests/ConfirmViewModelTests.cs src/WinRestoreKit.Tests/RestoreConsentDialogTests.cs
+git commit -m "feat: confirm WPF restores safely"
+```
+
+### Task 6: Verify the complete Compare → Confirm path without changing backup or cutover scope
+
+**Files:**
+- Modify: `src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs`
+- Modify: `src/WinRestoreKit.Tests/ComparisonWorkspaceViewModelTests.cs`
+- Modify: `src/WinRestoreKit.Tests/ConfirmViewModelTests.cs`
+- Modify: `src/WinRestoreKit.Tests/RestoreConsentDialogTests.cs`
+
+**Interfaces:**
+- Consumes: all contracts from Tasks 1–5.
+- Produces: a tested Stage-3 workflow boundary. No project identity, publish configuration, backup creation flow, WinForms deletion, or semantic-provider surface is produced by this task.
+
+- [ ] **Step 1: Add failing cross-workflow regression tests for snapshot replacement and partial source labeling**
+
+```csharp
+[Fact]
+public async Task Navigator_ChangingSnapshotWithRestoreSet_CancelKeepsOriginalSetAndDisposesIncomingScope()
+{
+    await WpfTestHost.RunAsync(async () =>
+    {
+        TestDiscardDialog dialogs = new(answer: false);
+        CompareWorkflowNavigator navigator = Navigator(dialogs);
+        navigator.OpenCompare(Prepared("first"));
+        await navigator.PendingTransition;
+        navigator.CurrentWorkspace.RestoreSet.Add(navigator.CurrentWorkspace.Rows[0].Comparison);
+
+        string incomingOwnedPath = Path.Combine(Path.GetTempPath(), "WinRestoreKit.Tests",
+            Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(incomingOwnedPath);
+        SnapshotPayloadPreparation incoming = new SnapshotPayloadPreparation(
+            SnapshotFor(incomingOwnedPath, "second"),
+            new BackupPayload.ReadScope(incomingOwnedPath, incomingOwnedPath), error: null);
+
+        navigator.OpenCompare(incoming);
+        await navigator.PendingTransition;
+
+        Assert.Equal("first", navigator.CurrentWorkspace.Snapshot.DisplayName);
+        Assert.True(navigator.CurrentWorkspace.RestoreSet.HasItems);
+        Assert.False(Directory.Exists(incomingOwnedPath));
+    });
+}
+
+[Fact]
+public void Confirm_PartialSourceStaysExplicitWithoutBypassingSnapshotGate()
+{
+    WpfTestHost.Run(() =>
+    {
+        ConfirmViewModel viewModel = new ConfirmViewModel(PartialSnapshot(), new[] { ModuleWithArtifact() });
+
+        Assert.Equal(SnapshotEventKind.Partial, viewModel.Snapshot.Kind);
+        Assert.True(viewModel.IsSourcePartial);
+    });
+}
+```
+
+The second test pins the separation between a selected partial source and the later, orchestrator-owned pre-restore `SnapshotGate` result: WPF can label the source honestly but cannot pre-authorize an override.
+
+- [ ] **Step 2: Run the Stage-3 focused test set and verify the new integration tests fail**
+
+Run:
+
+```powershell
+dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~SnapshotComparisonServiceTests|FullyQualifiedName~RestoreSetViewModelTests|FullyQualifiedName~ComparisonWorkspaceViewModelTests|FullyQualifiedName~ConfirmViewModelTests|FullyQualifiedName~RestoreConsentDialogTests"
+```
+
+Expected: FAIL until snapshot replacement retains/cancels state exactly as specified and Confirm exposes the partial-source label while leaving the snapshot override decision to the orchestrator.
+
+- [ ] **Step 3: Implement the remaining workflow facts and preserve existing tests**
+
+```csharp
+internal bool IsSourcePartial => Snapshot.Kind == SnapshotEventKind.Partial;
+```
+
+Complete `CompareWorkflowNavigator` so it disposes every rejected incoming preparation, waits for `CancelAsync()` before replacing an active comparison, and clears the old restore set only after accepted replacement. Keep the existing WinForms-only regression tests unchanged while the side-by-side shell remains runnable; later cutover removes them only after explicit WPF/Application replacements. Do not delete them in this plan.
+
+- [ ] **Step 4: Run all Stage-3 focused tests and verify success**
+
+Run:
+
+```powershell
+dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~SnapshotComparisonServiceTests|FullyQualifiedName~RestoreSetViewModelTests|FullyQualifiedName~ComparisonWorkspaceViewModelTests|FullyQualifiedName~ConfirmViewModelTests|FullyQualifiedName~RestoreConsentDialogTests|FullyQualifiedName~RestoreContentsTests|FullyQualifiedName~RestorePlanTests|FullyQualifiedName~RestoreScopeTests|FullyQualifiedName~RestoreDispatchTests|FullyQualifiedName~SnapshotGateConsentTests|FullyQualifiedName~ExplorerRestartPromptTests"
+```
+
+Expected: PASS; comparison behavior is deterministic and isolated, WPF selection/confirmation is safe, and the retained Core restore gates still pass their original contracts.
+
+- [ ] **Step 5: Build and run the WPF Compare/Confirm smoke path**
+
+Run:
+
+```powershell
+dotnet build src/WinRestoreKit.sln -c Debug
+dotnet run --project src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj -c Debug
+```
+
+Expected: build succeeds with zero errors; the WPF app opens while the WinForms project remains runnable.
+
+In the launched WPF application, exercise this exact read-only path with a local verified or partial Timeline snapshot:
+
+1. Select the snapshot with keyboard Enter; confirm its Compare view names the selected snapshot and starts with **All modules** selected.
+2. Wait for results; verify Changed, Same, Unavailable, and Not captured labels remain textually distinct, and a known unavailable row remains visible under All.
+3. Switch to Changed only, then back to All; verify row evidence and any already-added usable module remain unchanged.
+4. Open a row's detail tray; verify it displays only target/process declarations, existing warning text, and an Explorer note only for modules declaring `RequiresExplorerRestart`; verify no reboot claim is displayed.
+5. Add a Changed row and, if available, an Unavailable row with a proven artifact; verify a Not captured row cannot be added. Select another Timeline snapshot, first choose Cancel and confirm the original restore set remains, then choose the explicit discard action and confirm the set clears.
+6. Continue to Confirm; verify selected modules and process/Explorer groups, then press Continue to restore. Verify the modal consent dialog is centered on and blocked by the main WPF window, has no prechecked consent boxes, and Cancel returns the existing no-changes result without a restore write.
+7. For a controlled test where the pre-restore snapshot is incomplete, verify the owner-bound `Pre-restore snapshot` Yes/No prompt appears only after the original pipeline reaches `SnapshotGate`, defaults to No, and No prevents restore writes.
+
+- [ ] **Step 6: Commit the verified Stage-3 boundary**
+
+```powershell
+git add src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs src/WinRestoreKit.Tests/ComparisonWorkspaceViewModelTests.cs src/WinRestoreKit.Tests/ConfirmViewModelTests.cs src/WinRestoreKit.Tests/RestoreConsentDialogTests.cs
+git commit -m "test: cover compare confirm restore workflow"
+```
+
+## Plan Self-Review
+
+- **Spec coverage:** Tasks 2–3 cover arbitrary selected snapshot comparison, manifest precedence, the four states, per-module isolation, bounded cancellation, and read-scope cleanup. Task 4 covers All by default, Changed only, ordered rows, detail tray, whole-module selection, and snapshot-change clearing. Task 5 preserves restore impacts, creates owner-bound consent, and launches only the existing orchestration/gates. Task 6 exercises the combined selection/confirmation and WPF smoke path. Backup creation, progress/results migration, app-restoration UX expansion, project identity, publishing, and cutover are intentionally delegated to their respective later plans.
+- **No fabricated evidence:** No XAML or ViewModel parses registry exports/payload contents, constructs before/after values, adds semantic providers, or creates reboot metadata. All visible impacts come from existing typed Core declarations or verbatim module warnings.
+- **Type consistency:** Every later WPF component consumes `BackupModuleRegistration`, `SnapshotEvent`, `SnapshotPayloadPreparation`, `ModuleComparison`, `RestoreSetViewModel`, and the Foundation `WpfRunUi` interfaces defined in the interface map. The required public comparison signature remains exactly `CompareAsync(SnapshotEvent, IReadOnlyList<BackupBase>, CancellationToken)`.
+- **Placeholder scan:** This plan contains no TODO/TBD/future implementation steps. Deferred scope is named only where the approved migration sequence assigns it to a different complete plan.
+
diff --git a/docs/superpowers/plans/2026-08-09-timeline-compare-wpf-migration-roadmap.md b/docs/superpowers/plans/2026-08-09-timeline-compare-wpf-migration-roadmap.md
new file mode 100644
index 0000000..11fa4fa
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-09-timeline-compare-wpf-migration-roadmap.md
@@ -0,0 +1,77 @@
+# Timeline + Compare WPF Migration Roadmap
+
+> **For agentic workers:** Execute the linked implementation plans in order. Each linked plan requires `superpowers:subagent-driven-development` (recommended) or `superpowers:executing-plans` and contains its own checkbox steps, tests, review gate, and commits.
+
+**Goal:** Replace WinRestoreKit’s WinForms shell with the approved Timeline + Compare WPF application while preserving Core behavior, restore safeguards, snapshot compatibility, and the self-contained Windows executable.
+
+**Architecture:** Introduce a framework-neutral `WinRestoreKit.Application` layer between `WinRestoreKit.Core` and the two temporary shells. Build and verify the WPF shell side by side, migrate one complete workflow at a time, then remove WinForms only after parity and real-desktop verification.
+
+**Tech Stack:** .NET 8, C#, WPF, MVVM, xUnit, Windows UI Automation, self-contained `win-x64` single-file publishing.
+
+## Global Constraints
+
+- Preserve existing backup and restore engine semantics, snapshot format, local storage model, and safety gates.
+- Keep the WinForms application runnable until Timeline, Compare/Confirm, Backup/Progress, History, Settings, About, and dialogs have verified WPF equivalents.
+- `WinRestoreKit.Application` must reference neither WinForms nor WPF.
+- WPF views and view models must not parse registry exports or invent comparison values.
+- Comparison is read-only and uses `HasArtifactIn` followed by `HasDriftedFrom`; one module failure must not erase other results.
+- Restore selection remains whole-module and incomplete-snapshot consent remains mandatory immediately before restore writes.
+- Do not retain unsafe incomplete folders merely to make failed attempts durable; non-persistable failures are current-session events only.
+- Support Follow system, Light, and Dark themes, 100–200% DPI, a 1024 px minimum usable width, reduced motion, keyboard operation, and UI Automation.
+- Preserve `highestAvailable`, `longPathAware`, `WinRestoreKit.ico`, the exact `Properties/AssemblyInfo.cs` version source, and `GenerateAssemblyInfo=false` on the shipping app.
+- Final publishing remains self-contained `win-x64`, single-file, native self-extracting, compressed, and untrimmed.
+- Final cutover removes obsolete WinForms views, forms, controls, resources, helpers, tests, and compatibility paths; no shims remain.
+
+---
+
+## Execution Order
+
+- [ ] **Stage 1: Build the neutral application layer and side-by-side WPF shell**
+
+  Execute: [`2026-08-09-wpf-foundation-application-shell.md`](2026-08-09-wpf-foundation-application-shell.md)
+
+  Gate: both the existing WinForms application and the new WPF shell build and launch; shared orchestration compiles without a UI-framework reference; theme/settings/about/update seams have focused tests.
+
+- [ ] **Stage 2: Replace Home and primary History with the Timeline event model**
+
+  Execute: [`2026-08-09-timeline-event-model.md`](2026-08-09-timeline-event-model.md)
+
+  Gate: Timeline and advanced History consume one event source; ordering and event states are deterministic; verified/partial snapshots are selectable; failed/unreadable events are diagnostic-only; compressed selection cleans up its private read scope.
+
+- [ ] **Stage 3: Add honest comparison, restore selection, and confirmation**
+
+  Execute: [`2026-08-09-compare-confirm-restore.md`](2026-08-09-compare-confirm-restore.md)
+
+  Gate: arbitrary selected snapshots produce Changed, Same, Unavailable, and Not captured module rows; the default All-modules filter cannot hide unsupported probes; restore selection and consent use existing safety contracts; comparison remains read-only.
+
+- [ ] **Stage 4: Migrate Create Snapshot, progress, results, and app restore**
+
+  Execute: [`2026-08-09-backup-progress-results.md`](2026-08-09-backup-progress-results.md)
+
+  Gate: Create snapshot → selection → progress → result → Timeline works in WPF; run admission, pause, cancel, compression, manifest/log, late-cancel wording, dialogs, and session-event behavior match current contracts.
+
+- [ ] **Stage 5: Verify parity and perform the clean WPF cutover**
+
+  Execute: [`2026-08-09-wpf-cutover-release-verification.md`](2026-08-09-wpf-cutover-release-verification.md)
+
+  Gate: real Windows desktop verification passes before deletion; WPF is the sole shipping `WinRestoreKit` application; relevant tests pass; all obsolete WinForms artifacts are gone; the publish directory contains exactly one verified `WinRestoreKit.exe`.
+
+## Cross-Stage Review Rules
+
+1. Run each linked plan’s focused test command before its commit.
+2. Run `dotnet build src/WinRestoreKit.sln -c Debug` at every stage gate.
+3. Run `dotnet test src/WinRestoreKit.sln -c Debug --no-build` after the corresponding successful build.
+4. Review each stage against `docs/superpowers/specs/2026-08-09-timeline-compare-wpf-shell-design.md` before starting the next stage.
+5. Stop the cutover if a workflow exists only in WinForms, a comparison value lacks Core evidence, a restore gate can be bypassed, or the WPF executable has not passed real-desktop verification.
+
+## Completion Evidence
+
+The migration is complete only when the Stage 5 plan records:
+
+- the full build and test outputs;
+- the runtime smoke-test matrix for Timeline, Compare, Confirm, Backup, Progress, Results, History, Settings, About, and dialogs;
+- keyboard, UI Automation, reduced-motion, theme, responsive-width, and DPI results;
+- screenshot-baseline comparisons;
+- the exact publish command and one-file directory listing;
+- executable metadata, checksum, launch evidence, manifest/elevation behavior, packaged resource behavior, and update-version coherence; and
+- a repository search showing no obsolete WinForms project, source, designer, resource, control, helper, or compatibility path remains.
diff --git a/docs/superpowers/plans/2026-08-09-timeline-event-model.md b/docs/superpowers/plans/2026-08-09-timeline-event-model.md
new file mode 100644
index 0000000..5e1a5ca
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-09-timeline-event-model.md
@@ -0,0 +1,906 @@
+# Timeline Event Model Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Deliver one framework-neutral snapshot-event source and an accessible WPF Timeline plus advanced History that can select verified or partial snapshots safely, while making failures and unreadable entries diagnostic-only.
+
+**Architecture:** Move filesystem discovery out of the WinForms view layer into `WinRestoreKit.Application`, preserving the existing root-recognition and manifest/payload semantics. `SnapshotEventCatalog` classifies and orders immutable events once; both WPF representations project the same event object through the same status projection. A selected event is prepared by a disposable Application-layer payload service and ownership transfers to the future Compare stage without exposing payload or manifest text to XAML.
+
+**Tech Stack:** .NET 8 (`net8.0-windows` framework-neutral Application layer and `net8.0-windows` WPF/test projects), WPF/MVVM, xUnit 2.9.3, Core `BackupManifest`, `BackupPayload`, `BackupLog`, `BackupRootRegistry`, and `DataHelper.Data`.
+
+## Global Constraints
+
+- Execute this plan after the Foundation plan has created `src/WinRestoreKit.Application/WinRestoreKit.Application.csproj`, moved `Settings/BackupRootRegistry.cs`, and granted Application access to Core internals.
+- `WinRestoreKit.Application` MUST reference neither WinForms nor WPF; its namespace remains `WinRestoreKit`.
+- Preserve the existing Core snapshot format, backup/restore behavior, custom-root recognition, and `BackupPayload.TryPrepareForRead` cleanup semantics.
+- The shared public event contract is exactly `SnapshotEventKind { Verified, Partial, Failed, Unreadable }`, immutable `SnapshotEvent`, and `SnapshotEventCatalog.Read(...)` (implemented here as the public instance method `Read()`).
+- The sort is deterministic: descending event timestamp, then `StringComparer.Ordinal` on the canonical full path. Never rely on directory enumeration order or localized string comparison.
+- `Verified` and `Partial` are selectable; `Failed` and `Unreadable` are diagnostic-only and must never enter Compare or Restore.
+- Durable failures are limited to retained attempts: a folder which remains on disk and has retained folder/manifest/log evidence survives restart and is rediscovered. Folder-creation failures and cancelled runs whose owned folder was deleted by cleanup are session-only events; they MUST NOT be persisted and MUST NOT affect retention or cleanup safety.
+- A failed custom root or manifest/payload read must show the real exception message or the truthful validation failure; no error may be rendered as “No backups yet”, an empty snapshot, or a guessed success.
+- Compressed selection uses a private `BackupPayload.ReadScope`; every unsuccessful path disposes it immediately, and the receiver that accepts a successful preparation owns disposal.
+- WPF uses MVVM. Views never parse registry exports, manifests, logs, or payload files. This plan intentionally does not create comparison rows or restore confirmation.
+- Keep the existing WinForms shell runnable during migration. Do not add a compatibility overload or a second status-classification path.
+- Keep tests in `src/WinRestoreKit.Tests`; update their project references for Application/WPF and add an STA helper for WPF construction.
+
+## Produced Interfaces
+
+These are the only Timeline interfaces later plans may consume.
+
+```csharp
+namespace WinRestoreKit;
+
+public enum SnapshotEventKind { Verified, Partial, Failed, Unreadable }
+
+public interface ISnapshotEventReader
+{
+    IReadOnlyList<SnapshotEvent> Read();
+}
+
+public sealed class SnapshotEvent
+{
+    internal SnapshotEvent(
+        SnapshotEventKind kind, DateTime created, string displayName,
+        string canonicalPath, string diagnosticReason, string machineName,
+        long sizeBytes, bool isSizeComplete, ManifestData manifest);
+
+    public SnapshotEventKind Kind { get; }
+    public DateTime Created { get; }
+    public string DisplayName { get; }
+    public string CanonicalPath { get; }
+    public string DiagnosticReason { get; }
+    public string MachineName { get; }
+    public long SizeBytes { get; }
+    public bool IsSizeComplete { get; }
+    public bool IsRestorable { get; } // true only for Verified and Partial
+
+    // Internal so WPF never sees Core persistence text. Application comparison code may read it.
+    internal ManifestData Manifest { get; }
+}
+
+public sealed class SnapshotEventCatalog : ISnapshotEventReader
+{
+    public SnapshotEventCatalog();
+    public IReadOnlyList<SnapshotEvent> Read();
+    public void RecordSessionFailure(DateTime created, string displayName, string diagnosticReason);
+}
+
+public interface ISnapshotPayloadPreparationService
+{
+    Task<SnapshotPayloadPreparation> PrepareAsync(
+        SnapshotEvent snapshot, CancellationToken cancellationToken);
+}
+
+public sealed class SnapshotPayloadPreparation : IDisposable
+{
+    internal SnapshotPayloadPreparation(SnapshotEvent snapshot, BackupPayload.ReadScope scope, string error);
+    public SnapshotEvent Snapshot { get; }
+    public string Path { get; }
+    public string Error { get; }
+    public bool IsPrepared { get; }
+    public void Dispose();
+}
+
+public sealed class SnapshotPayloadPreparationService : ISnapshotPayloadPreparationService
+{
+    public Task<SnapshotPayloadPreparation> PrepareAsync(
+        SnapshotEvent snapshot, CancellationToken cancellationToken);
+}
+```
+
+```csharp
+// src/WinRestoreKit.Wpf/Navigation/ITimelineNavigator.cs
+namespace WinRestoreKit.Wpf.Navigation;
+
+internal interface ITimelineNavigator
+{
+    void OpenCompare(SnapshotPayloadPreparation preparation); // ownership transfers to receiver
+    void ShowSnapshotDiagnostic(SnapshotEvent snapshot);
+}
+```
+
+```csharp
+// Bound WPF types and every property XAML binds MUST be public: WPF binding reflects public
+// properties and silently drops inaccessible bindings.
+public sealed class SnapshotEventStatus
+{
+    public string Label { get; }
+    public string Glyph { get; }
+    public bool IsDiagnosticOnly { get; }
+}
+
+public sealed class SnapshotEventViewModel
+{
+    public SnapshotEvent Event { get; }
+    public SnapshotEventStatus Status { get; }
+    public string DisplayName { get; }
+    public string CreatedDisplay { get; }
+    public string DiagnosticReason { get; }
+    public bool HasDiagnostic { get; }
+    public string AutomationName { get; }
+}
+
+public sealed class TimelineViewModel : INotifyPropertyChanged
+{
+    internal TimelineViewModel(
+        ISnapshotEventReader catalog,
+        ISnapshotPayloadPreparationService preparationService,
+        ITimelineNavigator navigator);
+
+    public ReadOnlyObservableCollection<SnapshotEventViewModel> Events { get; }
+    public SnapshotEventViewModel SelectedEvent { get; set; }
+    public string SelectionError { get; }
+    public bool HasSelectionError { get; }
+    public event PropertyChangedEventHandler PropertyChanged;
+    internal Task RefreshAsync(CancellationToken cancellationToken = default);
+    internal Task OpenSelectedAsync(CancellationToken cancellationToken = default);
+}
+
+public sealed class AdvancedHistoryViewModel : INotifyPropertyChanged
+{
+    internal AdvancedHistoryViewModel(ISnapshotEventReader catalog);
+
+    public ICollectionView Events { get; }
+    public string SearchText { get; set; }
+    public SnapshotEventViewModel SelectedEvent { get; set; }
+    public event PropertyChangedEventHandler PropertyChanged;
+    internal Task RefreshAsync(CancellationToken cancellationToken = default);
+}
+```
+
+---
+
+### Task 1: Move lossless backup-folder discovery into Application
+
+**Files:**
+- Create: `src/WinRestoreKit.Application/Snapshots/BackupFolders.cs`
+- Delete: `src/WinRestoreKit/Views/BackupFolders.cs`
+- Modify: `src/WinRestoreKit/WinRestoreKit.csproj`
+- Modify: `src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj`
+- Modify: `src/WinRestoreKit.Tests/BackupFoldersReadTests.cs`
+- Modify: `src/WinRestoreKit/MainForm.cs`
+- Modify: `src/WinRestoreKit/Views/HomePageView.cs`
+- Modify: `src/WinRestoreKit/Views/HistoryPageView.cs`
+- Modify: `src/WinRestoreKit/Views/ProgressPageView.cs`
+- Modify: `src/WinRestoreKit/Views/RestoreWizardStep1View.cs`
+- Modify: `src/WinRestoreKit/Views/RestoreWizardStep2View.cs`
+- Test: `src/WinRestoreKit.Tests/BackupFoldersReadTests.cs`
+
+**Interfaces:**
+- Consumes: Foundation’s framework-neutral Application project, `Settings/BackupRootRegistry.cs`, Core `Data.DataRootDir`, `BackupManifest`, `BackupPayload`, and `BackupLog`.
+- Produces: internal `WinRestoreKit.BackupFolders` and `BackupFolder` with the existing `Read()`, `Backups`, `Snapshots`, `UnreadableReason`, `Path`, `Name`, `DisplayName`, `Created`, and `ReadManifest()` members, plus internal `ManifestError` that records an invalid/unreadable manifest reason. Existing WinForms callers consume these through an Application friend assembly, not a copied View implementation.
+
+- [ ] **Step 1: Write failing discovery-preservation tests**
+
+Move the existing `BackupFoldersReadTests` import from `Views` to `WinRestoreKit`, retaining its custom-root coverage. Add a malformed-manifest test and an unreadable-root assertion that tests the actual message rather than a synthetic empty-state label:
+
+```csharp
+[Fact]
+public void Read_MalformedManifestKeepsValidationReason()
+{
+    RunWithRoots((defaultRoot, customRoot) =>
+    {
+        string folder = Directory.CreateDirectory(Path.Combine(defaultRoot, "bad-manifest")).FullName;
+        File.WriteAllText(Path.Combine(folder, BackupManifest.FileName), "{ not json");
+
+        BackupFolder found = Assert.Single(BackupFolders.Read().Backups);
+
+        Assert.Null(found.ReadManifest());
+        Assert.Equal("The backup manifest is invalid or uses an unsupported schema.", found.ManifestError);
+    });
+}
+```
+
+- [ ] **Step 2: Run the focused test and verify it fails**
+
+Run: `dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter FullyQualifiedName~BackupFoldersReadTests`
+
+Expected: FAIL to compile because `WinRestoreKit.BackupFolders` and `BackupFolder.ManifestError` do not yet exist in Application.
+
+- [ ] **Step 3: Move the filesystem-only types and preserve root behavior**
+
+Move the old implementation without UI references to `src/WinRestoreKit.Application/Snapshots/BackupFolders.cs`, change its namespace to `WinRestoreKit`, and retain the existing default-root/custom-root rules verbatim: direct `Directory.GetDirectories`, recognizability only for custom children, nested-custom-root exclusion, snapshot-name handling, manifest timestamp preference, and legacy timestamp-name recognition. Do not retain a forwarding class in `Views`.
+
+Add explicit manifest evidence while retaining `ReadManifest()` compatibility for legacy WinForms consumers:
+
+```csharp
+internal sealed class BackupFolder
+{
+    private readonly ManifestData manifest;
+
+    internal BackupFolder(string path)
+    {
+        Path = path;
+        Name = System.IO.Path.GetFileName(path);
+        manifest = ReadManifest(path, out string manifestError);
+        ManifestError = manifestError;
+        Created = ReadCreated(path, manifest);
+    }
+
+    internal string ManifestError { get; }
+    internal ManifestData ReadManifest() => manifest;
+
+    private static ManifestData ReadManifest(string path, out string error)
+    {
+        error = null;
+        string file = System.IO.Path.Combine(path, BackupManifest.FileName);
+        try
+        {
+            if (!File.Exists(file))
+                return null;
+
+            ManifestData parsed = BackupManifest.TryParse(File.ReadAllText(file));
+            if (parsed == null)
+                error = "The backup manifest is invalid or uses an unsupported schema.";
+            return parsed;
+        }
+        catch (Exception ex)
+        {
+            error = ex.Message;
+            return null;
+        }
+    }
+}
+```
+
+Reference Application from the still-runnable WinForms project and tests; remove the compiled View source rather than leaving a duplicate filesystem reader:
+
+```xml
+<ItemGroup>
+  <ProjectReference Include="..\WinRestoreKit.Application\WinRestoreKit.Application.csproj" />
+  <ProjectReference Include="..\WinRestoreKit.Core\WinRestoreKit.Core.csproj" />
+</ItemGroup>
+```
+
+Foundation owns the necessary Application friend declaration; before moving the types, confirm `src/WinRestoreKit.Application/Properties/AssemblyInfo.cs` contains `[assembly: InternalsVisibleTo("WinRestoreKit")]`. Do not add a second declaration in this plan.
+
+Add `using WinRestoreKit;` to each of `MainForm.cs`, `HomePageView.cs`, `HistoryPageView.cs`, `ProgressPageView.cs`, `RestoreWizardStep1View.cs`, and `RestoreWizardStep2View.cs` when it is not already present. Preserve each existing call to `BackupFolders.Read()`, `BackupFolder`, `ReadManifest()`, and `IsSnapshot`; only its assembly owner changes. This is required to keep every WinForms backup/restore picker, progress surface, and existing Home/History view compiling and runnable while WPF is introduced.
+
+- [ ] **Step 4: Run the focused discovery tests and compile the side-by-side shell**
+
+Run: `dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter FullyQualifiedName~BackupFoldersReadTests`
+
+Expected: PASS; existing default/custom/nested root cases still pass, and malformed JSON produces the validation reason while an inaccessible root retains its OS-supplied error message.
+
+Run: `dotnet build src/WinRestoreKit.sln`
+
+Expected: Build succeeds. The WinForms app still resolves `BackupFolders` and `BackupFolder` from its Application friend assembly; no `Views.BackupFolders` copy remains.
+
+- [ ] **Step 5: Commit the discovery extraction**
+
+```bash
+git add src/WinRestoreKit.Application/Snapshots/BackupFolders.cs src/WinRestoreKit/WinRestoreKit.csproj src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj src/WinRestoreKit/MainForm.cs src/WinRestoreKit/Views/HomePageView.cs src/WinRestoreKit/Views/HistoryPageView.cs src/WinRestoreKit/Views/ProgressPageView.cs src/WinRestoreKit/Views/RestoreWizardStep1View.cs src/WinRestoreKit/Views/RestoreWizardStep2View.cs src/WinRestoreKit.Tests/BackupFoldersReadTests.cs
+git rm src/WinRestoreKit/Views/BackupFolders.cs
+git commit -m "refactor: move backup folder discovery to application"
+```
+
+### Task 2: Add the immutable event DTO, status classifier, and deterministic catalog
+
+**Files:**
+- Create: `src/WinRestoreKit.Application/Snapshots/SnapshotEventKind.cs`
+- Create: `src/WinRestoreKit.Application/Snapshots/SnapshotEvent.cs`
+- Create: `src/WinRestoreKit.Application/Snapshots/SnapshotEventCatalog.cs`
+- Create: `src/WinRestoreKit.Tests/SnapshotEventCatalogTests.cs`
+- Test: `src/WinRestoreKit.Tests/SnapshotEventCatalogTests.cs`
+
+**Interfaces:**
+- Consumes: Task 1’s lossless `BackupFolders`/`BackupFolder` discovery, `ManifestData`, manifest state literals, and moved `BackupRootRegistry` root configuration.
+- Produces: the exact public `SnapshotEventKind`, `SnapshotEvent`, and `SnapshotEventCatalog` interfaces in **Produced Interfaces**. Later comparison code may read `SnapshotEvent.Manifest` only inside Application; WPF consumes only public DTO fields.
+
+- [ ] **Step 1: Write failing catalog contract tests**
+
+Create a catalog test fixture that temporarily sets `Data.DataRootDir`, isolates `BackupRootRegistry`, and constructs one app-lifetime `SnapshotEventCatalog`. Write valid v1 manifests using the real schema fields. Add these focused facts:
+
+```csharp
+[Fact]
+public void Read_OrdersSameTimestampByOrdinalCanonicalPath()
+{
+    using TempDirectory root = TempDirectory.Create();
+    WriteManifest(root.Create("zulu"), "2026-08-09T12:00:00.0000000Z", "succeeded");
+    WriteManifest(root.Create("alpha"), "2026-08-09T12:00:00.0000000Z", "succeeded");
+    UseBackupRoots(root.Path, () =>
+    {
+        IReadOnlyList<SnapshotEvent> events = new SnapshotEventCatalog().Read();
+
+        Assert.Equal(new[] { "alpha", "zulu" }, events.Select(e => e.DisplayName));
+    });
+}
+
+[Fact]
+public void Read_ClassifiesFailedPartialAndUnreadableWithoutMakingThemRestorable()
+{
+    using TempDirectory root = TempDirectory.Create();
+    WriteManifest(root.Create("verified"), "2026-08-09T11:00:00.0000000Z", "succeeded");
+    WriteManifest(root.Create("partial"), "2026-08-09T10:00:00.0000000Z", "skipped");
+    WriteManifest(root.Create("failed"), "2026-08-09T09:00:00.0000000Z", "failed");
+    File.WriteAllText(Path.Combine(root.Create("broken"), BackupManifest.FileName), "not-json");
+
+    UseBackupRoots(root.Path, () =>
+    {
+        SnapshotEvent[] events = new SnapshotEventCatalog().Read().ToArray();
+
+        Assert.Equal(SnapshotEventKind.Verified, events.Single(e => e.DisplayName == "verified").Kind);
+        Assert.Equal(SnapshotEventKind.Partial, events.Single(e => e.DisplayName == "partial").Kind);
+        Assert.Equal(SnapshotEventKind.Failed, events.Single(e => e.DisplayName == "failed").Kind);
+        SnapshotEvent unreadable = events.Single(e => e.DisplayName == "broken");
+        Assert.Equal(SnapshotEventKind.Unreadable, unreadable.Kind);
+        Assert.False(events.Single(e => e.DisplayName == "failed").IsRestorable);
+        Assert.False(unreadable.IsRestorable);
+        Assert.NotEmpty(unreadable.DiagnosticReason);
+    });
+}
+```
+
+Also add facts for: an empty manifest module list is `Failed`; a manifest with any succeeded plus skipped/failed/unknown module is `Partial`; a missing manifest in a recognized legacy folder is `Partial`; an unreadable root produces one `Unreadable` event containing `ex.Message` while readable roots remain represented; and a `RecordSessionFailure` entry disappears when a fresh catalog instance simulates restart.
+
+- [ ] **Step 2: Run the catalog tests and verify they fail**
+
+Run: `dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter FullyQualifiedName~SnapshotEventCatalogTests`
+
+Expected: FAIL to compile because `SnapshotEventKind`, `SnapshotEvent`, and `SnapshotEventCatalog` are absent.
+
+- [ ] **Step 3: Implement the one canonical status path**
+
+Keep all classification in `SnapshotEventCatalog`; do not reproduce `HistoryPageView.ReadResult`, `HomePageView.IsEntirelyFailed`, or text-log parsing. Construct a normal folder event with its canonical full path and actual size evidence. Classify only from trusted manifest evidence:
+
+```csharp
+private static SnapshotEventKind Classify(BackupFolder folder, ManifestData manifest)
+{
+    if (folder.ManifestError != null)
+        return SnapshotEventKind.Unreadable;
+
+    if (manifest == null)
+        return SnapshotEventKind.Partial; // legacy/manifest-silent evidence, never inferred verified
+
+    if (manifest.Modules.Count == 0 || manifest.Modules.All(m => m.State == BackupManifest.StateFailed))
+        return SnapshotEventKind.Failed;
+
+    if (manifest.Modules.Any(m => m.State != BackupManifest.StateSucceeded))
+        return SnapshotEventKind.Partial;
+
+    return SnapshotEventKind.Verified;
+}
+
+private static int CompareEvents(SnapshotEvent left, SnapshotEvent right)
+{
+    int timestamp = right.Created.CompareTo(left.Created);
+    return timestamp != 0
+        ? timestamp
+        : StringComparer.Ordinal.Compare(left.CanonicalPath, right.CanonicalPath);
+}
+```
+
+For each root enumeration failure, make an `Unreadable` event with `DiagnosticReason = ex.Message` and a canonicalized root path when possible. For invalid manifest content use Task 1’s validation reason; for an invalid directory timestamp use `DateTime.MinValue` and the real read error. Compute `SizeBytes` by enumerating recursively; set `IsSizeComplete = false` and retain the exception message as diagnostic evidence if an individual entry cannot be measured.
+
+Keep a private, in-memory `List<SnapshotEvent>` for `RecordSessionFailure`. Reject null/whitespace reasons with `ArgumentException`, generate a process-local `session://failure/<ordinal>` canonical path, classify it as `Failed`, and merge it only in that catalog instance’s `Read()`. It writes no folder, manifest, log, registry value, or retention marker. A retained directory with manifest/log/payload evidence is never recorded this way; it is rediscovered from disk so normal cleanup continues to be based on the existing durable storage rules.
+
+- [ ] **Step 4: Run the catalog tests and verify they pass**
+
+Run: `dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter FullyQualifiedName~SnapshotEventCatalogTests`
+
+Expected: PASS; status, non-restorability, actual error diagnostics, stable ordinal canonical-path tie-breaking, and session-only failure lifetime all pass.
+
+- [ ] **Step 5: Commit the event source**
+
+```bash
+git add src/WinRestoreKit.Application/Snapshots/SnapshotEventKind.cs src/WinRestoreKit.Application/Snapshots/SnapshotEvent.cs src/WinRestoreKit.Application/Snapshots/SnapshotEventCatalog.cs src/WinRestoreKit.Tests/SnapshotEventCatalogTests.cs
+git commit -m "feat: add deterministic snapshot event catalog"
+```
+
+### Task 3: Prepare selected payloads with explicit ownership and cleanup
+
+**Files:**
+- Create: `src/WinRestoreKit.Application/Snapshots/SnapshotPayloadPreparation.cs`
+- Create: `src/WinRestoreKit.Application/Snapshots/SnapshotPayloadPreparationService.cs`
+- Create: `src/WinRestoreKit.Tests/SnapshotPayloadPreparationServiceTests.cs`
+- Test: `src/WinRestoreKit.Tests/SnapshotPayloadPreparationServiceTests.cs`
+
+**Interfaces:**
+- Consumes: Task 2 `SnapshotEvent`; Core `BackupPayload.TryPrepareForRead`, `BackupPayload.ReadScope`, and its archive validation/error behavior.
+- Produces: `SnapshotPayloadPreparation` and `SnapshotPayloadPreparationService.PrepareAsync(SnapshotEvent, CancellationToken)` exactly as declared above. A later Compare stage receives the successful preparation and owns its `Dispose()` call.
+
+- [ ] **Step 1: Write failing preparation tests against real loose and compressed folders**
+
+Use the existing `SnapshotCompressionTests`/`BackupPayloadTests` archive helpers rather than a fake zip reader. Cover successful compressed extraction, corrupted archive evidence, cancellation before extraction, failed-event rejection, and cleanup:
+
+```csharp
+[Fact]
+public async Task PrepareAsync_CompressedSnapshotDeletesPrivateExtractionWhenDisposed()
+{
+    using TempDirectory backup = TempDirectory.Create();
+    CreateCompressedPayload(backup.Path, "registry/mouse.reg", "Windows Registry Editor Version 5.00");
+    SnapshotEvent snapshot = NewEvent(SnapshotEventKind.Verified, backup.Path);
+    SnapshotPayloadPreparationService service = new SnapshotPayloadPreparationService();
+
+    SnapshotPayloadPreparation prepared = await service.PrepareAsync(snapshot, CancellationToken.None);
+    string extractedPath = prepared.Path;
+
+    Assert.True(prepared.IsPrepared);
+    Assert.True(File.Exists(Path.Combine(extractedPath, "registry", "mouse.reg")));
+    prepared.Dispose();
+    Assert.False(Directory.Exists(extractedPath));
+}
+
+[Fact]
+public async Task PrepareAsync_FailedSnapshotReturnsDiagnosticWithoutOpeningPayload()
+{
+    SnapshotPayloadPreparation prepared = await new SnapshotPayloadPreparationService().PrepareAsync(
+        NewEvent(SnapshotEventKind.Failed, @"C:\retained-failure"), CancellationToken.None);
+
+    Assert.False(prepared.IsPrepared);
+    Assert.Contains("cannot be selected", prepared.Error, StringComparison.OrdinalIgnoreCase);
+}
+```
+
+- [ ] **Step 2: Run the focused preparation tests and verify they fail**
+
+Run: `dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter FullyQualifiedName~SnapshotPayloadPreparationServiceTests`
+
+Expected: FAIL to compile because the preparation DTO and service do not exist.
+
+- [ ] **Step 3: Implement asynchronous preparation without changing Core payload semantics**
+
+Make the result own the Core read scope and expose its path only when preparation succeeds. Do not filter archive entries here: comparison/restore needs the selected snapshot’s complete prepared payload and Core remains the archive validator.
+
+```csharp
+public async Task<SnapshotPayloadPreparation> PrepareAsync(
+    SnapshotEvent snapshot, CancellationToken cancellationToken)
+{
+    if (snapshot == null)
+        throw new ArgumentNullException(nameof(snapshot));
+
+    if (!snapshot.IsRestorable)
+        return new SnapshotPayloadPreparation(snapshot, null,
+            "This backup attempt cannot be selected because it is failed or unreadable.");
+
+    cancellationToken.ThrowIfCancellationRequested();
+    return await Task.Run(() =>
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        if (!BackupPayload.TryPrepareForRead(snapshot.CanonicalPath, out BackupPayload.ReadScope scope,
+                                             out string error))
+        {
+            return new SnapshotPayloadPreparation(snapshot, null,
+                "The selected backup payload could not be prepared: " + error);
+        }
+
+        if (cancellationToken.IsCancellationRequested)
+        {
+            scope.Dispose();
+            cancellationToken.ThrowIfCancellationRequested();
+        }
+
+        return new SnapshotPayloadPreparation(snapshot, scope, null);
+    }, cancellationToken).ConfigureAwait(false);
+}
+```
+
+`SnapshotPayloadPreparation.Dispose()` must be idempotent and call `scope?.Dispose()`. On every failure it holds no scope; its `Error` is the Core error text with context, never an invented “empty snapshot” state.
+
+Pin the DTO invariant in both implementation and tests so a successful loose-folder scope (whose owned extraction path is null) is not misreported as failed:
+
+```csharp
+public string Path => scope?.Path;
+public string Error { get; }
+public bool IsPrepared => Error == null;
+```
+
+- [ ] **Step 4: Run the preparation tests and verify they pass**
+
+Run: `dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter FullyQualifiedName~SnapshotPayloadPreparationServiceTests`
+
+Expected: PASS; loose folders keep their original path, compressed folders are removed after disposal, and corrupt/missing payload errors are surfaced verbatim enough to diagnose the actual failure.
+
+- [ ] **Step 5: Commit safe selection preparation**
+
+```bash
+git add src/WinRestoreKit.Application/Snapshots/SnapshotPayloadPreparation.cs src/WinRestoreKit.Application/Snapshots/SnapshotPayloadPreparationService.cs src/WinRestoreKit.Tests/SnapshotPayloadPreparationServiceTests.cs
+git commit -m "feat: prepare selected snapshot payloads safely"
+```
+
+### Task 4: Project the shared events into Timeline and advanced-history view models
+
+**Files:**
+- Create: `src/WinRestoreKit.Wpf/Navigation/ITimelineNavigator.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/Snapshots/SnapshotEventStatus.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/Snapshots/SnapshotEventViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/Timeline/TimelineViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/History/AdvancedHistoryViewModel.cs`
+- Modify: `src/WinRestoreKit.Wpf/Properties/AssemblyInfo.cs`
+- Create: `src/WinRestoreKit.Tests/TimelineViewModelTests.cs`
+- Create: `src/WinRestoreKit.Tests/AdvancedHistoryViewModelTests.cs`
+- Test: `src/WinRestoreKit.Tests/TimelineViewModelTests.cs`
+
+**Interfaces:**
+- Consumes: Task 2 event catalog, Task 3 preparation service, and `ITimelineNavigator` defined in this task.
+- Produces: `SnapshotEventViewModel` as the sole WPF projection of kind, label, icon, diagnostic-only state, and selection eligibility; `TimelineViewModel` exposes the default timeline list and `AdvancedHistoryViewModel` exposes the same source filtered by query. `ITimelineNavigator.OpenCompare` owns a successful preparation; `ShowSnapshotDiagnostic` never receives a preparation.
+
+- [ ] **Step 1: Write failing selection, status, and history-source tests**
+
+Test a constructed catalog/fixture event list, not XAML. Assert one status mapper determines labels for both screens and that rejected statuses never call payload preparation:
+
+```csharp
+[Fact]
+public async Task OpenSelectedAsync_PreparesPartialAndTransfersOwnershipToNavigator()
+{
+    SnapshotEvent partial = NewEvent(SnapshotEventKind.Partial, @"C:\snapshot");
+    RecordingNavigator navigator = new RecordingNavigator();
+    TimelineViewModel viewModel = new TimelineViewModel(
+        new FakeCatalog(partial), new FakePreparationService(partial), navigator);
+
+    await viewModel.RefreshAsync();
+    viewModel.SelectedEvent = Assert.Single(viewModel.Events);
+    await viewModel.OpenSelectedAsync();
+
+    Assert.Same(partial, navigator.Prepared.Snapshot);
+    Assert.Null(navigator.Diagnostic);
+}
+
+[Fact]
+public async Task OpenSelectedAsync_ShowsFailedEvidenceWithoutPreparingPayload()
+{
+    SnapshotEvent failed = NewEvent(SnapshotEventKind.Failed, @"C:\failed", "disk full");
+    FakePreparationService service = new FakePreparationService();
+    RecordingNavigator navigator = new RecordingNavigator();
+    TimelineViewModel viewModel = new TimelineViewModel(new FakeCatalog(failed), service, navigator);
+
+    await viewModel.RefreshAsync();
+    viewModel.SelectedEvent = Assert.Single(viewModel.Events);
+    await viewModel.OpenSelectedAsync();
+
+    Assert.Same(failed, navigator.Diagnostic);
+    Assert.Equal(0, service.Calls);
+}
+
+
+private static SnapshotEvent NewEvent(SnapshotEventKind kind, string path, string reason = null)
+    => new SnapshotEvent(kind, new DateTime(2026, 8, 9, 12, 0, 0, DateTimeKind.Local),
+        Path.GetFileName(path), Path.GetFullPath(path), reason, "TEST-PC", 0, true, null);
+private sealed class FakeCatalog : ISnapshotEventReader
+{
+    private readonly IReadOnlyList<SnapshotEvent> events;
+    internal FakeCatalog(params SnapshotEvent[] events) => this.events = events;
+    public IReadOnlyList<SnapshotEvent> Read() => events;
+}
+
+private sealed class FakePreparationService : ISnapshotPayloadPreparationService
+{
+    private readonly SnapshotEvent preparedEvent;
+    internal FakePreparationService(SnapshotEvent preparedEvent = null) => this.preparedEvent = preparedEvent;
+    internal int Calls { get; private set; }
+
+    public Task<SnapshotPayloadPreparation> PrepareAsync(SnapshotEvent snapshot, CancellationToken cancellationToken)
+    {
+        Calls++;
+        return Task.FromResult(new SnapshotPayloadPreparation(
+            preparedEvent ?? snapshot, null, preparedEvent == null ? "unexpected preparation" : null));
+    }
+}
+
+private sealed class RecordingNavigator : ITimelineNavigator
+{
+    internal SnapshotPayloadPreparation Prepared { get; private set; }
+    internal SnapshotEvent Diagnostic { get; private set; }
+    public void OpenCompare(SnapshotPayloadPreparation preparation) => Prepared = preparation;
+    public void ShowSnapshotDiagnostic(SnapshotEvent snapshot) => Diagnostic = snapshot;
+}
+```
+
+Add an advanced-history test that filters by display name, machine, canonical path, and kind label while retaining the same `SnapshotEventViewModel.Status` instance/values used by Timeline. The history test must not create a second classifier.
+
+- [ ] **Step 2: Run the focused view-model tests and verify they fail**
+
+Run: `dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~TimelineViewModelTests|FullyQualifiedName~AdvancedHistoryViewModelTests"`
+
+Expected: FAIL to compile because the WPF view-model and navigation types are absent.
+
+- [ ] **Step 3: Implement one presentation projection and explicit selection transfer**
+
+Make `SnapshotEventStatus.For` the only WPF kind-to-UI projection. It supplies words and a Fluent glyph key but does not recalculate whether a snapshot is restorable:
+
+```csharp
+public sealed class SnapshotEventStatus
+{
+    public SnapshotEventStatus(string label, string glyph, bool isDiagnosticOnly)
+    {
+        Label = label;
+        Glyph = glyph;
+        IsDiagnosticOnly = isDiagnosticOnly;
+    }
+
+    public string Label { get; }
+    public string Glyph { get; }
+    public bool IsDiagnosticOnly { get; }
+}
+
+internal static class SnapshotEventStatusProjection
+{
+    internal static SnapshotEventStatus For(SnapshotEventKind kind) => kind switch
+    {
+        SnapshotEventKind.Verified => new("Verified", "CheckmarkCircle", false),
+        SnapshotEventKind.Partial => new("Partial snapshot", "Warning", false),
+        SnapshotEventKind.Failed => new("Backup failed", "ErrorCircle", true),
+        SnapshotEventKind.Unreadable => new("Details unavailable", "ErrorCircle", true),
+        _ => throw new ArgumentOutOfRangeException(nameof(kind))
+    };
+}
+```
+
+`SnapshotEventViewModel` holds the immutable event and this status. `TimelineViewModel.RefreshAsync` replaces its observable collection from one `catalog.Read()` result; its `OpenSelectedAsync` follows this ownership-safe branch:
+
+```csharp
+if (SelectedEvent == null)
+    return;
+
+if (!SelectedEvent.Event.IsRestorable)
+{
+    navigator.ShowSnapshotDiagnostic(SelectedEvent.Event);
+    return;
+}
+
+SnapshotPayloadPreparation prepared = await preparationService
+    .PrepareAsync(SelectedEvent.Event, cancellationToken);
+if (!prepared.IsPrepared)
+{
+    SelectionError = prepared.Error;
+    prepared.Dispose();
+    return;
+}
+
+
+try
+{
+    navigator.OpenCompare(prepared);
+    prepared = null; // navigator now owns it
+}
+finally
+{
+    prepared?.Dispose();
+}
+```
+
+Add `<InternalsVisibleTo Include="WinRestoreKit.Tests" />` to the WPF project’s existing assembly-friend declarations so test-only `RecordingNavigator` can implement the internal navigation seam. Do not make `ITimelineNavigator` public; make only types/properties bound from XAML public, as specified in **Produced Interfaces**.
+
+`AdvancedHistoryViewModel` receives the same catalog instance and uses `ICollectionView` filtering over `SnapshotEventViewModel`; it exposes exact timestamp, machine, canonical path, manifest state label, byte count/unknown size, and diagnostic reason. It never reads files or parses manifest/log/payload content.
+
+- [ ] **Step 4: Run the view-model tests and verify they pass**
+
+Run: `dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~TimelineViewModelTests|FullyQualifiedName~AdvancedHistoryViewModelTests"`
+
+Expected: PASS; verified/partial transfer a prepared scope, failed/unreadable are diagnostic-only, failed preparation is inline evidence, and both screens use the one status projection.
+
+- [ ] **Step 5: Commit the WPF event projection**
+
+```bash
+git add src/WinRestoreKit.Wpf/Properties/AssemblyInfo.cs src/WinRestoreKit.Wpf/Navigation/ITimelineNavigator.cs src/WinRestoreKit.Wpf/ViewModels/Snapshots/SnapshotEventStatus.cs src/WinRestoreKit.Wpf/ViewModels/Snapshots/SnapshotEventViewModel.cs src/WinRestoreKit.Wpf/ViewModels/Timeline/TimelineViewModel.cs src/WinRestoreKit.Wpf/ViewModels/History/AdvancedHistoryViewModel.cs src/WinRestoreKit.Tests/TimelineViewModelTests.cs src/WinRestoreKit.Tests/AdvancedHistoryViewModelTests.cs
+git commit -m "feat: add timeline and advanced history view models"
+```
+
+### Task 5: Render accessible Timeline and advanced History from the shared projection
+
+**Files:**
+- Create: `src/WinRestoreKit.Wpf/Views/Controls/SnapshotEventList.xaml`
+- Create: `src/WinRestoreKit.Wpf/Views/Controls/SnapshotEventList.xaml.cs`
+- Create: `src/WinRestoreKit.Wpf/Views/TimelineView.xaml`
+- Create: `src/WinRestoreKit.Wpf/Views/TimelineView.xaml.cs`
+- Create: `src/WinRestoreKit.Wpf/Views/AdvancedHistoryView.xaml`
+- Create: `src/WinRestoreKit.Wpf/Views/AdvancedHistoryView.xaml.cs`
+- Create: `src/WinRestoreKit.Wpf/Resources/SnapshotEventTemplates.xaml`
+- Create: `src/WinRestoreKit.Tests/TimelineAccessibilityTests.cs`
+- Test: `src/WinRestoreKit.Tests/TimelineAccessibilityTests.cs`
+
+**Interfaces:**
+- Consumes: Task 4’s `TimelineViewModel`, `AdvancedHistoryViewModel`, `SnapshotEventViewModel`, and one status projection.
+- Produces: keyboard-operable views that bind only to view-model properties. `SnapshotEventList` is the common visual-timeline/list-fallback control used by both screens; it has a standard `ListBox` UIA surface and never contains filesystem or status-classification code.
+
+- [ ] **Step 1: Write failing STA accessibility and construction tests**
+
+Use Foundation’s sole `src/WinRestoreKit.Tests/WpfTestHost.cs` helper, `WpfTestHost.Run(Action)`, to construct the actual view:
+
+```csharp
+[Fact]
+public void TimelineView_ExposesEquivalentNamedListAndKeyboardSelection()
+{
+    WpfTestHost.Run(() =>
+    {
+        TimelineView view = new TimelineView { DataContext = NewTimelineViewModel() };
+        view.ApplyTemplate();
+
+        ListBox list = Assert.IsType<ListBox>(view.FindName("TimelineEventList"));
+        Assert.Equal("Snapshots", AutomationProperties.GetName(list));
+        Assert.Equal(SelectionMode.Single, list.SelectionMode);
+        Assert.True(KeyboardNavigation.GetDirectionalNavigation(list) == KeyboardNavigationMode.Continue);
+        Assert.Contains("Enter", AutomationProperties.GetHelpText(list));
+        list.SelectedIndex = 0;
+        RaiseKey(list, Key.Right);
+        Assert.Equal(1, list.SelectedIndex);
+        RaiseKey(list, Key.Left);
+        Assert.Equal(0, list.SelectedIndex);
+    });
+}
+```
+
+Add this test-local key helper; `NewTimelineViewModel()` creates two events through the `ISnapshotEventReader`/preparation-service test doubles defined in Task 4:
+
+```csharp
+private static void RaiseKey(UIElement target, Key key)
+{
+    target.RaiseEvent(new KeyEventArgs(Keyboard.PrimaryDevice, null, 0, key)
+    {
+        RoutedEvent = Keyboard.PreviewKeyDownEvent
+    });
+}
+```
+
+Also assert each row’s `AutomationProperties.Name` includes its title, formatted timestamp, text status, and `DiagnosticReason` when diagnostic-only; assert the inline selection-error `TextBlock` has `AutomationProperties.LiveSetting="Polite"`.
+
+- [ ] **Step 2: Run the focused WPF tests and verify they fail**
+
+Run: `dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter FullyQualifiedName~TimelineAccessibilityTests`
+
+Expected: FAIL to compile because the Timeline WPF views do not exist.
+
+- [ ] **Step 3: Implement reusable list/list-fallback XAML and input semantics**
+
+Use an ordinary `ListBox` for the UIA-equivalent narrow representation; it must remain the accessible control even when the wide visual timeline applies an item template with a restrained connecting line. Bind the common collection and avoid duplicate row templates.
+
+```xml
+<!-- Views/Controls/SnapshotEventList.xaml -->
+<ListBox x:Name="TimelineEventList"
+         ItemsSource="{Binding Events}"
+         SelectedItem="{Binding SelectedEvent, Mode=TwoWay}"
+         SelectionMode="Single"
+         AutomationProperties.Name="Snapshots"
+         AutomationProperties.HelpText="Left and Right Arrow move snapshots. Enter opens a verified or partial snapshot; failed and unreadable entries open details."
+         KeyboardNavigation.DirectionalNavigation="Continue"
+         PreviewKeyDown="OnPreviewKeyDown">
+  <ListBox.ItemTemplate>
+    <DataTemplate DataType="{x:Type vm:SnapshotEventViewModel}">
+      <Grid AutomationProperties.Name="{Binding AutomationName}">
+        <Grid.ColumnDefinitions>
+          <ColumnDefinition Width="Auto" />
+          <ColumnDefinition Width="*" />
+        </Grid.ColumnDefinitions>
+        <TextBlock Grid.Column="0" Text="{Binding Status.Glyph}" />
+        <StackPanel Grid.Column="1">
+          <TextBlock Text="{Binding DisplayName}" />
+          <TextBlock Text="{Binding CreatedDisplay}" />
+          <TextBlock Text="{Binding Status.Label}" />
+          <TextBlock Text="{Binding DiagnosticReason}"
+                     Visibility="{Binding HasDiagnostic, Converter={StaticResource BooleanToVisibilityConverter}}" />
+        </StackPanel>
+      </Grid>
+    </DataTemplate>
+  </ListBox.ItemTemplate>
+</ListBox>
+```
+
+In `OnPreviewKeyDown`, change `SelectedIndex` by `-1` for `Key.Left` and `+1` for `Key.Right`, constrain it to `[0, Items.Count - 1]`, set `e.Handled = true`, and call `ScrollIntoView`; let Up/Down, Tab, Shift+Tab, and standard `ListBox` selection behavior remain native. On Enter execute the view model’s async open command. In a width trigger at 1024px, change only layout and connector visibility; retain the same `ListBox`, bindings, item text, commands, names, and focus behavior rather than maintaining a second data source.
+
+Use `SnapshotEventTemplates.xaml` from both Timeline and History to bind `Status.Label`, not local `DataTrigger` status text. `TimelineView` contains the error text shown after failed payload preparation:
+
+```xml
+<TextBlock Text="{Binding SelectionError}"
+           Visibility="{Binding HasSelectionError, Converter={StaticResource BooleanToVisibilityConverter}}"
+           AutomationProperties.LiveSetting="Polite"
+           Foreground="{DynamicResource WarningTextBrush}" />
+```
+
+`AdvancedHistoryView` binds the same event rows in a searchable `ListView`/`GridView` (timestamp, machine, path, manifest status, size, diagnostics), preserving the shared status template and no Restore button.
+
+Use Foundation’s existing `WpfTestHost.Run(Action)`; do not create another STA helper.
+
+- [ ] **Step 4: Run the accessibility tests and verify they pass**
+
+Run: `dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter FullyQualifiedName~TimelineAccessibilityTests`
+
+Expected: PASS; WPF views construct on an STA thread, the list exposes a stable UIA name/help text, all state is textually distinguishable, and narrow/wide layouts share the same accessible item collection.
+
+- [ ] **Step 5: Commit the WPF Timeline and advanced History views**
+
+```bash
+git add src/WinRestoreKit.Wpf/Views/Controls/SnapshotEventList.xaml src/WinRestoreKit.Wpf/Views/Controls/SnapshotEventList.xaml.cs src/WinRestoreKit.Wpf/Views/TimelineView.xaml src/WinRestoreKit.Wpf/Views/TimelineView.xaml.cs src/WinRestoreKit.Wpf/Views/AdvancedHistoryView.xaml src/WinRestoreKit.Wpf/Views/AdvancedHistoryView.xaml.cs src/WinRestoreKit.Wpf/Resources/SnapshotEventTemplates.xaml src/WinRestoreKit.Tests/TimelineAccessibilityTests.cs
+git commit -m "feat: render accessible snapshot timeline"
+```
+
+### Task 6: Verify the Timeline WPF runtime path without comparison scope
+
+**Files:**
+- Create: `src/WinRestoreKit.Tests/TimelineWpfSmokeTests.cs`
+- Test: `src/WinRestoreKit.Tests/TimelineWpfSmokeTests.cs`
+
+**Interfaces:**
+- Consumes: Tasks 2–5. The test host supplies a real `TimelineViewModel`, catalog, preparation service, and recording `ITimelineNavigator`.
+- Produces: runtime evidence that the real Timeline WPF control can load event data, render an accessible list, and transfer a verified/partial preparation to its navigation boundary. Task 5 supplies the separate explicit keyboard-movement test. The Compare/Confirm plan owns production shell-stage composition and the long-lived preparation after this boundary.
+
+- [ ] **Step 1: Write the failing WPF runtime smoke test**
+
+```csharp
+[Fact]
+public void TimelineView_LoadsSelectionAndTransfersPreparedSnapshot()
+{
+    WpfTestHost.Run(() =>
+    {
+        RecordingNavigator navigator = new RecordingNavigator();
+        SnapshotEvent snapshot = NewEvent(SnapshotEventKind.Verified, @"C:\timeline-smoke");
+        TimelineViewModel viewModel = new TimelineViewModel(
+            new FakeCatalog(snapshot), new FakePreparationService(snapshot), navigator);
+        TimelineView view = new TimelineView { DataContext = viewModel };
+        Window host = new Window { Content = view, Width = 1024, Height = 720 };
+
+        host.Show();
+        try
+        {
+            viewModel.RefreshAsync().GetAwaiter().GetResult();
+            ListBox list = FindDescendant<ListBox>(view);
+            list.SelectedIndex = 0;
+            viewModel.OpenSelectedAsync().GetAwaiter().GetResult();
+
+            Assert.NotNull(navigator.Prepared);
+            Assert.Equal(SnapshotEventKind.Verified, navigator.Prepared.Snapshot.Kind);
+        }
+        finally
+        {
+            navigator.Prepared?.Dispose();
+            host.Close();
+        }
+    });
+}
+```
+
+Add this test-local visual-tree helper in `TimelineWpfSmokeTests.cs`:
+
+```csharp
+private static T FindDescendant<T>(DependencyObject root) where T : DependencyObject
+{
+    if (root is T matched)
+        return matched;
+
+    for (int index = 0; index < VisualTreeHelper.GetChildrenCount(root); index++)
+    {
+        T found = FindDescendant<T>(VisualTreeHelper.GetChild(root, index));
+        if (found != null)
+            return found;
+    }
+
+    return null;
+}
+```
+
+- [ ] **Step 2: Run the runtime smoke test and verify it fails**
+
+Run: `dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter FullyQualifiedName~TimelineWpfSmokeTests`
+
+Expected: FAIL because the Timeline control cannot yet be hosted with a populated view model and transfer a selected preparation.
+
+- [ ] **Step 3: Correct real-control binding, layout, and command wiring**
+
+Make only the Task 4/Task 5 controls work under a shown WPF `Window`: use `Loaded`/dispatcher-safe collection refresh, ensure the `ListBox` receives keyboard focus after the test selects it, and bind the Enter handler to `OpenSelectedAsync`. The recording navigator must be a test double only; production ownership and navigation are deliberately implemented by the next Compare/Confirm plan. Do not add a comparison surface, a fake “coming soon” state, a restore-set collection, or a confirmation dialog.
+
+- [ ] **Step 4: Run all focused Timeline tests and the WPF runtime smoke test**
+
+Run: `dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~SnapshotEventCatalogTests|FullyQualifiedName~SnapshotPayloadPreparationServiceTests|FullyQualifiedName~TimelineViewModelTests|FullyQualifiedName~AdvancedHistoryViewModelTests|FullyQualifiedName~TimelineAccessibilityTests|FullyQualifiedName~TimelineWpfSmokeTests"`
+
+Expected: PASS; event classification, selection cleanup, shared status projection, keyboard/UIA construction, and the shown-window Timeline runtime path all pass.
+
+- [ ] **Step 5: Commit Timeline runtime verification coverage**
+
+```bash
+git add src/WinRestoreKit.Tests/TimelineWpfSmokeTests.cs
+git commit -m "test: smoke timeline WPF runtime path"
+```
+## Final Verification
+
+- [ ] Run: `dotnet test src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~BackupFoldersReadTests|FullyQualifiedName~SnapshotEventCatalogTests|FullyQualifiedName~SnapshotPayloadPreparationServiceTests|FullyQualifiedName~TimelineViewModelTests|FullyQualifiedName~AdvancedHistoryViewModelTests|FullyQualifiedName~TimelineAccessibilityTests|FullyQualifiedName~TimelineWpfSmokeTests"`
+
+Expected: PASS with no failing selected Timeline/event tests.
+
+- [ ] Run: `dotnet build src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj`
+
+Expected: Build succeeds; `WinRestoreKit.Application` compiles without `UseWindowsForms` or `UseWPF`, and WPF references the event DTO rather than a `Views` discovery type.
+
+- [ ] Run: `dotnet build src/WinRestoreKit.sln`
+
+Expected: Build succeeds with both the legacy WinForms shell and side-by-side WPF project resolving one Application-owned backup-folder discovery implementation.
+
+- [ ] On a real Windows desktop, perform Task 5’s keyboard/UIA smoke and Task 6’s shown-window preparation smoke with a compressed snapshot, a failed retained folder, a malformed manifest, and a session-only folder-creation failure. Expected: only verified/partial events can start payload preparation; Left/Right changes the selected accessible list item; all diagnostic text reflects actual evidence; closing/canceling a successful compressed selection removes its private extraction directory; restarting the app removes only the session-only failure from Timeline and does not alter any backup retention state.
diff --git a/docs/superpowers/plans/2026-08-09-wpf-cutover-release-verification.md b/docs/superpowers/plans/2026-08-09-wpf-cutover-release-verification.md
new file mode 100644
index 0000000..011d4ab
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-09-wpf-cutover-release-verification.md
@@ -0,0 +1,1407 @@
+# WPF Cutover, Release, and Verification Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use `superpowers:subagent-driven-development` (recommended) or `superpowers:executing-plans` to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Verify the completed WPF workflows on a real Windows desktop, make WPF the sole shipping `WinRestoreKit` application without compatibility shims, and prove that the released artifact is one self-contained, version-coherent `WinRestoreKit.exe`.
+
+**Architecture:** This is the fifth and final migration stage. It consumes the framework-neutral Application layer and the WPF Timeline, Compare/Confirm, and Backup/Progress outputs; it does not redesign their behavior. First make the existing WPF shell observable and testable, then complete the real-desktop parity gate, switch the sole shipping identity and test references to WPF, remove every obsolete WinForms artifact, and finally run the release procedure against the published executable.
+
+**Tech Stack:** .NET 8, C#, WPF/MVVM, xUnit 2.9.3, WPF Dispatcher and UI Automation peers, Windows accessibility tooling, PowerShell, Windows SDK `mt.exe`, GitHub Releases, self-contained `win-x64` single-file publishing.
+
+## Global Constraints
+
+- Preserve `WinRestoreKit.Core` backup/restore semantics, the on-disk snapshot and manifest format, `RestorePlan`, `SnapshotGate`, `RestoreScope`, `RestoreDispatch`, `ExplorerRestartPrompt`, backup-root behavior, and all existing outcome meanings.
+- Execute this plan only after the Foundation, Timeline, Compare/Confirm, and Backup/Progress plans below have completed their focused test cycles and their WPF equivalents are runnable alongside WinForms.
+- `WinRestoreKit.Application` remains framework-neutral: it references neither WinForms nor WPF, keeps namespace `WinRestoreKit`, and retains its own `InternalsVisibleTo("WinRestoreKit.Tests")` access boundary.
+- `RunSummary` uses `RunSeverity { Information, Warning, Error }`. `IRunUi` has no `MessageBoxIcon`, `IWin32Window`, or typed `Owner`; it exposes only `object DialogOwner { get; }` so the existing Core app-restore seam stays framework-neutral and opaque.
+- Timeline events retain `SnapshotEventKind { Verified, Partial, Failed, Unreadable }`; sort deterministically by descending timestamp and then ordinal canonical path; failed and unreadable events remain non-restorable; session-only failures never change cleanup retention.
+- Compare continues to be manifest-first with the exact `RestoreContents` artifact-precedence rules, maps `HasDriftedFrom` `true`/`false`/`null` to `Changed`/`Same`/`Unavailable`, marks only the throwing module unavailable, and always disposes its `BackupPayload.ReadScope`.
+- WPF never parses registry exports or payload text and never invents semantic comparison values. Restore remains whole-module and its confirmation reports only process closures, Explorer restart, and sign-out impacts that existing contracts declare; do not introduce reboot metadata.
+- Do not delete WinForms until the real Windows desktop smoke matrix in Task 2 has passed and its evidence is committed. A build, unit test, or screenshot alone is not a substitute for this gate.
+- The final WPF app has assembly and executable identity `WinRestoreKit`, preserves `highestAvailable`, `longPathAware`, `WinRestoreKit.ico`, and the physical raw fallback source `src/WinRestoreKit/Properties/AssemblyInfo.cs`.
+- The raw fallback source retains the exact three-part `[assembly: AssemblyFileVersion("x.y.z")]` line. `GenerateAssemblyInfo=false` appears only on the final shipping WPF project; `Core` and `Application` keep SDK-generated assembly metadata.
+- The only shipping release is self-contained `win-x64`, single-file, native-self-extracting, compressed, and untrimmed. The publish directory contains exactly one `WinRestoreKit.exe`; do not ship a framework-dependent `bin\Release` executable.
+- Preserve relevant Core and Application tests. Replace tests that only construct or inspect WinForms controls with observable WPF contract tests; do not mechanically port control-tree assertions.
+- Do not commit `bin/`, `obj/`, `publish/`, temporary snapshot roots, extracted manifests, screenshots outside the committed baseline directory, or release-verification scratch output.
+
+---
+
+## Upstream Interfaces and Required Completed Outputs
+
+This plan may consume the preceding plans only through this block. Do not reimplement these services in Stage 5.
+
+| Upstream plan | Consumed files and interfaces | Cutover responsibility |
+| --- | --- | --- |
+| `docs/superpowers/plans/2026-08-09-wpf-foundation-application-shell.md` | `src/WinRestoreKit.Application/`; `RunSeverity`; neutral `RunSummary`; neutral `IRunUi`; moved `RunCoordinator`, `RunControl`, `BackupRestoreOrchestrator`, `ProgressMetrics`; `Application/Updates/VersionInfo.cs`, `UpdateVerdict.cs`, `UpdateCheckService.cs`; `Application/Settings/BackupRootRegistry.cs`; `WinRestoreKit.Wpf/App.xaml`, `App.xaml.cs`, `MainWindow.xaml`, `ViewModels/ShellViewModel.cs`, WPF dispatcher/dialog/log/theme/update adapters | Keep Application framework-neutral; retain WPF MVVM composition and update/version behavior while changing WPF from its temporary identity to the shipping identity. |
+| `docs/superpowers/plans/2026-08-09-timeline-event-model.md` | `SnapshotEventKind`; immutable `SnapshotEvent`; `SnapshotEventCatalog.Read()`; `SnapshotEventCatalog.RecordSessionFailure(DateTime created, string displayName, string diagnosticReason)`; `SnapshotPayloadPreparationService.PrepareAsync(SnapshotEvent snapshot, CancellationToken cancellationToken)`; `TimelineViewModel`; `AdvancedHistoryViewModel`; `TimelineView.xaml`; `AdvancedHistoryView.xaml`; shared `WpfTestHost.cs`; Timeline accessibility and smoke tests | Reuse the same event catalog for Timeline and Advanced History; retain the session-failure rule and the Timeline `ListBox` automation name `Snapshots`; extend the sole STA helper and runtime coverage rather than introducing another one. |
+| `docs/superpowers/plans/2026-08-09-compare-confirm-restore.md` | `ComparisonState { Changed, Same, Unavailable, NotCaptured }`; immutable `ModuleComparison`; `Task<IReadOnlyList<ModuleComparison>> SnapshotComparisonService.CompareAsync(SnapshotEvent snapshot, IReadOnlyList<BackupBase> modules, CancellationToken cancellationToken)`; `ComparisonWorkspaceViewModel`; `ModuleComparisonRowViewModel`; `RestoreSetViewModel`; `ConfirmViewModel`; `ComparisonWorkspaceView`; `ConfirmView`; `RestoreConsentDialog`; `WpfRunUi` dialog wiring | Verify all comparison evidence states and cancellation at runtime, preserve whole-module restore selection, and verify WPF-owned modal ownership without reintroducing a typed WinForms owner seam. |
+| `docs/superpowers/plans/2026-08-09-backup-progress-results.md` | `BackupWorkspaceViewModel`; `ProgressWorkspaceViewModel`; `ResultWorkspaceViewModel`; `BackupWorkspaceView`; `ProgressWorkspaceView`; `ResultWorkspaceView`; `WpfRunUi`; `WpfLogSink`; `WpfAppRestoreDialog`; Application-side `ScopeGroups`, `BackupPresets`, `BackupFolders` | Verify Create snapshot → Progress → Results → Timeline end to end, preserve app-restore behavior, and remove the corresponding WinForms implementations only after their WPF contracts pass. |
+
+### Stage-5 invariants to pin before removal
+
+- `SnapshotEventCatalog.Read()` is the sole persisted Timeline/Advanced History source. A failed session event comes only from `RecordSessionFailure`, is diagnostic-only, and does not create or preserve a cleanup-retained folder.
+- `SnapshotComparisonService.CompareAsync(SnapshotEvent snapshot, IReadOnlyList<BackupBase> modules, CancellationToken cancellationToken)` remains read-only. Every temporary payload from `SnapshotPayloadPreparationService.PrepareAsync(SnapshotEvent snapshot, CancellationToken cancellationToken)` is released when the Compare workspace cancels, changes snapshot, or closes.
+- `IRunUi` carries progress, summary, consent, snapshot-override, plan-error, Explorer-restart, and opaque `object DialogOwner { get; }` without a WinForms type. The Application orchestrator preserves the Core call `await appStoreApps.RestoreAsync(currentRestorePath, ui.DialogOwner)`; WPF supplies its shell `Window` as the opaque owner and registers `WpfAppRestoreDialog` through Core's existing `RestoreDialog` delegate.
+- `src/WinRestoreKit.Tests/WpfTestHost.cs` is the sole STA smoke helper. It constructs a named STA thread, exposes `Run(Action)` and `Run<T>(Func<T>)`, captures and rethrows failures, shuts down the thread's `Dispatcher`, and joins the thread. Tests construct `ShellViewModel` with Foundation test fakes and pass it directly to `new MainWindow(shell)`; they do not use reflection or add a second application startup path.
+- WPF automation identifiers are stable contracts, not layout details: `TimelineEventList`, `ComparisonWorkspace`, `CompareModuleList`, `CompareFilterAll`, `CompareFilterChanged`, `RestoreSetList`, `CompareContinueToConfirmButton`, `ConfirmRestoreButton`, `CreateSnapshotButton`, `SettingsThemeFollowSystem`, `SettingsThemeLight`, and `SettingsThemeDark`.
+
+---
+
+### Task 1: Make the completed WPF shell testable on one STA host and pin its observable runtime contract
+
+**Files:**
+- Create: `src/WinRestoreKit.Tests/WpfCutoverRuntimeTests.cs`
+- Modify: `src/WinRestoreKit.Tests/WpfTestHost.cs`
+- Modify: `src/WinRestoreKit.Tests/TimelineWpfSmokeTests.cs`
+- Modify: `src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj`
+- Modify: `src/WinRestoreKit.Wpf/MainWindow.xaml`
+- Modify: `src/WinRestoreKit.Wpf/Views/TimelineView.xaml`
+- Modify: `src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml`
+- Modify: `src/WinRestoreKit.Wpf/Views/ConfirmView.xaml`
+- Modify: `src/WinRestoreKit.Wpf/Views/SettingsView.xaml`
+- Test: `src/WinRestoreKit.Tests/TimelineWpfSmokeTests.cs`
+- Test: `src/WinRestoreKit.Tests/TimelineAccessibilityTests.cs`
+- Test: `src/WinRestoreKit.Tests/WpfCutoverRuntimeTests.cs`
+
+**Interfaces:**
+- Consumes: Foundation `internal static WpfTestHost.Run(Action action)` and `WpfTestHost.Run<T>(Func<T> action)`; `ShellViewModel(IThemeService themes, WpfUpdatePresenter updates, string currentVersion)`, internal `NavigateTo(object workspace, string workflowLabel)`, `ShowTimeline()`, `ShowSettingsCommand`, and `CreateSnapshotCommand`; `MainWindow(ShellViewModel shell)`; WPF test friendship; direct `TimelineView`, `ComparisonWorkspaceView`, and `ConfirmView` hosts; and the Foundation `IThemeService`, `IUpdateCheckService`, `IWpfDialogService`, and `IExternalLinkService` contracts.
+- Produces: exactly one reusable STA helper, stable UI Automation identifiers and names, and runtime tests that construct the real WPF shell, navigate actual WPF workspace controls through it, assert focusability and automation roles, and never touch a registry, snapshot, network endpoint, backup run, or dialog.
+
+- [ ] **Step 1: Write the failing WPF shell automation-contract test**
+
+  Add `WpfCutoverRuntimeTests.cs`. Construct `ShellViewModel` through the Foundation test fakes—not a reflection factory and not `App.OnStartup`—then host the real `MainWindow` in `WpfTestHost`. The initial test must fail until Compare, Confirm, and Settings expose the required automation identifiers.
+
+  ```csharp
+  using System;
+  using System.Threading;
+  using System.Runtime.ExceptionServices;
+  using System.Threading.Tasks;
+  using System.Windows;
+  using System.Windows.Automation;
+  using System.Windows.Threading;
+  using System.Windows.Automation.Peers;
+  using System.Windows.Controls;
+  using System.Windows.Media;
+  using WinRestoreKit;
+  using WinRestoreKit.Wpf;
+  using WinRestoreKit.Wpf.Services;
+  using WinRestoreKit.Wpf.ViewModels;
+  using WinRestoreKit.Wpf.Views;
+  using Xunit;
+
+  namespace WinRestoreKit.Tests
+  {
+      public sealed class WpfCutoverRuntimeTests
+      {
+          [Fact]
+          public void MainWindow_ConstructsOnStaAndExposesThePrimaryAutomationSurface()
+          {
+              WpfTestHost.Run(() =>
+              {
+                  ShellViewModel shell = CreateShell();
+                  MainWindow window = new MainWindow(shell);
+                  window.Show();
+
+                  try
+                  {
+                      Navigate(shell, window, new TimelineView(), "Timeline");
+                      ListBox timeline = Require<ListBox>(window, "TimelineEventList");
+                      Assert.Equal("Snapshots", AutomationProperties.GetName(timeline));
+                      Assert.True(timeline.Focusable);
+                      AssertControlType(timeline, AutomationControlType.List);
+
+                      Navigate(shell, window, new ComparisonWorkspaceView(), "Compare");
+                      ComparisonWorkspaceView comparison = Require<ComparisonWorkspaceView>(
+                          window, "ComparisonWorkspace");
+                      Assert.Equal("Snapshot comparison workspace",
+                          AutomationProperties.GetName(comparison));
+                      ListBox modules = Require<ListBox>(window, "CompareModuleList");
+                      Assert.Equal("Modules in the selected snapshot",
+                          AutomationProperties.GetName(modules));
+                      AssertControlType(modules, AutomationControlType.List);
+                      RadioButton all = Require<RadioButton>(window, "CompareFilterAll");
+                      Assert.Equal("Show all compared modules", AutomationProperties.GetName(all));
+                      Assert.True(all.Focusable);
+                      RadioButton changed = Require<RadioButton>(window, "CompareFilterChanged");
+                      Assert.Equal("Show only changed modules",
+                          AutomationProperties.GetName(changed));
+                      Assert.True(changed.Focusable);
+                      Assert.True(Require<ListBox>(window, "RestoreSetList").Focusable);
+                      Assert.True(Require<Button>(window,
+                          "CompareContinueToConfirmButton").Focusable);
+
+                      Navigate(shell, window, new ConfirmView(), "Confirm");
+                      Button confirm = Require<Button>(window, "ConfirmRestoreButton");
+                      Assert.Equal("Continue to final restore consent",
+                          AutomationProperties.GetName(confirm));
+                      Assert.True(confirm.Focusable);
+                      AssertControlType(confirm, AutomationControlType.Button);
+
+                      shell.ShowSettingsCommand.Execute(null);
+                      window.UpdateLayout();
+                      Assert.True(Require<RadioButton>(window,
+                          "SettingsThemeFollowSystem").Focusable);
+                      Assert.True(Require<RadioButton>(window, "SettingsThemeLight").Focusable);
+                      Assert.True(Require<RadioButton>(window, "SettingsThemeDark").Focusable);
+
+                      shell.ShowTimeline();
+                      shell.CreateSnapshotCommand.Execute(null);
+                      window.UpdateLayout();
+                      Button createSnapshot = Require<Button>(window, "CreateSnapshotButton");
+                      Assert.Equal("Create snapshot",
+                          AutomationProperties.GetName(createSnapshot));
+                      Assert.True(createSnapshot.Focusable);
+                      AssertControlType(createSnapshot, AutomationControlType.Button);
+                  }
+                  finally
+                  {
+                      window.Close();
+                  }
+              });
+          }
+
+          private static ShellViewModel CreateShell()
+          {
+              WpfUpdatePresenter updates = new WpfUpdatePresenter(
+                  new FakeUpdates(),
+                  new FakeDialogs(),
+                  new FakeLinks());
+              return new ShellViewModel(new FakeThemeService(), updates, "0.0.1");
+          }
+
+          private static void Navigate(ShellViewModel shell, MainWindow window,
+              FrameworkElement workspace, string workflowLabel)
+          {
+              shell.NavigateTo(workspace, workflowLabel);
+              window.UpdateLayout();
+          }
+
+          private static T Require<T>(DependencyObject root, string automationId)
+              where T : FrameworkElement
+          {
+              T found = Find<T>(root, automationId);
+              Assert.NotNull(found);
+              return found;
+          }
+
+          private static void AssertControlType(FrameworkElement element,
+              AutomationControlType expected)
+          {
+              AutomationPeer peer = UIElementAutomationPeer.CreatePeerForElement(
+                  (UIElement)element);
+              Assert.NotNull(peer);
+              Assert.Equal(expected, peer.GetAutomationControlType());
+          }
+
+          private static T Find<T>(DependencyObject root, string automationId)
+              where T : FrameworkElement
+          {
+              if (root is T current
+                  && AutomationProperties.GetAutomationId(current) == automationId)
+                  return current;
+
+              for (int index = 0; index < VisualTreeHelper.GetChildrenCount(root); index++)
+              {
+                  T found = Find<T>(VisualTreeHelper.GetChild(root, index), automationId);
+                  if (found != null)
+                      return found;
+              }
+
+              return null;
+          }
+
+          private sealed class FakeThemeService : IThemeService
+          {
+              public ThemeMode Mode { get; private set; } = ThemeMode.FollowSystem;
+              public ThemeMode EffectiveMode { get; private set; } = ThemeMode.Light;
+              public event EventHandler ThemeChanged;
+
+              public void SetMode(ThemeMode mode)
+              {
+                  Mode = mode;
+                  EffectiveMode = mode == ThemeMode.FollowSystem ? ThemeMode.Light : mode;
+                  ThemeChanged?.Invoke(this, EventArgs.Empty);
+              }
+
+              public void Dispose() { }
+          }
+
+          private sealed class FakeUpdates : IUpdateCheckService
+          {
+              public Task<UpdateCheckResult> CheckAsync(string currentVersion,
+                  CancellationToken cancellationToken)
+                  => Task.FromResult(new UpdateCheckResult(
+                      UpdateVerdict.UpToDate, currentVersion, currentVersion));
+          }
+
+          private sealed class FakeDialogs : IWpfDialogService
+          {
+              public void ShowInformation(string text, string caption) { }
+              public void ShowWarning(string text, string caption) { }
+              public void ShowError(string text, string caption) { }
+              public bool Confirm(string text, string caption) => false;
+          }
+
+          private sealed class FakeLinks : IExternalLinkService
+          {
+              public void Open(string url) { }
+          }
+      }
+  }
+  ```
+  The test uses the internal navigation seam only to host each concrete, production `UserControl` in the real `MainWindow`; it does not manufacture a replacement window or execute a workflow. Timeline, Compare, Confirm, backup, and dialog behavior remains covered by their upstream view-model tests and the Task 2 desktop session.
+
+
+- [ ] **Step 2: Run the new test to verify it fails before all WPF automation surfaces exist**
+
+
+  Run:
+
+  ```powershell
+  dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj -c Debug --filter FullyQualifiedName~WpfCutoverRuntimeTests
+  ```
+
+  Expected: the test fails because one or more required Compare, Confirm, or Settings automation identifiers are absent. Do not accept a hand-built fake window as a substitute for the real `ShellViewModel` and `MainWindow`.
+
+- [ ] **Step 3: Give the shared test assembly temporary dual-framework support while WinForms remains runnable**
+
+  During Tasks 1–2, WinForms tests and WPF tests must both compile. Keep the existing WinForms reference and add WPF/Application support; do not remove the WinForms property or project reference until Task 3 deletes every test that depends on it.
+
+  ```xml
+  <PropertyGroup>
+    <TargetFramework>net8.0-windows</TargetFramework>
+    <UseWindowsForms>true</UseWindowsForms>
+    <UseWPF>true</UseWPF>
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+    <Nullable>disable</Nullable>
+    <ImplicitUsings>disable</ImplicitUsings>
+    <Platforms>AnyCPU</Platforms>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\WinRestoreKit\WinRestoreKit.csproj" />
+    <ProjectReference Include="..\WinRestoreKit.Application\WinRestoreKit.Application.csproj" />
+    <ProjectReference Include="..\WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <None Include="..\WinRestoreKit\Properties\AssemblyInfo.cs" Link="TestData\AssemblyInfo.cs">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </None>
+  </ItemGroup>
+  ```
+
+  This dual-reference state is migration-only. It keeps the tree green while real-desktop parity is being proven; it is removed atomically with the obsolete tests and project in Task 3.
+
+- [ ] **Step 4: Keep `WpfTestHost` as the sole STA helper**
+
+  `WpfTestHost` is the sole STA helper from Foundation through cutover. Update Timeline WPF smoke tests to call `WpfTestHost.Run(Action)`; do not create, delete, or reference a second STA helper.
+
+  ```csharp
+  using System;
+  using System.Runtime.ExceptionServices;
+  using System.Threading;
+  using System.Windows.Threading;
+
+  internal static class WpfTestHost
+  {
+      internal static T Run<T>(Func<T> action)
+      {
+          T result = default;
+          Exception failure = null;
+          Thread thread = new Thread(() =>
+          {
+              try
+              {
+                  result = action();
+              }
+              catch (Exception ex)
+              {
+                  failure = ex;
+              }
+              finally
+              {
+                  Dispatcher.CurrentDispatcher.InvokeShutdown();
+              }
+          });
+
+          thread.Name = "WinRestoreKit WPF test STA";
+          thread.IsBackground = true;
+          thread.SetApartmentState(ApartmentState.STA);
+          thread.Start();
+          thread.Join();
+
+          if (failure != null)
+              ExceptionDispatchInfo.Capture(failure).Throw();
+          return result;
+      }
+  }
+  ```
+
+  Retain the existing `Run(Action action)` overload as a thin wrapper around `Run<object>(() => { action(); return null; })`. Do not use `Application.Run`, create a second `Application`, or leave a Dispatcher alive after a test.
+
+- [ ] **Step 5: Pin automation names, roles, focusability, and live status in the actual WPF views**
+
+  Add the stable UIA surface to the existing controls; do not create hidden duplicate controls merely to satisfy a test. The values below are intentionally user-facing and testable.
+
+  ```xml
+  <!-- TimelineView.xaml -->
+  <ListBox x:Name="TimelineEventList"
+           Focusable="True"
+           AutomationProperties.AutomationId="TimelineEventList"
+           AutomationProperties.Name="Snapshots"
+           AutomationProperties.HelpText="Use Left and Right Arrow to move through snapshots. Press Enter to compare a restorable snapshot." />
+
+  <!-- ComparisonWorkspaceView.xaml: merge these attributes into the existing elements;
+       the root and controls keep their existing parents and bindings. -->
+  <UserControl AutomationProperties.AutomationId="ComparisonWorkspace"
+               AutomationProperties.Name="Snapshot comparison workspace" />
+  <ListBox x:Name="CompareModuleList"
+           Focusable="True"
+           AutomationProperties.AutomationId="CompareModuleList"
+           AutomationProperties.Name="Modules in the selected snapshot" />
+  <RadioButton x:Name="CompareFilterAll"
+               AutomationProperties.AutomationId="CompareFilterAll"
+               AutomationProperties.Name="Show all compared modules" />
+  <RadioButton x:Name="CompareFilterChanged"
+               AutomationProperties.AutomationId="CompareFilterChanged"
+               AutomationProperties.Name="Show only changed modules" />
+  <ListBox x:Name="RestoreSetList"
+           AutomationProperties.AutomationId="RestoreSetList"
+           AutomationProperties.Name="Modules selected for restore" />
+  <Button x:Name="CompareContinueToConfirmButton"
+          AutomationProperties.AutomationId="CompareContinueToConfirmButton" />
+
+  <!-- ConfirmView.xaml -->
+  <Button x:Name="ConfirmRestoreButton"
+          AutomationProperties.AutomationId="ConfirmRestoreButton"
+          AutomationProperties.Name="Continue to final restore consent" />
+
+  <!-- SettingsView.xaml -->
+  <RadioButton x:Name="SettingsThemeFollowSystem"
+               AutomationProperties.AutomationId="SettingsThemeFollowSystem"
+               Content="Follow system" />
+  <RadioButton x:Name="SettingsThemeLight"
+               AutomationProperties.AutomationId="SettingsThemeLight"
+               Content="Light" />
+  <RadioButton x:Name="SettingsThemeDark"
+               AutomationProperties.AutomationId="SettingsThemeDark"
+               Content="Dark" />
+  ```
+
+  For each event row, compose its automation name from title, timestamp, event state, and diagnostic reason when one exists. Mark the real inline error/status element with `AutomationProperties.LiveSetting="Polite"`; failed and unreadable entries remain disabled for restoration rather than disappearing.
+
+- [ ] **Step 6: Run the focused STA, Timeline, and accessibility tests to verify they pass**
+
+  Run:
+
+  ```powershell
+  dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj -c Debug --filter "FullyQualifiedName~WpfCutoverRuntimeTests|FullyQualifiedName~TimelineWpfSmokeTests|FullyQualifiedName~TimelineAccessibilityTests"
+  ```
+
+  Expected: all selected tests pass, no test opens a visible window indefinitely, and output reports `Failed: 0`. At this point the WinForms tests remain present and runnable under the temporary dual-reference project.
+
+- [ ] **Step 7: Commit the reusable WPF runtime-test surface**
+
+  ```powershell
+  git add src\WinRestoreKit.Tests\WpfTestHost.cs src\WinRestoreKit.Tests\WpfCutoverRuntimeTests.cs src\WinRestoreKit.Tests\TimelineWpfSmokeTests.cs src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj src\WinRestoreKit.Wpf\MainWindow.xaml src\WinRestoreKit.Wpf\Views\TimelineView.xaml src\WinRestoreKit.Wpf\Views\ComparisonWorkspaceView.xaml src\WinRestoreKit.Wpf\Views\ConfirmView.xaml src\WinRestoreKit.Wpf\Views\SettingsView.xaml
+  git commit -m "test: add WPF cutover runtime coverage"
+  ```
+### Task 2: Execute and record the real Windows parity, accessibility, responsive, theme, and visual-baseline gate
+
+**Files:**
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover.md`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/timeline-normal-light-100.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/timeline-normal-dark-100.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/timeline-partial-light-100.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/timeline-partial-dark-100.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/timeline-failed-light-100.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/timeline-failed-dark-100.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/timeline-unreadable-light-100.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/timeline-unreadable-dark-100.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/compare-all-light-100.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/compare-all-dark-100.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/confirm-light-100.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/confirm-dark-100.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/timeline-normal-light-150.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/compare-all-light-150.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/confirm-light-150.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/timeline-normal-light-200.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/compare-all-light-200.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/confirm-light-200.png`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-cutover/screenshots/compare-all-light-1024w.png`
+- Modify: `src/WinRestoreKit.Wpf/Views/TimelineView.xaml`
+- Modify: `src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml`
+- Modify: `src/WinRestoreKit.Wpf/Views/ConfirmView.xaml`
+- Modify: `src/WinRestoreKit.Wpf/Views/SettingsView.xaml`
+- Test: `src/WinRestoreKit.Tests/WpfCutoverRuntimeTests.cs`
+- Test: `src/WinRestoreKit.Tests/TimelineAccessibilityTests.cs`
+- Test: `src/WinRestoreKit.Tests/ComparisonWorkspaceViewModelTests.cs`
+- Test: `src/WinRestoreKit.Tests/ConfirmViewModelTests.cs`
+- Test: `src/WinRestoreKit.Tests/BackupWorkspaceViewModelTests.cs`
+- Test: `src/WinRestoreKit.Tests/ProgressWorkspaceViewModelTests.cs`
+- Test: `src/WinRestoreKit.Tests/ResultWorkspaceViewModelTests.cs`
+
+**Interfaces:**
+- Consumes: one application-lifetime `SnapshotEventCatalog`, `TimelineViewModel.RefreshAsync()`, `SnapshotPayloadPreparationService.PrepareAsync(SnapshotEvent snapshot, CancellationToken cancellationToken)`, `SnapshotComparisonService.CompareAsync(SnapshotEvent snapshot, IReadOnlyList<BackupBase> modules, CancellationToken cancellationToken)`, comparison and restore-set view models, `WpfRunUi`, `WpfDialogService`, `WpfAppRestoreDialog`, `IThemeService`, and the Task 1 automation identifiers.
+- Produces: a committed real-desktop verification record and deterministic screenshot baselines proving the WPF shell is usable before destructive source removal. It produces no new product workflow, snapshot format, comparison evidence, restore rule, or compatibility shell.
+
+- [ ] **Step 1: Write the verification record before running the desktop session**
+
+  Create `docs/superpowers/verification/2026-08-09-wpf-cutover.md` with these immutable headings and a results table under each heading: `Environment`, `Build under test`, `Snapshot fixtures`, `Workflow parity`, `Keyboard and UI Automation`, `Themes and reduced motion`, `DPI and responsive layout`, `Screenshot baselines`, `Publish smoke prerequisites`, and `Result`.
+
+  Record all of the following before taking screenshots:
+
+  | Legacy workflow that must be absent after cutover | WPF workflow that must be observed now | Required result |
+  | --- | --- | --- |
+  | `MainForm` rail and `HomePageView` dashboard | `MainWindow` top bar and default Timeline workspace | No persistent sidebar or dashboard metric-strip home is present. |
+  | `RestoreWizardStep1View` | Timeline event selection and narrow list fallback | Verified and Partial entries enter Compare; Failed and Unreadable entries expose diagnostics only. |
+  | `RestoreWizardStep2View` | Comparison workspace and whole-module restore set | All/Changed-only filtering retains Unavailable and Not captured evidence under All; selection never descends below a module. |
+  | `RestoreConfirmForm` | Confirm workspace plus `RestoreConsentDialog` | Existing plan, snapshot gate, process/Explorer/sign-out impacts, and incomplete-snapshot consent are presented before a write. |
+  | `BackupPageView` and `ScopeGroups` | Create snapshot and WPF backup selection | Existing preset, scope, containment, naming, and compression choices reach the unchanged Application orchestration. |
+  | `ProgressPageView`, `ProgressLogSink`, `RichTextBoxLogSink` | WPF progress/result views and WPF dispatcher/log adapters | Progress, pause/cancel, logs, late-cancel wording, and final summary remain observable. |
+  | `HistoryPageView` | Timeline plus Advanced History | Both projections show the same events and source paths. |
+  | `AboutPageView`, `Theme`, `UpdateCheck` | WPF About, settings, theme and update adapters | Light, Dark, Follow system, version display, update status, and safe external link behavior are present. |
+  | `RestAppsForm` | `WpfAppRestoreDialog` | Existing app-export source and outcome behavior is reachable from a WPF-owned dialog. |
+
+- [ ] **Step 2: Build the side-by-side WPF application and run its focused deterministic tests**
+
+  Run:
+
+  ```powershell
+  dotnet build src\WinRestoreKit.sln -c Debug
+  dotnet test src\WinRestoreKit.sln -c Debug --no-build --filter "FullyQualifiedName~Timeline|FullyQualifiedName~SnapshotComparison|FullyQualifiedName~ComparisonWorkspace|FullyQualifiedName~RestoreSet|FullyQualifiedName~Confirm|FullyQualifiedName~BackupSelection|FullyQualifiedName~Progress|FullyQualifiedName~Wpf"
+  ```
+
+  Expected: the solution builds, all selected tests pass with `Failed: 0`, and both the old WinForms app and temporary WPF app remain buildable at this point. Record the SDK version, Windows build, monitor resolution, current DPI scale, and test summary in the verification record.
+
+- [ ] **Step 3: Run the WPF workflow smoke on a real Windows desktop before any WinForms deletion**
+
+  Launch the temporary WPF shell from an elevated Windows test account or a disposable Windows VM:
+
+  ```powershell
+  dotnet run --project src\WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj -c Debug
+  ```
+
+  Use a disposable backup root and reversible test data. Do not initiate a real registry restore on a personal workstation. When a restore write is required for the smoke, use the disposable VM, select one reversible whole module from a snapshot created in that VM, and obtain the VM operator's confirmation immediately before clicking **Start restore**.
+
+  Record each result in the verification document:
+
+  | Scenario | Exact interaction | Expected observable result |
+  | --- | --- | --- |
+  | Startup | Start the command above and wait for the window to settle. | The WPF `MainWindow` opens on Timeline with compact top bar, wordmark, Settings, and Create snapshot; no WinForms rail, dashboard home, ownerless dialog, or startup exception appears. |
+  | Timeline source states | Load one verified snapshot, one partial snapshot, a catalog session failure created through `RecordSessionFailure`, and one malformed/unreadable fixture. | All four states show honest labels and diagnostics. Only Verified/Partial can enter Compare; Failed/Unreadable have no restore action. |
+  | Timeline selection | Select a verified compressed snapshot, enter Compare, return, then select another snapshot. | Preparation is read-only; changing source clears a non-empty restore set only after its explicit confirmation; temporary payload scope is released when leaving Compare. |
+  | Compare | Let comparison load, use All and Changed-only filters, select a row, open its detail tray, cancel an in-flight comparison, and load it again. | Rows remain catalog-ordered; Changed, Same, Unavailable, and Not captured are distinguishable with text/icons; a one-module error does not erase other rows; cancel is awaited and leaves no leaked temporary payload. |
+  | Confirm | Add restorable modules, enter Confirm, inspect impacts, cancel, then repeat in the disposable VM and accept the existing consent/snapshot gates. | Selection is whole-module; exact existing process closures, Explorer restart, and sign-out impacts are shown; no reboot impact is invented; cancel writes nothing; accepted execution follows existing `RestorePlan`, `SnapshotGate`, `RestoreScope`, and `RestoreDispatch`. |
+  | Create snapshot | Choose an existing scope/preset and compression option, start one disposable backup, observe progress, then return to Timeline. | Run admission, progress, logs, cancellation controls, compression, manifest/log output, and late-cancel wording match Application contracts. A verified completion becomes selectable; untrusted/failed outcomes are truthful session diagnostics only. |
+  | App restore | Enter the app-restore module from the disposable snapshot and close its WPF dialog without installing software. | The WPF-owned dialog is modal to the main window and its source/list/error text matches the Application service; no WinForms form opens. |
+  | Advanced destinations | Open Advanced History, Settings, and About, then return to Timeline. | Advanced History is the same event source; theme and version settings persist correctly; About update/link flows are WPF-owned. |
+
+- [ ] **Step 4: Verify keyboard-only and UI Automation behavior on the live desktop**
+
+  Start the Windows SDK inspection utility while the WPF shell is visible:
+
+  ```powershell
+  $inspect = Get-ChildItem "${env:ProgramFiles(x86)}\Windows Kits\10\bin" -Recurse -Filter Inspect.exe | Select-Object -First 1 -ExpandProperty FullName
+  if ([string]::IsNullOrWhiteSpace($inspect)) { throw "Install the Windows SDK Inspect.exe tool before recording UI Automation evidence." }
+  & $inspect
+  ```
+
+  Then execute and record this matrix. For each row record the UIA Name, ControlType, IsEnabled state, and keyboard result observed with Inspect.exe.
+
+  | Keyboard path | Expected result |
+  | --- | --- |
+  | Tab from the top bar through Create snapshot, Timeline, filters, row actions, restore-set actions, Confirm, Settings, and About | Visible focus never disappears, no focus trap occurs, and labels describe each action. |
+  | Left/Right while `TimelineEventList` has focus | Moves among timeline events without a mouse. |
+  | Enter on Verified or Partial event | Selects the event and opens Compare. |
+  | Enter on Failed or Unreadable event | Opens diagnostic detail only; no restore set or restore command becomes available. |
+  | Tab/Shift+Tab and Space/Enter in Compare and Confirm | Reaches filters, row selection, detail tray, add/remove actions, cancel, and confirm in a predictable order. |
+  | Narrow Timeline list fallback | Exposes the same title, timestamp, state, diagnostic, enabled/disabled status, and selection action as the visual timeline. |
+  | WPF dialog open | Dialog has the main WPF window as owner, remains in the foreground, and its controls are independently discoverable by UIA. |
+
+  Use the Task 1 automation identifiers as the stable evidence points. For a row with an error, verify the live status is announced politely rather than converted to “nothing found.”
+
+- [ ] **Step 5: Verify Light, Dark, Follow system, contrast, and reduced-motion behavior**
+
+  In the WPF Settings view, select **Light**, **Dark**, and **Follow system** in separate runs. For Follow system, change the Windows app color preference and return focus to the application. Test reduced motion on the disposable test profile only:
+
+  ```powershell
+  Start-Process "ms-settings:easeofaccess-display"
+  ```
+
+  Capture the previous animation setting, turn off **Animation effects**, restart the WPF app, select a Timeline event, filter Compare, and open/close the detail tray. Restore the prior Windows setting after the test.
+
+  Expected:
+
+  - Light and Dark use neutral Windows surfaces, mineral-blue primary action, restrained coral warnings, Segoe UI Variable for normal UI text, and the packaged monospace face only for logs/technical values.
+  - Status is never encoded only by color; focus, selected, warning, unavailable, and changed states remain distinguishable in grayscale.
+  - Inspect foreground/background pairs with a contrast checker and record a contrast ratio of at least `4.5:1` for every normal-text token in Light and Dark.
+  - Follow system changes only while Follow system is selected; explicit Light and Dark do not react to the OS setting.
+  - With Animation effects disabled, nonessential selection/filter/tray motion is absent and state changes remain immediate and usable.
+
+- [ ] **Step 6: Verify all required DPI scales and the minimum-width layout on the live desktop**
+
+  Open Windows Display Settings on the disposable test profile:
+
+  ```powershell
+  Start-Process "ms-settings:display"
+  ```
+
+  Restart the WPF app at 100%, 125%, 150%, 175%, and 200% scaling. At each scale inspect Timeline, Compare, Confirm, backup selection, progress, result, settings, About, and a dialog. At 100%, resize the window to its 1024 px minimum usable width and test the Compare workspace.
+
+  Expected:
+
+  - No clipped labels, overlap, unusable hit targets, hidden keyboard focus, or horizontal content loss occurs at any required scale.
+  - The window cannot be reduced below its usable 1024 px minimum.
+  - At the minimum width, comparison evidence and restore-set panes stack vertically; both remain reachable through keyboard and UIA.
+  - At wider widths the normal two-pane comparison presentation returns without duplicate content or a stale selection.
+
+- [ ] **Step 7: Capture, compare, and commit deterministic screenshots**
+
+  Use the same test account, 100% scaling unless the filename names another scale, a fixed application window size, the same disposable fixture root, and no unrelated windows. Capture the exact filenames listed in **Files** for this task. For each baseline, record theme, DPI, logical window size, fixture state, and SHA-256 in the verification document.
+
+  Compare every new capture side by side with its committed predecessor when a predecessor exists. A change is accepted only when it matches the approved Timeline + Compare visual direction: no permanent sidebar, generic dashboard card grid, giant failure headline, glow, purple gradient, decorative chart, or color-only state. Record `new baseline` for the first approved set and `matched` or a concise visual difference for later runs.
+
+  Expected screenshot coverage:
+
+  - Light and Dark Timeline screenshots cover normal, Partial, Failed, and Unreadable source states.
+  - Light and Dark Compare screenshots show All modules, including Changed, Same, Unavailable, and Not captured evidence.
+  - Light and Dark Confirm screenshots show grouped existing restore impacts and the explicit start action.
+  - Timeline, Compare, and Confirm each have 100%, 150%, and 200% baseline coverage.
+  - `compare-all-light-1024w.png` demonstrates the required stacked narrow layout.
+
+  Before setting the gate result, verify the baseline directory has exactly the required files and emit their hashes for the record:
+
+  ```powershell
+  $baselineRoot = 'docs\superpowers\verification\2026-08-09-wpf-cutover\screenshots'
+  $expectedBaselineNames = @(
+    'timeline-normal-light-100.png', 'timeline-normal-dark-100.png',
+    'timeline-partial-light-100.png', 'timeline-partial-dark-100.png',
+    'timeline-failed-light-100.png', 'timeline-failed-dark-100.png',
+    'timeline-unreadable-light-100.png', 'timeline-unreadable-dark-100.png',
+    'compare-all-light-100.png', 'compare-all-dark-100.png',
+    'confirm-light-100.png', 'confirm-dark-100.png',
+    'timeline-normal-light-150.png', 'compare-all-light-150.png',
+    'confirm-light-150.png', 'timeline-normal-light-200.png',
+    'compare-all-light-200.png', 'confirm-light-200.png',
+    'compare-all-light-1024w.png'
+  ) | Sort-Object
+  $actualBaselineNames = @(Get-ChildItem $baselineRoot -File -Filter '*.png' |
+      Select-Object -ExpandProperty Name | Sort-Object)
+  $baselineDelta = Compare-Object $expectedBaselineNames $actualBaselineNames
+  if ($baselineDelta) {
+      throw "Screenshot baseline set differs from the required 19 files:`n$($baselineDelta | Out-String)"
+  }
+  Get-ChildItem $baselineRoot -File -Filter '*.png' |
+      Sort-Object Name | Get-FileHash -Algorithm SHA256
+  ```
+
+  Expected: the command prints exactly 19 named SHA-256 rows and throws if any capture is absent, extra, or misspelled.
+
+- [ ] **Step 8: Make the deletion decision explicit**
+
+  In the verification record, set `Result: PASS — real Windows desktop gate complete` only when every Task 2 row passed, every listed screenshot exists, and the desktop exercise observed an actual WPF startup, Timeline, Compare, Confirm, backup/progress/results, dialogs, theme modes, keyboard/UIA, reduced motion, DPI, and minimum-width layout.
+
+  If any item fails, set `Result: BLOCKED —` followed by the exact scenario name and observed failure, repair the owning WPF view/view-model/service, then repeat the affected focused test and live desktop row. Do not begin Task 3 or remove a WinForms file while the result is blocked.
+
+- [ ] **Step 9: Commit the real-desktop evidence and baselines**
+
+  ```powershell
+  git add docs\superpowers\verification\2026-08-09-wpf-cutover.md docs\superpowers\verification\2026-08-09-wpf-cutover\screenshots src\WinRestoreKit.Wpf\Views\TimelineView.xaml src\WinRestoreKit.Wpf\Views\ComparisonWorkspaceView.xaml src\WinRestoreKit.Wpf\Views\ConfirmView.xaml src\WinRestoreKit.Wpf\Views\SettingsView.xaml
+  git commit -m "docs: record WPF desktop verification baselines"
+  ```
+
+### Task 3: Atomically transfer the `WinRestoreKit` shipping identity to WPF and remove every obsolete WinForms artifact
+
+**Files:**
+- Modify: `src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj`
+- Move: `src/WinRestoreKit/app.manifest` to `src/WinRestoreKit.Wpf/app.manifest`
+- Move: `src/WinRestoreKit/WinRestoreKit.ico` to `src/WinRestoreKit.Wpf/WinRestoreKit.ico`
+- Move: `src/WinRestoreKit/Fonts/IBMPlexMono-Regular.ttf` to `src/WinRestoreKit.Wpf/Assets/Fonts/IBMPlexMono-Regular.ttf`
+- Move: `src/WinRestoreKit/Fonts/IBMPlexMono-Medium.ttf` to `src/WinRestoreKit.Wpf/Assets/Fonts/IBMPlexMono-Medium.ttf`
+- Delete: `src/WinRestoreKit.Wpf/Properties/AssemblyInfo.cs`
+- Modify: `src/WinRestoreKit.Core/Conf/AppStoreApps.cs`
+- Modify: `src/WinRestoreKit/Properties/AssemblyInfo.cs`
+- Modify: `src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj`
+- Create: `src/WinRestoreKit.Tests/ShippingIdentityTests.cs`
+- Modify: `src/WinRestoreKit.Tests/VersionParsingTests.cs`
+- Modify: `src/WinRestoreKit.Tests/RebrandIdentityTests.cs`
+- Modify: `src/WinRestoreKit.Tests/RestoreDeclarationTests.cs`
+- Modify: `src/WinRestoreKit.Tests/RunSummaryTests.cs`
+- Modify: `src/WinRestoreKit.Tests/AssemblyInfo.cs`
+- Modify: `src/WinRestoreKit.Tests/UpdateCheckVerdictTests.cs`
+- Modify: `src/WinRestoreKit.Tests/OsVersionTests.cs`
+- Modify: `src/WinRestoreKit.Tests/AppRestoreDialogTests.cs`
+- Modify: `src/WinRestoreKit.Tests/BackupFoldersReadTests.cs`
+- Modify: `src/WinRestoreKit.Tests/LogHelperTests.cs`
+- Modify: `src/WinRestoreKit.Tests/ScopeGroupsPrivacyTests.cs`
+- Create: `src/WinRestoreKit.Tests/AppRestoreOwnerTests.cs` (rewrite/rename of `RestoreDialogOwnerTests.cs`)
+- Modify: `src/WinRestoreKit.Tests/ArchiveProgressTests.cs`
+- Modify: `src/WinRestoreKit.Tests/BackupDestinationContainmentTests.cs`
+- Modify: `src/WinRestoreKit.Tests/BackupDestinationLifecycleTests.cs`
+- Modify: `src/WinRestoreKit.Tests/BackupPresetsTests.cs`
+- Modify: `src/WinRestoreKit.Tests/LockedPayloadBackupTests.cs`
+- Modify: `src/WinRestoreKit.Tests/ModuleShapeTests.cs`
+- Modify: `src/WinRestoreKit.Tests/RestoreConsentCancellationTests.cs`
+- Modify: `src/WinRestoreKit.Tests/SnapshotFolderPathTests.cs`
+- Modify: `src/WinRestoreKit.Tests/ViewDataHelperTests.cs`
+- Modify: `src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs`
+- Modify: `src/WinRestoreKit.sln`
+- Delete: `src/WinRestoreKit/WinRestoreKit.csproj`
+- Delete: `src/WinRestoreKit/Program.cs`
+- Delete: `src/WinRestoreKit/MainForm.cs`
+- Delete: `src/WinRestoreKit/MainForm.Designer.cs`
+- Delete: `src/WinRestoreKit/MainForm.resx`
+- Delete: `src/WinRestoreKit/GitHub.cs`
+- Delete: `src/WinRestoreKit/GitHubIcon.png`
+- Delete: `src/WinRestoreKit/Views/`
+- Delete: `src/WinRestoreKit/Forms/`
+- Delete: `src/WinRestoreKit/Controls/`
+- Delete: `src/WinRestoreKit/Helpers/`
+- Delete: `src/WinRestoreKit/Orchestration/`
+- Delete: `src/WinRestoreKit/Results/`
+- Delete: `src/WinRestoreKit/Fonts/Barlow-Regular.otf`
+- Delete: `src/WinRestoreKit/Fonts/Barlow-Medium.otf`
+- Delete: `src/WinRestoreKit/Fonts/Barlow-SemiBold.otf`
+- Delete: `src/WinRestoreKit/Fonts/BarlowCondensed-Regular.otf`
+- Delete: `src/WinRestoreKit/Fonts/BarlowCondensed-SemiBold.otf`
+- Delete: `src/WinRestoreKit/Fonts/BarlowCondensed-Bold.otf`
+- Delete: `src/WinRestoreKit/Properties/Resources.resx`
+- Delete: `src/WinRestoreKit/Properties/Resources.Designer.cs`
+- Delete: `src/WinRestoreKit.Tests/BackupPageViewTests.cs`
+- Delete: `src/WinRestoreKit.Tests/HomePageViewBaselineTests.cs`
+- Delete: `src/WinRestoreKit.Tests/HomePageViewDriftTests.cs`
+- Delete: `src/WinRestoreKit.Tests/MainFormRunAdmissionTests.cs`
+- Delete: `src/WinRestoreKit.Tests/NavigationServiceTests.cs`
+- Delete: `src/WinRestoreKit.Tests/ProgressPageViewTests.cs`
+- Delete: `src/WinRestoreKit.Tests/HistoryPageViewTests.cs`
+- Delete: `src/WinRestoreKit.Tests/RestoreDialogOwnerTests.cs`
+- Delete: `src/WinRestoreKit.Tests/ShellLayoutTests.cs`
+- Delete: `src/WinRestoreKit.Tests/FontLoaderTests.cs`
+- Delete: `src/WinRestoreKit.Tests/CompressedDriftPayloadTests.cs`
+- Test: `src/WinRestoreKit.Tests/ShippingIdentityTests.cs`
+- Test: `src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs`
+- Test: `src/WinRestoreKit.Tests/AdvancedHistoryViewModelTests.cs`
+- Test: `src/WinRestoreKit.Tests/BackupWorkspaceViewModelTests.cs`
+- Test: `src/WinRestoreKit.Tests/ProgressWorkspaceViewModelTests.cs`
+- Test: `src/WinRestoreKit.Tests/ResultWorkspaceViewModelTests.cs`
+- Test: `src/WinRestoreKit.Tests/RestoreConsentDialogTests.cs`
+- Test: `src/WinRestoreKit.Tests/AppRestoreDialogTests.cs`
+- Test: `src/WinRestoreKit.Tests/AppRestoreOwnerTests.cs`
+
+**Interfaces:**
+- Consumes: Application implementations of orchestration, run state, run summary, backup root, scope groups, presets, folders, update checking, and app-restore parsing; WPF adapters and view models from the four upstream plans; Core's existing `BackupBase`, payload, manifest, restore, and logging contracts; the Task 2 desktop gate.
+- Produces: the only `WinRestoreKit` executable/assembly is WPF; the solution contains `Core`, `Application`, `Wpf`, and `Tests`; the physical raw version source survives at its exact old path; no old WinForms project, source, resource, helper, control, form, test, or compatibility path remains.
+
+- [ ] **Step 1: Re-run the real-desktop deletion gate and stop on missing evidence**
+
+  Before writing an identity test or issuing any removal command, read `docs/superpowers/verification/2026-08-09-wpf-cutover.md` and verify that `Result` is exactly `PASS — real Windows desktop gate complete` and every screenshot listed in Task 2 exists.
+
+  Run:
+
+  ```powershell
+  Test-Path docs\superpowers\verification\2026-08-09-wpf-cutover.md
+  Get-ChildItem docs\superpowers\verification\2026-08-09-wpf-cutover\screenshots -File | Measure-Object
+  ```
+
+  Expected: the report exists and the screenshot file count is `19`. If either condition is false, stop. WinForms deletion is not authorized until the real desktop evidence is complete.
+
+- [ ] **Step 2: Write and observe the failing final-identity regression test while temporary side-by-side references still compile**
+
+  Add `ShippingIdentityTests.cs`. During this one red test cycle, WPF still has its temporary assembly name and the test project still has both application references, so the test can compile and fail only on the intended shipping-identity assertion.
+
+  ```csharp
+  using System.IO;
+  using System.Linq;
+  using System.Reflection;
+  using System.Runtime.Versioning;
+  using DataHelper;
+  using WinRestoreKit.Wpf;
+  using Xunit;
+
+  namespace WinRestoreKit.Tests
+  {
+      public sealed class ShippingIdentityTests
+      {
+          [Fact]
+          public void ShippingWpfAssembly_UsesTheRawFallbackVersionSource()
+          {
+              string source = File.ReadAllText(Path.Combine(
+                  AppContext.BaseDirectory, "TestData", "AssemblyInfo.cs"));
+              Assembly assembly = typeof(App).Assembly;
+              string compiled = assembly.GetCustomAttribute<AssemblyFileVersionAttribute>().Version;
+
+              Assert.Equal("WinRestoreKit", assembly.GetName().Name);
+              Assert.Equal(Data.ParseLatestVersion(source), compiled);
+              Assert.Equal(3, compiled.Split('.').Length);
+          }
+
+          [Fact]
+          public void ShippingWpfAssembly_HasNoWinFormsAssemblyReference()
+          {
+              string[] references = typeof(App).Assembly
+                  .GetReferencedAssemblies()
+                  .Select(reference => reference.Name)
+                  .ToArray();
+
+              Assert.DoesNotContain("System.Windows.Forms", references);
+              Assert.Contains(typeof(App).Assembly.GetCustomAttributes<SupportedOSPlatformAttribute>(),
+                  attribute => attribute.PlatformName == "windows7.0");
+          }
+      }
+  }
+  ```
+
+- [ ] **Step 3: Run the identity test to verify it fails for the temporary WPF identity**
+
+  Run:
+
+  ```powershell
+  dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj -c Debug --filter FullyQualifiedName~ShippingIdentityTests
+  ```
+
+  Expected: `ShippingWpfAssembly_UsesTheRawFallbackVersionSource` fails because the temporary WPF assembly name is `WinRestoreKit.Wpf`. Do not commit this red intermediate state.
+
+- [ ] **Step 4: Preserve every behavioral test before removing its WinForms host**
+
+  Verify this ownership map and make the stated test migration before deleting the old source:
+
+  | Legacy path or test | Required surviving owner and assertion | Cutover action |
+  | --- | --- | --- |
+  | `Orchestration/BackupRestoreOrchestrator.cs`, `RunControl.cs`, `RunCoordinator.cs`, `IRunUi.cs`, `Results/RunSummary.cs` | `src/WinRestoreKit.Application/`; `RunCoordinatorTests`, `RunControlTests`, `RunSummaryTests`, backup/restore lifecycle tests compile without WinForms imports. | Remove old files after tests target Application. |
+  | `Helpers/BackupRootRegistry.cs` | `Application/Settings/BackupRootRegistry.cs`; registry format and destination tests retain exact behavior. | Remove old file. |
+  | `Helpers/UpdateCheck.cs` | `Application/Updates/VersionInfo.cs`, `UpdateVerdict.cs`, `UpdateCheckService.cs`, plus WPF presenters. | Retarget version tests; keep raw URL/path invariant. |
+  | `Program` version/update helpers and their tests | Application `VersionInfo`, `UpdateVerdict`, and `UpdateCheckService`; final `App` assembly. | Retarget `VersionParsingTests`, `UpdateCheckVerdictTests`, `RebrandIdentityTests`, `RestoreDeclarationTests`, and `OsVersionTests` from `Program`/`MainForm`; preserve unknown-version, normalization, raw-fallback, startup-failure wording, and product-identity assertions. Remove every stale WinForms/startup comment. |
+  | `Helpers/RichTextBoxLogSink.cs`, `LogHelperTargetExtensions`, and `LogHelperTests.cs` | Core `ILogSink` and `LogHelper.SetSink(ILogSink)` with WPF `WpfLogSink`. | Replace the `RichTextBox` construction with a recording `ILogSink` fake; retain braces, format, clear, and no-sink behavior, then remove every `SetTarget` call and extension. |
+  | `Views/ScopeGroups.cs`, `BackupPresets.cs`, `BackupFolders.cs`, `WatchedGroups.cs` | Application data contracts plus WPF backup/history view models. | Retarget `BackupPresetsTests`, `BackupFoldersReadTests`, `ScopeGroupsPrivacyTests`, and `ViewDataHelperTests`; retain exact membership literals, privacy-safe exclusions, and folder behavior. |
+  | `Forms/RestAppsForm.cs` and its former parser/list/install helpers | `Application/AppRestore/AppRestoreService.cs` and `WpfAppRestoreDialog`. | Rewrite `AppRestoreDialogTests.cs` to use `AppRestoreService.BuildSources`, `ReadFromSource`, `ComposeListState`, `RouteProblem`, and `InstallAsync`; preserve exact export-source precedence, parser states, package IDs, winget outcome, and failure wording without a `Views` or WinForms import. |
+  | `HomePageView` drift checks and restore wizard artifact discovery | `SnapshotComparisonService`, `SnapshotPayloadPreparationService`, Timeline/Compare view models. | Move the old drift and compressed-payload assertions into `SnapshotComparisonServiceTests.cs` and `SnapshotPayloadPreparationServiceTests.cs`; no reflection over `HomePageView` remains. |
+
+  Write the `AppRestoreDialogTests.cs` red assertions against the Application service before removing the Form helpers, then make the test green only after the helper migration:
+
+  ```csharp
+  AppExport export = AppRestoreService.ReadFromSource(sourcePath);
+
+  Assert.Equal(AppExportState.Ok, export.State);
+  Assert.Equal(new[] { "Microsoft.PowerToys" }, export.PackageIdentifiers);
+  ```
+
+  `ReadFromSource` must use `AppStoreApps.ExportPathIn` and dispose its private payload `ReadScope`; do not recreate JSON parsing in WPF or in the test.
+
+  Rewrite `LogHelperTests.cs` before deleting `Helpers/RichTextBoxLogSink.cs`:
+
+  ```csharp
+  private sealed class RecordingLogSink : ILogSink
+  {
+      internal List<string> Entries { get; } = new List<string>();
+
+      public void Append(string text) => Entries.Add(text);
+      public void Clear() => Entries.Clear();
+  }
+
+  [Fact]
+  public void LogMessage_UnmatchedBrace_DoesNotThrowAndStillLogs()
+  {
+      RecordingLogSink sink = new RecordingLogSink();
+      LogHelper.Instance.SetSink(sink);
+      try
+      {
+          LogHelper.Instance.LogMessage("failed on {0 unbalanced");
+          Assert.Contains("unbalanced", sink.Entries[0]);
+      }
+      finally
+      {
+          LogHelper.Instance.SetSink(null);
+      }
+  }
+  ```
+
+  Preserve the existing `Log`, `LogMessage`, `ClearLog`, and no-sink assertions; no test constructs a UI control after this conversion.
+
+  Update the test doubles in `ArchiveProgressTests.cs`, `BackupDestinationContainmentTests.cs`, `BackupDestinationLifecycleTests.cs`, `LockedPayloadBackupTests.cs`, `RestoreConsentCancellationTests.cs`, and `SnapshotFolderPathTests.cs` to remove `using System.Windows.Forms;` and a typed `IWin32Window Owner`. They implement `IRunUi.DialogOwner` with an opaque sentinel; tests for app restore live in `AppRestoreOwnerTests.cs`, not generic run doubles.
+
+  ```csharp
+  private sealed class TestRunUi : IRunUi
+  {
+      private static readonly object DialogOwnerSentinel = new object();
+
+      internal List<string> ProgressTexts { get; } = new List<string>();
+
+      public object DialogOwner => DialogOwnerSentinel;
+      public void SetProgressText(string text) => ProgressTexts.Add(text ?? string.Empty);
+      public void SetProgressPercent(int percent) { }
+      public void SetProgressDetail(string groupInfo, string elapsed, string remaining,
+          string throughput, long bytesWritten, int errors, int warnings) { }
+      public void ShowSummary(RunSummary summary, string caption,
+          IReadOnlyList<ModuleOutcome> outcomes) { }
+      public IReadOnlyList<string> ShowConsentDialog(RestorePlan plan) => Array.Empty<string>();
+      public bool ConfirmSnapshotOverride(string text, string caption) => false;
+      public void ShowPlanCompositionError(string text, string caption) { }
+      public void SetExplorerRestartVisible(bool visible) { }
+  }
+  ```
+
+  Preserve the Core API and outcome semantics in `src/WinRestoreKit.Core/Conf/AppStoreApps.cs`: `RestoreAsync(string path, object owner)`, `Restore(string path, object owner)`, and `Action<string, object> RestoreDialog` remain unchanged. Rewrite only stale `RestAppsForm`, WinForms, `IWin32Window`, and `Program.Main` XML remarks so they describe `WpfAppRestoreDialog`, an opaque shell-owned STA `Window`, and `App.OnStartup`; do not change visibility, failure messages, skipped result, or callback invocation. `AppRestoreOwnerTests.cs` must prove all three paths:
+
+  ```csharp
+  using Conf;
+  using Xunit;
+
+  [Fact]
+  public async Task RestoreAsync_ForwardsTheOpaqueDialogOwner()
+  {
+      object expectedOwner = new object();
+      object actualOwner = null;
+      AppStoreApps.RestoreDialog = (_, owner) => actualOwner = owner;
+
+      ModuleResult result = await new AppStoreApps().RestoreAsync("apps.json", expectedOwner);
+
+      Assert.Same(expectedOwner, actualOwner);
+      Assert.Contains(result.Steps, step => step.State == ResultState.Skipped);
+  }
+  ```
+
+  Keep distinct facts named `Restore_WithNoDialogRegistered_FailsRatherThanClaimingSkipped`, `Restore_WithADialogButNoOwner_FailsRatherThanClaimingSkipped`, `Restore_WithADialogRegistered_OpensItForTheSelectedSourceAndReportsSkipped`, and `RestoreAsync_RunsTheDialogOnTheCallersThread`; all use an `object` sentinel rather than a WinForms type. Move the old static `DialogHook` into this renamed file and use it to restore the prior delegate after every test.
+
+  Reset the mutable static delegate in `finally`/`IDisposable` cleanup. Keep the module's existing backup/result behavior unchanged: the moved Application orchestrator invokes exactly `await appStoreApps.RestoreAsync(currentRestorePath, ui.DialogOwner)`, and the WPF composition root supplies the current shell `Window` as that opaque owner.
+
+- [ ] **Step 5: Perform the identity transfer, test-project migration, solution removal, asset moves, and source deletion as one atomic green change**
+
+  Do not create two app assemblies named `WinRestoreKit` in a green tree. First remove the old project from the solution, then make the WPF assembly the shipping identity while removing the old app source and all tests that require it.
+
+  ```powershell
+  dotnet sln src\WinRestoreKit.sln remove src\WinRestoreKit\WinRestoreKit.csproj
+  New-Item -ItemType Directory -Force src\WinRestoreKit.Wpf\Assets\Fonts | Out-Null
+  git mv src\WinRestoreKit\app.manifest src\WinRestoreKit.Wpf\app.manifest
+  git mv src\WinRestoreKit\WinRestoreKit.ico src\WinRestoreKit.Wpf\WinRestoreKit.ico
+  git mv src\WinRestoreKit\Fonts\IBMPlexMono-Regular.ttf src\WinRestoreKit.Wpf\Assets\Fonts\IBMPlexMono-Regular.ttf
+  git mv src\WinRestoreKit\Fonts\IBMPlexMono-Medium.ttf src\WinRestoreKit.Wpf\Assets\Fonts\IBMPlexMono-Medium.ttf
+  ```
+
+  Change `src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj` exactly as follows. This is the only app project with `GenerateAssemblyInfo=false`.
+
+  ```xml
+  <Project Sdk="Microsoft.NET.Sdk">
+    <PropertyGroup>
+      <OutputType>WinExe</OutputType>
+      <TargetFramework>net8.0-windows</TargetFramework>
+      <UseWPF>true</UseWPF>
+      <RootNamespace>WinRestoreKit.Wpf</RootNamespace>
+      <AssemblyName>WinRestoreKit</AssemblyName>
+      <ApplicationManifest>app.manifest</ApplicationManifest>
+      <ApplicationIcon>WinRestoreKit.ico</ApplicationIcon>
+      <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
+      <Nullable>disable</Nullable>
+      <ImplicitUsings>disable</ImplicitUsings>
+      <Platforms>AnyCPU</Platforms>
+      <Deterministic>true</Deterministic>
+    </PropertyGroup>
+
+    <ItemGroup>
+      <Compile Include="..\WinRestoreKit\Properties\AssemblyInfo.cs"
+               Link="Properties\AssemblyInfo.cs" />
+      <Resource Include="Assets\Fonts\IBMPlexMono-Regular.ttf" />
+      <Resource Include="Assets\Fonts\IBMPlexMono-Medium.ttf" />
+    </ItemGroup>
+
+    <ItemGroup>
+      <ProjectReference Include="..\WinRestoreKit.Application\WinRestoreKit.Application.csproj" />
+      <ProjectReference Include="..\WinRestoreKit.Core\WinRestoreKit.Core.csproj" />
+    </ItemGroup>
+  </Project>
+  ```
+
+  Do not set `Version`, `AssemblyVersion`, `FileVersion`, `InformationalVersion`, `PublishTrimmed`, or `UseWindowsForms` in this project. Delete `src/WinRestoreKit.Wpf/Properties/AssemblyInfo.cs`, because the linked physical file becomes the one source of WPF assembly attributes and test friendship.
+
+  Retain these manifest elements exactly after the move; remove only WinForms-specific explanatory comments:
+
+  ```xml
+  <requestedExecutionLevel level="highestAvailable" uiAccess="false" />
+  <longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware>
+  ```
+
+  Do not add a `dpiAware` element. WPF handles DPI without `Application.SetHighDpiMode`.
+
+  In `WinRestoreKit.Tests.csproj`, remove the old WinForms project reference and replace the temporary dual-framework settings with final WPF-only support:
+
+  ```xml
+  <PropertyGroup>
+    <TargetFramework>net8.0-windows</TargetFramework>
+    <UseWPF>true</UseWPF>
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+    <Nullable>disable</Nullable>
+    <ImplicitUsings>disable</ImplicitUsings>
+    <Platforms>AnyCPU</Platforms>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\WinRestoreKit.Application\WinRestoreKit.Application.csproj" />
+    <ProjectReference Include="..\WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj" />
+  </ItemGroup>
+  ```
+
+  Keep the existing `None Include="..\WinRestoreKit\Properties\AssemblyInfo.cs"` test-data link unchanged.
+
+  Update the comments in the physical `src/WinRestoreKit/Properties/AssemblyInfo.cs` from WinForms to WPF but keep the physical path, attribute order, and exact version source format unchanged:
+
+  ```csharp
+  [assembly: SupportedOSPlatform("windows7.0")]
+  [assembly: AssemblyTitle("WinRestoreKit")]
+  [assembly: AssemblyVersion("0.0.1")]
+  [assembly: AssemblyFileVersion("0.0.1")]
+  [assembly: InternalsVisibleTo("WinRestoreKit.Tests")]
+  ```
+
+  Keep `Data.Uri.URL_ASSEMBLY` exactly `https://raw.githubusercontent.com/nicolasestrem/WinRestoreKit/main/src/WinRestoreKit/Properties/AssemblyInfo.cs`.
+
+- [ ] **Step 6: Delete every obsolete production and construction-test path without a shim**
+
+  Remove the old shell in the same atomic change. Retain only `src/WinRestoreKit/Properties/AssemblyInfo.cs` under the old directory.
+
+  ```powershell
+  git rm src\WinRestoreKit\WinRestoreKit.csproj src\WinRestoreKit\Program.cs src\WinRestoreKit\MainForm.cs src\WinRestoreKit\MainForm.Designer.cs src\WinRestoreKit\MainForm.resx src\WinRestoreKit\GitHub.cs src\WinRestoreKit\GitHubIcon.png
+  git rm -r src\WinRestoreKit\Views src\WinRestoreKit\Forms src\WinRestoreKit\Controls src\WinRestoreKit\Helpers src\WinRestoreKit\Orchestration src\WinRestoreKit\Results
+  git rm src\WinRestoreKit\Fonts\Barlow-Regular.otf src\WinRestoreKit\Fonts\Barlow-Medium.otf src\WinRestoreKit\Fonts\Barlow-SemiBold.otf src\WinRestoreKit\Fonts\BarlowCondensed-Regular.otf src\WinRestoreKit\Fonts\BarlowCondensed-SemiBold.otf src\WinRestoreKit\Fonts\BarlowCondensed-Bold.otf
+  git rm src\WinRestoreKit\Properties\Resources.resx src\WinRestoreKit\Properties\Resources.Designer.cs
+  git rm src\WinRestoreKit.Tests\BackupPageViewTests.cs src\WinRestoreKit.Tests\HomePageViewBaselineTests.cs src\WinRestoreKit.Tests\HomePageViewDriftTests.cs src\WinRestoreKit.Tests\MainFormRunAdmissionTests.cs src\WinRestoreKit.Tests\NavigationServiceTests.cs src\WinRestoreKit.Tests\ProgressPageViewTests.cs src\WinRestoreKit.Tests\HistoryPageViewTests.cs src\WinRestoreKit.Tests\RestoreDialogOwnerTests.cs src\WinRestoreKit.Tests\ShellLayoutTests.cs src\WinRestoreKit.Tests\FontLoaderTests.cs src\WinRestoreKit.Tests\CompressedDriftPayloadTests.cs
+  ```
+
+  Apply this exact test disposition before the delete command:
+
+  | Legacy test | Required replacement or retained assertion |
+  | --- | --- |
+  | `BackupPageViewTests.cs` | `BackupWorkspaceViewModelTests.cs` verifies selected scopes/modules, validation, compression, and request emission. |
+  | `ProgressPageViewTests.cs` | `ProgressWorkspaceViewModelTests.cs` and `ResultWorkspaceViewModelTests.cs` verify cancellation state, progress text, late-cancel summary, and outcomes. |
+  | `MainFormRunAdmissionTests.cs` | `RunCoordinatorTests.cs` plus WPF progress navigation/runtime test verify one active run and replacement only after completion. |
+  | `NavigationServiceTests.cs` | `ShellViewModel`/runtime tests verify explicit workspace navigation. |
+  | `ShellLayoutTests.cs` | Task 1 automation and Task 2 DPI/screenshot evidence verify actual WPF layout. |
+  | `HomePageViewBaselineTests.cs` | `TimelineViewModelTests.cs`, `TimelineAccessibilityTests.cs`, and Task 2 state baselines verify empty/verified/failed visuals. |
+  | `HomePageViewDriftTests.cs` | `SnapshotComparisonServiceTests.cs` verifies changed/same/unavailable evidence. |
+  | `CompressedDriftPayloadTests.cs` | `SnapshotComparisonServiceTests.cs` and `SnapshotPayloadPreparationServiceTests.cs` retain compressed-payload evidence. |
+  | `HistoryPageViewTests.cs` | `AdvancedHistoryViewModelTests.cs` and `SnapshotEventCatalogTests.cs` cover event reading, filtering, pruning rules, and source parity. |
+  | `RestoreDialogOwnerTests.cs` | Rename and rewrite as `AppRestoreOwnerTests.cs`; Core unit tests prove opaque-owner forwarding plus missing-owner/missing-dialog outcomes, while WPF STA runtime tests verify a current WPF `Window` reaches the dialog. |
+  | `FontLoaderTests.cs` | Task 1 runtime tests and Task 2 baselines verify packaged IBM Plex Mono; normal UI uses Segoe UI Variable. |
+  | `AppRestoreDialogTests.cs` / `ModuleShapeTests.cs` form calls | `AppRestoreService` tests retain parser, source, winget outcome, and failure wording; replace `RestAppsForm.Describe` assertions with `AppRestoreService.RouteProblem`; WPF STA dialog tests retain ownership. |
+  | `BackupPresetsTests.cs`, `BackupFoldersReadTests.cs`, `ScopeGroupsPrivacyTests.cs`, and `ViewDataHelperTests.cs` | Retarget Application scope/preset/folder types and retain exact membership literals, source ordering, and privacy exclusions. |
+
+  `GitHub.cs`/`Stargazers` has no consumers; remove it without replacement. Do not preserve a `MainForm`, `RestAppsForm`, `RestoreConfirmForm`, `NavigationService`, `RichTextBoxLogSink`, `ProgressLogSink`, `MessageBoxIcon`, or `IWin32Window` compatibility alias. The pre-existing Core `object DialogOwner`/`RestoreDialog` seam is not a compatibility alias and must remain opaque to Application.
+
+- [ ] **Step 7: Retarget the surviving version, summary, declaration, and test-assembly assertions**
+
+  Replace direct `MainForm`/`Program` references in version tests with the final WPF assembly and the Foundation `VersionInfo` normalizer. Preserve all three-part and malformed-input assertions.
+
+  ```csharp
+  Assembly shipping = typeof(global::WinRestoreKit.Wpf.App).Assembly;
+  string compiled = shipping
+      .GetCustomAttribute<AssemblyFileVersionAttribute>()
+      .Version;
+  string parsed = global::DataHelper.Data.ParseLatestVersion(RealAssemblyInfoText());
+
+  Assert.Equal(parsed, compiled);
+  Assert.Equal("1.2.3", VersionInfo.Normalize("  1.2.3+build  "));
+  ```
+
+  In `RunSummaryTests.cs`, replace each `MessageBoxIcon` expectation with neutral severity:
+
+  ```csharp
+  Assert.Equal(RunSeverity.Warning, summary.Severity);
+  ```
+
+  In `RestoreDeclarationTests.cs`, use `typeof(global::WinRestoreKit.Wpf.App).Assembly` as the app assembly to prove no concrete `BackupBase` module leaked into the shell. In `AssemblyInfo.cs`, remove mutable WinForms `Theme` state from the parallelism rationale and retain the disabled-parallelization attribute for real process-wide data/registry tests.
+
+- [ ] **Step 8: Run the post-removal build, complete test suite, and no-legacy-path checks**
+
+  Run:
+
+  ```powershell
+  dotnet build src\WinRestoreKit.sln -c Debug
+  dotnet test src\WinRestoreKit.sln -c Debug --no-build
+
+  $removed = @(
+    'src\WinRestoreKit\WinRestoreKit.csproj',
+    'src\WinRestoreKit\Program.cs',
+    'src\WinRestoreKit\MainForm.cs',
+    'src\WinRestoreKit\Views',
+    'src\WinRestoreKit\Forms',
+    'src\WinRestoreKit\Controls',
+    'src\WinRestoreKit\Helpers',
+    'src\WinRestoreKit\Orchestration',
+    'src\WinRestoreKit\Results'
+  ) | Where-Object { Test-Path $_ }
+  if ($removed) { throw "Obsolete WinForms paths remain: $($removed -join ', ')" }
+
+  $forms = git grep -n 'System\.Windows\.Forms' -- 'src/**/*.cs' 'src/**/*.csproj'
+  if ($forms) { throw "WinForms source references remain:`n$forms" }
+
+  $obsoleteShell = git grep -nE 'MainForm|RestoreConfirmForm|RestAppsForm|NavigationService|RichTextBoxLogSink|ProgressLogSink|MessageBoxIcon|LogHelperTargetExtensions|SetTarget\(' -- 'src/**/*.cs' 'src/**/*.csproj'
+  if ($obsoleteShell) { throw "Obsolete shell references remain:`n$obsoleteShell" }
+
+  $legacyViews = git grep -nE '^[[:space:]]*(using[[:space:]]+Views;|namespace[[:space:]]+Views([[:space:]]|\{))' -- 'src/**/*.cs'
+  if ($legacyViews) { throw "Removed legacy Views namespace references remain:`n$legacyViews" }
+
+  $typedOwners = git grep -n 'IWin32Window' -- 'src/WinRestoreKit.Application/**/*.cs' 'src/WinRestoreKit.Wpf/**/*.cs' 'src/WinRestoreKit.Tests/**/*.cs'
+  if ($typedOwners) { throw "Typed WinForms dialog owners remain outside historical Core comments:`n$typedOwners" }
+  ```
+
+  Expected: build succeeds, all Core/Application/WPF tests pass with `Failed: 0`, every removed path is absent, and the searches return no source hits. Historical docs may mention WinForms, but shipping source, project files, and tests may not.
+
+- [ ] **Step 9: Commit the single green atomic cutover**
+
+  ```powershell
+  git add -A src\WinRestoreKit src\WinRestoreKit.Application src\WinRestoreKit.Wpf src\WinRestoreKit.Tests src\WinRestoreKit.sln
+  git commit -m "refactor: make WPF the WinRestoreKit app"
+  ```
+### Task 4: Update active release documentation and prove the final self-contained WPF executable
+
+**Files:**
+- Modify: `CLAUDE.md`
+- Modify: `README.md`
+- Modify: `.claude/skills/release/SKILL.md`
+- Modify: `.claude/agents/windows-safety-reviewer.md`
+- Modify: `CHANGELOG.md`
+- Create: `docs/superpowers/verification/2026-08-09-wpf-release.md`
+- Test: `src/WinRestoreKit.Tests/ShippingIdentityTests.cs`
+- Test: `src/WinRestoreKit.Tests/VersionParsingTests.cs`
+- Test: `src/WinRestoreKit.Tests/RebrandIdentityTests.cs`
+
+**Interfaces:**
+- Consumes: final WPF project `src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj`, the preserved raw fallback source, Foundation `VersionInfo`/`UpdateCheckService`, Core `Data.DataRootDir`, the final `App` assembly, manifest/icon/font resources, and the project-local `/release` procedure.
+- Produces: active build/release guidance that names WPF, a verified self-contained one-file executable, recorded manifest/resource/data-root/version evidence, and a release procedure that cannot target the removed project.
+
+- [ ] **Step 1: Write the failing documentation and artifact target check**
+
+  Before editing active docs, search them for the removed publish target:
+
+  ```powershell
+  git grep -nE 'src[\\/]WinRestoreKit[\\/]WinRestoreKit\.csproj|UseWindowsForms|Windows Forms desktop app' -- README.md CLAUDE.md .claude\skills\release\SKILL.md .claude\agents\windows-safety-reviewer.md
+  ```
+
+  Expected: this command returns active legacy references. Preserve historical changelog/design records as history; update only current instructions and the new changelog entry for this release.
+
+  Create `docs/superpowers/verification/2026-08-09-wpf-release.md` now with these fixed headings: `Build and tests`, `Publish directory`, `Embedded manifest`, `Clean-desktop executable smoke`, `Version coherence`, `GitHub Release`, and `Result`. Under each heading, record only the command, actual output, artifact SHA-256, screenshot-independent desktop observation, or remote value that proves its result. Leave the file uncommitted until Step 10 because it must describe the real released artifact, not a planned one.
+
+- [ ] **Step 2: Update the active project and release documentation to target WPF**
+
+  Make these exact documentation changes:
+
+  - `CLAUDE.md`: describe `WinRestoreKit.Wpf` as the only shipping app, `WinRestoreKit.Application` as framework-neutral shared orchestration, `WinRestoreKit.Core` as engine, and `WinRestoreKit.Tests` as xUnit. State that the raw fallback source physically remains `src/WinRestoreKit/Properties/AssemblyInfo.cs` and is linked by WPF. Replace WinForms output paths with `src\WinRestoreKit.Wpf\bin\Debug\net8.0-windows\` and `src\WinRestoreKit.Wpf\bin\Release\net8.0-windows\`. Explain WPF dispatcher/dialog/log adapters and retain the no-trimming, manifest, and one-file requirements.
+  - `README.md`: retain the build/test commands but replace the publish project path with the WPF project path shown below.
+  - `.claude/skills/release/SKILL.md`: retain the three-way version invariant, raw fallback URL, three-part format, PR/approval/tag/release order, and one-file flags; replace every old project publish path and WinForms-only trimming rationale with the final WPF project and its XAML/resource/runtime loading rationale.
+  - `.claude/agents/windows-safety-reviewer.md`: describe the WPF shell and Application layer while retaining the elevation, registry, process-kill, overwrite, and safety-review scope.
+  - `CHANGELOG.md`: add the approved WPF cutover release entry only when the release version is selected; describe the clean removal of WinForms and preserved backup compatibility without claiming a reboot requirement.
+
+  The publish command must be byte-for-byte identical in README and the release skill:
+
+  ```bat
+  dotnet publish src\WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj -c Release -r win-x64 --self-contained true ^
+    -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true ^
+    -p:EnableCompressionInSingleFile=true -p:DebugType=none -o publish
+  ```
+
+  Commit these active, version-independent instructions before opening a release branch. Do not stage `CHANGELOG.md` or the post-publication verification record in this commit.
+
+  ```powershell
+  git add CLAUDE.md README.md .claude\skills\release\SKILL.md .claude\agents\windows-safety-reviewer.md
+  git commit -m "docs: target release workflow at WPF shell"
+  ```
+
+- [ ] **Step 3: Run the final Release build, full test suite, and exact single-file publish**
+
+  Run:
+
+  ```powershell
+  dotnet build src\WinRestoreKit.sln -c Release
+  dotnet test src\WinRestoreKit.sln -c Release --no-build
+  Remove-Item -Recurse -Force publish -ErrorAction SilentlyContinue
+  dotnet publish src\WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true -p:EnableCompressionInSingleFile=true -p:DebugType=none -o publish
+  ```
+
+  Expected: Release build succeeds, tests report `Failed: 0`, and publish succeeds without setting `PublishTrimmed`.
+
+- [ ] **Step 4: Prove that publish contains exactly one realistic-size executable**
+
+  Run:
+
+  ```powershell
+  $files = @(Get-ChildItem .\publish -File)
+  if ($files.Count -ne 1 -or $files[0].Name -ne 'WinRestoreKit.exe') {
+      throw "Expected exactly one publish artifact named WinRestoreKit.exe; found: $($files.Name -join ', ')"
+  }
+  $sizeMiB = [math]::Round($files[0].Length / 1MB, 1)
+  if ($sizeMiB -lt 60 -or $sizeMiB -gt 90) {
+      throw "Expected a compressed self-contained WPF executable near 69 MiB; got $sizeMiB MiB."
+  }
+  Get-FileHash .\publish\WinRestoreKit.exe -Algorithm SHA256
+  ```
+
+  Expected: one `WinRestoreKit.exe`, approximately 69 MiB, no loose WPF native DLLs, and a recorded SHA-256. Do not put an extracted manifest or any verification file in `publish`; that would invalidate the one-file assertion.
+
+- [ ] **Step 5: Extract the embedded manifest and verify elevated/long-path behavior**
+
+  Run:
+
+  ```powershell
+  New-Item -ItemType Directory -Force release-verification | Out-Null
+  cmd /c "mt.exe -inputresource:publish\WinRestoreKit.exe;#1 -out:release-verification\WinRestoreKit.manifest.xml"
+  Select-String -Path release-verification\WinRestoreKit.manifest.xml -Pattern 'requestedExecutionLevel level="highestAvailable" uiAccess="false"','<longPathAware[^>]*>true</longPathAware>'
+  ```
+
+  Expected: `mt.exe` writes the extracted manifest outside `publish`, and both requested strings are found. The executable remains the only file in `publish`.
+
+- [ ] **Step 6: Verify real published-executable behavior on a clean Windows desktop or disposable equivalent**
+
+  Copy only `publish\WinRestoreKit.exe` to a clean disposable folder and launch it from a different current working directory:
+
+  ```powershell
+  $smokeRoot = Join-Path $env:TEMP 'WinRestoreKit-WpfReleaseSmoke'
+  Remove-Item -Recurse -Force $smokeRoot -ErrorAction SilentlyContinue
+  New-Item -ItemType Directory -Force $smokeRoot, "$smokeRoot\working" | Out-Null
+  Copy-Item .\publish\WinRestoreKit.exe "$smokeRoot\WinRestoreKit.exe"
+  $process = Start-Process "$smokeRoot\WinRestoreKit.exe" -WorkingDirectory "$smokeRoot\working" -PassThru
+  ```
+
+  On the clean desktop, verify and record all of these before closing the process:
+
+  | Check | Required evidence |
+  | --- | --- |
+  | Single-file startup | The copied exe opens without a .NET Desktop Runtime installation and without adjacent DLLs. |
+  | Elevated manifest behavior | UAC/highest-available behavior is observed on the disposable account and Task Manager shows the expected elevated state when the account can elevate. |
+  | Icon and title bar | Explorer, taskbar, and title bar display `WinRestoreKit.ico` and the WPF theme applies correctly. |
+  | Fonts | Normal UI uses Segoe UI Variable; a technical/log surface uses the packaged IBM Plex Mono face; no legacy Barlow face is required. |
+  | Data-root resolution | Create one disposable snapshot through the published UI. The new `app` data is beside `$smokeRoot\WinRestoreKit.exe`, never under `$smokeRoot\working`; Timeline can read it after restart. |
+  | WPF workflow | Startup, Timeline, Compare, Confirm cancellation, Settings theme switch, About, and an owner-bound dialog work from the published artifact. |
+
+  Stop the disposable process after recording the evidence:
+
+  ```powershell
+  Stop-Process -Id $process.Id
+  ```
+
+  Expected: no crash, no missing native resource, no framework-runtime prompt, and no data root created in the unrelated working directory.
+
+- [ ] **Step 7: Verify update-version coherence against the actual artifact and release inputs**
+
+  Read the raw source, normalize the Windows file-version resource to three parts, and compare it to the update fallback parser:
+
+  ```powershell
+  $source = Get-Content src\WinRestoreKit\Properties\AssemblyInfo.cs -Raw
+  $match = [regex]::Match($source, '\[assembly: AssemblyFileVersion\("(?<v>\d+\.\d+\.\d+)"\)\]')
+  if (-not $match.Success) { throw 'The raw AssemblyFileVersion line is missing or malformed.' }
+  $sourceVersion = $match.Groups['v'].Value
+  $resourceVersion = [Diagnostics.FileVersionInfo]::GetVersionInfo((Resolve-Path .\publish\WinRestoreKit.exe)).FileVersion
+  $parsedResource = [version]$resourceVersion
+  $artifactVersion = "$($parsedResource.Major).$($parsedResource.Minor).$($parsedResource.Build)"
+  if ($sourceVersion -ne $artifactVersion) {
+      throw "Artifact version $artifactVersion does not match raw fallback version $sourceVersion."
+  }
+  Write-Host "Version coherence preflight passed: $sourceVersion"
+  ```
+
+  Expected: the script prints the same three-part version embedded in the artifact and in the raw fallback source. `ShippingIdentityTests`, `VersionParsingTests`, and `RebrandIdentityTests` must already have passed before this release-only check.
+
+- [ ] **Step 8: Execute the tag and GitHub Release only after explicit release approval**
+
+  This step has external effects. First verify the working tree is clean and the release starts from current `main`; then obtain the approver's explicit release version and confirmation:
+
+  ```powershell
+  git checkout main
+  git pull
+  if (git status --porcelain) { throw "Release work requires a clean working tree." }
+  $version = Read-Host "Enter the explicitly approved three-part release version"
+  if ($version -notmatch '^\d+\.\d+\.\d+$') {
+      throw "Release version must have exactly three numeric parts."
+  }
+  $approval = Read-Host "Type RELEASE $version to authorize the release branch, tag, and GitHub Release"
+  if ($approval -cne "RELEASE $version") {
+      throw "Release approval was not supplied."
+  }
+  ```
+
+  Create the release branch, change only the two hand-maintained version attributes to `$version`, add the dated changelog heading, and rerun Steps 3 through 7 against the bumped artifact:
+
+  ```powershell
+  git checkout -b ("release/" + $version)
+  $assemblyInfo = 'src\WinRestoreKit\Properties\AssemblyInfo.cs'
+  $text = Get-Content $assemblyInfo -Raw
+  $text = [regex]::Replace($text,
+      '\[assembly: AssemblyVersion\("\d+\.\d+\.\d+"\)\]',
+      ('[assembly: AssemblyVersion("{0}")]' -f $version))
+  $text = [regex]::Replace($text,
+      '\[assembly: AssemblyFileVersion\("\d+\.\d+\.\d+"\)\]',
+      ('[assembly: AssemblyFileVersion("{0}")]' -f $version))
+  Set-Content -Path $assemblyInfo -Value $text -NoNewline -Encoding utf8
+  git diff -- src\WinRestoreKit\Properties\AssemblyInfo.cs
+  ```
+
+  Expected diff: only `AssemblyVersion` and `AssemblyFileVersion` change to the same three-part `$version`, and the raw `AssemblyFileVersion` line keeps its exact bracket/quote format. Add the dated `$version` release heading to `CHANGELOG.md`, then commit and open a PR:
+
+  ```powershell
+  git add src\WinRestoreKit\Properties\AssemblyInfo.cs CHANGELOG.md
+  git commit -m ("release: " + $version)
+  git push -u origin ("release/" + $version)
+  ```
+
+  Stop for PR review. Only after the PR is approved and merged to `main`, recreate and re-verify the final publish artifact from merged `main` before making a tag:
+
+  ```powershell
+  git checkout main
+  git pull
+  Remove-Item -Recurse -Force publish -ErrorAction SilentlyContinue
+  dotnet build src\WinRestoreKit.sln -c Release
+  dotnet test src\WinRestoreKit.sln -c Release --no-build
+  dotnet publish src\WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true -p:EnableCompressionInSingleFile=true -p:DebugType=none -o publish
+  ```
+
+  Rerun the exact single-file (Step 4), extracted-manifest (Step 5), clean-desktop (Step 6), and artifact-version (Step 7) checks against this merged-main output. Do not create the tag if any of those checks fails. Then validate `HEAD` before tagging and validate the tag after creation:
+
+  ```powershell
+  $headAssemblyInfo = git show 'HEAD:src/WinRestoreKit/Properties/AssemblyInfo.cs'
+  $headMatch = [regex]::Match($headAssemblyInfo,
+      '\[assembly: AssemblyFileVersion\("(?<v>\d+\.\d+\.\d+)"\)\]')
+  if (-not $headMatch.Success -or $headMatch.Groups['v'].Value -ne $version) {
+      throw "Merged main does not contain the approved AssemblyFileVersion $version."
+  }
+  $headCommit = (git rev-parse HEAD).Trim()
+  git tag $version
+  $tagCommit = (git rev-parse ($version + '^{commit}')).Trim()
+  if ($tagCommit -ne $headCommit) {
+      throw "The new tag does not point at the verified merged-main commit."
+  }
+  git push origin $version
+  gh release create $version publish\WinRestoreKit.exe --title ("WinRestoreKit " + $version) --generate-notes
+  ```
+
+  Expected: the tagged file contains the exact same three-part `AssemblyFileVersion`, and the GitHub Release attaches only `WinRestoreKit.exe`. Never attach `bin\Release\net8.0-windows\WinRestoreKit.exe`.
+- [ ] **Step 9: Perform the post-publication remote checks and record release evidence**
+
+  Run after the release is published and `main` contains the version bump:
+  ```powershell
+
+  $latest = Invoke-RestMethod 'https://api.github.com/repos/nicolasestrem/WinRestoreKit/releases/latest' -Headers @{ 'User-Agent' = 'WinRestoreKit-release-verification' }
+  $raw = Invoke-WebRequest 'https://raw.githubusercontent.com/nicolasestrem/WinRestoreKit/main/src/WinRestoreKit/Properties/AssemblyInfo.cs' -UseBasicParsing
+  $rawMatch = [regex]::Match($raw.Content,
+      '\[assembly: AssemblyFileVersion\("(?<v>\d+\.\d+\.\d+)"\)\]')
+  if (-not $rawMatch.Success) { throw 'Remote raw AssemblyFileVersion is missing or malformed.' }
+  $rawVersion = $rawMatch.Groups['v'].Value
+  if ($latest.tag_name -ne $rawVersion) {
+      throw "Latest release tag $($latest.tag_name) differs from raw source version $rawVersion."
+  }
+  $assets = @($latest.assets | Where-Object { $_.name -eq 'WinRestoreKit.exe' })
+  if ($assets.Count -ne 1 -or $latest.assets.Count -ne 1) {
+      throw "Latest release must contain exactly one WinRestoreKit.exe asset."
+  }
+  $downloaded = 'release-verification\WinRestoreKit.downloaded.exe'
+  Invoke-WebRequest $assets[0].browser_download_url -OutFile $downloaded -UseBasicParsing
+  $localHash = (Get-FileHash .\publish\WinRestoreKit.exe -Algorithm SHA256).Hash
+  $downloadedHash = (Get-FileHash $downloaded -Algorithm SHA256).Hash
+  if ($localHash -ne $downloadedHash) {
+      throw "Downloaded release hash $downloadedHash differs from verified local publish hash $localHash."
+  }
+  [pscustomobject]@{
+      ReleaseUrl = $latest.html_url
+      Tag = $latest.tag_name
+      RawVersion = $rawVersion
+      AssetSize = $assets[0].size
+      Sha256 = $downloadedHash
+  }
+  ```
+
+- [ ] **Step 10: Commit post-publication release evidence**
+
+  ```powershell
+  git add docs\superpowers\verification\2026-08-09-wpf-release.md
+  git commit -m "docs: record WPF release verification"
+  ```
+
+### Task 5: Perform the final regression and safety review before declaring the migration complete
+
+**Files:**
+- Modify: `docs/superpowers/verification/2026-08-09-wpf-cutover.md`
+- Modify: `docs/superpowers/verification/2026-08-09-wpf-release.md`
+- Test: `src/WinRestoreKit.Tests/ShippingIdentityTests.cs`
+- Test: `src/WinRestoreKit.Tests/SnapshotEventCatalogTests.cs`
+- Test: `src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs`
+- Test: `src/WinRestoreKit.Tests/RestoreSetViewModelTests.cs`
+- Test: `src/WinRestoreKit.Tests/ConfirmViewModelTests.cs`
+- Test: `src/WinRestoreKit.Tests/BackupDestinationLifecycleTests.cs`
+- Test: `src/WinRestoreKit.Tests/BackupManifestTests.cs`
+- Test: `src/WinRestoreKit.Tests/RestorePlanTests.cs`
+- Test: `src/WinRestoreKit.Tests/SnapshotGateConsentTests.cs`
+- Test: `src/WinRestoreKit.Tests/ExplorerRestartPromptTests.cs`
+
+**Interfaces:**
+- Consumes: all final Application/Core/WPF contracts and Task 2/Task 4 evidence.
+- Produces: a signed-off acceptance record with evidence that the WPF app is the sole shipping app, no Core safety rule regressed, no legacy path remains, and the release executable is runnable.
+
+- [ ] **Step 1: Run the final focused safety and migration regression suite**
+
+  Run:
+
+  ```powershell
+  dotnet build src\WinRestoreKit.sln -c Release
+  dotnet test src\WinRestoreKit.sln -c Release --no-build --filter "FullyQualifiedName~ShippingIdentityTests|FullyQualifiedName~SnapshotEventCatalogTests|FullyQualifiedName~SnapshotComparisonServiceTests|FullyQualifiedName~RestoreSetViewModelTests|FullyQualifiedName~ConfirmViewModelTests|FullyQualifiedName~BackupDestinationLifecycleTests|FullyQualifiedName~BackupManifestTests|FullyQualifiedName~RestorePlanTests|FullyQualifiedName~SnapshotGateConsentTests|FullyQualifiedName~ExplorerRestartPromptTests"
+  dotnet test src\WinRestoreKit.sln -c Release --no-build
+  ```
+
+  Expected: both selected and full suites report `Failed: 0`. Treat any failure as a regression until it is reproduced, fixed in its owning layer, and covered by the test that failed.
+
+- [ ] **Step 2: Review the final diff for prohibited layering and safety regressions**
+
+  Review the completed diff against these concrete questions:
+
+  | Review question | Required answer |
+  | --- | --- |
+  | Does any `WinRestoreKit.Application` source reference WPF or WinForms? | No. Application remains framework-neutral. |
+  | Does any WPF view/view model parse a `.reg`, manifest, or payload body? | No. It renders Application/Core models only. |
+  | Can Compare write to a snapshot or live system? | No. It uses read scopes and `HasDriftedFrom` evidence only. |
+  | Can Failed/Unreadable Timeline events restore or influence retention? | No. They remain diagnostic-only and session failures do not retain cleanup data. |
+  | Can a WPF restore bypass `RestorePlan`, `SnapshotGate`, `RestoreScope`, `RestoreDispatch`, incomplete-snapshot consent, or `ExplorerRestartPrompt`? | No. Confirm delegates to the existing Application orchestration path. |
+  | Does a user see an invented reboot requirement? | No. Only existing process, Explorer restart, and sign-out impacts render. |
+  | Is there an ownerless dialog or a WinForms owner seam? | No. WPF dialog services own modal windows. |
+  | Does any app identity/version path diverge? | No. Linked raw source, compiled WPF assembly, release tag, and GitHub Release use one normalized three-part version. |
+
+  Run the repository checks from Task 3 Step 8 again. In addition, verify Application does not import either UI framework:
+
+  ```powershell
+  $applicationUi = git grep -nE 'System\.Windows\.Forms|System\.Windows\.(Controls|Window|Application)' -- 'src/WinRestoreKit.Application/**/*.cs' 'src/WinRestoreKit.Application/**/*.csproj'
+  if ($applicationUi) { throw "Application layer references a UI framework:`n$applicationUi" }
+  ```
+
+  Expected: no output from the check.
+
+- [ ] **Step 3: Request the repository's Windows safety review for the final WPF restore/dialog diff**
+
+  Give `.claude/agents/windows-safety-reviewer.md` the final diff touching `src/WinRestoreKit.Application/`, `src/WinRestoreKit.Wpf/Services/WpfRunUi.cs`, WPF dialog views, restore view models, and release settings. Require evidence-backed findings only.
+
+  Expected: no unresolved finding that permits a registry import, process closure, profile overwrite, restore prompt bypass, ownerless dialog, silent failure, or unintended elevated browser launch. Record reviewer identity, reviewed commit, and disposition in `docs/superpowers/verification/2026-08-09-wpf-release.md`.
+
+- [ ] **Step 4: Record final acceptance evidence and commit it**
+
+  Add this checklist to both verification records and mark an item only with the command/output or desktop observation that proved it:
+
+  ```markdown
+  - [ ] WPF Timeline + Compare is the shipping home and restore workflow.
+  - [ ] All current workflows have a verified WPF equivalent.
+  - [ ] Existing snapshot gates and restore safety behavior remain enforced.
+  - [ ] Failed attempts are visible and non-restorable.
+  - [ ] Keyboard, UIA, reduced motion, themes, DPI, and narrow layout passed real-desktop verification.
+  - [ ] All required screenshot baselines were reviewed.
+  - [ ] Core, Application, WPF, and full solution tests passed.
+  - [ ] No obsolete WinForms project, source, resource, control, helper, test, or compatibility path remains.
+  - [ ] Publish contains exactly one self-contained `WinRestoreKit.exe`.
+  - [ ] The executable passed the clean Windows desktop smoke and update-version coherence checks.
+  ```
+
+  Commit the evidence-only final review:
+
+  ```powershell
+  git add docs\superpowers\verification\2026-08-09-wpf-cutover.md docs\superpowers\verification\2026-08-09-wpf-release.md
+  git commit -m "docs: complete WPF cutover regression review"
+  ```
+
+## Completion Criteria
+
+The migration is complete only when the real-desktop gate preceded WinForms deletion, the WPF project is the sole shipping `WinRestoreKit` app, `src/WinRestoreKit/Properties/AssemblyInfo.cs` remains the linked raw version source, all relevant Core/Application/WPF tests are green, the code tree contains no WinForms shell or compatibility artifacts, and the final publish directory contains exactly one verified self-contained `WinRestoreKit.exe` that ran successfully on a real Windows desktop.
diff --git a/docs/superpowers/plans/2026-08-09-wpf-foundation-application-shell.md b/docs/superpowers/plans/2026-08-09-wpf-foundation-application-shell.md
new file mode 100644
index 0000000..c051901
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-09-wpf-foundation-application-shell.md
@@ -0,0 +1,1454 @@
+# WPF Foundation Application Shell Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Introduce a framework-neutral shared application layer and a runnable side-by-side WPF shell whose only workspace is an honest, empty Timeline state, while preserving the runnable WinForms application and all Core backup/restore semantics.
+
+**Architecture:** `WinRestoreKit.Application` is a `net8.0-windows` class library because it consumes the Windows-targeted Core project, but it has neither `UseWindowsForms` nor `UseWPF` and contains no framework types. It owns shared orchestration, neutral result/UI contracts, registry-backed application settings, and update/version logic; framework projects use friend access instead of widening those migration-only types. `WinRestoreKit.Wpf` is an MVVM host that composes WPF dispatcher, dialog, log, theme, settings, About, and update adapters, then renders a real empty Timeline view without manufacturing snapshot data.
+
+**Tech Stack:** .NET 8 (`net8.0-windows`), C# 12-compatible SDK project settings, WPF/XAML, existing WinRestoreKit.Core, xUnit 2.9.3, Microsoft.Win32 registry APIs, `HttpClient`, `Microsoft.Win32.SystemEvents`.
+
+## Global Constraints
+
+- Preserve `WinRestoreKit.Core` backup/restore semantics, existing snapshot format, `RestorePlan`, `SnapshotGate`, `RestoreScope`, `RestoreDispatch`, `ExplorerRestartPrompt`, and every existing Core result/safety decision.
+- `WinRestoreKit.Application` targets `net8.0-windows` solely because Core does; it MUST contain no `System.Windows.Forms`, `System.Windows`, WPF XAML, WinForms/WPF project property, or UI-framework reference.
+- Keep namespace `WinRestoreKit` for all Application contracts moved from the app; Application exposes internals to the still-runnable `WinRestoreKit` WinForms assembly, `WinRestoreKit.Wpf`, and `WinRestoreKit.Tests` with its own assembly-level `InternalsVisibleTo` attributes.
+- Keep the WinForms project runnable throughout this plan. It continues to reference Core directly for its existing internal Core consumers and additionally references Application for moved app-layer types.
+- Replace `RunSummary.Icon : MessageBoxIcon` with `RunSummary.Severity : RunSeverity`; `RunSeverity` values are exactly `Information`, `Warning`, and `Error`.
+- Replace the WinForms-typed `IRunUi.Owner` with framework-neutral `object DialogOwner { get; }`. No WinForms or WPF type crosses Application; each shell supplies its current native dialog owner as an opaque object.
+- Preserve Core `AppStoreApps.RestoreDialog : Action<string, object>` and the exact existing AppStore restore outcome semantics. The moved orchestrator calls `await appStoreApps.RestoreAsync(currentRestorePath, ui.DialogOwner)`; do not introduce a new restore-dialog callback or fallback result path.
+- The WPF shell has no permanent rail, dashboard cards, fake timeline entries, comparison data, restore selection, backup-selection view, progress view, or cutover deletion in this plan.
+- Use exactly the new user-facing theme labels **Follow system**, **Light**, and **Dark**. Store the WPF preference as a DWORD `ThemeMode` under `HKCU\Software\WinRestoreKit`; do not reuse the WinForms-only `PaletteMode` setting.
+- WPF visual resources use neutral Windows surfaces, mineral-blue actions, restrained coral warnings, Segoe UI Variable interface text, and the linked packaged `IBMPlexMono-Regular.ttf` only for technical/log styles. State is conveyed by text/icon as well as color.
+- The side-by-side WPF project has assembly/executable identity `WinRestoreKit.Wpf`. It links the existing `app.manifest` and `WinRestoreKit.ico`, preserving `highestAvailable` and `longPathAware`, but does **not** compile the existing `Properties/AssemblyInfo.cs` and does **not** set `GenerateAssemblyInfo=false`.
+- Preserve the final publish contract in WPF project properties: self-contained `win-x64`, single-file, native-library self-extract, compression, and `PublishTrimmed=false`. The later cutover plan changes the WPF identity to `WinRestoreKit` and links the existing AssemblyInfo source at its exact physical path.
+- `src/WinRestoreKit/Properties/AssemblyInfo.cs` remains at that exact path and retains the exact three-part `[assembly: AssemblyFileVersion("x.y.z")]` source consumed by the GitHub raw fallback. Do not set competing version properties or attributes in any project.
+- Tests remain in `src/WinRestoreKit.Tests`. Preserve pure existing tests; retain WinForms construction tests while WinForms exists; add an STA helper before constructing WPF runtime objects.
+- Every code change below follows a red → green cycle. Run only the named focused test/build command at each step; do not run formatters, linters, or broad test suites as part of this foundation plan.
+
+---
+
+## File Structure and Ownership
+
+| Path | Responsibility |
+| --- | --- |
+| `src/WinRestoreKit.Application/WinRestoreKit.Application.csproj` | Framework-neutral shared application library; references Core and grants friends access to WPF/tests. |
+| `src/WinRestoreKit.Application/Properties/AssemblyInfo.cs` | Application-only friend declarations for WPF and tests. |
+| `src/WinRestoreKit.Application/Orchestration/{IRunUi,RunCoordinator,RunControl,BackupRestoreOrchestrator}.cs` | Moved orchestration and neutral interaction surface. `BackupRestoreOrchestrator.cs` also retains `ProgressMetricValues` and `ProgressMetrics`. |
+| `src/WinRestoreKit.Application/Results/RunSummary.cs` | Moved run grammar/state/summary and neutral severity. |
+| `src/WinRestoreKit.Application/Settings/{BackupRootRegistry,ThemeMode,IThemeSettings,RegistryThemeSettings}.cs` | Registry-backed custom-root and theme-preference contracts, without UI framework types. |
+| `src/WinRestoreKit.Application/Updates/{VersionInfo,UpdateVerdict,UpdateCheckResult,IUpdateCheckService,UpdateCheckService}.cs` | Version normalization and GitHub-release/raw-AssemblyInfo update decision/fetch service without dialog code. |
+| `src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj` | Side-by-side WPF app configuration, linked manifest/icon/font, final publish properties, Application/Core references. |
+| `src/WinRestoreKit.Wpf/{App.xaml,App.xaml.cs,MainWindow.xaml,MainWindow.xaml.cs}` | WPF resources, startup composition, and top-level content host. |
+| `src/WinRestoreKit.Wpf/Infrastructure/{ObservableObject,DelegateCommand}.cs` | Minimal dependency-free MVVM notifications and commands. |
+| `src/WinRestoreKit.Wpf/ViewModels/{ShellViewModel,TimelineWorkspaceViewModel,SettingsViewModel,AboutViewModel}.cs` | Shell navigation and state; the Timeline VM models only the actual empty state. |
+| `src/WinRestoreKit.Wpf/Views/{TimelineWorkspaceView,SettingsView,AboutView}.xaml` and code-behind | Declarative, framework-owned presentation with no registry/payload parsing. |
+| `src/WinRestoreKit.Wpf/Themes/{Controls,Light,Dark}.xaml` | Dynamic resource keys and the approved Light/Dark token dictionaries. |
+| `src/WinRestoreKit.Wpf/Services/{ISystemThemeDetector,WindowsThemeDetector,IThemeService,WpfThemeService,IWpfDialogService,WpfDialogService,IExternalLinkService,ExternalLinkService,WpfUpdatePresenter,IRunPresentation,IRunDialogService,WpfDispatcher,WpfRunUi,WpfLogSink}.cs` | Shell-owned dispatcher/dialog/log/theme/update adapters. The run interfaces are ready for later workflow views but no workflow is rendered in this plan. |
+| `src/WinRestoreKit/Orchestration/*`, `src/WinRestoreKit/Results/RunSummary.cs`, `src/WinRestoreKit/Helpers/{BackupRootRegistry,UpdateCheck}.cs` | Deleted after their contents move to Application; no forwarding copies remain. |
+| `src/WinRestoreKit/{WinRestoreKit.csproj,Program.cs,Views/ProgressPageView.cs,Views/AboutPageView.cs,Helpers/WinFormsUpdatePresenter.cs}` | Existing shell rebuilt against Application, preserving modal WinForms ownership and startup behavior. |
+| `src/WinRestoreKit.Core/WinRestoreKit.Core.csproj` | Adds Application and WPF as internal friends without changing Core type access levels. |
+| `src/WinRestoreKit.Tests/{WinRestoreKit.Tests.csproj,AssemblyInfo.cs,WpfTestHost.cs,ApplicationBoundaryTests.cs,RunSummaryTests.cs,RunCoordinatorTests.cs,RunControlTests.cs,ThemeSettingsTests.cs,ThemeServiceTests.cs,VersionParsingTests.cs,UpdateCheckVerdictTests.cs,WpfShellTests.cs}` | Existing tests migrated to moved symbols plus focused new Application/WPF tests and STA construction helper. |
+| `src/WinRestoreKit.sln` | Adds Application and WPF projects without removing WinForms, Core, or Tests. |
+
+## Definitive Interfaces Produced by This Plan
+
+These signatures are the integration boundary for the Timeline, Compare/Confirm, Backup/Progress, and Cutover plans.
+
+```csharp
+// src/WinRestoreKit.Application/Orchestration/IRunUi.cs
+namespace WinRestoreKit;
+
+internal interface IRunUi
+{
+    void SetProgressText(string text);
+    void SetProgressPercent(int percent);
+    void SetProgressDetail(string groupInfo, string elapsed, string remaining, string throughput,
+                           long bytesWritten, int errors, int warnings);
+    void ShowSummary(RunSummary summary, string caption, IReadOnlyList<ModuleOutcome> outcomes);
+    IReadOnlyList<string> ShowConsentDialog(RestorePlan plan);
+    object DialogOwner { get; }
+    bool ConfirmSnapshotOverride(string text, string caption);
+    void ShowPlanCompositionError(string text, string caption);
+    void SetExplorerRestartVisible(bool visible);
+}
+
+// src/WinRestoreKit.Application/Orchestration/BackupRestoreOrchestrator.cs
+namespace WinRestoreKit;
+
+internal sealed class BackupRestoreOrchestrator
+{
+    internal BackupRestoreOrchestrator(IRunUi ui, RunControl runControl = null);
+    internal Task RunBackup(IReadOnlyList<BackupBase> modules, string destination,
+                            string snapshotName, SnapshotCompression compression);
+    internal Task RunRestore(IReadOnlyList<BackupBase> modules, string backupPath);
+}
+
+// src/WinRestoreKit.Application/Results/RunSummary.cs
+namespace WinRestoreKit;
+
+internal enum RunSeverity { Information, Warning, Error }
+
+internal sealed class RunSummary
+{
+    public RunState State { get; private set; }
+    public string Headline { get; private set; }
+    public string Detail { get; private set; }
+    public RunSeverity Severity { get; }
+    internal static RunSummary For(IReadOnlyList<ModuleOutcome> outcomes, bool ran, RunVerb verb,
+                                   string because = null);
+    internal static RunSummary Incomplete(IReadOnlyList<ModuleOutcome> outcomes, RunVerb verb,
+                                          string detail);
+    internal static RunSummary Canceled(RunVerb verb);
+}
+
+// src/WinRestoreKit.Application/Settings/ThemeMode.cs
+namespace WinRestoreKit;
+
+internal enum ThemeMode { FollowSystem = 0, Light = 1, Dark = 2 }
+
+internal interface IThemeSettings
+{
+    ThemeMode ReadThemeMode();
+    void WriteThemeMode(ThemeMode mode);
+}
+
+// src/WinRestoreKit.Application/Updates/IUpdateCheckService.cs
+namespace WinRestoreKit;
+
+internal interface IUpdateCheckService
+{
+    Task<UpdateCheckResult> CheckAsync(string currentVersion, CancellationToken cancellationToken);
+}
+```
+
+```csharp
+// src/WinRestoreKit.Wpf/Services/WpfRunUi.cs
+namespace WinRestoreKit.Wpf.Services;
+
+internal sealed class WpfRunUi : IRunUi
+{
+    internal WpfRunUi(Dispatcher dispatcher, IRunPresentation presentation,
+                      IRunDialogService dialogs, Func<Window> ownerProvider);
+    object IRunUi.DialogOwner { get; }
+}
+
+// src/WinRestoreKit.Wpf/Services/IRunPresentation.cs
+internal interface IRunPresentation
+{
+    void SetProgressText(string text);
+    void SetProgressPercent(int percent);
+    void SetProgressDetail(string groupInfo, string elapsed, string remaining, string throughput,
+                           long bytesWritten, int errors, int warnings);
+    void ShowSummary(RunSummary summary, string caption, IReadOnlyList<ModuleOutcome> outcomes);
+    void SetExplorerRestartVisible(bool visible);
+}
+
+// src/WinRestoreKit.Wpf/Services/IRunDialogService.cs
+internal interface IRunDialogService
+{
+    IReadOnlyList<string> ShowRestoreConsent(RestorePlan plan);
+    bool ConfirmSnapshotOverride(string text, string caption);
+    void ShowPlanCompositionError(string text, string caption);
+}
+
+// src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs
+internal sealed class ShellViewModel : ObservableObject
+{
+    internal ShellViewModel(IThemeService themes, WpfUpdatePresenter updates,
+                            string currentVersion);
+    public object CurrentWorkspace { get; private set; }
+    public string WorkflowLabel { get; private set; }
+    public ICommand ShowTimelineCommand { get; }
+    public ICommand ShowSettingsCommand { get; }
+    public ICommand ShowAboutCommand { get; }
+    internal void ShowTimeline();
+    internal void NavigateTo(object workspace, string workflowLabel);
+}
+```
+
+`WpfRunUi` is not composed by the empty-shell startup; later real Backup/Progress and Compare/Confirm workspaces provide concrete `IRunPresentation` and `IRunDialogService` implementations. This is an adapter boundary, not a visible unfinished workflow.
+
+### Task 1: Add the application/WPF build topology and test access boundaries
+
+**Files:**
+- Create: `src/WinRestoreKit.Application/WinRestoreKit.Application.csproj`
+- Create: `src/WinRestoreKit.Application/Properties/AssemblyInfo.cs`
+- Create: `src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj`
+- Create: `src/WinRestoreKit.Wpf/App.xaml`
+- Create: `src/WinRestoreKit.Wpf/App.xaml.cs`
+- Create: `src/WinRestoreKit.Wpf/Properties/AssemblyInfo.cs`
+- Create: `src/WinRestoreKit.Tests/ApplicationBoundaryTests.cs`
+- Modify: `src/WinRestoreKit.Core/WinRestoreKit.Core.csproj:36-46`
+- Modify: `src/WinRestoreKit/WinRestoreKit.csproj:38-49`
+- Modify: `src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj:3-41`
+- Modify: `src/WinRestoreKit.sln`
+
+**Interfaces:**
+- Consumes: Existing `WinRestoreKit.Core` net8.0-windows target, its `WinRestoreKit`/`WinRestoreKit.Tests` internal friends, the existing manifest/icon, and the existing hand-maintained AssemblyInfo source.
+- Produces: Application and WPF projects in the solution; Core grants internals to `WinRestoreKit.Application` and `WinRestoreKit.Wpf`; Application grants internals to WinForms, WPF, and tests; Tests can reference Application/WPF and will receive the STA helper in Task 3.
+
+- [ ] **Step 1: Add empty project files and solution entries before adding behavior.**
+
+Create the two project files and use the SDK to add both to the existing solution. The Application project must target Windows only to match Core; it must not set either UI framework property. The WPF app has a temporary distinct assembly identity, links the existing manifest/icon/font, and includes the release properties without taking ownership of the version source.
+
+```xml
+<!-- src/WinRestoreKit.Application/WinRestoreKit.Application.csproj -->
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0-windows</TargetFramework>
+    <RootNamespace>WinRestoreKit</RootNamespace>
+    <AssemblyName>WinRestoreKit.Application</AssemblyName>
+    <Nullable>disable</Nullable>
+    <ImplicitUsings>disable</ImplicitUsings>
+    <Platforms>AnyCPU</Platforms>
+    <Deterministic>true</Deterministic>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\WinRestoreKit.Core\WinRestoreKit.Core.csproj" />
+  </ItemGroup>
+</Project>
+
+<!-- src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj -->
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>WinExe</OutputType>
+    <TargetFramework>net8.0-windows</TargetFramework>
+    <UseWPF>true</UseWPF>
+    <RootNamespace>WinRestoreKit.Wpf</RootNamespace>
+    <AssemblyName>WinRestoreKit.Wpf</AssemblyName>
+    <ApplicationManifest>..\WinRestoreKit\app.manifest</ApplicationManifest>
+    <ApplicationIcon>..\WinRestoreKit\WinRestoreKit.ico</ApplicationIcon>
+    <RuntimeIdentifier>win-x64</RuntimeIdentifier>
+    <SelfContained>true</SelfContained>
+    <PublishSingleFile>true</PublishSingleFile>
+    <IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract>
+    <EnableCompressionInSingleFile>true</EnableCompressionInSingleFile>
+    <PublishTrimmed>false</PublishTrimmed>
+    <Nullable>disable</Nullable>
+    <ImplicitUsings>disable</ImplicitUsings>
+    <Platforms>AnyCPU</Platforms>
+    <Deterministic>true</Deterministic>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\WinRestoreKit.Application\WinRestoreKit.Application.csproj" />
+    <ProjectReference Include="..\WinRestoreKit.Core\WinRestoreKit.Core.csproj" />
+    <Resource Include="..\WinRestoreKit\Fonts\IBMPlexMono-Regular.ttf" Link="Fonts\IBMPlexMono-Regular.ttf" />
+  </ItemGroup>
+</Project>
+```
+
+Create the minimal WPF application definition now so the side-by-side project has a generated STA entry point and can build before Task 6 adds composition:
+
+```xml
+<!-- src/WinRestoreKit.Wpf/App.xaml -->
+<Application x:Class="WinRestoreKit.Wpf.App"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" />
+```
+
+```csharp
+// src/WinRestoreKit.Wpf/App.xaml.cs
+using System.Windows;
+
+namespace WinRestoreKit.Wpf;
+
+public partial class App : Application
+{
+}
+```
+
+Run:
+
+```powershell
+dotnet sln src\WinRestoreKit.sln add src\WinRestoreKit.Application\WinRestoreKit.Application.csproj src\WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj
+```
+
+Expected: both projects appear in `src\WinRestoreKit.sln`; neither project removes or retargets WinForms, Core, or Tests.
+
+- [ ] **Step 2: Write the failing project-boundary test.**
+
+Add a direct use of the Application `RunControl` type. Do not create that type until Task 2; this establishes that the test project references the new assembly before the moved code exists.
+
+```csharp
+// src/WinRestoreKit.Tests/ApplicationBoundaryTests.cs
+extern alias Application;
+
+using System.Linq;
+using ApplicationWinRestoreKit = Application::WinRestoreKit;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public class ApplicationBoundaryTests
+    {
+        [Fact]
+        public void ApplicationRunControl_IsAvailableWithoutConstructingAUiFrameworkObject()
+        {
+            using (ApplicationWinRestoreKit.RunControl control =
+                   new ApplicationWinRestoreKit.RunControl())
+            {
+                Assert.False(control.IsPaused);
+                Assert.False(control.IsCancellationRequested);
+            }
+        }
+    }
+}
+```
+
+Extend the test project now so this fails for the missing moved type rather than silently exercising the old app assembly:
+
+```xml
+<!-- Add to src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj -->
+<PropertyGroup>
+  <UseWindowsForms>true</UseWindowsForms>
+  <UseWPF>true</UseWPF>
+</PropertyGroup>
+<ItemGroup>
+  <ProjectReference Include="..\WinRestoreKit.Application\WinRestoreKit.Application.csproj">
+    <Aliases>global;Application</Aliases>
+  </ProjectReference>
+  <ProjectReference Include="..\WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj" />
+</ItemGroup>
+```
+
+Run:
+
+```powershell
+dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj --filter FullyQualifiedName~ApplicationBoundaryTests
+```
+
+Expected: FAIL at compile time because `RunControl` has not yet been created in `WinRestoreKit.Application`.
+
+- [ ] **Step 3: Establish all internal-friend and project-reference boundaries.**
+
+Add the Application and WPF friends to Core without changing Core type modifiers, add WinForms/WPF/tests as Application friends, and add Application as an additional reference from the still-runnable WinForms project. The test project retains its existing WinForms project reference because existing tests still construct the old shell during migration.
+
+```xml
+<!-- Add inside the existing ItemGroup in src/WinRestoreKit.Core/WinRestoreKit.Core.csproj -->
+<InternalsVisibleTo Include="WinRestoreKit.Application" />
+<InternalsVisibleTo Include="WinRestoreKit.Wpf" />
+
+<!-- Add inside src/WinRestoreKit/WinRestoreKit.csproj ItemGroup containing project references -->
+<ProjectReference Include="..\WinRestoreKit.Application\WinRestoreKit.Application.csproj" />
+```
+
+```csharp
+// src/WinRestoreKit.Application/Properties/AssemblyInfo.cs
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("WinRestoreKit")]
+[assembly: InternalsVisibleTo("WinRestoreKit.Wpf")]
+[assembly: InternalsVisibleTo("WinRestoreKit.Tests")]
+
+// src/WinRestoreKit.Wpf/Properties/AssemblyInfo.cs
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("WinRestoreKit.Tests")]
+```
+
+Do not add `GenerateAssemblyInfo=false` to either new project. Do not copy or link `src/WinRestoreKit/Properties/AssemblyInfo.cs` into WPF.
+
+- [ ] **Step 4: Run focused project topology verification.**
+
+Run:
+
+```powershell
+dotnet build src\WinRestoreKit.Application\WinRestoreKit.Application.csproj
+dotnet build src\WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj
+dotnet build src\WinRestoreKit\WinRestoreKit.csproj
+```
+
+Expected: the first command succeeds with an Application DLL that has no UI-framework project dependency; the second succeeds as `WinRestoreKit.Wpf`; the third succeeds as the existing `WinRestoreKit` WinForms executable. The focused test still fails only because Task 2 has not moved `RunControl`.
+
+- [ ] **Step 5: Commit the topology only.**
+
+```powershell
+git add src\WinRestoreKit.sln src\WinRestoreKit.Core\WinRestoreKit.Core.csproj src\WinRestoreKit\WinRestoreKit.csproj src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj src\WinRestoreKit.Tests\ApplicationBoundaryTests.cs src\WinRestoreKit.Application\WinRestoreKit.Application.csproj src\WinRestoreKit.Application\Properties\AssemblyInfo.cs src\WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj src\WinRestoreKit.Wpf\App.xaml src\WinRestoreKit.Wpf\App.xaml.cs src\WinRestoreKit.Wpf\Properties\AssemblyInfo.cs
+git commit -m "build: add application and WPF migration projects"
+```
+
+### Task 2: Extract shared run state/orchestration and neutralize its UI contract
+
+**Files:**
+- Create: `src/WinRestoreKit.Application/Orchestration/IRunUi.cs`
+- Create: `src/WinRestoreKit.Application/Orchestration/RunCoordinator.cs`
+- Create: `src/WinRestoreKit.Application/Orchestration/RunControl.cs`
+- Create: `src/WinRestoreKit.Application/Orchestration/BackupRestoreOrchestrator.cs`
+- Create: `src/WinRestoreKit.Application/Results/RunSummary.cs`
+- Create: `src/WinRestoreKit.Application/Settings/BackupRootRegistry.cs`
+- Verify unchanged: `src/WinRestoreKit/MainForm.cs:17-303` — `StartBackup`, `StartRestore`, and `OnRunningChanged` continue to resolve the moved `RunCoordinator` by the same `WinRestoreKit` namespace; do not redesign its rail/navigation in this foundation plan.
+- Modify: `src/WinRestoreKit/Views/ProgressPageView.cs:15-25,399-445,685-790`
+- Modify: `src/WinRestoreKit/Orchestration/BackupRestoreOrchestrator.cs:1-1325` then delete it
+- Modify: `src/WinRestoreKit/Orchestration/IRunUi.cs:1-52` then delete it
+- Modify: `src/WinRestoreKit/Orchestration/RunCoordinator.cs:1-47` then delete it
+- Modify: `src/WinRestoreKit/Orchestration/RunControl.cs:1-106` then delete it
+- Modify: `src/WinRestoreKit/Results/RunSummary.cs:1-169` then delete it
+- Modify: `src/WinRestoreKit/Helpers/BackupRootRegistry.cs:1-104` then delete it
+- Modify: `src/WinRestoreKit.Tests/RunSummaryTests.cs`
+- Modify: `src/WinRestoreKit.Tests/ApplicationBoundaryTests.cs`
+- Modify: `src/WinRestoreKit.Tests/RunCoordinatorTests.cs`
+- Modify: `src/WinRestoreKit.Tests/RunControlTests.cs`
+- Modify: `src/WinRestoreKit.Tests/BackupDestinationLifecycleTests.cs`
+- Verify unchanged: `src/WinRestoreKit.Tests/RestoreDialogOwnerTests.cs:1-64` — its existing `AppStoreApps.RestoreDialog` hook must continue to prove that the opaque owner passed to the Core overload reaches the registered dialog and returns the current `Skipped` outcome.
+
+**Interfaces:**
+- Consumes: Task 1 project/friend topology; Core `BackupBase`, `ModuleOutcome`, `RestorePlan`, `LogHelper`, `SnapshotGate`, `RestoreScope`, `RestoreDispatch`, `ExplorerRestartPrompt`, and `Conf.AppStoreApps`.
+- Produces: The exact Application `IRunUi`, `RunControl`, `RunCoordinator`, `BackupRestoreOrchestrator`, `RunSummary`, `RunSeverity`, and `BackupRootRegistry` contracts declared above. WinForms remains an `IRunUi` implementation and supplies its dialog owner only as the opaque `object DialogOwner`.
+
+- [ ] **Step 1: Write failing severity and neutral-owner-contract tests.**
+
+Replace the obsolete WinForms icon assertions in `RunSummaryTests` with neutral severity assertions, and add a contract check that pins `IRunUi.DialogOwner` to `object` while proving the WinForms-typed `Owner` property has gone. Do not modify `RestoreDialogOwnerTests`; it is the existing focused regression test for the preserved Core `Action<string, object>` dialog seam and is re-run with this task’s focused command.
+
+```csharp
+[Fact]
+public void DidNotRun_IsWarningWithoutAWinFormsMessageBoxIcon()
+{
+    RunSummary summary = RunSummary.For(new List<ModuleOutcome>(), false, RunVerb.Backup,
+                                        "the destination is empty");
+
+    Assert.Equal(RunSeverity.Warning, summary.Severity);
+    var dialogOwner = typeof(IRunUi).GetProperty("DialogOwner");
+    Assert.NotNull(dialogOwner);
+    Assert.Equal(typeof(object), dialogOwner.PropertyType);
+    Assert.Null(typeof(IRunUi).GetProperty("Owner"));
+}
+
+[Fact]
+public void IncompleteRun_IsWarning()
+{
+    RunSummary summary = RunSummary.Incomplete(new List<ModuleOutcome>(), RunVerb.Restore,
+                                                "The pre-restore snapshot was incomplete.");
+
+    Assert.Equal(RunSeverity.Warning, summary.Severity);
+}
+
+```
+
+Add this separate test to `ApplicationBoundaryTests.cs`, which already imports `ApplicationWinRestoreKit` through the direct Application assembly alias:
+
+```csharp
+[Fact]
+public void ApplicationAssembly_HasNoWinFormsOrWpfAssemblyReference()
+{
+    string[] references = typeof(ApplicationWinRestoreKit.RunControl).Assembly.GetReferencedAssemblies()
+        .Select(reference => reference.Name)
+        .ToArray();
+
+    Assert.DoesNotContain("System.Windows.Forms", references);
+    Assert.DoesNotContain("PresentationFramework", references);
+    Assert.DoesNotContain("WindowsBase", references);
+}
+```
+
+Run:
+
+```powershell
+dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~RunSummaryTests|FullyQualifiedName~ApplicationBoundaryTests"
+```
+
+Expected: FAIL because the Application project does not yet contain `RunSummary`, `IRunUi`, or `RunControl`.
+
+- [ ] **Step 2: Move run types verbatim first, then make the two intentional contract changes.**
+
+Move the existing bodies from the old `Orchestration`, `Results`, and `BackupRootRegistry` paths to the exact Application paths. Preserve all existing namespace, type names, method bodies, cancellation behavior, manifest writes, `SnapshotGate` sequencing, cleanup/retention rules, and `ProgressMetrics` formulas. Delete the old source files after the move; do not retain forwarding files.
+
+Replace the WinForms-only `RunSummary.Icon` property with this mapping:
+
+```csharp
+internal enum RunSeverity
+{
+    Information,
+    Warning,
+    Error
+}
+
+public RunSeverity Severity
+    => State == RunState.Problems || State == RunState.DidNotRun
+        ? RunSeverity.Warning
+        : RunSeverity.Information;
+```
+
+Replace the former WinForms-typed `Owner` property in the moved interface with this exact neutral abstraction:
+
+```csharp
+/// <summary>
+/// Opaque owner for a shell-native modal dialog. The Application layer never casts it.
+/// </summary>
+object DialogOwner { get; }
+```
+
+At the existing AppStore branch in `BackupRestoreOrchestrator.RunRestore`, preserve the Core seam and all current result semantics; change only the property name and type at the Application boundary:
+
+```csharp
+ModuleResult outcome = config is Conf.AppStoreApps appStoreApps
+    ? await appStoreApps.RestoreAsync(currentRestorePath, ui.DialogOwner)
+    : await config.RestoreAsync(currentRestorePath);
+```
+
+Do not modify `Conf.AppStoreApps`, its `RestoreDialog : Action<string, object>` seam, Core artifact handling, restore order, or the AppStore module’s existing `Skipped`/failure outcome semantics in this task.
+
+- [ ] **Step 3: Adapt the still-shipping WinForms run view to the neutral contract.**
+
+Replace the explicit `IRunUi.Owner` implementation in `ProgressPageView` with this exact opaque owner property. It returns the same current Form-or-control object currently passed to `AppStoreApps.RestoreAsync`; do not construct `RestAppsForm` here or change its dialog lifecycle.
+
+```csharp
+object IRunUi.DialogOwner => (object)FindForm() ?? this;
+```
+
+Keep every existing `ShowConsentDialog`, snapshot-override confirmation, plan-composition error, Explorer restart, progress, summary, log-sink, cancellation, and dispatcher behavior. Preserve the current title accent behavior by using the neutral severity:
+
+```csharp
+titleLabel.ForeColor = summary.Severity == RunSeverity.Warning
+    ? Theme.Current.Accent2_600
+    : Theme.Current.Text;
+```
+
+- [ ] **Step 4: Run the extracted pure-contract tests to verify they pass.**
+
+Run:
+
+```powershell
+dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~ApplicationBoundaryTests|FullyQualifiedName~RunSummaryTests|FullyQualifiedName~RunCoordinatorTests|FullyQualifiedName~RunControlTests|FullyQualifiedName~BackupDestinationLifecycleTests|FullyQualifiedName~RestoreDialogOwnerTests"
+```
+
+Expected: PASS. The existing coordinator test still admits exactly one concurrent run; control tests still release paused waiters on cancellation; backup-root lifecycle behavior still records valid custom roots; new summary tests prove severity plus an `object`-typed `IRunUi.DialogOwner` without `IRunUi.Owner`; `RestoreDialogOwnerTests` proves the unchanged Core AppStore dialog seam receives the supplied opaque owner.
+
+- [ ] **Step 5: Verify the Application boundary and WinForms compatibility compile independently.**
+
+Run:
+
+```powershell
+dotnet build src\WinRestoreKit.Application\WinRestoreKit.Application.csproj
+dotnet build src\WinRestoreKit\WinRestoreKit.csproj
+```
+
+Expected: both PASS. Application compiles against Core with no WinForms/WPF reference; WinForms compiles its existing `ProgressPageView` against the moved Application types.
+
+- [ ] **Step 6: Commit the complete orchestration extraction.**
+
+```powershell
+git add -A src\WinRestoreKit.Application src\WinRestoreKit\Orchestration src\WinRestoreKit\Results src\WinRestoreKit\Helpers\BackupRootRegistry.cs src\WinRestoreKit\Views\ProgressPageView.cs src\WinRestoreKit.Tests\ApplicationBoundaryTests.cs src\WinRestoreKit.Tests\RunSummaryTests.cs src\WinRestoreKit.Tests\RunCoordinatorTests.cs src\WinRestoreKit.Tests\RunControlTests.cs src\WinRestoreKit.Tests\BackupDestinationLifecycleTests.cs
+git commit -m "refactor: move shared run orchestration to application"
+```
+
+### Task 3: Add registry-backed WPF theme settings and dynamic Light/Dark/Follow-system resources
+
+**Files:**
+- Create: `src/WinRestoreKit.Application/Settings/ThemeMode.cs`
+- Create: `src/WinRestoreKit.Application/Settings/IThemeSettings.cs`
+- Create: `src/WinRestoreKit.Application/Settings/RegistryThemeSettings.cs`
+- Create: `src/WinRestoreKit.Wpf/Themes/Controls.xaml`
+- Create: `src/WinRestoreKit.Wpf/Themes/Light.xaml`
+- Create: `src/WinRestoreKit.Wpf/Themes/Dark.xaml`
+- Create: `src/WinRestoreKit.Wpf/Services/ISystemThemeDetector.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/WindowsThemeDetector.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/IThemeService.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/WpfThemeService.cs`
+- Create: `src/WinRestoreKit.Tests/WpfTestHost.cs`
+- Create: `src/WinRestoreKit.Tests/ThemeSettingsTests.cs`
+- Create: `src/WinRestoreKit.Tests/ThemeServiceTests.cs`
+
+**Interfaces:**
+- Consumes: Application’s no-UI project boundary from Task 1; `Microsoft.Win32.Registry`; WPF resource dictionaries; and `SystemEvents.UserPreferenceChanged`.
+- Produces: `ThemeMode`, `IThemeSettings`, `RegistryThemeSettings`, `ISystemThemeDetector`, `IThemeService`, and `WpfThemeService`. The WPF shell reads only these neutral settings; it does not reuse WinForms `Theme`, `PaletteMode`, `Voltage`, or `Flux`.
+
+- [ ] **Step 1: Write the failing settings and effective-theme tests.**
+
+Use a unique HKCU subkey in the persistence test, delete it in `finally`, and use fakes for the system detector so the visual decision is deterministic.
+
+Create the STA helper as test infrastructure before writing the WPF-specific test. It creates no `Application` object and never displays a window:
+
+```csharp
+// src/WinRestoreKit.Tests/WpfTestHost.cs
+using System;
+using System.Runtime.ExceptionServices;
+using System.Threading;
+using System.Windows.Threading;
+
+namespace WinRestoreKit.Tests
+{
+    internal static class WpfTestHost
+    {
+        internal static void Run(Action action)
+            => Run<object>(() =>
+            {
+                action();
+                return null;
+            });
+
+        internal static T Run<T>(Func<T> action)
+        {
+            if (action == null)
+                throw new ArgumentNullException(nameof(action));
+
+            T result = default;
+            ExceptionDispatchInfo failure = null;
+            Thread thread = new Thread(() =>
+            {
+                try
+                {
+                    result = action();
+                }
+                catch (Exception ex)
+                {
+                    failure = ExceptionDispatchInfo.Capture(ex);
+                }
+                finally
+                {
+                    Dispatcher.CurrentDispatcher.InvokeShutdown();
+                }
+            })
+            {
+                IsBackground = true,
+                Name = "WinRestoreKit WPF test"
+            };
+
+            thread.SetApartmentState(ApartmentState.STA);
+            thread.Start();
+            thread.Join();
+            failure?.Throw();
+            return result;
+        }
+    }
+}
+```
+
+```csharp
+[Fact]
+public void RegistryThemeSettings_RoundTripsLightDarkAndFollowSystem()
+{
+    string keyPath = @"Software\WinRestoreKit.Tests\" + Guid.NewGuid().ToString("N");
+    try
+    {
+        IThemeSettings settings = new RegistryThemeSettings(keyPath);
+
+        settings.WriteThemeMode(ThemeMode.Dark);
+        Assert.Equal(ThemeMode.Dark, settings.ReadThemeMode());
+        settings.WriteThemeMode(ThemeMode.Light);
+        Assert.Equal(ThemeMode.Light, settings.ReadThemeMode());
+        settings.WriteThemeMode(ThemeMode.FollowSystem);
+        Assert.Equal(ThemeMode.FollowSystem, settings.ReadThemeMode());
+    }
+    finally
+    {
+        Registry.CurrentUser.DeleteSubKeyTree(keyPath, false);
+    }
+}
+
+[Fact]
+public void WpfThemeService_UsesSystemDarkOnlyWhenModeFollowsSystem()
+{
+    WpfTestHost.Run(() =>
+    {
+        ResourceDictionary resources = new ResourceDictionary();
+        FakeThemeSettings settings = new FakeThemeSettings(ThemeMode.FollowSystem);
+        using (WpfThemeService service = new WpfThemeService(resources, settings,
+                   new FakeSystemThemeDetector(isDark: true)))
+        {
+            Assert.Equal(ThemeMode.Dark, service.EffectiveMode);
+            service.SetMode(ThemeMode.Light);
+            Assert.Equal(ThemeMode.Light, service.EffectiveMode);
+            Assert.Equal(ThemeMode.Light, settings.ReadThemeMode());
+        }
+    });
+}
+
+private sealed class FakeThemeSettings : IThemeSettings
+{
+    private ThemeMode mode;
+
+    internal FakeThemeSettings(ThemeMode mode) => this.mode = mode;
+
+    public ThemeMode ReadThemeMode() => mode;
+    public void WriteThemeMode(ThemeMode mode) => this.mode = mode;
+}
+
+private sealed class FakeSystemThemeDetector : ISystemThemeDetector
+{
+    private readonly bool isDark;
+
+    internal FakeSystemThemeDetector(bool isDark) => this.isDark = isDark;
+
+    public bool IsDarkAppsTheme() => isDark;
+}
+```
+
+Run:
+
+```powershell
+dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~ThemeSettingsTests|FullyQualifiedName~ThemeServiceTests"
+```
+
+Expected: FAIL to compile because `ThemeMode`, `RegistryThemeSettings`, and `WpfThemeService` do not exist yet.
+
+- [ ] **Step 2: Implement neutral settings with a deterministic invalid-value default.**
+
+Use the existing product registry root and a new `ThemeMode` DWORD. Allow an optional key path only for isolated tests; production construction uses the default path. Invalid/missing data and registry failures default to Follow system.
+
+```csharp
+internal enum ThemeMode
+{
+    FollowSystem = 0,
+    Light = 1,
+    Dark = 2
+}
+
+internal sealed class RegistryThemeSettings : IThemeSettings
+{
+    private const string DefaultKeyPath = @"Software\WinRestoreKit";
+    private const string ValueName = "ThemeMode";
+    private readonly string keyPath;
+
+    internal RegistryThemeSettings(string keyPath = DefaultKeyPath)
+    {
+        this.keyPath = string.IsNullOrWhiteSpace(keyPath) ? DefaultKeyPath : keyPath;
+    }
+
+    public ThemeMode ReadThemeMode()
+    {
+        try
+        {
+            using (RegistryKey key = Registry.CurrentUser.OpenSubKey(keyPath))
+            {
+                return key?.GetValue(ValueName) is int value && Enum.IsDefined(typeof(ThemeMode), value)
+                    ? (ThemeMode)value
+                    : ThemeMode.FollowSystem;
+            }
+        }
+        catch (Exception)
+        {
+            return ThemeMode.FollowSystem;
+        }
+    }
+
+    public void WriteThemeMode(ThemeMode mode)
+    {
+        try
+        {
+            using (RegistryKey key = Registry.CurrentUser.CreateSubKey(keyPath))
+                key?.SetValue(ValueName, (int)mode, RegistryValueKind.DWord);
+        }
+        catch (Exception)
+        {
+        }
+    }
+}
+```
+
+Do not modify `Helpers/Theme.cs` or delete the WinForms `PaletteMode` in this staged task. The two shells intentionally maintain their own settings during side-by-side migration.
+
+- [ ] **Step 3: Implement WPF theme resolution, preference-change subscription, and token dictionaries.**
+
+`WindowsThemeDetector` reads `HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme`, returns `false` on any failure, and has this exact interface:
+
+```csharp
+internal interface ISystemThemeDetector
+{
+    bool IsDarkAppsTheme();
+}
+```
+
+`WpfThemeService` owns the `SystemEvents.UserPreferenceChanged` subscription, updates only while `Mode == ThemeMode.FollowSystem`, replaces exactly one Light/Dark dictionary in `resources.MergedDictionaries`, and unsubscribes in `Dispose`.
+
+```csharp
+internal interface IThemeService : IDisposable
+{
+    ThemeMode Mode { get; }
+    ThemeMode EffectiveMode { get; }
+    event EventHandler ThemeChanged;
+    void SetMode(ThemeMode mode);
+}
+
+internal sealed class WpfThemeService : IThemeService
+{
+    internal WpfThemeService(ResourceDictionary resources, IThemeSettings settings,
+                             ISystemThemeDetector systemTheme);
+
+    public ThemeMode Mode { get; private set; }
+    public ThemeMode EffectiveMode { get; private set; }
+
+    public void SetMode(ThemeMode mode)
+    {
+        Mode = mode;
+        settings.WriteThemeMode(mode);
+        ApplyEffectiveMode();
+    }
+}
+```
+
+Create `Themes/Controls.xaml` with `FontFamily` resources and common focusable-control styles, including an Automation-friendly visible focus trigger. Use `DynamicResource` keys rather than hardcoded colors in views. Link the packaged monospace font only through the technical text style.
+
+```xml
+<!-- Representative resource keys in Themes/Light.xaml; Dark.xaml defines the same keys. -->
+<ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+                    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
+  <Color x:Key="WindowBackgroundColor">#FFF7F8FA</Color>
+  <Color x:Key="SurfaceColor">#FFFFFFFF</Color>
+  <Color x:Key="TextColor">#FF1A1D21</Color>
+  <Color x:Key="MutedTextColor">#FF5F6875</Color>
+  <Color x:Key="AccentColor">#FF1769AA</Color>
+  <Color x:Key="WarningColor">#FFB44E3C</Color>
+  <Color x:Key="DividerColor">#FFD7DCE2</Color>
+  <SolidColorBrush x:Key="WindowBackgroundBrush" Color="{StaticResource WindowBackgroundColor}" />
+  <SolidColorBrush x:Key="SurfaceBrush" Color="{StaticResource SurfaceColor}" />
+  <SolidColorBrush x:Key="TextBrush" Color="{StaticResource TextColor}" />
+  <SolidColorBrush x:Key="MutedTextBrush" Color="{StaticResource MutedTextColor}" />
+  <SolidColorBrush x:Key="AccentBrush" Color="{StaticResource AccentColor}" />
+  <SolidColorBrush x:Key="WarningBrush" Color="{StaticResource WarningColor}" />
+  <SolidColorBrush x:Key="DividerBrush" Color="{StaticResource DividerColor}" />
+</ResourceDictionary>
+```
+
+In `Controls.xaml`, use `Segoe UI Variable` for `TextBlock`, `Button`, `ComboBox`, and `Label`, and reserve the linked package for the key `TechnicalTextStyle`:
+
+```xml
+<Style x:Key="TechnicalTextStyle" TargetType="TextBlock">
+  <Setter Property="FontFamily" Value="pack://application:,,,/Fonts/#IBM Plex Mono" />
+  <Setter Property="FontSize" Value="12" />
+</Style>
+```
+
+- [ ] **Step 4: Re-run the focused theme tests.**
+
+Run:
+
+```powershell
+dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~ThemeSettingsTests|FullyQualifiedName~ThemeServiceTests"
+```
+
+Expected: PASS. The test proves all three persisted choices round-trip and Follow system maps to detector output while an explicit Light choice overrides a dark detector.
+
+- [ ] **Step 5: Commit settings and theme infrastructure.**
+
+```powershell
+git add src\WinRestoreKit.Application\Settings\ThemeMode.cs src\WinRestoreKit.Application\Settings\IThemeSettings.cs src\WinRestoreKit.Application\Settings\RegistryThemeSettings.cs src\WinRestoreKit.Wpf\Themes src\WinRestoreKit.Wpf\Services\ISystemThemeDetector.cs src\WinRestoreKit.Wpf\Services\WindowsThemeDetector.cs src\WinRestoreKit.Wpf\Services\IThemeService.cs src\WinRestoreKit.Wpf\Services\WpfThemeService.cs src\WinRestoreKit.Tests\WpfTestHost.cs src\WinRestoreKit.Tests\ThemeSettingsTests.cs src\WinRestoreKit.Tests\ThemeServiceTests.cs
+git commit -m "feat: add WPF theme settings and resources"
+```
+
+### Task 4: Move version/update decisions into Application and keep dialog ownership in each shell
+
+**Files:**
+- Create: `src/WinRestoreKit.Application/Updates/VersionInfo.cs`
+- Create: `src/WinRestoreKit.Application/Updates/UpdateVerdict.cs`
+- Create: `src/WinRestoreKit.Application/Updates/UpdateCheckResult.cs`
+- Create: `src/WinRestoreKit.Application/Updates/IUpdateCheckService.cs`
+- Create: `src/WinRestoreKit.Application/Updates/UpdateCheckService.cs`
+- Create: `src/WinRestoreKit/Helpers/WinFormsUpdatePresenter.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/IWpfDialogService.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/WpfDialogService.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/IExternalLinkService.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/ExternalLinkService.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/WpfUpdatePresenter.cs`
+- Modify: `src/WinRestoreKit/Program.cs:13-133`
+- Modify: `src/WinRestoreKit/Views/AboutPageView.cs:137-141,346-401`
+- Modify: `src/WinRestoreKit/Helpers/UpdateCheck.cs:1-189` then delete it
+- Modify: `src/WinRestoreKit.Tests/VersionParsingTests.cs`
+- Modify: `src/WinRestoreKit.Tests/UpdateCheckVerdictTests.cs`
+
+**Interfaces:**
+- Consumes: Current assembly file-version behavior, Core `Data.UserAgent`, `Data.IsInet`, release API URL, raw AssemblyInfo URL, `ParseLatestReleaseTag`, `ParseLatestVersion`, and existing `Utils.OpenUrl` error seam.
+- Produces: Framework-neutral `VersionInfo` and update service/result contracts; WinForms and WPF presenters map results to shell-owned owner-bound dialogs. The raw `Properties/AssemblyInfo.cs` location and parser contract stay unchanged.
+
+- [ ] **Step 1: Write the failing tests against Application version/update types.**
+
+Migrate existing tests from `Program`/`UpdateCheck` to the destination types and add coverage for the neutral error result. Keep the real AssemblyInfo test-data link exactly as it is in the test project.
+
+```csharp
+[Fact]
+public void GetCurrentVersion_UsesTheAssemblyFileVersionAttribute()
+{
+    string version = VersionInfo.GetCurrentVersion(typeof(VersionParsingTests).Assembly);
+
+    Assert.NotEqual(VersionInfo.UnknownVersion, version);
+    Assert.Matches("^\\d+\\.\\d+\\.\\d+$", version);
+}
+
+[Fact]
+public void Decide_ReturnsWarningVerdictWhenInstalledVersionIsUnknown()
+{
+    UpdateVerdict verdict = UpdateCheckService.Decide(VersionInfo.UnknownVersion, "1.2.3");
+
+    Assert.Equal(UpdateVerdict.CannotDetermineCurrentVersion, verdict);
+}
+```
+
+Run:
+
+```powershell
+dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~VersionParsingTests|FullyQualifiedName~UpdateCheckVerdictTests"
+```
+
+Expected: FAIL because Application version/update types do not exist and existing tests still refer to the WinForms types.
+
+- [ ] **Step 2: Implement the framework-neutral version and update service.**
+
+Move the exact normalization behavior out of `Program`: trim whitespace; drop `+`/`-` suffixes before parsing; require a third version component; preserve malformed non-empty values verbatim; and return the literal `"unknown"` only for null/empty input. The assembly accessor must read `AssemblyFileVersionAttribute` before `Assembly.GetName().Version`.
+
+```csharp
+internal static class VersionInfo
+{
+    internal const string UnknownVersion = "unknown";
+
+    internal static string GetCurrentVersion(Assembly assembly)
+        => Normalize(assembly?.GetCustomAttribute<AssemblyFileVersionAttribute>()?.Version
+                     ?? assembly?.GetName().Version?.ToString());
+
+    internal static string Normalize(string rawVersion)
+    {
+        if (string.IsNullOrWhiteSpace(rawVersion))
+            return UnknownVersion;
+
+        string raw = rawVersion.Trim();
+        int suffix = raw.IndexOfAny(new[] { '+', '-' });
+        string candidate = suffix >= 0 ? raw.Substring(0, suffix) : raw;
+        return Version.TryParse(candidate, out Version parsed) && parsed.Build >= 0
+            ? parsed.ToString(3)
+            : raw;
+    }
+}
+```
+
+`UpdateCheckService` owns one process-wide `HttpClient` with the existing `Data.UserAgent`, checks `Data.IsInet` off the calling thread, reads the GitHub Releases tag first, and on any primary read failure falls back to `Data.ParseLatestVersion(await Client.GetStringAsync(Data.Uri.URL_ASSEMBLY))`. It returns data, never displays a dialog and never launches a URL.
+
+```csharp
+internal sealed class UpdateCheckResult
+{
+    internal UpdateCheckResult(UpdateVerdict verdict, string currentVersion, string latestVersion,
+                               string errorMessage = null);
+    public UpdateVerdict Verdict { get; }
+    public string CurrentVersion { get; }
+    public string LatestVersion { get; }
+    public string ErrorMessage { get; }
+}
+
+internal sealed class UpdateCheckService : IUpdateCheckService
+{
+    public Task<UpdateCheckResult> CheckAsync(string currentVersion,
+                                               CancellationToken cancellationToken);
+
+    internal static UpdateVerdict Decide(string currentVersion, string latestTag);
+}
+```
+
+Preserve current verdict semantics exactly: unknown installed version is `CannotDetermineCurrentVersion`; blank/unreadable latest version is `LatestVersionUnreadable`; equal/newer installed versions are `UpToDate`; a higher parsable tag or incomparable nonblank tag is `UpdateAvailable`. Translate transport/parse exceptions into an `UpdateCheckResult` with the original exception message in `ErrorMessage`, not a fabricated latest version.
+
+- [ ] **Step 3: Replace each shell’s old direct MessageBox update code with owner-bound presenters.**
+
+`WinFormsUpdatePresenter` receives an `IUpdateCheckService`, an `IWin32Window` owner, and the current version. It reuses the current exact wording and default buttons, but chooses `MessageBoxIcon` only inside the WinForms project. `AboutPageView` calls it instead of `UpdateCheck.CheckForUpdatesAsync`, and reads its display version from `VersionInfo.GetCurrentVersion(typeof(AboutPageView).Assembly)`.
+
+WPF keeps native ownership in WPF. Its dialog service accepts an owner provider and invokes the supplied action on the dispatcher; no Application type receives a `Window`.
+
+```csharp
+internal interface IWpfDialogService
+{
+    void ShowInformation(string text, string caption);
+    void ShowWarning(string text, string caption);
+    void ShowError(string text, string caption);
+    bool Confirm(string text, string caption);
+}
+
+internal interface IExternalLinkService
+{
+    void Open(string url);
+}
+
+internal sealed class WpfUpdatePresenter
+{
+    internal WpfUpdatePresenter(IUpdateCheckService updates, IWpfDialogService dialogs,
+                                IExternalLinkService links);
+
+    internal async Task CheckAsync(string currentVersion, CancellationToken cancellationToken)
+    {
+        UpdateCheckResult result = await updates.CheckAsync(currentVersion, cancellationToken);
+        switch (result.Verdict)
+        {
+            case UpdateVerdict.CannotDetermineCurrentVersion:
+                dialogs.ShowWarning(
+                    "The installed WinRestoreKit version could not be determined, so no update download can be offered.",
+                    "WinRestoreKit Update");
+                return;
+            case UpdateVerdict.LatestVersionUnreadable:
+                if (!string.IsNullOrWhiteSpace(result.ErrorMessage))
+                    dialogs.ShowError("Checking for WinRestoreKit updates failed.\n" + result.ErrorMessage,
+                                      "WinRestoreKit Update");
+                else
+                    dialogs.ShowWarning(
+                        "Could not read the latest WinRestoreKit version number from the update file.",
+                        "WinRestoreKit Update");
+                return;
+            case UpdateVerdict.UpToDate:
+                dialogs.ShowInformation("No new WinRestoreKit updates are available.", "WinRestoreKit Update");
+                return;
+            case UpdateVerdict.UpdateAvailable:
+                if (dialogs.Confirm(
+                    "WinRestoreKit version " + result.LatestVersion +
+                    " is available.\nDo you want to open the download page?",
+                    "WinRestoreKit Update Available"))
+                {
+                    links.Open(Data.Uri.URL_GITLATEST);
+                }
+                return;
+            default:
+                throw new InvalidOperationException("The update result has an unknown verdict.");
+        }
+    }
+}
+```
+
+`WpfDialogService` calls `MessageBox.Show(ownerProvider(), ...)` only after checking the owner is non-null and loaded; it returns `false` from `Confirm` if no owner is available. `ExternalLinkService.Open(string url)` calls existing `Utils.OpenUrl(url)`. During WPF startup in Task 6, register `Utils.UrlFailureUi` to dispatcher-marshal an owner-bound `ShowWarning`; retain the WinForms registration in `Program.RegisterUiSeams()`.
+
+Remove `Helpers/UpdateCheck.cs` once both presenters use `UpdateCheckService`. Remove the moved version methods from `Program`, leaving only startup-failure description and WinForms Core seam registration there.
+
+- [ ] **Step 4: Run update/version tests and WinForms compilation.**
+
+Run:
+
+```powershell
+dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~VersionParsingTests|FullyQualifiedName~UpdateCheckVerdictTests"
+dotnet build src\WinRestoreKit\WinRestoreKit.csproj
+```
+
+Expected: PASS. The tests prove the raw AssemblyInfo fallback and normalized comparison behavior remain coherent; the WinForms application still builds with owner-bound update dialogs despite `UpdateCheck.cs` no longer existing in that project.
+
+- [ ] **Step 5: Commit the neutral update seam.**
+
+```powershell
+git add -A src\WinRestoreKit.Application\Updates src\WinRestoreKit\Program.cs src\WinRestoreKit\Views\AboutPageView.cs src\WinRestoreKit\Helpers\WinFormsUpdatePresenter.cs src\WinRestoreKit\Helpers\UpdateCheck.cs src\WinRestoreKit.Wpf\Services\IWpfDialogService.cs src\WinRestoreKit.Wpf\Services\WpfDialogService.cs src\WinRestoreKit.Wpf\Services\IExternalLinkService.cs src\WinRestoreKit.Wpf\Services\ExternalLinkService.cs src\WinRestoreKit.Wpf\Services\WpfUpdatePresenter.cs src\WinRestoreKit.Tests\VersionParsingTests.cs src\WinRestoreKit.Tests\UpdateCheckVerdictTests.cs
+git commit -m "refactor: separate update decisions from shell dialogs"
+```
+
+### Task 5: Build the MVVM WPF shell with an honest empty Timeline, settings, and About views
+
+**Files:**
+- Create: `src/WinRestoreKit.Wpf/Infrastructure/ObservableObject.cs`
+- Create: `src/WinRestoreKit.Wpf/Infrastructure/DelegateCommand.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/TimelineWorkspaceViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/SettingsViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/ViewModels/AboutViewModel.cs`
+- Create: `src/WinRestoreKit.Wpf/Views/TimelineWorkspaceView.xaml`
+- Create: `src/WinRestoreKit.Wpf/Views/TimelineWorkspaceView.xaml.cs`
+- Create: `src/WinRestoreKit.Wpf/Views/SettingsView.xaml`
+- Create: `src/WinRestoreKit.Wpf/Views/SettingsView.xaml.cs`
+- Create: `src/WinRestoreKit.Wpf/Views/AboutView.xaml`
+- Create: `src/WinRestoreKit.Wpf/Views/AboutView.xaml.cs`
+- Create: `src/WinRestoreKit.Tests/WpfShellTests.cs`
+
+**Interfaces:**
+- Consumes: Task 3 `IThemeService`/`ThemeMode`, Task 4 `VersionInfo`/`WpfUpdatePresenter`, WPF theme resource keys, and the shell type names declared in the definitive interface section.
+- Produces: Constructible `ShellViewModel`, `TimelineWorkspaceViewModel`, Settings and About view models, and the three matching views. The shell deliberately exposes only Timeline, Settings, and About at this phase; subsequent real workspaces use `NavigateTo` rather than a duplicate navigation implementation.
+
+- [ ] **Step 1: Write the failing STA construction and empty-state tests.**
+
+Use the `WpfTestHost` added in Task 3. Write the tests before adding the MVVM shell types:
+
+
+```csharp
+[Fact]
+public void Shell_StartsOnTimelineWithTheOnlyRealEmptyState()
+{
+    WpfTestHost.Run(() =>
+    {
+        ShellViewModel shell = CreateShell();
+
+        Assert.Equal("Timeline", shell.WorkflowLabel);
+        TimelineWorkspaceViewModel timeline = Assert.IsType<TimelineWorkspaceViewModel>(shell.CurrentWorkspace);
+        Assert.Equal("No local snapshots are available.", timeline.EmptyStateTitle);
+        Assert.Equal("Create a snapshot to begin protecting this PC.", timeline.EmptyStateDescription);
+    });
+}
+
+[Fact]
+public void Shell_SettingsAndAboutCommandsNavigateWithoutAVisualRail()
+{
+    WpfTestHost.Run(() =>
+    {
+        ShellViewModel shell = CreateShell();
+        shell.ShowSettingsCommand.Execute(null);
+        Assert.Equal("Settings", shell.WorkflowLabel);
+        shell.ShowAboutCommand.Execute(null);
+        Assert.Equal("About", shell.WorkflowLabel);
+        shell.ShowTimeline();
+        Assert.IsType<TimelineWorkspaceViewModel>(shell.CurrentWorkspace);
+    });
+}
+```
+
+Use this exact test fixture code; it supplies all dependencies without reading a registry or making a network call:
+
+```csharp
+private static ShellViewModel CreateShell()
+{
+    return new ShellViewModel(
+        new FakeThemeService(),
+        new WpfUpdatePresenter(new FakeUpdates(), new FakeDialogs(), new FakeLinks()),
+        "0.0.1");
+}
+
+private sealed class FakeThemeService : IThemeService
+{
+    public ThemeMode Mode { get; private set; } = ThemeMode.FollowSystem;
+    public ThemeMode EffectiveMode { get; private set; } = ThemeMode.Light;
+    public event EventHandler ThemeChanged;
+
+    public void SetMode(ThemeMode mode)
+    {
+        Mode = mode;
+        EffectiveMode = mode == ThemeMode.FollowSystem ? ThemeMode.Light : mode;
+        ThemeChanged?.Invoke(this, EventArgs.Empty);
+    }
+
+    public void Dispose() { }
+}
+
+private sealed class FakeUpdates : IUpdateCheckService
+{
+    public Task<UpdateCheckResult> CheckAsync(string currentVersion, CancellationToken cancellationToken)
+        => Task.FromResult(new UpdateCheckResult(UpdateVerdict.UpToDate, currentVersion, currentVersion));
+}
+
+private sealed class FakeDialogs : IWpfDialogService
+{
+    public void ShowInformation(string text, string caption) { }
+    public void ShowWarning(string text, string caption) { }
+    public void ShowError(string text, string caption) { }
+    public bool Confirm(string text, string caption) => false;
+}
+
+private sealed class FakeLinks : IExternalLinkService
+{
+    public void Open(string url) { }
+}
+```
+
+Run:
+
+```powershell
+dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj --filter FullyQualifiedName~WpfShellTests
+```
+
+Expected: FAIL to compile because the MVVM shell types do not exist.
+
+- [ ] **Step 2: Implement the dependency-free MVVM base and explicit workspace state.**
+
+`ObservableObject` implements `INotifyPropertyChanged` and only raises when a field changes. `DelegateCommand` implements `ICommand`, accepts execute/can-execute delegates, and exposes `RaiseCanExecuteChanged()`; do not add a third-party MVVM package.
+
+```csharp
+internal sealed class DelegateCommand : ICommand
+{
+    private readonly Action<object> execute;
+    private readonly Predicate<object> canExecute;
+
+    internal DelegateCommand(Action<object> execute, Predicate<object> canExecute = null)
+    {
+        this.execute = execute ?? throw new ArgumentNullException(nameof(execute));
+        this.canExecute = canExecute;
+    }
+
+    public event EventHandler CanExecuteChanged;
+
+    public bool CanExecute(object parameter) => canExecute?.Invoke(parameter) ?? true;
+
+    public void Execute(object parameter) => execute(parameter);
+
+    internal void RaiseCanExecuteChanged()
+        => CanExecuteChanged?.Invoke(this, EventArgs.Empty);
+}
+```
+
+`ShellViewModel` constructs three real view models and uses the following state transition method. A later plan may pass its fully implemented workspace through this method; this plan does not add a no-op backup command or a disabled control.
+
+```csharp
+internal void NavigateTo(object workspace, string workflowLabel)
+{
+    if (workspace == null)
+        throw new ArgumentNullException(nameof(workspace));
+    if (string.IsNullOrWhiteSpace(workflowLabel))
+        throw new ArgumentException("A workflow label is required.", nameof(workflowLabel));
+
+    CurrentWorkspace = workspace;
+    WorkflowLabel = workflowLabel;
+    OnPropertyChanged(nameof(CurrentWorkspace));
+    OnPropertyChanged(nameof(WorkflowLabel));
+}
+
+internal void ShowTimeline() => NavigateTo(timeline, "Timeline");
+```
+
+The Timeline VM is intentionally small and truthful:
+
+```csharp
+internal sealed class TimelineWorkspaceViewModel
+{
+    public string EmptyStateTitle => "No local snapshots are available.";
+    public string EmptyStateDescription => "Create a snapshot to begin protecting this PC.";
+    public bool HasEvents => false;
+}
+```
+
+It does not expose sample rows, a generated timestamp, a selection, a Compare command, or any hardcoded restore state. Timeline event reading is introduced by the Timeline plan.
+
+`SettingsViewModel` exposes an `IReadOnlyList<ThemeMode> AvailableModes`, a `ThemeMode SelectedTheme`, and display labels exactly `Follow system`, `Light`, and `Dark`; assigning `SelectedTheme` calls `IThemeService.SetMode`. `AboutViewModel` exposes the Application-derived current version, `CheckForUpdatesCommand`, and `OpenReleaseNotesCommand`; it delegates user interaction to `WpfUpdatePresenter`/`IExternalLinkService` and never parses update or registry content.
+
+- [ ] **Step 3: Implement accessible declarative workspace views and the top bar.**
+
+Create `TimelineWorkspaceView` as a keyboard-focusable empty state, not a mock list. The only usable action in its body is the text explanation; do not add a fake `Create snapshot` control in this plan because the real backup workspace is not yet implemented.
+
+```xml
+<UserControl x:Class="WinRestoreKit.Wpf.Views.TimelineWorkspaceView"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="clr-namespace:WinRestoreKit.Wpf.ViewModels"
+             AutomationProperties.Name="Timeline workspace">
+  <Border Background="{DynamicResource WindowBackgroundBrush}" Padding="40">
+    <StackPanel MaxWidth="640" VerticalAlignment="Center">
+      <TextBlock Text="Timeline" FontSize="28" FontWeight="SemiBold"
+                 Foreground="{DynamicResource TextBrush}" />
+      <TextBlock Text="{Binding EmptyStateTitle}" Margin="0,20,0,0" FontSize="20"
+                 Foreground="{DynamicResource TextBrush}" />
+      <TextBlock Text="{Binding EmptyStateDescription}" Margin="0,8,0,0" TextWrapping="Wrap"
+                 Foreground="{DynamicResource MutedTextBrush}" />
+    </StackPanel>
+  </Border>
+</UserControl>
+```
+
+Create `SettingsView` with a labeled `ComboBox` bound two-way to `SelectedTheme`. Create `AboutView` with version text, a **Check for updates** button, and a labeled **Release notes** link/button. Both bind entirely to their view model commands. Set AutomationProperties names on all controls and retain keyboard focus through normal WPF controls.
+
+- [ ] **Step 4: Implement the MainWindow content host and XAML data templates.**
+
+Use a compact top bar with wordmark, `WorkflowLabel`, Settings, and About commands; it has no permanent sidebar. The grid has a minimum usable width of 1024 and a content host bound to `CurrentWorkspace`.
+
+```xml
+<Window x:Class="WinRestoreKit.Wpf.MainWindow"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        xmlns:views="clr-namespace:WinRestoreKit.Wpf.Views"
+        xmlns:vm="clr-namespace:WinRestoreKit.Wpf.ViewModels"
+        Title="WinRestoreKit" MinWidth="1024" MinHeight="640"
+        Background="{DynamicResource WindowBackgroundBrush}">
+  <Window.Resources>
+    <DataTemplate DataType="{x:Type vm:TimelineWorkspaceViewModel}"><views:TimelineWorkspaceView /></DataTemplate>
+    <DataTemplate DataType="{x:Type vm:SettingsViewModel}"><views:SettingsView /></DataTemplate>
+    <DataTemplate DataType="{x:Type vm:AboutViewModel}"><views:AboutView /></DataTemplate>
+  </Window.Resources>
+  <DockPanel>
+    <Border DockPanel.Dock="Top" Background="{DynamicResource SurfaceBrush}"
+            BorderBrush="{DynamicResource DividerBrush}" BorderThickness="0,0,0,1" Padding="24,14">
+      <Grid>
+        <Grid.ColumnDefinitions><ColumnDefinition /><ColumnDefinition Width="Auto" /><ColumnDefinition Width="Auto" /></Grid.ColumnDefinitions>
+        <StackPanel Orientation="Horizontal">
+          <TextBlock Text="WinRestoreKit" FontSize="16" FontWeight="SemiBold" Foreground="{DynamicResource TextBrush}" />
+          <TextBlock Text="{Binding WorkflowLabel}" Margin="18,2,0,0" Foreground="{DynamicResource MutedTextBrush}" />
+        </StackPanel>
+        <Button Grid.Column="1" Content="Settings" Command="{Binding ShowSettingsCommand}" AutomationProperties.Name="Settings" />
+        <Button Grid.Column="2" Content="About" Command="{Binding ShowAboutCommand}" Margin="8,0,0,0" AutomationProperties.Name="About" />
+      </Grid>
+    </Border>
+    <ContentControl Content="{Binding CurrentWorkspace}" />
+  </DockPanel>
+</Window>
+```
+
+The later Backup/Progress plan adds the real **Create snapshot** command and workspace at the same top-bar location; do not place a disabled button, a message-only action, or placeholder content there now.
+
+- [ ] **Step 5: Run WPF construction tests to verify they pass.**
+
+Run:
+
+```powershell
+dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj --filter FullyQualifiedName~WpfShellTests
+```
+
+Expected: PASS. The test constructs view models on STA, proves Timeline is the default and only empty-state workspace, proves no rail navigation is required, and validates Settings/About state transitions without opening a window or accessing network/registry state.
+
+- [ ] **Step 6: Commit the MVVM shell views.**
+
+```powershell
+git add src\WinRestoreKit.Wpf\Infrastructure src\WinRestoreKit.Wpf\ViewModels src\WinRestoreKit.Wpf\Views src\WinRestoreKit.Tests\WpfShellTests.cs
+git commit -m "feat: add WPF timeline shell empty state"
+```
+
+### Task 6: Compose WPF startup, implement framework adapters, and smoke-test both shells
+
+**Files:**
+- Modify: `src/WinRestoreKit.Wpf/App.xaml`
+- Modify: `src/WinRestoreKit.Wpf/App.xaml.cs`
+- Create: `src/WinRestoreKit.Wpf/MainWindow.xaml.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/WpfDispatcher.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/IRunPresentation.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/IRunDialogService.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/WpfRunUi.cs`
+- Create: `src/WinRestoreKit.Wpf/Services/WpfLogSink.cs`
+- Modify: `src/WinRestoreKit.Tests/WpfShellTests.cs`
+
+**Interfaces:**
+- Consumes: Application update/settings/orchestration contracts from Tasks 2–4; WPF services/theme/view models from Tasks 3–5; Core `ILogSink` and `Utils.UrlFailureUi` seam.
+- Produces: A real WPF process that creates Application settings/update/theme services, registers owner-bound error presentation, binds `MainWindow` to `ShellViewModel`, and opens the Timeline empty state. It also produces the exact run adapter contracts future workflow plans instantiate.
+
+- [ ] **Step 1: Write the failing WPF window-composition test.**
+
+Extend `WpfShellTests` to construct a `MainWindow` from a composed `ShellViewModel` and inspect its observable state. Do not call `Show`, create sample snapshots, or invoke network operations.
+
+```csharp
+[Fact]
+public void MainWindow_ComposesTheTimelineWorkspaceWithoutAnySnapshotRows()
+{
+    WpfTestHost.Run(() =>
+    {
+        ShellViewModel shell = CreateShell();
+        MainWindow window = new MainWindow(shell);
+        Assert.Equal("WinRestoreKit", window.Title);
+        Assert.Same(shell, window.DataContext);
+        Assert.IsType<TimelineWorkspaceViewModel>(shell.CurrentWorkspace);
+        Assert.False(((TimelineWorkspaceViewModel)shell.CurrentWorkspace).HasEvents);
+    });
+}
+```
+
+Run:
+
+```powershell
+dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj --filter FullyQualifiedName~WpfShellTests
+```
+
+Expected: FAIL to compile because `MainWindow` code-behind and WPF startup composition do not exist.
+
+- [ ] **Step 2: Implement WPF dispatcher, dialog, log, and run adapters with shell-owned modal behavior.**
+
+`WpfDispatcher` is a thin wrapper around `Dispatcher` used by adapters to check access and invoke work. `WpfLogSink` implements Core’s internal `ILogSink` and always dispatches append/clear callbacks rather than touching a view from a worker thread.
+
+```csharp
+internal sealed class WpfLogSink : ILogSink
+{
+    private readonly Dispatcher dispatcher;
+    private readonly Action<string> append;
+    private readonly Action clear;
+
+    internal WpfLogSink(Dispatcher dispatcher, Action<string> append, Action clear)
+    {
+        this.dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher));
+        this.append = append ?? throw new ArgumentNullException(nameof(append));
+        this.clear = clear ?? throw new ArgumentNullException(nameof(clear));
+    }
+
+    public void Append(string text) => dispatcher.BeginInvoke(append, text);
+    public void Clear() => dispatcher.BeginInvoke(clear);
+}
+```
+
+`WpfRunUi` implements every Application callback using the exact constructor and interfaces declared earlier. Progress and summary calls marshal to `IRunPresentation`; consent, snapshot override, and plan-composition methods invoke `IRunDialogService` synchronously on the WPF dispatcher. For the unchanged Core AppStore seam, it supplies the current shell `Window` only through the framework-neutral `object IRunUi.DialogOwner` property; Application never casts it or references WPF.
+
+```csharp
+internal T InvokeDialog<T>(Func<T> action)
+{
+    return dispatcher.CheckAccess() ? action() : dispatcher.Invoke(action);
+}
+
+object IRunUi.DialogOwner
+    => InvokeDialog(() => (object)ownerProvider());
+```
+
+The first concrete `IRunDialogService` implementations arrive with the real Confirm and Backup/Progress views. The adapter does not intercept or replace Core’s AppStore dialog seam.
+
+- [ ] **Step 3: Compose startup and register Core’s shell-owned URL failure seam.**
+
+`App.xaml` merges only the framework-independent control styles. `App.OnStartup` creates Application settings/update services, WPF theme/detector/dialog/link services, a WPF update presenter, the Shell VM, and the `MainWindow`; it calls `Show` only after the window is available as an owner. It registers `Utils.UrlFailureUi` with an action that dispatcher-marshals an owner-bound warning through `IWpfDialogService`.
+
+```xml
+<!-- src/WinRestoreKit.Wpf/App.xaml -->
+<Application x:Class="WinRestoreKit.Wpf.App"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
+  <Application.Resources>
+    <ResourceDictionary>
+      <ResourceDictionary.MergedDictionaries>
+        <ResourceDictionary Source="Themes/Controls.xaml" />
+      </ResourceDictionary.MergedDictionaries>
+    </ResourceDictionary>
+  </Application.Resources>
+</Application>
+```
+
+```csharp
+private WpfThemeService themes;
+
+protected override void OnStartup(StartupEventArgs e)
+{
+    base.OnStartup(e);
+
+    RegistryThemeSettings settings = new RegistryThemeSettings();
+    WpfDialogService dialogs = new WpfDialogService(Dispatcher, () => MainWindow);
+    themes = new WpfThemeService(Resources, settings, new WindowsThemeDetector());
+    WpfUpdatePresenter updates = new WpfUpdatePresenter(new UpdateCheckService(), dialogs,
+                                                         new ExternalLinkService());
+    ShellViewModel shell = new ShellViewModel(themes, updates,
+        VersionInfo.GetCurrentVersion(typeof(App).Assembly));
+    MainWindow window = new MainWindow(shell);
+
+    Utils.UrlFailureUi = (url, exception) => Dispatcher.BeginInvoke(() =>
+        dialogs.ShowWarning("Could not open this link in your browser:\n\n" + url + "\n\n" +
+                            exception.Message, "Unable to open link"));
+
+    MainWindow = window;
+    window.Show();
+}
+
+protected override void OnExit(ExitEventArgs e)
+{
+    themes?.Dispose();
+    base.OnExit(e);
+}
+```
+
+The `OnExit` override above disposes `WpfThemeService` before calling `base.OnExit(e)` so the static system-preference handler is always removed. Do not register a global exception policy, alter Core’s existing static app-restore seam, or start a backup/restore run in the shell startup.
+
+```csharp
+public partial class MainWindow : Window
+{
+    public MainWindow(ShellViewModel shell)
+    {
+        InitializeComponent();
+        DataContext = shell ?? throw new ArgumentNullException(nameof(shell));
+    }
+}
+```
+
+- [ ] **Step 4: Re-run the construction test and focused foundation tests.**
+
+Run:
+
+```powershell
+dotnet test src\WinRestoreKit.Tests\WinRestoreKit.Tests.csproj --filter "FullyQualifiedName~WpfShellTests|FullyQualifiedName~ThemeSettingsTests|FullyQualifiedName~ThemeServiceTests|FullyQualifiedName~VersionParsingTests|FullyQualifiedName~UpdateCheckVerdictTests|FullyQualifiedName~RunSummaryTests|FullyQualifiedName~RunCoordinatorTests|FullyQualifiedName~RunControlTests|FullyQualifiedName~BackupDestinationLifecycleTests"
+```
+
+Expected: PASS. Tests construct `MainWindow` on an STA, verify the default Timeline empty state, prove all theme/update/run contracts, and preserve the existing pure run/root tests.
+
+- [ ] **Step 5: Build both hosts and perform the real WPF smoke test.**
+
+Run:
+
+```powershell
+dotnet build src\WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj
+dotnet build src\WinRestoreKit\WinRestoreKit.csproj
+dotnet run --project src\WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj --no-build
+```
+
+Expected: both build commands PASS. The last command opens a `WinRestoreKit`-titled WPF window with the compact top bar, Timeline workflow label, and the exact empty state **No local snapshots are available.** / **Create a snapshot to begin protecting this PC.** It displays no fabricated snapshot rows, no permanent sidebar, no comparison/restore controls, and no backup/progress workflow. Use Settings to select Light, Dark, and Follow system; close the window normally after confirming each selection changes resources and persists `ThemeMode` under the product registry key. Open About, invoke **Check for updates** only if network access is available, and verify any result/error is owner-bound; use **Release notes** only to verify the existing URL error seam when a launch failure is forced in a controlled test environment.
+
+- [ ] **Step 6: Commit the runnable WPF foundation.**
+
+```powershell
+git add src\WinRestoreKit.Wpf\App.xaml src\WinRestoreKit.Wpf\App.xaml.cs src\WinRestoreKit.Wpf\MainWindow.xaml.cs src\WinRestoreKit.Wpf\Services\WpfDispatcher.cs src\WinRestoreKit.Wpf\Services\IRunPresentation.cs src\WinRestoreKit.Wpf\Services\IRunDialogService.cs src\WinRestoreKit.Wpf\Services\WpfRunUi.cs src\WinRestoreKit.Wpf\Services\WpfLogSink.cs src\WinRestoreKit.Tests\WpfShellTests.cs
+git commit -m "feat: compose runnable WPF application shell"
+```
+
+## Final Foundation Verification
+
+- [ ] Confirm `src/WinRestoreKit.Application/WinRestoreKit.Application.csproj` contains neither `UseWindowsForms` nor `UseWPF`, while `dotnet build` for it succeeds against Core.
+- [ ] Confirm `IRunUi` has `object DialogOwner` and no WinForms-typed `Owner` member; confirm `BackupRestoreOrchestrator` preserves the `AppStoreApps.RestoreAsync(currentRestorePath, ui.DialogOwner)` Core seam; confirm `RunSummary` has `RunSeverity` rather than `MessageBoxIcon`; and confirm the WinForms project still builds/runs through its updated `ProgressPageView` adapter.
+- [ ] Confirm no duplicate `BackupRootRegistry`, `RunControl`, `RunCoordinator`, `BackupRestoreOrchestrator`, `IRunUi`, `RunSummary`, or `UpdateCheck` source remains under the old WinForms paths.
+- [ ] Confirm WPF uses the new `ThemeMode` DWORD and resource dictionaries rather than WinForms `PaletteMode`/Voltage/Flux, with owner-bound settings/about/update interactions.
+- [ ] Confirm the side-by-side WPF project still links the existing manifest/icon and preserves the final single-file publish settings without consuming the legacy AssemblyInfo source or changing the temporary `WinRestoreKit.Wpf` identity.
+- [ ] Re-run the Task 6 focused test command, build both app projects, and repeat the real WPF window smoke test. Expected: all named tests/builds pass; the WPF app opens directly to the real empty Timeline workspace; the WinForms app remains runnable; no Timeline catalog, Compare, Confirm, backup workflow, progress UI, or cutover deletion has been introduced.
diff --git a/docs/superpowers/specs/2026-08-09-timeline-compare-wpf-shell-design.md b/docs/superpowers/specs/2026-08-09-timeline-compare-wpf-shell-design.md
new file mode 100644
index 0000000..f503b5b
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-09-timeline-compare-wpf-shell-design.md
@@ -0,0 +1,353 @@
+# WinRestoreKit Timeline + Compare WPF Shell Design
+
+**Date:** 2026-08-09  
+**Status:** Approved visual direction; written specification awaiting final review  
+**Approved direction:** Timeline + Comparison Workspace  
+**Target framework:** WPF on .NET 8 for Windows
+
+## 1. Objective
+
+Replace the current WinForms shell with a modern WPF application organized around two connected ideas:
+
+1. time selects the snapshot; and
+2. comparison selects what will be restored.
+
+The redesign must preserve the existing backup and restore engine, snapshot format, safety gates, local storage model, and self-contained `win-x64` executable. It must not reproduce the approved visual as a fragile owner-drawn WinForms skin.
+
+## 2. Why the Current Shell Is Being Replaced
+
+The current shell uses a permanent left rail, a large status headline, a four-cell metric strip, action buttons, and a lower dashboard grid. Typography and palette changes cannot overcome that repeated dashboard structure. The redesign therefore changes the information architecture rather than reskinning the same control tree.
+
+The rejected directions established these constraints:
+
+- no persistent navigation rail;
+- no generic sidebar + hero + metric cards + activity list composition;
+- no giant failure headline that replaces the normal workflow;
+- no decorative glass, glow, purple gradients, or multicolored category tiles;
+- no browser-only effects presented as feasible WinForms work; and
+- no invented comparison values unsupported by Core.
+
+## 3. Scope
+
+### 3.1 In scope
+
+- a WPF shell and WPF replacements for every current WinForms workflow;
+- Timeline as the home experience;
+- comparison of the current PC against an arbitrary verified snapshot;
+- honest module-level comparison states;
+- selection of whole modules into a restore set;
+- a confirmation stage that exposes restore impact and existing safety gates;
+- migration of backup selection, progress/results, history, settings, and about screens;
+- Follow system, Light, and Dark themes;
+- keyboard, scaling, reduced-motion, and UI Automation support;
+- WPF runtime, accessibility, and screenshot verification; and
+- preservation of self-contained single-file publishing.
+
+### 3.2 Deliberately staged
+
+Semantic before/after values and item-level restore are not required for the first WPF release. An optional Core-owned comparison adapter contract will allow modules to add verified semantic details later without redesigning the shell.
+
+### 3.3 Out of scope
+
+- changing the backup payload or manifest format;
+- rewriting `WinRestoreKit.Core` backup or restore behavior;
+- silently parsing registry exports in the WPF layer;
+- presenting guessed or synthesized before/after values;
+- replacing the local snapshot model with a database or cloud service;
+- adopting WinUI 3, MSIX, or a new installer in this redesign; and
+- retaining a permanent mixed WinForms/WPF production shell.
+
+## 4. Framework and Project Architecture
+
+### 4.1 Framework decision
+
+WPF is the approved balance of polish, accessibility, deployment stability, and migration cost. It provides templated controls, retained-mode drawing, transitions, scalable typography, shadows, and responsive layout without the packaging changes required by WinUI 3.
+
+### 4.2 Project layout
+
+During migration, add a side-by-side WPF application project under `src/WinRestoreKit.Wpf/`. It references `src/WinRestoreKit.Core/` and uses the existing Core contracts rather than copying engine code.
+
+At cutover:
+
+- `WinRestoreKit.Wpf` becomes the only shipping application project;
+- its assembly and executable names remain `WinRestoreKit`;
+- the old WinForms application project, views, forms, designer files, and WinForms-only controls are removed;
+- the solution, publish command, tests, documentation, and release workflow target the WPF project; and
+- no compatibility shell or deprecated WinForms entry point remains.
+
+The temporary side-by-side period exists only to preserve a runnable baseline during migration.
+
+### 4.3 Layering
+
+- **WinRestoreKit.Core:** snapshot discovery, payload preparation, modules, comparison evidence, backup/restore orchestration inputs, results, and safety decisions.
+- **WPF application services:** thin adapters for Core operations, WPF dispatcher ownership, dialog ownership, and application lifetime.
+- **View models:** presentation state, commands, selection, cancellation, and navigation state. They do not import or restore data directly.
+- **Views and controls:** rendering, input, automation peers, responsive layout, and theme resources. They contain no backup or restore policy.
+
+## 5. Application Structure and Navigation
+
+The shell has no permanent sidebar. A compact top bar contains the wordmark, current workflow indicator, Settings, and **Create snapshot**.
+
+The primary restore workflow is a continuous three-stage workspace:
+
+1. **Timeline** — select a verified snapshot.
+2. **Compare** — compare the selected snapshot with the current PC and select modules.
+3. **Confirm** — review selected modules and restore impact, then explicitly start restore.
+
+Timeline is the default home state. Secondary destinations such as raw run logs, advanced module inventory, About, and theme settings are compact commands rather than permanent navigation destinations.
+
+Creating a snapshot opens the migrated backup-selection workflow. Progress and results return to the timeline as a new verified snapshot or failed-attempt event.
+
+## 6. Timeline
+
+### 6.1 Data source
+
+Timeline reads the existing backup-folder and manifest data. It orders events by actual creation time and distinguishes:
+
+- verified snapshots;
+- incomplete or partial snapshots;
+- failed backup attempts; and
+- unreadable entries.
+
+A failed attempt remains visible for diagnosis but is never selectable as a restore source. Unreadable entries expose their real error and never masquerade as empty snapshots.
+A failed attempt survives application restart only when the existing backup flow retained a folder, manifest, or log that can be discovered safely. Folder-creation failures and cancellations whose cleanup removed the output are shown as current-session events only. Timeline must never weaken cleanup or retain an unsafe incomplete folder merely to make an event durable.
+
+### 6.2 Interaction
+
+- Left and Right arrow keys move among timeline events.
+- Enter selects a verified or partial snapshot and opens Compare.
+- Failed and unreadable events open diagnostic detail only.
+- The visual timeline has an equivalent list presentation for narrow layouts and UI Automation.
+- Selecting a compressed snapshot prepares a private read scope through the existing payload-validation path.
+- Selection and comparison are read-only and never mutate the live system or snapshot directory.
+
+## 7. Comparison Workspace
+
+### 7.1 First-release granularity
+
+Each comparison row represents one registered module. A row has exactly one evidence state:
+
+- **Changed:** Core proved current state differs from the selected snapshot.
+- **Same:** Core proved current state matches the selected snapshot.
+- **Unavailable:** Core cannot establish a trustworthy comparison and supplies a reason.
+- **Not captured:** the selected snapshot lacks a usable artifact for the module.
+
+The default filter is **All modules** so modules that cannot yet prove Changed or Same remain visible. Users may switch to **Changed only** after results are available.
+
+### 7.2 Comparison pipeline
+
+1. The selected snapshot payload is prepared for read.
+2. Module registrations are enumerated in catalog order.
+3. Artifact availability is derived from manifest evidence and the existing `BackupBase.HasArtifactIn(preparedPayloadPath)` fallback, using the same precedence as restore-content discovery. A proven absence becomes Not captured; an indeterminate or throwing probe becomes Unavailable.
+4. For a module with a usable artifact, Core calls its existing `BackupBase.HasDriftedFrom(preparedPayloadPath)` contract. `true` maps to Changed, `false` maps to Same, and `null` maps to Unavailable. Registry-backed modules use Core's normalized fresh-export comparison; modules that deliberately cannot make a trustworthy comparison remain Unavailable.
+5. These probes execute asynchronously with bounded concurrency and cancellation. No comparison calls `Backup`, writes into the selected snapshot, or asks the WPF layer to parse artifacts.
+6. Each module produces an independent result; one exception becomes one Unavailable row rather than aborting the workspace.
+7. Results stream into the view model without reordering the catalog.
+8. Canceling comparison stops pending probes and disposes temporary payloads.
+
+### 7.3 Optional semantic adapters
+
+Core may define an optional comparison-provider contract for modules capable of producing verified semantic details. Such a provider returns structured labels and snapshot/current values with explicit confidence and restore granularity.
+
+The WPF layer never derives semantic values from registry or payload text. When a provider is absent, the detail tray shows module-level evidence, captured artifacts, comparison availability, and restore impact only.
+
+### 7.4 Restore selection
+
+The first WPF release selects whole modules. A module can be added to the restore set only when the selected snapshot contains a usable restore artifact. Unavailable comparison does not automatically prohibit restore, but the row must clearly state that equivalence could not be measured.
+
+The restore set exists in memory until confirmation or cancellation. Changing the selected timeline snapshot clears the restore set after explicit confirmation if it is non-empty.
+
+## 8. Detail Tray and Confirm Stage
+
+Selecting a comparison row opens a temporary detail tray containing:
+
+- module title and group;
+- evidence state and reason;
+- captured artifact summary;
+- optional semantic values supplied by Core;
+- affected applications or processes;
+- Explorer restart or sign-out requirements declared by existing module/Core contracts. The first WPF release does not infer or advertise reboot impact without a structured Core declaration;
+- an explicit Add to restore or Remove from restore action.
+
+The Confirm stage lists all selected modules, grouped by impact. It identifies process closures and machine-state changes before execution. It then invokes the existing snapshot gate and restore orchestration path.
+
+Partial or incomplete snapshots remain visually distinct. Existing incomplete-snapshot consent is mandatory immediately before any restore write. The WPF shell cannot bypass, pre-answer, or downgrade that decision.
+
+## 9. Backup, Progress, Results, and History
+
+### 9.1 Create snapshot
+
+**Create snapshot** is always available in the top bar when no run is active. It opens the migrated backup-selection workflow with the same module catalog, scope behavior, destination containment rules, naming rules, and compression options as the current application.
+
+### 9.2 Progress and results
+
+A running operation replaces the workspace content with progress while retaining the shell. It uses existing run-control and outcome semantics. Cancellation, rollback, application closure, Explorer restart, and shutdown behavior remain engine-owned.
+
+After completion, the result appears on the timeline:
+
+- a verified snapshot becomes a selectable snapshot event;
+- an incomplete or partial result is labeled honestly;
+- a failed attempt is diagnostic-only; and
+- late cancellation must not relabel an already completed run.
+
+### 9.3 History
+
+Timeline subsumes the primary History navigation. Advanced history remains available as a searchable list with exact timestamps, machine names, paths, manifest state, sizes, and logs. It is an alternate representation of the same event model, not a separate source of truth.
+
+## 10. Visual System
+
+### 10.1 Character
+
+The application should resemble a first-party Windows utility: calm, precise, and task-focused. It must not read as a gamer dashboard, generated SaaS template, or themed legacy form.
+
+### 10.2 Themes and color
+
+Replace Voltage and Flux naming with:
+
+- Follow system;
+- Light; and
+- Dark.
+
+Use neutral Windows surfaces, one mineral-blue action color, and one restrained coral warning color. Status always includes text and an icon; color alone carries no meaning.
+
+### 10.3 Typography and icons
+
+- Segoe UI Variable for interface text.
+- A packaged monospace face only for logs, registry paths, and technical identifiers.
+- Fluent system icons paired with labels for primary actions.
+- No icon-only destructive control.
+
+### 10.4 Geometry and effects
+
+- 6–10 px corner radii for controls and temporary surfaces.
+- Mostly flat panes with borders or tonal separation.
+- Shadows only on temporary layers such as dialogs and the detail tray.
+- No Mica dependency, blur, glow, purple gradient, or decorative chart.
+
+### 10.5 Motion
+
+Selection, filtering, and tray transitions use 120–180 ms motion. Follow Windows reduced-motion settings and remove nonessential animation when reduced motion is enabled.
+
+## 11. Responsive and Accessible Behavior
+
+- Support 100%, 125%, 150%, 175%, and 200% DPI.
+- Support a minimum usable window width of 1024 px.
+- At narrow widths, comparison panes stack vertically rather than clipping.
+- Timeline, comparison rows, restore selection, and confirmation have visible keyboard focus.
+- Arrow keys move through the timeline; standard navigation moves through rows and actions.
+- Every custom visual exposes UI Automation names, roles, states, and actions.
+- The timeline has a list fallback that provides equivalent information and actions.
+- Text contrast meets at least 4.5:1 for normal text.
+- Focus, selected, unavailable, changed, and warning states remain distinguishable without color.
+
+## 12. Errors, Cancellation, and Cleanup
+
+- Payload preparation failures disable Compare and Restore for the affected entry and display the real reason.
+- Per-module comparison exceptions produce Unavailable rows with diagnostic text and logs.
+- The shell does not convert errors into “nothing found.”
+- Comparison cancellation is explicit, awaited, and disposes any private payload read scope.
+- Navigating away from an active comparison requests cancellation before discarding the view model.
+- Restore cancellation continues to use existing rollback and outcome semantics.
+- User-visible errors use owner-bound WPF dialogs or inline error states; no ownerless message boxes remain.
+- Errors continue through existing logging and result contracts.
+
+## 13. Migration Strategy
+
+1. Add the WPF shell project, shared theme resources, application services, and view-model test project support.
+2. Build the event model and Timeline against existing manifests.
+3. Add read-only arbitrary-snapshot module comparison and cancellation.
+4. Add restore-set construction and Confirm using existing restore gates.
+5. Migrate backup selection, progress/results, and advanced history.
+6. Migrate Settings, About, dialogs, and remaining app-owned seams.
+7. Verify feature parity, runtime behavior, accessibility, scaling, themes, and publishing.
+8. Make WPF the only shipping application project and remove the WinForms shell cleanly.
+
+WinForms remains runnable during steps 1–6. No new product feature is added only to the old shell during migration unless required for a safety fix.
+
+## 14. Testing and Verification
+
+### 14.1 Preserve existing coverage
+
+All existing Core, module, payload, manifest, orchestration, restore-safety, and outcome tests remain green. Tests that only assert WinForms control construction are replaced by tests of the new observable WPF contract rather than mechanically ported.
+
+### 14.2 New deterministic tests
+
+Add tests for:
+
+- timeline ordering and stable tie-breaking;
+- verified, partial, failed, and unreadable event classification;
+- failed attempts being non-restorable;
+- arbitrary snapshot selection and payload preparation;
+- Changed, Same, Unavailable, and Not captured comparison states;
+- per-module exception isolation;
+- comparison cancellation and temporary-payload cleanup;
+- restore-set add/remove/clear behavior;
+- restore-set invalidation when changing snapshot;
+- confirmation impact grouping;
+- incomplete-snapshot consent before execution;
+- semantic-provider presence and absence; and
+- theme and settings persistence decisions.
+
+### 14.3 WPF runtime verification
+
+Run the built application on a real Windows desktop and verify:
+
+- startup and main-window construction;
+- Timeline selection and accessible list parity;
+- comparison loading, filtering, selection, and cancellation;
+- keyboard-only Timeline → Compare → Confirm traversal;
+- owner-bound confirmation and error dialogs;
+- backup, progress, results, and restore smoke paths;
+- light, dark, and follow-system switching;
+- reduced-motion behavior;
+- 100%, 150%, and 200% DPI; and
+- narrow-width stacked comparison layout.
+
+### 14.4 Visual regression
+
+Capture deterministic screenshot baselines for:
+
+- Light and Dark themes;
+- normal, failed-attempt, partial-snapshot, and unreadable states;
+- Timeline, Compare, and Confirm stages;
+- 100%, 150%, and 200% DPI; and
+- minimum supported width.
+
+### 14.5 Release verification
+
+Publish the final WPF application as self-contained `win-x64`. Verify the produced executable on a clean machine or equivalent Windows environment, including:
+
+- single-file startup;
+- elevated manifest behavior;
+- packaged fonts and icons;
+- title-bar and theme behavior;
+- backup destination resolution from the executable directory; and
+- update-check version coherence.
+
+## 15. Acceptance Criteria
+
+The redesign is complete only when all of the following are true:
+
+1. Timeline + Compare is the shipping home and restore workflow.
+2. The application has no permanent sidebar or dashboard stat-card home.
+3. The WPF shell exposes all current product workflows.
+4. Comparison displays only evidence Core can support.
+5. Restore selection is whole-module and requires explicit confirmation.
+6. Existing snapshot gates and restore safety behavior remain enforced.
+7. Failed attempts are visible but non-restorable.
+8. Light, Dark, and Follow system themes meet the approved visual system.
+9. Keyboard, UI Automation, reduced motion, DPI, and narrow-width requirements pass runtime verification.
+10. Existing relevant tests and all new deterministic tests pass.
+11. The final self-contained executable passes real Windows smoke verification.
+12. The obsolete WinForms shell, controls, dialogs, and compatibility paths are removed.
+
+## 16. Approved Decisions
+
+- Structural direction: Timeline combined with Before / After comparison.
+- Framework: WPF on .NET 8.
+- Migration: side-by-side until parity, followed by clean WinForms removal.
+- Comparison depth: staged; module-level first, optional semantic adapters later.
+- Restore granularity: whole module in the first WPF release.
+- Visual system: Windows-native neutral surfaces, mineral blue, restrained coral, Light/Dark/System themes.
+- Distribution: preserve the self-contained single-file executable.
+- Safety: comparison is read-only; existing snapshot and restore gates remain authoritative.
diff --git a/src/WinRestoreKit.Application/AppRestore/AppRestoreService.cs b/src/WinRestoreKit.Application/AppRestore/AppRestoreService.cs
new file mode 100644
index 0000000..5df9b35
--- /dev/null
+++ b/src/WinRestoreKit.Application/AppRestore/AppRestoreService.cs
@@ -0,0 +1,270 @@
+using Conf;
+using Newtonsoft.Json.Linq;
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace WinRestoreKit
+{
+    internal enum AppExportState
+    {
+        Ok,
+        Absent,
+        Unreadable
+    }
+
+    internal enum AppRestoreProblemRouting
+    {
+        None,
+        ShowNow,
+        Defer
+    }
+
+    internal sealed class AppRestoreSource
+    {
+        internal AppRestoreSource(string path, string displayName, bool isSelectedRestoreSource)
+        {
+            Path = path ?? string.Empty;
+            DisplayName = displayName ?? string.Empty;
+            IsSelectedRestoreSource = isSelectedRestoreSource;
+        }
+
+        public string Path { get; }
+        public string DisplayName { get; }
+        public bool IsSelectedRestoreSource { get; }
+    }
+
+    internal sealed class AppExport
+    {
+        private AppExport(AppExportState state, IReadOnlyList<string> packageIdentifiers, string message)
+        {
+            State = state;
+            PackageIdentifiers = packageIdentifiers == null
+                ? Array.Empty<string>()
+                : Array.AsReadOnly(packageIdentifiers.ToArray());
+            Message = message ?? string.Empty;
+        }
+
+        internal AppExportState State { get; }
+        internal IReadOnlyList<string> PackageIdentifiers { get; }
+        internal string Message { get; }
+        internal bool IsProblem => State == AppExportState.Unreadable;
+
+        internal static AppExport Ok(IReadOnlyList<string> ids, string message) =>
+            new AppExport(AppExportState.Ok, ids, message);
+        internal static AppExport Absent(string message) =>
+            new AppExport(AppExportState.Absent, null, message);
+        internal static AppExport Unreadable(string message) =>
+            new AppExport(AppExportState.Unreadable, null, message);
+    }
+
+    internal sealed class AppRestoreListState
+    {
+        internal AppRestoreListState(IReadOnlyList<string> items, bool installEnabled)
+        {
+            Items = items == null ? Array.Empty<string>() : Array.AsReadOnly(items.ToArray());
+            InstallEnabled = installEnabled;
+        }
+
+        internal IReadOnlyList<string> Items { get; }
+        internal bool InstallEnabled { get; }
+    }
+
+    internal sealed class AppRestoreOutcome
+    {
+        internal AppRestoreOutcome(string caption, string text, RunSeverity severity)
+            => (Caption, Text, Severity) = (caption ?? string.Empty, text ?? string.Empty, severity);
+
+        internal string Caption { get; }
+        internal string Text { get; }
+        internal RunSeverity Severity { get; }
+    }
+
+    internal static class AppRestoreService
+    {
+        internal static IReadOnlyList<AppRestoreSource> BuildSources(string selectedRestorePath,
+            IReadOnlyList<SnapshotEvent> snapshots)
+        {
+            var sources = new List<AppRestoreSource>();
+            AddDistinct(sources, selectedRestorePath, "Selected restore source", true);
+
+            foreach (SnapshotEvent snapshot in snapshots ?? Array.Empty<SnapshotEvent>())
+            {
+                if (snapshot == null || !snapshot.IsRestorable)
+                    continue;
+
+                AddDistinct(sources, snapshot.CanonicalPath, snapshot.DisplayName, false);
+            }
+
+            return Array.AsReadOnly(sources.ToArray());
+        }
+
+        internal static AppRestoreListState ComposeListState(AppExport export) =>
+            export == null
+                ? new AppRestoreListState(null, false)
+                : new AppRestoreListState(export.PackageIdentifiers, export.PackageIdentifiers.Count > 0);
+
+        internal static AppRestoreProblemRouting RouteProblem(AppExport export, bool windowShown)
+        {
+            if (export == null || !export.IsProblem)
+                return AppRestoreProblemRouting.None;
+
+            return windowShown ? AppRestoreProblemRouting.ShowNow : AppRestoreProblemRouting.Defer;
+        }
+
+        internal static AppExport ReadFromSource(string sourcePath)
+        {
+            if (!BackupPayload.TryPrepareForRead(sourcePath, out BackupPayload.ReadScope scope, out string error))
+                return AppExport.Unreadable("Could not prepare the app export source: " + error);
+
+            using (scope)
+                return ReadExport(AppStoreApps.ExportPathIn(scope.Path));
+        }
+
+        internal static Task<AppRestoreOutcome> InstallAsync(IReadOnlyList<string> packageIdentifiers,
+            Func<bool> stopRequested) =>
+            InstallAsync(packageIdentifiers, id => Utils.RunWingetAsync(true, "install", "--id", id,
+                "--accept-source-agreements", "--accept-package-agreements"), stopRequested);
+
+        internal static async Task<AppRestoreOutcome> InstallAsync(IReadOnlyList<string> packageIdentifiers,
+            Func<string, Task<ProcessOutcome>> installOneAsync, Func<bool> stopRequested)
+        {
+            string[] requested = (packageIdentifiers ?? Array.Empty<string>())
+                .Where(identifier => !string.IsNullOrWhiteSpace(identifier)).ToArray();
+            var failures = new List<string>();
+            int attempted = 0;
+
+            foreach (string identifier in requested)
+            {
+                if (stopRequested?.Invoke() == true)
+                    break;
+
+                attempted++;
+                string reason = Describe(await installOneAsync(identifier));
+                if (reason != null)
+                    failures.Add(identifier + ": " + reason);
+            }
+
+            return ComposeOutcome(requested.Length, attempted, failures);
+        }
+
+        internal static string Describe(ProcessOutcome outcome)
+        {
+            if (outcome == null)
+                return "winget returned no outcome";
+            if (!outcome.Started)
+                return "could not run winget: " + outcome.Error;
+            if (outcome.TimedOut)
+                return "winget did not finish, and was stopped";
+            if (outcome.Error != null)
+                return "winget ran but its outcome could not be determined: " + outcome.Error;
+            return outcome.ExitCode != 0 ? "winget exited with code " + outcome.ExitCode : null;
+        }
+
+        internal static AppRestoreOutcome ComposeOutcome(int requested, int attempted,
+            IReadOnlyList<string> failures)
+        {
+            int failed = failures?.Count ?? 0;
+            string failureList = failures == null ? string.Empty : string.Join("\n", failures);
+            bool stoppedEarly = attempted < requested;
+            int notStarted = requested - attempted;
+
+            if (requested == 0)
+                return new AppRestoreOutcome("Nothing to do", "No apps were ticked, so nothing was installed.",
+                    RunSeverity.Information);
+
+            if (stoppedEarly)
+            {
+                string stopped = $"Stopped after {attempted} of {requested} app(s). The remaining {notStarted} were not started.";
+                if (failed == 0)
+                    return new AppRestoreOutcome("Stopped", stopped + $"\n\nwinget installed {attempted} app(s).",
+                        RunSeverity.Information);
+
+                return new AppRestoreOutcome("Stopped, and some apps failed",
+                    stopped + $"\n\n{failed} of the {attempted} attempted failed:\n\n{failureList}",
+                    RunSeverity.Warning);
+            }
+
+            if (failed == 0)
+                return new AppRestoreOutcome("Done",
+                    $"winget installed {attempted} app(s).\n\nAlready-installed apps are upgraded to the current version rather than put back at the backed-up one.",
+                    RunSeverity.Information);
+
+            return new AppRestoreOutcome("Some apps did not install",
+                $"{failed} of {attempted} app(s) did not install:\n\n{failureList}", RunSeverity.Warning);
+        }
+
+        private static void AddDistinct(List<AppRestoreSource> sources, string path, string displayName,
+            bool isSelectedRestoreSource)
+        {
+            if (string.IsNullOrWhiteSpace(path))
+                return;
+
+            string canonicalPath;
+            try
+            {
+                canonicalPath = Path.GetFullPath(path);
+            }
+            catch (Exception)
+            {
+                return;
+            }
+
+            if (sources.Any(source => string.Equals(source.Path, canonicalPath,
+                StringComparison.OrdinalIgnoreCase)))
+                return;
+
+            sources.Add(new AppRestoreSource(canonicalPath, displayName, isSelectedRestoreSource));
+        }
+
+        private static AppExport ReadExport(string path)
+        {
+            if (string.IsNullOrWhiteSpace(path))
+                return AppExport.Absent("No app export path could be worked out, so no apps are listed.");
+
+            string json;
+            try
+            {
+                json = File.ReadAllText(path);
+            }
+            catch (FileNotFoundException)
+            {
+                return AppExport.Absent("This backup contains no app export (" + path +
+                    "), so there are no apps to list for it.");
+            }
+            catch (Exception ex)
+            {
+                return AppExport.Unreadable("Could not read the app export at " + path + ": " + ex.Message);
+            }
+
+            if (string.IsNullOrWhiteSpace(json))
+                return AppExport.Unreadable("The app export at " + path + " is empty.");
+
+            JArray packages;
+            try
+            {
+                packages = JObject.Parse(json)["Sources"]?.FirstOrDefault()?["Packages"] as JArray;
+            }
+            catch (Exception ex)
+            {
+                return AppExport.Unreadable("The app export at " + path + " is not valid JSON: " + ex.Message);
+            }
+
+            if (packages == null)
+                return AppExport.Unreadable("The app export at " + path +
+                    " has no list of packages in it, so nothing could be restored from it.");
+
+            var identifiers = new List<string>();
+            foreach (JToken package in packages)
+            {
+                string identifier = package?.Value<string>("PackageIdentifier");
+                if (!string.IsNullOrWhiteSpace(identifier))
+                    identifiers.Add(identifier);
+            }
+
+            return AppExport.Ok(identifiers, "Read " + identifiers.Count + " app(s) from " + path + ".");
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Application/Backup/BackupCompletionPublisher.cs b/src/WinRestoreKit.Application/Backup/BackupCompletionPublisher.cs
new file mode 100644
index 0000000..4683ef2
--- /dev/null
+++ b/src/WinRestoreKit.Application/Backup/BackupCompletionPublisher.cs
@@ -0,0 +1,44 @@
+using System;
+using System.IO;
+using System.Linq;
+
+namespace WinRestoreKit
+{
+    internal sealed class BackupCompletionPublisher
+    {
+        private readonly SnapshotEventCatalog catalog;
+
+        internal BackupCompletionPublisher(SnapshotEventCatalog catalog)
+            => this.catalog = catalog ?? throw new ArgumentNullException(nameof(catalog));
+
+        internal void Publish(string attemptedBackupPath, string displayName,
+            RunSummary summary, DateTime created)
+        {
+            string canonicalPath = TryCanonicalize(attemptedBackupPath);
+            bool retained = canonicalPath != null && catalog.Read().Any(snapshot =>
+                string.Equals(snapshot.CanonicalPath, canonicalPath,
+                    StringComparison.OrdinalIgnoreCase));
+
+            if (retained)
+                return;
+
+            string diagnostic = summary?.Detail;
+            if (string.IsNullOrWhiteSpace(diagnostic))
+                diagnostic = "The snapshot run ended without a retained recognizable result.";
+
+            catalog.RecordSessionFailure(created, displayName ?? string.Empty, diagnostic);
+        }
+
+        private static string TryCanonicalize(string path)
+        {
+            try
+            {
+                return Path.GetFullPath(path);
+            }
+            catch (Exception)
+            {
+                return null;
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Application/Backup/BackupPresets.cs b/src/WinRestoreKit.Application/Backup/BackupPresets.cs
new file mode 100644
index 0000000..9ac9a85
--- /dev/null
+++ b/src/WinRestoreKit.Application/Backup/BackupPresets.cs
@@ -0,0 +1,13 @@
+using System.Collections.Generic;
+
+namespace WinRestoreKit
+{
+    public static class BackupPresets
+    {
+        public static readonly IReadOnlyList<string> DeveloperMachine =
+            new[] { "ETerminal", "EVSCode", "ESsh", "EEnvironment", "EHosts" };
+
+        public static readonly IReadOnlyList<string> MinimalPrivacySafeExclusions =
+            new[] { "WUpdates", "EEnvironment", "EEnvironmentFiltered", "CWiFiConf" };
+    }
+}
diff --git a/src/WinRestoreKit/Views/ScopeGroups.cs b/src/WinRestoreKit.Application/Backup/ScopeGroups.cs
similarity index 75%
rename from src/WinRestoreKit/Views/ScopeGroups.cs
rename to src/WinRestoreKit.Application/Backup/ScopeGroups.cs
index eb1763d..b38c756 100644
--- a/src/WinRestoreKit/Views/ScopeGroups.cs
+++ b/src/WinRestoreKit.Application/Backup/ScopeGroups.cs
@@ -2,72 +2,58 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
-using WinRestoreKit;
 
-namespace Views
+namespace WinRestoreKit
 {
-    internal sealed class ScopeGroupRow
+    public sealed class ScopeGroupRow
     {
-        internal ScopeGroupRow(string name, string detail, string sizeLabel, bool defaultChecked,
-                               bool requiresExplicitOptIn, string cautionNote,
-                               IReadOnlyList<BackupBase> modules)
+        internal ScopeGroupRow(string name, string detail, bool defaultChecked,
+            bool requiresExplicitOptIn, string cautionNote, IReadOnlyList<BackupBase> modules)
         {
             Name = name;
             Detail = detail;
-            SizeLabel = sizeLabel;
             DefaultChecked = defaultChecked;
             RequiresExplicitOptIn = requiresExplicitOptIn;
             CautionNote = cautionNote ?? string.Empty;
             Modules = modules;
         }
 
-        internal string Name { get; }
+        public string Name { get; }
 
-        internal string Detail { get; }
+        public string Detail { get; }
 
-        internal string SizeLabel { get; }
+        public bool DefaultChecked { get; }
 
-        internal bool DefaultChecked { get; }
+        public bool RequiresExplicitOptIn { get; }
 
-        /// <summary>
-        /// Gets whether this scope must remain unchecked until the user deliberately selects it.
-        /// </summary>
-        internal bool RequiresExplicitOptIn { get; }
+        public string CautionNote { get; }
 
-        /// <summary>
-        /// Gets the source-module warning displayed before a user selects this scope.
-        /// </summary>
-        internal string CautionNote { get; }
-
-        internal IReadOnlyList<BackupBase> Modules { get; }
+        public IReadOnlyList<BackupBase> Modules { get; }
     }
 
-    internal static class ScopeGroups
+    public static class ScopeGroups
     {
         private const int DetailLimit = 96;
 
         private static readonly ScopeDefinition[] Definitions =
         {
-            new ScopeDefinition("Registry branches", static module => false),
             new ScopeDefinition("Explorer & shell", IsExplorerAndShell),
             new ScopeDefinition("Power & devices", IsPowerAndDevices),
-            new ScopeDefinition("Installed drivers", static module => false),
             new ScopeDefinition("Fonts", static module => module is WFonts),
-            new ScopeDefinition("Scheduled tasks", static module => false),
             new ScopeDefinition("Network profiles", IsNetworkProfile),
             new ScopeDefinition("Environment variables (unfiltered)", static module => module is EEnvironment,
                 requiresExplicitOptIn: true, cautionNoteFactory: static modules => modules.Single().WarningMessage),
             new ScopeDefinition("App settings (AppData)", IsAppSetting)
         };
 
-        internal static IReadOnlyList<ScopeGroupRow> Build()
+        public static IReadOnlyList<ScopeGroupRow> Build()
         {
-            IReadOnlyList<ModuleRegistration> registrations = ModuleCatalog.CreateAll();
+            IReadOnlyList<BackupModuleRegistration> registrations = BackupModuleCatalog.CreateAll();
             Dictionary<ScopeDefinition, List<BackupBase>> modulesByScope = Definitions.ToDictionary(
                 definition => definition,
                 definition => new List<BackupBase>());
 
-            foreach (ModuleRegistration registration in registrations)
+            foreach (BackupModuleRegistration registration in registrations)
             {
                 ScopeDefinition match = null;
 
@@ -77,15 +63,19 @@ internal static IReadOnlyList<ScopeGroupRow> Build()
                         continue;
 
                     if (match != null)
+                    {
                         throw new InvalidOperationException(
                             $"Module '{registration.Module.GetType().FullName}' belongs to multiple backup scopes.");
+                    }
 
                     match = definition;
                 }
 
                 if (match == null)
+                {
                     throw new InvalidOperationException(
                         $"Module '{registration.Module.GetType().FullName}' has no backup scope.");
+                }
 
                 modulesByScope[match].Add(registration.Module);
             }
@@ -94,13 +84,11 @@ internal static IReadOnlyList<ScopeGroupRow> Build()
                 .Select(definition =>
                 {
                     IReadOnlyList<BackupBase> modules = modulesByScope[definition];
-
                     string cautionNote = definition.CautionNoteFactory?.Invoke(modules) ?? string.Empty;
 
                     return new ScopeGroupRow(
                         definition.Name,
                         modules.Count == 0 ? "No supported items detected" : Truncate(modules[0].Info),
-                        "--",
                         !definition.RequiresExplicitOptIn && modules.Any(module => module.IsInstalled()),
                         definition.RequiresExplicitOptIn,
                         cautionNote,
@@ -152,11 +140,21 @@ or ESsh
                 or EEnvironmentFiltered;
         }
 
+        private static string Truncate(string value)
+        {
+            string singleLine = string.Join(" ", (value ?? string.Empty)
+                .Split((char[])null, StringSplitOptions.RemoveEmptyEntries));
+
+            return singleLine.Length <= DetailLimit
+                ? singleLine
+                : singleLine.Substring(0, DetailLimit - 3).TrimEnd() + "...";
+        }
+
         private sealed class ScopeDefinition
         {
             internal ScopeDefinition(string name, Func<BackupBase, bool> includes,
-                                     bool requiresExplicitOptIn = false,
-                                     Func<IReadOnlyList<BackupBase>, string> cautionNoteFactory = null)
+                bool requiresExplicitOptIn = false,
+                Func<IReadOnlyList<BackupBase>, string> cautionNoteFactory = null)
             {
                 Name = name;
                 Includes = includes;
@@ -172,15 +170,5 @@ internal ScopeDefinition(string name, Func<BackupBase, bool> includes,
 
             internal Func<IReadOnlyList<BackupBase>, string> CautionNoteFactory { get; }
         }
-
-        private static string Truncate(string value)
-        {
-            string singleLine = string.Join(" ", (value ?? string.Empty)
-                .Split((char[])null, StringSplitOptions.RemoveEmptyEntries));
-
-            return singleLine.Length <= DetailLimit
-                ? singleLine
-                : singleLine.Substring(0, DetailLimit - 3).TrimEnd() + "...";
-        }
     }
 }
diff --git a/src/WinRestoreKit.Application/Comparison/ComparisonState.cs b/src/WinRestoreKit.Application/Comparison/ComparisonState.cs
new file mode 100644
index 0000000..213e005
--- /dev/null
+++ b/src/WinRestoreKit.Application/Comparison/ComparisonState.cs
@@ -0,0 +1,10 @@
+namespace WinRestoreKit
+{
+    public enum ComparisonState
+    {
+        Changed,
+        Same,
+        Unavailable,
+        NotCaptured
+    }
+}
diff --git a/src/WinRestoreKit.Application/Comparison/ModuleComparison.cs b/src/WinRestoreKit.Application/Comparison/ModuleComparison.cs
new file mode 100644
index 0000000..233277f
--- /dev/null
+++ b/src/WinRestoreKit.Application/Comparison/ModuleComparison.cs
@@ -0,0 +1,27 @@
+using System;
+
+namespace WinRestoreKit
+{
+    public sealed class ModuleComparison
+    {
+        internal ModuleComparison(BackupBase module, ComparisonState state,
+                                  bool hasUsableArtifact, string artifactSummary, string reason)
+        {
+            Module = module ?? throw new ArgumentNullException(nameof(module));
+            State = state;
+            HasUsableArtifact = hasUsableArtifact;
+            ArtifactSummary = artifactSummary ?? string.Empty;
+            Reason = reason ?? string.Empty;
+        }
+
+        public BackupBase Module { get; }
+
+        public ComparisonState State { get; }
+
+        public bool HasUsableArtifact { get; }
+
+        public string ArtifactSummary { get; }
+
+        public string Reason { get; }
+    }
+}
diff --git a/src/WinRestoreKit.Application/Comparison/SnapshotComparisonService.cs b/src/WinRestoreKit.Application/Comparison/SnapshotComparisonService.cs
new file mode 100644
index 0000000..3d99dfd
--- /dev/null
+++ b/src/WinRestoreKit.Application/Comparison/SnapshotComparisonService.cs
@@ -0,0 +1,261 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace WinRestoreKit
+{
+    internal readonly struct ComparisonProgress
+    {
+        internal ComparisonProgress(int ordinal, ModuleComparison comparison)
+        {
+            Ordinal = ordinal;
+            Comparison = comparison;
+        }
+
+        internal int Ordinal { get; }
+
+        internal ModuleComparison Comparison { get; }
+    }
+
+    public sealed class SnapshotComparisonService
+    {
+        private const int MaximumConcurrentProbes = 4;
+
+        public async Task<IReadOnlyList<ModuleComparison>> CompareAsync(
+            SnapshotEvent snapshot, IReadOnlyList<BackupBase> modules,
+            CancellationToken cancellationToken)
+        {
+            ArgumentNullException.ThrowIfNull(snapshot);
+            if (!snapshot.IsRestorable)
+            {
+                throw new ArgumentException(
+                    "Only a verified or partial snapshot can be compared.", nameof(snapshot));
+            }
+
+            using (SnapshotPayloadPreparation preparation = await new SnapshotPayloadPreparationService()
+                .PrepareAsync(snapshot, cancellationToken).ConfigureAwait(false))
+            {
+                return await CompareAsync(preparation, modules, cancellationToken, progress: null)
+                    .ConfigureAwait(false);
+            }
+        }
+
+        internal Task<IReadOnlyList<ModuleComparison>> CompareAsync(
+            SnapshotPayloadPreparation preparation, IReadOnlyList<BackupBase> modules,
+            CancellationToken cancellationToken, IProgress<ComparisonProgress> progress)
+        {
+            ArgumentNullException.ThrowIfNull(preparation);
+            return ComparePreparedAsync(preparation, modules, cancellationToken, progress);
+        }
+
+        private async Task<IReadOnlyList<ModuleComparison>> ComparePreparedAsync(
+            SnapshotPayloadPreparation preparation, IReadOnlyList<BackupBase> modules,
+            CancellationToken cancellationToken, IProgress<ComparisonProgress> progress)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+
+            BackupBase[] catalog = (modules ?? Array.Empty<BackupBase>())
+                .Where(module => module != null)
+                .ToArray();
+
+            if (!string.IsNullOrWhiteSpace(preparation.Error))
+            {
+                ModuleComparison[] failedRows = PayloadFailureRows(catalog, preparation.Snapshot.Manifest,
+                    preparation.Error);
+                ReportRows(failedRows, progress);
+                return failedRows;
+            }
+
+            using (SemaphoreSlim gate = new SemaphoreSlim(MaximumConcurrentProbes, MaximumConcurrentProbes))
+            {
+                Task<ModuleComparison>[] workers = catalog.Select((module, ordinal) =>
+                    CompareAtOrdinalAsync(module, ordinal, preparation.Path, preparation.Snapshot.Manifest,
+                        gate, cancellationToken, progress)).ToArray();
+
+                try
+                {
+                    return await Task.WhenAll(workers).ConfigureAwait(false);
+                }
+                finally
+                {
+                    // The caller owns preparation and can dispose it once this task settles. Wait for
+                    // every synchronous probe before that happens, including probes that outlast cancellation.
+                    await Task.WhenAll(workers.Select(ObserveCompletionAsync)).ConfigureAwait(false);
+                }
+            }
+        }
+
+        private static async Task<ModuleComparison> CompareAtOrdinalAsync(
+            BackupBase module, int ordinal, string payloadPath, ManifestData manifest,
+            SemaphoreSlim gate, CancellationToken token, IProgress<ComparisonProgress> progress)
+        {
+            bool enteredGate = false;
+            try
+            {
+                await gate.WaitAsync(token).ConfigureAwait(false);
+                enteredGate = true;
+                token.ThrowIfCancellationRequested();
+
+                ModuleComparison row = await Task.Run(() => CompareOne(module, payloadPath, manifest), token)
+                    .ConfigureAwait(false);
+                token.ThrowIfCancellationRequested();
+                progress?.Report(new ComparisonProgress(ordinal, row));
+                return row;
+            }
+            finally
+            {
+                if (enteredGate)
+                    gate.Release();
+            }
+        }
+
+        private static async Task ObserveCompletionAsync(Task task)
+        {
+            try
+            {
+                await task.ConfigureAwait(false);
+            }
+            catch (OperationCanceledException)
+            {
+            }
+            catch (Exception)
+            {
+            }
+        }
+
+        private static void ReportRows(IReadOnlyList<ModuleComparison> rows,
+                                       IProgress<ComparisonProgress> progress)
+        {
+            if (progress == null)
+                return;
+
+            for (int ordinal = 0; ordinal < rows.Count; ordinal++)
+                progress.Report(new ComparisonProgress(ordinal, rows[ordinal]));
+        }
+
+        private static ModuleComparison[] PayloadFailureRows(IReadOnlyList<BackupBase> modules,
+                                                              ManifestData manifest, string error)
+        {
+            ModuleComparison[] rows = new ModuleComparison[modules.Count];
+            for (int index = 0; index < modules.Count; index++)
+            {
+                BackupBase module = modules[index];
+                ManifestModule entry = FindManifestEntry(manifest, module.GetType().Name);
+
+                rows[index] = IsManifestWithoutArtifact(entry)
+                    ? NotCapturedFromManifest(module, entry)
+                    : new ModuleComparison(module, ComparisonState.Unavailable, false,
+                        "The selected backup payload could not be prepared.", error);
+            }
+
+            return rows;
+        }
+
+        private static ModuleComparison CompareOne(BackupBase module, string payloadPath,
+                                                   ManifestData manifest)
+        {
+            ManifestModule entry = FindManifestEntry(manifest, module.GetType().Name);
+
+            if (IsManifestWithoutArtifact(entry))
+                return NotCapturedFromManifest(module, entry);
+
+            bool usableArtifact;
+            string artifactSummary;
+            if (entry?.State == BackupManifest.StateSucceeded)
+            {
+                usableArtifact = true;
+                artifactSummary = "The snapshot manifest records this module as captured.";
+            }
+            else
+            {
+                bool? probe;
+                try
+                {
+                    probe = module.HasArtifactIn(payloadPath);
+                }
+                catch (Exception ex)
+                {
+                    LogHelper.Instance.LogMessage("Comparison artifact probe failed for " + module.Title
+                        + ": " + ex.Message);
+                    return new ModuleComparison(module, ComparisonState.Unavailable, false,
+                        "Artifact presence could not be determined.", ex.Message);
+                }
+
+                if (probe == false)
+                {
+                    return new ModuleComparison(module, ComparisonState.NotCaptured, false,
+                        "The module proved that this snapshot has no restore artifact.", string.Empty);
+                }
+
+                if (!probe.HasValue)
+                {
+                    if (manifest != null)
+                    {
+                        return new ModuleComparison(module, ComparisonState.NotCaptured, false,
+                            "The manifest does not record this module and the module cannot prove an artifact.",
+                            string.Empty);
+                    }
+
+                    // Preserve RestoreContents' no-manifest fallback; drift remains explicit below.
+                    usableArtifact = true;
+                    artifactSummary = "No manifest is available and the module cannot disprove a legacy artifact.";
+                }
+                else
+                {
+                    usableArtifact = true;
+                    artifactSummary = "The module verified a captured artifact.";
+                }
+            }
+
+            try
+            {
+                bool? drifted = module.HasDriftedFrom(payloadPath);
+                if (drifted == true)
+                {
+                    return new ModuleComparison(module, ComparisonState.Changed, usableArtifact, artifactSummary,
+                        "Core confirmed that current state differs from the snapshot.");
+                }
+
+                if (drifted == false)
+                {
+                    return new ModuleComparison(module, ComparisonState.Same, usableArtifact, artifactSummary,
+                        "Core confirmed that current state matches the snapshot.");
+                }
+
+                return new ModuleComparison(module, ComparisonState.Unavailable, usableArtifact, artifactSummary,
+                    "Core could not establish a trustworthy live comparison.");
+            }
+            catch (Exception ex)
+            {
+                LogHelper.Instance.LogMessage("Comparison drift probe failed for " + module.Title
+                    + ": " + ex.Message);
+                return new ModuleComparison(module, ComparisonState.Unavailable, usableArtifact, artifactSummary,
+                    ex.Message);
+            }
+        }
+
+        private static ModuleComparison NotCapturedFromManifest(BackupBase module, ManifestModule entry)
+            => new ModuleComparison(module, ComparisonState.NotCaptured, false,
+                "The snapshot manifest records no usable artifact for this module.",
+                string.IsNullOrWhiteSpace(entry.Reason) ? entry.State : entry.Reason);
+
+        private static bool IsManifestWithoutArtifact(ManifestModule entry)
+            => entry?.State == BackupManifest.StateSkipped || entry?.State == BackupManifest.StateFailed;
+
+        private static ManifestModule FindManifestEntry(ManifestData manifest, string typeName)
+        {
+            if (manifest?.Modules == null)
+                return null;
+
+            foreach (ManifestModule entry in manifest.Modules)
+            {
+                if (entry != null && string.Equals(entry.Type, typeName, StringComparison.Ordinal))
+                    return entry;
+            }
+
+            return null;
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Application/Modules/BackupModuleCatalog.cs b/src/WinRestoreKit.Application/Modules/BackupModuleCatalog.cs
new file mode 100644
index 0000000..e9b0588
--- /dev/null
+++ b/src/WinRestoreKit.Application/Modules/BackupModuleCatalog.cs
@@ -0,0 +1,14 @@
+using Conf;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace WinRestoreKit
+{
+    public static class BackupModuleCatalog
+    {
+        public static IReadOnlyList<BackupModuleRegistration> CreateAll()
+            => ModuleCatalog.CreateAll()
+                .Select(entry => new BackupModuleRegistration(entry.Module, entry.Category))
+                .ToArray();
+    }
+}
diff --git a/src/WinRestoreKit.Application/Modules/BackupModuleRegistration.cs b/src/WinRestoreKit.Application/Modules/BackupModuleRegistration.cs
new file mode 100644
index 0000000..d97c3bd
--- /dev/null
+++ b/src/WinRestoreKit.Application/Modules/BackupModuleRegistration.cs
@@ -0,0 +1,20 @@
+using System;
+
+namespace WinRestoreKit
+{
+    public sealed class BackupModuleRegistration
+    {
+        internal BackupModuleRegistration(BackupBase module, string category)
+        {
+            Module = module ?? throw new ArgumentNullException(nameof(module));
+            Category = category ?? string.Empty;
+            Title = module.Title ?? string.Empty;
+        }
+
+        public BackupBase Module { get; }
+
+        public string Category { get; }
+
+        public string Title { get; }
+    }
+}
diff --git a/src/WinRestoreKit/Orchestration/BackupRestoreOrchestrator.cs b/src/WinRestoreKit.Application/Orchestration/BackupRestoreOrchestrator.cs
similarity index 98%
rename from src/WinRestoreKit/Orchestration/BackupRestoreOrchestrator.cs
rename to src/WinRestoreKit.Application/Orchestration/BackupRestoreOrchestrator.cs
index ddc6f89..6c7daa9 100644
--- a/src/WinRestoreKit/Orchestration/BackupRestoreOrchestrator.cs
+++ b/src/WinRestoreKit.Application/Orchestration/BackupRestoreOrchestrator.cs
@@ -5,6 +5,7 @@
 using System.Globalization;
 using System.IO;
 using System.Linq;
+using System.Reflection;
 using System.Threading.Tasks;
 
 namespace WinRestoreKit
@@ -57,6 +58,11 @@ internal sealed class BackupRestoreOrchestrator
         /// </summary>
         internal SnapshotCompression SnapshotCompression { get; private set; } = SnapshotCompression.Fast;
 
+        /// <summary>
+        /// The exact backup path attempted by the most recent backup call.
+        /// </summary>
+        internal string BackupOutputPath { get; private set; }
+
         internal BackupRestoreOrchestrator(IRunUi ui, RunControl runControl = null)
         {
             this.ui = ui;
@@ -64,7 +70,10 @@ internal BackupRestoreOrchestrator(IRunUi ui, RunControl runControl = null)
         }
 
         internal Task RunBackup(IReadOnlyList<BackupBase> selection, string backupPath)
-            => RunBackupCore(selection, backupPath, null, SnapshotCompression, null);
+        {
+            BackupOutputPath = backupPath;
+            return RunBackupCore(selection, backupPath, null, SnapshotCompression, null);
+        }
 
         /// <summary>
         /// Runs a user backup below <paramref name="destinationPath"/> with an optional display name.
@@ -103,6 +112,7 @@ internal Task RunBackup(IReadOnlyList<BackupBase> selection, string destinationP
 
             SnapshotCompression = compression;
             string backupPath = Path.Combine(destinationPath, Data.NowShort);
+            BackupOutputPath = backupPath;
 
             if (DestinationInsideSelectedSource(backupPath, selection, out string containingSource))
             {
@@ -736,7 +746,7 @@ private void WriteBackupManifest(string backupFolderPath, IReadOnlyList<BackupBa
                     Environment.MachineName,
                     Environment.UserName,
                     OsHelper.GetVersion(),
-                    Program.GetCurrentVersionTostring(),
+                    VersionInfo.GetCurrentVersion(Assembly.GetEntryAssembly()),
                     snapshotName,
                     compression,
                     payloadFile);
@@ -853,7 +863,9 @@ private async Task<ModuleResult> RestoreOne(RestoreScopeEntry entry, IReadOnlyLi
                     closeSteps.Add(DescribeJustInTimeClose(config.Title, requirement, closed));
                 }
 
-                ModuleResult outcome = await config.RestoreAsync(currentRestorePath);
+                ModuleResult outcome = config is Conf.AppStoreApps appStoreApps
+                    ? await appStoreApps.RestoreAsync(currentRestorePath, ui.DialogOwner)
+                    : await config.RestoreAsync(currentRestorePath);
 
                 foreach (StepResult closeStep in closeSteps)
                     outcome = RestoreDispatch.Fold(closeStep, outcome);
@@ -863,8 +875,8 @@ private async Task<ModuleResult> RestoreOne(RestoreScopeEntry entry, IReadOnlyLi
             catch (Exception ex)
             {
                 // Rule 6, and it matters more here than on the backup path: this method is awaited
-                // by the restore flow, which is itself awaited from an async void handler, and
-                // AppStoreApps.Restore opens a dialog from a thread-pool thread with no message pump.
+                // by the restore flow, which is itself awaited from an async void handler. A module
+                // failure must therefore become a result rather than escape as an unhandled UI error.
                 return ModuleResult.Aggregate(new[]
                 {
                     StepResult.Failed(config.Title, "unhandled error: " + ex.GetType().Name + ": " + ex.Message)
diff --git a/src/WinRestoreKit/Orchestration/IRunUi.cs b/src/WinRestoreKit.Application/Orchestration/IRunUi.cs
similarity index 74%
rename from src/WinRestoreKit/Orchestration/IRunUi.cs
rename to src/WinRestoreKit.Application/Orchestration/IRunUi.cs
index ff7fb85..5362f92 100644
--- a/src/WinRestoreKit/Orchestration/IRunUi.cs
+++ b/src/WinRestoreKit.Application/Orchestration/IRunUi.cs
@@ -1,5 +1,4 @@
 using System.Collections.Generic;
-using System.Windows.Forms;
 
 namespace WinRestoreKit
 {
@@ -8,11 +7,10 @@ namespace WinRestoreKit
     /// </summary>
     /// <remarks>
     /// Extracted in Phase 4 PR 5 so the backup/restore orchestration can move out of
-    /// <c>ConfPageView</c> without taking WinForms control references with it. Every member is a
-    /// direct replacement for something the view used to do inline; see the per-member remarks for
-    /// the exact line each replaces. The orchestrator is app-side (not Core) precisely because
-    /// <see cref="RunSummary"/> carries a <see cref="MessageBoxIcon"/> and stays app-side with its
-    /// test - that decision is recorded in the Phase 4 design spec.
+    /// <c>ConfPageView</c> without taking control references with it. Every member is a direct
+    /// replacement for something the view used to do inline; see the per-member remarks for the
+    /// exact line each replaces. The orchestrator is app-side because it coordinates UI work
+    /// through this neutral contract.
     /// </remarks>
     internal interface IRunUi
     {
@@ -26,8 +24,10 @@ internal interface IRunUi
         void SetProgressDetail(string groupInfo, string elapsed, string remaining, string throughput,
                                long bytesWritten, int errors, int warnings);
 
-        /// <summary>Owner for modal dialogs. Replaces FindForm().</summary>
-        IWin32Window Owner { get; }
+        /// <summary>
+        /// Opaque owner for a shell-native modal dialog. The Application layer never casts it.
+        /// </summary>
+        object DialogOwner { get; }
 
         /// <summary>Renders a run result. Replaces ShowSummary's log+MessageBox pair.</summary>
         void ShowSummary(RunSummary summary, string caption, IReadOnlyList<ModuleOutcome> outcomes);
diff --git a/src/WinRestoreKit/Orchestration/RunControl.cs b/src/WinRestoreKit.Application/Orchestration/RunControl.cs
similarity index 100%
rename from src/WinRestoreKit/Orchestration/RunControl.cs
rename to src/WinRestoreKit.Application/Orchestration/RunControl.cs
diff --git a/src/WinRestoreKit/Orchestration/RunCoordinator.cs b/src/WinRestoreKit.Application/Orchestration/RunCoordinator.cs
similarity index 100%
rename from src/WinRestoreKit/Orchestration/RunCoordinator.cs
rename to src/WinRestoreKit.Application/Orchestration/RunCoordinator.cs
diff --git a/src/WinRestoreKit.Application/Properties/AssemblyInfo.cs b/src/WinRestoreKit.Application/Properties/AssemblyInfo.cs
new file mode 100644
index 0000000..503ee65
--- /dev/null
+++ b/src/WinRestoreKit.Application/Properties/AssemblyInfo.cs
@@ -0,0 +1,5 @@
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("WinRestoreKit")]
+[assembly: InternalsVisibleTo("WinRestoreKit.Wpf")]
+[assembly: InternalsVisibleTo("WinRestoreKit.Tests")]
diff --git a/src/WinRestoreKit/Results/RunSummary.cs b/src/WinRestoreKit.Application/Results/RunSummary.cs
similarity index 94%
rename from src/WinRestoreKit/Results/RunSummary.cs
rename to src/WinRestoreKit.Application/Results/RunSummary.cs
index 93add93..017c4e2 100644
--- a/src/WinRestoreKit/Results/RunSummary.cs
+++ b/src/WinRestoreKit.Application/Results/RunSummary.cs
@@ -1,6 +1,5 @@
 using System.Collections.Generic;
 using System.Linq;
-using System.Windows.Forms;
 
 namespace WinRestoreKit
 {
@@ -42,6 +41,13 @@ internal enum RunState
         DidNotRun
     }
 
+    internal enum RunSeverity
+    {
+        Information,
+        Warning,
+        Error
+    }
+
     /// <summary>
     /// What to tell the user after a whole backup or restore run.
     /// </summary>
@@ -56,13 +62,10 @@ internal sealed class RunSummary
         public string Headline { get; private set; }
         public string Detail { get; private set; }
 
-        // DidNotRun is a warning, not information: the user picked a backup folder and it was not
-        // there, so they asked for something and did not get it. Done, NothingDone, and Canceled are
-        // informational.
-        public MessageBoxIcon Icon
+        public RunSeverity Severity
             => State == RunState.Problems || State == RunState.DidNotRun
-                ? MessageBoxIcon.Warning
-                : MessageBoxIcon.Information;
+                ? RunSeverity.Warning
+                : RunSeverity.Information;
 
         /// <param name="because">
         /// Why the run never started, when <paramref name="ran"/> is false. Defaults to the missing
diff --git a/src/WinRestoreKit/Helpers/BackupRootRegistry.cs b/src/WinRestoreKit.Application/Settings/BackupRootRegistry.cs
similarity index 100%
rename from src/WinRestoreKit/Helpers/BackupRootRegistry.cs
rename to src/WinRestoreKit.Application/Settings/BackupRootRegistry.cs
diff --git a/src/WinRestoreKit.Application/Settings/IThemeSettings.cs b/src/WinRestoreKit.Application/Settings/IThemeSettings.cs
new file mode 100644
index 0000000..daa84b6
--- /dev/null
+++ b/src/WinRestoreKit.Application/Settings/IThemeSettings.cs
@@ -0,0 +1,8 @@
+namespace WinRestoreKit
+{
+    internal interface IThemeSettings
+    {
+        ThemeMode ReadThemeMode();
+        void WriteThemeMode(ThemeMode mode);
+    }
+}
diff --git a/src/WinRestoreKit.Application/Settings/RegistryThemeSettings.cs b/src/WinRestoreKit.Application/Settings/RegistryThemeSettings.cs
new file mode 100644
index 0000000..a2f873a
--- /dev/null
+++ b/src/WinRestoreKit.Application/Settings/RegistryThemeSettings.cs
@@ -0,0 +1,46 @@
+using System;
+using Microsoft.Win32;
+
+namespace WinRestoreKit
+{
+    internal sealed class RegistryThemeSettings : IThemeSettings
+    {
+        private const string DefaultKeyPath = @"Software\WinRestoreKit";
+        private const string ValueName = "ThemeMode";
+        private readonly string keyPath;
+
+        internal RegistryThemeSettings(string keyPath = DefaultKeyPath)
+        {
+            this.keyPath = string.IsNullOrWhiteSpace(keyPath) ? DefaultKeyPath : keyPath;
+        }
+
+        public ThemeMode ReadThemeMode()
+        {
+            try
+            {
+                using (RegistryKey key = Registry.CurrentUser.OpenSubKey(keyPath))
+                {
+                    return key?.GetValue(ValueName) is int value && Enum.IsDefined(typeof(ThemeMode), value)
+                        ? (ThemeMode)value
+                        : ThemeMode.FollowSystem;
+                }
+            }
+            catch (Exception)
+            {
+                return ThemeMode.FollowSystem;
+            }
+        }
+
+        public void WriteThemeMode(ThemeMode mode)
+        {
+            try
+            {
+                using (RegistryKey key = Registry.CurrentUser.CreateSubKey(keyPath))
+                    key?.SetValue(ValueName, (int)mode, RegistryValueKind.DWord);
+            }
+            catch (Exception)
+            {
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Application/Settings/ThemeMode.cs b/src/WinRestoreKit.Application/Settings/ThemeMode.cs
new file mode 100644
index 0000000..d016785
--- /dev/null
+++ b/src/WinRestoreKit.Application/Settings/ThemeMode.cs
@@ -0,0 +1,9 @@
+namespace WinRestoreKit
+{
+    internal enum ThemeMode
+    {
+        FollowSystem = 0,
+        Light = 1,
+        Dark = 2
+    }
+}
diff --git a/src/WinRestoreKit/Views/BackupFolders.cs b/src/WinRestoreKit.Application/Snapshots/BackupFolders.cs
similarity index 55%
rename from src/WinRestoreKit/Views/BackupFolders.cs
rename to src/WinRestoreKit.Application/Snapshots/BackupFolders.cs
index 159bba3..820fe5d 100644
--- a/src/WinRestoreKit/Views/BackupFolders.cs
+++ b/src/WinRestoreKit.Application/Snapshots/BackupFolders.cs
@@ -1,29 +1,21 @@
-using WinRestoreKit;
 using DataHelper;
 using System;
 using System.Collections.Generic;
 using System.Globalization;
 using System.IO;
 
-namespace Views
+namespace WinRestoreKit
 {
-    /// <summary>
-    /// The backup directory, split into the user's own backups and the pre-restore snapshots.
-    /// </summary>
-    /// <remarks>
-    /// The retired picker listed these folder names verbatim in one flat list, which was fine for picking a
-    /// folder to restore from but wrong for a dashboard: "last backup: 4 minutes ago" naming a
-    /// snapshot the app took by itself, immediately before overwriting something, answers a question
-    /// nobody asked. SnapshotNaming is the sole authority on which is which.
-    /// </remarks>
+    /// <summary>The backup directory, split into user backups and pre-restore snapshots.</summary>
     internal sealed class BackupFolders
     {
         private BackupFolders(IReadOnlyList<BackupFolder> backups, IReadOnlyList<BackupFolder> snapshots,
-                              string unreadableReason)
+                              string unreadableReason, IReadOnlyList<UnreadableBackupRoot> unreadableRoots)
         {
             Backups = backups;
             Snapshots = snapshots;
             UnreadableReason = unreadableReason;
+            UnreadableRoots = unreadableRoots;
         }
 
         /// <summary>User backups, newest first.</summary>
@@ -32,37 +24,18 @@ private BackupFolders(IReadOnlyList<BackupFolder> backups, IReadOnlyList<BackupF
         /// <summary>Pre-restore snapshots, newest first.</summary>
         internal IReadOnlyList<BackupFolder> Snapshots { get; }
 
-        /// <summary>
-        /// Why the backup folder could not be listed, or null when it was listed successfully.
-        /// </summary>
-        /// <remarks>
-        /// "Could not look" and "looked, found nothing" are different answers and the screen must not
-        /// merge them. An empty list means nothing has ever been backed up; a denied or vanished
-        /// folder means this app does not know, and rendering that as "No backups yet" tells the user
-        /// their backups are gone when they may be sitting there intact.
-        /// </remarks>
+        /// <summary>Why legacy WinForms discovery could not list its root, when no root was readable.</summary>
         internal string UnreadableReason { get; }
 
-        /// <summary>
-        /// Reads the default root and every remembered custom root without letting one removable
-        /// destination erase the results already obtained from another.
-        /// </summary>
-        /// <remarks>
-        /// The default root is owned by this application, so every child remains eligible for legacy
-        /// restore compatibility. A custom root can be Documents, a drive root or a network share,
-        /// where treating every child as a backup would make unrelated user data restorable and make
-        /// Home measure it as application storage. Its children therefore need evidence that this
-        /// application wrote them.
-        ///
-        /// A remembered removable destination can disappear after a successful backup. That failure
-        /// says nothing about a readable root, so it is retained only when no root could be inspected.
-        /// The default root remains fatal because no fallback can distinguish an access failure there
-        /// from an empty root the application has successfully listed.
-        /// </remarks>
+        /// <summary>Every root whose enumeration produced an observable error.</summary>
+        internal IReadOnlyList<UnreadableBackupRoot> UnreadableRoots { get; }
+
+        /// <summary>Reads the default root and every remembered custom root without dropping readable roots.</summary>
         internal static BackupFolders Read()
         {
             List<BackupFolder> backups = new List<BackupFolder>();
             List<BackupFolder> snapshots = new List<BackupFolder>();
+            List<UnreadableBackupRoot> unreadableRoots = new List<UnreadableBackupRoot>();
             List<string> roots = new List<string> { Data.DataRootDir };
 
             BackupRootRegistry.TryCanonicalize(Data.DataRootDir, out string defaultRoot);
@@ -89,23 +62,25 @@ internal static BackupFolders Read()
 
                 try
                 {
-                    // Enumerate directly instead of guarding with Directory.Exists. Exists SWALLOWS the
-                    // access error and answers false, so a folder whose ACL denies this user is
-                    // indistinguishable from one that was never created - which is how an unreadable
-                    // root came to be reported as "no backups yet".
+                    // Do not guard this with Directory.Exists: Exists suppresses access errors and
+                    // makes an unreadable root indistinguishable from a root with no backups.
                     paths = Directory.GetDirectories(root);
                     inspectedRoots++;
                 }
                 catch (DirectoryNotFoundException)
                 {
-                    // An absent root is ordinary before its first backup. Continue because a known
-                    // custom root may still hold snapshots created in an earlier session.
+                    // An absent root is ordinary before the first backup and remains distinct from
+                    // a root that exists but cannot be inspected.
                     continue;
                 }
                 catch (Exception ex)
                 {
+                    unreadableRoots.Add(new UnreadableBackupRoot(CanonicalizeRoot(root), ex.Message));
+
                     if (isDefaultRoot)
-                        return new BackupFolders(backups, snapshots, ex.Message);
+                    {
+                        return new BackupFolders(backups, snapshots, ex.Message, unreadableRoots);
+                    }
 
                     unreadableCustomRootReason ??= ex.Message;
                     continue;
@@ -113,8 +88,8 @@ internal static BackupFolders Read()
 
                 foreach (string path in paths)
                 {
-                    // A custom destination can live below the default root. Its parent is not a
-                    // legacy backup, it is a container whose children the custom-root pass owns.
+                    // A remembered custom root below the default root is a container owned by the
+                    // custom-root pass, not a default-root legacy backup.
                     if (isDefaultRoot && IsRememberedCustomRootOrContainer(path, roots))
                         continue;
 
@@ -131,12 +106,27 @@ internal static BackupFolders Read()
             }
 
             if (inspectedRoots == 0 && unreadableCustomRootReason != null)
-                return new BackupFolders(backups, snapshots, unreadableCustomRootReason);
+                return new BackupFolders(backups, snapshots, unreadableCustomRootReason, unreadableRoots);
 
             backups.Sort(NewestFirst);
             snapshots.Sort(NewestFirst);
 
-            return new BackupFolders(backups, snapshots, null);
+            return new BackupFolders(backups, snapshots, null, unreadableRoots);
+        }
+
+        private static string CanonicalizeRoot(string root)
+        {
+            if (BackupRootRegistry.TryCanonicalize(root, out string canonicalRoot))
+                return canonicalRoot;
+
+            try
+            {
+                return Path.GetFullPath(root);
+            }
+            catch (Exception)
+            {
+                return root;
+            }
         }
 
         private static bool IsRememberedCustomRootOrContainer(string path, IReadOnlyList<string> roots)
@@ -163,20 +153,9 @@ private static bool IsRememberedCustomRootOrContainer(string path, IReadOnlyList
         }
 
         private static bool IsDirectorySeparator(char value)
-        {
-            return value == Path.DirectorySeparatorChar || value == Path.AltDirectorySeparatorChar;
-        }
+            => value == Path.DirectorySeparatorChar || value == Path.AltDirectorySeparatorChar;
 
-        /// <summary>
-        /// Whether a child of a custom root carries metadata or a frozen name shape that this
-        /// application writes.
-        /// </summary>
-        /// <remarks>
-        /// A custom root is often chosen for free space rather than dedicated to backups. Metadata
-        /// admits complete and interrupted backups, while the timestamp shape preserves old loose
-        /// folders whose manifest was never written. Both paths are needed because excluding an
-        /// interrupted backup is safer than presenting every unrelated folder as a restore source.
-        /// </remarks>
+        /// <summary>Whether a custom-root child carries application metadata or a legacy timestamp name.</summary>
         private static bool IsRecognizableCustomFolder(string path)
         {
             return File.Exists(Path.Combine(path, BackupManifest.FileName))
@@ -266,24 +245,16 @@ private static bool MatchesDataRootTimestampShape(string timestamp)
                     && char.IsDigit(timestamp[template.Length + 2]));
         }
 
-        /// <summary>
-        /// Whether a folder name is a pre-restore snapshot.
-        /// </summary>
-        /// <remarks>
-        /// Contains, not EndsWith. SnapshotNaming.Unique appends " (2)", " (3)" AFTER the suffix when
-        /// two restores land in the same second, so the marker is not guaranteed to be terminal - and
-        /// those collision folders are exactly the ones taken when a restore went wrong, which is
-        /// when misfiling one as a user backup would matter most.
-        /// </remarks>
+        /// <summary>Whether a folder name is a pre-restore snapshot.</summary>
         internal static bool IsSnapshot(string folderName)
             => folderName != null
                 && folderName.IndexOf(SnapshotNaming.Suffix, StringComparison.OrdinalIgnoreCase) >= 0;
 
-        private static int NewestFirst(BackupFolder a, BackupFolder b)
-            => b.Created.CompareTo(a.Created);
+        private static int NewestFirst(BackupFolder left, BackupFolder right)
+            => right.Created.CompareTo(left.Created);
     }
 
-    /// <summary>One folder under the backup root.</summary>
+    /// <summary>One folder under a backup root.</summary>
     internal sealed class BackupFolder
     {
         private readonly ManifestData manifest;
@@ -292,72 +263,59 @@ internal BackupFolder(string path)
         {
             Path = path;
             Name = System.IO.Path.GetFileName(path);
-
-            // Read once here rather than on demand: Created depends on it, and the folders are
-            // sorted by Created, so a lazy read would parse the same small file repeatedly during
-            // an ordinary sort.
-            manifest = ReadManifest(path);
-            Created = ReadCreated(path, manifest);
+            manifest = ReadManifest(path, out string manifestError);
+            ManifestError = manifestError;
+            Created = ReadCreated(path, manifest, out string createdError);
+            CreatedError = createdError;
         }
 
         internal string Path { get; }
 
         internal string Name { get; }
 
-        /// <summary>
-        /// User-facing backup name from the manifest, or the physical folder name for every legacy
-        /// backup and manifest that does not supply one.
-        /// </summary>
         internal string DisplayName
             => manifest == null || string.IsNullOrEmpty(manifest.SnapshotName)
                 ? Name
                 : manifest.SnapshotName;
 
-        /// <summary>
-        /// When the run this folder holds actually finished.
-        /// </summary>
-        /// <remarks>
-        /// From the manifest when there is one, and only otherwise from the directory timestamp.
-        /// The filesystem answer is the weaker of the two in both directions: a second backup in one
-        /// session reuses the folder, so the directory still carries the FIRST run's creation time
-        /// and "12 days ago" would be said of a run made minutes ago; and a backup folder copied
-        /// from another machine is stamped with the moment it was copied, so an old run sorts first
-        /// and reads as today's.
-        /// </remarks>
         internal DateTime Created { get; }
 
-        /// <summary>
-        /// The folder's manifest, or null when there is not a trustworthy one.
-        /// </summary>
-        /// <remarks>
-        /// Absent file, unreadable file and a document TryParse refuses all collapse to the same
-        /// null, because they are the same answer to the caller: this app does not know what is in
-        /// here. Callers render that as "details unavailable".
-        /// </remarks>
+        /// <summary>Reason the manifest was invalid or unreadable; null for a valid or absent manifest.</summary>
+        internal string ManifestError { get; }
+
+        /// <summary>Reason the directory timestamp could not be read; null when a timestamp was available.</summary>
+        internal string CreatedError { get; }
+
         internal ManifestData ReadManifest() => manifest;
 
-        private static ManifestData ReadManifest(string path)
+        private static ManifestData ReadManifest(string path, out string error)
         {
+            error = null;
+            string file = System.IO.Path.Combine(path, BackupManifest.FileName);
+
             try
             {
-                string file = System.IO.Path.Combine(path, BackupManifest.FileName);
-
                 if (!File.Exists(file))
                     return null;
 
-                return BackupManifest.TryParse(File.ReadAllText(file));
+                ManifestData parsed = BackupManifest.TryParse(File.ReadAllText(file));
+
+                if (parsed == null)
+                    error = "The backup manifest is invalid or uses an unsupported schema.";
+
+                return parsed;
             }
-            catch (Exception)
+            catch (Exception ex)
             {
+                error = ex.Message;
                 return null;
             }
         }
 
-        private static DateTime ReadCreated(string path, ManifestData manifest)
+        private static DateTime ReadCreated(string path, ManifestData manifest, out string error)
         {
-            // "o" as written by Compose. Parsed with RoundtripKind and converted to local time, so a
-            // backup carried over from a machine in another time zone is described in the time zone
-            // of whoever is reading the screen.
+            error = null;
+
             if (manifest != null
                 && DateTime.TryParse(manifest.Created, CultureInfo.InvariantCulture,
                                      DateTimeStyles.RoundtripKind, out DateTime recorded))
@@ -369,12 +327,25 @@ private static DateTime ReadCreated(string path, ManifestData manifest)
             {
                 return Directory.GetCreationTime(path);
             }
-            catch (Exception)
+            catch (Exception ex)
             {
-                // MinValue sorts the folder last rather than pretending it is the newest thing on
-                // disk, which is what DateTime.Now here would have done.
+                error = ex.Message;
                 return DateTime.MinValue;
             }
         }
     }
+
+    /// <summary>Observed root-level discovery failure retained for diagnostic event projection.</summary>
+    internal sealed class UnreadableBackupRoot
+    {
+        internal UnreadableBackupRoot(string canonicalPath, string reason)
+        {
+            CanonicalPath = canonicalPath;
+            Reason = reason;
+        }
+
+        internal string CanonicalPath { get; }
+
+        internal string Reason { get; }
+    }
 }
diff --git a/src/WinRestoreKit.Application/Snapshots/SnapshotEvent.cs b/src/WinRestoreKit.Application/Snapshots/SnapshotEvent.cs
new file mode 100644
index 0000000..6ce923a
--- /dev/null
+++ b/src/WinRestoreKit.Application/Snapshots/SnapshotEvent.cs
@@ -0,0 +1,42 @@
+using System;
+
+namespace WinRestoreKit
+{
+    public sealed class SnapshotEvent
+    {
+        internal SnapshotEvent(SnapshotEventKind kind, DateTime created, string displayName,
+                               string canonicalPath, string diagnosticReason, string machineName,
+                               long sizeBytes, bool isSizeComplete, ManifestData manifest)
+        {
+            Kind = kind;
+            Created = created;
+            DisplayName = displayName;
+            CanonicalPath = canonicalPath;
+            DiagnosticReason = diagnosticReason;
+            MachineName = machineName;
+            SizeBytes = sizeBytes;
+            IsSizeComplete = isSizeComplete;
+            Manifest = manifest;
+        }
+
+        public SnapshotEventKind Kind { get; }
+
+        public DateTime Created { get; }
+
+        public string DisplayName { get; }
+
+        public string CanonicalPath { get; }
+
+        public string DiagnosticReason { get; }
+
+        public string MachineName { get; }
+
+        public long SizeBytes { get; }
+
+        public bool IsSizeComplete { get; }
+
+        public bool IsRestorable => Kind == SnapshotEventKind.Verified || Kind == SnapshotEventKind.Partial;
+
+        internal ManifestData Manifest { get; }
+    }
+}
diff --git a/src/WinRestoreKit.Application/Snapshots/SnapshotEventCatalog.cs b/src/WinRestoreKit.Application/Snapshots/SnapshotEventCatalog.cs
new file mode 100644
index 0000000..ab4f76d
--- /dev/null
+++ b/src/WinRestoreKit.Application/Snapshots/SnapshotEventCatalog.cs
@@ -0,0 +1,199 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.IO;
+
+namespace WinRestoreKit
+{
+    public interface ISnapshotEventReader
+    {
+        IReadOnlyList<SnapshotEvent> Read();
+    }
+
+    /// <summary>Classifies discovered backup evidence once into deterministic, immutable events.</summary>
+    public sealed class SnapshotEventCatalog : ISnapshotEventReader
+    {
+        private readonly List<SnapshotEvent> sessionFailures = new List<SnapshotEvent>();
+        private readonly object sessionFailuresGate = new object();
+        private int nextSessionFailureOrdinal;
+
+        public IReadOnlyList<SnapshotEvent> Read()
+        {
+            BackupFolders folders = BackupFolders.Read();
+            List<SnapshotEvent> events = new List<SnapshotEvent>(
+                folders.Backups.Count + folders.Snapshots.Count + folders.UnreadableRoots.Count);
+
+            AddFolderEvents(events, folders.Backups);
+            AddFolderEvents(events, folders.Snapshots);
+
+            foreach (UnreadableBackupRoot root in folders.UnreadableRoots)
+                events.Add(CreateUnreadableRootEvent(root));
+
+            lock (sessionFailuresGate)
+                events.AddRange(sessionFailures);
+
+            events.Sort(CompareEvents);
+            return events.AsReadOnly();
+        }
+
+        /// <summary>Records a process-local failure that never reached durable backup storage.</summary>
+        public void RecordSessionFailure(DateTime created, string displayName, string diagnosticReason)
+        {
+            if (string.IsNullOrWhiteSpace(diagnosticReason))
+                throw new ArgumentException("A session failure must have a diagnostic reason.", nameof(diagnosticReason));
+
+            lock (sessionFailuresGate)
+            {
+                int ordinal = ++nextSessionFailureOrdinal;
+                sessionFailures.Add(new SnapshotEvent(
+                    SnapshotEventKind.Failed,
+                    created,
+                    displayName,
+                    "session://failure/" + ordinal.ToString(CultureInfo.InvariantCulture),
+                    diagnosticReason,
+                    string.Empty,
+                    0,
+                    false,
+                    null));
+            }
+        }
+
+        private static void AddFolderEvents(List<SnapshotEvent> events, IReadOnlyList<BackupFolder> folders)
+        {
+            foreach (BackupFolder folder in folders)
+                events.Add(CreateFolderEvent(folder));
+        }
+
+        private static SnapshotEvent CreateFolderEvent(BackupFolder folder)
+        {
+            ManifestData manifest = folder.ReadManifest();
+            SizeEvidence size = ReadSize(folder.Path);
+
+            return new SnapshotEvent(
+                Classify(folder, manifest),
+                folder.Created,
+                folder.DisplayName,
+                CanonicalizePath(folder.Path),
+                JoinDiagnostic(folder.ManifestError, folder.CreatedError, size.Error),
+                manifest?.MachineName ?? string.Empty,
+                size.Bytes,
+                size.IsComplete,
+                manifest);
+        }
+
+        private static SnapshotEvent CreateUnreadableRootEvent(UnreadableBackupRoot root)
+        {
+            string canonicalPath = CanonicalizePath(root.CanonicalPath);
+
+            return new SnapshotEvent(
+                SnapshotEventKind.Unreadable,
+                DateTime.MinValue,
+                DisplayNameForRoot(canonicalPath),
+                canonicalPath,
+                root.Reason,
+                string.Empty,
+                0,
+                false,
+                null);
+        }
+
+        private static SnapshotEventKind Classify(BackupFolder folder, ManifestData manifest)
+        {
+            if (folder.ManifestError != null)
+                return SnapshotEventKind.Unreadable;
+
+            if (manifest == null)
+                return SnapshotEventKind.Partial;
+
+            if (manifest.Modules.Count == 0 || manifest.Modules.All(module => module.State == BackupManifest.StateFailed))
+                return SnapshotEventKind.Failed;
+
+            if (manifest.Modules.Any(module => module.State != BackupManifest.StateSucceeded))
+                return SnapshotEventKind.Partial;
+
+            return SnapshotEventKind.Verified;
+        }
+
+        private static int CompareEvents(SnapshotEvent left, SnapshotEvent right)
+        {
+            int timestamp = right.Created.CompareTo(left.Created);
+            return timestamp != 0
+                ? timestamp
+                : StringComparer.Ordinal.Compare(left.CanonicalPath, right.CanonicalPath);
+        }
+
+        private static SizeEvidence ReadSize(string path)
+        {
+            long bytes = 0;
+
+            try
+            {
+                foreach (string file in Directory.EnumerateFiles(path, "*", SearchOption.AllDirectories))
+                {
+                    long length = new FileInfo(file).Length;
+                    checked
+                    {
+                        bytes += length;
+                    }
+                }
+
+                return new SizeEvidence(bytes, true, null);
+            }
+            catch (Exception ex)
+            {
+                return new SizeEvidence(bytes, false, ex.Message);
+            }
+        }
+
+        private static string CanonicalizePath(string path)
+        {
+            try
+            {
+                return Path.GetFullPath(path);
+            }
+            catch (Exception)
+            {
+                return path ?? string.Empty;
+            }
+        }
+
+        private static string DisplayNameForRoot(string path)
+        {
+            string trimmed = path.TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
+            string name = Path.GetFileName(trimmed);
+            return string.IsNullOrEmpty(name) ? path : name;
+        }
+
+        private static string JoinDiagnostic(params string[] reasons)
+        {
+            string diagnostic = null;
+
+            foreach (string reason in reasons)
+            {
+                if (string.IsNullOrWhiteSpace(reason))
+                    continue;
+
+                diagnostic = diagnostic == null ? reason : diagnostic + Environment.NewLine + reason;
+            }
+
+            return diagnostic ?? string.Empty;
+        }
+
+        private readonly struct SizeEvidence
+        {
+            internal SizeEvidence(long bytes, bool isComplete, string error)
+            {
+                Bytes = bytes;
+                IsComplete = isComplete;
+                Error = error;
+            }
+
+            internal long Bytes { get; }
+
+            internal bool IsComplete { get; }
+
+            internal string Error { get; }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Application/Snapshots/SnapshotEventKind.cs b/src/WinRestoreKit.Application/Snapshots/SnapshotEventKind.cs
new file mode 100644
index 0000000..c145209
--- /dev/null
+++ b/src/WinRestoreKit.Application/Snapshots/SnapshotEventKind.cs
@@ -0,0 +1,10 @@
+namespace WinRestoreKit
+{
+    public enum SnapshotEventKind
+    {
+        Verified,
+        Partial,
+        Failed,
+        Unreadable
+    }
+}
diff --git a/src/WinRestoreKit.Application/Snapshots/SnapshotPayloadPreparation.cs b/src/WinRestoreKit.Application/Snapshots/SnapshotPayloadPreparation.cs
new file mode 100644
index 0000000..9c56f1c
--- /dev/null
+++ b/src/WinRestoreKit.Application/Snapshots/SnapshotPayloadPreparation.cs
@@ -0,0 +1,42 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace WinRestoreKit
+{
+    public interface ISnapshotPayloadPreparationService
+    {
+        Task<SnapshotPayloadPreparation> PrepareAsync(
+            SnapshotEvent snapshot, CancellationToken cancellationToken);
+    }
+
+    /// <summary>Owns a prepared payload scope until Compare accepts it or the selection is abandoned.</summary>
+    public sealed class SnapshotPayloadPreparation : IDisposable
+    {
+        private readonly BackupPayload.ReadScope scope;
+        private int disposed;
+
+        internal SnapshotPayloadPreparation(SnapshotEvent snapshot, BackupPayload.ReadScope scope, string error)
+        {
+            Snapshot = snapshot;
+            this.scope = scope;
+            Error = error;
+        }
+
+        public SnapshotEvent Snapshot { get; }
+
+        public string Path => scope?.Path;
+
+        public string Error { get; }
+
+        public bool IsPrepared => Error == null;
+
+        public void Dispose()
+        {
+            if (Interlocked.Exchange(ref disposed, 1) != 0)
+                return;
+
+            scope?.Dispose();
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Application/Snapshots/SnapshotPayloadPreparationService.cs b/src/WinRestoreKit.Application/Snapshots/SnapshotPayloadPreparationService.cs
new file mode 100644
index 0000000..12f77d0
--- /dev/null
+++ b/src/WinRestoreKit.Application/Snapshots/SnapshotPayloadPreparationService.cs
@@ -0,0 +1,45 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace WinRestoreKit
+{
+    public sealed class SnapshotPayloadPreparationService : ISnapshotPayloadPreparationService
+    {
+        public async Task<SnapshotPayloadPreparation> PrepareAsync(
+            SnapshotEvent snapshot, CancellationToken cancellationToken)
+        {
+            if (snapshot == null)
+                throw new ArgumentNullException(nameof(snapshot));
+
+            if (!snapshot.IsRestorable)
+            {
+                return new SnapshotPayloadPreparation(snapshot, null,
+                    "This backup attempt cannot be selected because it is failed or unreadable.");
+            }
+
+            cancellationToken.ThrowIfCancellationRequested();
+
+            return await Task.Run(() =>
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+
+                if (!BackupPayload.TryPrepareForRead(snapshot.CanonicalPath, out BackupPayload.ReadScope scope,
+                                                     out string error))
+                {
+                    scope?.Dispose();
+                    return new SnapshotPayloadPreparation(snapshot, null,
+                        "The selected backup payload could not be prepared: " + error);
+                }
+
+                if (cancellationToken.IsCancellationRequested)
+                {
+                    scope.Dispose();
+                    cancellationToken.ThrowIfCancellationRequested();
+                }
+
+                return new SnapshotPayloadPreparation(snapshot, scope, null);
+            }, cancellationToken).ConfigureAwait(false);
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Application/Updates/IUpdateCheckService.cs b/src/WinRestoreKit.Application/Updates/IUpdateCheckService.cs
new file mode 100644
index 0000000..4138ed9
--- /dev/null
+++ b/src/WinRestoreKit.Application/Updates/IUpdateCheckService.cs
@@ -0,0 +1,10 @@
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace WinRestoreKit
+{
+    internal interface IUpdateCheckService
+    {
+        Task<UpdateCheckResult> CheckAsync(string currentVersion, CancellationToken cancellationToken);
+    }
+}
diff --git a/src/WinRestoreKit.Application/Updates/UpdateCheckResult.cs b/src/WinRestoreKit.Application/Updates/UpdateCheckResult.cs
new file mode 100644
index 0000000..5b8ad51
--- /dev/null
+++ b/src/WinRestoreKit.Application/Updates/UpdateCheckResult.cs
@@ -0,0 +1,22 @@
+namespace WinRestoreKit
+{
+    internal sealed class UpdateCheckResult
+    {
+        internal UpdateCheckResult(UpdateVerdict verdict, string currentVersion, string latestVersion,
+                                   string errorMessage = null)
+        {
+            Verdict = verdict;
+            CurrentVersion = currentVersion;
+            LatestVersion = latestVersion;
+            ErrorMessage = errorMessage;
+        }
+
+        public UpdateVerdict Verdict { get; }
+
+        public string CurrentVersion { get; }
+
+        public string LatestVersion { get; }
+
+        public string ErrorMessage { get; }
+    }
+}
diff --git a/src/WinRestoreKit.Application/Updates/UpdateCheckService.cs b/src/WinRestoreKit.Application/Updates/UpdateCheckService.cs
new file mode 100644
index 0000000..4958430
--- /dev/null
+++ b/src/WinRestoreKit.Application/Updates/UpdateCheckService.cs
@@ -0,0 +1,112 @@
+using System;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+using DataHelper;
+
+namespace WinRestoreKit
+{
+    internal sealed class UpdateCheckService : IUpdateCheckService
+    {
+        private static readonly HttpClient Client = CreateClient();
+
+        public async Task<UpdateCheckResult> CheckAsync(string currentVersion,
+                                                         CancellationToken cancellationToken)
+        {
+            if (Decide(currentVersion, string.Empty) == UpdateVerdict.CannotDetermineCurrentVersion)
+            {
+                return new UpdateCheckResult(UpdateVerdict.CannotDetermineCurrentVersion,
+                                             currentVersion,
+                                             null);
+            }
+
+            try
+            {
+                if (!await Task.Run(Data.IsInet, cancellationToken))
+                {
+                    return new UpdateCheckResult(
+                        UpdateVerdict.LatestVersionUnreadable,
+                        currentVersion,
+                        null,
+                        "Problem with the internet connection: checking for WinRestoreKit updates failed.");
+                }
+
+                string latestTag = await ReadLatestVersionAsync(cancellationToken);
+                UpdateVerdict verdict = Decide(currentVersion, latestTag);
+                string latestVersion = string.IsNullOrWhiteSpace(latestTag)
+                    ? null
+                    : VersionInfo.Normalize(latestTag);
+
+                return new UpdateCheckResult(verdict, currentVersion, latestVersion);
+            }
+            catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+            {
+                throw;
+            }
+            catch (Exception ex)
+            {
+                return new UpdateCheckResult(UpdateVerdict.LatestVersionUnreadable,
+                                             currentVersion,
+                                             null,
+                                             ex.Message);
+            }
+        }
+
+        internal static UpdateVerdict Decide(string currentVersion, string latestTag)
+        {
+            if (string.Equals(currentVersion, VersionInfo.UnknownVersion, StringComparison.Ordinal))
+                return UpdateVerdict.CannotDetermineCurrentVersion;
+
+            if (string.IsNullOrWhiteSpace(latestTag))
+                return UpdateVerdict.LatestVersionUnreadable;
+
+            string latestVersion = VersionInfo.Normalize(latestTag);
+            if (string.Equals(currentVersion, latestVersion, StringComparison.Ordinal))
+                return UpdateVerdict.UpToDate;
+
+            if (Version.TryParse(currentVersion, out Version current)
+                && Version.TryParse(latestVersion, out Version latest))
+            {
+                return latest.CompareTo(current) > 0
+                    ? UpdateVerdict.UpdateAvailable
+                    : UpdateVerdict.UpToDate;
+            }
+
+            return UpdateVerdict.UpdateAvailable;
+        }
+
+        private static HttpClient CreateClient()
+        {
+            HttpClient client = new HttpClient { Timeout = TimeSpan.FromSeconds(10) };
+            client.DefaultRequestHeaders.UserAgent.ParseAdd(Data.UserAgent);
+            return client;
+        }
+
+        private static async Task<string> ReadLatestVersionAsync(CancellationToken cancellationToken)
+        {
+            try
+            {
+                using (HttpResponseMessage response = await Client.GetAsync(
+                           Data.Uri.URL_GITAPI_LATEST, cancellationToken))
+                {
+                    response.EnsureSuccessStatusCode();
+                    string tag = Data.ParseLatestReleaseTag(
+                        await response.Content.ReadAsStringAsync(cancellationToken));
+
+                    if (!string.IsNullOrWhiteSpace(tag))
+                        return tag;
+                }
+            }
+            catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+            {
+                throw;
+            }
+            catch (Exception)
+            {
+            }
+
+            return Data.ParseLatestVersion(
+                await Client.GetStringAsync(Data.Uri.URL_ASSEMBLY, cancellationToken));
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Application/Updates/UpdateVerdict.cs b/src/WinRestoreKit.Application/Updates/UpdateVerdict.cs
new file mode 100644
index 0000000..ca8a0ae
--- /dev/null
+++ b/src/WinRestoreKit.Application/Updates/UpdateVerdict.cs
@@ -0,0 +1,10 @@
+namespace WinRestoreKit
+{
+    internal enum UpdateVerdict
+    {
+        CannotDetermineCurrentVersion,
+        LatestVersionUnreadable,
+        UpToDate,
+        UpdateAvailable
+    }
+}
diff --git a/src/WinRestoreKit.Application/Updates/VersionInfo.cs b/src/WinRestoreKit.Application/Updates/VersionInfo.cs
new file mode 100644
index 0000000..8396840
--- /dev/null
+++ b/src/WinRestoreKit.Application/Updates/VersionInfo.cs
@@ -0,0 +1,27 @@
+using System;
+using System.Reflection;
+
+namespace WinRestoreKit
+{
+    internal static class VersionInfo
+    {
+        internal const string UnknownVersion = "unknown";
+
+        internal static string GetCurrentVersion(Assembly assembly)
+            => Normalize(assembly?.GetCustomAttribute<AssemblyFileVersionAttribute>()?.Version
+                         ?? assembly?.GetName().Version?.ToString());
+
+        internal static string Normalize(string rawVersion)
+        {
+            if (string.IsNullOrWhiteSpace(rawVersion))
+                return UnknownVersion;
+
+            string raw = rawVersion.Trim();
+            int suffix = raw.IndexOfAny(new[] { '+', '-' });
+            string candidate = suffix >= 0 ? raw.Substring(0, suffix) : raw;
+            return Version.TryParse(candidate, out Version parsed) && parsed.Build >= 0
+                ? parsed.ToString(3)
+                : raw;
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Application/WinRestoreKit.Application.csproj b/src/WinRestoreKit.Application/WinRestoreKit.Application.csproj
new file mode 100644
index 0000000..126728c
--- /dev/null
+++ b/src/WinRestoreKit.Application/WinRestoreKit.Application.csproj
@@ -0,0 +1,14 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0-windows</TargetFramework>
+    <RootNamespace>WinRestoreKit</RootNamespace>
+    <AssemblyName>WinRestoreKit.Application</AssemblyName>
+    <Nullable>disable</Nullable>
+    <ImplicitUsings>disable</ImplicitUsings>
+    <Platforms>AnyCPU</Platforms>
+    <Deterministic>true</Deterministic>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\WinRestoreKit.Core\WinRestoreKit.Core.csproj" />
+  </ItemGroup>
+</Project>
diff --git a/src/WinRestoreKit.Core/Conf/AppStoreApps.cs b/src/WinRestoreKit.Core/Conf/AppStoreApps.cs
index eadbd7e..8b8a1d5 100644
--- a/src/WinRestoreKit.Core/Conf/AppStoreApps.cs
+++ b/src/WinRestoreKit.Core/Conf/AppStoreApps.cs
@@ -184,12 +184,9 @@ internal static StepResult Verify(ProcessOutcome outcome, string outputFilePath)
         /// </summary>
         /// <remarks>
         /// The base RestoreAsync wraps Restore in Task.Run, and this is the one module whose Restore
-        /// opens a window. Thread-pool threads are MTA; Windows Forms requires STA, which Program.Main
-        /// declares. ShowDialog from the pool therefore spins up a second message loop on a thread
-        /// that is not apartment-correct: the dialog has no owner and can paint behind the main
-        /// window, and the COM-backed parts of it (clipboard, drag and drop, shell dialogs) are
-        /// unreliable. Every caller reaches this through an await on the UI thread, so returning a
-        /// completed Task keeps the dialog on the thread that owns the window.
+        /// opens a window. Thread-pool threads are MTA; Windows Forms requires the application's STA
+        /// UI thread. The orchestrator therefore calls the owner-aware overload below and this
+        /// completed task keeps the dialog on the thread that owns that window.
         ///
         /// Not marked async on purpose: there is nothing to await, and async here would move the
         /// body back off the caller's thread in every case but the first.
@@ -197,11 +194,17 @@ internal static StepResult Verify(ProcessOutcome outcome, string outputFilePath)
         public override Task<ModuleResult> RestoreAsync(string path)
             => Task.FromResult(Restore(path));
 
+        /// <summary>Runs the dialog on the caller's thread with its modal owner.</summary>
+        internal Task<ModuleResult> RestoreAsync(string path, object owner)
+            => Task.FromResult(Restore(path, owner));
+
         /// <summary>
-        /// Opens the app reinstall dialog for <paramref name="path"/>. Registered by the app at
-        /// startup; null in any process that has no UI to open it with.
+        /// Opens the app reinstall dialog for <paramref name="path"/> with its modal owner.
+        /// Registered by the app at startup; null in any process that has no UI to open it with.
         /// </summary>
         /// <remarks>
+        /// The owner remains <see cref="object"/> here so Core stays WinForms-free. The app passes
+        /// its <c>IWin32Window</c> through this seam and casts it only at the ShowDialog call site.
         /// A delegate rather than a constructor argument because this module is constructed by
         /// Activator.CreateInstance(type) with no arguments in nine test sites, and every module in
         /// the app is enumerated that way. A parameterless constructor is not negotiable here.
@@ -210,27 +213,29 @@ public override Task<ModuleResult> RestoreAsync(string path)
         /// path below is not reachable from the running app. It exists for the test suite and for
         /// any future headless host, where failing closed is the point.
         /// </remarks>
-        internal static Action<string> RestoreDialog;
+        internal static Action<string, object> RestoreDialog;
 
         /// <remarks>
         /// This module restores nothing itself. It opens the app restore dialog, and the installs
         /// happen later from inside it, so Skipped is the only honest answer available here -
         /// claiming a result it does not have would be a new lie in a phase built to remove them.
         ///
-        /// When no dialog is registered the answer is Failed, NOT Skipped, and the distinction is
-        /// the whole reason this seam is written out longhand. Skipped already means something
-        /// specific and true on this module - "the dialog took it from here" - so reusing it for
-        /// "there was no dialog and nothing was offered" would make a total no-op indistinguishable
-        /// from the ordinary success path, in the one module whose success is defined by a window
-        /// having opened. That is the unverified-success claim this architecture exists to prevent.
+        /// When no dialog is registered or no owner is supplied the answer is Failed, NOT Skipped.
+        /// Skipped already means something specific and true on this module - "the dialog took it
+        /// from here" - so reusing it for a total no-op would make a missing dialog or unowned
+        /// dialog indistinguishable from the ordinary interactive path.
         ///
         /// Call this only from the UI thread - see RestoreAsync above.
         /// </remarks>
         public override ModuleResult Restore(string path)
+            => Restore(path, null);
+
+        /// <summary>Opens the registered dialog with an application-owned modal window.</summary>
+        internal ModuleResult Restore(string path, object owner)
         {
             // Read the delegate once: it is static and mutable, and a null check against one read
             // followed by an invoke of another is a race with whatever cleared it.
-            Action<string> dialog = RestoreDialog;
+            Action<string, object> dialog = RestoreDialog;
 
             if (dialog == null)
             {
@@ -242,7 +247,17 @@ public override ModuleResult Restore(string path)
                 });
             }
 
-            dialog(path);
+            if (owner == null)
+            {
+                return ModuleResult.Aggregate(new[]
+                {
+                    StepResult.Failed(Title,
+                        "the app restore dialog requires an owning application window, so nothing " +
+                        "could be offered for reinstall")
+                });
+            }
+
+            dialog(path, owner);
 
             return ModuleResult.Aggregate(new[]
             {
diff --git a/src/WinRestoreKit.Core/Conf/FileModule.cs b/src/WinRestoreKit.Core/Conf/FileModule.cs
index 0c2dd56..3cecaba 100644
--- a/src/WinRestoreKit.Core/Conf/FileModule.cs
+++ b/src/WinRestoreKit.Core/Conf/FileModule.cs
@@ -1,3 +1,4 @@
+using System;
 using WinRestoreKit;
 using System.Collections.Generic;
 using System.IO;
@@ -185,6 +186,26 @@ public override bool HasBackupIn(string restorePath)
             return false;
         }
 
+        /// <summary>
+        /// Removes a previous backup artifact before this run decides whether the source exists.
+        /// </summary>
+        private static string TryClear(string filePath)
+        {
+            try
+            {
+                if (File.Exists(filePath))
+                    File.Delete(filePath);
+
+                return null;
+            }
+            catch (Exception ex)
+            {
+                LogHelper.Instance.LogMessage(
+                    "Could not clear the previous backup file at " + filePath + ": " + ex.Message);
+                return ex.Message;
+            }
+        }
+
         public sealed override async Task<ModuleResult> BackupAsync(string path)
         {
             List<StepResult> steps = new List<StepResult>();
@@ -192,8 +213,17 @@ public sealed override async Task<ModuleResult> BackupAsync(string path)
 
             foreach (string f in Files)
             {
-                CopyResult copy = await Utils.CopyFile(f, Path.Combine(backupDir, BackupFileNameFor(f)))
-                    .ConfigureAwait(true);
+                string destination = Path.Combine(backupDir, BackupFileNameFor(f));
+                string clearError = TryClear(destination);
+
+                if (clearError != null)
+                {
+                    steps.Add(StepResult.Failed(f,
+                        "could not clear the previous backup file at " + destination + ": " + clearError));
+                    continue;
+                }
+
+                CopyResult copy = await Utils.CopyFile(f, destination).ConfigureAwait(true);
 
                 // The live path as the step target, not the Title: these modules carry several
                 // files each, so a per-file row saying only "Windows Terminal" would leave the
diff --git a/src/WinRestoreKit.Core/Conf/FolderModule.cs b/src/WinRestoreKit.Core/Conf/FolderModule.cs
index abe34e7..fd2b904 100644
--- a/src/WinRestoreKit.Core/Conf/FolderModule.cs
+++ b/src/WinRestoreKit.Core/Conf/FolderModule.cs
@@ -1,3 +1,4 @@
+using System;
 using WinRestoreKit;
 using System.Collections.Generic;
 using System.IO;
@@ -110,9 +111,41 @@ public override bool HasBackupIn(string restorePath)
             return false;
         }
 
+        /// <summary>
+        /// Removes this module's previous backup directory before a fresh copy begins.
+        /// </summary>
+        private static string TryClear(string directoryPath)
+        {
+            try
+            {
+                if (Directory.Exists(directoryPath))
+                    Directory.Delete(directoryPath, recursive: true);
+
+                return null;
+            }
+            catch (Exception ex)
+            {
+                LogHelper.Instance.LogMessage(
+                    "Could not clear the previous backup folder at " + directoryPath + ": " + ex.Message);
+                return ex.Message;
+            }
+        }
+
         public sealed override async Task<ModuleResult> BackupAsync(string path)
         {
-            CopyResult copy = await Utils.CopyFolder(Folder, Path.Combine(path, Title));
+            string backupDir = Path.Combine(path, Title);
+            string clearError = TryClear(backupDir);
+
+            if (clearError != null)
+            {
+                return ModuleResult.Aggregate(new[]
+                {
+                    StepResult.Failed(Title,
+                        "could not clear the previous backup folder at " + backupDir + ": " + clearError)
+                });
+            }
+
+            CopyResult copy = await Utils.CopyFolder(Folder, backupDir);
 
             return ModuleResult.Aggregate(new[] { BackupStepFor(copy) });
         }
diff --git a/src/WinRestoreKit.Core/Conf/WPowerPlans.cs b/src/WinRestoreKit.Core/Conf/WPowerPlans.cs
index b638a19..48083b7 100644
--- a/src/WinRestoreKit.Core/Conf/WPowerPlans.cs
+++ b/src/WinRestoreKit.Core/Conf/WPowerPlans.cs
@@ -220,7 +220,7 @@ internal static string ParseActiveSchemeGuid(string text)
         /// <summary>
         /// A powercfg run together with whatever it printed.
         /// </summary>
-        private sealed class ToolCapture
+        protected sealed class ToolCapture
         {
             internal ProcessOutcome Outcome;
 
@@ -245,7 +245,7 @@ private sealed class ToolCapture
         /// It is removed in a finally. A removal that fails is logged and dropped: it leaves a few
         /// hundred bytes in %TEMP% and must never displace the real result of the run.
         /// </remarks>
-        private static async Task<ToolCapture> CaptureAsync(params string[] args)
+        protected virtual async Task<ToolCapture> CaptureAsync(params string[] args)
         {
             ToolCapture capture = new ToolCapture();
 
@@ -375,6 +375,16 @@ public override async Task<ModuleResult> BackupAsync(string path)
 
             try
             {
+                string manifestPath = ManifestPathIn(path);
+                string clearError = TryClear(manifestPath);
+
+                if (clearError != null)
+                {
+                    steps.Add(StepResult.Failed(Title,
+                        "could not clear the previous manifest at " + manifestPath + ": " + clearError));
+                    return ModuleResult.Aggregate(steps);
+                }
+
                 ToolCapture list = await CaptureAsync("/list");
 
                 string problem = ProblemWith(list.Outcome);
diff --git a/src/WinRestoreKit.Core/Results/RegFile.cs b/src/WinRestoreKit.Core/Results/RegFile.cs
index 3a58f65..a99b973 100644
--- a/src/WinRestoreKit.Core/Results/RegFile.cs
+++ b/src/WinRestoreKit.Core/Results/RegFile.cs
@@ -9,6 +9,7 @@ internal enum RegFileCheck
         Missing,
         Empty,
         BadHeader,
+        Invalid,
 
         /// <summary>Present, but we could not read it. Says nothing about its contents.</summary>
         Unreadable
@@ -61,9 +62,45 @@ internal static RegFileCheck Validate(string path, out string error)
             if (string.IsNullOrWhiteSpace(text))
                 return RegFileCheck.Empty;
 
-            return text.StartsWith(Header, StringComparison.OrdinalIgnoreCase)
-                ? RegFileCheck.Valid
-                : RegFileCheck.BadHeader;
+            if (!text.StartsWith(Header, StringComparison.OrdinalIgnoreCase)
+                || (text.Length > Header.Length
+                    && text[Header.Length] != '\r'
+                    && text[Header.Length] != '\n'))
+            {
+                return RegFileCheck.BadHeader;
+            }
+
+            return HasRegistryContent(text) ? RegFileCheck.Valid : RegFileCheck.Invalid;
+        }
+
+        /// <summary>
+        /// A registry export must name at least one exported key after its header. This rejects
+        /// captures interrupted after the header and a final backslash whose continuation was lost.
+        /// </summary>
+        private static bool HasRegistryContent(string text)
+        {
+            string[] lines = text.Replace("\r\n", "\n").Replace("\r", "\n").Split('\n');
+            bool hasKeyDeclaration = false;
+            string lastContent = null;
+
+            foreach (string line in lines)
+            {
+                string trimmed = line.Trim();
+
+                if (trimmed.Length == 0)
+                    continue;
+
+                lastContent = trimmed;
+                if (trimmed.StartsWith("[HKEY_", StringComparison.OrdinalIgnoreCase)
+                    && trimmed.EndsWith("]", StringComparison.Ordinal))
+                {
+                    hasKeyDeclaration = true;
+                }
+            }
+
+            return hasKeyDeclaration
+                && lastContent != null
+                && !lastContent.EndsWith("\\", StringComparison.Ordinal);
         }
 
         /// <summary>
diff --git a/src/WinRestoreKit.Core/Results/RestoreContents.cs b/src/WinRestoreKit.Core/Results/RestoreContents.cs
index c4d59bf..70045a5 100644
--- a/src/WinRestoreKit.Core/Results/RestoreContents.cs
+++ b/src/WinRestoreKit.Core/Results/RestoreContents.cs
@@ -14,13 +14,16 @@ internal sealed class RestoreContentsRow
         internal bool HasBackup { get; }
         internal string ManifestState { get; }
         internal string Warning { get; }
+        internal bool CouldNotBeRead { get; }
 
-        internal RestoreContentsRow(BackupBase module, bool hasBackup, string manifestState, string warning)
+        internal RestoreContentsRow(BackupBase module, bool hasBackup, string manifestState, string warning,
+                                    bool couldNotBeRead = false)
         {
             Module = module;
             HasBackup = hasBackup;
             ManifestState = manifestState;
             Warning = warning;
+            CouldNotBeRead = couldNotBeRead;
         }
     }
 
@@ -48,6 +51,7 @@ internal static IReadOnlyList<RestoreContentsRow> For(IReadOnlyList<BackupBase>
             string probePath = restoreSourcePath;
             BackupPayload.ReadScope payload = null;
             bool payloadPrepared = false;
+            string payloadError = null;
 
             try
             {
@@ -57,14 +61,28 @@ internal static IReadOnlyList<RestoreContentsRow> For(IReadOnlyList<BackupBase>
                         continue;
 
                     string state = ManifestStateFor(manifest, module.GetType().Name);
-                    if (!payloadPrepared
-                        && state != BackupManifest.StateSucceeded
+                    bool needsPayload = state != BackupManifest.StateSucceeded
                         && state != BackupManifest.StateSkipped
-                        && state != BackupManifest.StateFailed)
+                        && state != BackupManifest.StateFailed;
+
+                    if (!payloadPrepared && needsPayload)
                     {
                         payloadPrepared = true;
-                        if (BackupPayload.TryPrepareForRead(restoreSourcePath, out payload, out string ignoredError))
+                        if (BackupPayload.TryPrepareForRead(restoreSourcePath, out payload, out string preparationError))
+                        {
                             probePath = payload.Path;
+                        }
+                        else
+                        {
+                            payloadError = "The backup payload could not be read"
+                                + (string.IsNullOrWhiteSpace(preparationError) ? "." : ": " + preparationError);
+                        }
+                    }
+
+                    if (payloadError != null && needsPayload)
+                    {
+                        rows.Add(new RestoreContentsRow(module, false, state, payloadError, true));
+                        continue;
                     }
 
                     rows.Add(new RestoreContentsRow(
diff --git a/src/WinRestoreKit.Core/Results/RestoreLog.cs b/src/WinRestoreKit.Core/Results/RestoreLog.cs
index c0516a7..def1ff7 100644
--- a/src/WinRestoreKit.Core/Results/RestoreLog.cs
+++ b/src/WinRestoreKit.Core/Results/RestoreLog.cs
@@ -102,27 +102,22 @@ private static IEnumerable<string> SnapshotLines(SnapshotDecision snapshot, stri
                 yield break;
             }
 
-            // RequiresOverride means the gate stopped the restore and the user pushed past it: the
-            // restore happened DESPITE the snapshot, not on the strength of it.
-            //
-            // Everything else defers to the verdict, and ONLY Complete may say the snapshot
-            // completed. Stated as an allowlist rather than by excluding the states that must not
-            // claim it, because excluding them is what went wrong: PartiallyCaptured was added to
-            // the gate and inherited the completion line by default, so a restore that overwrote
-            // items the snapshot had nothing to save for was recorded as fully protected. A verdict
-            // added later must fall back to its own summary, not to a claim nobody checked.
-            bool claimsCompletion =
-                !snapshot.RequiresOverride && snapshot.Verdict == SnapshotVerdict.Complete;
-
-            if (snapshot.RequiresOverride)
-                yield return NoSnapshotWarning;
-            else if (claimsCompletion)
+            // Consent and log wording are independent. PartiallyCaptured needs consent because
+            // some writes have no fallback, but it did capture a snapshot; its own summary names
+            // the missing fallback more accurately than the no-snapshot warning. A NothingCaptured
+            // verdict only gets that warning when the gate required consent: an entirely empty
+            // selection is a legitimate no-op and has no snapshot risk to warn about.
+            bool claimsCompletion = snapshot.Verdict == SnapshotVerdict.Complete;
+            bool isPartialCapture = snapshot.Verdict == SnapshotVerdict.PartiallyCaptured;
+            bool isSafeEmptySnapshot =
+                snapshot.Verdict == SnapshotVerdict.NothingCaptured && !snapshot.RequiresOverride;
+
+            if (claimsCompletion)
                 yield return SnapshotTakenLine;
-            else
-                yield return "# " + snapshot.Summary;
+            else if (!isPartialCapture && !isSafeEmptySnapshot)
+                yield return NoSnapshotWarning;
 
-            if (claimsCompletion || snapshot.RequiresOverride)
-                yield return "# " + snapshot.Summary;
+            yield return "# " + snapshot.Summary;
 
             for (int i = 0; i < snapshot.Failures.Count; i++)
                 yield return "#   " + snapshot.Failures[i];
diff --git a/src/WinRestoreKit.Core/Results/SnapshotGate.cs b/src/WinRestoreKit.Core/Results/SnapshotGate.cs
index ececd0b..7f5f0a0 100644
--- a/src/WinRestoreKit.Core/Results/SnapshotGate.cs
+++ b/src/WinRestoreKit.Core/Results/SnapshotGate.cs
@@ -181,11 +181,10 @@ internal static SnapshotDecision Evaluate(IReadOnlyList<ModuleOutcome> outcomes,
 
                     // Reported, never dropped. Every module reaching this gate is one the restore is
                     // about to overwrite, so a skip means that particular item has no fallback -
-                    // restoring it will write state the snapshot cannot put back. It does not force
-                    // an override, because on this path a skip means the item had nothing to capture
-                    // rather than that the capture refused: the snapshot runs with prompts
-                    // suppressed, so a module cannot decline it. Silently dropping it was how a
-                    // module could be listed as snapshotted while nothing of it was saved.
+                    // restoring it will write state the snapshot cannot put back. A legitimate
+                    // absence still needs an override: whether the capture skipped because there
+                    // was nothing live or failed outright, the user has no fallback for a write
+                    // this restore may make.
                     default:
                         notCaptured.Add(Describe(outcome.Title, outcome.Result.Reason));
                         break;
@@ -201,8 +200,8 @@ internal static SnapshotDecision Evaluate(IReadOnlyList<ModuleOutcome> outcomes,
                 return SnapshotDecision.Create(SnapshotVerdict.ModulesFailed, true, summary, failures);
             }
 
-            // Nothing failed and nothing was captured. This proceeds, but it must SAY so: a user
-            // told "snapshot taken" who then needs to roll back would find an empty folder.
+            // An empty snapshot is safe to proceed only when no considered module can write.
+            // Otherwise the user must explicitly accept that the restore has no fallback.
             if (captured == 0)
             {
                 string summary;
@@ -224,7 +223,7 @@ internal static SnapshotDecision Evaluate(IReadOnlyList<ModuleOutcome> outcomes,
                     summary = "No pre-restore snapshot was taken: none of the selected items change anything when restored.";
                 }
 
-                return SnapshotDecision.Create(SnapshotVerdict.NothingCaptured, false, summary, notCaptured);
+                return SnapshotDecision.Create(SnapshotVerdict.NothingCaptured, considered > 0, summary, notCaptured);
             }
 
             if (notCaptured.Count > 0)
@@ -237,7 +236,7 @@ internal static SnapshotDecision Evaluate(IReadOnlyList<ModuleOutcome> outcomes,
                     "The pre-restore snapshot captured {0} of {1} item(s). The rest had nothing to save, so restoring them cannot be undone:",
                     captured, considered);
 
-                return SnapshotDecision.Create(SnapshotVerdict.PartiallyCaptured, false, summary, notCaptured);
+                return SnapshotDecision.Create(SnapshotVerdict.PartiallyCaptured, true, summary, notCaptured);
             }
 
             return SnapshotDecision.Create(
diff --git a/src/WinRestoreKit.Core/WinRestoreKit.Core.csproj b/src/WinRestoreKit.Core/WinRestoreKit.Core.csproj
index 9af4d33..8f77238 100644
--- a/src/WinRestoreKit.Core/WinRestoreKit.Core.csproj
+++ b/src/WinRestoreKit.Core/WinRestoreKit.Core.csproj
@@ -43,6 +43,8 @@
     -->
     <InternalsVisibleTo Include="WinRestoreKit" />
     <InternalsVisibleTo Include="WinRestoreKit.Tests" />
+    <InternalsVisibleTo Include="WinRestoreKit.Application" />
+    <InternalsVisibleTo Include="WinRestoreKit.Wpf" />
   </ItemGroup>
 
 </Project>
diff --git a/src/WinRestoreKit.Tests/AdvancedHistoryViewModelTests.cs b/src/WinRestoreKit.Tests/AdvancedHistoryViewModelTests.cs
new file mode 100644
index 0000000..0643580
--- /dev/null
+++ b/src/WinRestoreKit.Tests/AdvancedHistoryViewModelTests.cs
@@ -0,0 +1,88 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Navigation;
+using WinRestoreKit.Wpf.ViewModels.History;
+using WinRestoreKit.Wpf.ViewModels.Snapshots;
+using WinRestoreKit.Wpf.ViewModels.Timeline;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class AdvancedHistoryViewModelTests
+    {
+        [Fact]
+        public async Task SearchText_FiltersTheSharedProjectionByDisplayMachinePathAndStatus()
+        {
+            SnapshotEvent verified = NewEvent(SnapshotEventKind.Verified, @"C:\history\alpha", "ALPHA-PC");
+            SnapshotEvent partial = NewEvent(SnapshotEventKind.Partial, @"C:\history\bravo", "BRAVO-PC");
+            SnapshotEvent failed = NewEvent(SnapshotEventKind.Failed, @"C:\history\charlie", "CHARLIE-PC", "disk full");
+            FakeCatalog catalog = new FakeCatalog(verified, partial, failed);
+            AdvancedHistoryViewModel history = new AdvancedHistoryViewModel(catalog);
+
+            await history.RefreshAsync();
+
+            AssertVisible(history, verified, "alpha");
+            AssertVisible(history, partial, "BRAVO-PC");
+            AssertVisible(history, partial, "history\\bravo");
+            AssertVisible(history, partial, "partial snapshot");
+        }
+
+        [Fact]
+        public async Task RefreshAsync_ReusesTheSameStableStatusProjectionAsTimeline()
+        {
+            SnapshotEvent failed = NewEvent(SnapshotEventKind.Failed, @"C:\history\failed", "TEST-PC", "disk full");
+            FakeCatalog catalog = new FakeCatalog(failed);
+            TimelineViewModel timeline = new TimelineViewModel(
+                catalog, new FakePreparationService(), new RecordingNavigator());
+            AdvancedHistoryViewModel history = new AdvancedHistoryViewModel(catalog);
+
+            await timeline.RefreshAsync();
+            await history.RefreshAsync();
+
+            SnapshotEventViewModel timelineEvent = Assert.Single(timeline.Events);
+            SnapshotEventViewModel historyEvent = Assert.Single(history.Events.Cast<SnapshotEventViewModel>());
+            Assert.Same(timelineEvent.Status, historyEvent.Status);
+            Assert.Equal("Backup failed", historyEvent.Status.Label);
+            Assert.Equal("disk full", historyEvent.DiagnosticReason);
+        }
+
+        private static void AssertVisible(AdvancedHistoryViewModel history, SnapshotEvent expected, string search)
+        {
+            history.SearchText = search;
+            SnapshotEventViewModel visible = Assert.Single(history.Events.Cast<SnapshotEventViewModel>());
+            Assert.Same(expected, visible.Event);
+        }
+
+        private static SnapshotEvent NewEvent(SnapshotEventKind kind, string path, string machine, string reason = null)
+            => new SnapshotEvent(kind, new DateTime(2026, 8, 9, 12, 0, 0, DateTimeKind.Local),
+                Path.GetFileName(path), Path.GetFullPath(path), reason, machine, 1024, true, null);
+
+        private sealed class FakeCatalog : ISnapshotEventReader
+        {
+            private readonly IReadOnlyList<SnapshotEvent> events;
+
+            internal FakeCatalog(params SnapshotEvent[] events) => this.events = events;
+
+            public IReadOnlyList<SnapshotEvent> Read() => events;
+        }
+
+        private sealed class FakePreparationService : ISnapshotPayloadPreparationService
+        {
+            public Task<SnapshotPayloadPreparation> PrepareAsync(SnapshotEvent snapshot,
+                CancellationToken cancellationToken)
+                => Task.FromResult(new SnapshotPayloadPreparation(snapshot, null, "unexpected preparation"));
+        }
+
+        private sealed class RecordingNavigator : ITimelineNavigator
+        {
+            public void OpenCompare(SnapshotPayloadPreparation preparation) => preparation.Dispose();
+
+            public void ShowSnapshotDiagnostic(SnapshotEvent snapshot) { }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/AppRestoreDialogTests.cs b/src/WinRestoreKit.Tests/AppRestoreDialogTests.cs
index 6d05102..d1df104 100644
--- a/src/WinRestoreKit.Tests/AppRestoreDialogTests.cs
+++ b/src/WinRestoreKit.Tests/AppRestoreDialogTests.cs
@@ -3,691 +3,167 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Text;
-// CloseReason only. Naming an enum member does not create a window or a message loop.
 using System.Windows.Forms;
+using WinRestoreKit;
 using Views;
 using Xunit;
 
 namespace WinRestoreKit.Tests
 {
-    /// <summary>
-    /// Covers the app restore dialog's pure surfaces: the export filename, the reader, the list
-    /// state, and the end-of-run summary.
-    /// </summary>
-    /// <remarks>
-    /// No test constructs RestAppsForm. Constructing it runs InitializeComponent and LoadBackups,
-    /// which opens a window and can raise a modal MessageBox - in a test run that is a message loop
-    /// nobody will ever close. Everything asserted here is deliberately internal static so it can be
-    /// reached without one, following the precedent set by RestAppsForm.Describe.
-    ///
-    /// Everything here also runs unelevated and never invokes winget.
-    /// </remarks>
     public class AppRestoreDialogTests
     {
         private static string NewTempDir()
-        {
-            string dir = Path.Combine(Path.GetTempPath(), "acapps_" + Guid.NewGuid().ToString("N"));
-            Directory.CreateDirectory(dir);
-            return dir;
-        }
+            => Directory.CreateDirectory(Path.Combine(Path.GetTempPath(), "acapps_" + Guid.NewGuid().ToString("N"))).FullName;
 
         private static string ExportWith(params string[] ids)
         {
-            StringBuilder packages = new StringBuilder();
-
-            for (int i = 0; i < ids.Length; i++)
+            var packages = new StringBuilder();
+            for (int index = 0; index < ids.Length; index++)
             {
-                if (i > 0)
+                if (index > 0)
                     packages.Append(',');
-
-                packages.Append("{\"PackageIdentifier\":\"").Append(ids[i]).Append("\"}");
+                packages.Append("{\"PackageIdentifier\":\"").Append(ids[index]).Append("\"}");
             }
-
             return "{\"Sources\":[{\"Packages\":[" + packages + "]}]}";
         }
 
-        // ---- the dialog seam -------------------------------------------------------------
-
-        /// <summary>
-        /// Swaps AppStoreApps.RestoreDialog for the duration of a test and puts it back.
-        /// </summary>
-        /// <remarks>
-        /// The hook is static, exactly like LogHelper's sink, and the same hazard applies: one left
-        /// behind here outlives the test that set it. A leaked hook would make every later test that
-        /// restores this module run someone else's lambda.
-        /// </remarks>
-        private sealed class DialogHook : IDisposable
-        {
-            private readonly Action<string> previous;
-
-            public DialogHook(Action<string> replacement)
-            {
-                previous = AppStoreApps.RestoreDialog;
-                AppStoreApps.RestoreDialog = replacement;
-            }
-
-            public void Dispose() => AppStoreApps.RestoreDialog = previous;
-        }
-
-        // The judgement call this module's restore turns on. Skipped is already TRUE here when a
-        // dialog ran - "the dialog took it from here" - so reusing it when no dialog exists would
-        // make a total no-op read exactly like the ordinary success path.
         [Fact]
-        public void Restore_WithNoDialogRegistered_FailsRatherThanClaimingSkipped()
+        public void ReadFromSource_UsesTheProducerExportPath()
         {
-            using (new DialogHook(null))
-            {
-                ModuleResult result = new AppStoreApps().Restore(NewTempDir());
-
-                Assert.Equal(ResultState.Failed, result.State);
-                Assert.Contains("restore dialog", result.Reason, StringComparison.Ordinal);
-            }
-        }
-
-        [Fact]
-        public void Restore_WithADialogRegistered_OpensItForTheSelectedSourceAndReportsSkipped()
-        {
-            int opened = 0;
-            string source = NewTempDir();
-            string openedFor = null;
-
+            string root = NewTempDir();
             try
             {
-                using (new DialogHook(path =>
-                {
-                    opened++;
-                    openedFor = path;
-                }))
-                {
-                    ModuleResult result = new AppStoreApps().Restore(source);
-
-                    Assert.Equal(1, opened);
-                    Assert.Equal(Path.GetFullPath(source), Path.GetFullPath(openedFor), StringComparer.OrdinalIgnoreCase);
-                    Assert.Equal(ResultState.Skipped, result.State);
-                    Assert.Equal("handled interactively in the app restore dialog",
-                        result.Steps[0].Reason, StringComparer.Ordinal);
-                }
-            }
-            finally
-            {
-                try { Directory.Delete(source, true); } catch { }
-            }
-        }
-
-        // RestoreAsync returns a completed Task on purpose so the dialog opens on the caller's STA
-        // thread rather than an MTA pool thread. Nothing pinned that until now, and the seam made it
-        // observable without constructing a window.
-        [Fact]
-        public void RestoreAsync_RunsTheDialogOnTheCallersThread()
-        {
-            int dialogThread = 0;
-
-            using (new DialogHook(_ => dialogThread = Environment.CurrentManagedThreadId))
-            {
-                System.Threading.Tasks.Task<ModuleResult> task =
-                    new AppStoreApps().RestoreAsync(NewTempDir());
-
-                Assert.True(task.IsCompleted);
-                Assert.Equal(Environment.CurrentManagedThreadId, dialogThread);
-            }
-        }
-
-        // ---- the filename ----------------------------------------------------------------
-
-        // Ordinal on purpose. This name existed in four spellings at once, three of which differed
-        // only in case; a case-insensitive assertion would pass on every one of them and so would
-        // reproduce the very bug it is here to prevent.
-        [Fact]
-        public void ExportFileName_IsTheModuleTitlePlusALowercaseJsonExtension()
-        {
-            Assert.Equal("Remember installed apps.json", AppStoreApps.ExportFileName, StringComparer.Ordinal);
-            Assert.Equal(AppStoreApps.ModuleTitle + ".json", AppStoreApps.ExportFileName, StringComparer.Ordinal);
-            Assert.EndsWith(".json", AppStoreApps.ExportFileName, StringComparison.Ordinal);
-        }
-
-        [Fact]
-        public void ModuleTitle_IsTheTitleTheModuleActuallyCarries()
-            => Assert.Equal(AppStoreApps.ModuleTitle, new AppStoreApps().Title, StringComparer.Ordinal);
-
-        // The producer's path and the dialog's path must name ONE file. Written through the
-        // producer, found through the reader - which is the round trip that was broken.
-        [Fact]
-        public void ProducerPathAndDialogPath_ResolveToTheSameFile()
-        {
-            string backupName = "acapps_" + Guid.NewGuid().ToString("N");
-            string backupDir = Path.Combine(DataHelper.Data.DataRootDir, backupName);
-
-            Directory.CreateDirectory(backupDir);
-
-            try
-            {
-                string written = AppStoreApps.ExportPathIn(backupDir);
-                File.WriteAllText(written, ExportWith("Microsoft.PowerToys"));
-
-                string read = RestAppsForm.ExportPathFor(backupDir);
-
-                Assert.True(File.Exists(read), "the dialog's path did not find the file the module wrote: " + read);
-                Assert.Equal(Path.GetFullPath(written), Path.GetFullPath(read), StringComparer.OrdinalIgnoreCase);
-
-                RestAppsForm.AppExport export = RestAppsForm.AppExport.Read(read);
-
-                Assert.Equal(RestAppsForm.AppExportState.Ok, export.State);
+                File.WriteAllText(AppStoreApps.ExportPathIn(root), ExportWith("Microsoft.PowerToys"));
+                AppExport export = AppRestoreService.ReadFromSource(root);
+                Assert.Equal(AppExportState.Ok, export.State);
                 Assert.Equal(new[] { "Microsoft.PowerToys" }, export.PackageIdentifiers);
             }
-            finally
-            {
-                try { Directory.Delete(backupDir, true); } catch { }
-            }
+            finally { Directory.Delete(root, true); }
         }
 
         [Fact]
-        public void BackupSources_PrefersTheExtractedRestoreSourceForPackageExport()
+        public void ReadFromSource_EmptyPackagesIsOkButMissingPackagesIsUnreadable()
         {
-            string extractedSource = NewTempDir();
-            string otherBackup = NewTempDir();
-
+            string root = NewTempDir();
             try
             {
-                File.WriteAllText(
-                    AppStoreApps.ExportPathIn(extractedSource),
-                    ExportWith("From.Extracted.Source"));
-                File.WriteAllText(
-                    AppStoreApps.ExportPathIn(otherBackup),
-                    ExportWith("From.Other.Backup"));
-
-                IReadOnlyList<string> sources = RestAppsForm.BackupSources(
-                    extractedSource,
-                    new[] { otherBackup });
-
-                Assert.Equal(new[] { extractedSource, otherBackup }, sources, StringComparer.OrdinalIgnoreCase);
+                File.WriteAllText(AppStoreApps.ExportPathIn(root), ExportWith());
+                AppExport empty = AppRestoreService.ReadFromSource(root);
+                Assert.Equal(AppExportState.Ok, empty.State);
+                Assert.Empty(empty.PackageIdentifiers);
 
-                RestAppsForm.AppExport export = RestAppsForm.AppExport.Read(
-                    RestAppsForm.ExportPathFor(sources[0]));
-
-                Assert.Equal(new[] { "From.Extracted.Source" }, export.PackageIdentifiers);
-            }
-            finally
-            {
-                try { Directory.Delete(extractedSource, true); } catch { }
-                try { Directory.Delete(otherBackup, true); } catch { }
-            }
-        }
-
-        // ---- Parse -----------------------------------------------------------------------
-
-        [Fact]
-        public void Parse_ReturnsIdentifiersInFileOrder()
-        {
-            RestAppsForm.AppExport export = RestAppsForm.AppExport.Parse(
-                ExportWith("A.One", "B.Two", "C.Three"), "x.json");
-
-            Assert.Equal(RestAppsForm.AppExportState.Ok, export.State);
-            Assert.Equal(new[] { "A.One", "B.Two", "C.Three" }, export.PackageIdentifiers);
-        }
-
-        // A machine with no winget packages is a fact, not a fault.
-        [Fact]
-        public void Parse_AnEmptyPackagesArray_IsNotAProblem()
-        {
-            RestAppsForm.AppExport export = RestAppsForm.AppExport.Parse(ExportWith(), "x.json");
-
-            Assert.Equal(RestAppsForm.AppExportState.Ok, export.State);
-            Assert.False(export.IsProblem);
-            Assert.Empty(export.PackageIdentifiers);
-        }
-
-        // A missing Packages array is not the same as an empty one: that file restores nothing.
-        [Fact]
-        public void Parse_NoPackagesArray_IsAProblemAndSaysSo()
-        {
-            RestAppsForm.AppExport export = RestAppsForm.AppExport.Parse("{\"Sources\":[{}]}", "x.json");
-
-            Assert.Equal(RestAppsForm.AppExportState.Unreadable, export.State);
-            Assert.True(export.IsProblem);
-            Assert.Contains("no list of packages", export.Message);
-        }
-
-        [Fact]
-        public void Parse_InvalidJson_SaysSoAndDoesNotThrow()
-        {
-            RestAppsForm.AppExport export = RestAppsForm.AppExport.Parse("{not json at all", "x.json");
-
-            Assert.Equal(RestAppsForm.AppExportState.Unreadable, export.State);
-            Assert.Contains("not valid JSON", export.Message);
-            Assert.Empty(export.PackageIdentifiers);
-        }
-
-        // A blank row is tickable, and a ticked blank row reaches winget install --id "".
-        [Fact]
-        public void Parse_EntriesWithNoPackageIdentifier_AreSkipped()
-        {
-            RestAppsForm.AppExport export = RestAppsForm.AppExport.Parse(
-                "{\"Sources\":[{\"Packages\":[{\"PackageIdentifier\":\"A.One\"},{},{\"PackageIdentifier\":\"\"},{\"PackageIdentifier\":\"B.Two\"}]}]}",
-                "x.json");
-
-            Assert.Equal(RestAppsForm.AppExportState.Ok, export.State);
-            Assert.Equal(new[] { "A.One", "B.Two" }, export.PackageIdentifiers);
-        }
-
-        // ---- Read ------------------------------------------------------------------------
-
-        // Absent is the ORDINARY case: this dialog is reachable standalone, and most backup folders
-        // contain no app export at all. It must not raise a problem.
-        [Fact]
-        public void Read_MissingFile_IsAbsentAndNamesThePath()
-        {
-            string dir = NewTempDir();
-
-            try
-            {
-                string path = AppStoreApps.ExportPathIn(dir);
-                RestAppsForm.AppExport export = RestAppsForm.AppExport.Read(path);
-
-                Assert.Equal(RestAppsForm.AppExportState.Absent, export.State);
-                Assert.False(export.IsProblem);
-                Assert.Contains(path, export.Message);
-                Assert.Empty(export.PackageIdentifiers);
-            }
-            finally
-            {
-                try { Directory.Delete(dir, true); } catch { }
-            }
-        }
-
-        [Fact]
-        public void Read_AGoodFile_IsOk()
-        {
-            string dir = NewTempDir();
-
-            try
-            {
-                string path = AppStoreApps.ExportPathIn(dir);
-                File.WriteAllText(path, ExportWith("A.One"));
-
-                RestAppsForm.AppExport export = RestAppsForm.AppExport.Read(path);
-
-                Assert.Equal(RestAppsForm.AppExportState.Ok, export.State);
-                Assert.Equal(new[] { "A.One" }, export.PackageIdentifiers);
-            }
-            finally
-            {
-                try { Directory.Delete(dir, true); } catch { }
+                File.WriteAllText(AppStoreApps.ExportPathIn(root), "{\"Sources\":[{}]}");
+                AppExport missing = AppRestoreService.ReadFromSource(root);
+                Assert.Equal(AppExportState.Unreadable, missing.State);
+                Assert.Contains("no list of packages", missing.Message);
             }
+            finally { Directory.Delete(root, true); }
         }
 
         [Fact]
-        public void Read_AnInvalidFile_IsAProblem()
+        public void ReadFromSource_MissingExportIsAbsentAndReadFailuresAreUnreadable()
         {
-            string dir = NewTempDir();
-
+            string root = NewTempDir();
             try
             {
-                string path = AppStoreApps.ExportPathIn(dir);
-                File.WriteAllText(path, "{not json at all");
-
-                RestAppsForm.AppExport export = RestAppsForm.AppExport.Read(path);
-
-                Assert.Equal(RestAppsForm.AppExportState.Unreadable, export.State);
-                Assert.True(export.IsProblem);
-            }
-            finally
-            {
-                try { Directory.Delete(dir, true); } catch { }
+                Assert.Equal(AppExportState.Absent, AppRestoreService.ReadFromSource(root).State);
+                Assert.Equal(AppExportState.Unreadable,
+                    AppRestoreService.ReadFromSource(Path.Combine(root, "gone")).State);
+                Assert.Equal(AppExportState.Unreadable, AppRestoreService.ReadFromSource(null).State);
             }
+            finally { Directory.Delete(root, true); }
         }
 
-        // Read runs during CONSTRUCTION, before any window exists, where an escaping exception
-        // terminates the process. Nothing may escape it - not a directory handed in where a file was
-        // expected, not a file another handle holds open, not a nonsense path.
         [Fact]
-        public void Read_IsTotal()
+        public void ReadFromSource_OmitsBlankIdentifiersInFileOrder()
         {
-            string dir = NewTempDir();
-
+            string root = NewTempDir();
             try
             {
-                // A directory where a file was expected.
-                Assert.NotNull(RestAppsForm.AppExport.Read(dir));
-
-                // ...and it is Unreadable, not Absent. This is the case that pins the rule: to
-                // File.Exists a directory is indistinguishable from nothing at all, and the old
-                // Read believed it - answering "this backup contains no app export" about a path it
-                // had not been able to look inside. Absent is a claim about the folder's contents
-                // and is only earned by a read that came back saying the file is not there.
-                Assert.Equal(RestAppsForm.AppExportState.Unreadable,
-                             RestAppsForm.AppExport.Read(dir).State);
-
-                // A path whose CONTAINING FOLDER is not there is Unreadable too, and this is the
-                // narrower half of the same rule. Only a read that opened the folder and did not
-                // find the file has seen enough to call it an absence. The folder vanishing between
-                // LoadBackups enumerating it and this read means a pulled drive or a dropped network
-                // path - the world changing, not a backup that contains no apps.
-                Assert.Equal(
-                    RestAppsForm.AppExportState.Unreadable,
-                    RestAppsForm.AppExport.Read(Path.Combine(dir, "gone", "apps.json")).State);
-
-                // And the one case that IS an absence: the folder is right there, the file is not.
-                Assert.Equal(
-                    RestAppsForm.AppExportState.Absent,
-                    RestAppsForm.AppExport.Read(Path.Combine(dir, "apps.json")).State);
-
-                // A file locked by another handle.
-                string locked = Path.Combine(dir, "locked.json");
-
-                using (FileStream hold = new FileStream(locked, FileMode.Create, FileAccess.ReadWrite, FileShare.None))
-                {
-                    hold.WriteByte((byte)'{');
-                    hold.Flush();
-
-                    RestAppsForm.AppExport export = RestAppsForm.AppExport.Read(locked);
-
-                    Assert.Equal(RestAppsForm.AppExportState.Unreadable, export.State);
-                    Assert.NotNull(export.PackageIdentifiers);
-                }
-            }
-            finally
-            {
-                try { Directory.Delete(dir, true); } catch { }
-            }
-
-            // Paths that are not paths, and no path at all.
-            foreach (string path in new[] { null, "", "   ", "\0::invalid", "Z:\\no\\such\\place\\x.json" })
-            {
-                RestAppsForm.AppExport export = RestAppsForm.AppExport.Read(path);
-
-                Assert.NotNull(export);
-                Assert.NotNull(export.PackageIdentifiers);
+                File.WriteAllText(AppStoreApps.ExportPathIn(root),
+                    "{\"Sources\":[{\"Packages\":[{\"PackageIdentifier\":\"A.One\"},{},{\"PackageIdentifier\":\"\"},{\"PackageIdentifier\":\"B.Two\"}]}]}");
+                Assert.Equal(new[] { "A.One", "B.Two" },
+                    AppRestoreService.ReadFromSource(root).PackageIdentifiers);
             }
+            finally { Directory.Delete(root, true); }
         }
 
-        // ---- list state ------------------------------------------------------------------
-
         [Fact]
-        public void ComposeListState_AFailedRead_YieldsAnEmptyListAndNoRestore()
+        public void ComposeListState_EnablesOnlyWhenThereAreIdentifiers()
         {
-            RestAppsForm.ListState state = RestAppsForm.ComposeListState(
-                RestAppsForm.AppExport.Unreadable("broken"));
-
-            Assert.Empty(state.Items);
-            Assert.False(state.RestoreEnabled);
+            Assert.False(AppRestoreService.ComposeListState(AppExport.Absent("missing")).InstallEnabled);
+            Assert.False(AppRestoreService.ComposeListState(AppExport.Unreadable("broken")).InstallEnabled);
+            Assert.True(AppRestoreService.ComposeListState(AppExport.Ok(new[] { "A.One" }, "read")).InstallEnabled);
         }
 
         [Fact]
-        public void ComposeListState_AnAbsentExport_YieldsAnEmptyListAndNoRestore()
+        public void RouteProblem_DefersOnlyUnreadableExportsBeforeTheWindowExists()
         {
-            RestAppsForm.ListState state = RestAppsForm.ComposeListState(
-                RestAppsForm.AppExport.Absent("nothing there"));
-
-            Assert.Empty(state.Items);
-            Assert.False(state.RestoreEnabled);
+            Assert.Equal(AppRestoreProblemRouting.Defer,
+                AppRestoreService.RouteProblem(AppExport.Unreadable("broken"), false));
+            Assert.Equal(AppRestoreProblemRouting.ShowNow,
+                AppRestoreService.RouteProblem(AppExport.Unreadable("broken"), true));
+            Assert.Equal(AppRestoreProblemRouting.None,
+                AppRestoreService.RouteProblem(AppExport.Absent("missing"), false));
         }
 
-        // An export that read perfectly but holds no apps still leaves nothing to install.
         [Fact]
-        public void ComposeListState_AnEmptyExport_StillDisablesRestore()
+        public void ComposeOutcome_PreservesStoppedAndFailedFacts()
         {
-            RestAppsForm.ListState state = RestAppsForm.ComposeListState(
-                RestAppsForm.AppExport.Parse(ExportWith(), "x.json"));
-
-            Assert.Empty(state.Items);
-            Assert.False(state.RestoreEnabled);
-        }
+            AppRestoreOutcome stopped = AppRestoreService.ComposeOutcome(10, 2, Array.Empty<string>());
+            Assert.Equal(RunSeverity.Information, stopped.Severity);
+            Assert.Contains("8 were not started", stopped.Text);
 
-        [Fact]
-        public void ComposeListState_AnExportWithApps_EnablesRestore()
-        {
-            RestAppsForm.ListState state = RestAppsForm.ComposeListState(
-                RestAppsForm.AppExport.Parse(ExportWith("A.One", "B.Two"), "x.json"));
-
-            Assert.Equal(new[] { "A.One", "B.Two" }, state.Items);
-            Assert.True(state.RestoreEnabled);
-        }
-
-        // ---- where a problem gets reported -----------------------------------------------
-
-        // The dialog used to be raised straight out of ApplyExport, which runs during CONSTRUCTION:
-        // LoadBackups sets SelectedIndex, the handler fires, and all of that happens before
-        // AStoreApps calls ShowDialog. Passing `this` as owner forced handle creation on an unshown
-        // form, so the box got an effectively invisible owner and could paint BEHIND the main
-        // window - which during an orchestrated restore is disabled. Frozen app, no cause, no exit.
-        [Fact]
-        public void RouteProblem_BeforeTheWindowIsShown_IsDeferredRatherThanShown()
-        {
-            Assert.Equal(RestAppsForm.ProblemRouting.Defer,
-                RestAppsForm.RouteProblem(RestAppsForm.AppExport.Unreadable("broken"), hasBeenShown: false));
+            AppRestoreOutcome failed = AppRestoreService.ComposeOutcome(10, 3,
+                new[] { "A.One: winget exited with code 1" });
+            Assert.Equal(RunSeverity.Warning, failed.Severity);
+            Assert.Contains("3 of 10", failed.Text);
+            Assert.Contains("A.One: winget exited with code 1", failed.Text);
         }
 
-        // Picking a different backup from the dropdown is a live window and must still report at once.
         [Fact]
-        public void RouteProblem_AfterTheWindowIsShown_IsReportedImmediately()
+        public void Describe_DistinguishesUnknownStartedProcessFromNeverStarted()
         {
-            Assert.Equal(RestAppsForm.ProblemRouting.ShowNow,
-                RestAppsForm.RouteProblem(RestAppsForm.AppExport.Unreadable("broken"), hasBeenShown: true));
+            Assert.Contains("could not run winget", AppRestoreService.Describe(ProcessOutcome.NeverStarted("missing")));
+            string unknown = AppRestoreService.Describe(ProcessOutcome.OutcomeUnknown("pipe closed"));
+            Assert.Contains("could not be determined", unknown);
+            Assert.DoesNotContain("could not run winget", unknown);
         }
 
-        // Absent must NOT be collapsed into Unreadable by the deferral. It is the ordinary case -
-        // most backup folders hold no app export - so it stays log-only, shown or not.
         [Fact]
-        public void RouteProblem_AnAbsentExport_IsNeverReportedAtAll()
-        {
-            Assert.Equal(RestAppsForm.ProblemRouting.None,
-                RestAppsForm.RouteProblem(RestAppsForm.AppExport.Absent("nothing there"), hasBeenShown: false));
-
-            Assert.Equal(RestAppsForm.ProblemRouting.None,
-                RestAppsForm.RouteProblem(RestAppsForm.AppExport.Absent("nothing there"), hasBeenShown: true));
-        }
-
-        [Fact]
-        public void RouteProblem_AGoodExport_IsNeverReported()
-        {
-            RestAppsForm.AppExport ok = RestAppsForm.AppExport.Parse(ExportWith("A.One"), "x.json");
-
-            Assert.Equal(RestAppsForm.ProblemRouting.None, RestAppsForm.RouteProblem(ok, hasBeenShown: false));
-            Assert.Equal(RestAppsForm.ProblemRouting.None, RestAppsForm.RouteProblem(ok, hasBeenShown: true));
-        }
-
-        [Fact]
-        public void RouteProblem_NoExport_IsNotAProblemAndDoesNotThrow()
-        {
-            Assert.Equal(RestAppsForm.ProblemRouting.None, RestAppsForm.RouteProblem(null, hasBeenShown: false));
-            Assert.Equal(RestAppsForm.ProblemRouting.None, RestAppsForm.RouteProblem(null, hasBeenShown: true));
-        }
-
-        // ---- which closes this dialog gets a vote on -------------------------------------
-
-        // The handler checked only the installing flag, so it vetoed EVERY CloseReason. A mid-install
-        // Application.Exit or a close of the owning MainForm was silently refused and the app looked
-        // hung; WindowsShutDown was refused until Windows overrode it, having first shown the user a
-        // blocked-shutdown screen naming WinRestoreKit.
-        [Fact]
-        public void ShouldDeferClose_OnlyAUserClosingThisDialogIsHeldBack()
-        {
-            Assert.True(RestAppsForm.ShouldDeferClose(installing: true, CloseReason.UserClosing));
-
-            foreach (CloseReason reason in new[]
-            {
-                CloseReason.ApplicationExitCall,
-                CloseReason.FormOwnerClosing,
-                CloseReason.MdiFormClosing,
-                CloseReason.WindowsShutDown,
-                CloseReason.TaskManagerClosing,
-                CloseReason.None
-            })
-            {
-                Assert.False(RestAppsForm.ShouldDeferClose(installing: true, reason),
-                    "a close this dialog does not get a vote on was vetoed: " + reason);
-            }
-        }
-
-        // With no install running there is nothing to wait for, whoever is closing.
-        [Fact]
-        public void ShouldDeferClose_WhenNotInstalling_NothingIsEverHeldBack()
-        {
-            foreach (CloseReason reason in Enum.GetValues<CloseReason>())
-                Assert.False(RestAppsForm.ShouldDeferClose(installing: false, reason));
-        }
-
-        /// <summary>
-        /// A closed-but-not-disposed form cannot own the install summary.
-        /// </summary>
-        /// <remarks>
-        /// This is the state both callers actually leave the form in. They open it with ShowDialog
-        /// and neither disposes it, and ShowDialog does not dispose on its own - Close on a modal
-        /// form hides it - so after any close ShouldDeferClose does not hold back, the window is
-        /// invisible while IsDisposed and Disposing are both still false. A guard testing only
-        /// disposal would pass here and raise a modal owned by an invisible window, which is the
-        /// hidden-dialog defect rather than the crash, and just as silent.
-        /// </remarks>
-        [Fact]
-        public void CanOwnADialog_AHiddenFormCannot_EvenWhenItIsNotDisposed()
-        {
-            Assert.True(RestAppsForm.CanOwnADialog(isDisposed: false, disposing: false, visible: true));
-
-            Assert.False(RestAppsForm.CanOwnADialog(isDisposed: false, disposing: false, visible: false));
-            Assert.False(RestAppsForm.CanOwnADialog(isDisposed: true, disposing: false, visible: true));
-            Assert.False(RestAppsForm.CanOwnADialog(isDisposed: false, disposing: true, visible: true));
-        }
-
-        // stopRequested is only read BETWEEN packages, so a wedged winget holds this dialog until
-        // RunWingetAsync's timeout kills it. The caption has to say the wait ends either way.
-        [Fact]
-        public void StoppingText_SaysTheWaitIsBoundedByATimeout()
+        public void WinFormsCloseRulesRemainPresentationSpecific()
         {
+            Assert.True(RestAppsForm.ShouldDeferClose(true, CloseReason.UserClosing));
+            Assert.False(RestAppsForm.ShouldDeferClose(true, CloseReason.ApplicationExitCall));
+            Assert.False(RestAppsForm.CanOwnADialog(false, false, false));
             Assert.Contains("timeout", RestAppsForm.StoppingText, StringComparison.OrdinalIgnoreCase);
-            Assert.Contains("current app", RestAppsForm.StoppingText, StringComparison.OrdinalIgnoreCase);
-        }
-
-        // ---- outcome composition ---------------------------------------------------------
-
-        [Fact]
-        public void ComposeOutcome_NothingTicked_SaysNothingWasInstalled()
-        {
-            RestAppsForm.OutcomeMessage m = RestAppsForm.ComposeOutcome(0, 0, new string[0]);
-
-            Assert.Contains("No apps were ticked", m.Text);
-            Assert.DoesNotContain("did not install", m.Text);
-        }
-
-        [Fact]
-        public void ComposeOutcome_AllInstalled_SaysInstalledNotRestored()
-        {
-            RestAppsForm.OutcomeMessage m = RestAppsForm.ComposeOutcome(3, 3, new string[0]);
-
-            Assert.Contains("winget installed 3 app(s)", m.Text);
-
-            // "restored" would be a claim nothing here verified: an already-present package is
-            // upgraded to the current version, and no version is pinned.
-            Assert.DoesNotContain("restored", m.Text);
-        }
-
-        [Fact]
-        public void ComposeOutcome_SomeFailed_NamesEveryFailure()
-        {
-            List<string> failures = new List<string>
-            {
-                "A.One: winget exited with code 1",
-                "B.Two: could not run winget: not installed"
-            };
-
-            RestAppsForm.OutcomeMessage m = RestAppsForm.ComposeOutcome(4, 4, failures);
-
-            Assert.Contains("2 of 4 app(s) did not install", m.Text);
-
-            foreach (string failure in failures)
-                Assert.Contains(failure, m.Text);
-        }
-
-        // Stopping after 2 of 10 leaves 8 that were never attempted. Calling those failures would be
-        // a false alarm; folding them into the attempted count would hide what actually happened.
-        [Fact]
-        public void ComposeOutcome_StoppedEarly_SeparatesNotStartedFromFailed()
-        {
-            RestAppsForm.OutcomeMessage m = RestAppsForm.ComposeOutcome(10, 2, new string[0]);
-
-            Assert.Contains("2 of 10", m.Text);
-            Assert.Contains("not started", m.Text);
-            Assert.DoesNotContain("did not install", m.Text);
-        }
-
-        [Fact]
-        public void ComposeOutcome_StoppedEarlyWithAFailure_KeepsBothFacts()
-        {
-            RestAppsForm.OutcomeMessage m = RestAppsForm.ComposeOutcome(
-                10, 3, new[] { "A.One: winget exited with code 1" });
-
-            // The stop.
-            Assert.Contains("3 of 10", m.Text);
-            Assert.Contains("not started", m.Text);
-
-            // And the failure, which must not be swallowed by the stop.
-            Assert.Contains("A.One: winget exited with code 1", m.Text);
-            Assert.Contains("1 of the 3 attempted failed", m.Text);
-        }
-
-        [Fact]
-        public void ComposeOutcome_NullFailures_IsTreatedAsNone()
-        {
-            RestAppsForm.OutcomeMessage m = RestAppsForm.ComposeOutcome(2, 2, null);
-
-            Assert.Contains("winget installed 2 app(s)", m.Text);
-        }
-
-        // ---- the producer's verify ladder ------------------------------------------------
-
-        // AStoreApps.Verify had no test at all. This covers the mapping, not winget.
-        [Fact]
-        public void Verify_NamesEveryWayTheExportCanFail()
-        {
-            string missing = Path.Combine(NewTempDir(), "nope.json");
-
-            Assert.Equal(ResultState.Failed, AppStoreApps.Verify(null, missing).State);
-            Assert.Equal(ResultState.Failed, AppStoreApps.Verify(ProcessOutcome.NeverStarted("no winget"), missing).State);
-            Assert.Equal(ResultState.Failed, AppStoreApps.Verify(ProcessOutcome.Timeout(), missing).State);
-            Assert.Equal(ResultState.Failed, AppStoreApps.Verify(ProcessOutcome.OutcomeUnknown("pipe closed"), missing).State);
-            Assert.Equal(ResultState.Failed, AppStoreApps.Verify(ProcessOutcome.Ran(1), missing).State);
-
-            // Exit code 0 is not evidence: winget exits 0 having written nothing when it has no
-            // source configured.
-            Assert.Equal(ResultState.Failed, AppStoreApps.Verify(ProcessOutcome.Ran(0), missing).State);
         }
 
         [Fact]
-        public void Verify_AGoodExport_Succeeds()
+        public void RestoreDialogCoreSeamRemainsInteractive()
         {
-            string dir = NewTempDir();
-
+            Action<string, object> previous = AppStoreApps.RestoreDialog;
+            string root = NewTempDir();
             try
             {
-                string path = AppStoreApps.ExportPathIn(dir);
-                File.WriteAllText(path, ExportWith("A.One", "B.Two"));
-
-                StepResult r = AppStoreApps.Verify(ProcessOutcome.Ran(0), path);
-
-                Assert.Equal(ResultState.Succeeded, r.State);
-                Assert.Contains("2", r.Reason);
-            }
-            finally
-            {
-                try { Directory.Delete(dir, true); } catch { }
-            }
-        }
-
-        // A file with no Packages array restores nothing, so a green tick on it would be a lie.
-        [Fact]
-        public void Verify_AnExportWithNoPackagesArray_Fails()
-        {
-            string dir = NewTempDir();
-
-            try
-            {
-                string path = AppStoreApps.ExportPathIn(dir);
-                File.WriteAllText(path, "{\"Sources\":[{}]}");
+                object owner = new object();
+                object receivedOwner = null;
+                string receivedPath = null;
+                AppStoreApps.RestoreDialog = (path, suppliedOwner) =>
+                {
+                    receivedPath = path;
+                    receivedOwner = suppliedOwner;
+                };
 
-                Assert.Equal(ResultState.Failed, AppStoreApps.Verify(ProcessOutcome.Ran(0), path).State);
+                ModuleResult result = new AppStoreApps().Restore(root, owner);
+                Assert.Equal(ResultState.Skipped, result.State);
+                Assert.Same(owner, receivedOwner);
+                Assert.Equal(Path.GetFullPath(root), Path.GetFullPath(receivedPath), StringComparer.OrdinalIgnoreCase);
             }
             finally
             {
-                try { Directory.Delete(dir, true); } catch { }
+                AppStoreApps.RestoreDialog = previous;
+                Directory.Delete(root, true);
             }
         }
     }
diff --git a/src/WinRestoreKit.Tests/AppRestoreServiceTests.cs b/src/WinRestoreKit.Tests/AppRestoreServiceTests.cs
new file mode 100644
index 0000000..b01c4f5
--- /dev/null
+++ b/src/WinRestoreKit.Tests/AppRestoreServiceTests.cs
@@ -0,0 +1,104 @@
+using Conf;
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public class AppRestoreServiceTests
+    {
+        [Fact]
+        public void BuildSources_SelectedSourcePrecedesDistinctRestorableCatalogEntries()
+        {
+            string selected = Path.Combine(Path.GetTempPath(), "app-restore-selected-" + Guid.NewGuid().ToString("N"));
+            string alternate = Path.Combine(Path.GetTempPath(), "app-restore-other-" + Guid.NewGuid().ToString("N"));
+            string duplicate = selected.ToUpperInvariant();
+            var snapshots = new SnapshotEvent[]
+            {
+                new(SnapshotEventKind.Failed, DateTime.UtcNow, "failed", "C:\\failed", "failure", "", 0, false, null),
+                new(SnapshotEventKind.Verified, DateTime.UtcNow, "alternate", alternate, "", "", 0, true, null),
+                new(SnapshotEventKind.Partial, DateTime.UtcNow, "duplicate", duplicate, "", "", 0, true, null),
+                new(SnapshotEventKind.Unreadable, DateTime.UtcNow, "unreadable", "C:\\unreadable", "error", "", 0, false, null)
+            };
+
+            IReadOnlyList<AppRestoreSource> sources = AppRestoreService.BuildSources(selected, snapshots);
+
+            Assert.Equal(2, sources.Count);
+            Assert.True(sources[0].IsSelectedRestoreSource);
+            Assert.Equal(Path.GetFullPath(selected), sources[0].Path, StringComparer.OrdinalIgnoreCase);
+            Assert.Equal(Path.GetFullPath(alternate), sources[1].Path, StringComparer.OrdinalIgnoreCase);
+        }
+
+        [Fact]
+        public void ReadFromSource_MissingExportIsAbsentButMalformedExportIsUnreadable()
+        {
+            string root = Directory.CreateDirectory(Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N"))).FullName;
+            try
+            {
+                AppExport missing = AppRestoreService.ReadFromSource(root);
+                Assert.Equal(AppExportState.Absent, missing.State);
+
+                File.WriteAllText(AppStoreApps.ExportPathIn(root), "{not json");
+                AppExport malformed = AppRestoreService.ReadFromSource(root);
+                Assert.Equal(AppExportState.Unreadable, malformed.State);
+                Assert.True(malformed.IsProblem);
+            }
+            finally
+            {
+                Directory.Delete(root, true);
+            }
+        }
+
+        [Fact]
+        public void ReadFromSource_PreservesNonblankPackageIdentifiersInFileOrder()
+        {
+            string root = Directory.CreateDirectory(Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N"))).FullName;
+            try
+            {
+                File.WriteAllText(AppStoreApps.ExportPathIn(root),
+                    "{\"Sources\":[{\"Packages\":[{\"PackageIdentifier\":\"A.One\"},{},{\"PackageIdentifier\":\"\"},{\"PackageIdentifier\":\"B.Two\"}]}]}");
+
+                AppExport export = AppRestoreService.ReadFromSource(root);
+
+                Assert.Equal(AppExportState.Ok, export.State);
+                Assert.Equal(new[] { "A.One", "B.Two" }, export.PackageIdentifiers);
+                Assert.True(AppRestoreService.ComposeListState(export).InstallEnabled);
+            }
+            finally
+            {
+                Directory.Delete(root, true);
+            }
+        }
+
+        [Fact]
+        public async Task InstallAsync_StopRequestDoesNotStartTheRemainingPackages()
+        {
+            int started = 0;
+            AppRestoreOutcome outcome = await AppRestoreService.InstallAsync(
+                new[] { "A.One", "B.Two" },
+                _ =>
+                {
+                    started++;
+                    return Task.FromResult(ProcessOutcome.Ran(0));
+                },
+                () => started == 1);
+
+            Assert.Equal("Stopped", outcome.Caption);
+            Assert.Equal("Stopped after 1 of 2 app(s). The remaining 1 were not started.\n\nwinget installed 1 app(s).", outcome.Text);
+            Assert.Equal(RunSeverity.Information, outcome.Severity);
+            Assert.Equal(1, started);
+        }
+
+        [Fact]
+        public void Describe_StartedOutcomeUnknownIsNotReportedAsNeverStarted()
+        {
+            string description = AppRestoreService.Describe(ProcessOutcome.OutcomeUnknown("pipe closed"));
+
+            Assert.Contains("could not be determined", description);
+            Assert.DoesNotContain("could not run winget", description);
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/ApplicationBoundaryTests.cs b/src/WinRestoreKit.Tests/ApplicationBoundaryTests.cs
new file mode 100644
index 0000000..a5c77ea
--- /dev/null
+++ b/src/WinRestoreKit.Tests/ApplicationBoundaryTests.cs
@@ -0,0 +1,34 @@
+extern alias Application;
+
+using System.Linq;
+using ApplicationWinRestoreKit = Application::WinRestoreKit;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public class ApplicationBoundaryTests
+    {
+        [Fact]
+        public void ApplicationRunControl_IsAvailableWithoutConstructingAUiFrameworkObject()
+        {
+            using (ApplicationWinRestoreKit.RunControl control =
+                   new ApplicationWinRestoreKit.RunControl())
+            {
+                Assert.False(control.IsPaused);
+                Assert.False(control.IsCancellationRequested);
+            }
+        }
+
+        [Fact]
+        public void ApplicationAssembly_HasNoWinFormsOrWpfAssemblyReference()
+        {
+            string[] references = typeof(ApplicationWinRestoreKit.RunControl).Assembly.GetReferencedAssemblies()
+                .Select(reference => reference.Name)
+                .ToArray();
+
+            Assert.DoesNotContain("System.Windows.Forms", references);
+            Assert.DoesNotContain("PresentationFramework", references);
+            Assert.DoesNotContain("WindowsBase", references);
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/ArchiveProgressTests.cs b/src/WinRestoreKit.Tests/ArchiveProgressTests.cs
index e7b5a93..65e031a 100644
--- a/src/WinRestoreKit.Tests/ArchiveProgressTests.cs
+++ b/src/WinRestoreKit.Tests/ArchiveProgressTests.cs
@@ -3,7 +3,6 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Threading.Tasks;
-using System.Windows.Forms;
 using Xunit;
 
 namespace WinRestoreKit.Tests
@@ -21,7 +20,8 @@ public async Task RunBackup_FastCompressionReportsArchivingAndWritesPayloadManif
                 await runner.RunBackup(new BackupBase[] { new ArtifactModule() }, isolation.DestinationRoot,
                     "archive-progress", SnapshotCompression.Fast);
 
-                string backupPath = Path.Combine(isolation.DestinationRoot, Data.NowShort);
+                string backupPath = runner.BackupOutputPath;
+                Assert.Equal(Path.Combine(isolation.DestinationRoot, Data.NowShort), backupPath);
                 ManifestData manifest = BackupManifest.TryParse(
                     File.ReadAllText(Path.Combine(backupPath, BackupManifest.FileName)));
 
@@ -51,7 +51,7 @@ private sealed class TestRunUi : IRunUi
         {
             internal List<string> ProgressTexts { get; } = new List<string>();
 
-            public IWin32Window Owner => null;
+            public object DialogOwner => null;
 
             public void SetProgressText(string text) => ProgressTexts.Add(text);
             public void SetProgressPercent(int percent) { }
diff --git a/src/WinRestoreKit.Tests/BackupCompletionPublisherTests.cs b/src/WinRestoreKit.Tests/BackupCompletionPublisherTests.cs
new file mode 100644
index 0000000..4df730c
--- /dev/null
+++ b/src/WinRestoreKit.Tests/BackupCompletionPublisherTests.cs
@@ -0,0 +1,65 @@
+using Conf;
+using System;
+using System.IO;
+using System.Linq;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class BackupCompletionPublisherTests
+    {
+        [Fact]
+        public void Publish_RetainedPartialFolder_DoesNotAddSessionFailure()
+        {
+            using (BackupRunIsolation isolation = new BackupRunIsolation())
+            {
+                string path = CreateRecognizedPartialFolder(isolation.DestinationRoot);
+                BackupRootRegistry.Remember(isolation.DestinationRoot);
+                SnapshotEventCatalog catalog = new SnapshotEventCatalog();
+                BackupCompletionPublisher publisher = new BackupCompletionPublisher(catalog);
+
+                publisher.Publish(path, "nightly", RunSummary.Incomplete(
+                    Array.Empty<ModuleOutcome>(), RunVerb.Backup,
+                    "Cancellation was requested. No further group was started."),
+                    new DateTime(2026, 8, 9, 9, 0, 0));
+
+                SnapshotEvent[] events = catalog.Read().ToArray();
+                SnapshotEvent discovered = Assert.Single(events, snapshot =>
+                    string.Equals(snapshot.CanonicalPath, Path.GetFullPath(path),
+                        StringComparison.OrdinalIgnoreCase));
+                Assert.Equal(SnapshotEventKind.Partial, discovered.Kind);
+                Assert.DoesNotContain(events, snapshot =>
+                    snapshot.CanonicalPath.StartsWith("session://failure/", StringComparison.Ordinal));
+            }
+        }
+
+        [Fact]
+        public void Publish_NoRetainedRecognizedFolder_RecordsSessionFailureOnly()
+        {
+            SnapshotEventCatalog catalog = new SnapshotEventCatalog();
+            BackupCompletionPublisher publisher = new BackupCompletionPublisher(catalog);
+            RunSummary summary = RunSummary.For(Array.Empty<ModuleOutcome>(), false, RunVerb.Backup,
+                "the backup folder could not be created: access denied");
+            string attemptedPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N"),
+                "snapshot-attempted-before-rollover");
+
+            publisher.Publish(attemptedPath, "nightly", summary, new DateTime(2026, 8, 9, 9, 0, 0));
+
+            SnapshotEvent failure = Assert.Single(catalog.Read(), snapshot =>
+                snapshot.CanonicalPath.StartsWith("session://failure/", StringComparison.Ordinal));
+            Assert.Equal("nightly", failure.DisplayName);
+            Assert.Contains("could not be created", failure.DiagnosticReason, StringComparison.OrdinalIgnoreCase);
+            Assert.False(failure.IsRestorable);
+        }
+
+        private static string CreateRecognizedPartialFolder(string root)
+        {
+            string path = Directory.CreateDirectory(Path.Combine(root, "snapshot-started-before-rollover")).FullName;
+            string manifest = BackupManifest.Compose(
+                new BackupBase[] { new DMouse() }, Array.Empty<ModuleResult>(),
+                new DateTime(2026, 8, 9, 9, 0, 0), "test-machine", "test-user", "test-build", "0.0.0");
+            File.WriteAllText(Path.Combine(path, BackupManifest.FileName), manifest);
+            return path;
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/BackupDestinationContainmentTests.cs b/src/WinRestoreKit.Tests/BackupDestinationContainmentTests.cs
index 2e09266..095ecbf 100644
--- a/src/WinRestoreKit.Tests/BackupDestinationContainmentTests.cs
+++ b/src/WinRestoreKit.Tests/BackupDestinationContainmentTests.cs
@@ -2,7 +2,6 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Threading.Tasks;
-using System.Windows.Forms;
 using Conf;
 using DataHelper;
 using WinRestoreKit;
@@ -40,6 +39,7 @@ public async Task RunBackup_DestinationInsideASelectedSourceFolder_IsRejectedBef
 
                 await runner.RunBackup(new BackupBase[] { new FolderSourceModule(source) },
                     destination, "nested", SnapshotCompression.None);
+                Assert.Equal(Path.Combine(destination, Data.NowShort), runner.BackupOutputPath);
 
                 Assert.NotNull(ui.LastSummary);
                 Assert.Equal(RunState.DidNotRun, ui.LastSummary.State);
@@ -84,7 +84,7 @@ public async Task RunBackup_DestinationOutsideEverySource_IsAccepted()
 
                 Assert.NotNull(ui.LastSummary);
                 Assert.NotEqual(RunState.DidNotRun, ui.LastSummary.State);
-                Assert.True(Directory.Exists(Path.Combine(destination, Data.NowShort)));
+                Assert.True(Directory.Exists(runner.BackupOutputPath));
             }
             finally
             {
@@ -108,7 +108,7 @@ private sealed class TestRunUi : IRunUi
         {
             internal RunSummary LastSummary { get; private set; }
 
-            public IWin32Window Owner => null;
+            public object DialogOwner => null;
             public void SetProgressText(string text) { }
             public void SetProgressPercent(int percent) { }
             public void SetProgressDetail(string groupInfo, string elapsed, string remaining,
diff --git a/src/WinRestoreKit.Tests/BackupDestinationLifecycleTests.cs b/src/WinRestoreKit.Tests/BackupDestinationLifecycleTests.cs
index 4e3449c..b79e51f 100644
--- a/src/WinRestoreKit.Tests/BackupDestinationLifecycleTests.cs
+++ b/src/WinRestoreKit.Tests/BackupDestinationLifecycleTests.cs
@@ -3,9 +3,9 @@
 using System;
 using System.Collections.Generic;
 using System.IO;
+using System.Reflection;
 using System.Linq;
 using System.Threading.Tasks;
-using System.Windows.Forms;
 using Views;
 using Xunit;
 
@@ -56,6 +56,27 @@ public async Task RunBackup_RemembersCustomDestinationBeforeFirstModuleRuns()
             }
         }
 
+        [Fact]
+        public async Task RunBackup_ManifestUsesTheEntryShellAssemblyVersion()
+        {
+            using (BackupRunIsolation isolation = new BackupRunIsolation())
+            {
+                BackupRestoreOrchestrator runner = new BackupRestoreOrchestrator(new TestRunUi());
+
+                await runner.RunBackup(
+                    new BackupBase[] { new RootObservingModule(isolation.DestinationRoot) },
+                    isolation.DestinationRoot,
+                    "entry-version",
+                    SnapshotCompression.None);
+
+                ManifestData manifest = BackupManifest.TryParse(File.ReadAllText(Path.Combine(
+                    runner.BackupOutputPath, BackupManifest.FileName)));
+
+                Assert.NotNull(manifest);
+                Assert.Equal(VersionInfo.GetCurrentVersion(Assembly.GetEntryAssembly()), manifest.AppVersion);
+            }
+        }
+
         [Fact]
         public async Task RunBackup_CancelledInExistingFolderRetainsTheExistingFolder()
         {
@@ -72,6 +93,7 @@ public async Task RunBackup_CancelledInExistingFolderRetainsTheExistingFolder()
                     BackupRestoreOrchestrator runner = new BackupRestoreOrchestrator(new TestRunUi(), control);
 
                     await runner.RunBackup(new BackupBase[] { new CancellingModule(control) }, backupPath);
+                    Assert.Equal(backupPath, runner.BackupOutputPath);
                 }
 
                 Assert.True(Directory.Exists(backupPath));
@@ -123,7 +145,7 @@ public override ModuleResult Backup(string path)
 
         private sealed class TestRunUi : IRunUi
         {
-            public IWin32Window Owner => null;
+            public object DialogOwner => null;
 
             public void SetProgressText(string text) { }
             public void SetProgressPercent(int percent) { }
diff --git a/src/WinRestoreKit.Tests/BackupFoldersReadTests.cs b/src/WinRestoreKit.Tests/BackupFoldersReadTests.cs
index 697c77f..5bcfd38 100644
--- a/src/WinRestoreKit.Tests/BackupFoldersReadTests.cs
+++ b/src/WinRestoreKit.Tests/BackupFoldersReadTests.cs
@@ -3,7 +3,6 @@
 using System;
 using System.IO;
 using System.Linq;
-using Views;
 using Xunit;
 
 namespace WinRestoreKit.Tests
@@ -37,7 +36,7 @@ public void Read_UnreadableCustomRootKeepsReadableDefaultRoot()
         }
 
         [Fact]
-        public void Read_UnreadableDefaultRootReportsFatalReason()
+        public void Read_UnreadableDefaultRootReportsActualReason()
         {
             string parent = NewTempDirectory();
             string unreadableDefaultRoot = Path.Combine(parent, "default-root-file");
@@ -45,11 +44,14 @@ public void Read_UnreadableDefaultRootReportsFatalReason()
 
             try
             {
+                Exception expected = Record.Exception(() => Directory.GetDirectories(unreadableDefaultRoot));
+                Assert.NotNull(expected);
+
                 RunWithConfiguredRoots(unreadableDefaultRoot, Array.Empty<string>(), () =>
                 {
                     BackupFolders folders = BackupFolders.Read();
 
-                    Assert.NotNull(folders.UnreadableReason);
+                    Assert.Equal(expected.Message, folders.UnreadableReason);
                 });
             }
             finally
@@ -122,6 +124,21 @@ public void Read_DefaultRootKeepsLooseLegacyFolder()
             });
         }
 
+        [Fact]
+        public void Read_MalformedManifestKeepsValidationReason()
+        {
+            RunWithRoots((defaultRoot, customRoot) =>
+            {
+                string folder = Directory.CreateDirectory(Path.Combine(defaultRoot, "bad-manifest")).FullName;
+                File.WriteAllText(Path.Combine(folder, BackupManifest.FileName), "{ not json");
+
+                BackupFolder found = Assert.Single(BackupFolders.Read().Backups);
+
+                Assert.Null(found.ReadManifest());
+                Assert.Equal("The backup manifest is invalid or uses an unsupported schema.", found.ManifestError);
+            });
+        }
+
         [Fact]
         public void Read_NestedRememberedRootExcludesDefaultRootContainerAndListsBackupOnce()
         {
diff --git a/src/WinRestoreKit.Tests/BackupModuleCatalogTests.cs b/src/WinRestoreKit.Tests/BackupModuleCatalogTests.cs
new file mode 100644
index 0000000..adaa261
--- /dev/null
+++ b/src/WinRestoreKit.Tests/BackupModuleCatalogTests.cs
@@ -0,0 +1,24 @@
+using Conf;
+using System.Collections.Generic;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class BackupModuleCatalogTests
+    {
+        [Fact]
+        public void CreateAll_PreservesCoreCatalogOrderCategoryAndTitle()
+        {
+            IReadOnlyList<BackupModuleRegistration> actual = BackupModuleCatalog.CreateAll();
+            IReadOnlyList<ModuleRegistration> core = ModuleCatalog.CreateAll();
+
+            Assert.Equal(core.Count, actual.Count);
+            for (int index = 0; index < core.Count; index++)
+            {
+                Assert.Same(core[index].Module.GetType(), actual[index].Module.GetType());
+                Assert.Equal(core[index].Category, actual[index].Category);
+                Assert.Equal(core[index].Module.Title, actual[index].Title);
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/BackupOutputPathTests.cs b/src/WinRestoreKit.Tests/BackupOutputPathTests.cs
new file mode 100644
index 0000000..4068192
--- /dev/null
+++ b/src/WinRestoreKit.Tests/BackupOutputPathTests.cs
@@ -0,0 +1,94 @@
+using Conf;
+using DataHelper;
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading.Tasks;
+using WinRestoreKit;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class BackupOutputPathTests
+    {
+        [Fact]
+        public async Task RunBackup_DirectPath_RetainsTheExactCallerSuppliedFolderBeforeValidation()
+        {
+            string root = Path.Combine(Path.GetTempPath(), "WinRestoreKitTests", Guid.NewGuid().ToString("N"));
+            string suppliedPath = Path.Combine(root, "snapshot-started-before-rollover");
+
+            try
+            {
+                var runner = new BackupRestoreOrchestrator(new TestRunUi());
+
+                await runner.RunBackup(new BackupBase[] { new EmptyModule() }, suppliedPath);
+
+                Assert.Equal(suppliedPath, runner.BackupOutputPath);
+            }
+            finally
+            {
+                if (Directory.Exists(root))
+                    Directory.Delete(root, true);
+            }
+        }
+
+        [Fact]
+        public async Task RunBackup_DestinationOverload_RetainsComputedPathWhenContainmentRejectsTheRun()
+        {
+            string source = Directory.CreateDirectory(Path.Combine(Path.GetTempPath(), "WinRestoreKitTests",
+                Guid.NewGuid().ToString("N"))).FullName;
+            string destination = Path.Combine(source, "backups");
+            string expectedPath = Path.Combine(destination, Data.NowShort);
+            var ui = new TestRunUi();
+
+            try
+            {
+                var runner = new BackupRestoreOrchestrator(ui);
+
+                await runner.RunBackup(new BackupBase[] { new FolderSourceModule(source) }, destination,
+                    "contained", SnapshotCompression.None);
+
+                Assert.Equal(expectedPath, runner.BackupOutputPath);
+                Assert.Equal(RunState.DidNotRun, ui.Summary.State);
+            }
+            finally
+            {
+                if (Directory.Exists(source))
+                    Directory.Delete(source, true);
+            }
+        }
+
+        private sealed class EmptyModule : BackupBase
+        {
+            internal EmptyModule()
+            {
+                Title = "Empty";
+            }
+        }
+
+        private sealed class FolderSourceModule : FolderModule
+        {
+            internal FolderSourceModule(string path) : base(path)
+            {
+                Title = "Source";
+            }
+        }
+
+        private sealed class TestRunUi : IRunUi
+        {
+            internal RunSummary Summary { get; private set; }
+
+            public object DialogOwner => null;
+            public void SetProgressText(string text) { }
+            public void SetProgressPercent(int percent) { }
+            public void SetProgressDetail(string groupInfo, string elapsed, string remaining, string throughput,
+                                          long bytesWritten, int errors, int warnings) { }
+            public void ShowSummary(RunSummary summary, string caption, IReadOnlyList<ModuleOutcome> outcomes)
+                => Summary = summary;
+            public IReadOnlyList<string> ShowConsentDialog(RestorePlan plan) => null;
+            public bool ConfirmSnapshotOverride(string text, string caption) => false;
+            public void ShowPlanCompositionError(string text, string caption) { }
+            public void SetExplorerRestartVisible(bool visible) { }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/BackupPageViewTests.cs b/src/WinRestoreKit.Tests/BackupPageViewTests.cs
index 221adb9..44f9b08 100644
--- a/src/WinRestoreKit.Tests/BackupPageViewTests.cs
+++ b/src/WinRestoreKit.Tests/BackupPageViewTests.cs
@@ -22,7 +22,7 @@ public void Capture_RequestsSelectedConcreteScopeModulesWithoutOwningRunUi()
                     scope.Checked = false;
 
                 CustomCheckbox explorerScope = view.Controls
-                    .Find("scopeToggle1", true)
+                    .Find("scopeToggle0", true)
                     .OfType<CustomCheckbox>()
                     .Single();
                 explorerScope.Checked = true;
diff --git a/src/WinRestoreKit.Tests/BackupPresetsTests.cs b/src/WinRestoreKit.Tests/BackupPresetsTests.cs
index 439a93e..9d36846 100644
--- a/src/WinRestoreKit.Tests/BackupPresetsTests.cs
+++ b/src/WinRestoreKit.Tests/BackupPresetsTests.cs
@@ -15,7 +15,7 @@ public void DeveloperMachine_IsPinnedLiteral()
         {
             Assert.Equal(
                 new[] { "ETerminal", "EVSCode", "ESsh", "EEnvironment", "EHosts" },
-                Views.BackupPresets.DeveloperMachine);
+                BackupPresets.DeveloperMachine);
         }
 
         [Fact]
@@ -23,18 +23,18 @@ public void MinimalPrivacySafeExclusions_IsPinnedLiteral()
         {
             Assert.Equal(
                 new[] { "WUpdates", "EEnvironment", "EEnvironmentFiltered", "CWiFiConf" },
-                Views.BackupPresets.MinimalPrivacySafeExclusions);
+                BackupPresets.MinimalPrivacySafeExclusions);
         }
 
         [Fact]
         public void PresetNames_AllResolveToRegisteredModules()
         {
-            System.Collections.Generic.HashSet<string> registered = ModuleCatalog.CreateAll()
+            System.Collections.Generic.HashSet<string> registered = BackupModuleCatalog.CreateAll()
                 .Select(r => r.Module.GetType().Name)
                 .ToHashSet();
 
-            foreach (string name in Views.BackupPresets.DeveloperMachine
-                .Concat(Views.BackupPresets.MinimalPrivacySafeExclusions))
+            foreach (string name in BackupPresets.DeveloperMachine
+                .Concat(BackupPresets.MinimalPrivacySafeExclusions))
             {
                 Assert.True(registered.Contains(name),
                     "preset names a module not in the catalog: " + name);
diff --git a/src/WinRestoreKit.Tests/BackupResultTimelinePublicationTests.cs b/src/WinRestoreKit.Tests/BackupResultTimelinePublicationTests.cs
new file mode 100644
index 0000000..8791c9c
--- /dev/null
+++ b/src/WinRestoreKit.Tests/BackupResultTimelinePublicationTests.cs
@@ -0,0 +1,94 @@
+using System;
+using Conf;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.ViewModels;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class BackupResultTimelinePublicationTests
+    {
+        [Fact]
+        public async Task CanceledRunWithoutRetainedFolder_PublishesOneSessionFailureBeforeShowingResult()
+        {
+            using var isolation = new BackupRunIsolation();
+            BackupRootRegistry.Remember(isolation.DestinationRoot);
+            RunCoordinator.SetRunning(false);
+
+            try
+            {
+                string attemptedPath = Path.Combine(isolation.DestinationRoot, "canceled-before-rollover");
+                RunSummary summary = RunSummary.Incomplete(Array.Empty<ModuleOutcome>(), RunVerb.Backup,
+                    "Cancellation was requested. No further group was started.");
+                var catalog = new SnapshotEventCatalog();
+                var shell = ShellViewModel.ForTest(
+                    _ => Task.FromResult(new BackupRunCompletion(summary, Array.Empty<ModuleOutcome>(), attemptedPath)),
+                    catalog,
+                    () => Task.CompletedTask);
+
+                shell.CreateSnapshotCommand.Execute(null);
+                BackupWorkspaceViewModel selection = Assert.IsType<BackupWorkspaceViewModel>(shell.CurrentWorkspace);
+                selection.Scopes.First().IsSelected = true;
+                selection.SnapshotName = "canceled-cleanup";
+                await selection.StartAsync();
+
+                SnapshotEvent failure = Assert.Single(catalog.Read(), snapshot =>
+                    snapshot.Kind == SnapshotEventKind.Failed
+                    && snapshot.DisplayName == "canceled-cleanup");
+                Assert.False(failure.IsRestorable);
+                Assert.Equal(summary.Detail, failure.DiagnosticReason);
+                Assert.IsType<ResultWorkspaceViewModel>(shell.CurrentWorkspace);
+            }
+            finally
+            {
+                RunCoordinator.SetRunning(false);
+            }
+        }
+
+        [Fact]
+        public async Task CanceledRunWithRetainedPartialFolder_UsesDiscoveredEventWithoutSessionFailure()
+        {
+            using var isolation = new BackupRunIsolation();
+            BackupRootRegistry.Remember(isolation.DestinationRoot);
+            RunCoordinator.SetRunning(false);
+
+            try
+            {
+                string attemptedPath = Directory.CreateDirectory(
+                    Path.Combine(isolation.DestinationRoot, "retained-partial-before-rollover")).FullName;
+                File.WriteAllText(Path.Combine(attemptedPath, BackupManifest.FileName), BackupManifest.Compose(
+                    new BackupBase[] { new DMouse() }, Array.Empty<ModuleResult>(),
+                    new DateTime(2026, 8, 9, 9, 0, 0), "test-machine", "test-user", "test-build", "0.0.0"));
+                RunSummary summary = RunSummary.Incomplete(Array.Empty<ModuleOutcome>(), RunVerb.Backup,
+                    "Cancellation was requested. No further group was started.");
+                var catalog = new SnapshotEventCatalog();
+                var shell = ShellViewModel.ForTest(
+                    _ => Task.FromResult(new BackupRunCompletion(summary, Array.Empty<ModuleOutcome>(), attemptedPath)),
+                    catalog,
+                    () => Task.CompletedTask);
+
+                shell.CreateSnapshotCommand.Execute(null);
+                BackupWorkspaceViewModel selection = Assert.IsType<BackupWorkspaceViewModel>(shell.CurrentWorkspace);
+                selection.Scopes.First().IsSelected = true;
+                selection.SnapshotName = "retained-partial";
+                await selection.StartAsync();
+
+                string canonicalPath = Path.GetFullPath(attemptedPath);
+                SnapshotEvent discovered = Assert.Single(catalog.Read(), snapshot =>
+                    string.Equals(snapshot.CanonicalPath, canonicalPath,
+                        StringComparison.OrdinalIgnoreCase));
+                Assert.Equal(SnapshotEventKind.Partial, discovered.Kind);
+                Assert.True(discovered.IsRestorable);
+                Assert.DoesNotContain(catalog.Read(), snapshot => snapshot.Kind == SnapshotEventKind.Failed
+                    && snapshot.DisplayName == "retained-partial");
+            }
+            finally
+            {
+                RunCoordinator.SetRunning(false);
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/BackupWorkspaceViewModelTests.cs b/src/WinRestoreKit.Tests/BackupWorkspaceViewModelTests.cs
new file mode 100644
index 0000000..a2f2b9d
--- /dev/null
+++ b/src/WinRestoreKit.Tests/BackupWorkspaceViewModelTests.cs
@@ -0,0 +1,162 @@
+using Conf;
+using DataHelper;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.ViewModels;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class BackupWorkspaceViewModelTests
+    {
+        [Fact]
+        public async Task StartAsync_SelectedScope_RequestsItsConcreteModulesAndFastCompression()
+        {
+            BackupRunRequest request = null;
+            var vm = new BackupWorkspaceViewModel(r =>
+            {
+                request = r;
+                return Task.CompletedTask;
+            }, @"C:\snapshots");
+            foreach (BackupScopeItemViewModel scope in vm.Scopes)
+                scope.IsSelected = false;
+            vm.Scopes.Single(scope => scope.Name == "Explorer & shell").IsSelected = true;
+
+            await vm.StartAsync();
+
+            Assert.Equal(SnapshotCompression.Fast, request.Compression);
+            Assert.Equal(new[]
+            {
+                typeof(WPersonalization), typeof(WVisualEffects), typeof(WTaskbar),
+                typeof(WThemes), typeof(APinnedApps)
+            }, request.Modules.Select(module => module.GetType()));
+        }
+
+        [Fact]
+        public async Task StartAsync_EmptySelectionOrDestination_ShowsValidationAndDoesNotRequestRun()
+        {
+            int starts = 0;
+            var vm = new BackupWorkspaceViewModel(_ =>
+            {
+                starts++;
+                return Task.CompletedTask;
+            }, string.Empty);
+            foreach (BackupScopeItemViewModel scope in vm.Scopes)
+                scope.IsSelected = false;
+
+            await vm.StartAsync();
+
+            Assert.Equal(0, starts);
+            Assert.Equal("Select at least one scope with supported items.", vm.ValidationMessage);
+        }
+
+        [Fact]
+        public async Task StartAsync_BlankDestinationWithSelection_ShowsDestinationValidation()
+        {
+            int starts = 0;
+            var vm = new BackupWorkspaceViewModel(_ =>
+            {
+                starts++;
+                return Task.CompletedTask;
+            }, " ");
+            foreach (BackupScopeItemViewModel scope in vm.Scopes)
+                scope.IsSelected = false;
+            vm.Scopes.Single(scope => scope.Name == "Explorer & shell").IsSelected = true;
+
+            await vm.StartAsync();
+
+            Assert.Equal(0, starts);
+            Assert.Equal("Choose a destination folder before capturing.", vm.ValidationMessage);
+        }
+
+        [Fact]
+        public void UnfilteredEnvironmentScope_StartsUnselectedAndExposesItsCaution()
+        {
+            var vm = new BackupWorkspaceViewModel(_ => Task.CompletedTask, @"C:\snapshots");
+
+            BackupScopeItemViewModel environment = vm.Scopes.Single(scope =>
+                scope.Name == "Environment variables (unfiltered)");
+
+            Assert.False(environment.IsSelected);
+            Assert.True(environment.RequiresExplicitOptIn);
+            Assert.True(environment.HasCaution);
+            Assert.False(string.IsNullOrWhiteSpace(environment.CautionNote));
+        }
+
+        [Fact]
+        public async Task StartAsync_CompressionOptions_MapDirectlyToCoreValues()
+        {
+            var seen = new List<SnapshotCompression>();
+            var vm = new BackupWorkspaceViewModel(request =>
+            {
+                seen.Add(request.Compression);
+                return Task.CompletedTask;
+            }, @"C:\snapshots");
+            foreach (BackupScopeItemViewModel scope in vm.Scopes)
+                scope.IsSelected = false;
+            vm.Scopes.Single(scope => scope.Name == "Explorer & shell").IsSelected = true;
+
+            foreach (SnapshotCompression compression in new[]
+                     { SnapshotCompression.None, SnapshotCompression.Fast, SnapshotCompression.Max })
+            {
+                vm.Compression = compression;
+                await vm.StartAsync();
+            }
+
+            Assert.Equal(new[] { SnapshotCompression.None, SnapshotCompression.Fast, SnapshotCompression.Max },
+                vm.CompressionOptions);
+            Assert.Equal(vm.CompressionOptions, seen);
+        }
+
+        [Fact]
+        public void PresetCommands_TransformApplicationLiteralTypeListsToWholeScopeSelection()
+        {
+            var vm = new BackupWorkspaceViewModel(_ => Task.CompletedTask, @"C:\snapshots");
+
+            vm.DeveloperMachineCommand.Execute(null);
+
+            Assert.Equal(vm.Scopes.Where(scope => scope.Modules.Any(module =>
+                    BackupPresets.DeveloperMachine.Contains(module.GetType().Name)))
+                    .Select(scope => scope.Name)
+                    .OrderBy(name => name),
+                vm.Scopes.Where(scope => scope.IsSelected)
+                    .Select(scope => scope.Name)
+                    .OrderBy(name => name));
+
+            vm.MinimalPrivacySafeCommand.Execute(null);
+
+            Assert.Equal(vm.Scopes.Where(scope => !scope.Modules.Any(module =>
+                    BackupPresets.MinimalPrivacySafeExclusions.Contains(module.GetType().Name)))
+                    .Select(scope => scope.Name)
+                    .OrderBy(name => name),
+                vm.Scopes.Where(scope => scope.IsSelected)
+                    .Select(scope => scope.Name)
+                    .OrderBy(name => name));
+        }
+
+        [Fact]
+        public async Task StartAsync_SelectAll_FlattensDistinctModulesInCatalogOrder()
+        {
+            BackupRunRequest request = null;
+            var vm = new BackupWorkspaceViewModel(r =>
+            {
+                request = r;
+                return Task.CompletedTask;
+            }, @"C:\snapshots");
+
+            vm.SelectAllCommand.Execute(null);
+            await vm.StartAsync();
+
+            Type[] expected = vm.Scopes.Where(scope => scope.IsSelected)
+                .SelectMany(scope => scope.Modules)
+                .Select(module => module.GetType())
+                .Distinct()
+                .ToArray();
+            Assert.Equal(expected, request.Modules.Select(module => module.GetType()));
+        }
+
+    }
+}
diff --git a/src/WinRestoreKit.Tests/BackupWorkspaceViewTests.cs b/src/WinRestoreKit.Tests/BackupWorkspaceViewTests.cs
new file mode 100644
index 0000000..bcbebae
--- /dev/null
+++ b/src/WinRestoreKit.Tests/BackupWorkspaceViewTests.cs
@@ -0,0 +1,35 @@
+using System.Threading.Tasks;
+using System.Windows.Automation;
+using System.Windows.Controls;
+using WinRestoreKit.Wpf.ViewModels;
+using WinRestoreKit.Wpf.Views;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class BackupWorkspaceViewTests
+    {
+        [Fact]
+        public void View_ExposesScopeWarningsLabeledCompressionAndExactAutomationIds()
+        {
+            WpfTestHost.Run(() =>
+            {
+                var view = new BackupWorkspaceView
+                {
+                    DataContext = new BackupWorkspaceViewModel(_ => Task.CompletedTask, @"C:\snapshots")
+                };
+
+                Assert.Equal("BackupWorkspace", AutomationProperties.GetAutomationId(view));
+                Assert.NotNull(view.FindName("BackupScopeList"));
+                Assert.NotNull(view.FindName("CreateSnapshotButton"));
+                Assert.NotNull(view.FindName("CompressionComboBox"));
+                Assert.Equal("BackupDestinationTextBox", AutomationProperties.GetAutomationId(
+                    Assert.IsType<TextBox>(view.FindName("DestinationTextBox"))));
+                Assert.Equal("CreateSnapshotButton", AutomationProperties.GetAutomationId(
+                    Assert.IsType<Button>(view.FindName("CreateSnapshotButton"))));
+                Assert.Equal("CompressionComboBox", AutomationProperties.GetAutomationId(
+                    Assert.IsType<ComboBox>(view.FindName("CompressionComboBox"))));
+            });
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/ComparisonWorkspaceViewModelTests.cs b/src/WinRestoreKit.Tests/ComparisonWorkspaceViewModelTests.cs
new file mode 100644
index 0000000..fef311d
--- /dev/null
+++ b/src/WinRestoreKit.Tests/ComparisonWorkspaceViewModelTests.cs
@@ -0,0 +1,222 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Threading;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.ViewModels;
+using WinRestoreKit.Wpf.Navigation;
+using WinRestoreKit.Wpf.Services;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class ComparisonWorkspaceViewModelTests
+    {
+        [Fact]
+        public async Task Workspace_DefaultsToAllAndChangedOnlyDoesNotChangeRestoreSet()
+        {
+            await WpfTestHost.RunAsync(async () =>
+            {
+                ComparisonWorkspaceViewModel workspace = await LoadedWorkspace(
+                    new TestModule("Changed", artifact: true, drift: true),
+                    new TestModule("Same", artifact: true, drift: false),
+                    new TestModule("Unknown", artifact: true, drift: null),
+                    new TestModule("Absent", artifact: false, drift: null));
+
+                Assert.Equal(ComparisonFilter.All, workspace.SelectedFilter);
+                Assert.Equal(4, workspace.VisibleRows.Count);
+                workspace.RestoreSet.Add(workspace.Rows[2].Comparison);
+
+                workspace.SelectedFilter = ComparisonFilter.ChangedOnly;
+
+                Assert.Single(workspace.VisibleRows);
+                Assert.Equal("Changed", workspace.VisibleRows[0].Title);
+                Assert.True(workspace.RestoreSet.Contains(workspace.Rows[2].Comparison.Module));
+            });
+        }
+
+        [Fact]
+        public async Task Workspace_SelectedRowExposesOnlyDeclaredImpacts()
+        {
+            await WpfTestHost.RunAsync(async () =>
+            {
+                TestModule module = new TestModule("Settings", true, true)
+                {
+                    Targets = new[] { RestoreTarget.RegistryKey(@"HKCU\\Software\\Test") },
+                    Processes = new[] { new RestoreCloseRequirement("Code", "Visual Studio Code", true) },
+                    Explorer = true,
+                    Warning = "Existing module warning."
+                };
+                ComparisonWorkspaceViewModel workspace = await LoadedWorkspace(module, category: "Settings");
+                workspace.SelectedRow = workspace.Rows[0];
+
+                Assert.True(workspace.IsDetailTrayOpen);
+                Assert.Equal("Settings", workspace.SelectedRow.Category);
+                Assert.Contains(workspace.SelectedRow.Impact.Targets, item => item.Kind == RestoreTargetKind.RegistryKey);
+                Assert.Contains(workspace.SelectedRow.Impact.Processes,
+                    item => item.NeedsConsent && item.DisplayName == "Visual Studio Code");
+                Assert.True(workspace.SelectedRow.Impact.RequiresExplorerRestart);
+                Assert.Equal("Existing module warning.", workspace.SelectedRow.Impact.WarningMessage);
+            });
+        }
+
+        [Fact]
+        public async Task Workspace_ContinueToConfirmUsesTheCurrentWholeModuleRestoreSet()
+        {
+            await WpfTestHost.RunAsync(async () =>
+            {
+                SnapshotEvent receivedSnapshot = null;
+                IReadOnlyList<BackupBase> receivedModules = null;
+                TestModule module = new TestModule("Changed", true, true);
+                ComparisonWorkspaceViewModel workspace = await LoadedWorkspace(
+                    new[] { module },
+                    (snapshot, modules) => { receivedSnapshot = snapshot; receivedModules = modules; });
+                workspace.RestoreSet.Add(workspace.Rows[0].Comparison);
+
+                workspace.ContinueToConfirmCommand.Execute(null);
+
+                Assert.Same(workspace.Snapshot, receivedSnapshot);
+                Assert.Single(receivedModules);
+                Assert.Same(module, receivedModules[0]);
+            });
+        }
+
+        [Fact]
+        public async Task Navigator_ChangingSnapshotWithRestoreSet_CancelKeepsOriginalSetAndDisposesIncomingScope()
+        {
+            await WpfTestHost.RunAsync(async () =>
+            {
+                Window owner = new Window();
+                TestDiscardDialog dialogs = new TestDiscardDialog(false);
+                ShellViewModel shell = TestShell();
+                CompareWorkflowNavigator navigator = new CompareWorkflowNavigator(shell, owner, dialogs);
+                navigator.OpenCompare(Prepared("first"));
+                await navigator.PendingTransition;
+
+                ModuleComparison selected = new ModuleComparison(
+                    navigator.CurrentWorkspace.Rows[0].Registration.Module,
+                    ComparisonState.Unavailable, true, "Artifact captured.", "Comparison unavailable.");
+                navigator.CurrentWorkspace.RestoreSet.Add(selected);
+
+                string incomingOwnedPath = Path.Combine(Path.GetTempPath(), "WinRestoreKit.Tests", Guid.NewGuid().ToString("N"));
+                Directory.CreateDirectory(incomingOwnedPath);
+                SnapshotPayloadPreparation incoming = new SnapshotPayloadPreparation(
+                    SnapshotFor(incomingOwnedPath, "second"),
+                    new BackupPayload.ReadScope(incomingOwnedPath, incomingOwnedPath), null);
+
+                navigator.OpenCompare(incoming);
+                await navigator.PendingTransition;
+
+                Assert.Equal("first", navigator.CurrentWorkspace.Snapshot.DisplayName);
+                Assert.True(navigator.CurrentWorkspace.RestoreSet.HasItems);
+                Assert.False(Directory.Exists(incomingOwnedPath));
+                owner.Close();
+            });
+        }
+
+        private static async Task<ComparisonWorkspaceViewModel> LoadedWorkspace(
+            params TestModule[] modules)
+            => await LoadedWorkspace(modules, (_, __) => { });
+
+        private static async Task<ComparisonWorkspaceViewModel> LoadedWorkspace(
+            TestModule module, string category)
+            => await LoadedWorkspace(new[] { module }, (_, __) => { }, category);
+
+        private static async Task<ComparisonWorkspaceViewModel> LoadedWorkspace(
+            TestModule[] modules, Action<SnapshotEvent, IReadOnlyList<BackupBase>> onConfirm, string category = "General")
+        {
+            string folder = Path.Combine(Path.GetTempPath(), "WinRestoreKit.Tests", Guid.NewGuid().ToString("N"));
+            Directory.CreateDirectory(folder);
+            SnapshotEvent snapshot = new SnapshotEvent(SnapshotEventKind.Verified, DateTime.UtcNow, "snapshot",
+                folder, string.Empty, string.Empty, 0, true, null);
+            SnapshotPayloadPreparation preparation = new SnapshotPayloadPreparation(
+                snapshot, new BackupPayload.ReadScope(folder, folder), null);
+            BackupModuleRegistration[] registrations = modules
+                .Select(module => new BackupModuleRegistration(module, category)).ToArray();
+            ComparisonWorkspaceViewModel workspace = new ComparisonWorkspaceViewModel(
+                snapshot, registrations, new SnapshotComparisonService(), onConfirm);
+            await workspace.StartAsync(preparation);
+            return workspace;
+        }
+
+        private static SnapshotPayloadPreparation Prepared(string name)
+        {
+            string path = Path.Combine(Path.GetTempPath(), "WinRestoreKit.Tests", Guid.NewGuid().ToString("N"));
+            Directory.CreateDirectory(path);
+            SnapshotEvent snapshot = SnapshotFor(path, name);
+            return new SnapshotPayloadPreparation(snapshot, new BackupPayload.ReadScope(path, path), null);
+        }
+
+        private static SnapshotEvent SnapshotFor(string path, string name)
+            => new SnapshotEvent(SnapshotEventKind.Verified, DateTime.UtcNow, name, path,
+                string.Empty, string.Empty, 0, true, null);
+
+        private static ShellViewModel TestShell()
+            => new ShellViewModel(new TestThemes(),
+                new WpfUpdatePresenter(new TestUpdates(), new TestDialogs(), new TestLinks()), "0.0.1");
+
+        private sealed class TestDiscardDialog : ICompareDialogService
+        {
+            private readonly bool answer;
+
+            internal TestDiscardDialog(bool answer) => this.answer = answer;
+            public bool ConfirmDiscardRestoreSet(Window owner, SnapshotEvent current, SnapshotEvent incoming) => answer;
+            public void ShowSnapshotDiagnostic(Window owner, SnapshotEvent snapshot) { }
+        }
+
+        private sealed class TestThemes : IThemeService
+        {
+            public ThemeMode Mode => ThemeMode.Light;
+            public ThemeMode EffectiveMode => ThemeMode.Light;
+            public event EventHandler ThemeChanged;
+            public void SetMode(ThemeMode mode) => ThemeChanged?.Invoke(this, EventArgs.Empty);
+            public void Dispose() { }
+        }
+
+        private sealed class TestUpdates : IUpdateCheckService
+        {
+            public Task<UpdateCheckResult> CheckAsync(string currentVersion, CancellationToken cancellationToken)
+                => Task.FromResult(new UpdateCheckResult(UpdateVerdict.UpToDate, currentVersion, currentVersion));
+        }
+
+        private sealed class TestDialogs : IWpfDialogService
+        {
+            public void ShowInformation(string text, string caption) { }
+            public void ShowWarning(string text, string caption) { }
+            public void ShowError(string text, string caption) { }
+            public bool Confirm(string text, string caption) => false;
+        }
+
+        private sealed class TestLinks : IExternalLinkService
+        {
+            public void Open(string url) { }
+        }
+
+        private sealed class TestModule : BackupBase
+        {
+            private readonly bool artifact;
+            private readonly bool? drift;
+
+            internal TestModule(string title, bool artifact, bool? drift)
+            {
+                Title = title;
+                this.artifact = artifact;
+                this.drift = drift;
+            }
+
+            internal IReadOnlyList<RestoreTarget> Targets { get; set; } = Array.Empty<RestoreTarget>();
+            internal IReadOnlyList<RestoreCloseRequirement> Processes { get; set; } = Array.Empty<RestoreCloseRequirement>();
+            internal bool Explorer { get; set; }
+            internal string Warning { get; set; } = string.Empty;
+            public override IReadOnlyList<RestoreTarget> RestoreTargets => Targets;
+            public override IReadOnlyList<RestoreCloseRequirement> ProcessesToCloseBeforeRestore => Processes;
+            public override bool RequiresExplorerRestart => Explorer;
+            public override string WarningMessage => Warning;
+            public override bool? HasArtifactIn(string backupPath) => artifact;
+            public override bool? HasDriftedFrom(string backupPath) => drift;
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/ConfirmViewModelTests.cs b/src/WinRestoreKit.Tests/ConfirmViewModelTests.cs
new file mode 100644
index 0000000..3da0c3b
--- /dev/null
+++ b/src/WinRestoreKit.Tests/ConfirmViewModelTests.cs
@@ -0,0 +1,106 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Threading;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Services;
+using WinRestoreKit.Wpf.ViewModels;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class ConfirmViewModelTests
+    {
+        [Fact]
+        public void Confirm_GroupsOnlyExistingProcessAndExplorerImpacts()
+        {
+            WpfTestHost.Run(() =>
+            {
+                TestModule consent = new TestModule("Code")
+                {
+                    Processes = new[] { new RestoreCloseRequirement("code", "Visual Studio Code", true) }
+                };
+                TestModule explorer = new TestModule("Taskbar")
+                {
+                    Explorer = true,
+                    Warning = "Existing sign-out warning."
+                };
+                ConfirmViewModel viewModel = new ConfirmViewModel(Snapshot(), new BackupBase[] { consent, explorer });
+
+                Assert.Equal(RestorePlan.FidelityCaveat, viewModel.FidelityCaveat);
+                Assert.Contains(viewModel.ConsentProcesses, item => item.DisplayName == "Visual Studio Code");
+                Assert.Contains(viewModel.ExplorerRestartModules, item => item.Title == "Taskbar");
+                Assert.Contains(viewModel.ModuleWarnings, item => item.Text == "Existing sign-out warning.");
+            });
+        }
+
+        [Fact]
+        public void Confirm_PartialSourceStaysExplicitWithoutBypassingSnapshotGate()
+        {
+            WpfTestHost.Run(() =>
+            {
+                ConfirmViewModel viewModel = new ConfirmViewModel(Snapshot(SnapshotEventKind.Partial), new BackupBase[] { new TestModule("Module") });
+
+                Assert.Equal(SnapshotEventKind.Partial, viewModel.Snapshot.Kind);
+                Assert.True(viewModel.IsSourcePartial);
+            });
+        }
+
+        [Fact]
+        public async Task Confirm_StartRestore_InvokesExistingOrchestratorWithSelectedSource()
+        {
+            await WpfTestHost.RunAsync(async () =>
+            {
+                string source = Path.Combine(Path.GetTempPath(), "WinRestoreKit.Tests", Guid.NewGuid().ToString("N"));
+                Directory.CreateDirectory(source);
+                try
+                {
+                    CancelingRunDialogService dialogs = new CancelingRunDialogService();
+                    ConfirmViewModel viewModel = new ConfirmViewModel(Snapshot(SnapshotEventKind.Verified, source), new BackupBase[] { new TestModule("Module") });
+                    Window owner = new Window();
+                    viewModel.AttachRunSurfaces(Dispatcher.CurrentDispatcher, () => owner, dialogs);
+
+                    await viewModel.StartRestoreAsync();
+
+                    Assert.Equal(Path.GetFullPath(source), dialogs.LastRestorePlan.RestoreSourcePath);
+                    Assert.Single(dialogs.LastRestorePlan.Modules);
+                    Assert.Contains("canceled", viewModel.Summary.Headline, StringComparison.OrdinalIgnoreCase);
+                    Assert.False(RunCoordinator.IsRunning);
+                    owner.Close();
+                }
+                finally
+                {
+                    if (Directory.Exists(source))
+                        Directory.Delete(source, true);
+                }
+            });
+        }
+
+        private static SnapshotEvent Snapshot(SnapshotEventKind kind = SnapshotEventKind.Verified, string path = null)
+        {
+            path = path ?? Path.GetTempPath();
+            return new SnapshotEvent(kind, DateTime.UtcNow, "snapshot", path, string.Empty, string.Empty, 0, true, null);
+        }
+
+        private sealed class CancelingRunDialogService : IRunDialogService
+        {
+            public RestorePlan LastRestorePlan { get; private set; }
+            public IReadOnlyList<string> ShowRestoreConsent(RestorePlan plan) { LastRestorePlan = plan; return null; }
+            public bool ConfirmSnapshotOverride(string text, string caption) => false;
+            public void ShowPlanCompositionError(string text, string caption) { }
+        }
+
+        private sealed class TestModule : BackupBase
+        {
+            internal TestModule(string title) => Title = title;
+            internal IReadOnlyList<RestoreCloseRequirement> Processes { get; set; } = Array.Empty<RestoreCloseRequirement>();
+            internal bool Explorer { get; set; }
+            internal string Warning { get; set; } = string.Empty;
+            public override IReadOnlyList<RestoreCloseRequirement> ProcessesToCloseBeforeRestore => Processes;
+            public override bool RequiresExplorerRestart => Explorer;
+            public override string WarningMessage => Warning;
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/FileFolderStaleArtifactTests.cs b/src/WinRestoreKit.Tests/FileFolderStaleArtifactTests.cs
new file mode 100644
index 0000000..b31d489
--- /dev/null
+++ b/src/WinRestoreKit.Tests/FileFolderStaleArtifactTests.cs
@@ -0,0 +1,104 @@
+using WinRestoreKit;
+using Conf;
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading.Tasks;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public class FileFolderStaleArtifactTests
+    {
+        private sealed class ClosingFileModule : FileModule
+        {
+            public ClosingFileModule(string file)
+            {
+                Title = "Files";
+                Files.Add(file);
+            }
+
+            protected override bool AbsenceIsNormal(string file) => true;
+
+            public override IReadOnlyList<RestoreCloseRequirement> ProcessesToCloseBeforeRestore
+                => new[] { new RestoreCloseRequirement("someapp", "Some App", true) };
+        }
+
+        private sealed class ClosingFolderModule : FolderModule
+        {
+            public ClosingFolderModule(string folder) : base(folder)
+            {
+                Title = "Folder";
+            }
+
+            public override IReadOnlyList<RestoreCloseRequirement> ProcessesToCloseBeforeRestore
+                => new[] { new RestoreCloseRequirement("someapp", "Some App", true) };
+        }
+
+        private static string NewTempDir()
+        {
+            string dir = Path.Combine(Path.GetTempPath(), "stale_artifact_" + Guid.NewGuid().ToString("N"));
+            Directory.CreateDirectory(dir);
+            return dir;
+        }
+
+        [Fact]
+        public async Task FileBackup_AfterSourceDisappears_RemovesThePreviousArtifact()
+        {
+            string source = NewTempDir();
+            string backup = NewTempDir();
+            string liveFile = Path.Combine(source, "config");
+            ClosingFileModule module = new ClosingFileModule(liveFile);
+
+            try
+            {
+                File.WriteAllText(liveFile, "first backup");
+                Assert.Equal(ResultState.Succeeded, (await module.BackupAsync(backup)).State);
+
+                File.Delete(liveFile);
+
+                ModuleResult rerun = await module.BackupAsync(backup);
+
+                Assert.Equal(ResultState.Skipped, rerun.State);
+                Assert.False(File.Exists(Path.Combine(backup, module.Title, "config")));
+                Assert.False(module.HasArtifactIn(backup));
+                Assert.False(module.HasBackupIn(backup));
+            }
+            finally
+            {
+                Directory.Delete(source, recursive: true);
+                Directory.Delete(backup, recursive: true);
+            }
+        }
+
+        [Fact]
+        public async Task FolderBackup_AfterSourceDisappears_RemovesThePreviousArtifactDirectory()
+        {
+            string sourceRoot = NewTempDir();
+            string source = Path.Combine(sourceRoot, "source");
+            string backup = NewTempDir();
+            Directory.CreateDirectory(source);
+            ClosingFolderModule module = new ClosingFolderModule(source);
+
+            try
+            {
+                File.WriteAllText(Path.Combine(source, "config"), "first backup");
+                Assert.Equal(ResultState.Succeeded, (await module.BackupAsync(backup)).State);
+
+                Directory.Delete(source, recursive: true);
+
+                ModuleResult rerun = await module.BackupAsync(backup);
+
+                Assert.Equal(ResultState.Skipped, rerun.State);
+                Assert.False(Directory.Exists(Path.Combine(backup, module.Title)));
+                Assert.False(module.HasArtifactIn(backup));
+                Assert.False(module.HasBackupIn(backup));
+            }
+            finally
+            {
+                Directory.Delete(sourceRoot, recursive: true);
+                Directory.Delete(backup, recursive: true);
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/LockedPayloadBackupTests.cs b/src/WinRestoreKit.Tests/LockedPayloadBackupTests.cs
index bc5c0a1..9a76261 100644
--- a/src/WinRestoreKit.Tests/LockedPayloadBackupTests.cs
+++ b/src/WinRestoreKit.Tests/LockedPayloadBackupTests.cs
@@ -3,7 +3,6 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Threading.Tasks;
-using System.Windows.Forms;
 using Xunit;
 
 namespace WinRestoreKit.Tests
@@ -29,6 +28,7 @@ public async Task RunBackup_LockedPayloadInReusedFolder_DoesNotRunOrPublishManif
 
                     await runner.RunBackup(new BackupBase[] { module }, isolation.DestinationRoot,
                         "locked-payload", SnapshotCompression.Fast);
+                    Assert.Equal(backupPath, runner.BackupOutputPath);
 
                     Assert.NotNull(ui.Summary);
                     Assert.Equal(RunState.DidNotRun, ui.Summary.State);
@@ -56,6 +56,7 @@ public async Task RunBackup_ReusableFolderWithoutPayload_CompletesAndWritesManif
 
                 await runner.RunBackup(new BackupBase[] { module }, isolation.DestinationRoot,
                     "unlocked-payload", SnapshotCompression.None);
+                Assert.Equal(backupPath, runner.BackupOutputPath);
 
                 Assert.NotNull(ui.Summary);
                 Assert.Equal(RunState.Done, ui.Summary.State);
@@ -86,7 +87,7 @@ private sealed class TestRunUi : IRunUi
         {
             internal RunSummary Summary { get; private set; }
 
-            public IWin32Window Owner => null;
+            public object DialogOwner => null;
 
             public void SetProgressText(string text) { }
             public void SetProgressPercent(int percent) { }
diff --git a/src/WinRestoreKit.Tests/ModuleShapeTests.cs b/src/WinRestoreKit.Tests/ModuleShapeTests.cs
index 03fc04e..bd96aed 100644
--- a/src/WinRestoreKit.Tests/ModuleShapeTests.cs
+++ b/src/WinRestoreKit.Tests/ModuleShapeTests.cs
@@ -96,26 +96,26 @@ public async Task AppStoreApps_RestoreAsync_RunsInlineOnTheCallingThread()
         // This covers the mapping, not the loop that calls it: whether RestorePackages actually
         // surfaces these needs a dialog and a real winget, and is on the manual smoke matrix.
         [Fact]
-        public void RestAppsForm_Describe_NamesEveryWayWingetCanFail()
+        public void AppRestoreService_Describe_NamesEveryWayWingetCanFail()
         {
-            Assert.Null(Views.RestAppsForm.Describe(ProcessOutcome.Ran(0)));
+            Assert.Null(AppRestoreService.Describe(ProcessOutcome.Ran(0)));
 
             Assert.Contains("could not run winget",
-                Views.RestAppsForm.Describe(ProcessOutcome.NeverStarted("not installed")));
+                AppRestoreService.Describe(ProcessOutcome.NeverStarted("not installed")));
 
             Assert.Contains("did not finish",
-                Views.RestAppsForm.Describe(ProcessOutcome.Timeout()));
+                AppRestoreService.Describe(ProcessOutcome.Timeout()));
 
             // Started-but-unknown must NOT read as "could not run winget": winget may have
             // half-installed the package, and reporting it as untouched would be a false statement
             // about whether this machine was changed.
-            string unknown = Views.RestAppsForm.Describe(ProcessOutcome.OutcomeUnknown("pipe closed"));
+            string unknown = AppRestoreService.Describe(ProcessOutcome.OutcomeUnknown("pipe closed"));
             Assert.Contains("could not be determined", unknown);
             Assert.DoesNotContain("could not run winget", unknown);
 
-            Assert.Contains("code 1", Views.RestAppsForm.Describe(ProcessOutcome.Ran(1)));
+            Assert.Contains("code 1", AppRestoreService.Describe(ProcessOutcome.Ran(1)));
 
-            Assert.NotNull(Views.RestAppsForm.Describe(null));
+            Assert.NotNull(AppRestoreService.Describe(null));
         }
 
         // Restoring from a folder containing no .reg file must be Skipped, not a false success.
diff --git a/src/WinRestoreKit.Tests/ProgressPageViewTests.cs b/src/WinRestoreKit.Tests/ProgressPageViewTests.cs
index 46529e4..68a4ccb 100644
--- a/src/WinRestoreKit.Tests/ProgressPageViewTests.cs
+++ b/src/WinRestoreKit.Tests/ProgressPageViewTests.cs
@@ -75,8 +75,22 @@ public void SetProgressText_ArchivePhase_DisablesCancellation()
         }
         private static ProgressPageView CreateView()
         {
-            return new ProgressPageView(new NavigationService(new Panel()), Array.Empty<BackupBase>(), "nightly",
+            var view = new ProgressPageView(new NavigationService(new Panel()), Array.Empty<BackupBase>(), "nightly",
                 SnapshotCompression.Fast, @"C:\backup");
+
+            // RenderSummary (called by the Render helper below) sets control properties that lazily
+            // create the view's handle, which fires OnLoad -> RunAsync -> a real async backup run.
+            // That run's completion calls ShowSummary and overwrites the very kicker these tests
+            // assert on, racing the test's read (RenderSummary_LateCancellationAfterCompletedBackup
+            // went deterministically red from this). OnLoad guards on `runStarted`; set it so the
+            // spurious run never starts and RenderSummary is exercised in isolation, which is what
+            // these tests intend.
+            FieldInfo runStarted = typeof(ProgressPageView).GetField("runStarted",
+                BindingFlags.Instance | BindingFlags.NonPublic);
+            Assert.NotNull(runStarted);
+            runStarted.SetValue(view, true);
+
+            return view;
         }
 
         private static ModuleOutcome SucceededOutcome()
diff --git a/src/WinRestoreKit.Tests/ProgressWorkspaceViewModelTests.cs b/src/WinRestoreKit.Tests/ProgressWorkspaceViewModelTests.cs
new file mode 100644
index 0000000..70b9982
--- /dev/null
+++ b/src/WinRestoreKit.Tests/ProgressWorkspaceViewModelTests.cs
@@ -0,0 +1,181 @@
+using System;
+using DataHelper;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Threading;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Services;
+using WinRestoreKit.Wpf.ViewModels;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class ProgressWorkspaceViewModelTests
+    {
+        [Fact]
+        public void PauseCommand_ChangesOnlyBoundaryStateAndLogsExactMessages()
+        {
+            WpfTestHost.Run(() =>
+            {
+                ProgressWorkspaceViewModel vm = CreateViewModel(new ConfirmingDialogs(false));
+
+                vm.PauseCommand.Execute(null);
+
+                Assert.True(vm.IsPaused);
+                Assert.Equal("Resume", vm.PauseCaption);
+                Assert.Equal("Run paused. The active group will finish before pausing.",
+                    Assert.Single(vm.LogLines).Text);
+
+                vm.PauseCommand.Execute(null);
+
+                Assert.False(vm.IsPaused);
+                Assert.Equal("Pause", vm.PauseCaption);
+                Assert.Equal(new[]
+                {
+                    "Run paused. The active group will finish before pausing.",
+                    "Run resumed. The next group may start."
+                }, vm.LogLines.Select(line => line.Text));
+            });
+        }
+
+        [Fact]
+        public void CancelCommand_WhenConfirmed_DisablesActionsAndLogsActiveGroupWarning()
+        {
+            WpfTestHost.Run(() =>
+            {
+                ProgressWorkspaceViewModel vm = CreateViewModel(new ConfirmingDialogs(true));
+
+                vm.CancelCommand.Execute(null);
+
+                Assert.True(vm.IsCancellationRequested);
+                Assert.False(vm.CanPause);
+                Assert.False(vm.CanCancel);
+                Assert.Equal("Cancellation requested. The active group will finish before cancellation.",
+                    Assert.Single(vm.LogLines).Text);
+            });
+        }
+
+        [Fact]
+        public void ArchiveProgress_DisablesCancellationWithoutInventingMetrics()
+        {
+            WpfTestHost.Run(() =>
+            {
+                ProgressWorkspaceViewModel vm = CreateViewModel(new ConfirmingDialogs(false));
+
+                vm.SetProgressDetail("Group 1 of 1. Mouse", "00:01", "N/A", "N/A", 0, 2, 1);
+                vm.SetProgressText(BackupRestoreOrchestrator.ArchiveProgressText);
+
+                Assert.False(vm.CanCancel);
+                Assert.Equal("N/A", vm.Remaining);
+                Assert.Equal("N/A", vm.Throughput);
+                Assert.Equal(0, vm.BytesWritten);
+                Assert.Equal(2, vm.Errors);
+                Assert.Equal(1, vm.Warnings);
+            });
+        }
+
+        [Fact]
+        public async Task RunBackupAsync_ExecutorWithoutSummary_UsesDidNotRunFallback()
+        {
+            await WpfTestHost.RunAsync(async () =>
+            {
+                ProgressWorkspaceViewModel vm = CreateViewModel(new ConfirmingDialogs(false),
+                    _ => Task.CompletedTask);
+
+                RunSummary summary = await vm.RunBackupAsync(new BackupRunRequest(
+                    Array.Empty<BackupBase>(), "nightly", SnapshotCompression.Fast, @"C:\snapshots"));
+
+                Assert.Equal(RunState.DidNotRun, summary.State);
+                Assert.Equal("Backup did not run.", summary.Headline);
+                Assert.Equal(summary, vm.Summary);
+            });
+        }
+
+        [Fact]
+        public void CancelCommand_WhenDeclined_LeavesBoundaryStateAndLogUntouched()
+        {
+            WpfTestHost.Run(() =>
+            {
+                ProgressWorkspaceViewModel vm = CreateViewModel(new ConfirmingDialogs(false));
+
+                vm.CancelCommand.Execute(null);
+
+                Assert.False(vm.IsCancellationRequested);
+                Assert.True(vm.CanPause);
+                Assert.True(vm.CanCancel);
+                Assert.Empty(vm.LogLines);
+            });
+        }
+
+        [Fact]
+        public void NoByteMeasurement_RendersTheCoreNotAvailableValue()
+        {
+            WpfTestHost.Run(() =>
+            {
+                ProgressWorkspaceViewModel vm = CreateViewModel(new ConfirmingDialogs(false));
+
+                vm.SetProgressDetail("Group 1 of 1. Mouse", "00:01", "N/A", "N/A", -1, 0, 0);
+
+                Assert.Equal(-1, vm.BytesWritten);
+                Assert.Equal(ProgressMetrics.NotAvailable, vm.BytesWrittenText);
+            });
+        }
+
+        [Fact]
+        public void ProgressView_RendersRunControlsWithoutWritingReadOnlyProgress()
+        {
+            WpfTestHost.Run(() =>
+            {
+                var view = new WinRestoreKit.Wpf.Views.ProgressWorkspaceView
+                {
+                    DataContext = CreateViewModel(new ConfirmingDialogs(false))
+                };
+                var window = new Window { Content = view };
+                window.Show();
+                window.UpdateLayout();
+                Dispatcher.CurrentDispatcher.Invoke(
+                    DispatcherPriority.ApplicationIdle,
+                    new Action(() => { }));
+
+                Assert.NotNull(view.FindName("ProgressPercentBar"));
+                Assert.NotNull(view.FindName("ProgressLogList"));
+                Assert.NotNull(view.FindName("PauseRunButton"));
+                Assert.NotNull(view.FindName("CancelRunButton"));
+                window.Close();
+            });
+        }
+
+        private static ProgressWorkspaceViewModel CreateViewModel(IWpfDialogService dialogs)
+            => new ProgressWorkspaceViewModel(Dispatcher.CurrentDispatcher, () => null,
+                new NoOpRunDialogs(), dialogs);
+
+        private static ProgressWorkspaceViewModel CreateViewModel(IWpfDialogService dialogs,
+                                                                    Func<BackupRunRequest, Task> executor)
+            => new ProgressWorkspaceViewModel(Dispatcher.CurrentDispatcher, () => null,
+                new NoOpRunDialogs(), dialogs, executor);
+
+        private sealed class ConfirmingDialogs : IWpfDialogService
+        {
+            private readonly bool confirmation;
+
+            internal ConfirmingDialogs(bool confirmation)
+            {
+                this.confirmation = confirmation;
+            }
+
+            public void ShowInformation(string text, string caption) { }
+            public void ShowWarning(string text, string caption) { }
+            public void ShowError(string text, string caption) { }
+            public bool Confirm(string text, string caption) => confirmation;
+        }
+
+        private sealed class NoOpRunDialogs : IRunDialogService
+        {
+            public IReadOnlyList<string> ShowRestoreConsent(RestorePlan plan) => null;
+            public bool ConfirmSnapshotOverride(string text, string caption) => false;
+            public void ShowPlanCompositionError(string text, string caption) { }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/RegFileValidateContentTests.cs b/src/WinRestoreKit.Tests/RegFileValidateContentTests.cs
new file mode 100644
index 0000000..46cdbd8
--- /dev/null
+++ b/src/WinRestoreKit.Tests/RegFileValidateContentTests.cs
@@ -0,0 +1,56 @@
+using System;
+using System.IO;
+using System.Text;
+using WinRestoreKit;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class RegFileValidateContentTests : IDisposable
+    {
+        private readonly string directory = Path.Combine(
+            Path.GetTempPath(), "WinRestoreKit-RegFile-" + Guid.NewGuid().ToString("N"));
+
+        public RegFileValidateContentTests()
+        {
+            Directory.CreateDirectory(directory);
+        }
+
+        public void Dispose()
+        {
+            try { Directory.Delete(directory, true); } catch { }
+        }
+
+        [Fact]
+        public void Validate_HeaderOnlyExport_IsInvalid()
+        {
+            Assert.Equal(RegFileCheck.Invalid, Validate("header-only.reg", RegFile.Header + "\r\n"));
+        }
+
+        [Fact]
+        public void Validate_HeaderAndPartialLineWithoutSection_IsInvalid()
+        {
+            Assert.Equal(RegFileCheck.Invalid, Validate("truncated.reg", RegFile.Header + "\r\n\r\n\"Name\"="));
+        }
+
+        [Fact]
+        public void Validate_ExportWithKeySectionAndValue_IsValid()
+        {
+            Assert.Equal(RegFileCheck.Valid, Validate("complete.reg",
+                RegFile.Header + "\r\n\r\n[HKEY_CURRENT_USER\\Software\\WinRestoreKit]\r\n\"Name\"=\"Value\"\r\n"));
+        }
+
+        [Fact]
+        public void Validate_EmptyFile_IsInvalid()
+        {
+            Assert.Equal(RegFileCheck.Empty, Validate("empty.reg", ""));
+        }
+
+        private RegFileCheck Validate(string name, string content)
+        {
+            string path = Path.Combine(directory, name);
+            File.WriteAllText(path, content, new UnicodeEncoding(false, true));
+            return RegFile.Validate(path);
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/RestoreConsentCancellationTests.cs b/src/WinRestoreKit.Tests/RestoreConsentCancellationTests.cs
index 22b9890..beeadcd 100644
--- a/src/WinRestoreKit.Tests/RestoreConsentCancellationTests.cs
+++ b/src/WinRestoreKit.Tests/RestoreConsentCancellationTests.cs
@@ -2,7 +2,6 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Threading.Tasks;
-using System.Windows.Forms;
 using WinRestoreKit;
 using Xunit;
 
@@ -23,11 +22,12 @@ public async Task ConsentCancellation_ShowsInformationalNoChangesSummary()
 
                 await runner.RunRestore(new BackupBase[] { new TestModule() }, restorePath);
 
+                Assert.Null(ui.DialogOwner);
                 RunSummary summary = Assert.IsType<RunSummary>(ui.Summary);
                 Assert.Equal(1, ui.SummaryCount);
                 Assert.NotEqual(RunState.Problems, summary.State);
                 Assert.NotEqual(RunState.DidNotRun, summary.State);
-                Assert.Equal(MessageBoxIcon.Information, summary.Icon);
+                Assert.Equal(RunSeverity.Information, summary.Severity);
                 Assert.Contains("canceled", summary.Headline, StringComparison.OrdinalIgnoreCase);
                 Assert.Contains("no changes", summary.Headline + " " + summary.Detail,
                     StringComparison.OrdinalIgnoreCase);
@@ -54,7 +54,7 @@ private sealed class CancelingUi : IRunUi
             public RunSummary Summary { get; private set; }
             public int SummaryCount { get; private set; }
 
-            public IWin32Window Owner => null;
+            public object DialogOwner => null;
             public void SetProgressText(string text) { }
             public void SetProgressPercent(int percent) { }
             public void SetProgressDetail(string groupInfo, string elapsed, string remaining, string throughput,
diff --git a/src/WinRestoreKit.Tests/RestoreConsentDialogTests.cs b/src/WinRestoreKit.Tests/RestoreConsentDialogTests.cs
new file mode 100644
index 0000000..0ae011b
--- /dev/null
+++ b/src/WinRestoreKit.Tests/RestoreConsentDialogTests.cs
@@ -0,0 +1,42 @@
+using System.Collections.Generic;
+using System.IO;
+using System.Windows;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Views.Dialogs;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class RestoreConsentDialogTests
+    {
+        [Fact]
+        public void RestoreConsentDialog_IsOwnerBoundAndDefaultsToNoConsentedProcesses()
+        {
+            WpfTestHost.Run(() =>
+            {
+                Window owner = new Window();
+                owner.Show();
+                RestoreConsentDialog dialog = RestoreConsentDialog.Create(owner, PlanWithOneConsentEntry());
+
+                Assert.Same(owner, dialog.Owner);
+                Assert.Empty(dialog.ConsentedProcessNames);
+                Assert.False(dialog.DialogResult == true);
+                dialog.Close();
+                owner.Close();
+            });
+        }
+
+        private static RestorePlan PlanWithOneConsentEntry()
+        {
+            ConsentModule module = new ConsentModule();
+            return new RestorePlan(new BackupBase[] { module }, Path.GetTempPath(), Path.Combine(Path.GetTempPath(), "snapshot"));
+        }
+
+        private sealed class ConsentModule : BackupBase
+        {
+            public ConsentModule() => Title = "Code";
+            public override IReadOnlyList<RestoreCloseRequirement> ProcessesToCloseBeforeRestore
+                => new[] { new RestoreCloseRequirement("code", "Visual Studio Code", true) };
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/RestoreContentsPayloadErrorTests.cs b/src/WinRestoreKit.Tests/RestoreContentsPayloadErrorTests.cs
new file mode 100644
index 0000000..5e8c4f0
--- /dev/null
+++ b/src/WinRestoreKit.Tests/RestoreContentsPayloadErrorTests.cs
@@ -0,0 +1,48 @@
+using System;
+using System.IO;
+using WinRestoreKit;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class RestoreContentsPayloadErrorTests : IDisposable
+    {
+        private readonly string backupPath = Path.Combine(
+            Path.GetTempPath(), "WinRestoreKit-PayloadError-" + Guid.NewGuid().ToString("N"));
+
+        public RestoreContentsPayloadErrorTests()
+        {
+            Directory.CreateDirectory(backupPath);
+            File.WriteAllText(Path.Combine(backupPath, BackupPayload.FileName), "not a zip archive");
+        }
+
+        public void Dispose()
+        {
+            try { Directory.Delete(backupPath, true); } catch { }
+        }
+
+        [Fact]
+        public void For_CorruptPayload_ReportsThatManifestSilentModuleCouldNotBeRead()
+        {
+            RestoreContentsRow row = Assert.Single(RestoreContents.For(
+                new BackupBase[] { new ManifestSilentModule() }, backupPath, null));
+
+            Assert.False(row.HasBackup);
+            Assert.True(row.CouldNotBeRead);
+            Assert.Contains("could not be read", row.Warning, StringComparison.OrdinalIgnoreCase);
+        }
+
+        private sealed class ManifestSilentModule : BackupBase
+        {
+            public ManifestSilentModule()
+            {
+                Title = "Manifest-silent";
+            }
+
+            public override bool? HasArtifactIn(string path)
+            {
+                return false;
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/RestoreDialogOwnerTests.cs b/src/WinRestoreKit.Tests/RestoreDialogOwnerTests.cs
new file mode 100644
index 0000000..29730dd
--- /dev/null
+++ b/src/WinRestoreKit.Tests/RestoreDialogOwnerTests.cs
@@ -0,0 +1,64 @@
+using Conf;
+using System;
+using System.IO;
+using System.Windows.Forms;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    /// <summary>
+    /// Pins the opaque Core-to-shell dialog seam. WinForms supplies an <see cref="IWin32Window"/>;
+    /// the WPF bridge independently admits only a visible <see cref="System.Windows.Window"/>.
+    /// </summary>
+    public class RestoreDialogOwnerTests
+    {
+        private sealed class TestWindowOwner : IWin32Window
+        {
+            public IntPtr Handle => IntPtr.Zero;
+        }
+
+        private sealed class DialogHook : IDisposable
+        {
+            private readonly Action<string, object> previous;
+
+            public DialogHook(Action<string, object> replacement)
+            {
+                previous = AppStoreApps.RestoreDialog;
+                AppStoreApps.RestoreDialog = replacement;
+            }
+
+            public void Dispose() => AppStoreApps.RestoreDialog = previous;
+        }
+
+        [Fact]
+        public void Restore_WithAnOwner_PassesThatOwnerToTheRegisteredDialog()
+        {
+            string source = Path.Combine(Path.GetTempPath(), "app-restore-" + Guid.NewGuid().ToString("N"));
+            IWin32Window owner = new TestWindowOwner();
+            object receivedOwner = null;
+            string openedPath = null;
+
+            try
+            {
+                Directory.CreateDirectory(source);
+
+                using (new DialogHook((path, suppliedOwner) =>
+                {
+                    openedPath = path;
+                    receivedOwner = suppliedOwner;
+                }))
+                {
+                    ModuleResult result = new AppStoreApps().Restore(source, owner);
+
+                    Assert.Equal(ResultState.Skipped, result.State);
+                    Assert.Same(owner, receivedOwner);
+                    Assert.Equal(Path.GetFullPath(source), Path.GetFullPath(openedPath), StringComparer.OrdinalIgnoreCase);
+                }
+            }
+            finally
+            {
+                try { Directory.Delete(source, true); } catch { }
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/RestoreSetViewModelTests.cs b/src/WinRestoreKit.Tests/RestoreSetViewModelTests.cs
new file mode 100644
index 0000000..7d71278
--- /dev/null
+++ b/src/WinRestoreKit.Tests/RestoreSetViewModelTests.cs
@@ -0,0 +1,36 @@
+using WinRestoreKit;
+using WinRestoreKit.Wpf.ViewModels;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class RestoreSetViewModelTests
+    {
+        [Fact]
+        public void RestoreSet_OnlyAcceptsRowsWithUsableArtifacts()
+        {
+            WpfTestHost.Run(() =>
+            {
+                RestoreSetViewModel restoreSet = new RestoreSetViewModel();
+                TestModule usableModule = new TestModule("Terminal");
+                TestModule absentModule = new TestModule("Fonts");
+                ModuleComparison unavailableButUsable = new ModuleComparison(
+                    usableModule, ComparisonState.Unavailable, true, "Artifact captured.", "Unable to compare.");
+                ModuleComparison absent = new ModuleComparison(
+                    absentModule, ComparisonState.NotCaptured, false, "No artifact captured.", "Not captured.");
+
+                restoreSet.Add(unavailableButUsable);
+                restoreSet.Add(absent);
+
+                Assert.Single(restoreSet.Modules);
+                Assert.Same(usableModule, restoreSet.Modules[0]);
+                Assert.False(restoreSet.Contains(absentModule));
+            });
+        }
+
+        internal sealed class TestModule : BackupBase
+        {
+            internal TestModule(string title) => Title = title;
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/ResultWorkspaceViewModelTests.cs b/src/WinRestoreKit.Tests/ResultWorkspaceViewModelTests.cs
new file mode 100644
index 0000000..c6a4aad
--- /dev/null
+++ b/src/WinRestoreKit.Tests/ResultWorkspaceViewModelTests.cs
@@ -0,0 +1,93 @@
+using System;
+using System.Threading.Tasks;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.ViewModels;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class ResultWorkspaceViewModelTests
+    {
+        [Fact]
+        public void Result_CompletedSummaryAfterLateCancel_IsNotRelabeledIncomplete()
+        {
+            using var control = new RunControl();
+            control.RequestCancellation();
+            RunSummary completed = RunSummary.For(new[] { SucceededOutcome() }, true, RunVerb.Backup);
+
+            ResultWorkspaceViewModel vm = ResultWorkspaceViewModel.From(completed,
+                new[] { SucceededOutcome() }, () => Task.CompletedTask);
+
+            Assert.Equal("Run complete", vm.StatusLabel);
+            Assert.DoesNotContain("canceled", vm.Headline, StringComparison.OrdinalIgnoreCase);
+            Assert.Equal(RunSeverity.Information, vm.Severity);
+        }
+
+        [Fact]
+        public void Result_IncompleteSummary_UsesItsActualCancellationWording()
+        {
+            RunSummary incomplete = RunSummary.Incomplete(Array.Empty<ModuleOutcome>(), RunVerb.Backup,
+                "Cancellation was requested. No further group was started.");
+
+            ResultWorkspaceViewModel vm = ResultWorkspaceViewModel.From(incomplete,
+                Array.Empty<ModuleOutcome>(), () => Task.CompletedTask);
+
+            Assert.Equal("Run canceled, incomplete", vm.StatusLabel);
+            Assert.Contains("canceled, run incomplete", vm.Headline, StringComparison.OrdinalIgnoreCase);
+            Assert.Equal(RunSeverity.Warning, vm.Severity);
+        }
+
+        [Fact]
+        public void Result_CanceledBeforeRun_UsesNoChangesLabelAndPreservesOutcomes()
+        {
+            ModuleOutcome outcome = SucceededOutcome();
+            ResultWorkspaceViewModel vm = ResultWorkspaceViewModel.From(RunSummary.Canceled(RunVerb.Restore),
+                new[] { outcome }, () => Task.CompletedTask);
+
+            Assert.Equal("Run canceled, no changes", vm.StatusLabel);
+            Assert.Equal(RunSeverity.Information, vm.Severity);
+            Assert.Same(outcome, Assert.Single(vm.Outcomes));
+        }
+
+        [Fact]
+        public void ResultView_ExposesNeutralSeverityAndReturnToTimelineAction()
+        {
+            WpfTestHost.Run(() =>
+            {
+                var view = new WinRestoreKit.Wpf.Views.ResultWorkspaceView
+                {
+                    DataContext = ResultWorkspaceViewModel.From(
+                        RunSummary.For(new[] { SucceededOutcome() }, true, RunVerb.Backup),
+                        new[] { SucceededOutcome() }, () => Task.CompletedTask)
+                };
+
+                Assert.NotNull(view.FindName("RunSeverityText"));
+                Assert.NotNull(view.FindName("RunOutcomesList"));
+                Assert.NotNull(view.FindName("ReturnTimelineButton"));
+            });
+        }
+
+        [Fact]
+        public async Task Result_ReturnToTimelineCommand_InvokesTheSuppliedAction()
+        {
+            var returned = new TaskCompletionSource<object>(TaskCreationOptions.RunContinuationsAsynchronously);
+            ResultWorkspaceViewModel vm = ResultWorkspaceViewModel.From(
+                RunSummary.For(new[] { SucceededOutcome() }, true, RunVerb.Backup),
+                new[] { SucceededOutcome() }, () =>
+                {
+                    returned.TrySetResult(null);
+                    return Task.CompletedTask;
+                });
+
+            vm.ReturnToTimelineCommand.Execute(null);
+
+            await returned.Task;
+        }
+
+        private static ModuleOutcome SucceededOutcome()
+            => new ModuleOutcome("Mouse", ModuleResult.Aggregate(new[]
+            {
+                StepResult.Succeeded("Mouse", "exported setting")
+            }));
+    }
+}
diff --git a/src/WinRestoreKit.Tests/RunSummaryTests.cs b/src/WinRestoreKit.Tests/RunSummaryTests.cs
index c445084..1fff298 100644
--- a/src/WinRestoreKit.Tests/RunSummaryTests.cs
+++ b/src/WinRestoreKit.Tests/RunSummaryTests.cs
@@ -1,6 +1,5 @@
 using WinRestoreKit;
 using System.Collections.Generic;
-using System.Windows.Forms;
 using Xunit;
 
 namespace WinRestoreKit.Tests
@@ -106,9 +105,26 @@ public void SucceededPlusSkipped_Restore_FootnoteDoesNotSayBackUp()
         }
 
         [Fact]
-        public void DidNotRun_IsAWarningNotInformation()
-            => Assert.Equal(MessageBoxIcon.Warning,
-                   RunSummary.For(new List<ModuleOutcome>(), false, RunVerb.Restore).Icon);
+        public void DidNotRun_IsWarningWithoutAWinFormsMessageBoxIcon()
+        {
+            RunSummary summary = RunSummary.For(new List<ModuleOutcome>(), false, RunVerb.Backup,
+                                                "the destination is empty");
+
+            Assert.Equal(RunSeverity.Warning, summary.Severity);
+            var dialogOwner = typeof(IRunUi).GetProperty("DialogOwner");
+            Assert.NotNull(dialogOwner);
+            Assert.Equal(typeof(object), dialogOwner.PropertyType);
+            Assert.Null(typeof(IRunUi).GetProperty("Owner"));
+        }
+
+        [Fact]
+        public void IncompleteRun_IsWarning()
+        {
+            RunSummary summary = RunSummary.Incomplete(new List<ModuleOutcome>(), RunVerb.Restore,
+                                                        "The pre-restore snapshot was incomplete.");
+
+            Assert.Equal(RunSeverity.Warning, summary.Severity);
+        }
 
         [Fact]
         public void Problems_DetailNamesEveryFailedModule()
diff --git a/src/WinRestoreKit.Tests/ScopeGroupsPrivacyTests.cs b/src/WinRestoreKit.Tests/ScopeGroupsPrivacyTests.cs
index 9f0152e..9fb39a3 100644
--- a/src/WinRestoreKit.Tests/ScopeGroupsPrivacyTests.cs
+++ b/src/WinRestoreKit.Tests/ScopeGroupsPrivacyTests.cs
@@ -2,7 +2,6 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
-using Views;
 using WinRestoreKit;
 using Xunit;
 
@@ -13,7 +12,7 @@ public class ScopeGroupsPrivacyTests
         [Fact]
         public void Build_RequiresExplicitOptInForUnfilteredEnvironmentVariables()
         {
-            IReadOnlyList<ModuleRegistration> registrations = ModuleCatalog.CreateAll();
+            IReadOnlyList<BackupModuleRegistration> registrations = BackupModuleCatalog.CreateAll();
             IReadOnlyList<ScopeGroupRow> groups = ScopeGroups.Build();
 
             ScopeGroupRow appSettings = Assert.Single(groups, group => group.Name == "App settings (AppData)");
diff --git a/src/WinRestoreKit.Tests/ShellBackupFlowTests.cs b/src/WinRestoreKit.Tests/ShellBackupFlowTests.cs
new file mode 100644
index 0000000..51e54af
--- /dev/null
+++ b/src/WinRestoreKit.Tests/ShellBackupFlowTests.cs
@@ -0,0 +1,96 @@
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.ViewModels;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class ShellBackupFlowTests
+    {
+        [Fact]
+        public async Task CreateSnapshot_AdmitsOneRun_ShowsResult_ThenRefreshesTimeline()
+        {
+            using var isolation = new BackupRunIsolation();
+            BackupRootRegistry.Remember(isolation.DestinationRoot);
+            RunCoordinator.SetRunning(false);
+
+            try
+            {
+                int refreshes = 0;
+                ModuleOutcome outcome = SucceededOutcome();
+                RunSummary summary = RunSummary.For(new[] { outcome }, true, RunVerb.Backup);
+                var shell = ShellViewModel.ForTest(
+                    _ => Task.FromResult(new BackupRunCompletion(summary, new[] { outcome },
+                        @"C:\snapshots\snapshot-started-before-rollover")),
+                    new SnapshotEventCatalog(),
+                    () =>
+                    {
+                        refreshes++;
+                        return Task.CompletedTask;
+                    });
+
+                shell.CreateSnapshotCommand.Execute(null);
+                BackupWorkspaceViewModel selection = Assert.IsType<BackupWorkspaceViewModel>(shell.CurrentWorkspace);
+                selection.Scopes.First().IsSelected = true;
+                await selection.StartAsync();
+
+                ResultWorkspaceViewModel result = Assert.IsType<ResultWorkspaceViewModel>(shell.CurrentWorkspace);
+                Assert.False(RunCoordinator.IsRunning);
+                Assert.Equal(1, refreshes);
+
+                result.ReturnToTimelineCommand.Execute(null);
+
+                Assert.Equal(1, refreshes);
+            }
+            finally
+            {
+                RunCoordinator.SetRunning(false);
+            }
+        }
+
+        [Fact]
+        public async Task CreateSnapshot_WhenRunIsAlreadyActive_LeavesSelectionAndDoesNotConstructRunner()
+        {
+            using var isolation = new BackupRunIsolation();
+            BackupRootRegistry.Remember(isolation.DestinationRoot);
+            RunCoordinator.SetRunning(false);
+
+            try
+            {
+                int runRequests = 0;
+                var shell = ShellViewModel.ForTest(
+                    _ =>
+                    {
+                        runRequests++;
+                        return Task.FromResult(new BackupRunCompletion(
+                            RunSummary.Canceled(RunVerb.Backup), Array.Empty<ModuleOutcome>(), string.Empty));
+                    },
+                    new SnapshotEventCatalog(),
+                    () => Task.CompletedTask);
+
+                shell.CreateSnapshotCommand.Execute(null);
+                BackupWorkspaceViewModel selection = Assert.IsType<BackupWorkspaceViewModel>(shell.CurrentWorkspace);
+                selection.Scopes.First().IsSelected = true;
+                RunCoordinator.SetRunning(true);
+
+                await selection.StartAsync();
+
+                Assert.Same(selection, shell.CurrentWorkspace);
+                Assert.Equal(0, runRequests);
+                Assert.Equal("Another backup or restore is already running.", selection.ValidationMessage);
+            }
+            finally
+            {
+                RunCoordinator.SetRunning(false);
+            }
+        }
+
+        private static ModuleOutcome SucceededOutcome()
+        {
+            return new ModuleOutcome("Mouse",
+                ModuleResult.Aggregate(new[] { StepResult.Succeeded("key", "exported key") }));
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs b/src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs
new file mode 100644
index 0000000..11188b4
--- /dev/null
+++ b/src/WinRestoreKit.Tests/SnapshotComparisonServiceTests.cs
@@ -0,0 +1,448 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.IO.Compression;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class SnapshotComparisonServiceTests
+    {
+        [Theory]
+        [InlineData(true, ComparisonState.Changed)]
+        [InlineData(false, ComparisonState.Same)]
+        public async Task CompareAsync_ManifestSucceeded_MapsDriftWithoutArtifactProbe(
+            bool drifted, ComparisonState expected)
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                ProbeModule module = new ProbeModule("Display", artifact: false, drifted: drifted);
+                SnapshotEvent snapshot = Snapshot(backup.Path, Manifest(Entry(module, BackupManifest.StateSucceeded)));
+
+                ModuleComparison row = Assert.Single(await new SnapshotComparisonService()
+                    .CompareAsync(snapshot, new[] { (BackupBase)module }, CancellationToken.None));
+
+                Assert.Equal(expected, row.State);
+                Assert.True(row.HasUsableArtifact);
+                Assert.Equal(0, module.ArtifactProbeCount);
+            }
+        }
+
+        [Theory]
+        [InlineData(BackupManifest.StateSkipped)]
+        [InlineData(BackupManifest.StateFailed)]
+        public async Task CompareAsync_ManifestStatesWithoutArtifact_AreNotCaptured(string state)
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                ProbeModule module = new ProbeModule("Fonts", artifact: true, drifted: true);
+
+                ModuleComparison row = Assert.Single(await new SnapshotComparisonService().CompareAsync(
+                    Snapshot(backup.Path, Manifest(Entry(module, state))), new[] { (BackupBase)module },
+                    CancellationToken.None));
+
+                Assert.Equal(ComparisonState.NotCaptured, row.State);
+                Assert.False(row.HasUsableArtifact);
+                Assert.Equal(0, module.ArtifactProbeCount);
+                Assert.Equal(0, module.DriftProbeCount);
+            }
+        }
+
+        [Fact]
+        public async Task CompareAsync_ManifestSilentIndeterminateArtifact_IsNotCaptured()
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                ProbeModule module = new ProbeModule("Terminal", artifact: null, drifted: false);
+
+                ModuleComparison row = Assert.Single(await new SnapshotComparisonService().CompareAsync(
+                    Snapshot(backup.Path, Manifest(EntryForDifferentModule())), new[] { (BackupBase)module },
+                    CancellationToken.None));
+
+                Assert.Equal(ComparisonState.NotCaptured, row.State);
+                Assert.False(row.HasUsableArtifact);
+                Assert.Equal(0, module.DriftProbeCount);
+            }
+        }
+
+        [Fact]
+        public async Task CompareAsync_NoManifestIndeterminateArtifact_UsesRestoreContentsFallback()
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                ProbeModule module = new ProbeModule("Legacy", artifact: null, drifted: false);
+
+                ModuleComparison row = Assert.Single(await new SnapshotComparisonService().CompareAsync(
+                    Snapshot(backup.Path, manifest: null), new[] { (BackupBase)module }, CancellationToken.None));
+
+                Assert.Equal(ComparisonState.Same, row.State);
+                Assert.True(row.HasUsableArtifact);
+                Assert.Equal(1, module.DriftProbeCount);
+            }
+        }
+
+        [Fact]
+        public async Task CompareAsync_ProvenMissingArtifact_IsNotCapturedWithoutDriftProbe()
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                ProbeModule module = new ProbeModule("Missing", artifact: false, drifted: true);
+
+                ModuleComparison row = Assert.Single(await new SnapshotComparisonService().CompareAsync(
+                    Snapshot(backup.Path, manifest: null), new[] { (BackupBase)module }, CancellationToken.None));
+
+                Assert.Equal(ComparisonState.NotCaptured, row.State);
+                Assert.False(row.HasUsableArtifact);
+                Assert.Equal(0, module.DriftProbeCount);
+            }
+        }
+
+        [Fact]
+        public async Task CompareAsync_ArtifactProbeException_IsUnavailableWithoutDriftProbe()
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                CreateCompressedBackupWithArtifact(backup.Path);
+                HashSet<string> payloadDirectoriesBefore = PayloadExtractionDirectories();
+                ProbeModule module = new ProbeModule("Broken artifact", artifact: true, drifted: true)
+                {
+                    ThrowOnArtifact = true
+                };
+
+                ModuleComparison row = Assert.Single(await new SnapshotComparisonService().CompareAsync(
+                    Snapshot(backup.Path, manifest: null), new[] { (BackupBase)module }, CancellationToken.None));
+
+                Assert.Equal(ComparisonState.Unavailable, row.State);
+                Assert.False(row.HasUsableArtifact);
+                Assert.Equal(0, module.DriftProbeCount);
+                Assert.Empty(PayloadExtractionDirectories().Except(payloadDirectoriesBefore));
+            }
+        }
+
+        [Fact]
+        public async Task CompareAsync_IndeterminateDrift_StaysUnavailableWithUsableArtifact()
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                ProbeModule module = new ProbeModule("Unknown", artifact: true, drifted: null);
+
+                ModuleComparison row = Assert.Single(await new SnapshotComparisonService().CompareAsync(
+                    Snapshot(backup.Path, manifest: null), new[] { (BackupBase)module }, CancellationToken.None));
+
+                Assert.Equal(ComparisonState.Unavailable, row.State);
+                Assert.True(row.HasUsableArtifact);
+            }
+        }
+
+        [Fact]
+        public async Task CompareAsync_ManifestLookupUsesExactClrTypeName()
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                ProbeModule module = new ProbeModule("Exact", artifact: false, drifted: true);
+                ManifestModule lowerCaseEntry = new ManifestModule(module.GetType().Name.ToLowerInvariant(),
+                    module.Title, BackupManifest.StateSucceeded, string.Empty);
+
+                ModuleComparison row = Assert.Single(await new SnapshotComparisonService().CompareAsync(
+                    Snapshot(backup.Path, Manifest(lowerCaseEntry)), new[] { (BackupBase)module },
+                    CancellationToken.None));
+
+                Assert.Equal(ComparisonState.NotCaptured, row.State);
+                Assert.Equal(1, module.ArtifactProbeCount);
+                Assert.Equal(0, module.DriftProbeCount);
+            }
+        }
+
+        [Fact]
+        public async Task CompareAsync_PayloadPreparationFailure_PreservesManifestAbsenceAndReason()
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                ProbeModule skipped = new ProbeModule("Skipped", artifact: true, drifted: true);
+                AlternateProbeModule unavailable = new AlternateProbeModule("Unavailable", artifact: true, drifted: true);
+                SnapshotEvent snapshot = Snapshot(backup.Path, Manifest(
+                    Entry(skipped, BackupManifest.StateSkipped)));
+                SnapshotPayloadPreparation preparation = new SnapshotPayloadPreparation(snapshot, null,
+                    "The selected payload is corrupt.");
+                List<ComparisonProgress> progress = new List<ComparisonProgress>();
+
+                IReadOnlyList<ModuleComparison> rows = await new SnapshotComparisonService().CompareAsync(
+                    preparation, new[] { (BackupBase)skipped, unavailable }, CancellationToken.None,
+                    new RecordingProgress(progress));
+                preparation.Dispose();
+
+                Assert.Collection(rows,
+                    row => Assert.Equal(ComparisonState.NotCaptured, row.State),
+                    row =>
+                    {
+                        Assert.Equal(ComparisonState.Unavailable, row.State);
+                        Assert.False(row.HasUsableArtifact);
+                        Assert.Equal("The selected payload is corrupt.", row.Reason);
+                    });
+                Assert.Equal(new[] { 0, 1 }, progress.Select(item => item.Ordinal));
+                Assert.Equal(0, skipped.ArtifactProbeCount + unavailable.ArtifactProbeCount);
+                Assert.Equal(0, skipped.DriftProbeCount + unavailable.DriftProbeCount);
+            }
+        }
+
+        [Fact]
+        public async Task CompareAsync_OneThrowingModule_DoesNotAbortLaterCatalogRows()
+        {
+            ProbeModule broken = new ProbeModule("Broken", artifact: true, drifted: null) { ThrowOnDrift = true };
+            ProbeModule same = new ProbeModule("Same", artifact: true, drifted: false);
+
+            IReadOnlyList<ModuleComparison> rows = await Compare(broken, same);
+
+            Assert.Collection(rows,
+                row => Assert.Equal(ComparisonState.Unavailable, row.State),
+                row => Assert.Equal(ComparisonState.Same, row.State));
+        }
+
+        [Fact]
+        public async Task CompareAsync_BoundsProbeConcurrencyAndReturnsCatalogOrder()
+        {
+            ConcurrentProbeModule.Reset();
+            ConcurrentProbeModule[] modules = Enumerable.Range(0, 9)
+                .Select(index => new ConcurrentProbeModule("Module " + index)).ToArray();
+
+            IReadOnlyList<ModuleComparison> rows = await Compare(modules);
+
+            Assert.True(ConcurrentProbeModule.MaximumObserved <= 4);
+            Assert.Equal(modules.Select(module => module.Title), rows.Select(row => row.Module.Title));
+        }
+
+        [Fact]
+        public async Task CompareAsync_CancellationWaitsForWorkersThenDeletesCompressedExtraction()
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            using (CancellationTokenSource cancellation = new CancellationTokenSource())
+            {
+                CreateCompressedBackupWithArtifact(backup.Path);
+                HashSet<string> payloadDirectoriesBefore = PayloadExtractionDirectories();
+                BlockingProbeModule module = new BlockingProbeModule("Blocking");
+                SnapshotComparisonService service = new SnapshotComparisonService();
+
+                try
+                {
+                    Task<IReadOnlyList<ModuleComparison>> task = service.CompareAsync(
+                        Snapshot(backup.Path, manifest: null), new[] { (BackupBase)module }, cancellation.Token);
+                    await module.Started.Task;
+                    cancellation.Cancel();
+                    module.Release.Set();
+
+                    await Assert.ThrowsAnyAsync<OperationCanceledException>(() => task);
+                    Assert.Empty(PayloadExtractionDirectories().Except(payloadDirectoriesBefore));
+                }
+                finally
+                {
+                    module.Release.Dispose();
+                }
+            }
+        }
+
+        [Fact]
+        public async Task CompareAsync_SuccessDisposesCompressedExtraction()
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                CreateCompressedBackupWithArtifact(backup.Path);
+                HashSet<string> payloadDirectoriesBefore = PayloadExtractionDirectories();
+
+                ModuleComparison row = Assert.Single(await new SnapshotComparisonService().CompareAsync(
+                    Snapshot(backup.Path, manifest: null),
+                    new[] { (BackupBase)new ProbeModule("Compressed", artifact: true, drifted: false) },
+                    CancellationToken.None));
+
+                Assert.Equal(ComparisonState.Same, row.State);
+                Assert.Empty(PayloadExtractionDirectories().Except(payloadDirectoriesBefore));
+            }
+        }
+
+        private static async Task<IReadOnlyList<ModuleComparison>> Compare(params BackupBase[] modules)
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                return await new SnapshotComparisonService().CompareAsync(
+                    Snapshot(backup.Path, manifest: null), modules, CancellationToken.None);
+            }
+        }
+
+        private static SnapshotEvent Snapshot(string path, ManifestData manifest)
+            => new SnapshotEvent(SnapshotEventKind.Verified, DateTime.UtcNow, "snapshot", path,
+                string.Empty, "TEST-PC", 0, true, manifest);
+
+        private static ManifestData Manifest(params ManifestModule[] modules)
+            => new ManifestData(BackupManifest.Version, "test", DateTime.UtcNow.ToString("O"), "TEST-PC",
+                "test-user", "test-os", modules);
+
+        private static ManifestModule Entry(BackupBase module, string state)
+            => new ManifestModule(module.GetType().Name, module.Title, state, "test reason");
+
+        private static ManifestModule EntryForDifferentModule()
+            => new ManifestModule("DifferentModule", "Different", BackupManifest.StateSucceeded, string.Empty);
+
+        private static void CreateCompressedBackupWithArtifact(string backupPath)
+        {
+            using (ZipArchive archive = ZipFile.Open(Path.Combine(backupPath, BackupPayload.FileName),
+                ZipArchiveMode.Create))
+            using (StreamWriter writer = new StreamWriter(archive.CreateEntry("artifact.txt").Open()))
+                writer.Write("captured");
+        }
+        private static HashSet<string> PayloadExtractionDirectories()
+        {
+            string root = Path.Combine(Path.GetTempPath(), "WinRestoreKit");
+            return !Directory.Exists(root)
+                ? new HashSet<string>(StringComparer.OrdinalIgnoreCase)
+                : Directory.EnumerateDirectories(root, "payload-*", SearchOption.TopDirectoryOnly)
+                    .ToHashSet(StringComparer.OrdinalIgnoreCase);
+        }
+
+
+        private class ProbeModule : BackupBase
+        {
+            private readonly bool? artifact;
+            private readonly bool? drifted;
+
+            internal ProbeModule(string title, bool? artifact, bool? drifted)
+            {
+                Title = title;
+                this.artifact = artifact;
+                this.drifted = drifted;
+            }
+
+            internal int ArtifactProbeCount { get; private set; }
+            internal int DriftProbeCount { get; private set; }
+            internal bool ThrowOnArtifact { get; set; }
+            internal bool ThrowOnDrift { get; set; }
+
+            public override bool? HasArtifactIn(string backupPath)
+            {
+                ArtifactProbeCount++;
+                if (ThrowOnArtifact)
+                    throw new IOException("artifact probe failed");
+                return artifact;
+            }
+
+            public override bool? HasDriftedFrom(string backupPath)
+            {
+                DriftProbeCount++;
+                if (ThrowOnDrift)
+                    throw new IOException("drift probe failed");
+                return drifted;
+            }
+        }
+        private sealed class AlternateProbeModule : ProbeModule
+        {
+            internal AlternateProbeModule(string title, bool? artifact, bool? drifted)
+                : base(title, artifact, drifted)
+            {
+            }
+        }
+
+
+        private sealed class ConcurrentProbeModule : ProbeModule
+        {
+            private static int active;
+            private static int maximumObserved;
+
+            internal ConcurrentProbeModule(string title)
+                : base(title, artifact: true, drifted: false)
+            {
+            }
+
+            internal static int MaximumObserved => Volatile.Read(ref maximumObserved);
+
+            internal static void Reset()
+            {
+                Interlocked.Exchange(ref active, 0);
+                Interlocked.Exchange(ref maximumObserved, 0);
+            }
+
+            public override bool? HasDriftedFrom(string backupPath)
+            {
+                int observed = Interlocked.Increment(ref active);
+                SetMaximum(observed);
+                try
+                {
+                    Thread.Sleep(50);
+                    return false;
+                }
+                finally
+                {
+                    Interlocked.Decrement(ref active);
+                }
+            }
+
+
+            private static void SetMaximum(int observed)
+            {
+                int current;
+                while ((current = Volatile.Read(ref maximumObserved)) < observed
+                    && Interlocked.CompareExchange(ref maximumObserved, observed, current) != current)
+                {
+                }
+            }
+        }
+        private sealed class RecordingProgress : IProgress<ComparisonProgress>
+        {
+            private readonly ICollection<ComparisonProgress> items;
+
+            internal RecordingProgress(ICollection<ComparisonProgress> items)
+            {
+                this.items = items;
+            }
+
+            public void Report(ComparisonProgress value)
+            {
+                items.Add(value);
+            }
+        }
+
+
+        private sealed class BlockingProbeModule : ProbeModule
+        {
+            internal BlockingProbeModule(string title)
+                : base(title, artifact: true, drifted: false)
+            {
+            }
+
+            internal TaskCompletionSource<object> Started { get; }
+                = new TaskCompletionSource<object>(TaskCreationOptions.RunContinuationsAsynchronously);
+
+            internal ManualResetEventSlim Release { get; } = new ManualResetEventSlim(false);
+
+            public override bool? HasDriftedFrom(string backupPath)
+            {
+                Started.TrySetResult(null);
+                Release.Wait();
+                return false;
+            }
+        }
+
+        private sealed class TestDirectory : IDisposable
+        {
+            private TestDirectory(string path)
+            {
+                Path = path;
+            }
+
+            internal string Path { get; }
+
+            internal static TestDirectory Create()
+            {
+                string path = System.IO.Path.Combine(System.IO.Path.GetTempPath(), "WinRestoreKitTests",
+                    Guid.NewGuid().ToString("N"));
+                return new TestDirectory(Directory.CreateDirectory(path).FullName);
+            }
+
+            public void Dispose()
+            {
+                if (Directory.Exists(Path))
+                    Directory.Delete(Path, true);
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/SnapshotEventCatalogTests.cs b/src/WinRestoreKit.Tests/SnapshotEventCatalogTests.cs
new file mode 100644
index 0000000..f939c43
--- /dev/null
+++ b/src/WinRestoreKit.Tests/SnapshotEventCatalogTests.cs
@@ -0,0 +1,257 @@
+using DataHelper;
+using Microsoft.Win32;
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class SnapshotEventCatalogTests
+    {
+        [Fact]
+        public void Read_OrdersSameTimestampByOrdinalCanonicalPath()
+        {
+            using (TestDirectory root = TestDirectory.Create())
+            {
+                WriteManifest(root.Create("zulu"), "2026-08-09T12:00:00.0000000Z", "succeeded");
+                WriteManifest(root.Create("alpha"), "2026-08-09T12:00:00.0000000Z", "succeeded");
+
+                UseBackupRoots(root.Path, () =>
+                {
+                    IReadOnlyList<SnapshotEvent> events = new SnapshotEventCatalog().Read();
+
+                    Assert.Equal(new[] { "alpha", "zulu" }, events.Select(snapshot => snapshot.DisplayName));
+                });
+            }
+        }
+
+        [Fact]
+        public void Read_ClassifiesFailedPartialAndUnreadableWithoutMakingThemRestorable()
+        {
+            using (TestDirectory root = TestDirectory.Create())
+            {
+                WriteManifest(root.Create("verified"), "2026-08-09T11:00:00.0000000Z", "succeeded");
+                WriteManifest(root.Create("partial"), "2026-08-09T10:00:00.0000000Z", "skipped");
+                WriteManifest(root.Create("failed"), "2026-08-09T09:00:00.0000000Z", "failed");
+                File.WriteAllText(Path.Combine(root.Create("broken"), BackupManifest.FileName), "not-json");
+
+                UseBackupRoots(root.Path, () =>
+                {
+                    SnapshotEvent[] events = new SnapshotEventCatalog().Read().ToArray();
+
+                    Assert.Equal(SnapshotEventKind.Verified, events.Single(snapshot => snapshot.DisplayName == "verified").Kind);
+                    Assert.Equal(SnapshotEventKind.Partial, events.Single(snapshot => snapshot.DisplayName == "partial").Kind);
+                    Assert.Equal(SnapshotEventKind.Failed, events.Single(snapshot => snapshot.DisplayName == "failed").Kind);
+                    SnapshotEvent unreadable = events.Single(snapshot => snapshot.DisplayName == "broken");
+                    Assert.Equal(SnapshotEventKind.Unreadable, unreadable.Kind);
+                    Assert.False(events.Single(snapshot => snapshot.DisplayName == "failed").IsRestorable);
+                    Assert.False(unreadable.IsRestorable);
+                    Assert.NotEmpty(unreadable.DiagnosticReason);
+                });
+            }
+        }
+
+        [Fact]
+        public void Read_EmptyManifestIsFailed()
+        {
+            using (TestDirectory root = TestDirectory.Create())
+            {
+                WriteManifest(root.Create("empty"), "2026-08-09T12:00:00.0000000Z");
+
+                UseBackupRoots(root.Path, () =>
+                {
+                    SnapshotEvent snapshot = Assert.Single(new SnapshotEventCatalog().Read());
+
+                    Assert.Equal(SnapshotEventKind.Failed, snapshot.Kind);
+                    Assert.False(snapshot.IsRestorable);
+                });
+            }
+        }
+
+        [Fact]
+        public void Read_ClassifiesMixedAndUnknownModulesAsPartial()
+        {
+            using (TestDirectory root = TestDirectory.Create())
+            {
+                WriteManifest(root.Create("skipped"), "2026-08-09T12:00:00.0000000Z", "succeeded", "skipped");
+                WriteManifest(root.Create("failed"), "2026-08-09T11:00:00.0000000Z", "succeeded", "failed");
+                WriteManifest(root.Create("unknown"), "2026-08-09T10:00:00.0000000Z", "succeeded", "unknown");
+
+                UseBackupRoots(root.Path, () =>
+                {
+                    Assert.All(new SnapshotEventCatalog().Read(), snapshot =>
+                    {
+                        Assert.Equal(SnapshotEventKind.Partial, snapshot.Kind);
+                        Assert.True(snapshot.IsRestorable);
+                    });
+                });
+            }
+        }
+
+        [Fact]
+        public void Read_ManifestSilentLegacyFolderIsPartial()
+        {
+            using (TestDirectory root = TestDirectory.Create())
+            {
+                root.Create("legacy");
+
+                UseBackupRoots(root.Path, () =>
+                {
+                    SnapshotEvent snapshot = Assert.Single(new SnapshotEventCatalog().Read());
+
+                    Assert.Equal(SnapshotEventKind.Partial, snapshot.Kind);
+                    Assert.True(snapshot.IsRestorable);
+                });
+            }
+        }
+
+        [Fact]
+        public void Read_UnreadableCustomRootRetainsActualErrorAlongsideReadableRoot()
+        {
+            using (TestDirectory parent = TestDirectory.Create())
+            {
+                string defaultRoot = parent.Create("default");
+                string backup = parent.Create(Path.Combine("default", "backup"));
+                string unreadableRoot = Path.Combine(parent.Path, "custom-root-file");
+                File.WriteAllText(unreadableRoot, "not a directory");
+                Exception expected = Record.Exception(() => Directory.GetDirectories(unreadableRoot));
+                Assert.NotNull(expected);
+
+                UseBackupRoots(defaultRoot, new[] { unreadableRoot }, () =>
+                {
+                    SnapshotEvent[] events = new SnapshotEventCatalog().Read().ToArray();
+
+                    Assert.Contains(events, snapshot => string.Equals(snapshot.CanonicalPath, backup,
+                        StringComparison.OrdinalIgnoreCase));
+                    SnapshotEvent unreadable = Assert.Single(events,
+                        snapshot => snapshot.Kind == SnapshotEventKind.Unreadable);
+                    Assert.Equal(expected.Message, unreadable.DiagnosticReason);
+                    Assert.False(unreadable.IsRestorable);
+                });
+            }
+        }
+
+        [Fact]
+        public void RecordSessionFailureExistsOnlyForCatalogLifetime()
+        {
+            using (TestDirectory root = TestDirectory.Create())
+            {
+                UseBackupRoots(root.Path, () =>
+                {
+                    SnapshotEventCatalog catalog = new SnapshotEventCatalog();
+                    catalog.RecordSessionFailure(new DateTime(2026, 8, 9, 12, 0, 0), "Failed run", "folder creation failed");
+
+                    SnapshotEvent recorded = Assert.Single(catalog.Read());
+                    Assert.Equal(SnapshotEventKind.Failed, recorded.Kind);
+                    Assert.Equal("session://failure/1", recorded.CanonicalPath);
+                    Assert.False(recorded.IsRestorable);
+
+                    Assert.Empty(new SnapshotEventCatalog().Read());
+                    Assert.Throws<ArgumentException>(() => catalog.RecordSessionFailure(DateTime.UtcNow, "", " "));
+                });
+            }
+        }
+
+        [Fact]
+        public void Read_ComputesCompleteFolderSize()
+        {
+            using (TestDirectory root = TestDirectory.Create())
+            {
+                string backup = root.Create("size");
+                File.WriteAllText(Path.Combine(backup, "one.txt"), "abc");
+                Directory.CreateDirectory(Path.Combine(backup, "nested"));
+                File.WriteAllText(Path.Combine(backup, "nested", "two.txt"), "de");
+
+                UseBackupRoots(root.Path, () =>
+                {
+                    SnapshotEvent snapshot = Assert.Single(new SnapshotEventCatalog().Read());
+
+                    Assert.Equal(5, snapshot.SizeBytes);
+                    Assert.True(snapshot.IsSizeComplete);
+                });
+            }
+        }
+
+        private static void WriteManifest(string folder, string created, params string[] states)
+        {
+            string modules = string.Join(",", states.Select(state =>
+                "{\"type\":\"TestModule\",\"title\":\"Test module\",\"state\":\"" + state
+                + "\",\"reason\":\"\"}"));
+            string manifest = "{\"manifest_version\":1,\"app_version\":\"0.0.1\",\"created\":\""
+                + created + "\",\"machine_name\":\"TEST-MACHINE\",\"user_name\":\"tester\",\"os_build\":\"test\",\"modules\":["
+                + modules + "]}";
+
+            File.WriteAllText(Path.Combine(folder, BackupManifest.FileName), manifest);
+        }
+
+        private static void UseBackupRoots(string defaultRoot, Action action)
+            => UseBackupRoots(defaultRoot, Array.Empty<string>(), action);
+
+        private static void UseBackupRoots(string defaultRoot, string[] customRoots, Action action)
+        {
+            string originalDefaultRoot = Data.DataRootDir;
+            object originalRoots = null;
+            RegistryValueKind? originalRootsKind = null;
+
+            try
+            {
+                using (RegistryKey key = Registry.CurrentUser.OpenSubKey(@"Software\WinRestoreKit"))
+                {
+                    if (key != null && key.GetValueNames().Contains("BackupRoots"))
+                    {
+                        originalRoots = key.GetValue("BackupRoots", null,
+                            RegistryValueOptions.DoNotExpandEnvironmentNames);
+                        originalRootsKind = key.GetValueKind("BackupRoots");
+                    }
+                }
+
+                Data.DataRootDir = defaultRoot;
+
+                using (RegistryKey key = Registry.CurrentUser.CreateSubKey(@"Software\WinRestoreKit"))
+                    key.SetValue("BackupRoots", customRoots, RegistryValueKind.MultiString);
+
+                action();
+            }
+            finally
+            {
+                Data.DataRootDir = originalDefaultRoot;
+
+                using (RegistryKey key = Registry.CurrentUser.CreateSubKey(@"Software\WinRestoreKit"))
+                {
+                    if (originalRoots == null)
+                        key.DeleteValue("BackupRoots", throwOnMissingValue: false);
+                    else
+                        key.SetValue("BackupRoots", originalRoots, originalRootsKind.Value);
+                }
+            }
+        }
+
+        private sealed class TestDirectory : IDisposable
+        {
+            private TestDirectory(string path)
+            {
+                Path = path;
+            }
+
+            internal string Path { get; }
+
+            internal static TestDirectory Create()
+            {
+                string path = System.IO.Path.Combine(System.IO.Path.GetTempPath(), "WinRestoreKitTests",
+                    Guid.NewGuid().ToString("N"));
+                return new TestDirectory(Directory.CreateDirectory(path).FullName);
+            }
+
+            internal string Create(string relativePath)
+                => Directory.CreateDirectory(System.IO.Path.Combine(Path, relativePath)).FullName;
+
+            public void Dispose()
+            {
+                if (Directory.Exists(Path))
+                    Directory.Delete(Path, true);
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/SnapshotFolderPathTests.cs b/src/WinRestoreKit.Tests/SnapshotFolderPathTests.cs
index 5c35da9..3c42695 100644
--- a/src/WinRestoreKit.Tests/SnapshotFolderPathTests.cs
+++ b/src/WinRestoreKit.Tests/SnapshotFolderPathTests.cs
@@ -5,7 +5,6 @@
 using System.IO;
 using System.Linq;
 using System.Threading.Tasks;
-using System.Windows.Forms;
 using Views;
 using Xunit;
 
@@ -39,7 +38,8 @@ public async Task RunBackup_CustomSnapshotNameKeepsTheFrozenTimestampFolderName(
                 await runner.RunBackup(new BackupBase[] { new EmptyModule() }, root, "before-driver-update",
                     SnapshotCompression.None);
 
-                string timestampFolder = Path.Combine(root, Data.NowShort);
+                string timestampFolder = runner.BackupOutputPath;
+                Assert.Equal(Path.Combine(root, Data.NowShort), timestampFolder);
                 Assert.True(Directory.Exists(timestampFolder));
                 Assert.False(Directory.Exists(Path.Combine(root, "before-driver-update")));
 
@@ -91,7 +91,7 @@ public async Task RunBackup_ToCustomDestinationMakesSnapshotDiscoverable()
                 await runner.RunBackup(new BackupBase[] { new EmptyModule() }, root, "custom-root",
                     SnapshotCompression.None);
 
-                string timestampFolder = Path.Combine(root, Data.NowShort);
+                string timestampFolder = runner.BackupOutputPath;
                 BackupFolders folders = BackupFolders.Read();
 
                 Assert.Contains(folders.Backups, folder =>
@@ -122,7 +122,7 @@ internal EmptyModule()
 
         private sealed class TestRunUi : IRunUi
         {
-            public IWin32Window Owner => null;
+            public object DialogOwner => null;
 
             public void SetProgressText(string text) { }
             public void SetProgressPercent(int percent) { }
diff --git a/src/WinRestoreKit.Tests/SnapshotGateConsentTests.cs b/src/WinRestoreKit.Tests/SnapshotGateConsentTests.cs
new file mode 100644
index 0000000..8a9fe4e
--- /dev/null
+++ b/src/WinRestoreKit.Tests/SnapshotGateConsentTests.cs
@@ -0,0 +1,48 @@
+using System.Collections.Generic;
+using WinRestoreKit;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    /// <summary>
+    /// Regression coverage for the second consent required when a pre-restore snapshot cannot undo
+    /// every write the selected restore may make.
+    /// </summary>
+    public class SnapshotGateConsentTests
+    {
+        private static ModuleResult Captured()
+            => ModuleResult.Aggregate(new[] { StepResult.Succeeded("test", "captured") });
+
+        private static ModuleResult NotCaptured()
+            => ModuleResult.Aggregate(new[] { StepResult.Skipped("test", "live state was absent") });
+
+        [Fact]
+        public void Evaluate_PartiallyCapturedSnapshot_RequiresOverrideConsentBeforeRestore()
+        {
+            SnapshotDecision decision = SnapshotGate.Evaluate(new List<ModuleOutcome>
+            {
+                new ModuleOutcome("Captured module", Captured()),
+                new ModuleOutcome("Absent live module", NotCaptured())
+            });
+
+            Assert.Equal(SnapshotVerdict.PartiallyCaptured, decision.Verdict);
+            Assert.True(decision.RequiresOverride);
+            Assert.Contains("cannot be undone", decision.Describe());
+            Assert.Contains("Absent live module", decision.Describe());
+        }
+
+        [Fact]
+        public void Evaluate_EmptyButConsideredSnapshot_RequiresOverrideConsentBeforeRestore()
+        {
+            SnapshotDecision decision = SnapshotGate.Evaluate(new List<ModuleOutcome>
+            {
+                new ModuleOutcome("Absent live module", NotCaptured())
+            });
+
+            Assert.Equal(SnapshotVerdict.NothingCaptured, decision.Verdict);
+            Assert.True(decision.RequiresOverride);
+            Assert.Contains("captured nothing", decision.Describe());
+            Assert.Contains("Absent live module", decision.Describe());
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/SnapshotPayloadPreparationServiceTests.cs b/src/WinRestoreKit.Tests/SnapshotPayloadPreparationServiceTests.cs
new file mode 100644
index 0000000..d0653a3
--- /dev/null
+++ b/src/WinRestoreKit.Tests/SnapshotPayloadPreparationServiceTests.cs
@@ -0,0 +1,132 @@
+using System;
+using System.IO;
+using System.IO.Compression;
+using System.Threading;
+using System.Threading.Tasks;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class SnapshotPayloadPreparationServiceTests
+    {
+        [Fact]
+        public async Task PrepareAsync_CompressedSnapshotDeletesPrivateExtractionWhenDisposed()
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                CreateCompressedPayload(backup.Path, "registry/mouse.reg", "Windows Registry Editor Version 5.00");
+                SnapshotEvent snapshot = NewEvent(SnapshotEventKind.Verified, backup.Path);
+                SnapshotPayloadPreparationService service = new SnapshotPayloadPreparationService();
+
+                SnapshotPayloadPreparation prepared = await service.PrepareAsync(snapshot, CancellationToken.None);
+                string extractedPath = prepared.Path;
+
+                Assert.True(prepared.IsPrepared);
+                Assert.True(File.Exists(Path.Combine(extractedPath, "registry", "mouse.reg")));
+                prepared.Dispose();
+                Assert.False(Directory.Exists(extractedPath));
+                prepared.Dispose();
+            }
+        }
+
+        [Fact]
+        public async Task PrepareAsync_LooseSnapshotKeepsBackupPathAndDoesNotOwnIt()
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                SnapshotPayloadPreparation prepared = await new SnapshotPayloadPreparationService().PrepareAsync(
+                    NewEvent(SnapshotEventKind.Partial, backup.Path), CancellationToken.None);
+
+                Assert.True(prepared.IsPrepared);
+                Assert.Equal(backup.Path, prepared.Path);
+                prepared.Dispose();
+                Assert.True(Directory.Exists(backup.Path));
+            }
+        }
+
+        [Fact]
+        public async Task PrepareAsync_CorruptArchiveReturnsCoreDiagnosticWithoutScope()
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                File.WriteAllText(Path.Combine(backup.Path, BackupPayload.FileName), "not a zip archive");
+
+                SnapshotPayloadPreparation prepared = await new SnapshotPayloadPreparationService().PrepareAsync(
+                    NewEvent(SnapshotEventKind.Verified, backup.Path), CancellationToken.None);
+
+                Assert.False(prepared.IsPrepared);
+                Assert.Null(prepared.Path);
+                Assert.Contains("could not be prepared", prepared.Error, StringComparison.OrdinalIgnoreCase);
+                Assert.NotEmpty(prepared.Error);
+            }
+        }
+
+        [Fact]
+        public async Task PrepareAsync_CancellationBeforeExtractionDoesNotOpenPayload()
+        {
+            using (TestDirectory backup = TestDirectory.Create())
+            {
+                CreateCompressedPayload(backup.Path, "registry/mouse.reg", "payload");
+                using (CancellationTokenSource cancellation = new CancellationTokenSource())
+                {
+                    cancellation.Cancel();
+
+                    await Assert.ThrowsAnyAsync<OperationCanceledException>(() =>
+                        new SnapshotPayloadPreparationService().PrepareAsync(
+                            NewEvent(SnapshotEventKind.Verified, backup.Path), cancellation.Token));
+                }
+            }
+        }
+
+        [Fact]
+        public async Task PrepareAsync_FailedSnapshotReturnsDiagnosticWithoutOpeningPayload()
+        {
+            SnapshotPayloadPreparation prepared = await new SnapshotPayloadPreparationService().PrepareAsync(
+                NewEvent(SnapshotEventKind.Failed, @"C:\retained-failure"), CancellationToken.None);
+
+            Assert.False(prepared.IsPrepared);
+            Assert.Contains("cannot be selected", prepared.Error, StringComparison.OrdinalIgnoreCase);
+            Assert.Null(prepared.Path);
+        }
+
+        [Fact]
+        public async Task PrepareAsync_NullSnapshotThrows()
+        {
+            await Assert.ThrowsAsync<ArgumentNullException>(() =>
+                new SnapshotPayloadPreparationService().PrepareAsync(null, CancellationToken.None));
+        }
+
+        private static SnapshotEvent NewEvent(SnapshotEventKind kind, string path)
+            => new SnapshotEvent(kind, DateTime.UtcNow, "snapshot", path, string.Empty, string.Empty, 0, true, null);
+
+        private static void CreateCompressedPayload(string root, string entryName, string contents)
+        {
+            using (ZipArchive archive = ZipFile.Open(Path.Combine(root, BackupPayload.FileName), ZipArchiveMode.Create))
+            using (StreamWriter writer = new StreamWriter(archive.CreateEntry(entryName).Open()))
+                writer.Write(contents);
+        }
+
+        private sealed class TestDirectory : IDisposable
+        {
+            private TestDirectory(string path)
+            {
+                Path = path;
+            }
+
+            internal string Path { get; }
+
+            internal static TestDirectory Create()
+            {
+                string path = System.IO.Path.Combine(System.IO.Path.GetTempPath(), "WinRestoreKitTests",
+                    Guid.NewGuid().ToString("N"));
+                return new TestDirectory(Directory.CreateDirectory(path).FullName);
+            }
+
+            public void Dispose()
+            {
+                if (Directory.Exists(Path))
+                    Directory.Delete(Path, true);
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/SnapshotTests.cs b/src/WinRestoreKit.Tests/SnapshotTests.cs
index 02cdc39..4f9c490 100644
--- a/src/WinRestoreKit.Tests/SnapshotTests.cs
+++ b/src/WinRestoreKit.Tests/SnapshotTests.cs
@@ -192,13 +192,13 @@ public void Gate_ModuleWithNoResult_CountsAsAFailure()
         }
 
         [Fact]
-        public void Gate_AllSkipped_ProceedsButSaysNothingWasCaptured()
+        public void Gate_AllSkipped_RequiresOverrideAndSaysNothingWasCaptured()
         {
             SnapshotDecision d = SnapshotGate.Evaluate(Outcomes(
                 new ModuleOutcome("Mouse", Skipped()),
                 new ModuleOutcome("Touchpad", Skipped())));
 
-            Assert.False(d.RequiresOverride);
+            Assert.True(d.RequiresOverride);
             Assert.Equal(SnapshotVerdict.NothingCaptured, d.Verdict);
             Assert.Contains("captured nothing", d.Summary);
 
@@ -243,19 +243,17 @@ public void Gate_AllSucceeded_Proceeds()
             Assert.Contains("2", d.Summary);
         }
 
-        // Rule 4's shape on the snapshot side: some captured, some legitimately absent. Nothing
-        // failed, so demanding an override here would be the cry-wolf direction - but it is not
-        // Complete either, and it must name what it did not capture. A skipped module is one the
-        // restore is about to overwrite with no fallback for it, and this branch previously dropped
-        // it silently and then reported the run as complete.
+        // Rule 4's shape on the snapshot side: some captured, some legitimately absent. The
+        // absence means a restore would write without a fallback, so the user must explicitly
+        // accept that gap. It is not Complete and it must name what it did not capture.
         [Fact]
-        public void Gate_SucceededPlusSkipped_ProceedsButDoesNotClaimCompleteness()
+        public void Gate_SucceededPlusSkipped_RequiresOverrideButDoesNotClaimCompleteness()
         {
             SnapshotDecision d = SnapshotGate.Evaluate(Outcomes(
                 new ModuleOutcome("Mouse", Ok()),
                 new ModuleOutcome("Gaming", Skipped())));
 
-            Assert.False(d.RequiresOverride);
+            Assert.True(d.RequiresOverride);
             Assert.Equal(SnapshotVerdict.PartiallyCaptured, d.Verdict);
 
             // Named, not merely counted: the user has to know WHICH item has no fallback.
diff --git a/src/WinRestoreKit.Tests/ThemeServiceTests.cs b/src/WinRestoreKit.Tests/ThemeServiceTests.cs
new file mode 100644
index 0000000..65ee88d
--- /dev/null
+++ b/src/WinRestoreKit.Tests/ThemeServiceTests.cs
@@ -0,0 +1,49 @@
+using System;
+using System.Windows;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Services;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public class ThemeServiceTests
+    {
+        [Fact]
+        public void WpfThemeService_UsesSystemDarkOnlyWhenModeFollowsSystem()
+        {
+            WpfTestHost.Run(() =>
+            {
+                ResourceDictionary resources = new ResourceDictionary();
+                FakeThemeSettings settings = new FakeThemeSettings(ThemeMode.FollowSystem);
+                using (WpfThemeService service = new WpfThemeService(resources, settings,
+                           new FakeSystemThemeDetector(isDark: true)))
+                {
+                    Assert.Equal(ThemeMode.Dark, service.EffectiveMode);
+                    service.SetMode(ThemeMode.Light);
+                    Assert.Equal(ThemeMode.Light, service.EffectiveMode);
+                    Assert.Equal(ThemeMode.Light, settings.ReadThemeMode());
+                }
+            });
+        }
+
+        private sealed class FakeThemeSettings : IThemeSettings
+        {
+            private ThemeMode mode;
+
+            internal FakeThemeSettings(ThemeMode mode) => this.mode = mode;
+
+            public ThemeMode ReadThemeMode() => mode;
+
+            public void WriteThemeMode(ThemeMode mode) => this.mode = mode;
+        }
+
+        private sealed class FakeSystemThemeDetector : ISystemThemeDetector
+        {
+            private readonly bool isDark;
+
+            internal FakeSystemThemeDetector(bool isDark) => this.isDark = isDark;
+
+            public bool IsDarkAppsTheme() => isDark;
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/ThemeSettingsTests.cs b/src/WinRestoreKit.Tests/ThemeSettingsTests.cs
new file mode 100644
index 0000000..42341e1
--- /dev/null
+++ b/src/WinRestoreKit.Tests/ThemeSettingsTests.cs
@@ -0,0 +1,31 @@
+using System;
+using Microsoft.Win32;
+using WinRestoreKit;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public class ThemeSettingsTests
+    {
+        [Fact]
+        public void RegistryThemeSettings_RoundTripsLightDarkAndFollowSystem()
+        {
+            string keyPath = @"Software\WinRestoreKit.Tests\" + Guid.NewGuid().ToString("N");
+            try
+            {
+                IThemeSettings settings = new RegistryThemeSettings(keyPath);
+
+                settings.WriteThemeMode(ThemeMode.Dark);
+                Assert.Equal(ThemeMode.Dark, settings.ReadThemeMode());
+                settings.WriteThemeMode(ThemeMode.Light);
+                Assert.Equal(ThemeMode.Light, settings.ReadThemeMode());
+                settings.WriteThemeMode(ThemeMode.FollowSystem);
+                Assert.Equal(ThemeMode.FollowSystem, settings.ReadThemeMode());
+            }
+            finally
+            {
+                Registry.CurrentUser.DeleteSubKeyTree(keyPath, false);
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/TimelineAccessibilityTests.cs b/src/WinRestoreKit.Tests/TimelineAccessibilityTests.cs
new file mode 100644
index 0000000..3f3f347
--- /dev/null
+++ b/src/WinRestoreKit.Tests/TimelineAccessibilityTests.cs
@@ -0,0 +1,166 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Automation;
+using System.Windows.Controls;
+using System.Windows.Input;
+using System.Windows.Media;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Navigation;
+using WinRestoreKit.Wpf.ViewModels.Timeline;
+using WinRestoreKit.Wpf.Views;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class TimelineAccessibilityTests
+    {
+        [Fact]
+        public void TimelineView_ExposesEquivalentNamedListAndKeyboardSelection()
+        {
+            WpfTestHost.Run(() =>
+            {
+                FakePreparationService service = new FakePreparationService();
+                TimelineViewModel viewModel = NewTimelineViewModel(service);
+                TimelineView view = new TimelineView { DataContext = viewModel };
+                Window host = new Window { Content = view, Width = 1024, Height = 720 };
+
+                host.Show();
+                try
+                {
+                    Layout(view);
+
+                    ListBox list = Assert.IsType<ListBox>(view.FindName("TimelineEventList"));
+                    Assert.Equal("Snapshots", AutomationProperties.GetName(list));
+                    Assert.Equal(SelectionMode.Single, list.SelectionMode);
+                    Assert.Equal(KeyboardNavigationMode.Continue, KeyboardNavigation.GetDirectionalNavigation(list));
+                    Assert.Contains("Enter", AutomationProperties.GetHelpText(list));
+                    list.SelectedIndex = 0;
+                    RaiseKey(list, Key.Right);
+                    Assert.Equal(1, list.SelectedIndex);
+                    RaiseKey(list, Key.Left);
+                    Assert.Equal(0, list.SelectedIndex);
+                    RaiseKey(list, Key.Enter);
+                    Assert.Equal(1, service.Calls);
+                }
+                finally
+                {
+                    host.Close();
+                }
+            });
+        }
+
+        [Fact]
+        public void TimelineView_ExposesEveryRowStateAndSelectionFailureAsAccessibleText()
+        {
+            WpfTestHost.Run(() =>
+            {
+                TimelineViewModel viewModel = NewTimelineViewModel();
+                TimelineView view = new TimelineView { DataContext = viewModel };
+                Window host = new Window { Content = view, Width = 1024, Height = 720 };
+
+                host.Show();
+                try
+                {
+                    Layout(view);
+
+                    ListBox list = Assert.IsType<ListBox>(view.FindName("TimelineEventList"));
+                    for (int index = 0; index < list.Items.Count; index++)
+                    {
+                        FrameworkElement row = FindElementWithAutomationName(
+                            list.ItemContainerGenerator.ContainerFromIndex(index), viewModel.Events[index].AutomationName);
+                        Assert.NotNull(row);
+                    }
+
+                    TextBlock selectionError = Assert.IsType<TextBlock>(view.FindName("SelectionErrorText"));
+                    Assert.Equal(AutomationLiveSetting.Polite, AutomationProperties.GetLiveSetting(selectionError));
+                }
+                finally
+                {
+                    host.Close();
+                }
+            });
+        }
+
+        private static TimelineViewModel NewTimelineViewModel(FakePreparationService service = null)
+        {
+            SnapshotEvent verified = NewEvent(SnapshotEventKind.Verified, @"C:\timeline\verified", "TEST-PC");
+            SnapshotEvent failed = NewEvent(SnapshotEventKind.Failed, @"C:\timeline\failed", "TEST-PC", "disk full");
+            TimelineViewModel viewModel = new TimelineViewModel(
+                new FakeCatalog(verified, failed), service ?? new FakePreparationService(), new RecordingNavigator());
+            viewModel.RefreshAsync().GetAwaiter().GetResult();
+            return viewModel;
+        }
+
+        private static SnapshotEvent NewEvent(SnapshotEventKind kind, string path, string machine, string reason = null)
+            => new SnapshotEvent(kind, new DateTime(2026, 8, 9, 12, 0, 0, DateTimeKind.Local),
+                Path.GetFileName(path), Path.GetFullPath(path), reason, machine, 0, true, null);
+
+        private static void RaiseKey(UIElement target, Key key)
+        {
+            PresentationSource inputSource = PresentationSource.FromVisual(target);
+            Assert.NotNull(inputSource);
+            target.RaiseEvent(new KeyEventArgs(Keyboard.PrimaryDevice, inputSource, 0, key)
+            {
+                RoutedEvent = Keyboard.PreviewKeyDownEvent
+            });
+        }
+
+        private static void Layout(FrameworkElement element)
+        {
+            element.Measure(new Size(1024, 720));
+            element.Arrange(new Rect(0, 0, 1024, 720));
+            element.UpdateLayout();
+        }
+
+        private static FrameworkElement FindElementWithAutomationName(DependencyObject root, string expectedName)
+        {
+            if (root is FrameworkElement element && AutomationProperties.GetName(element) == expectedName)
+                return element;
+
+            if (root == null)
+                return null;
+
+            for (int index = 0; index < VisualTreeHelper.GetChildrenCount(root); index++)
+            {
+                FrameworkElement found = FindElementWithAutomationName(
+                    VisualTreeHelper.GetChild(root, index), expectedName);
+                if (found != null)
+                    return found;
+            }
+
+            return null;
+        }
+
+        private sealed class FakeCatalog : ISnapshotEventReader
+        {
+            private readonly IReadOnlyList<SnapshotEvent> events;
+
+            internal FakeCatalog(params SnapshotEvent[] events) => this.events = events;
+
+            public IReadOnlyList<SnapshotEvent> Read() => events;
+        }
+
+        private sealed class FakePreparationService : ISnapshotPayloadPreparationService
+        {
+            internal int Calls { get; private set; }
+
+            public Task<SnapshotPayloadPreparation> PrepareAsync(SnapshotEvent snapshot,
+                CancellationToken cancellationToken)
+            {
+                Calls++;
+                return Task.FromResult(new SnapshotPayloadPreparation(snapshot, null, "unexpected preparation"));
+            }
+        }
+
+        private sealed class RecordingNavigator : ITimelineNavigator
+        {
+            public void OpenCompare(SnapshotPayloadPreparation preparation) => preparation.Dispose();
+
+            public void ShowSnapshotDiagnostic(SnapshotEvent snapshot) { }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/TimelineViewModelTests.cs b/src/WinRestoreKit.Tests/TimelineViewModelTests.cs
new file mode 100644
index 0000000..4156f3e
--- /dev/null
+++ b/src/WinRestoreKit.Tests/TimelineViewModelTests.cs
@@ -0,0 +1,119 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Navigation;
+using WinRestoreKit.Wpf.ViewModels.Snapshots;
+using WinRestoreKit.Wpf.ViewModels.Timeline;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class TimelineViewModelTests
+    {
+        [Fact]
+        public async Task OpenSelectedAsync_PreparesPartialAndTransfersOwnershipToNavigator()
+        {
+            SnapshotEvent partial = NewEvent(SnapshotEventKind.Partial, @"C:\snapshot");
+            RecordingNavigator navigator = new RecordingNavigator();
+            TimelineViewModel viewModel = new TimelineViewModel(
+                new FakeCatalog(partial), new FakePreparationService(partial), navigator);
+
+            await viewModel.RefreshAsync();
+            viewModel.SelectedEvent = Assert.Single(viewModel.Events);
+            await viewModel.OpenSelectedAsync();
+
+            Assert.Same(partial, navigator.Prepared.Snapshot);
+            Assert.Null(navigator.Diagnostic);
+            navigator.Prepared.Dispose();
+        }
+
+        [Fact]
+        public async Task OpenSelectedAsync_ShowsFailedEvidenceWithoutPreparingPayload()
+        {
+            SnapshotEvent failed = NewEvent(SnapshotEventKind.Failed, @"C:\failed", "disk full");
+            FakePreparationService service = new FakePreparationService();
+            RecordingNavigator navigator = new RecordingNavigator();
+            TimelineViewModel viewModel = new TimelineViewModel(new FakeCatalog(failed), service, navigator);
+
+            await viewModel.RefreshAsync();
+            viewModel.SelectedEvent = Assert.Single(viewModel.Events);
+            await viewModel.OpenSelectedAsync();
+
+            Assert.Same(failed, navigator.Diagnostic);
+            Assert.Equal(0, service.Calls);
+        }
+
+        [Fact]
+        public async Task OpenSelectedAsync_ReportsPreparationFailureInline()
+        {
+            SnapshotEvent verified = NewEvent(SnapshotEventKind.Verified, @"C:\verified");
+            TimelineViewModel viewModel = new TimelineViewModel(
+                new FakeCatalog(verified), new FakePreparationService(), new RecordingNavigator());
+
+            await viewModel.RefreshAsync();
+            viewModel.SelectedEvent = Assert.Single(viewModel.Events);
+            await viewModel.OpenSelectedAsync();
+
+            Assert.True(viewModel.HasSelectionError);
+            Assert.Equal("unexpected preparation", viewModel.SelectionError);
+        }
+
+        [Theory]
+        [InlineData(SnapshotEventKind.Verified, "Verified", false)]
+        [InlineData(SnapshotEventKind.Partial, "Partial snapshot", false)]
+        [InlineData(SnapshotEventKind.Failed, "Backup failed", true)]
+        [InlineData(SnapshotEventKind.Unreadable, "Details unavailable", true)]
+        public void SnapshotEventViewModel_MapsEveryKindToItsStableStatus(
+            SnapshotEventKind kind, string label, bool isDiagnosticOnly)
+        {
+            SnapshotEventViewModel viewModel = new SnapshotEventViewModel(NewEvent(kind, @"C:\status", "details"));
+
+            Assert.Equal(label, viewModel.Status.Label);
+            Assert.Equal(isDiagnosticOnly, viewModel.Status.IsDiagnosticOnly);
+        }
+
+        private static SnapshotEvent NewEvent(SnapshotEventKind kind, string path, string reason = null)
+            => new SnapshotEvent(kind, new DateTime(2026, 8, 9, 12, 0, 0, DateTimeKind.Local),
+                Path.GetFileName(path), Path.GetFullPath(path), reason, "TEST-PC", 0, true, null);
+
+        private sealed class FakeCatalog : ISnapshotEventReader
+        {
+            private readonly IReadOnlyList<SnapshotEvent> events;
+
+            internal FakeCatalog(params SnapshotEvent[] events) => this.events = events;
+
+            public IReadOnlyList<SnapshotEvent> Read() => events;
+        }
+
+        private sealed class FakePreparationService : ISnapshotPayloadPreparationService
+        {
+            private readonly SnapshotEvent preparedEvent;
+
+            internal FakePreparationService(SnapshotEvent preparedEvent = null) => this.preparedEvent = preparedEvent;
+
+            internal int Calls { get; private set; }
+
+            public Task<SnapshotPayloadPreparation> PrepareAsync(SnapshotEvent snapshot,
+                CancellationToken cancellationToken)
+            {
+                Calls++;
+                return Task.FromResult(new SnapshotPayloadPreparation(
+                    preparedEvent ?? snapshot, null, preparedEvent == null ? "unexpected preparation" : null));
+            }
+        }
+
+        private sealed class RecordingNavigator : ITimelineNavigator
+        {
+            internal SnapshotPayloadPreparation Prepared { get; private set; }
+
+            internal SnapshotEvent Diagnostic { get; private set; }
+
+            public void OpenCompare(SnapshotPayloadPreparation preparation) => Prepared = preparation;
+
+            public void ShowSnapshotDiagnostic(SnapshotEvent snapshot) => Diagnostic = snapshot;
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/TimelineWpfSmokeTests.cs b/src/WinRestoreKit.Tests/TimelineWpfSmokeTests.cs
new file mode 100644
index 0000000..eae3eb2
--- /dev/null
+++ b/src/WinRestoreKit.Tests/TimelineWpfSmokeTests.cs
@@ -0,0 +1,99 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Controls;
+using System.Windows.Media;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Navigation;
+using WinRestoreKit.Wpf.ViewModels.Timeline;
+using WinRestoreKit.Wpf.Views;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class TimelineWpfSmokeTests
+    {
+        [Fact]
+        public void TimelineView_LoadsSelectionAndTransfersPreparedSnapshot()
+        {
+            WpfTestHost.Run(() =>
+            {
+                RecordingNavigator navigator = new RecordingNavigator();
+                SnapshotEvent snapshot = NewEvent(SnapshotEventKind.Verified, @"C:\timeline-smoke");
+                TimelineViewModel viewModel = new TimelineViewModel(
+                    new FakeCatalog(snapshot), new FakePreparationService(snapshot), navigator);
+                TimelineView view = new TimelineView { DataContext = viewModel };
+                Window host = new Window { Content = view, Width = 1024, Height = 720 };
+
+                host.Show();
+                try
+                {
+                    viewModel.RefreshAsync().GetAwaiter().GetResult();
+                    ListBox list = FindDescendant<ListBox>(view);
+                    Assert.NotNull(list);
+                    list.SelectedIndex = 0;
+                    viewModel.OpenSelectedAsync().GetAwaiter().GetResult();
+
+                    Assert.NotNull(navigator.Prepared);
+                    Assert.Equal(SnapshotEventKind.Verified, navigator.Prepared.Snapshot.Kind);
+                }
+                finally
+                {
+                    navigator.Prepared?.Dispose();
+                    host.Close();
+                }
+            });
+        }
+
+        private static SnapshotEvent NewEvent(SnapshotEventKind kind, string path)
+            => new SnapshotEvent(kind, new DateTime(2026, 8, 9, 12, 0, 0, DateTimeKind.Local),
+                Path.GetFileName(path), Path.GetFullPath(path), null, "TEST-PC", 0, true, null);
+
+        private static T FindDescendant<T>(DependencyObject root) where T : DependencyObject
+        {
+            if (root is T matched)
+                return matched;
+
+            for (int index = 0; index < VisualTreeHelper.GetChildrenCount(root); index++)
+            {
+                T found = FindDescendant<T>(VisualTreeHelper.GetChild(root, index));
+                if (found != null)
+                    return found;
+            }
+
+            return null;
+        }
+
+        private sealed class FakeCatalog : ISnapshotEventReader
+        {
+            private readonly IReadOnlyList<SnapshotEvent> events;
+
+            internal FakeCatalog(params SnapshotEvent[] events) => this.events = events;
+
+            public IReadOnlyList<SnapshotEvent> Read() => events;
+        }
+
+        private sealed class FakePreparationService : ISnapshotPayloadPreparationService
+        {
+            private readonly SnapshotEvent preparedEvent;
+
+            internal FakePreparationService(SnapshotEvent preparedEvent) => this.preparedEvent = preparedEvent;
+
+            public Task<SnapshotPayloadPreparation> PrepareAsync(SnapshotEvent snapshot,
+                CancellationToken cancellationToken)
+                => Task.FromResult(new SnapshotPayloadPreparation(preparedEvent, null, null));
+        }
+
+        private sealed class RecordingNavigator : ITimelineNavigator
+        {
+            internal SnapshotPayloadPreparation Prepared { get; private set; }
+
+            public void OpenCompare(SnapshotPayloadPreparation preparation) => Prepared = preparation;
+
+            public void ShowSnapshotDiagnostic(SnapshotEvent snapshot) { }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/UpdateCheckVerdictTests.cs b/src/WinRestoreKit.Tests/UpdateCheckVerdictTests.cs
new file mode 100644
index 0000000..cf64e23
--- /dev/null
+++ b/src/WinRestoreKit.Tests/UpdateCheckVerdictTests.cs
@@ -0,0 +1,51 @@
+using WinRestoreKit;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public class UpdateCheckVerdictTests
+    {
+        [Fact]
+        public void Decide_ReturnsWarningVerdictWhenInstalledVersionIsUnknown()
+        {
+            UpdateVerdict verdict = UpdateCheckService.Decide(VersionInfo.UnknownVersion, "1.2.3");
+
+            Assert.Equal(UpdateVerdict.CannotDetermineCurrentVersion, verdict);
+            Assert.NotEqual(UpdateVerdict.UpdateAvailable, verdict);
+        }
+
+        [Fact]
+        public void Decide_ReturnsUpToDateWhenVersionsMatch()
+        {
+            UpdateVerdict verdict = UpdateCheckService.Decide("1.2.3", "1.2.3");
+
+            Assert.Equal(UpdateVerdict.UpToDate, verdict);
+        }
+
+        [Theory]
+        [InlineData("1.2.2", "1.2.3", true)]
+        [InlineData("1.2.4", "1.2.3", false)]
+        public void Decide_ComparesInstalledAndLatestVersions(string currentVersion, string latestTag,
+                                                               bool updateAvailable)
+        {
+            UpdateVerdict verdict = UpdateCheckService.Decide(currentVersion, latestTag);
+
+            Assert.Equal(updateAvailable ? UpdateVerdict.UpdateAvailable : UpdateVerdict.UpToDate, verdict);
+        }
+
+        [Fact]
+        public void UpdateCheckResult_PreservesTheNeutralErrorMessage()
+        {
+            UpdateCheckResult result = new UpdateCheckResult(
+                UpdateVerdict.LatestVersionUnreadable,
+                "1.2.3",
+                null,
+                "network unavailable");
+
+            Assert.Equal(UpdateVerdict.LatestVersionUnreadable, result.Verdict);
+            Assert.Equal("1.2.3", result.CurrentVersion);
+            Assert.Null(result.LatestVersion);
+            Assert.Equal("network unavailable", result.ErrorMessage);
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/VersionParsingTests.cs b/src/WinRestoreKit.Tests/VersionParsingTests.cs
index 157b3ba..5b7fb39 100644
--- a/src/WinRestoreKit.Tests/VersionParsingTests.cs
+++ b/src/WinRestoreKit.Tests/VersionParsingTests.cs
@@ -68,12 +68,13 @@ public void ParseLatestVersion_OnRealAssemblyInfo_MatchesCompiledAssemblyFileVer
         }
 
         [Fact]
-        public void ParseLatestVersion_OnRealAssemblyInfo_AgreesWithGetCurrentVersionTostring()
+        public void ParseLatestVersion_OnRealAssemblyInfo_AgreesWithGetCurrentVersion()
         {
-            // THE load-bearing invariant. CheckForUpdatesAsync compares these two values with ==; if they
-            // can differ for an up-to-date client, the app reports a phantom update forever.
+            // The fallback-version invariant. UpdateCheckService.Decide normalizes and compares both
+            // sides, so a difference for an up-to-date client must never become a phantom update offer.
             string remoteSide = global::DataHelper.Data.ParseLatestVersion(RealAssemblyInfoText());
-            string localSide = global::WinRestoreKit.Program.GetCurrentVersionTostring();
+            string localSide = global::WinRestoreKit.VersionInfo.GetCurrentVersion(
+                typeof(global::WinRestoreKit.MainForm).Assembly);
 
             Assert.Equal(localSide, remoteSide);
         }
@@ -157,8 +158,8 @@ public void ParseLatestVersion_SpacesInsideParentheses_LeaksTheQuoteCharacters()
         [Fact]
         public void ParseLatestVersion_NoMatchingLine_ReturnsEmptyString()
         {
-            // Empty string - not null, and no throw. CheckForUpdatesAsync then compares "" against the
-            // current version, finds them unequal, and offers a bogus update. Documented, not fixed.
+            // Empty string - not null, and no throw. UpdateCheckService.Decide classifies it as
+            // LatestVersionUnreadable and shows no download offer.
             string text = "using System;\n[assembly: AssemblyVersion(\"1.2.3\")]\n";
 
             Assert.Equal(string.Empty, global::DataHelper.Data.ParseLatestVersion(text));
@@ -174,8 +175,8 @@ public void ParseLatestVersion_EmptyInput_ReturnsEmptyString()
         public void ParseLatestVersion_MatchingLineWithoutParentheses_Throws()
         {
             // CURRENT BEHAVIOR: IndexOf returns -1 for both parens, producing a negative Substring
-            // length. In production this is swallowed by CheckForUpdatesAsync' catch and surfaces as
-            // "Checking for App updates failed."
+            // length. In production this escapes the fallback parser and CheckForUpdatesAsync shows
+            // its owner-guarded update-check failure prompt.
             string text = "[assembly: AssemblyFileVersion is mentioned in a comment";
 
             Assert.Throws<ArgumentOutOfRangeException>(
@@ -195,34 +196,18 @@ public void ParseLatestVersion_NullInput_Throws()
         // ---------------------------------------------------------------------------------------
 
         [Fact]
-        public void GetCurrentVersionTostring_ReturnsWellFormedThreePartVersion()
+        public void GetCurrentVersion_UsesTheAssemblyFileVersionAttribute()
         {
-            string version = global::WinRestoreKit.Program.GetCurrentVersionTostring();
-
-            Assert.False(string.IsNullOrWhiteSpace(version));
-            Assert.Equal(3, version.Split('.').Length);
-            Assert.Equal(version, new Version(version).ToString(3));
-            // A "+<sha>" or "-preview" suffix would make new Version(...) throw upstream of here.
-            Assert.DoesNotContain("+", version);
-            Assert.DoesNotContain("-", version);
-        }
+            string version = global::WinRestoreKit.VersionInfo.GetCurrentVersion(
+                typeof(VersionParsingTests).Assembly);
 
-        [Fact]
-        public void GetCurrentVersionTostring_MatchesAssemblyFileVersionAttribute()
-        {
-            // Pins the source of truth: the value must come from AssemblyFileVersion (what the
-            // remote checker parses), NOT from AssemblyInformationalVersion or a csproj <Version>.
-            string expected = new Version(
-                typeof(global::WinRestoreKit.MainForm).Assembly
-                    .GetCustomAttribute<AssemblyFileVersionAttribute>()
-                    .Version).ToString(3);
-
-            Assert.Equal(expected, global::WinRestoreKit.Program.GetCurrentVersionTostring());
+            Assert.NotEqual(global::WinRestoreKit.VersionInfo.UnknownVersion, version);
+            Assert.Matches("^\\d+\\.\\d+\\.\\d+$", version);
         }
 
         // ---------------------------------------------------------------------------------------
-        // NormalizeVersion - the pure half of the local side. GetCurrentVersionTostring runs during
-        // MainForm construction, so anything that makes this throw is a startup crash.
+        // VersionInfo.Normalize - the pure half of the local side. VersionInfo is used during shell
+        // construction, so anything that makes this throw is a startup crash.
         // ---------------------------------------------------------------------------------------
 
         [Theory]
@@ -232,7 +217,7 @@ public void GetCurrentVersionTostring_MatchesAssemblyFileVersionAttribute()
         [InlineData("  1.2.3  ", "1.2.3")]
         public void NormalizeVersion_WellFormed_ReturnsThreePartVersion(string raw, string expected)
         {
-            Assert.Equal(expected, global::WinRestoreKit.Program.NormalizeVersion(raw));
+            Assert.Equal(expected, global::WinRestoreKit.VersionInfo.Normalize(raw));
         }
 
         [Theory]
@@ -241,7 +226,7 @@ public void NormalizeVersion_WellFormed_ReturnsThreePartVersion(string raw, stri
         public void NormalizeVersion_SemVerSuffix_IsStripped(string raw, string expected)
         {
             // What an AssemblyInformationalVersion would look like if one were ever introduced.
-            Assert.Equal(expected, global::WinRestoreKit.Program.NormalizeVersion(raw));
+            Assert.Equal(expected, global::WinRestoreKit.VersionInfo.Normalize(raw));
         }
 
         [Fact]
@@ -249,7 +234,7 @@ public void NormalizeVersion_TwoComponents_ReturnsInputInsteadOfThrowing()
         {
             // The trap that made the naive Version.TryParse fix wrong: "1.2" parses just fine, but
             // Version.ToString(3) throws ArgumentException because Build was never set.
-            Assert.Equal("1.2", global::WinRestoreKit.Program.NormalizeVersion("1.2"));
+            Assert.Equal("1.2", global::WinRestoreKit.VersionInfo.Normalize("1.2"));
         }
 
         [Theory]
@@ -259,10 +244,9 @@ public void NormalizeVersion_TwoComponents_ReturnsInputInsteadOfThrowing()
         [InlineData("+")]
         public void NormalizeVersion_Unparseable_ReturnsInputVerbatim(string raw)
         {
-            // Passed through, not replaced with a plausible-looking placeholder - see the remarks
-            // on NormalizeVersion. "-" and "+" also cover the suffix strip producing an empty
-            // candidate, which must not turn into an empty return value.
-            Assert.Equal(raw, global::WinRestoreKit.Program.NormalizeVersion(raw));
+            // Passed through, not replaced with a plausible-looking placeholder. "-" and "+" also
+            // cover the suffix strip producing an empty candidate, which must not turn into empty.
+            Assert.Equal(raw, global::WinRestoreKit.VersionInfo.Normalize(raw));
         }
 
         [Theory]
@@ -271,30 +255,24 @@ public void NormalizeVersion_Unparseable_ReturnsInputVerbatim(string raw)
         [InlineData("   ")]
         public void NormalizeVersion_Missing_ReturnsUnknown(string raw)
         {
-            // Reachable only if both AssemblyFileVersion and Application.ProductVersion come back
-            // empty. Previously this dereferenced null and took the app down at startup.
-            Assert.Equal(global::WinRestoreKit.Program.UnknownVersion,
-                         global::WinRestoreKit.Program.NormalizeVersion(raw));
+            Assert.Equal(global::WinRestoreKit.VersionInfo.UnknownVersion,
+                         global::WinRestoreKit.VersionInfo.Normalize(raw));
         }
 
         [Fact]
         public void NormalizeVersion_UnknownPlaceholder_IsNotMistakableForAVersion()
         {
-            // The placeholder must never look like a real version, or a user reading the title bar
-            // cannot tell "we don't know" from "0.0.0 is installed".
-            Assert.False(Version.TryParse(global::WinRestoreKit.Program.UnknownVersion, out _));
+            Assert.False(Version.TryParse(global::WinRestoreKit.VersionInfo.UnknownVersion, out _));
         }
 
         [Fact]
         public void Assembly_DeclaresNoInformationalVersion_SoProductVersionCannotDrift()
         {
-            // Guards the trap described in Program.GetCurrentVersionTostring's remarks. Adding an
-            // AssemblyInformationalVersion - directly, or implicitly by setting <Version> in the
-            // csproj - makes the SDK append "+<commit-sha>", and Application.ProductVersion prefers
-            // that attribute over the Win32 resource. Asserting absence outright (rather than
-            // "absent OR clean") is deliberate: it makes the failure fire at the moment someone
-            // introduces the attribute, which is when the decision needs re-examining, instead of
-            // waiting for the suffix to actually appear in a release build.
+            // Guards the source-of-truth invariant in VersionInfo. Adding an
+            // AssemblyInformationalVersion can make release metadata diverge from the Win32 resource.
+            // Asserting absence outright (rather than "absent OR clean") is deliberate: it makes the
+            // failure fire at the moment someone introduces the attribute, which is when the decision
+            // needs re-examining, instead of waiting for the suffix to actually appear in a release build.
             var informational = typeof(global::WinRestoreKit.MainForm).Assembly
                 .GetCustomAttribute<AssemblyInformationalVersionAttribute>();
 
diff --git a/src/WinRestoreKit.Tests/ViewDataHelperTests.cs b/src/WinRestoreKit.Tests/ViewDataHelperTests.cs
index 95084eb..07df8ea 100644
--- a/src/WinRestoreKit.Tests/ViewDataHelperTests.cs
+++ b/src/WinRestoreKit.Tests/ViewDataHelperTests.cs
@@ -2,7 +2,8 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
-using Views;
+using ViewWatchedGroupSummary = Views.WatchedGroupSummary;
+using ViewWatchedGroups = Views.WatchedGroups;
 using Xunit;
 
 namespace WinRestoreKit.Tests
@@ -13,13 +14,13 @@ public class ViewDataHelperTests
         public void WatchedGroups_GetCurrent_ReflectsEveryCatalogCategory()
         {
             IReadOnlyList<ModuleRegistration> registrations = ModuleCatalog.CreateAll();
-            IReadOnlyList<WatchedGroupSummary> groups = WatchedGroups.GetCurrent();
+            IReadOnlyList<ViewWatchedGroupSummary> groups = ViewWatchedGroups.GetCurrent();
 
             Assert.Equal(
                 registrations.Select(registration => registration.Category).Distinct(),
                 groups.Select(group => group.Name));
 
-            foreach (WatchedGroupSummary group in groups)
+            foreach (ViewWatchedGroupSummary group in groups)
             {
                 int expectedCount = registrations.Count(registration => registration.Category == group.Name);
                 Assert.Equal($"{expectedCount} items", group.Count);
@@ -27,25 +28,21 @@ public void WatchedGroups_GetCurrent_ReflectsEveryCatalogCategory()
         }
 
         [Fact]
-        public void ScopeGroups_Build_UsesNineFixedScopesAndAssignsEachCatalogModuleOnce()
+        public void ScopeGroups_Build_UsesSixFixedScopesAndAssignsEachCatalogModuleOnce()
         {
-            IReadOnlyList<ModuleRegistration> registrations = ModuleCatalog.CreateAll();
+            IReadOnlyList<BackupModuleRegistration> registrations = BackupModuleCatalog.CreateAll();
             IReadOnlyList<ScopeGroupRow> groups = ScopeGroups.Build();
             string[] expectedScopeNames =
             [
-                "Registry branches",
                 "Explorer & shell",
                 "Power & devices",
-                "Installed drivers",
                 "Fonts",
-                "Scheduled tasks",
                 "Network profiles",
                 "Environment variables (unfiltered)",
                 "App settings (AppData)"
             ];
             IReadOnlyDictionary<string, Type[]> expectedModules = new Dictionary<string, Type[]>
             {
-                ["Registry branches"] = Array.Empty<Type>(),
                 ["Explorer & shell"] =
                 [
                     typeof(WPersonalization),
@@ -62,9 +59,7 @@ public void ScopeGroups_Build_UsesNineFixedScopesAndAssignsEachCatalogModuleOnce
                     typeof(DKeyboard),
                     typeof(DTouchpad)
                 ],
-                ["Installed drivers"] = Array.Empty<Type>(),
                 ["Fonts"] = [typeof(WFonts)],
-                ["Scheduled tasks"] = Array.Empty<Type>(),
                 ["Network profiles"] =
                 [
                     typeof(WNetworkConf),
@@ -99,7 +94,6 @@ public void ScopeGroups_Build_UsesNineFixedScopesAndAssignsEachCatalogModuleOnce
                 Assert.Equal(
                     group.RequiresExplicitOptIn ? false : group.Modules.Any(module => module.IsInstalled()),
                     group.DefaultChecked);
-                Assert.Equal("--", group.SizeLabel);
 
                 if (group.Modules.Count == 0)
                     Assert.Equal("No supported items detected", group.Detail);
diff --git a/src/WinRestoreKit.Tests/WPowerPlansManifestPreClearTests.cs b/src/WinRestoreKit.Tests/WPowerPlansManifestPreClearTests.cs
new file mode 100644
index 0000000..f62f4d2
--- /dev/null
+++ b/src/WinRestoreKit.Tests/WPowerPlansManifestPreClearTests.cs
@@ -0,0 +1,50 @@
+using WinRestoreKit;
+using Conf;
+using System;
+using System.IO;
+using System.Threading.Tasks;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public class WPowerPlansManifestPreClearTests
+    {
+        private sealed class FailedListPowerPlans : WPowerPlans
+        {
+            protected override Task<ToolCapture> CaptureAsync(params string[] args)
+            {
+                Assert.Equal(new[] { "/list" }, args);
+
+                return Task.FromResult(new ToolCapture
+                {
+                    Outcome = ProcessOutcome.NeverStarted("test failure")
+                });
+            }
+        }
+
+        [Fact]
+        public async Task Backup_WhenListingFails_RemovesThePreviousManifest()
+        {
+            string backup = Path.Combine(Path.GetTempPath(), "power_manifest_" + Guid.NewGuid().ToString("N"));
+            Directory.CreateDirectory(backup);
+            WPowerPlans module = new FailedListPowerPlans();
+            string manifest = WPowerPlans.ManifestPathIn(backup);
+
+            try
+            {
+                File.WriteAllText(manifest, "{ \"activeSchemeGuid\": \"previous-plan\" }");
+                Assert.True(module.HasArtifactIn(backup));
+
+                ModuleResult result = await module.BackupAsync(backup);
+
+                Assert.Equal(ResultState.Failed, result.State);
+                Assert.False(File.Exists(manifest));
+                Assert.False(module.HasArtifactIn(backup));
+            }
+            finally
+            {
+                Directory.Delete(backup, recursive: true);
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj b/src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj
index 978d0cc..8f3d23b 100644
--- a/src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj
+++ b/src/WinRestoreKit.Tests/WinRestoreKit.Tests.csproj
@@ -10,6 +10,7 @@
       reference in order to resolve those types. No test opens a window.
     -->
     <UseWindowsForms>true</UseWindowsForms>
+    <UseWPF>true</UseWPF>
     <IsPackable>false</IsPackable>
     <IsTestProject>true</IsTestProject>
     <!-- Match the production project's settings so test code compiles under the same rules. -->
@@ -26,6 +27,10 @@
 
   <ItemGroup>
     <ProjectReference Include="..\WinRestoreKit\WinRestoreKit.csproj" />
+    <ProjectReference Include="..\WinRestoreKit.Application\WinRestoreKit.Application.csproj">
+      <Aliases>global,Application</Aliases>
+    </ProjectReference>
+    <ProjectReference Include="..\WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/WinRestoreKit.Tests/WpfAppRestoreDialogTests.cs b/src/WinRestoreKit.Tests/WpfAppRestoreDialogTests.cs
new file mode 100644
index 0000000..61000f0
--- /dev/null
+++ b/src/WinRestoreKit.Tests/WpfAppRestoreDialogTests.cs
@@ -0,0 +1,46 @@
+using System;
+using System.Windows;
+using WinRestoreKit.Wpf.Services;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public class WpfAppRestoreDialogTests
+    {
+        [Fact]
+        public void RestoreDialogCallback_PassesTheVisibleWpfWindowAndPreparedPath()
+        {
+            WpfTestHost.Run(() =>
+            {
+                var owner = new Window();
+                owner.Show();
+                Window receivedOwner = null;
+                string receivedPath = null;
+                Action<string, object> callback = WpfAppRestoreDialog.CreateCallback(
+                    (actualOwner, path) => { receivedOwner = actualOwner; receivedPath = path; });
+
+                try
+                {
+                    callback(@"C:\prepared", owner);
+                    Assert.Same(owner, receivedOwner);
+                    Assert.Equal(@"C:\prepared", receivedPath);
+                }
+                finally
+                {
+                    owner.Close();
+                }
+            });
+        }
+
+        [Fact]
+        public void RestoreDialogCallback_WithoutAVisibleWpfOwner_DoesNotOpenDialog()
+        {
+            Action<string, object> callback = WpfAppRestoreDialog.CreateCallback((_, _) =>
+                throw new Xunit.Sdk.XunitException("must not open"));
+
+            callback(@"C:\prepared", new object());
+
+            WpfTestHost.Run(() => callback(@"C:\prepared", new Window()));
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/WpfLogSinkTests.cs b/src/WinRestoreKit.Tests/WpfLogSinkTests.cs
new file mode 100644
index 0000000..ac717ac
--- /dev/null
+++ b/src/WinRestoreKit.Tests/WpfLogSinkTests.cs
@@ -0,0 +1,42 @@
+using System.Collections.Generic;
+using System.Windows.Threading;
+using WinRestoreKit.Wpf.Services;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class WpfLogSinkTests
+    {
+        [Fact]
+        public void LogSink_AfterDispose_DoesNotPostAnotherLogLine()
+        {
+            WpfTestHost.Run(() =>
+            {
+                var lines = new List<string>();
+                using var sink = new WpfLogSink(Dispatcher.CurrentDispatcher, lines.Add, () => lines.Clear());
+                sink.Append("before");
+                Dispatcher.CurrentDispatcher.Invoke(() => { }, DispatcherPriority.ApplicationIdle);
+                sink.Dispose();
+                sink.Append("after");
+                Dispatcher.CurrentDispatcher.Invoke(() => { }, DispatcherPriority.ApplicationIdle);
+
+                Assert.Equal(new[] { "before" }, lines);
+            });
+        }
+
+        [Fact]
+        public void LogSink_QueuedLineDisposedBeforeDispatch_DoesNotMutateThePresentation()
+        {
+            WpfTestHost.Run(() =>
+            {
+                var lines = new List<string>();
+                using var sink = new WpfLogSink(Dispatcher.CurrentDispatcher, lines.Add, () => lines.Clear());
+                sink.Append("queued");
+                sink.Dispose();
+                Dispatcher.CurrentDispatcher.Invoke(() => { }, DispatcherPriority.ApplicationIdle);
+
+                Assert.Empty(lines);
+            });
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/WpfRunUiTests.cs b/src/WinRestoreKit.Tests/WpfRunUiTests.cs
new file mode 100644
index 0000000..fffc2fd
--- /dev/null
+++ b/src/WinRestoreKit.Tests/WpfRunUiTests.cs
@@ -0,0 +1,82 @@
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Threading;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Services;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public sealed class WpfRunUiTests
+    {
+        [Fact]
+        public void ProgressCallbacksMarshalToTheDispatcherAndSummaryIsStoredBeforeReturn()
+        {
+            WpfTestHost.Run(() =>
+            {
+                var presentation = new RecordingPresentation();
+                var ui = new WpfRunUi(Dispatcher.CurrentDispatcher, presentation,
+                    new RecordingRunDialogs(), () => null);
+                RunSummary summary = RunSummary.For(new[] { SucceededOutcome() }, true, RunVerb.Backup);
+
+                Task.Run(() => ((IRunUi)ui).SetProgressText("Copying settings")).GetAwaiter().GetResult();
+                Dispatcher.CurrentDispatcher.Invoke(() => { }, DispatcherPriority.ApplicationIdle);
+                ((IRunUi)ui).ShowSummary(summary, "Backup", new[] { SucceededOutcome() });
+
+                Assert.Equal("Copying settings", presentation.ProgressText);
+                Assert.Same(summary, presentation.Summary);
+                Assert.Single(presentation.Outcomes);
+            });
+        }
+
+        [Fact]
+        public void DialogOwner_ReturnsOnlyALiveVisibleWpfWindow()
+        {
+            WpfTestHost.Run(() =>
+            {
+                Window owner = new Window();
+                var ui = new WpfRunUi(Dispatcher.CurrentDispatcher, new RecordingPresentation(),
+                    new RecordingRunDialogs(), () => owner);
+
+                Assert.Null(((IRunUi)ui).DialogOwner);
+                owner.Show();
+                Assert.Same(owner, ((IRunUi)ui).DialogOwner);
+                owner.Close();
+                Assert.Null(((IRunUi)ui).DialogOwner);
+            });
+        }
+
+        private static ModuleOutcome SucceededOutcome()
+            => new ModuleOutcome("Mouse", ModuleResult.Aggregate(new[]
+            {
+                StepResult.Succeeded("Mouse", "exported setting")
+            }));
+
+        private sealed class RecordingPresentation : IRunPresentation
+        {
+            internal string ProgressText { get; private set; }
+            internal RunSummary Summary { get; private set; }
+            internal IReadOnlyList<ModuleOutcome> Outcomes { get; private set; }
+
+            public void SetProgressText(string text) => ProgressText = text;
+            public void SetProgressPercent(int percent) { }
+            public void SetProgressDetail(string groupInfo, string elapsed, string remaining, string throughput,
+                                          long bytesWritten, int errors, int warnings) { }
+            public void ShowSummary(RunSummary summary, string caption, IReadOnlyList<ModuleOutcome> outcomes)
+            {
+                Summary = summary;
+                Outcomes = outcomes;
+            }
+            public void SetExplorerRestartVisible(bool visible) { }
+        }
+
+        private sealed class RecordingRunDialogs : IRunDialogService
+        {
+            public IReadOnlyList<string> ShowRestoreConsent(RestorePlan plan) => null;
+            public bool ConfirmSnapshotOverride(string text, string caption) => false;
+            public void ShowPlanCompositionError(string text, string caption) { }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/WpfShellTests.cs b/src/WinRestoreKit.Tests/WpfShellTests.cs
new file mode 100644
index 0000000..26ec570
--- /dev/null
+++ b/src/WinRestoreKit.Tests/WpfShellTests.cs
@@ -0,0 +1,124 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows.Threading;
+using WinRestoreKit;
+using WinRestoreKit.Wpf;
+using WinRestoreKit.Wpf.Services;
+using WinRestoreKit.Wpf.ViewModels;
+using WinRestoreKit.Wpf.ViewModels.Timeline;
+using Xunit;
+
+namespace WinRestoreKit.Tests
+{
+    public class WpfShellTests
+    {
+        [Fact]
+        public void Shell_ComposesTheRealTimelineWorkflow()
+        {
+            WpfTestHost.Run(() =>
+            {
+                ShellViewModel shell = CreateShell();
+                MainWindow window = new MainWindow(shell);
+
+                Assert.Equal("Timeline", shell.WorkflowLabel);
+                Assert.IsType<TimelineViewModel>(shell.CurrentWorkspace);
+                window.Close();
+            });
+        }
+
+        [Fact]
+        public void Shell_SettingsAndAboutCommandsReturnToTheRealTimeline()
+        {
+            WpfTestHost.Run(() =>
+            {
+                ShellViewModel shell = CreateShell();
+                MainWindow window = new MainWindow(shell);
+                shell.ShowSettingsCommand.Execute(null);
+                Assert.Equal("Settings", shell.WorkflowLabel);
+                shell.ShowAboutCommand.Execute(null);
+                Assert.Equal("About", shell.WorkflowLabel);
+                shell.ShowTimeline();
+                Assert.IsType<TimelineViewModel>(shell.CurrentWorkspace);
+                window.Close();
+            });
+        }
+
+        [Fact]
+        public void Shell_ShowAbout_RendersReadOnlyVersionBinding()
+        {
+            WpfTestHost.Run(() =>
+            {
+                ShellViewModel shell = CreateShell();
+                MainWindow window = new MainWindow(shell);
+                window.Show();
+
+                shell.ShowAboutCommand.Execute(null);
+                window.UpdateLayout();
+                Dispatcher.CurrentDispatcher.Invoke(
+                    DispatcherPriority.ApplicationIdle,
+                    new Action(() => { }));
+
+                Assert.Equal("About", shell.WorkflowLabel);
+                window.Close();
+            });
+        }
+
+        [Fact]
+        public void MainWindow_ComposesTheTimelineWorkflow()
+        {
+            WpfTestHost.Run(() =>
+            {
+                ShellViewModel shell = CreateShell();
+                MainWindow window = new MainWindow(shell);
+                Assert.Equal("WinRestoreKit", window.Title);
+                Assert.Same(shell, window.DataContext);
+                Assert.IsType<TimelineViewModel>(shell.CurrentWorkspace);
+                window.Close();
+            });
+        }
+
+        private static ShellViewModel CreateShell()
+        {
+            return new ShellViewModel(
+                new FakeThemeService(),
+                new WpfUpdatePresenter(new FakeUpdates(), new FakeDialogs(), new FakeLinks()),
+                "0.0.1");
+        }
+
+        private sealed class FakeThemeService : IThemeService
+        {
+            public ThemeMode Mode { get; private set; } = ThemeMode.FollowSystem;
+            public ThemeMode EffectiveMode { get; private set; } = ThemeMode.Light;
+            public event EventHandler ThemeChanged;
+
+            public void SetMode(ThemeMode mode)
+            {
+                Mode = mode;
+                EffectiveMode = mode == ThemeMode.FollowSystem ? ThemeMode.Light : mode;
+                ThemeChanged?.Invoke(this, EventArgs.Empty);
+            }
+
+            public void Dispose() { }
+        }
+
+        private sealed class FakeUpdates : IUpdateCheckService
+        {
+            public Task<UpdateCheckResult> CheckAsync(string currentVersion, CancellationToken cancellationToken)
+                => Task.FromResult(new UpdateCheckResult(UpdateVerdict.UpToDate, currentVersion, currentVersion));
+        }
+
+        private sealed class FakeDialogs : IWpfDialogService
+        {
+            public void ShowInformation(string text, string caption) { }
+            public void ShowWarning(string text, string caption) { }
+            public void ShowError(string text, string caption) { }
+            public bool Confirm(string text, string caption) => false;
+        }
+
+        private sealed class FakeLinks : IExternalLinkService
+        {
+            public void Open(string url) { }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Tests/WpfTestHost.cs b/src/WinRestoreKit.Tests/WpfTestHost.cs
new file mode 100644
index 0000000..61d6ff9
--- /dev/null
+++ b/src/WinRestoreKit.Tests/WpfTestHost.cs
@@ -0,0 +1,90 @@
+using System;
+using System.Runtime.ExceptionServices;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows.Threading;
+
+namespace WinRestoreKit.Tests
+{
+    internal static class WpfTestHost
+    {
+        internal static void Run(Action action)
+            => Run<object>(() =>
+            {
+                action();
+                return null;
+            });
+
+        internal static T Run<T>(Func<T> action)
+        {
+            if (action == null)
+                throw new ArgumentNullException(nameof(action));
+
+            T result = default;
+            ExceptionDispatchInfo failure = null;
+            Thread thread = new Thread(() =>
+            {
+                try
+                {
+                    result = action();
+                }
+                catch (Exception ex)
+                {
+                    failure = ExceptionDispatchInfo.Capture(ex);
+                }
+                finally
+                {
+                    Dispatcher.CurrentDispatcher.InvokeShutdown();
+                }
+            })
+            {
+                IsBackground = true,
+                Name = "WinRestoreKit WPF test"
+            };
+
+            thread.SetApartmentState(ApartmentState.STA);
+            thread.Start();
+            thread.Join();
+            failure?.Throw();
+            return result;
+        }
+
+        internal static Task RunAsync(Func<Task> action)
+        {
+            if (action == null)
+                throw new ArgumentNullException(nameof(action));
+
+            TaskCompletionSource<object> completion =
+                new TaskCompletionSource<object>(TaskCreationOptions.RunContinuationsAsynchronously);
+            Thread thread = new Thread(() =>
+            {
+                Dispatcher dispatcher = Dispatcher.CurrentDispatcher;
+                dispatcher.BeginInvoke(new Action(async () =>
+                {
+                    try
+                    {
+                        await action();
+                        completion.TrySetResult(null);
+                    }
+                    catch (Exception ex)
+                    {
+                        completion.TrySetException(ex);
+                    }
+                    finally
+                    {
+                        dispatcher.BeginInvokeShutdown(DispatcherPriority.Background);
+                    }
+                }));
+                Dispatcher.Run();
+            })
+            {
+                IsBackground = true,
+                Name = "WinRestoreKit asynchronous WPF test"
+            };
+
+            thread.SetApartmentState(ApartmentState.STA);
+            thread.Start();
+            return completion.Task;
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/App.xaml b/src/WinRestoreKit.Wpf/App.xaml
new file mode 100644
index 0000000..1a785ed
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/App.xaml
@@ -0,0 +1,11 @@
+<Application x:Class="WinRestoreKit.Wpf.App"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
+  <Application.Resources>
+    <ResourceDictionary>
+      <ResourceDictionary.MergedDictionaries>
+        <ResourceDictionary Source="Themes/Controls.xaml" />
+      </ResourceDictionary.MergedDictionaries>
+    </ResourceDictionary>
+  </Application.Resources>
+</Application>
diff --git a/src/WinRestoreKit.Wpf/App.xaml.cs b/src/WinRestoreKit.Wpf/App.xaml.cs
new file mode 100644
index 0000000..529edc5
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/App.xaml.cs
@@ -0,0 +1,39 @@
+using System;
+using System.Windows;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Services;
+using WinRestoreKit.Wpf.ViewModels;
+
+namespace WinRestoreKit.Wpf;
+
+public partial class App : Application
+{
+    private WpfThemeService themes;
+
+    protected override void OnStartup(StartupEventArgs e)
+    {
+        base.OnStartup(e);
+
+        RegistryThemeSettings settings = new RegistryThemeSettings();
+        WpfDialogService dialogs = new WpfDialogService(Dispatcher, () => MainWindow);
+        themes = new WpfThemeService(Resources, settings, new WindowsThemeDetector());
+        WpfUpdatePresenter updates = new WpfUpdatePresenter(new UpdateCheckService(), dialogs,
+                                                             new ExternalLinkService());
+        ShellViewModel shell = new ShellViewModel(themes, updates,
+            VersionInfo.GetCurrentVersion(typeof(App).Assembly));
+        MainWindow window = new MainWindow(shell);
+
+        Utils.UrlFailureUi = (url, exception) => Dispatcher.BeginInvoke(() =>
+            dialogs.ShowWarning("Could not open this link in your browser:\n\n" + url + "\n\n" +
+                                exception.Message, "Unable to open link"));
+
+        MainWindow = window;
+        window.Show();
+    }
+
+    protected override void OnExit(ExitEventArgs e)
+    {
+        themes?.Dispose();
+        base.OnExit(e);
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Infrastructure/AsyncDelegateCommand.cs b/src/WinRestoreKit.Wpf/Infrastructure/AsyncDelegateCommand.cs
new file mode 100644
index 0000000..50a5757
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Infrastructure/AsyncDelegateCommand.cs
@@ -0,0 +1,45 @@
+using System;
+using System.Threading.Tasks;
+using System.Windows.Input;
+
+namespace WinRestoreKit.Wpf.Infrastructure
+{
+    internal sealed class AsyncDelegateCommand : ICommand
+    {
+        private readonly Func<Task> executeAsync;
+        private readonly Action<Exception> reportFailure;
+        private bool executing;
+
+        internal AsyncDelegateCommand(Func<Task> executeAsync, Action<Exception> reportFailure = null)
+        {
+            this.executeAsync = executeAsync ?? throw new ArgumentNullException(nameof(executeAsync));
+            this.reportFailure = reportFailure;
+        }
+
+        public event EventHandler CanExecuteChanged;
+
+        public bool CanExecute(object parameter) => !executing;
+
+        public async void Execute(object parameter)
+        {
+            if (executing)
+                return;
+
+            executing = true;
+            CanExecuteChanged?.Invoke(this, EventArgs.Empty);
+            try
+            {
+                await executeAsync();
+            }
+            catch (Exception ex)
+            {
+                reportFailure?.Invoke(ex);
+            }
+            finally
+            {
+                executing = false;
+                CanExecuteChanged?.Invoke(this, EventArgs.Empty);
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Infrastructure/DelegateCommand.cs b/src/WinRestoreKit.Wpf/Infrastructure/DelegateCommand.cs
new file mode 100644
index 0000000..4259713
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Infrastructure/DelegateCommand.cs
@@ -0,0 +1,26 @@
+using System;
+using System.Windows.Input;
+
+namespace WinRestoreKit.Wpf.Infrastructure
+{
+    internal sealed class DelegateCommand : ICommand
+    {
+        private readonly Action<object> execute;
+        private readonly Predicate<object> canExecute;
+
+        internal DelegateCommand(Action<object> execute, Predicate<object> canExecute = null)
+        {
+            this.execute = execute ?? throw new ArgumentNullException(nameof(execute));
+            this.canExecute = canExecute;
+        }
+
+        public event EventHandler CanExecuteChanged;
+
+        public bool CanExecute(object parameter) => canExecute?.Invoke(parameter) ?? true;
+
+        public void Execute(object parameter) => execute(parameter);
+
+        internal void RaiseCanExecuteChanged()
+            => CanExecuteChanged?.Invoke(this, EventArgs.Empty);
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Infrastructure/ObservableObject.cs b/src/WinRestoreKit.Wpf/Infrastructure/ObservableObject.cs
new file mode 100644
index 0000000..ebc8ace
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Infrastructure/ObservableObject.cs
@@ -0,0 +1,29 @@
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+
+namespace WinRestoreKit.Wpf.Infrastructure
+{
+    internal abstract class ObservableObject : INotifyPropertyChanged
+    {
+        public event PropertyChangedEventHandler PropertyChanged;
+
+        protected bool SetProperty<T>(ref T field, T value, string propertyName)
+        {
+            if (EqualityComparer<T>.Default.Equals(field, value))
+                return false;
+
+            field = value;
+            OnPropertyChanged(propertyName);
+            return true;
+        }
+
+        protected void OnPropertyChanged(string propertyName)
+        {
+            if (string.IsNullOrWhiteSpace(propertyName))
+                throw new ArgumentException("A property name is required.", nameof(propertyName));
+
+            PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(propertyName));
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/MainWindow.xaml b/src/WinRestoreKit.Wpf/MainWindow.xaml
new file mode 100644
index 0000000..aa028c4
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/MainWindow.xaml
@@ -0,0 +1,86 @@
+<Window x:Class="WinRestoreKit.Wpf.MainWindow"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        xmlns:views="clr-namespace:WinRestoreKit.Wpf.Views"
+        xmlns:vm="clr-namespace:WinRestoreKit.Wpf.ViewModels"
+        xmlns:timeline="clr-namespace:WinRestoreKit.Wpf.ViewModels.Timeline"
+        Title="WinRestoreKit" MinWidth="1024" MinHeight="640"
+        UseLayoutRounding="True"
+        TextOptions.TextFormattingMode="Ideal"
+        FontFamily="{DynamicResource ApplicationFont}"
+        FontSize="13"
+        Foreground="{DynamicResource TextBrush}"
+        Background="{DynamicResource WindowBackgroundBrush}">
+  <Window.Resources>
+    <DataTemplate DataType="{x:Type timeline:TimelineViewModel}"><views:TimelineView /></DataTemplate>
+    <DataTemplate DataType="{x:Type vm:ComparisonWorkspaceViewModel}"><views:ComparisonWorkspaceView /></DataTemplate>
+    <DataTemplate DataType="{x:Type vm:ConfirmViewModel}"><views:ConfirmView /></DataTemplate>
+    <DataTemplate DataType="{x:Type vm:BackupWorkspaceViewModel}"><views:BackupWorkspaceView /></DataTemplate>
+    <DataTemplate DataType="{x:Type vm:ProgressWorkspaceViewModel}"><views:ProgressWorkspaceView /></DataTemplate>
+    <DataTemplate DataType="{x:Type vm:ResultWorkspaceViewModel}"><views:ResultWorkspaceView /></DataTemplate>
+    <DataTemplate DataType="{x:Type vm:SettingsViewModel}"><views:SettingsView /></DataTemplate>
+    <DataTemplate DataType="{x:Type vm:AboutViewModel}"><views:AboutView /></DataTemplate>
+  </Window.Resources>
+  <DockPanel>
+    <!--
+      Compact command bar, not a navigation chrome: wordmark, the stage the user is in, and the
+      three always-available commands. Everything else belongs to the workspace below it.
+    -->
+    <Border DockPanel.Dock="Top"
+            Background="{DynamicResource SurfaceBrush}"
+            BorderBrush="{DynamicResource DividerBrush}"
+            BorderThickness="0,0,0,1"
+            Padding="20,0"
+            SnapsToDevicePixels="True">
+      <Grid Height="52">
+        <Grid.ColumnDefinitions>
+          <ColumnDefinition Width="*" />
+          <ColumnDefinition Width="Auto" />
+          <ColumnDefinition Width="Auto" />
+          <ColumnDefinition Width="Auto" />
+        </Grid.ColumnDefinitions>
+
+        <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+          <Border Width="3" Height="17" CornerRadius="1.5"
+                  Background="{DynamicResource AccentBrush}"
+                  SnapsToDevicePixels="True" />
+          <TextBlock Text="WinRestoreKit"
+                     Margin="10,0,0,0"
+                     FontSize="14" FontWeight="SemiBold"
+                     Foreground="{DynamicResource TextBrush}"
+                     VerticalAlignment="Center" />
+          <Border Width="1" Height="16" Margin="14,0"
+                  Background="{DynamicResource DividerBrush}"
+                  SnapsToDevicePixels="True" />
+          <TextBlock Text="{Binding WorkflowLabel}"
+                     FontSize="12.5"
+                     Foreground="{DynamicResource MutedTextBrush}"
+                     VerticalAlignment="Center"
+                     TextTrimming="CharacterEllipsis" />
+        </StackPanel>
+
+        <Button Grid.Column="1"
+                Content="Create snapshot"
+                Command="{Binding CreateSnapshotCommand}"
+                Style="{DynamicResource PrimaryButtonStyle}"
+                VerticalAlignment="Center"
+                AutomationProperties.Name="Create snapshot" />
+        <Button Grid.Column="2"
+                Content="Settings"
+                Command="{Binding ShowSettingsCommand}"
+                Style="{DynamicResource SubtleButtonStyle}"
+                Margin="8,0,0,0"
+                VerticalAlignment="Center"
+                AutomationProperties.Name="Settings" />
+        <Button Grid.Column="3"
+                Content="About"
+                Command="{Binding ShowAboutCommand}"
+                Style="{DynamicResource SubtleButtonStyle}"
+                Margin="4,0,0,0"
+                VerticalAlignment="Center"
+                AutomationProperties.Name="About" />
+      </Grid>
+    </Border>
+    <ContentControl Content="{Binding CurrentWorkspace}" Focusable="False" />
+  </DockPanel>
+</Window>
diff --git a/src/WinRestoreKit.Wpf/MainWindow.xaml.cs b/src/WinRestoreKit.Wpf/MainWindow.xaml.cs
new file mode 100644
index 0000000..26272ed
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/MainWindow.xaml.cs
@@ -0,0 +1,24 @@
+using System;
+using System.Windows;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Navigation;
+using WinRestoreKit.Wpf.Services;
+using WinRestoreKit.Wpf.ViewModels;
+using WinRestoreKit.Wpf.ViewModels.Timeline;
+
+namespace WinRestoreKit.Wpf
+{
+    public partial class MainWindow : Window
+    {
+        internal MainWindow(ShellViewModel shell)
+        {
+            if (shell == null)
+                throw new ArgumentNullException(nameof(shell));
+
+            InitializeComponent();
+            DataContext = shell;
+            CompareWorkflowNavigator navigator = new CompareWorkflowNavigator(shell, this, new CompareDialogService());
+            shell.SetTimeline(new TimelineViewModel(shell.SnapshotEventCatalog, new SnapshotPayloadPreparationService(), navigator));
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Navigation/CompareWorkflowNavigator.cs b/src/WinRestoreKit.Wpf/Navigation/CompareWorkflowNavigator.cs
new file mode 100644
index 0000000..a23ec02
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Navigation/CompareWorkflowNavigator.cs
@@ -0,0 +1,82 @@
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using System.Windows;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Services;
+using WinRestoreKit.Wpf.ViewModels;
+
+namespace WinRestoreKit.Wpf.Navigation
+{
+    internal sealed class CompareWorkflowNavigator : ITimelineNavigator
+    {
+        private readonly ShellViewModel shell;
+        private readonly Window owner;
+        private readonly ICompareDialogService dialogs;
+        private ComparisonWorkspaceViewModel currentWorkspace;
+
+        internal CompareWorkflowNavigator(ShellViewModel shell, Window owner, ICompareDialogService dialogs)
+        {
+            this.shell = shell ?? throw new ArgumentNullException(nameof(shell));
+            this.owner = owner ?? throw new ArgumentNullException(nameof(owner));
+            this.dialogs = dialogs ?? throw new ArgumentNullException(nameof(dialogs));
+        }
+
+        internal Task PendingTransition { get; private set; } = Task.CompletedTask;
+        internal ComparisonWorkspaceViewModel CurrentWorkspace => currentWorkspace;
+
+        public void OpenCompare(SnapshotPayloadPreparation incoming)
+        {
+            if (incoming == null)
+                throw new ArgumentNullException(nameof(incoming));
+
+            if (string.Equals(currentWorkspace?.Snapshot.CanonicalPath, incoming.Snapshot.CanonicalPath,
+                StringComparison.OrdinalIgnoreCase))
+            {
+                incoming.Dispose();
+                return;
+            }
+
+            if (currentWorkspace?.RestoreSet.HasItems == true &&
+                !dialogs.ConfirmDiscardRestoreSet(owner, currentWorkspace.Snapshot, incoming.Snapshot))
+            {
+                incoming.Dispose();
+                return;
+            }
+
+            PendingTransition = ReplaceWorkspaceAsync(incoming);
+        }
+
+        public void ShowSnapshotDiagnostic(SnapshotEvent snapshot)
+            => dialogs.ShowSnapshotDiagnostic(owner, snapshot);
+
+        private async Task ReplaceWorkspaceAsync(SnapshotPayloadPreparation incoming)
+        {
+            bool comparisonStarted = false;
+            try
+            {
+                if (currentWorkspace != null)
+                    await currentWorkspace.CancelAsync();
+                currentWorkspace?.RestoreSet.Clear();
+
+                currentWorkspace = new ComparisonWorkspaceViewModel(incoming.Snapshot,
+                    BackupModuleCatalog.CreateAll(), new SnapshotComparisonService(), ShowConfirm);
+                shell.ShowCompare(currentWorkspace);
+                comparisonStarted = true;
+                await currentWorkspace.StartAsync(incoming);
+            }
+            catch (Exception ex)
+            {
+                if (!comparisonStarted)
+                    incoming.Dispose();
+                shell.ShowInlineWorkflowError("Comparison could not start: " + ex.Message);
+            }
+        }
+
+        private void ShowConfirm(SnapshotEvent snapshot, IReadOnlyList<BackupBase> modules)
+        {
+            ConfirmViewModel confirm = new ConfirmViewModel(snapshot, modules, () => shell.ShowCompare(currentWorkspace));
+            shell.ShowConfirm(confirm);
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Navigation/ITimelineNavigator.cs b/src/WinRestoreKit.Wpf/Navigation/ITimelineNavigator.cs
new file mode 100644
index 0000000..f9f90f4
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Navigation/ITimelineNavigator.cs
@@ -0,0 +1,11 @@
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.Navigation
+{
+    internal interface ITimelineNavigator
+    {
+        void OpenCompare(SnapshotPayloadPreparation preparation);
+
+        void ShowSnapshotDiagnostic(SnapshotEvent snapshot);
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Properties/AssemblyInfo.cs b/src/WinRestoreKit.Wpf/Properties/AssemblyInfo.cs
new file mode 100644
index 0000000..1c3687a
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Properties/AssemblyInfo.cs
@@ -0,0 +1,3 @@
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("WinRestoreKit.Tests")]
diff --git a/src/WinRestoreKit.Wpf/Resources/SnapshotEventTemplates.xaml b/src/WinRestoreKit.Wpf/Resources/SnapshotEventTemplates.xaml
new file mode 100644
index 0000000..e263077
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Resources/SnapshotEventTemplates.xaml
@@ -0,0 +1,282 @@
+<ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+                    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+                    xmlns:vm="clr-namespace:WinRestoreKit.Wpf.ViewModels.Snapshots">
+  <!--
+    Snapshot status is drawn as vector geometry rather than icon-font text, so no symbol
+    name can leak into rendered output and nothing depends on an installed icon face.
+    Every status surface pairs the shape with its written label; colour alone never carries meaning.
+
+      Positive  filled node + check  "Verified"            selectable restore point
+      Caution   hollow node + bang   "Partial snapshot"    selectable, incomplete
+      Critical  filled node + cross  "Backup failed"       diagnostic only
+      Neutral   hollow node + dash   "Details unavailable" diagnostic only
+
+    Selection and hover are expressed with element styles rather than DataTemplate triggers so
+    the FindAncestor bindings resolve from a concrete element in the row.
+  -->
+  <BooleanToVisibilityConverter x:Key="BooleanToVisibilityConverter" />
+
+  <!-- ============ Status shape and pill (SnapshotEventStatus data context) ============ -->
+
+  <Style x:Key="SnapshotStatusGlyphStyle" TargetType="{x:Type Path}">
+    <Setter Property="Width" Value="14" />
+    <Setter Property="Height" Value="14" />
+    <Setter Property="StrokeThickness" Value="1.7" />
+    <Setter Property="StrokeStartLineCap" Value="Round" />
+    <Setter Property="StrokeEndLineCap" Value="Round" />
+    <Setter Property="StrokeLineJoin" Value="Round" />
+    <Setter Property="VerticalAlignment" Value="Center" />
+    <Setter Property="Stroke" Value="{DynamicResource MutedTextBrush}" />
+    <Setter Property="Data" Value="M 3,7 L 11,7" />
+    <Style.Triggers>
+      <DataTrigger Binding="{Binding Tone}" Value="Positive">
+        <Setter Property="Stroke" Value="{DynamicResource AccentTextBrush}" />
+        <Setter Property="Data" Value="M 2.6,7.3 L 5.7,10.4 L 11.4,3.9" />
+      </DataTrigger>
+      <DataTrigger Binding="{Binding Tone}" Value="Caution">
+        <Setter Property="Stroke" Value="{DynamicResource WarningTextBrush}" />
+        <Setter Property="Data" Value="M 7,2.8 L 7,8.1 M 7,10.7 L 7,11.2" />
+      </DataTrigger>
+      <DataTrigger Binding="{Binding Tone}" Value="Critical">
+        <Setter Property="Stroke" Value="{DynamicResource DangerTextBrush}" />
+        <Setter Property="Data" Value="M 3.6,3.6 L 10.4,10.4 M 10.4,3.6 L 3.6,10.4" />
+      </DataTrigger>
+    </Style.Triggers>
+  </Style>
+
+  <Style x:Key="SnapshotStatusPillBorderStyle" TargetType="{x:Type Border}">
+    <Setter Property="Background" Value="{DynamicResource SubtleBrush}" />
+    <Setter Property="BorderBrush" Value="{DynamicResource DividerBrush}" />
+    <Setter Property="BorderThickness" Value="1" />
+    <Setter Property="CornerRadius" Value="10" />
+    <Setter Property="Padding" Value="7,2,10,3" />
+    <Setter Property="VerticalAlignment" Value="Center" />
+    <Setter Property="SnapsToDevicePixels" Value="True" />
+    <Style.Triggers>
+      <DataTrigger Binding="{Binding Tone}" Value="Positive">
+        <Setter Property="Background" Value="{DynamicResource AccentSoftBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+      </DataTrigger>
+      <DataTrigger Binding="{Binding Tone}" Value="Caution">
+        <Setter Property="Background" Value="{DynamicResource WarningSoftBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource WarningBrush}" />
+      </DataTrigger>
+      <DataTrigger Binding="{Binding Tone}" Value="Critical">
+        <Setter Property="Background" Value="{DynamicResource DangerSoftBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource DangerBrush}" />
+      </DataTrigger>
+    </Style.Triggers>
+  </Style>
+
+  <Style x:Key="SnapshotStatusPillTextStyle" TargetType="{x:Type TextBlock}">
+    <Setter Property="FontFamily" Value="{DynamicResource ApplicationFont}" />
+    <Setter Property="FontSize" Value="11" />
+    <Setter Property="FontWeight" Value="SemiBold" />
+    <Setter Property="VerticalAlignment" Value="Center" />
+    <Setter Property="Margin" Value="6,0,0,0" />
+    <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+    <Style.Triggers>
+      <DataTrigger Binding="{Binding Tone}" Value="Positive">
+        <Setter Property="Foreground" Value="{DynamicResource AccentTextBrush}" />
+      </DataTrigger>
+      <DataTrigger Binding="{Binding Tone}" Value="Caution">
+        <Setter Property="Foreground" Value="{DynamicResource WarningTextBrush}" />
+      </DataTrigger>
+      <DataTrigger Binding="{Binding Tone}" Value="Critical">
+        <Setter Property="Foreground" Value="{DynamicResource DangerTextBrush}" />
+      </DataTrigger>
+    </Style.Triggers>
+  </Style>
+
+  <!-- Dense inline form: shape plus the full status sentence. Used by advanced history. -->
+  <DataTemplate x:Key="SnapshotEventStatusTemplate" DataType="{x:Type vm:SnapshotEventStatus}">
+    <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+      <Path Style="{StaticResource SnapshotStatusGlyphStyle}" />
+      <TextBlock Text="{Binding Label}" Margin="7,0,0,0" VerticalAlignment="Center"
+                 Foreground="{DynamicResource TextBrush}" />
+    </StackPanel>
+  </DataTemplate>
+
+  <!-- Compact pill form: shape plus the condensed status word. Used by timeline cards. -->
+  <DataTemplate x:Key="SnapshotEventStatusPillTemplate" DataType="{x:Type vm:SnapshotEventStatus}">
+    <Border Style="{StaticResource SnapshotStatusPillBorderStyle}">
+      <StackPanel Orientation="Horizontal">
+        <Path Style="{StaticResource SnapshotStatusGlyphStyle}" />
+        <TextBlock Text="{Binding ShortLabel}" Style="{StaticResource SnapshotStatusPillTextStyle}" />
+      </StackPanel>
+    </Border>
+  </DataTemplate>
+
+  <!-- ============ Timeline row chrome (SnapshotEventViewModel data context) ============ -->
+
+  <Style x:Key="SnapshotTimelineNodeRingStyle" TargetType="{x:Type Ellipse}">
+    <Setter Property="StrokeThickness" Value="2" />
+    <Setter Property="Stroke" Value="{DynamicResource StrongDividerBrush}" />
+    <Setter Property="Fill" Value="Transparent" />
+    <Style.Triggers>
+      <DataTrigger Binding="{Binding Status.Tone}" Value="Positive">
+        <Setter Property="Stroke" Value="{DynamicResource AccentBrush}" />
+        <Setter Property="Fill" Value="{DynamicResource AccentBrush}" />
+      </DataTrigger>
+      <DataTrigger Binding="{Binding Status.Tone}" Value="Caution">
+        <Setter Property="Stroke" Value="{DynamicResource WarningBrush}" />
+      </DataTrigger>
+      <DataTrigger Binding="{Binding Status.Tone}" Value="Critical">
+        <Setter Property="Stroke" Value="{DynamicResource DangerBrush}" />
+        <Setter Property="Fill" Value="{DynamicResource DangerBrush}" />
+      </DataTrigger>
+    </Style.Triggers>
+  </Style>
+
+  <Style x:Key="SnapshotTimelineNodeHaloStyle" TargetType="{x:Type Ellipse}">
+    <Setter Property="Margin" Value="-5" />
+    <Setter Property="Stroke" Value="{DynamicResource AccentBrush}" />
+    <Setter Property="StrokeThickness" Value="1.5" />
+    <Setter Property="Opacity" Value="0.5" />
+    <Setter Property="IsHitTestVisible" Value="False" />
+    <Setter Property="Visibility" Value="Collapsed" />
+    <Style.Triggers>
+      <DataTrigger Binding="{Binding IsSelected, RelativeSource={RelativeSource AncestorType={x:Type ListBoxItem}}}" Value="True">
+        <Setter Property="Visibility" Value="Visible" />
+      </DataTrigger>
+    </Style.Triggers>
+  </Style>
+
+  <Style x:Key="SnapshotTimelineCardStyle" TargetType="{x:Type Border}">
+    <Setter Property="Background" Value="{DynamicResource SurfaceBrush}" />
+    <Setter Property="BorderBrush" Value="{DynamicResource DividerBrush}" />
+    <Setter Property="BorderThickness" Value="1" />
+    <Setter Property="CornerRadius" Value="8" />
+    <Setter Property="Padding" Value="16,13,16,14" />
+    <Setter Property="SnapsToDevicePixels" Value="True" />
+    <Style.Triggers>
+      <DataTrigger Binding="{Binding IsMouseOver, RelativeSource={RelativeSource AncestorType={x:Type ListBoxItem}}}" Value="True">
+        <Setter Property="Background" Value="{DynamicResource SurfaceAltBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource StrongDividerBrush}" />
+      </DataTrigger>
+      <DataTrigger Binding="{Binding IsSelected, RelativeSource={RelativeSource AncestorType={x:Type ListBoxItem}}}" Value="True">
+        <Setter Property="Background" Value="{DynamicResource SelectedBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+      </DataTrigger>
+    </Style.Triggers>
+  </Style>
+
+  <!-- Drawn outside the card so selection never reflows the card's content. -->
+  <Style x:Key="SnapshotTimelineSelectionRingStyle" TargetType="{x:Type Border}">
+    <Setter Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+    <Setter Property="BorderThickness" Value="1.4" />
+    <Setter Property="CornerRadius" Value="9.4" />
+    <Setter Property="Margin" Value="-1.4" />
+    <Setter Property="IsHitTestVisible" Value="False" />
+    <Setter Property="SnapsToDevicePixels" Value="True" />
+    <Setter Property="Visibility" Value="Collapsed" />
+    <Style.Triggers>
+      <DataTrigger Binding="{Binding IsSelected, RelativeSource={RelativeSource AncestorType={x:Type ListBoxItem}}}" Value="True">
+        <Setter Property="Visibility" Value="Visible" />
+      </DataTrigger>
+      <!-- Selection alone is an accent ring; keyboard focus thickens it into the focus colour. -->
+      <MultiDataTrigger>
+        <MultiDataTrigger.Conditions>
+          <Condition Binding="{Binding IsSelected, RelativeSource={RelativeSource AncestorType={x:Type ListBoxItem}}}" Value="True" />
+          <Condition Binding="{Binding IsKeyboardFocusWithin, RelativeSource={RelativeSource AncestorType={x:Type ListBox}}}" Value="True" />
+        </MultiDataTrigger.Conditions>
+        <Setter Property="Visibility" Value="Visible" />
+        <Setter Property="BorderBrush" Value="{DynamicResource FocusBrush}" />
+        <Setter Property="BorderThickness" Value="2.2" />
+        <Setter Property="CornerRadius" Value="10.6" />
+        <Setter Property="Margin" Value="-2.6" />
+      </MultiDataTrigger>
+    </Style.Triggers>
+  </Style>
+
+  <Style x:Key="SnapshotDiagnosticBorderStyle" TargetType="{x:Type Border}">
+    <Setter Property="Margin" Value="0,11,0,0" />
+    <Setter Property="Padding" Value="11,7,11,8" />
+    <Setter Property="CornerRadius" Value="6" />
+    <Setter Property="BorderThickness" Value="3,0,0,0" />
+    <Setter Property="SnapsToDevicePixels" Value="True" />
+    <Setter Property="Background" Value="{DynamicResource WarningSoftBrush}" />
+    <Setter Property="BorderBrush" Value="{DynamicResource WarningBrush}" />
+    <Style.Triggers>
+      <DataTrigger Binding="{Binding Status.Tone}" Value="Critical">
+        <Setter Property="Background" Value="{DynamicResource DangerSoftBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource DangerBrush}" />
+      </DataTrigger>
+      <DataTrigger Binding="{Binding Status.Tone}" Value="Neutral">
+        <Setter Property="Background" Value="{DynamicResource SurfaceAltBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource StrongDividerBrush}" />
+      </DataTrigger>
+    </Style.Triggers>
+  </Style>
+
+  <Style x:Key="SnapshotDiagnosticTextStyle" TargetType="{x:Type TextBlock}">
+    <Setter Property="FontFamily" Value="{DynamicResource ApplicationFont}" />
+    <Setter Property="FontSize" Value="12" />
+    <Setter Property="TextWrapping" Value="Wrap" />
+    <Setter Property="Foreground" Value="{DynamicResource WarningTextBrush}" />
+    <Style.Triggers>
+      <DataTrigger Binding="{Binding Status.Tone}" Value="Critical">
+        <Setter Property="Foreground" Value="{DynamicResource DangerTextBrush}" />
+      </DataTrigger>
+      <DataTrigger Binding="{Binding Status.Tone}" Value="Neutral">
+        <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+      </DataTrigger>
+    </Style.Triggers>
+  </Style>
+
+  <DataTemplate x:Key="SnapshotEventRowTemplate" DataType="{x:Type vm:SnapshotEventViewModel}">
+    <Grid Margin="0,0,0,10">
+      <Grid.ColumnDefinitions>
+        <ColumnDefinition Width="48" />
+        <ColumnDefinition Width="*" />
+      </Grid.ColumnDefinitions>
+
+      <Grid Grid.Column="0" Width="16" Height="16" HorizontalAlignment="Left"
+            VerticalAlignment="Top" Margin="16,18,0,0">
+        <!-- Opaque backing so the continuous rail reads as passing behind the node. -->
+        <Ellipse Fill="{DynamicResource WindowBackgroundBrush}" Margin="-3" />
+        <Ellipse Style="{StaticResource SnapshotTimelineNodeRingStyle}" />
+        <Ellipse Style="{StaticResource SnapshotTimelineNodeHaloStyle}" />
+      </Grid>
+
+      <Grid Grid.Column="1">
+        <Border Style="{StaticResource SnapshotTimelineCardStyle}">
+          <StackPanel>
+            <Grid>
+              <Grid.ColumnDefinitions>
+                <ColumnDefinition Width="*" />
+                <ColumnDefinition Width="Auto" />
+              </Grid.ColumnDefinitions>
+              <TextBlock Text="{Binding DisplayName}"
+                         FontSize="14" FontWeight="SemiBold"
+                         Foreground="{DynamicResource TextBrush}"
+                         TextTrimming="CharacterEllipsis"
+                         VerticalAlignment="Center" />
+              <ContentPresenter Grid.Column="1" Margin="14,0,0,0"
+                                Content="{Binding Status}"
+                                ContentTemplate="{StaticResource SnapshotEventStatusPillTemplate}" />
+            </Grid>
+
+            <TextBlock Text="{Binding CreatedDisplay}"
+                       Margin="0,4,0,0" FontSize="12.5"
+                       Foreground="{DynamicResource MutedTextBrush}"
+                       TextTrimming="CharacterEllipsis" />
+
+            <TextBlock Text="{Binding MetaDisplay}"
+                       Visibility="{Binding HasMeta, Converter={StaticResource BooleanToVisibilityConverter}}"
+                       Margin="0,3,0,0" FontSize="11.5"
+                       Foreground="{DynamicResource MutedTextBrush}"
+                       TextTrimming="CharacterEllipsis" />
+
+            <Border Style="{StaticResource SnapshotDiagnosticBorderStyle}"
+                    Visibility="{Binding HasDiagnostic, Converter={StaticResource BooleanToVisibilityConverter}}">
+              <TextBlock Text="{Binding DiagnosticReason}"
+                         Style="{StaticResource SnapshotDiagnosticTextStyle}" />
+            </Border>
+          </StackPanel>
+        </Border>
+        <Border Style="{StaticResource SnapshotTimelineSelectionRingStyle}" />
+      </Grid>
+    </Grid>
+  </DataTemplate>
+</ResourceDictionary>
diff --git a/src/WinRestoreKit.Wpf/Services/CompareDialogService.cs b/src/WinRestoreKit.Wpf/Services/CompareDialogService.cs
new file mode 100644
index 0000000..73b854b
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/CompareDialogService.cs
@@ -0,0 +1,19 @@
+using System.Windows;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal sealed class CompareDialogService : ICompareDialogService
+    {
+        public bool ConfirmDiscardRestoreSet(Window owner, SnapshotEvent current, SnapshotEvent incoming)
+            => MessageBox.Show(owner,
+                "Changing from \"" + current.DisplayName + "\" to \"" + incoming.DisplayName +
+                "\" clears the selected restore modules. Change snapshot?",
+                "Change snapshot", MessageBoxButton.YesNo, MessageBoxImage.Warning,
+                MessageBoxResult.No) == MessageBoxResult.Yes;
+
+        public void ShowSnapshotDiagnostic(Window owner, SnapshotEvent snapshot)
+            => MessageBox.Show(owner, snapshot.DiagnosticReason, "Snapshot diagnostic",
+                MessageBoxButton.OK, MessageBoxImage.Error);
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/ExternalLinkService.cs b/src/WinRestoreKit.Wpf/Services/ExternalLinkService.cs
new file mode 100644
index 0000000..d026a07
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/ExternalLinkService.cs
@@ -0,0 +1,9 @@
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal sealed class ExternalLinkService : IExternalLinkService
+    {
+        public void Open(string url) => Utils.OpenUrl(url);
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/ICompareDialogService.cs b/src/WinRestoreKit.Wpf/Services/ICompareDialogService.cs
new file mode 100644
index 0000000..1962eb6
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/ICompareDialogService.cs
@@ -0,0 +1,11 @@
+using System.Windows;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal interface ICompareDialogService
+    {
+        bool ConfirmDiscardRestoreSet(Window owner, SnapshotEvent current, SnapshotEvent incoming);
+        void ShowSnapshotDiagnostic(Window owner, SnapshotEvent snapshot);
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/IExternalLinkService.cs b/src/WinRestoreKit.Wpf/Services/IExternalLinkService.cs
new file mode 100644
index 0000000..be2b176
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/IExternalLinkService.cs
@@ -0,0 +1,7 @@
+namespace WinRestoreKit.Wpf.Services
+{
+    internal interface IExternalLinkService
+    {
+        void Open(string url);
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/IRunDialogService.cs b/src/WinRestoreKit.Wpf/Services/IRunDialogService.cs
new file mode 100644
index 0000000..83cd6db
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/IRunDialogService.cs
@@ -0,0 +1,12 @@
+using System.Collections.Generic;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal interface IRunDialogService
+    {
+        IReadOnlyList<string> ShowRestoreConsent(RestorePlan plan);
+        bool ConfirmSnapshotOverride(string text, string caption);
+        void ShowPlanCompositionError(string text, string caption);
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/IRunPresentation.cs b/src/WinRestoreKit.Wpf/Services/IRunPresentation.cs
new file mode 100644
index 0000000..27ed139
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/IRunPresentation.cs
@@ -0,0 +1,15 @@
+using System.Collections.Generic;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal interface IRunPresentation
+    {
+        void SetProgressText(string text);
+        void SetProgressPercent(int percent);
+        void SetProgressDetail(string groupInfo, string elapsed, string remaining, string throughput,
+                               long bytesWritten, int errors, int warnings);
+        void ShowSummary(RunSummary summary, string caption, IReadOnlyList<ModuleOutcome> outcomes);
+        void SetExplorerRestartVisible(bool visible);
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/ISystemThemeDetector.cs b/src/WinRestoreKit.Wpf/Services/ISystemThemeDetector.cs
new file mode 100644
index 0000000..62b988a
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/ISystemThemeDetector.cs
@@ -0,0 +1,7 @@
+namespace WinRestoreKit.Wpf.Services
+{
+    internal interface ISystemThemeDetector
+    {
+        bool IsDarkAppsTheme();
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/IThemeService.cs b/src/WinRestoreKit.Wpf/Services/IThemeService.cs
new file mode 100644
index 0000000..c40f547
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/IThemeService.cs
@@ -0,0 +1,13 @@
+using System;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal interface IThemeService : IDisposable
+    {
+        ThemeMode Mode { get; }
+        ThemeMode EffectiveMode { get; }
+        event EventHandler ThemeChanged;
+        void SetMode(ThemeMode mode);
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/IWpfDialogService.cs b/src/WinRestoreKit.Wpf/Services/IWpfDialogService.cs
new file mode 100644
index 0000000..9df872b
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/IWpfDialogService.cs
@@ -0,0 +1,10 @@
+namespace WinRestoreKit.Wpf.Services
+{
+    internal interface IWpfDialogService
+    {
+        void ShowInformation(string text, string caption);
+        void ShowWarning(string text, string caption);
+        void ShowError(string text, string caption);
+        bool Confirm(string text, string caption);
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/RestoreRunDialogService.cs b/src/WinRestoreKit.Wpf/Services/RestoreRunDialogService.cs
new file mode 100644
index 0000000..f848222
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/RestoreRunDialogService.cs
@@ -0,0 +1,31 @@
+using System;
+using System.Collections.Generic;
+using System.Windows;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Views.Dialogs;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal sealed class RestoreRunDialogService : IRunDialogService
+    {
+        private readonly Window owner;
+
+        internal RestoreRunDialogService(Window owner)
+        {
+            this.owner = owner ?? throw new ArgumentNullException(nameof(owner));
+        }
+
+        public IReadOnlyList<string> ShowRestoreConsent(RestorePlan plan)
+        {
+            RestoreConsentDialog dialog = RestoreConsentDialog.Create(owner, plan);
+            return dialog.ShowDialog() == true ? dialog.ConsentedProcessNames : null;
+        }
+
+        public bool ConfirmSnapshotOverride(string text, string caption)
+            => MessageBox.Show(owner, text, caption, MessageBoxButton.YesNo,
+                MessageBoxImage.Warning, MessageBoxResult.No) == MessageBoxResult.Yes;
+
+        public void ShowPlanCompositionError(string text, string caption)
+            => MessageBox.Show(owner, text, caption, MessageBoxButton.OK, MessageBoxImage.Error);
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/WindowsThemeDetector.cs b/src/WinRestoreKit.Wpf/Services/WindowsThemeDetector.cs
new file mode 100644
index 0000000..8b2a7cf
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/WindowsThemeDetector.cs
@@ -0,0 +1,27 @@
+using System;
+using Microsoft.Win32;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal sealed class WindowsThemeDetector : ISystemThemeDetector
+    {
+        private const string PersonalizeKeyPath =
+            @"Software\Microsoft\Windows\CurrentVersion\Themes\Personalize";
+        private const string AppsUseLightThemeValueName = "AppsUseLightTheme";
+
+        public bool IsDarkAppsTheme()
+        {
+            try
+            {
+                using (RegistryKey key = Registry.CurrentUser.OpenSubKey(PersonalizeKeyPath))
+                {
+                    return key?.GetValue(AppsUseLightThemeValueName) is int value && value == 0;
+                }
+            }
+            catch (Exception)
+            {
+                return false;
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/WpfAppRestoreDialog.cs b/src/WinRestoreKit.Wpf/Services/WpfAppRestoreDialog.cs
new file mode 100644
index 0000000..24a7478
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/WpfAppRestoreDialog.cs
@@ -0,0 +1,47 @@
+using Conf;
+using System;
+using System.Windows;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Views;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal sealed class WpfAppRestoreDialog
+    {
+        private readonly SnapshotEventCatalog catalog;
+
+        internal WpfAppRestoreDialog(SnapshotEventCatalog catalog)
+            => this.catalog = catalog ?? throw new ArgumentNullException(nameof(catalog));
+
+        internal static void Register(SnapshotEventCatalog catalog)
+        {
+            var dialog = new WpfAppRestoreDialog(catalog);
+            AppStoreApps.RestoreDialog = CreateCallback(dialog.Show);
+        }
+
+        internal static Action<string, object> CreateCallback(Action<Window, string> show)
+        {
+            if (show == null)
+                throw new ArgumentNullException(nameof(show));
+
+            return (path, owner) =>
+            {
+                if (owner is not Window window || !window.IsLoaded || !window.IsVisible
+                    || window.Dispatcher.HasShutdownStarted || window.Dispatcher.HasShutdownFinished)
+                    return;
+
+                Action open = () => show(window, path);
+                if (window.Dispatcher.CheckAccess())
+                    open();
+                else
+                    window.Dispatcher.Invoke(open);
+            };
+        }
+
+        internal void Show(Window owner, string payloadPath)
+        {
+            var dialog = new AppRestoreDialog(payloadPath, catalog.Read()) { Owner = owner };
+            dialog.ShowDialog();
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/WpfDialogService.cs b/src/WinRestoreKit.Wpf/Services/WpfDialogService.cs
new file mode 100644
index 0000000..1d5f176
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/WpfDialogService.cs
@@ -0,0 +1,60 @@
+using System;
+using System.Windows;
+using System.Windows.Threading;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal sealed class WpfDialogService : IWpfDialogService
+    {
+        private readonly Dispatcher dispatcher;
+        private readonly Func<Window> ownerProvider;
+
+        internal WpfDialogService(Dispatcher dispatcher, Func<Window> ownerProvider)
+        {
+            this.dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher));
+            this.ownerProvider = ownerProvider ?? throw new ArgumentNullException(nameof(ownerProvider));
+        }
+
+        public void ShowInformation(string text, string caption)
+            => Show(text, caption, MessageBoxButton.OK, MessageBoxImage.Information);
+
+        public void ShowWarning(string text, string caption)
+            => Show(text, caption, MessageBoxButton.OK, MessageBoxImage.Warning);
+
+        public void ShowError(string text, string caption)
+            => Show(text, caption, MessageBoxButton.OK, MessageBoxImage.Error);
+
+        public bool Confirm(string text, string caption)
+        {
+            return dispatcher.CheckAccess()
+                ? ConfirmOnDispatcher(text, caption)
+                : dispatcher.Invoke(() => ConfirmOnDispatcher(text, caption));
+        }
+
+        private void Show(string text, string caption, MessageBoxButton buttons, MessageBoxImage image)
+        {
+            if (dispatcher.CheckAccess())
+                ShowOnDispatcher(text, caption, buttons, image);
+            else
+                dispatcher.Invoke(() => ShowOnDispatcher(text, caption, buttons, image));
+        }
+
+        private void ShowOnDispatcher(string text, string caption, MessageBoxButton buttons,
+                                      MessageBoxImage image)
+        {
+            Window owner = ownerProvider();
+            if (owner == null || !owner.IsLoaded)
+                return;
+
+            MessageBox.Show(owner, text, caption, buttons, image);
+        }
+
+        private bool ConfirmOnDispatcher(string text, string caption)
+        {
+            Window owner = ownerProvider();
+            return owner != null && owner.IsLoaded &&
+                   MessageBox.Show(owner, text, caption, MessageBoxButton.YesNo,
+                                   MessageBoxImage.Information) == MessageBoxResult.Yes;
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/WpfDispatcher.cs b/src/WinRestoreKit.Wpf/Services/WpfDispatcher.cs
new file mode 100644
index 0000000..01dd2a3
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/WpfDispatcher.cs
@@ -0,0 +1,41 @@
+using System;
+using System.Windows.Threading;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal sealed class WpfDispatcher
+    {
+        private readonly Dispatcher dispatcher;
+
+        internal WpfDispatcher(Dispatcher dispatcher)
+        {
+            this.dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher));
+        }
+
+        internal bool CheckAccess() => dispatcher.CheckAccess();
+
+        internal void Invoke(Action action)
+        {
+            if (action == null)
+                throw new ArgumentNullException(nameof(action));
+
+            dispatcher.Invoke(action);
+        }
+
+        internal T Invoke<T>(Func<T> action)
+        {
+            if (action == null)
+                throw new ArgumentNullException(nameof(action));
+
+            return dispatcher.Invoke(action);
+        }
+
+        internal void BeginInvoke(Action action)
+        {
+            if (action == null)
+                throw new ArgumentNullException(nameof(action));
+
+            dispatcher.BeginInvoke(action);
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/WpfLogSink.cs b/src/WinRestoreKit.Wpf/Services/WpfLogSink.cs
new file mode 100644
index 0000000..2fdb48c
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/WpfLogSink.cs
@@ -0,0 +1,49 @@
+using System;
+using System.Threading;
+using System.Windows.Threading;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal sealed class WpfLogSink : ILogSink, IDisposable
+    {
+        private readonly Dispatcher dispatcher;
+        private readonly Action<string> append;
+        private readonly Action clear;
+        private int disposed;
+
+        internal WpfLogSink(Dispatcher dispatcher, Action<string> append, Action clear)
+        {
+            this.dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher));
+            this.append = append ?? throw new ArgumentNullException(nameof(append));
+            this.clear = clear ?? throw new ArgumentNullException(nameof(clear));
+        }
+
+        public void Append(string text) => Post(() => append(text ?? string.Empty));
+
+        public void Clear() => Post(clear);
+
+        public void Dispose() => Interlocked.Exchange(ref disposed, 1);
+
+        private void Post(Action action)
+        {
+            if (Volatile.Read(ref disposed) != 0 || dispatcher.HasShutdownStarted ||
+                dispatcher.HasShutdownFinished)
+            {
+                return;
+            }
+
+            try
+            {
+                dispatcher.BeginInvoke(() =>
+                {
+                    if (Volatile.Read(ref disposed) == 0)
+                        action();
+                });
+            }
+            catch (InvalidOperationException)
+            {
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/WpfRunUi.cs b/src/WinRestoreKit.Wpf/Services/WpfRunUi.cs
new file mode 100644
index 0000000..e222e28
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/WpfRunUi.cs
@@ -0,0 +1,138 @@
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Windows;
+using System.Windows.Threading;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal sealed class WpfRunUi : IRunUi
+    {
+        private readonly Dispatcher dispatcher;
+        private readonly IRunPresentation presentation;
+        private readonly IRunDialogService dialogs;
+        private readonly Func<Window> ownerProvider;
+        private Window observedOwner;
+        private bool observedOwnerClosing;
+
+        internal WpfRunUi(Dispatcher dispatcher, IRunPresentation presentation,
+                          IRunDialogService dialogs, Func<Window> ownerProvider)
+        {
+            this.dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher));
+            this.presentation = presentation ?? throw new ArgumentNullException(nameof(presentation));
+            this.dialogs = dialogs ?? throw new ArgumentNullException(nameof(dialogs));
+            this.ownerProvider = ownerProvider ?? throw new ArgumentNullException(nameof(ownerProvider));
+        }
+
+        void IRunUi.SetProgressText(string text)
+            => DispatchPresentation(() => presentation.SetProgressText(text));
+
+        void IRunUi.SetProgressPercent(int percent)
+            => DispatchPresentation(() => presentation.SetProgressPercent(percent));
+
+        void IRunUi.SetProgressDetail(string groupInfo, string elapsed, string remaining, string throughput,
+                                      long bytesWritten, int errors, int warnings)
+            => DispatchPresentation(() => presentation.SetProgressDetail(
+                groupInfo, elapsed, remaining, throughput, bytesWritten, errors, warnings));
+
+        void IRunUi.ShowSummary(RunSummary summary, string caption, IReadOnlyList<ModuleOutcome> outcomes)
+            => InvokePresentation(() => presentation.ShowSummary(summary, caption, outcomes));
+
+        IReadOnlyList<string> IRunUi.ShowConsentDialog(RestorePlan plan)
+            => InvokeDialog(() => dialogs.ShowRestoreConsent(plan));
+
+        object IRunUi.DialogOwner
+            => InvokeDialog(() => (object)GetLiveOwner());
+
+        bool IRunUi.ConfirmSnapshotOverride(string text, string caption)
+            => InvokeDialog(() => dialogs.ConfirmSnapshotOverride(text, caption));
+
+        void IRunUi.ShowPlanCompositionError(string text, string caption)
+            => InvokeDialog(() => dialogs.ShowPlanCompositionError(text, caption));
+
+        void IRunUi.SetExplorerRestartVisible(bool visible)
+            => DispatchPresentation(() => presentation.SetExplorerRestartVisible(visible));
+
+        private void DispatchPresentation(Action action)
+        {
+            if (dispatcher.CheckAccess())
+            {
+                action();
+                return;
+            }
+
+            try
+            {
+                dispatcher.BeginInvoke(action);
+            }
+            catch (InvalidOperationException)
+            {
+            }
+        }
+
+        private void InvokePresentation(Action action)
+        {
+            if (dispatcher.CheckAccess())
+                action();
+            else
+                dispatcher.Invoke(action);
+        }
+
+        private void InvokeDialog(Action action)
+        {
+            if (dispatcher.CheckAccess())
+                action();
+            else
+                dispatcher.Invoke(action);
+        }
+
+        private T InvokeDialog<T>(Func<T> action)
+            => dispatcher.CheckAccess() ? action() : dispatcher.Invoke(action);
+
+        private Window GetLiveOwner()
+        {
+            Window owner = ownerProvider();
+            if (!ReferenceEquals(owner, observedOwner))
+            {
+                if (observedOwner != null)
+                {
+                    observedOwner.Closing -= OwnerClosing;
+                    observedOwner.Closed -= OwnerClosed;
+                }
+
+                observedOwner = owner;
+                observedOwnerClosing = false;
+                if (observedOwner != null)
+                {
+                    observedOwner.Closing += OwnerClosing;
+                    observedOwner.Closed += OwnerClosed;
+                }
+            }
+
+            return observedOwner != null && !observedOwnerClosing && observedOwner.IsLoaded &&
+                   observedOwner.IsVisible
+                ? observedOwner
+                : null;
+        }
+
+        private void OwnerClosing(object sender, CancelEventArgs e)
+        {
+            observedOwnerClosing = true;
+            try
+            {
+                dispatcher.BeginInvoke(new Action(() =>
+                {
+                    if (ReferenceEquals(sender, observedOwner) && observedOwner.IsVisible)
+                        observedOwnerClosing = false;
+                }));
+            }
+            catch (InvalidOperationException)
+            {
+            }
+        }
+
+        private void OwnerClosed(object sender, EventArgs e)
+            => observedOwnerClosing = true;
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/WpfThemeService.cs b/src/WinRestoreKit.Wpf/Services/WpfThemeService.cs
new file mode 100644
index 0000000..6ce422a
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/WpfThemeService.cs
@@ -0,0 +1,81 @@
+using System;
+using System.Windows;
+using Microsoft.Win32;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal sealed class WpfThemeService : IThemeService
+    {
+        private readonly ResourceDictionary resources;
+        private readonly IThemeSettings settings;
+        private readonly ISystemThemeDetector systemTheme;
+        private ResourceDictionary activeThemeDictionary;
+        private bool disposed;
+
+        internal WpfThemeService(ResourceDictionary resources, IThemeSettings settings,
+                                 ISystemThemeDetector systemTheme)
+        {
+            this.resources = resources ?? throw new ArgumentNullException(nameof(resources));
+            this.settings = settings ?? throw new ArgumentNullException(nameof(settings));
+            this.systemTheme = systemTheme ?? throw new ArgumentNullException(nameof(systemTheme));
+
+            Mode = settings.ReadThemeMode();
+            SystemEvents.UserPreferenceChanged += SystemEvents_UserPreferenceChanged;
+            ApplyEffectiveMode();
+        }
+
+        public ThemeMode Mode { get; private set; }
+
+        public ThemeMode EffectiveMode { get; private set; }
+
+        public event EventHandler ThemeChanged;
+
+        public void SetMode(ThemeMode mode)
+        {
+            Mode = mode;
+            settings.WriteThemeMode(mode);
+            ApplyEffectiveMode();
+        }
+
+        public void Dispose()
+        {
+            if (disposed)
+                return;
+
+            SystemEvents.UserPreferenceChanged -= SystemEvents_UserPreferenceChanged;
+            disposed = true;
+        }
+
+        private void SystemEvents_UserPreferenceChanged(object sender, UserPreferenceChangedEventArgs e)
+        {
+            if (Mode == ThemeMode.FollowSystem)
+                ApplyEffectiveMode();
+        }
+
+        private void ApplyEffectiveMode()
+        {
+            ThemeMode effectiveMode = Mode == ThemeMode.FollowSystem
+                ? (systemTheme.IsDarkAppsTheme() ? ThemeMode.Dark : ThemeMode.Light)
+                : Mode;
+
+            if (effectiveMode != ThemeMode.Dark)
+                effectiveMode = ThemeMode.Light;
+
+            ResourceDictionary nextThemeDictionary = (ResourceDictionary)Application.LoadComponent(
+                new Uri(
+                    effectiveMode == ThemeMode.Dark
+                        ? "/WinRestoreKit.Wpf;component/Themes/Dark.xaml"
+                        : "/WinRestoreKit.Wpf;component/Themes/Light.xaml",
+                    UriKind.Relative));
+
+            if (activeThemeDictionary != null)
+                resources.MergedDictionaries.Remove(activeThemeDictionary);
+
+            resources.MergedDictionaries.Add(nextThemeDictionary);
+            activeThemeDictionary = nextThemeDictionary;
+            EffectiveMode = effectiveMode;
+            ThemeChanged?.Invoke(this, EventArgs.Empty);
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Services/WpfUpdatePresenter.cs b/src/WinRestoreKit.Wpf/Services/WpfUpdatePresenter.cs
new file mode 100644
index 0000000..0b51869
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Services/WpfUpdatePresenter.cs
@@ -0,0 +1,62 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using DataHelper;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.Services
+{
+    internal sealed class WpfUpdatePresenter
+    {
+        private readonly IUpdateCheckService updates;
+        private readonly IWpfDialogService dialogs;
+        private readonly IExternalLinkService links;
+
+        internal WpfUpdatePresenter(IUpdateCheckService updates, IWpfDialogService dialogs,
+                                    IExternalLinkService links)
+        {
+            this.updates = updates ?? throw new ArgumentNullException(nameof(updates));
+            this.dialogs = dialogs ?? throw new ArgumentNullException(nameof(dialogs));
+            this.links = links ?? throw new ArgumentNullException(nameof(links));
+        }
+
+        internal async Task CheckAsync(string currentVersion, CancellationToken cancellationToken)
+        {
+            UpdateCheckResult result = await updates.CheckAsync(currentVersion, cancellationToken);
+            switch (result.Verdict)
+            {
+                case UpdateVerdict.CannotDetermineCurrentVersion:
+                    dialogs.ShowWarning(
+                        "The installed WinRestoreKit version could not be determined, so no update download can be offered.",
+                        "WinRestoreKit Update");
+                    return;
+                case UpdateVerdict.LatestVersionUnreadable:
+                    if (!string.IsNullOrWhiteSpace(result.ErrorMessage))
+                        dialogs.ShowError("Checking for WinRestoreKit updates failed.\n" + result.ErrorMessage,
+                                          "WinRestoreKit Update");
+                    else
+                        dialogs.ShowWarning(
+                            "Could not read the latest WinRestoreKit version number from the update file.",
+                            "WinRestoreKit Update");
+                    return;
+                case UpdateVerdict.UpToDate:
+                    dialogs.ShowInformation("No new WinRestoreKit updates are available.", "WinRestoreKit Update");
+                    return;
+                case UpdateVerdict.UpdateAvailable:
+                    if (dialogs.Confirm(
+                        "WinRestoreKit version " + result.LatestVersion +
+                        " is available.\nDo you want to open the download page?",
+                        "WinRestoreKit Update Available"))
+                    {
+                        links.Open(Data.Uri.URL_GITLATEST);
+                    }
+
+                    return;
+                default:
+                    throw new InvalidOperationException("The update result has an unknown verdict.");
+            }
+        }
+
+        internal void OpenReleaseNotes() => links.Open(Data.Uri.URL_GITLATEST);
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Themes/Controls.xaml b/src/WinRestoreKit.Wpf/Themes/Controls.xaml
new file mode 100644
index 0000000..67c38da
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Themes/Controls.xaml
@@ -0,0 +1,870 @@
+<ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+                    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
+  <!--
+    Shared visual contract for the WinRestoreKit WPF shell.
+
+    Themes/Light.xaml and Themes/Dark.xaml are merged into Application.Resources at
+    runtime by WpfThemeService, i.e. AFTER this dictionary. Every colour reference in
+    this file therefore MUST be DynamicResource. StaticResource is used only for
+    non-theme values that live in this dictionary (fonts, radii, nested styles).
+  -->
+
+  <!-- "Segoe UI Variable" alone does not resolve on Windows 11; the installed families are
+       the Display/Text/Small optical sizes. The fallback chain keeps text out of the Win32 default face. -->
+  <FontFamily x:Key="ApplicationFont">Segoe UI Variable Text, Segoe UI Variable, Segoe UI</FontFamily>
+  <FontFamily x:Key="DisplayFont">Segoe UI Variable Display, Segoe UI Variable, Segoe UI</FontFamily>
+
+  <CornerRadius x:Key="CardRadius">8</CornerRadius>
+  <CornerRadius x:Key="ControlRadius">6</CornerRadius>
+  <CornerRadius x:Key="PillRadius">10</CornerRadius>
+
+  <Style x:Key="VisibleFocusVisual" TargetType="{x:Type Control}">
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type Control}">
+          <Border BorderBrush="{DynamicResource FocusBrush}" BorderThickness="2"
+                  CornerRadius="{StaticResource ControlRadius}" Margin="-3"
+                  SnapsToDevicePixels="True" />
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <!-- ==================== Typography ==================== -->
+
+  <Style TargetType="{x:Type TextBlock}">
+    <Setter Property="FontFamily" Value="{StaticResource ApplicationFont}" />
+    <Setter Property="TextOptions.TextFormattingMode" Value="Ideal" />
+    <Setter Property="TextOptions.TextRenderingMode" Value="ClearType" />
+  </Style>
+
+  <Style x:Key="PageTitleStyle" TargetType="{x:Type TextBlock}" BasedOn="{StaticResource {x:Type TextBlock}}">
+    <Setter Property="FontFamily" Value="{StaticResource DisplayFont}" />
+    <Setter Property="FontSize" Value="24" />
+    <Setter Property="FontWeight" Value="SemiBold" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="TextWrapping" Value="Wrap" />
+  </Style>
+
+  <Style x:Key="SectionTitleStyle" TargetType="{x:Type TextBlock}" BasedOn="{StaticResource {x:Type TextBlock}}">
+    <Setter Property="FontSize" Value="15" />
+    <Setter Property="FontWeight" Value="SemiBold" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="TextWrapping" Value="Wrap" />
+  </Style>
+
+  <Style x:Key="BodyTextStyle" TargetType="{x:Type TextBlock}" BasedOn="{StaticResource {x:Type TextBlock}}">
+    <Setter Property="FontSize" Value="13" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="TextWrapping" Value="Wrap" />
+  </Style>
+
+  <Style x:Key="CaptionTextStyle" TargetType="{x:Type TextBlock}" BasedOn="{StaticResource {x:Type TextBlock}}">
+    <Setter Property="FontSize" Value="12" />
+    <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+    <Setter Property="TextWrapping" Value="Wrap" />
+  </Style>
+
+  <Style x:Key="FieldLabelStyle" TargetType="{x:Type TextBlock}" BasedOn="{StaticResource {x:Type TextBlock}}">
+    <Setter Property="FontSize" Value="12" />
+    <Setter Property="FontWeight" Value="SemiBold" />
+    <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+  </Style>
+
+  <Style x:Key="PillTextStyle" TargetType="{x:Type TextBlock}" BasedOn="{StaticResource {x:Type TextBlock}}">
+    <Setter Property="FontSize" Value="11" />
+    <Setter Property="FontWeight" Value="SemiBold" />
+    <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+    <Setter Property="VerticalAlignment" Value="Center" />
+  </Style>
+
+  <Style x:Key="TechnicalTextStyle" TargetType="{x:Type TextBlock}">
+    <Setter Property="FontFamily" Value="pack://application:,,,/Fonts/#IBM Plex Mono" />
+    <Setter Property="FontSize" Value="12" />
+    <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+    <Setter Property="TextWrapping" Value="Wrap" />
+  </Style>
+
+  <!-- ==================== Surfaces ==================== -->
+
+  <Style x:Key="CardBorderStyle" TargetType="{x:Type Border}">
+    <Setter Property="Background" Value="{DynamicResource SurfaceBrush}" />
+    <Setter Property="BorderBrush" Value="{DynamicResource DividerBrush}" />
+    <Setter Property="BorderThickness" Value="1" />
+    <Setter Property="CornerRadius" Value="{StaticResource CardRadius}" />
+    <Setter Property="Padding" Value="20" />
+    <Setter Property="SnapsToDevicePixels" Value="True" />
+  </Style>
+
+  <Style x:Key="SubtleBorderStyle" TargetType="{x:Type Border}">
+    <Setter Property="Background" Value="{DynamicResource SurfaceAltBrush}" />
+    <Setter Property="BorderBrush" Value="{DynamicResource DividerBrush}" />
+    <Setter Property="BorderThickness" Value="1" />
+    <Setter Property="CornerRadius" Value="{StaticResource ControlRadius}" />
+    <Setter Property="Padding" Value="12" />
+    <Setter Property="SnapsToDevicePixels" Value="True" />
+  </Style>
+
+  <Style x:Key="PillBorderStyle" TargetType="{x:Type Border}">
+    <Setter Property="Background" Value="{DynamicResource SubtleBrush}" />
+    <Setter Property="BorderBrush" Value="{DynamicResource DividerBrush}" />
+    <Setter Property="BorderThickness" Value="1" />
+    <Setter Property="CornerRadius" Value="{StaticResource PillRadius}" />
+    <Setter Property="Padding" Value="8,2,9,3" />
+    <Setter Property="HorizontalAlignment" Value="Left" />
+    <Setter Property="VerticalAlignment" Value="Center" />
+    <Setter Property="SnapsToDevicePixels" Value="True" />
+  </Style>
+
+  <Style TargetType="{x:Type Separator}">
+    <Setter Property="Height" Value="1" />
+    <Setter Property="Margin" Value="0" />
+    <Setter Property="Background" Value="{DynamicResource DividerBrush}" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type Separator}">
+          <Border Background="{TemplateBinding Background}" Height="1" SnapsToDevicePixels="True" />
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <Style TargetType="{x:Type ToolTip}">
+    <Setter Property="FontFamily" Value="{StaticResource ApplicationFont}" />
+    <Setter Property="FontSize" Value="12" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="HasDropShadow" Value="False" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type ToolTip}">
+          <Border Background="{DynamicResource SurfaceBrush}"
+                  BorderBrush="{DynamicResource StrongDividerBrush}"
+                  BorderThickness="1" CornerRadius="{StaticResource ControlRadius}"
+                  Padding="10,6" SnapsToDevicePixels="True">
+            <Border.Effect>
+              <DropShadowEffect BlurRadius="12" ShadowDepth="2" Direction="270" Opacity="0.20" Color="#FF000000" />
+            </Border.Effect>
+            <ContentPresenter />
+          </Border>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <!-- ==================== Buttons ==================== -->
+
+  <Style x:Key="BaseButtonStyle" TargetType="{x:Type Button}">
+    <Setter Property="FontFamily" Value="{StaticResource ApplicationFont}" />
+    <Setter Property="FontSize" Value="13" />
+    <Setter Property="FontWeight" Value="SemiBold" />
+    <Setter Property="Padding" Value="14,7" />
+    <Setter Property="MinWidth" Value="88" />
+    <Setter Property="MinHeight" Value="32" />
+    <Setter Property="BorderThickness" Value="1" />
+    <Setter Property="HorizontalContentAlignment" Value="Center" />
+    <Setter Property="VerticalContentAlignment" Value="Center" />
+    <Setter Property="SnapsToDevicePixels" Value="True" />
+    <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type Button}">
+          <Grid>
+            <Border x:Name="Fill"
+                    Background="{TemplateBinding Background}"
+                    BorderBrush="{TemplateBinding BorderBrush}"
+                    BorderThickness="{TemplateBinding BorderThickness}"
+                    CornerRadius="{StaticResource ControlRadius}"
+                    SnapsToDevicePixels="True">
+              <ContentPresenter Margin="{TemplateBinding Padding}"
+                                HorizontalAlignment="{TemplateBinding HorizontalContentAlignment}"
+                                VerticalAlignment="{TemplateBinding VerticalContentAlignment}"
+                                RecognizesAccessKey="True"
+                                SnapsToDevicePixels="True" />
+            </Border>
+            <Border x:Name="FocusRing"
+                    BorderBrush="{DynamicResource FocusBrush}" BorderThickness="2"
+                    CornerRadius="{StaticResource ControlRadius}" Margin="-3"
+                    Visibility="Collapsed" IsHitTestVisible="False" SnapsToDevicePixels="True" />
+          </Grid>
+          <ControlTemplate.Triggers>
+            <Trigger Property="IsKeyboardFocused" Value="True">
+              <Setter TargetName="FocusRing" Property="Visibility" Value="Visible" />
+            </Trigger>
+            <Trigger Property="IsEnabled" Value="False">
+              <Setter Property="Opacity" Value="0.45" />
+            </Trigger>
+          </ControlTemplate.Triggers>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <Style x:Key="PrimaryButtonStyle" TargetType="{x:Type Button}" BasedOn="{StaticResource BaseButtonStyle}">
+    <Setter Property="Background" Value="{DynamicResource AccentBrush}" />
+    <Setter Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+    <Setter Property="Foreground" Value="{DynamicResource OnAccentBrush}" />
+    <Style.Triggers>
+      <Trigger Property="IsMouseOver" Value="True">
+        <Setter Property="Background" Value="{DynamicResource AccentHoverBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource AccentHoverBrush}" />
+      </Trigger>
+      <Trigger Property="IsPressed" Value="True">
+        <Setter Property="Background" Value="{DynamicResource AccentPressedBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource AccentPressedBrush}" />
+      </Trigger>
+    </Style.Triggers>
+  </Style>
+
+  <Style x:Key="SecondaryButtonStyle" TargetType="{x:Type Button}" BasedOn="{StaticResource BaseButtonStyle}">
+    <Setter Property="Background" Value="{DynamicResource ControlBackgroundBrush}" />
+    <Setter Property="BorderBrush" Value="{DynamicResource ControlBorderBrush}" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Style.Triggers>
+      <Trigger Property="IsMouseOver" Value="True">
+        <Setter Property="Background" Value="{DynamicResource HoverBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource StrongDividerBrush}" />
+      </Trigger>
+      <Trigger Property="IsPressed" Value="True">
+        <Setter Property="Background" Value="{DynamicResource PressedBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource StrongDividerBrush}" />
+      </Trigger>
+    </Style.Triggers>
+  </Style>
+
+  <Style x:Key="SubtleButtonStyle" TargetType="{x:Type Button}" BasedOn="{StaticResource BaseButtonStyle}">
+    <Setter Property="Background" Value="Transparent" />
+    <Setter Property="BorderBrush" Value="Transparent" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="FontWeight" Value="Normal" />
+    <Setter Property="MinWidth" Value="0" />
+    <Style.Triggers>
+      <Trigger Property="IsMouseOver" Value="True">
+        <Setter Property="Background" Value="{DynamicResource HoverBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource DividerBrush}" />
+      </Trigger>
+      <Trigger Property="IsPressed" Value="True">
+        <Setter Property="Background" Value="{DynamicResource PressedBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource StrongDividerBrush}" />
+      </Trigger>
+    </Style.Triggers>
+  </Style>
+
+  <Style x:Key="DangerButtonStyle" TargetType="{x:Type Button}" BasedOn="{StaticResource BaseButtonStyle}">
+    <Setter Property="Background" Value="{DynamicResource DangerBrush}" />
+    <Setter Property="BorderBrush" Value="{DynamicResource DangerBrush}" />
+    <Setter Property="Foreground" Value="{DynamicResource OnDangerBrush}" />
+    <Style.Triggers>
+      <Trigger Property="IsMouseOver" Value="True">
+        <Setter Property="Background" Value="{DynamicResource DangerHoverBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource DangerHoverBrush}" />
+      </Trigger>
+      <Trigger Property="IsPressed" Value="True">
+        <Setter Property="Background" Value="{DynamicResource DangerPressedBrush}" />
+        <Setter Property="BorderBrush" Value="{DynamicResource DangerPressedBrush}" />
+      </Trigger>
+    </Style.Triggers>
+  </Style>
+
+  <!-- Any Button without an explicit Style still reads as a first-party Windows control. -->
+  <Style TargetType="{x:Type Button}" BasedOn="{StaticResource SecondaryButtonStyle}" />
+
+  <!-- ==================== Text input ==================== -->
+
+  <Style TargetType="{x:Type TextBox}">
+    <Setter Property="FontFamily" Value="{StaticResource ApplicationFont}" />
+    <Setter Property="FontSize" Value="13" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="Background" Value="{DynamicResource ControlBackgroundBrush}" />
+    <Setter Property="BorderBrush" Value="{DynamicResource ControlBorderBrush}" />
+    <Setter Property="BorderThickness" Value="1" />
+    <Setter Property="Padding" Value="10,6" />
+    <Setter Property="MinHeight" Value="32" />
+    <Setter Property="VerticalContentAlignment" Value="Center" />
+    <Setter Property="CaretBrush" Value="{DynamicResource TextBrush}" />
+    <Setter Property="SelectionBrush" Value="{DynamicResource AccentBrush}" />
+    <Setter Property="SelectionOpacity" Value="0.35" />
+    <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type TextBox}">
+          <Grid>
+            <Border x:Name="Root"
+                    Background="{TemplateBinding Background}"
+                    BorderBrush="{TemplateBinding BorderBrush}"
+                    BorderThickness="{TemplateBinding BorderThickness}"
+                    CornerRadius="{StaticResource ControlRadius}"
+                    SnapsToDevicePixels="True">
+              <ScrollViewer x:Name="PART_ContentHost"
+                            Margin="{TemplateBinding Padding}"
+                            Focusable="False"
+                            HorizontalScrollBarVisibility="Hidden"
+                            VerticalScrollBarVisibility="Hidden" />
+            </Border>
+            <Border x:Name="FocusRing"
+                    BorderBrush="{DynamicResource FocusBrush}" BorderThickness="2"
+                    CornerRadius="{StaticResource ControlRadius}" Margin="-3"
+                    Visibility="Collapsed" IsHitTestVisible="False" SnapsToDevicePixels="True" />
+          </Grid>
+          <ControlTemplate.Triggers>
+            <Trigger Property="IsMouseOver" Value="True">
+              <Setter TargetName="Root" Property="BorderBrush" Value="{DynamicResource StrongDividerBrush}" />
+            </Trigger>
+            <Trigger Property="IsKeyboardFocusWithin" Value="True">
+              <Setter TargetName="Root" Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+              <Setter TargetName="FocusRing" Property="Visibility" Value="Visible" />
+            </Trigger>
+            <Trigger Property="IsEnabled" Value="False">
+              <Setter Property="Opacity" Value="0.5" />
+            </Trigger>
+          </ControlTemplate.Triggers>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <Style TargetType="{x:Type Label}">
+    <Setter Property="FontFamily" Value="{StaticResource ApplicationFont}" />
+    <Setter Property="FontSize" Value="13" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="Padding" Value="0,0,0,4" />
+    <Setter Property="FocusVisualStyle" Value="{StaticResource VisibleFocusVisual}" />
+  </Style>
+
+  <!-- ==================== Selection controls ==================== -->
+
+  <Style TargetType="{x:Type CheckBox}">
+    <Setter Property="FontFamily" Value="{StaticResource ApplicationFont}" />
+    <Setter Property="FontSize" Value="13" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="Padding" Value="10,0,0,0" />
+    <Setter Property="MinHeight" Value="24" />
+    <Setter Property="VerticalContentAlignment" Value="Center" />
+    <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type CheckBox}">
+          <Grid Background="Transparent">
+            <Grid.ColumnDefinitions>
+              <ColumnDefinition Width="Auto" />
+              <ColumnDefinition Width="*" />
+            </Grid.ColumnDefinitions>
+            <Grid Width="18" Height="18" VerticalAlignment="Center">
+              <Border x:Name="Box"
+                      Background="{DynamicResource ControlBackgroundBrush}"
+                      BorderBrush="{DynamicResource StrongDividerBrush}"
+                      BorderThickness="1" CornerRadius="4" SnapsToDevicePixels="True" />
+              <Path x:Name="Check" Visibility="Collapsed"
+                    Data="M 4,9.2 L 7.4,12.6 L 14,5.6"
+                    Stroke="{DynamicResource OnAccentBrush}" StrokeThickness="1.9"
+                    StrokeStartLineCap="Round" StrokeEndLineCap="Round" StrokeLineJoin="Round" />
+              <Rectangle x:Name="Mixed" Visibility="Collapsed"
+                         Width="9" Height="2" RadiusX="1" RadiusY="1"
+                         Fill="{DynamicResource OnAccentBrush}" />
+              <Border x:Name="FocusRing"
+                      BorderBrush="{DynamicResource FocusBrush}" BorderThickness="2"
+                      CornerRadius="7" Margin="-4" Visibility="Collapsed"
+                      IsHitTestVisible="False" SnapsToDevicePixels="True" />
+            </Grid>
+            <ContentPresenter Grid.Column="1"
+                              Margin="{TemplateBinding Padding}"
+                              VerticalAlignment="{TemplateBinding VerticalContentAlignment}"
+                              RecognizesAccessKey="True" />
+          </Grid>
+          <ControlTemplate.Triggers>
+            <Trigger Property="IsChecked" Value="True">
+              <Setter TargetName="Box" Property="Background" Value="{DynamicResource AccentBrush}" />
+              <Setter TargetName="Box" Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+              <Setter TargetName="Check" Property="Visibility" Value="Visible" />
+            </Trigger>
+            <Trigger Property="IsChecked" Value="{x:Null}">
+              <Setter TargetName="Box" Property="Background" Value="{DynamicResource AccentBrush}" />
+              <Setter TargetName="Box" Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+              <Setter TargetName="Mixed" Property="Visibility" Value="Visible" />
+            </Trigger>
+            <Trigger Property="IsMouseOver" Value="True">
+              <Setter TargetName="Box" Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+            </Trigger>
+            <Trigger Property="IsKeyboardFocused" Value="True">
+              <Setter TargetName="FocusRing" Property="Visibility" Value="Visible" />
+            </Trigger>
+            <Trigger Property="IsEnabled" Value="False">
+              <Setter Property="Opacity" Value="0.45" />
+            </Trigger>
+          </ControlTemplate.Triggers>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <Style TargetType="{x:Type RadioButton}">
+    <Setter Property="FontFamily" Value="{StaticResource ApplicationFont}" />
+    <Setter Property="FontSize" Value="13" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="Padding" Value="10,0,0,0" />
+    <Setter Property="MinHeight" Value="24" />
+    <Setter Property="VerticalContentAlignment" Value="Center" />
+    <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type RadioButton}">
+          <Grid Background="Transparent">
+            <Grid.ColumnDefinitions>
+              <ColumnDefinition Width="Auto" />
+              <ColumnDefinition Width="*" />
+            </Grid.ColumnDefinitions>
+            <Grid Width="18" Height="18" VerticalAlignment="Center">
+              <Ellipse x:Name="Ring"
+                       Fill="{DynamicResource ControlBackgroundBrush}"
+                       Stroke="{DynamicResource StrongDividerBrush}" StrokeThickness="1" />
+              <Ellipse x:Name="Dot" Width="8" Height="8" Visibility="Collapsed"
+                       Fill="{DynamicResource OnAccentBrush}" />
+              <Border x:Name="FocusRing"
+                      BorderBrush="{DynamicResource FocusBrush}" BorderThickness="2"
+                      CornerRadius="11" Margin="-4" Visibility="Collapsed"
+                      IsHitTestVisible="False" SnapsToDevicePixels="True" />
+            </Grid>
+            <ContentPresenter Grid.Column="1"
+                              Margin="{TemplateBinding Padding}"
+                              VerticalAlignment="{TemplateBinding VerticalContentAlignment}"
+                              RecognizesAccessKey="True" />
+          </Grid>
+          <ControlTemplate.Triggers>
+            <Trigger Property="IsChecked" Value="True">
+              <Setter TargetName="Ring" Property="Fill" Value="{DynamicResource AccentBrush}" />
+              <Setter TargetName="Ring" Property="Stroke" Value="{DynamicResource AccentBrush}" />
+              <Setter TargetName="Dot" Property="Visibility" Value="Visible" />
+            </Trigger>
+            <Trigger Property="IsMouseOver" Value="True">
+              <Setter TargetName="Ring" Property="Stroke" Value="{DynamicResource AccentBrush}" />
+            </Trigger>
+            <Trigger Property="IsKeyboardFocused" Value="True">
+              <Setter TargetName="FocusRing" Property="Visibility" Value="Visible" />
+            </Trigger>
+            <Trigger Property="IsEnabled" Value="False">
+              <Setter Property="Opacity" Value="0.45" />
+            </Trigger>
+          </ControlTemplate.Triggers>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <!-- ==================== Scrollbars ==================== -->
+
+  <Style x:Key="ScrollBarThumbStyle" TargetType="{x:Type Thumb}">
+    <Setter Property="OverridesDefaultStyle" Value="True" />
+    <Setter Property="IsTabStop" Value="False" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type Thumb}">
+          <Border x:Name="ThumbFill" Background="{DynamicResource StrongDividerBrush}"
+                  CornerRadius="3" Margin="3" />
+          <ControlTemplate.Triggers>
+            <Trigger Property="IsMouseOver" Value="True">
+              <Setter TargetName="ThumbFill" Property="Background" Value="{DynamicResource MutedTextBrush}" />
+            </Trigger>
+            <Trigger Property="IsDragging" Value="True">
+              <Setter TargetName="ThumbFill" Property="Background" Value="{DynamicResource MutedTextBrush}" />
+            </Trigger>
+          </ControlTemplate.Triggers>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <Style x:Key="ScrollBarPageButtonStyle" TargetType="{x:Type RepeatButton}">
+    <Setter Property="OverridesDefaultStyle" Value="True" />
+    <Setter Property="Focusable" Value="False" />
+    <Setter Property="IsTabStop" Value="False" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type RepeatButton}">
+          <Border Background="Transparent" />
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <Style TargetType="{x:Type ScrollBar}">
+    <Setter Property="Background" Value="Transparent" />
+    <Setter Property="Width" Value="12" />
+    <Setter Property="MinWidth" Value="12" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type ScrollBar}">
+          <Grid Background="{TemplateBinding Background}">
+            <Track x:Name="PART_Track" IsDirectionReversed="True">
+              <Track.DecreaseRepeatButton>
+                <RepeatButton Style="{StaticResource ScrollBarPageButtonStyle}" Command="ScrollBar.PageUpCommand" />
+              </Track.DecreaseRepeatButton>
+              <Track.Thumb>
+                <Thumb Style="{StaticResource ScrollBarThumbStyle}" />
+              </Track.Thumb>
+              <Track.IncreaseRepeatButton>
+                <RepeatButton Style="{StaticResource ScrollBarPageButtonStyle}" Command="ScrollBar.PageDownCommand" />
+              </Track.IncreaseRepeatButton>
+            </Track>
+          </Grid>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+    <Style.Triggers>
+      <Trigger Property="Orientation" Value="Horizontal">
+        <Setter Property="Width" Value="Auto" />
+        <Setter Property="MinWidth" Value="0" />
+        <Setter Property="Height" Value="12" />
+        <Setter Property="MinHeight" Value="12" />
+        <Setter Property="Template">
+          <Setter.Value>
+            <ControlTemplate TargetType="{x:Type ScrollBar}">
+              <Grid Background="{TemplateBinding Background}">
+                <Track x:Name="PART_Track" IsDirectionReversed="False">
+                  <Track.DecreaseRepeatButton>
+                    <RepeatButton Style="{StaticResource ScrollBarPageButtonStyle}" Command="ScrollBar.PageLeftCommand" />
+                  </Track.DecreaseRepeatButton>
+                  <Track.Thumb>
+                    <Thumb Style="{StaticResource ScrollBarThumbStyle}" />
+                  </Track.Thumb>
+                  <Track.IncreaseRepeatButton>
+                    <RepeatButton Style="{StaticResource ScrollBarPageButtonStyle}" Command="ScrollBar.PageRightCommand" />
+                  </Track.IncreaseRepeatButton>
+                </Track>
+              </Grid>
+            </ControlTemplate>
+          </Setter.Value>
+        </Setter>
+      </Trigger>
+    </Style.Triggers>
+  </Style>
+
+  <!-- ==================== Lists ==================== -->
+
+  <Style TargetType="{x:Type ListBox}">
+    <Setter Property="FontFamily" Value="{StaticResource ApplicationFont}" />
+    <Setter Property="FontSize" Value="13" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="Background" Value="{DynamicResource ControlBackgroundBrush}" />
+    <Setter Property="BorderBrush" Value="{DynamicResource DividerBrush}" />
+    <Setter Property="BorderThickness" Value="1" />
+    <Setter Property="Padding" Value="4" />
+    <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+    <Setter Property="ScrollViewer.HorizontalScrollBarVisibility" Value="Disabled" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type ListBox}">
+          <Border x:Name="Root"
+                  Background="{TemplateBinding Background}"
+                  BorderBrush="{TemplateBinding BorderBrush}"
+                  BorderThickness="{TemplateBinding BorderThickness}"
+                  CornerRadius="{StaticResource ControlRadius}"
+                  SnapsToDevicePixels="True">
+            <ScrollViewer Padding="{TemplateBinding Padding}" Focusable="False">
+              <ItemsPresenter SnapsToDevicePixels="True" />
+            </ScrollViewer>
+          </Border>
+          <ControlTemplate.Triggers>
+            <Trigger Property="IsKeyboardFocusWithin" Value="True">
+              <Setter TargetName="Root" Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+            </Trigger>
+          </ControlTemplate.Triggers>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <Style TargetType="{x:Type ListBoxItem}">
+    <Setter Property="Padding" Value="10,7" />
+    <Setter Property="Margin" Value="0,1" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+    <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type ListBoxItem}">
+          <Grid>
+            <Border x:Name="Fill" Background="Transparent"
+                    BorderBrush="Transparent" BorderThickness="1"
+                    CornerRadius="{StaticResource ControlRadius}" SnapsToDevicePixels="True">
+              <ContentPresenter Margin="{TemplateBinding Padding}"
+                                HorizontalAlignment="{TemplateBinding HorizontalContentAlignment}"
+                                VerticalAlignment="{TemplateBinding VerticalContentAlignment}" />
+            </Border>
+            <Border x:Name="FocusRing"
+                    BorderBrush="{DynamicResource FocusBrush}" BorderThickness="2"
+                    CornerRadius="{StaticResource ControlRadius}"
+                    Visibility="Collapsed" IsHitTestVisible="False" SnapsToDevicePixels="True" />
+          </Grid>
+          <ControlTemplate.Triggers>
+            <Trigger Property="IsMouseOver" Value="True">
+              <Setter TargetName="Fill" Property="Background" Value="{DynamicResource HoverBrush}" />
+            </Trigger>
+            <Trigger Property="IsSelected" Value="True">
+              <Setter TargetName="Fill" Property="Background" Value="{DynamicResource SelectedBrush}" />
+              <Setter TargetName="Fill" Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+            </Trigger>
+            <Trigger Property="IsKeyboardFocused" Value="True">
+              <Setter TargetName="FocusRing" Property="Visibility" Value="Visible" />
+            </Trigger>
+            <Trigger Property="IsEnabled" Value="False">
+              <Setter Property="Opacity" Value="0.5" />
+            </Trigger>
+          </ControlTemplate.Triggers>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <Style TargetType="{x:Type ListView}">
+    <Setter Property="FontFamily" Value="{StaticResource ApplicationFont}" />
+    <Setter Property="FontSize" Value="13" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="Background" Value="{DynamicResource SurfaceBrush}" />
+    <Setter Property="BorderBrush" Value="{DynamicResource DividerBrush}" />
+    <Setter Property="BorderThickness" Value="1" />
+    <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+  </Style>
+
+  <Style TargetType="{x:Type ListViewItem}">
+    <Setter Property="Padding" Value="0,6" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+    <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type ListViewItem}">
+          <Grid>
+            <Border x:Name="Fill" Background="Transparent"
+                    BorderBrush="Transparent" BorderThickness="0,0,0,1"
+                    SnapsToDevicePixels="True">
+              <GridViewRowPresenter Margin="{TemplateBinding Padding}"
+                                    Columns="{TemplateBinding GridView.ColumnCollection}"
+                                    Content="{TemplateBinding Content}" />
+            </Border>
+            <Border x:Name="FocusRing"
+                    BorderBrush="{DynamicResource FocusBrush}" BorderThickness="2"
+                    Visibility="Collapsed" IsHitTestVisible="False" SnapsToDevicePixels="True" />
+          </Grid>
+          <ControlTemplate.Triggers>
+            <Trigger Property="IsMouseOver" Value="True">
+              <Setter TargetName="Fill" Property="Background" Value="{DynamicResource HoverBrush}" />
+            </Trigger>
+            <Trigger Property="IsSelected" Value="True">
+              <Setter TargetName="Fill" Property="Background" Value="{DynamicResource SelectedBrush}" />
+            </Trigger>
+            <Trigger Property="IsKeyboardFocused" Value="True">
+              <Setter TargetName="FocusRing" Property="Visibility" Value="Visible" />
+            </Trigger>
+          </ControlTemplate.Triggers>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <Style TargetType="{x:Type GridViewColumnHeader}">
+    <Setter Property="FontFamily" Value="{StaticResource ApplicationFont}" />
+    <Setter Property="FontSize" Value="12" />
+    <Setter Property="FontWeight" Value="SemiBold" />
+    <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+    <Setter Property="HorizontalContentAlignment" Value="Left" />
+    <Setter Property="Padding" Value="10,8" />
+    <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type GridViewColumnHeader}">
+          <Border x:Name="Fill"
+                  Background="{DynamicResource SurfaceAltBrush}"
+                  BorderBrush="{DynamicResource DividerBrush}"
+                  BorderThickness="0,0,1,1"
+                  SnapsToDevicePixels="True">
+            <ContentPresenter Margin="{TemplateBinding Padding}"
+                              HorizontalAlignment="{TemplateBinding HorizontalContentAlignment}"
+                              VerticalAlignment="Center"
+                              RecognizesAccessKey="True" />
+          </Border>
+          <ControlTemplate.Triggers>
+            <Trigger Property="IsMouseOver" Value="True">
+              <Setter TargetName="Fill" Property="Background" Value="{DynamicResource HoverBrush}" />
+            </Trigger>
+            <Trigger Property="Role" Value="Padding">
+              <Setter TargetName="Fill" Property="BorderThickness" Value="0,0,0,1" />
+            </Trigger>
+          </ControlTemplate.Triggers>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <!-- ==================== ComboBox ==================== -->
+
+  <Style x:Key="ComboBoxSurfaceToggleStyle" TargetType="{x:Type ToggleButton}">
+    <Setter Property="OverridesDefaultStyle" Value="True" />
+    <Setter Property="Focusable" Value="False" />
+    <Setter Property="IsTabStop" Value="False" />
+    <Setter Property="ClickMode" Value="Press" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type ToggleButton}">
+          <Border Background="Transparent" />
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <Style TargetType="{x:Type ComboBoxItem}">
+    <Setter Property="FontFamily" Value="{StaticResource ApplicationFont}" />
+    <Setter Property="FontSize" Value="13" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="Padding" Value="10,7" />
+    <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+    <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type ComboBoxItem}">
+          <Border x:Name="Fill" Background="Transparent"
+                  CornerRadius="4" Margin="0,1" SnapsToDevicePixels="True">
+            <ContentPresenter Margin="{TemplateBinding Padding}"
+                              HorizontalAlignment="{TemplateBinding HorizontalContentAlignment}"
+                              VerticalAlignment="Center" />
+          </Border>
+          <ControlTemplate.Triggers>
+            <Trigger Property="IsMouseOver" Value="True">
+              <Setter TargetName="Fill" Property="Background" Value="{DynamicResource HoverBrush}" />
+            </Trigger>
+            <Trigger Property="IsHighlighted" Value="True">
+              <Setter TargetName="Fill" Property="Background" Value="{DynamicResource HoverBrush}" />
+            </Trigger>
+            <Trigger Property="IsSelected" Value="True">
+              <Setter TargetName="Fill" Property="Background" Value="{DynamicResource SelectedBrush}" />
+            </Trigger>
+          </ControlTemplate.Triggers>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <Style TargetType="{x:Type ComboBox}">
+    <Setter Property="FontFamily" Value="{StaticResource ApplicationFont}" />
+    <Setter Property="FontSize" Value="13" />
+    <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    <Setter Property="Background" Value="{DynamicResource ControlBackgroundBrush}" />
+    <Setter Property="BorderBrush" Value="{DynamicResource ControlBorderBrush}" />
+    <Setter Property="BorderThickness" Value="1" />
+    <Setter Property="Padding" Value="10,6" />
+    <Setter Property="MinHeight" Value="32" />
+    <Setter Property="MaxDropDownHeight" Value="320" />
+    <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type ComboBox}">
+          <Grid>
+            <Border x:Name="Root"
+                    Background="{TemplateBinding Background}"
+                    BorderBrush="{TemplateBinding BorderBrush}"
+                    BorderThickness="{TemplateBinding BorderThickness}"
+                    CornerRadius="{StaticResource ControlRadius}"
+                    SnapsToDevicePixels="True">
+              <Grid>
+                <Grid.ColumnDefinitions>
+                  <ColumnDefinition Width="*" />
+                  <ColumnDefinition Width="Auto" />
+                </Grid.ColumnDefinitions>
+                <ContentPresenter Margin="{TemplateBinding Padding}"
+                                  Content="{TemplateBinding SelectionBoxItem}"
+                                  ContentTemplate="{TemplateBinding SelectionBoxItemTemplate}"
+                                  ContentStringFormat="{TemplateBinding SelectionBoxItemStringFormat}"
+                                  HorizontalAlignment="Left" VerticalAlignment="Center"
+                                  IsHitTestVisible="False" />
+                <Path x:Name="Chevron" Grid.Column="1" Margin="0,0,11,0"
+                      VerticalAlignment="Center" IsHitTestVisible="False"
+                      Data="M 0,0 L 4.5,4.5 L 9,0"
+                      Stroke="{DynamicResource MutedTextBrush}" StrokeThickness="1.4"
+                      StrokeStartLineCap="Round" StrokeEndLineCap="Round" StrokeLineJoin="Round" />
+              </Grid>
+            </Border>
+            <ToggleButton Style="{StaticResource ComboBoxSurfaceToggleStyle}"
+                          IsChecked="{Binding IsDropDownOpen, Mode=TwoWay, RelativeSource={RelativeSource TemplatedParent}}" />
+            <Border x:Name="FocusRing"
+                    BorderBrush="{DynamicResource FocusBrush}" BorderThickness="2"
+                    CornerRadius="{StaticResource ControlRadius}" Margin="-3"
+                    Visibility="Collapsed" IsHitTestVisible="False" SnapsToDevicePixels="True" />
+            <Popup x:Name="PART_Popup" Placement="Bottom" Focusable="False"
+                   AllowsTransparency="True" PopupAnimation="None"
+                   IsOpen="{TemplateBinding IsDropDownOpen}">
+              <Border Background="{DynamicResource SurfaceBrush}"
+                      BorderBrush="{DynamicResource StrongDividerBrush}"
+                      BorderThickness="1" CornerRadius="{StaticResource ControlRadius}"
+                      Margin="0,4,10,12" Padding="4"
+                      MinWidth="{Binding ActualWidth, RelativeSource={RelativeSource TemplatedParent}}"
+                      MaxHeight="{TemplateBinding MaxDropDownHeight}"
+                      SnapsToDevicePixels="True">
+                <Border.Effect>
+                  <DropShadowEffect BlurRadius="16" ShadowDepth="4" Direction="270" Opacity="0.24" Color="#FF000000" />
+                </Border.Effect>
+                <ScrollViewer Focusable="False">
+                  <ItemsPresenter KeyboardNavigation.DirectionalNavigation="Contained" SnapsToDevicePixels="True" />
+                </ScrollViewer>
+              </Border>
+            </Popup>
+          </Grid>
+          <ControlTemplate.Triggers>
+            <Trigger Property="IsMouseOver" Value="True">
+              <Setter TargetName="Root" Property="BorderBrush" Value="{DynamicResource StrongDividerBrush}" />
+            </Trigger>
+            <Trigger Property="IsKeyboardFocusWithin" Value="True">
+              <Setter TargetName="Root" Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+              <Setter TargetName="FocusRing" Property="Visibility" Value="Visible" />
+            </Trigger>
+            <Trigger Property="IsDropDownOpen" Value="True">
+              <Setter TargetName="Root" Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+              <Setter TargetName="Chevron" Property="Stroke" Value="{DynamicResource AccentBrush}" />
+            </Trigger>
+            <Trigger Property="IsEnabled" Value="False">
+              <Setter Property="Opacity" Value="0.5" />
+            </Trigger>
+          </ControlTemplate.Triggers>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
+  <!-- ==================== Progress ==================== -->
+
+  <Style TargetType="{x:Type ProgressBar}">
+    <Setter Property="Height" Value="6" />
+    <Setter Property="Background" Value="{DynamicResource SubtleBrush}" />
+    <Setter Property="Foreground" Value="{DynamicResource AccentBrush}" />
+    <Setter Property="BorderThickness" Value="0" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type ProgressBar}">
+          <Grid>
+            <Border x:Name="PART_Track" Background="{TemplateBinding Background}"
+                    CornerRadius="3" SnapsToDevicePixels="True" />
+            <Border x:Name="PART_Indicator" Background="{TemplateBinding Foreground}"
+                    CornerRadius="3" HorizontalAlignment="Left" SnapsToDevicePixels="True" />
+            <Border x:Name="Pulse" Background="{TemplateBinding Foreground}"
+                    CornerRadius="3" Opacity="0" IsHitTestVisible="False" />
+          </Grid>
+          <ControlTemplate.Triggers>
+            <Trigger Property="IsIndeterminate" Value="True">
+              <Setter TargetName="PART_Indicator" Property="Visibility" Value="Collapsed" />
+              <Trigger.EnterActions>
+                <BeginStoryboard Name="PulseStoryboard">
+                  <Storyboard>
+                    <DoubleAnimation Storyboard.TargetName="Pulse"
+                                     Storyboard.TargetProperty="Opacity"
+                                     From="0.18" To="0.65" Duration="0:0:1.1"
+                                     AutoReverse="True" RepeatBehavior="Forever" />
+                  </Storyboard>
+                </BeginStoryboard>
+              </Trigger.EnterActions>
+              <Trigger.ExitActions>
+                <StopStoryboard BeginStoryboardName="PulseStoryboard" />
+              </Trigger.ExitActions>
+            </Trigger>
+          </ControlTemplate.Triggers>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+</ResourceDictionary>
diff --git a/src/WinRestoreKit.Wpf/Themes/Dark.xaml b/src/WinRestoreKit.Wpf/Themes/Dark.xaml
new file mode 100644
index 0000000..26084de
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Themes/Dark.xaml
@@ -0,0 +1,84 @@
+<ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+                    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
+  <!-- Neutral Windows surfaces. Nothing is pure black; every neutral is tinted cool. -->
+  <Color x:Key="WindowBackgroundColor">#FF16191E</Color>
+  <Color x:Key="SurfaceColor">#FF1E222A</Color>
+  <Color x:Key="SurfaceAltColor">#FF262B34</Color>
+  <Color x:Key="SubtleColor">#FF2B313B</Color>
+  <Color x:Key="HoverColor">#FF2A303A</Color>
+  <Color x:Key="PressedColor">#FF333A45</Color>
+  <Color x:Key="SelectedColor">#FF1D3244</Color>
+  <Color x:Key="ControlBackgroundColor">#FF262B34</Color>
+  <Color x:Key="ControlBorderColor">#FF454C58</Color>
+
+  <Color x:Key="TextColor">#FFF0F3F7</Color>
+  <Color x:Key="MutedTextColor">#FFA9B3C0</Color>
+  <Color x:Key="DisabledTextColor">#FF6B7583</Color>
+
+  <Color x:Key="DividerColor">#FF343A45</Color>
+  <Color x:Key="StrongDividerColor">#FF4A525E</Color>
+
+  <!-- One mineral blue carries every action and every "available" state. -->
+  <Color x:Key="AccentColor">#FF5EA7E0</Color>
+  <Color x:Key="AccentHoverColor">#FF76B6E9</Color>
+  <Color x:Key="AccentPressedColor">#FF4A92CB</Color>
+  <Color x:Key="AccentSoftColor">#FF1B2C3B</Color>
+  <Color x:Key="AccentTextColor">#FF83BEEE</Color>
+  <Color x:Key="OnAccentColor">#FF0E1B25</Color>
+  <Color x:Key="FocusColor">#FF8CC6F0</Color>
+
+  <!-- One restrained coral carries caution and failure; glyph and text separate them. -->
+  <Color x:Key="WarningColor">#FFEF8E7B</Color>
+  <Color x:Key="WarningTextColor">#FFF39D8B</Color>
+  <Color x:Key="WarningSoftColor">#FF33231F</Color>
+  <Color x:Key="DangerColor">#FFEF8E7B</Color>
+  <Color x:Key="DangerHoverColor">#FFF4A08F</Color>
+  <Color x:Key="DangerPressedColor">#FFD97A68</Color>
+  <Color x:Key="DangerTextColor">#FFF39D8B</Color>
+  <Color x:Key="DangerSoftColor">#FF33221E</Color>
+  <Color x:Key="OnDangerColor">#FF2A100B</Color>
+
+  <!-- Muted green, reserved for completed-run outcomes. -->
+  <Color x:Key="SuccessColor">#FF6FC08D</Color>
+  <Color x:Key="SuccessTextColor">#FF83CB9D</Color>
+  <Color x:Key="SuccessSoftColor">#FF1B2A22</Color>
+
+  <SolidColorBrush x:Key="WindowBackgroundBrush" Color="{StaticResource WindowBackgroundColor}" />
+  <SolidColorBrush x:Key="SurfaceBrush" Color="{StaticResource SurfaceColor}" />
+  <SolidColorBrush x:Key="SurfaceAltBrush" Color="{StaticResource SurfaceAltColor}" />
+  <SolidColorBrush x:Key="SubtleBrush" Color="{StaticResource SubtleColor}" />
+  <SolidColorBrush x:Key="HoverBrush" Color="{StaticResource HoverColor}" />
+  <SolidColorBrush x:Key="PressedBrush" Color="{StaticResource PressedColor}" />
+  <SolidColorBrush x:Key="SelectedBrush" Color="{StaticResource SelectedColor}" />
+  <SolidColorBrush x:Key="ControlBackgroundBrush" Color="{StaticResource ControlBackgroundColor}" />
+  <SolidColorBrush x:Key="ControlBorderBrush" Color="{StaticResource ControlBorderColor}" />
+
+  <SolidColorBrush x:Key="TextBrush" Color="{StaticResource TextColor}" />
+  <SolidColorBrush x:Key="MutedTextBrush" Color="{StaticResource MutedTextColor}" />
+  <SolidColorBrush x:Key="DisabledTextBrush" Color="{StaticResource DisabledTextColor}" />
+
+  <SolidColorBrush x:Key="DividerBrush" Color="{StaticResource DividerColor}" />
+  <SolidColorBrush x:Key="StrongDividerBrush" Color="{StaticResource StrongDividerColor}" />
+
+  <SolidColorBrush x:Key="AccentBrush" Color="{StaticResource AccentColor}" />
+  <SolidColorBrush x:Key="AccentHoverBrush" Color="{StaticResource AccentHoverColor}" />
+  <SolidColorBrush x:Key="AccentPressedBrush" Color="{StaticResource AccentPressedColor}" />
+  <SolidColorBrush x:Key="AccentSoftBrush" Color="{StaticResource AccentSoftColor}" />
+  <SolidColorBrush x:Key="AccentTextBrush" Color="{StaticResource AccentTextColor}" />
+  <SolidColorBrush x:Key="OnAccentBrush" Color="{StaticResource OnAccentColor}" />
+  <SolidColorBrush x:Key="FocusBrush" Color="{StaticResource FocusColor}" />
+
+  <SolidColorBrush x:Key="WarningBrush" Color="{StaticResource WarningColor}" />
+  <SolidColorBrush x:Key="WarningTextBrush" Color="{StaticResource WarningTextColor}" />
+  <SolidColorBrush x:Key="WarningSoftBrush" Color="{StaticResource WarningSoftColor}" />
+  <SolidColorBrush x:Key="DangerBrush" Color="{StaticResource DangerColor}" />
+  <SolidColorBrush x:Key="DangerHoverBrush" Color="{StaticResource DangerHoverColor}" />
+  <SolidColorBrush x:Key="DangerPressedBrush" Color="{StaticResource DangerPressedColor}" />
+  <SolidColorBrush x:Key="DangerTextBrush" Color="{StaticResource DangerTextColor}" />
+  <SolidColorBrush x:Key="DangerSoftBrush" Color="{StaticResource DangerSoftColor}" />
+  <SolidColorBrush x:Key="OnDangerBrush" Color="{StaticResource OnDangerColor}" />
+
+  <SolidColorBrush x:Key="SuccessBrush" Color="{StaticResource SuccessColor}" />
+  <SolidColorBrush x:Key="SuccessTextBrush" Color="{StaticResource SuccessTextColor}" />
+  <SolidColorBrush x:Key="SuccessSoftBrush" Color="{StaticResource SuccessSoftColor}" />
+</ResourceDictionary>
diff --git a/src/WinRestoreKit.Wpf/Themes/Light.xaml b/src/WinRestoreKit.Wpf/Themes/Light.xaml
new file mode 100644
index 0000000..a71fee6
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Themes/Light.xaml
@@ -0,0 +1,84 @@
+<ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+                    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
+  <!-- Neutral Windows surfaces. Nothing is pure white; every neutral is tinted cool. -->
+  <Color x:Key="WindowBackgroundColor">#FFF3F5F7</Color>
+  <Color x:Key="SurfaceColor">#FFFCFDFE</Color>
+  <Color x:Key="SurfaceAltColor">#FFEDEFF3</Color>
+  <Color x:Key="SubtleColor">#FFE8ECF1</Color>
+  <Color x:Key="HoverColor">#FFEAEEF3</Color>
+  <Color x:Key="PressedColor">#FFDFE4EB</Color>
+  <Color x:Key="SelectedColor">#FFE4EFF8</Color>
+  <Color x:Key="ControlBackgroundColor">#FFFFFFFF</Color>
+  <Color x:Key="ControlBorderColor">#FFC7CDD6</Color>
+
+  <Color x:Key="TextColor">#FF16191D</Color>
+  <Color x:Key="MutedTextColor">#FF576170</Color>
+  <Color x:Key="DisabledTextColor">#FF929BA8</Color>
+
+  <Color x:Key="DividerColor">#FFDBE0E6</Color>
+  <Color x:Key="StrongDividerColor">#FFBFC6D0</Color>
+
+  <!-- One mineral blue carries every action and every "available" state. -->
+  <Color x:Key="AccentColor">#FF1769AA</Color>
+  <Color x:Key="AccentHoverColor">#FF135D96</Color>
+  <Color x:Key="AccentPressedColor">#FF0F4E7F</Color>
+  <Color x:Key="AccentSoftColor">#FFE3EEF7</Color>
+  <Color x:Key="AccentTextColor">#FF135F9B</Color>
+  <Color x:Key="OnAccentColor">#FFFFFFFF</Color>
+  <Color x:Key="FocusColor">#FF0F4E7F</Color>
+
+  <!-- One restrained coral carries caution and failure; glyph and text separate them. -->
+  <Color x:Key="WarningColor">#FFB44E3C</Color>
+  <Color x:Key="WarningTextColor">#FF9C4231</Color>
+  <Color x:Key="WarningSoftColor">#FFFAEDE9</Color>
+  <Color x:Key="DangerColor">#FFA83B2B</Color>
+  <Color x:Key="DangerHoverColor">#FF953325</Color>
+  <Color x:Key="DangerPressedColor">#FF7E2B1F</Color>
+  <Color x:Key="DangerTextColor">#FF963425</Color>
+  <Color x:Key="DangerSoftColor">#FFF8E8E4</Color>
+  <Color x:Key="OnDangerColor">#FFFFFFFF</Color>
+
+  <!-- Muted green, reserved for completed-run outcomes. -->
+  <Color x:Key="SuccessColor">#FF2F7D4F</Color>
+  <Color x:Key="SuccessTextColor">#FF2A6E46</Color>
+  <Color x:Key="SuccessSoftColor">#FFE7F2EB</Color>
+
+  <SolidColorBrush x:Key="WindowBackgroundBrush" Color="{StaticResource WindowBackgroundColor}" />
+  <SolidColorBrush x:Key="SurfaceBrush" Color="{StaticResource SurfaceColor}" />
+  <SolidColorBrush x:Key="SurfaceAltBrush" Color="{StaticResource SurfaceAltColor}" />
+  <SolidColorBrush x:Key="SubtleBrush" Color="{StaticResource SubtleColor}" />
+  <SolidColorBrush x:Key="HoverBrush" Color="{StaticResource HoverColor}" />
+  <SolidColorBrush x:Key="PressedBrush" Color="{StaticResource PressedColor}" />
+  <SolidColorBrush x:Key="SelectedBrush" Color="{StaticResource SelectedColor}" />
+  <SolidColorBrush x:Key="ControlBackgroundBrush" Color="{StaticResource ControlBackgroundColor}" />
+  <SolidColorBrush x:Key="ControlBorderBrush" Color="{StaticResource ControlBorderColor}" />
+
+  <SolidColorBrush x:Key="TextBrush" Color="{StaticResource TextColor}" />
+  <SolidColorBrush x:Key="MutedTextBrush" Color="{StaticResource MutedTextColor}" />
+  <SolidColorBrush x:Key="DisabledTextBrush" Color="{StaticResource DisabledTextColor}" />
+
+  <SolidColorBrush x:Key="DividerBrush" Color="{StaticResource DividerColor}" />
+  <SolidColorBrush x:Key="StrongDividerBrush" Color="{StaticResource StrongDividerColor}" />
+
+  <SolidColorBrush x:Key="AccentBrush" Color="{StaticResource AccentColor}" />
+  <SolidColorBrush x:Key="AccentHoverBrush" Color="{StaticResource AccentHoverColor}" />
+  <SolidColorBrush x:Key="AccentPressedBrush" Color="{StaticResource AccentPressedColor}" />
+  <SolidColorBrush x:Key="AccentSoftBrush" Color="{StaticResource AccentSoftColor}" />
+  <SolidColorBrush x:Key="AccentTextBrush" Color="{StaticResource AccentTextColor}" />
+  <SolidColorBrush x:Key="OnAccentBrush" Color="{StaticResource OnAccentColor}" />
+  <SolidColorBrush x:Key="FocusBrush" Color="{StaticResource FocusColor}" />
+
+  <SolidColorBrush x:Key="WarningBrush" Color="{StaticResource WarningColor}" />
+  <SolidColorBrush x:Key="WarningTextBrush" Color="{StaticResource WarningTextColor}" />
+  <SolidColorBrush x:Key="WarningSoftBrush" Color="{StaticResource WarningSoftColor}" />
+  <SolidColorBrush x:Key="DangerBrush" Color="{StaticResource DangerColor}" />
+  <SolidColorBrush x:Key="DangerHoverBrush" Color="{StaticResource DangerHoverColor}" />
+  <SolidColorBrush x:Key="DangerPressedBrush" Color="{StaticResource DangerPressedColor}" />
+  <SolidColorBrush x:Key="DangerTextBrush" Color="{StaticResource DangerTextColor}" />
+  <SolidColorBrush x:Key="DangerSoftBrush" Color="{StaticResource DangerSoftColor}" />
+  <SolidColorBrush x:Key="OnDangerBrush" Color="{StaticResource OnDangerColor}" />
+
+  <SolidColorBrush x:Key="SuccessBrush" Color="{StaticResource SuccessColor}" />
+  <SolidColorBrush x:Key="SuccessTextBrush" Color="{StaticResource SuccessTextColor}" />
+  <SolidColorBrush x:Key="SuccessSoftBrush" Color="{StaticResource SuccessSoftColor}" />
+</ResourceDictionary>
diff --git a/src/WinRestoreKit.Wpf/ViewModels/AboutViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/AboutViewModel.cs
new file mode 100644
index 0000000..3bbd2e0
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/AboutViewModel.cs
@@ -0,0 +1,34 @@
+using System;
+using System.Threading;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
+using WinRestoreKit.Wpf.Services;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class AboutViewModel : ObservableObject
+    {
+        private readonly WpfUpdatePresenter updates;
+
+        internal AboutViewModel(WpfUpdatePresenter updates, string currentVersion)
+        {
+            this.updates = updates ?? throw new ArgumentNullException(nameof(updates));
+            CurrentVersion = string.IsNullOrWhiteSpace(currentVersion)
+                ? VersionInfo.UnknownVersion
+                : currentVersion;
+            CheckForUpdatesCommand = new DelegateCommand(_ => CheckForUpdates());
+            OpenReleaseNotesCommand = new DelegateCommand(_ => updates.OpenReleaseNotes());
+        }
+
+        public string CurrentVersion { get; }
+
+        public DelegateCommand CheckForUpdatesCommand { get; }
+
+        public DelegateCommand OpenReleaseNotesCommand { get; }
+
+        private async void CheckForUpdates()
+        {
+            await updates.CheckAsync(CurrentVersion, CancellationToken.None);
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/AppRestoreDialogViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/AppRestoreDialogViewModel.cs
new file mode 100644
index 0000000..a36e1b6
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/AppRestoreDialogViewModel.cs
@@ -0,0 +1,182 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Linq;
+using System.Threading.Tasks;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class AppRestorePackageViewModel : ObservableObject
+    {
+        private readonly Action selectionChanged;
+        private bool isSelected;
+
+        internal AppRestorePackageViewModel(string identifier, Action selectionChanged)
+        {
+            Identifier = identifier ?? string.Empty;
+            this.selectionChanged = selectionChanged;
+        }
+
+        public string Identifier { get; }
+
+        public bool IsSelected
+        {
+            get => isSelected;
+            set
+            {
+                if (SetProperty(ref isSelected, value, nameof(IsSelected)))
+                    selectionChanged?.Invoke();
+            }
+        }
+    }
+
+    internal sealed class AppRestoreDialogViewModel : ObservableObject
+    {
+        internal const string StoppingText = "Stopping after the current app (or its timeout)";
+
+        private readonly ObservableCollection<AppRestorePackageViewModel> packages =
+            new ObservableCollection<AppRestorePackageViewModel>();
+        private readonly Action close;
+        private AppRestoreSource selectedSource;
+        private bool isInstalling;
+        private bool stopRequested;
+        private string statusText = string.Empty;
+
+        internal AppRestoreDialogViewModel(string selectedRestorePath,
+            IReadOnlyList<SnapshotEvent> snapshots, Action close = null)
+        {
+            this.close = close;
+            Sources = AppRestoreService.BuildSources(selectedRestorePath, snapshots);
+            Packages = new ReadOnlyObservableCollection<AppRestorePackageViewModel>(packages);
+            InstallCommand = new DelegateCommand(_ => _ = InstallSelectedAsync(), _ => CanInstall);
+            StopOrCloseCommand = new DelegateCommand(_ => StopOrClose());
+
+            if (Sources.Count > 0)
+                SelectedSource = Sources[0];
+            else
+                StatusText = "No app backup source is available.";
+        }
+
+        public IReadOnlyList<AppRestoreSource> Sources { get; }
+        public ReadOnlyObservableCollection<AppRestorePackageViewModel> Packages { get; }
+        public DelegateCommand InstallCommand { get; }
+        public DelegateCommand StopOrCloseCommand { get; }
+        public AppRestoreOutcome Outcome { get; private set; }
+
+        public AppRestoreSource SelectedSource
+        {
+            get => selectedSource;
+            set
+            {
+                if (isInstalling || !SetProperty(ref selectedSource, value, nameof(SelectedSource)))
+                    return;
+
+                ReadSelectedSource();
+            }
+        }
+
+        public bool IsInstalling
+        {
+            get => isInstalling;
+            private set
+            {
+                if (!SetProperty(ref isInstalling, value, nameof(IsInstalling)))
+                    return;
+
+                OnPropertyChanged(nameof(CanChooseSource));
+                OnPropertyChanged(nameof(CanChoosePackages));
+                OnPropertyChanged(nameof(CanInstall));
+                OnPropertyChanged(nameof(StopCaption));
+                InstallCommand.RaiseCanExecuteChanged();
+                StopOrCloseCommand.RaiseCanExecuteChanged();
+            }
+        }
+
+        public bool CanChooseSource => !IsInstalling;
+        public bool CanChoosePackages => !IsInstalling;
+        public bool CanInstall => !IsInstalling && packages.Any(package => package.IsSelected);
+        public string StopCaption => IsInstalling ? (stopRequested ? StoppingText : "Stop after the current app") : "Close";
+
+        public string StatusText
+        {
+            get => statusText;
+            private set => SetProperty(ref statusText, value ?? string.Empty, nameof(StatusText));
+        }
+
+        internal bool RequestStop()
+        {
+            if (!IsInstalling)
+                return false;
+
+            stopRequested = true;
+            OnPropertyChanged(nameof(StopCaption));
+            StopOrCloseCommand.RaiseCanExecuteChanged();
+            return true;
+        }
+        private void StopOrClose()
+        {
+            if (!RequestStop())
+                close?.Invoke();
+        }
+
+
+        internal async Task InstallSelectedAsync()
+        {
+            if (!CanInstall)
+                return;
+
+            string[] identifiers = packages.Where(package => package.IsSelected)
+                .Select(package => package.Identifier).ToArray();
+            stopRequested = false;
+            IsInstalling = true;
+            StatusText = "Installing selected apps...";
+            Outcome = null;
+            OnPropertyChanged(nameof(Outcome));
+
+            try
+            {
+                Outcome = await AppRestoreService.InstallAsync(identifiers, () => stopRequested);
+                StatusText = Outcome.Text;
+                OnPropertyChanged(nameof(Outcome));
+            }
+            catch (Exception ex)
+            {
+                StatusText = "App installation failed: " + ex.Message;
+            }
+            finally
+            {
+                stopRequested = false;
+                IsInstalling = false;
+            }
+        }
+
+        private void ReadSelectedSource()
+        {
+            packages.Clear();
+            Outcome = null;
+            OnPropertyChanged(nameof(Outcome));
+            if (SelectedSource == null)
+            {
+                StatusText = "No app backup source is selected.";
+                RefreshInstallAvailability();
+                return;
+            }
+
+            AppExport export = AppRestoreService.ReadFromSource(SelectedSource.Path);
+            AppRestoreListState listState = AppRestoreService.ComposeListState(export);
+            foreach (string identifier in listState.Items)
+                packages.Add(new AppRestorePackageViewModel(identifier, RefreshInstallAvailability));
+
+            StatusText = export.Message;
+            RefreshInstallAvailability();
+        }
+
+        private void RefreshInstallAvailability()
+        {
+            OnPropertyChanged(nameof(CanInstall));
+            InstallCommand.RaiseCanExecuteChanged();
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/BackupRunCompletion.cs b/src/WinRestoreKit.Wpf/ViewModels/BackupRunCompletion.cs
new file mode 100644
index 0000000..970a729
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/BackupRunCompletion.cs
@@ -0,0 +1,21 @@
+using System;
+using System.Collections.Generic;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class BackupRunCompletion
+    {
+        internal BackupRunCompletion(RunSummary summary, IReadOnlyList<ModuleOutcome> outcomes,
+            string attemptedBackupPath)
+        {
+            Summary = summary ?? throw new ArgumentNullException(nameof(summary));
+            Outcomes = outcomes ?? Array.Empty<ModuleOutcome>();
+            AttemptedBackupPath = attemptedBackupPath;
+        }
+
+        internal RunSummary Summary { get; }
+        internal IReadOnlyList<ModuleOutcome> Outcomes { get; }
+        internal string AttemptedBackupPath { get; }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/BackupRunRequest.cs b/src/WinRestoreKit.Wpf/ViewModels/BackupRunRequest.cs
new file mode 100644
index 0000000..4bd6884
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/BackupRunRequest.cs
@@ -0,0 +1,24 @@
+using System;
+using System.Collections.Generic;
+using DataHelper;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class BackupRunRequest
+    {
+        internal BackupRunRequest(IReadOnlyList<BackupBase> modules, string snapshotName,
+                                  SnapshotCompression compression, string destination)
+        {
+            Modules = modules ?? throw new ArgumentNullException(nameof(modules));
+            SnapshotName = snapshotName ?? string.Empty;
+            Compression = compression;
+            Destination = destination ?? string.Empty;
+        }
+
+        public IReadOnlyList<BackupBase> Modules { get; }
+        public string SnapshotName { get; }
+        public SnapshotCompression Compression { get; }
+        public string Destination { get; }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/BackupScopeItemViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/BackupScopeItemViewModel.cs
new file mode 100644
index 0000000..32539c7
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/BackupScopeItemViewModel.cs
@@ -0,0 +1,38 @@
+using System;
+using System.Collections.Generic;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class BackupScopeItemViewModel : ObservableObject
+    {
+        private bool isSelected;
+
+        internal BackupScopeItemViewModel(ScopeGroupRow scope)
+        {
+            if (scope == null)
+                throw new ArgumentNullException(nameof(scope));
+
+            Name = scope.Name;
+            Detail = scope.Detail;
+            CautionNote = scope.CautionNote;
+            RequiresExplicitOptIn = scope.RequiresExplicitOptIn;
+            Modules = scope.Modules;
+            isSelected = scope.DefaultChecked;
+        }
+
+        public string Name { get; }
+        public string Detail { get; }
+        public string CautionNote { get; }
+        public bool HasCaution => !string.IsNullOrWhiteSpace(CautionNote);
+        public bool RequiresExplicitOptIn { get; }
+        public IReadOnlyList<BackupBase> Modules { get; }
+
+        public bool IsSelected
+        {
+            get => isSelected;
+            set => SetProperty(ref isSelected, value, nameof(IsSelected));
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/BackupWorkspaceViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/BackupWorkspaceViewModel.cs
new file mode 100644
index 0000000..860d05f
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/BackupWorkspaceViewModel.cs
@@ -0,0 +1,125 @@
+using DataHelper;
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Linq;
+using System.Threading.Tasks;
+using System.Windows.Input;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class BackupWorkspaceViewModel : ObservableObject
+    {
+        private readonly Func<BackupRunRequest, Task> startRunAsync;
+        private string snapshotName = string.Empty;
+        private string destination;
+        private SnapshotCompression compression;
+        private string validationMessage;
+
+        internal BackupWorkspaceViewModel(Func<BackupRunRequest, Task> startRunAsync,
+                                          string defaultDestination)
+        {
+            this.startRunAsync = startRunAsync ?? throw new ArgumentNullException(nameof(startRunAsync));
+            destination = defaultDestination ?? string.Empty;
+            compression = SnapshotCompression.Fast;
+            Scopes = new ObservableCollection<BackupScopeItemViewModel>(
+                ScopeGroups.Build().Select(scope => new BackupScopeItemViewModel(scope)));
+            StartCommand = new AsyncDelegateCommand(StartAsync, ex => SetValidationMessage(ex.Message));
+            SelectAllCommand = new DelegateCommand(_ => SelectAll());
+            ClearCommand = new DelegateCommand(_ => Clear());
+            DeveloperMachineCommand = new DelegateCommand(_ =>
+                SelectModulesByTypeName(BackupPresets.DeveloperMachine, selectScopesContainingType: true));
+            MinimalPrivacySafeCommand = new DelegateCommand(_ =>
+                SelectModulesByTypeName(BackupPresets.MinimalPrivacySafeExclusions,
+                    selectScopesContainingType: false));
+        }
+
+        public ObservableCollection<BackupScopeItemViewModel> Scopes { get; }
+
+        public IReadOnlyList<SnapshotCompression> CompressionOptions { get; } =
+            new[] { SnapshotCompression.None, SnapshotCompression.Fast, SnapshotCompression.Max };
+
+        public string SnapshotName
+        {
+            get => snapshotName;
+            set => SetProperty(ref snapshotName, value ?? string.Empty, nameof(SnapshotName));
+        }
+
+        public string Destination
+        {
+            get => destination;
+            set => SetProperty(ref destination, value ?? string.Empty, nameof(Destination));
+        }
+
+        public SnapshotCompression Compression
+        {
+            get => compression;
+            set => SetProperty(ref compression, value, nameof(Compression));
+        }
+
+        public string ValidationMessage
+        {
+            get => validationMessage;
+            private set => SetProperty(ref validationMessage, value, nameof(ValidationMessage));
+        }
+
+        public ICommand StartCommand { get; }
+        public ICommand SelectAllCommand { get; }
+        public ICommand ClearCommand { get; }
+        public ICommand DeveloperMachineCommand { get; }
+        public ICommand MinimalPrivacySafeCommand { get; }
+
+        internal async Task StartAsync()
+        {
+            IReadOnlyList<BackupBase> modules = Scopes.Where(scope => scope.IsSelected)
+                .SelectMany(scope => scope.Modules)
+                .Distinct()
+                .ToArray();
+            if (modules.Count == 0)
+            {
+                SetValidationMessage("Select at least one scope with supported items.");
+                return;
+            }
+
+            if (string.IsNullOrWhiteSpace(Destination))
+            {
+                SetValidationMessage("Choose a destination folder before capturing.");
+                return;
+            }
+
+            SetValidationMessage(null);
+            await startRunAsync(new BackupRunRequest(modules, SnapshotName.Trim(), Compression,
+                Destination.Trim()));
+        }
+
+        internal void ReportAdmissionRejected(string message)
+            => SetValidationMessage(message);
+
+        private void SelectAll()
+            => SelectModulesByTypeName(BackupModuleCatalog.CreateAll()
+                .Select(registration => registration.Module.GetType().Name), selectScopesContainingType: true);
+
+        private void Clear()
+            => SelectModulesByTypeName(Array.Empty<string>(), selectScopesContainingType: true);
+
+        private void SelectModulesByTypeName(IEnumerable<string> moduleTypeNames,
+                                             bool selectScopesContainingType)
+        {
+            var typeNames = new HashSet<string>((moduleTypeNames ?? Array.Empty<string>())
+                .Where(name => !string.IsNullOrWhiteSpace(name)), StringComparer.Ordinal);
+            foreach (BackupScopeItemViewModel scope in Scopes)
+            {
+                bool containsRequestedType = scope.Modules.Any(module =>
+                    typeNames.Contains(module.GetType().Name));
+                scope.IsSelected = selectScopesContainingType
+                    ? containsRequestedType
+                    : !containsRequestedType;
+            }
+        }
+
+        private void SetValidationMessage(string message)
+            => ValidationMessage = string.IsNullOrWhiteSpace(message) ? null : message;
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/ComparisonFilter.cs b/src/WinRestoreKit.Wpf/ViewModels/ComparisonFilter.cs
new file mode 100644
index 0000000..b75e37d
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/ComparisonFilter.cs
@@ -0,0 +1,8 @@
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal enum ComparisonFilter
+    {
+        All,
+        ChangedOnly
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/ComparisonWorkspaceViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/ComparisonWorkspaceViewModel.cs
new file mode 100644
index 0000000..de17102
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/ComparisonWorkspaceViewModel.cs
@@ -0,0 +1,179 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class ComparisonWorkspaceViewModel : ObservableObject
+    {
+        private readonly IReadOnlyList<BackupModuleRegistration> registrations;
+        private readonly SnapshotComparisonService comparisonService;
+        private readonly CancellationTokenSource comparisonCancellation = new CancellationTokenSource();
+        private readonly Action<SnapshotEvent, IReadOnlyList<BackupBase>> showConfirm;
+        private Task comparisonTask;
+        private ComparisonFilter selectedFilter = ComparisonFilter.All;
+        private ModuleComparisonRowViewModel selectedRow;
+
+        internal ComparisonWorkspaceViewModel(
+            SnapshotEvent snapshot,
+            IReadOnlyList<BackupModuleRegistration> registrations,
+            SnapshotComparisonService comparisonService,
+            Action<SnapshotEvent, IReadOnlyList<BackupBase>> showConfirm)
+        {
+            Snapshot = snapshot ?? throw new ArgumentNullException(nameof(snapshot));
+            this.registrations = registrations ?? throw new ArgumentNullException(nameof(registrations));
+            this.comparisonService = comparisonService ?? throw new ArgumentNullException(nameof(comparisonService));
+            this.showConfirm = showConfirm ?? throw new ArgumentNullException(nameof(showConfirm));
+
+            Rows = new ObservableCollection<ModuleComparisonRowViewModel>();
+            VisibleRows = new ObservableCollection<ModuleComparisonRowViewModel>();
+            RestoreSet = new RestoreSetViewModel();
+            RestoreSet.PropertyChanged += RestoreSet_PropertyChanged;
+            ContinueToConfirmCommand = new DelegateCommand(_ => ContinueToConfirm(), _ => CanContinueToConfirm);
+        }
+
+        public SnapshotEvent Snapshot { get; }
+        public ObservableCollection<ModuleComparisonRowViewModel> Rows { get; }
+        public ObservableCollection<ModuleComparisonRowViewModel> VisibleRows { get; }
+        public RestoreSetViewModel RestoreSet { get; }
+        public bool IsComparing { get; private set; }
+        public string ComparisonStatus { get; private set; } = string.Empty;
+        public ComparisonFilter SelectedFilter
+        {
+            get => selectedFilter;
+            set
+            {
+                if (selectedFilter == value)
+                    return;
+
+                selectedFilter = value;
+                OnPropertyChanged(nameof(SelectedFilter));
+                OnPropertyChanged(nameof(IsAllFilter));
+                OnPropertyChanged(nameof(IsChangedOnlyFilter));
+                RefreshVisibleRows();
+            }
+        }
+
+        public bool IsAllFilter
+        {
+            get => SelectedFilter == ComparisonFilter.All;
+            set
+            {
+                if (value)
+                    SelectedFilter = ComparisonFilter.All;
+            }
+        }
+
+        public bool IsChangedOnlyFilter
+        {
+            get => SelectedFilter == ComparisonFilter.ChangedOnly;
+            set
+            {
+                if (value)
+                    SelectedFilter = ComparisonFilter.ChangedOnly;
+            }
+        }
+
+        public ModuleComparisonRowViewModel SelectedRow
+        {
+            get => selectedRow;
+            set
+            {
+                if (ReferenceEquals(selectedRow, value))
+                    return;
+
+                selectedRow = value;
+                OnPropertyChanged(nameof(SelectedRow));
+                OnPropertyChanged(nameof(IsDetailTrayOpen));
+            }
+        }
+
+        public bool IsDetailTrayOpen => SelectedRow != null;
+        public bool CanContinueToConfirm => RestoreSet.HasItems && !IsComparing;
+        public DelegateCommand ContinueToConfirmCommand { get; }
+
+        internal Task StartAsync(SnapshotPayloadPreparation preparation)
+            => comparisonTask ?? (comparisonTask = StartCoreAsync(preparation));
+
+        internal async Task CancelAsync()
+        {
+            comparisonCancellation.Cancel();
+            if (comparisonTask != null)
+                await comparisonTask;
+        }
+
+        private async Task StartCoreAsync(SnapshotPayloadPreparation preparation)
+        {
+            if (preparation == null)
+                throw new ArgumentNullException(nameof(preparation));
+
+            Rows.Clear();
+            foreach (BackupModuleRegistration registration in registrations)
+                Rows.Add(new ModuleComparisonRowViewModel(registration, RestoreSet));
+            RefreshVisibleRows();
+
+            IsComparing = true;
+            OnPropertyChanged(nameof(IsComparing));
+            OnPropertyChanged(nameof(CanContinueToConfirm));
+            ContinueToConfirmCommand.RaiseCanExecuteChanged();
+            try
+            {
+                IProgress<ComparisonProgress> progress = new Progress<ComparisonProgress>(item =>
+                {
+                    Rows[item.Ordinal].Apply(item.Comparison);
+                    RefreshVisibleRows();
+                });
+                await comparisonService.CompareAsync(preparation,
+                    registrations.Select(registration => registration.Module).ToArray(),
+                    comparisonCancellation.Token, progress);
+            }
+            catch (OperationCanceledException) when (comparisonCancellation.IsCancellationRequested)
+            {
+                ComparisonStatus = "Comparison canceled.";
+                OnPropertyChanged(nameof(ComparisonStatus));
+            }
+            finally
+            {
+                IsComparing = false;
+                OnPropertyChanged(nameof(IsComparing));
+                OnPropertyChanged(nameof(CanContinueToConfirm));
+                ContinueToConfirmCommand.RaiseCanExecuteChanged();
+                preparation.Dispose();
+                RefreshVisibleRows();
+            }
+        }
+
+        private void RestoreSet_PropertyChanged(object sender, System.ComponentModel.PropertyChangedEventArgs e)
+        {
+            if (e.PropertyName != nameof(RestoreSetViewModel.HasItems))
+                return;
+
+            foreach (ModuleComparisonRowViewModel row in Rows)
+                row.RefreshRestoreSetState();
+            OnPropertyChanged(nameof(CanContinueToConfirm));
+            ContinueToConfirmCommand.RaiseCanExecuteChanged();
+        }
+
+        private void ContinueToConfirm()
+        {
+            if (CanContinueToConfirm)
+                showConfirm(Snapshot, RestoreSet.Modules.ToArray());
+        }
+
+        private void RefreshVisibleRows()
+        {
+            VisibleRows.Clear();
+            foreach (ModuleComparisonRowViewModel row in Rows)
+            {
+                if (SelectedFilter == ComparisonFilter.All ||
+                    (row.Comparison != null && row.Comparison.State == ComparisonState.Changed))
+                    VisibleRows.Add(row);
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/ConfirmViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/ConfirmViewModel.cs
new file mode 100644
index 0000000..7245140
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/ConfirmViewModel.cs
@@ -0,0 +1,173 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Linq;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Threading;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
+using WinRestoreKit.Wpf.Services;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class Notice
+    {
+        internal Notice(string title, string text)
+        {
+            Title = title;
+            Text = text;
+        }
+
+        public string Title { get; }
+        public string Text { get; }
+    }
+
+    internal sealed class ConfirmViewModel : ObservableObject, IRunPresentation
+    {
+        private readonly Action backToCompare;
+        private readonly ObservableCollection<string> logLines = new ObservableCollection<string>();
+        private Dispatcher dispatcher;
+        private IRunDialogService dialogService;
+        private Func<Window> ownerProvider;
+        private RunControl activeControl;
+        private bool isRestoring;
+
+        internal ConfirmViewModel(SnapshotEvent snapshot, IReadOnlyList<BackupBase> modules, Action backToCompare = null)
+        {
+            Snapshot = snapshot ?? throw new ArgumentNullException(nameof(snapshot));
+            Modules = modules == null ? Array.Empty<BackupBase>() : modules.Where(module => module != null).ToArray();
+            this.backToCompare = backToCompare;
+            LogLines = new ReadOnlyObservableCollection<string>(logLines);
+            FidelityCaveat = RestorePlan.FidelityCaveat;
+            ConsentProcesses = SelectProcesses(true);
+            InformationalProcesses = SelectProcesses(false);
+            ExplorerRestartModules = Modules.Where(module => module.RequiresExplorerRestart).ToArray();
+            ModuleWarnings = Modules.Where(module => !string.IsNullOrWhiteSpace(module.WarningMessage))
+                .Select(module => new Notice(module.Title, module.WarningMessage)).ToArray();
+
+            StartRestoreCommand = new DelegateCommand(_ => _ = StartFromCommandAsync(), _ => CanStartRestore);
+            CancelRestoreCommand = new DelegateCommand(_ => activeControl?.RequestCancellation(), _ => IsRestoring);
+            BackToCompareCommand = new DelegateCommand(_ => backToCompare?.Invoke(), _ => CanNavigate);
+        }
+
+        public SnapshotEvent Snapshot { get; }
+        public IReadOnlyList<BackupBase> Modules { get; }
+        public IReadOnlyList<RestoreCloseRequirement> ConsentProcesses { get; }
+        public IReadOnlyList<RestoreCloseRequirement> InformationalProcesses { get; }
+        public IReadOnlyList<BackupBase> ExplorerRestartModules { get; }
+        public IReadOnlyList<Notice> ModuleWarnings { get; }
+        public string FidelityCaveat { get; }
+        public bool IsSourcePartial => Snapshot.Kind == SnapshotEventKind.Partial;
+        public bool IsRestoring
+        {
+            get => isRestoring;
+            private set
+            {
+                if (isRestoring == value)
+                    return;
+
+                isRestoring = value;
+                OnPropertyChanged(nameof(IsRestoring));
+                OnPropertyChanged(nameof(CanStartRestore));
+                OnPropertyChanged(nameof(CanNavigate));
+                StartRestoreCommand.RaiseCanExecuteChanged();
+                CancelRestoreCommand.RaiseCanExecuteChanged();
+                BackToCompareCommand.RaiseCanExecuteChanged();
+            }
+        }
+
+        public bool CanStartRestore => Modules.Count != 0 && !IsRestoring && dialogService != null && ownerProvider != null;
+        public bool CanNavigate => !IsRestoring;
+        public string ProgressText { get; private set; } = string.Empty;
+        public RunSummary Summary { get; private set; }
+        public bool ExplorerRestartVisible { get; private set; }
+        public DelegateCommand StartRestoreCommand { get; }
+        public DelegateCommand CancelRestoreCommand { get; }
+        public DelegateCommand BackToCompareCommand { get; }
+        public ReadOnlyObservableCollection<string> LogLines { get; }
+
+        internal void AttachRunSurfaces(Dispatcher dispatcher, Func<Window> ownerProvider, IRunDialogService dialogs)
+        {
+            this.dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher));
+            this.ownerProvider = ownerProvider ?? throw new ArgumentNullException(nameof(ownerProvider));
+            dialogService = dialogs ?? throw new ArgumentNullException(nameof(dialogs));
+            OnPropertyChanged(nameof(CanStartRestore));
+            StartRestoreCommand.RaiseCanExecuteChanged();
+        }
+
+        internal async Task StartRestoreAsync()
+        {
+            if (Modules.Count == 0 || IsRestoring || dialogService == null || ownerProvider == null || !RunCoordinator.TryStart())
+                return;
+
+            activeControl = new RunControl();
+            bool logSinkInstalled = false;
+            try
+            {
+                WpfLogSink logSink = new WpfLogSink(dispatcher, AppendLog, ClearLog);
+                WpfRunUi runUi = new WpfRunUi(dispatcher, this, dialogService, ownerProvider);
+                LogHelper.Instance.SetSink(logSink);
+                logSinkInstalled = true;
+                IsRestoring = true;
+                await new BackupRestoreOrchestrator(runUi, activeControl).RunRestore(Modules, Snapshot.CanonicalPath);
+            }
+            catch (Exception ex)
+            {
+                ShowSummary(RunSummary.For(Array.Empty<ModuleOutcome>(), false, RunVerb.Restore, ex.Message),
+                    "Restore", Array.Empty<ModuleOutcome>());
+            }
+            finally
+            {
+                if (logSinkInstalled)
+                    LogHelper.Instance.SetSink(null);
+                activeControl?.Dispose();
+                activeControl = null;
+                IsRestoring = false;
+                RunCoordinator.SetRunning(false);
+            }
+        }
+
+        public void SetProgressText(string text)
+        {
+            ProgressText = text ?? string.Empty;
+            OnPropertyChanged(nameof(ProgressText));
+        }
+
+        public void SetProgressPercent(int percent) { }
+        public void SetProgressDetail(string groupInfo, string elapsed, string remaining, string throughput, long bytesWritten, int errors, int warnings) { }
+
+        public void ShowSummary(RunSummary summary, string caption, IReadOnlyList<ModuleOutcome> outcomes)
+        {
+            Summary = summary;
+            OnPropertyChanged(nameof(Summary));
+        }
+
+        public void SetExplorerRestartVisible(bool visible)
+        {
+            ExplorerRestartVisible = visible;
+            OnPropertyChanged(nameof(ExplorerRestartVisible));
+        }
+
+        private IReadOnlyList<RestoreCloseRequirement> SelectProcesses(bool needsConsent)
+            => Modules.SelectMany(module => module.ProcessesToCloseBeforeRestore ?? Array.Empty<RestoreCloseRequirement>())
+                .Where(requirement => requirement != null && requirement.NeedsConsent == needsConsent)
+                .GroupBy(requirement => requirement.ProcessName, StringComparer.OrdinalIgnoreCase)
+                .Select(group => group.First()).ToArray();
+
+        private async Task StartFromCommandAsync()
+        {
+            try
+            {
+                await StartRestoreAsync();
+            }
+            catch (Exception ex)
+            {
+                SetProgressText("Restore could not start: " + ex.Message);
+            }
+        }
+
+        private void AppendLog(string text) => logLines.Add(text ?? string.Empty);
+        private void ClearLog() => logLines.Clear();
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/History/AdvancedHistoryViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/History/AdvancedHistoryViewModel.cs
new file mode 100644
index 0000000..77fba5e
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/History/AdvancedHistoryViewModel.cs
@@ -0,0 +1,96 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.ComponentModel;
+using System.Windows.Data;
+using System.Threading;
+using System.Threading.Tasks;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.ViewModels.Snapshots;
+
+namespace WinRestoreKit.Wpf.ViewModels.History
+{
+    public sealed class AdvancedHistoryViewModel : INotifyPropertyChanged
+    {
+        private readonly ISnapshotEventReader catalog;
+        private readonly ObservableCollection<SnapshotEventViewModel> events;
+        private string searchText;
+        private SnapshotEventViewModel selectedEvent;
+
+        internal AdvancedHistoryViewModel(ISnapshotEventReader catalog)
+        {
+            this.catalog = catalog ?? throw new ArgumentNullException(nameof(catalog));
+            events = new ObservableCollection<SnapshotEventViewModel>();
+            Events = CollectionViewSource.GetDefaultView(events);
+            Events.Filter = MatchesSearch;
+        }
+
+        public ICollectionView Events { get; }
+
+        public string SearchText
+        {
+            get => searchText;
+            set
+            {
+                if (string.Equals(searchText, value, StringComparison.Ordinal))
+                    return;
+
+                searchText = value;
+                Events.Refresh();
+                OnPropertyChanged(nameof(SearchText));
+            }
+        }
+
+        public SnapshotEventViewModel SelectedEvent
+        {
+            get => selectedEvent;
+            set
+            {
+                if (ReferenceEquals(selectedEvent, value))
+                    return;
+
+                selectedEvent = value;
+                OnPropertyChanged(nameof(SelectedEvent));
+            }
+        }
+
+        public event PropertyChangedEventHandler PropertyChanged;
+
+        internal Task RefreshAsync(CancellationToken cancellationToken = default)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            IReadOnlyList<SnapshotEvent> snapshots = catalog.Read();
+
+            events.Clear();
+            foreach (SnapshotEvent snapshot in snapshots)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                events.Add(new SnapshotEventViewModel(snapshot));
+            }
+
+            SelectedEvent = null;
+            return Task.CompletedTask;
+        }
+
+        private bool MatchesSearch(object item)
+        {
+            if (item is not SnapshotEventViewModel snapshot)
+                return false;
+
+            if (string.IsNullOrWhiteSpace(SearchText))
+                return true;
+
+            string query = SearchText.Trim();
+            return Contains(snapshot.DisplayName, query)
+                || Contains(snapshot.MachineName, query)
+                || Contains(snapshot.CanonicalPath, query)
+                || Contains(snapshot.Status.Label, query);
+        }
+
+        private static bool Contains(string value, string query)
+            => value != null && value.IndexOf(query, StringComparison.OrdinalIgnoreCase) >= 0;
+
+        private void OnPropertyChanged(string propertyName)
+            => PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(propertyName));
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/ModuleComparisonRowViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/ModuleComparisonRowViewModel.cs
new file mode 100644
index 0000000..d8de2a0
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/ModuleComparisonRowViewModel.cs
@@ -0,0 +1,65 @@
+using System;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class ModuleComparisonRowViewModel : ObservableObject
+    {
+        private readonly RestoreSetViewModel restoreSet;
+
+        internal ModuleComparisonRowViewModel(BackupModuleRegistration registration, RestoreSetViewModel restoreSet)
+        {
+            Registration = registration ?? throw new ArgumentNullException(nameof(registration));
+            this.restoreSet = restoreSet ?? throw new ArgumentNullException(nameof(restoreSet));
+            Impact = new ModuleImpactViewModel(registration.Module);
+            ToggleRestoreSetCommand = new DelegateCommand(_ => ToggleRestoreSet(), _ => CanChangeRestoreSet);
+        }
+
+        internal BackupModuleRegistration Registration { get; }
+        internal ModuleComparison Comparison { get; private set; }
+        public string Title => Registration.Title;
+        public string Category => Registration.Category;
+        public ModuleImpactViewModel Impact { get; }
+        public bool IsChecking => Comparison == null;
+        public bool CanChangeRestoreSet => Comparison != null && Comparison.HasUsableArtifact;
+        public bool IsInRestoreSet => restoreSet.Contains(Registration.Module);
+        public string StateLabel => IsChecking ? "Checking" : Comparison.State.ToString();
+        public string ArtifactSummary => IsChecking ? "Comparison has not finished." : Comparison.ArtifactSummary;
+        public string Reason => Comparison == null ? string.Empty : Comparison.Reason;
+        public string RestoreActionLabel => IsInRestoreSet ? "Remove from restore" : "Add to restore";
+        public string RestoreActionAutomationName => RestoreActionLabel + " " + Title;
+        public DelegateCommand ToggleRestoreSetCommand { get; }
+
+        internal void Apply(ModuleComparison comparison)
+        {
+            Comparison = comparison ?? throw new ArgumentNullException(nameof(comparison));
+            OnPropertyChanged(nameof(IsChecking));
+            OnPropertyChanged(nameof(StateLabel));
+            OnPropertyChanged(nameof(ArtifactSummary));
+            OnPropertyChanged(nameof(Reason));
+            OnPropertyChanged(nameof(CanChangeRestoreSet));
+            ToggleRestoreSetCommand.RaiseCanExecuteChanged();
+        }
+
+        internal void RefreshRestoreSetState()
+        {
+            OnPropertyChanged(nameof(IsInRestoreSet));
+            OnPropertyChanged(nameof(RestoreActionLabel));
+            OnPropertyChanged(nameof(RestoreActionAutomationName));
+        }
+
+        private void ToggleRestoreSet()
+        {
+            if (!CanChangeRestoreSet)
+                return;
+
+            if (IsInRestoreSet)
+                restoreSet.Remove(Registration.Module);
+            else
+                restoreSet.Add(Comparison);
+
+            RefreshRestoreSetState();
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/ModuleImpactViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/ModuleImpactViewModel.cs
new file mode 100644
index 0000000..18a599b
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/ModuleImpactViewModel.cs
@@ -0,0 +1,27 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class ModuleImpactViewModel
+    {
+        internal ModuleImpactViewModel(BackupBase module)
+        {
+            if (module == null)
+                throw new ArgumentNullException(nameof(module));
+
+            Targets = (module.RestoreTargets ?? Array.Empty<RestoreTarget>()).ToArray();
+            Processes = (module.ProcessesToCloseBeforeRestore ?? Array.Empty<RestoreCloseRequirement>())
+                .Where(requirement => requirement != null).ToArray();
+            RequiresExplorerRestart = module.RequiresExplorerRestart;
+            WarningMessage = module.WarningMessage ?? string.Empty;
+        }
+
+        public IReadOnlyList<RestoreTarget> Targets { get; }
+        public IReadOnlyList<RestoreCloseRequirement> Processes { get; }
+        public bool RequiresExplorerRestart { get; }
+        public string WarningMessage { get; }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/ProgressWorkspaceViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/ProgressWorkspaceViewModel.cs
new file mode 100644
index 0000000..4abb74e
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/ProgressWorkspaceViewModel.cs
@@ -0,0 +1,372 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Input;
+using System.Windows.Threading;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
+using WinRestoreKit.Wpf.Services;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class LogLineViewModel
+    {
+        internal LogLineViewModel(string text)
+        {
+            Text = text ?? string.Empty;
+        }
+
+        public string Text { get; }
+    }
+
+    internal sealed class ProgressWorkspaceViewModel : ObservableObject, IRunPresentation
+    {
+        private readonly RunControl runControl;
+        private readonly BackupRestoreOrchestrator runner;
+        private readonly WpfLogSink logSink;
+        private readonly IWpfDialogService dialogs;
+        private readonly Func<BackupRunRequest, Task> backupRunAsyncOverride;
+        private readonly ObservableCollection<LogLineViewModel> logLines = new();
+        private bool sinkInstalled;
+        private bool runStarted;
+        private bool isPaused;
+        private bool isCancellationRequested;
+        private bool isArchivePhase;
+        private bool isTerminal;
+        private RunVerb activeVerb = RunVerb.Backup;
+        private string progressText = string.Empty;
+        private int percent;
+        private string groupInfo = string.Empty;
+        private string elapsed = string.Empty;
+        private string remaining = string.Empty;
+        private string throughput = string.Empty;
+        private long bytesWritten;
+        private string bytesWrittenText = ProgressMetrics.NotAvailable;
+        private int errors;
+        private int warnings;
+        private RunSummary summary;
+        private IReadOnlyList<ModuleOutcome> outcomes = Array.Empty<ModuleOutcome>();
+        private string attemptedBackupPath;
+        private bool explorerRestartVisible;
+
+        internal ProgressWorkspaceViewModel(Dispatcher dispatcher, Func<Window> ownerProvider,
+                                            IRunDialogService runDialogService,
+                                            IWpfDialogService dialogs)
+            : this(dispatcher, ownerProvider, runDialogService, dialogs, null)
+        {
+        }
+
+        internal ProgressWorkspaceViewModel(Dispatcher dispatcher, Func<Window> ownerProvider,
+                                            IRunDialogService runDialogService,
+                                            IWpfDialogService dialogs,
+                                            Func<BackupRunRequest, Task> backupRunAsyncOverride)
+        {
+            if (dispatcher == null)
+                throw new ArgumentNullException(nameof(dispatcher));
+            if (ownerProvider == null)
+                throw new ArgumentNullException(nameof(ownerProvider));
+            if (runDialogService == null)
+                throw new ArgumentNullException(nameof(runDialogService));
+
+            LogLines = new ReadOnlyObservableCollection<LogLineViewModel>(logLines);
+            this.dialogs = dialogs ?? throw new ArgumentNullException(nameof(dialogs));
+            this.backupRunAsyncOverride = backupRunAsyncOverride;
+            runControl = new RunControl();
+            var runUi = new WpfRunUi(dispatcher, this, runDialogService, ownerProvider);
+            runner = new BackupRestoreOrchestrator(runUi, runControl);
+            logSink = new WpfLogSink(dispatcher, AppendLog, ClearLog);
+            PauseCommand = new DelegateCommand(_ => TogglePause(), _ => CanPause);
+            CancelCommand = new DelegateCommand(_ => RequestCancellation(), _ => CanCancel);
+        }
+
+        public string ProgressText
+        {
+            get => progressText;
+            private set => SetProperty(ref progressText, value ?? string.Empty, nameof(ProgressText));
+        }
+
+        public int Percent
+        {
+            get => percent;
+            private set => SetProperty(ref percent, value, nameof(Percent));
+        }
+
+        public string GroupInfo
+        {
+            get => groupInfo;
+            private set => SetProperty(ref groupInfo, value ?? string.Empty, nameof(GroupInfo));
+        }
+
+        public string Elapsed
+        {
+            get => elapsed;
+            private set => SetProperty(ref elapsed, value ?? string.Empty, nameof(Elapsed));
+        }
+
+        public string Remaining
+        {
+            get => remaining;
+            private set => SetProperty(ref remaining, value ?? string.Empty, nameof(Remaining));
+        }
+
+        public string Throughput
+        {
+            get => throughput;
+            private set => SetProperty(ref throughput, value ?? string.Empty, nameof(Throughput));
+        }
+
+        public long BytesWritten
+        {
+            get => bytesWritten;
+            private set
+            {
+                if (!SetProperty(ref bytesWritten, value, nameof(BytesWritten)))
+                    return;
+
+                BytesWrittenText = value < 0 ? ProgressMetrics.NotAvailable : value.ToString();
+            }
+        }
+
+        public int Errors
+        {
+            get => errors;
+            private set => SetProperty(ref errors, value, nameof(Errors));
+        }
+
+        public string BytesWrittenText
+        {
+            get => bytesWrittenText;
+            private set => SetProperty(ref bytesWrittenText, value ?? ProgressMetrics.NotAvailable,
+                nameof(BytesWrittenText));
+        }
+
+        public int Warnings
+        {
+            get => warnings;
+            private set => SetProperty(ref warnings, value, nameof(Warnings));
+        }
+
+        public bool ExplorerRestartVisible
+        {
+            get => explorerRestartVisible;
+            private set => SetProperty(ref explorerRestartVisible, value, nameof(ExplorerRestartVisible));
+        }
+
+        public RunSummary Summary
+        {
+            get => summary;
+            private set => SetProperty(ref summary, value, nameof(Summary));
+        }
+
+        public IReadOnlyList<ModuleOutcome> Outcomes
+        {
+            get => outcomes;
+            private set => SetProperty(ref outcomes, value ?? Array.Empty<ModuleOutcome>(), nameof(Outcomes));
+        }
+
+        public string AttemptedBackupPath
+        {
+            get => attemptedBackupPath;
+            private set => SetProperty(ref attemptedBackupPath, value, nameof(AttemptedBackupPath));
+        }
+
+        public ReadOnlyObservableCollection<LogLineViewModel> LogLines { get; }
+
+        public bool IsPaused => isPaused;
+        public bool IsCancellationRequested => isCancellationRequested;
+        public bool CanPause => !isTerminal && !isCancellationRequested;
+        public bool CanCancel => !isTerminal && !isCancellationRequested && !isArchivePhase;
+        public string PauseCaption => isPaused ? "Resume" : "Pause";
+        public ICommand PauseCommand { get; }
+        public ICommand CancelCommand { get; }
+
+        internal async Task<RunSummary> RunBackupAsync(BackupRunRequest request)
+        {
+            if (request == null)
+                throw new ArgumentNullException(nameof(request));
+
+            BeginRun(RunVerb.Backup);
+            SetProgressText("Started snapshot " + request.SnapshotName + ".");
+            try
+            {
+                if (backupRunAsyncOverride == null)
+                {
+                    await runner.RunBackup(request.Modules, request.Destination, request.SnapshotName,
+                        request.Compression);
+                }
+                else
+                {
+                    await backupRunAsyncOverride(request);
+                }
+                return EnsureSummary(RunVerb.Backup, "the backup runner returned without a result");
+            }
+            catch (Exception ex)
+            {
+                SetSummary(RunSummary.For(Array.Empty<ModuleOutcome>(), false, RunVerb.Backup, ex.Message),
+                    Array.Empty<ModuleOutcome>());
+                return Summary;
+            }
+            finally
+            {
+                AttemptedBackupPath = runner.BackupOutputPath;
+                EndRun();
+            }
+        }
+
+        internal async Task<RunSummary> RunRestoreAsync(IReadOnlyList<BackupBase> modules, string backupPath)
+        {
+            BeginRun(RunVerb.Restore);
+            SetProgressText("Started restore.");
+            try
+            {
+                await runner.RunRestore(modules, backupPath);
+                return EnsureSummary(RunVerb.Restore, "the restore runner returned without a result");
+            }
+            catch (Exception ex)
+            {
+                SetSummary(RunSummary.For(Array.Empty<ModuleOutcome>(), false, RunVerb.Restore, ex.Message),
+                    Array.Empty<ModuleOutcome>());
+                return Summary;
+            }
+            finally
+            {
+                EndRun();
+            }
+        }
+
+        public void SetProgressText(string text)
+        {
+            ProgressText = text;
+            isArchivePhase = string.Equals(text, BackupRestoreOrchestrator.ArchiveProgressText,
+                StringComparison.Ordinal);
+            RefreshCommandAvailability();
+        }
+
+        public void SetProgressPercent(int value)
+            => Percent = value;
+
+        public void SetProgressDetail(string newGroupInfo, string newElapsed, string newRemaining,
+                                      string newThroughput, long newBytesWritten, int newErrors,
+                                      int newWarnings)
+        {
+            GroupInfo = newGroupInfo;
+            Elapsed = newElapsed;
+            Remaining = newRemaining;
+            Throughput = newThroughput;
+            BytesWritten = newBytesWritten;
+            Errors = newErrors;
+            Warnings = newWarnings;
+        }
+
+        public void ShowSummary(RunSummary runSummary, string caption,
+                                IReadOnlyList<ModuleOutcome> runOutcomes)
+            => SetSummary(runSummary, runOutcomes);
+
+        public void SetExplorerRestartVisible(bool visible)
+            => ExplorerRestartVisible = visible;
+
+        private void BeginRun(RunVerb verb)
+        {
+            if (runStarted)
+                throw new InvalidOperationException("A progress workspace can run only one admitted operation.");
+
+            runStarted = true;
+            activeVerb = verb;
+            ClearLog();
+            LogHelper.Instance.SetSink(logSink);
+            sinkInstalled = true;
+        }
+
+        private void EndRun()
+        {
+            if (sinkInstalled)
+                LogHelper.Instance.SetSink(null);
+            sinkInstalled = false;
+            logSink.Dispose();
+            runControl.Dispose();
+        }
+
+        private RunSummary EnsureSummary(RunVerb verb, string reason)
+        {
+            if (Summary == null)
+                SetSummary(RunSummary.For(Array.Empty<ModuleOutcome>(), false, verb, reason),
+                    Array.Empty<ModuleOutcome>());
+            return Summary;
+        }
+
+        private void TogglePause()
+        {
+            if (!CanPause)
+                return;
+
+            if (isPaused)
+            {
+                runControl.Resume();
+                isPaused = false;
+                OnPropertyChanged(nameof(IsPaused));
+                OnPropertyChanged(nameof(PauseCaption));
+                AppendLog("Run resumed. The next group may start.");
+            }
+            else
+            {
+                runControl.Pause();
+                isPaused = true;
+                OnPropertyChanged(nameof(IsPaused));
+                OnPropertyChanged(nameof(PauseCaption));
+                AppendLog("Run paused. The active group will finish before pausing.");
+            }
+        }
+
+        private void RequestCancellation()
+        {
+            if (!CanCancel)
+                return;
+
+            string operation = activeVerb == RunVerb.Restore ? "restore" : "backup";
+            if (!dialogs.Confirm("Cancel this " + operation +
+                "? The active group will finish before cancellation. No further groups will start. " +
+                "Already applied restored settings are not rolled back. Partial backup output created by this run " +
+                "is removed only when it can be identified as new. Otherwise it is preserved without a trusted manifest.",
+                "Cancel " + operation))
+            {
+                return;
+            }
+
+            runControl.RequestCancellation();
+            isCancellationRequested = true;
+            OnPropertyChanged(nameof(IsCancellationRequested));
+            RefreshCommandAvailability();
+            AppendLog("Cancellation requested. The active group will finish before cancellation.");
+        }
+
+        private void SetSummary(RunSummary runSummary, IReadOnlyList<ModuleOutcome> runOutcomes)
+        {
+            Summary = runSummary ?? throw new ArgumentNullException(nameof(runSummary));
+            Outcomes = runOutcomes ?? Array.Empty<ModuleOutcome>();
+            isTerminal = true;
+            OnPropertyChanged(nameof(CanPause));
+            OnPropertyChanged(nameof(CanCancel));
+            RefreshCommandAvailability();
+        }
+
+        private void AppendLog(string text)
+        {
+            string message = text ?? string.Empty;
+            if (message.Length != 0)
+                logLines.Add(new LogLineViewModel(message));
+        }
+
+        private void ClearLog()
+            => logLines.Clear();
+
+        private void RefreshCommandAvailability()
+        {
+            OnPropertyChanged(nameof(CanPause));
+            OnPropertyChanged(nameof(CanCancel));
+            (PauseCommand as DelegateCommand)?.RaiseCanExecuteChanged();
+            (CancelCommand as DelegateCommand)?.RaiseCanExecuteChanged();
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/RestoreSetViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/RestoreSetViewModel.cs
new file mode 100644
index 0000000..c3eb076
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/RestoreSetViewModel.cs
@@ -0,0 +1,47 @@
+using System.Collections.ObjectModel;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class RestoreSetViewModel : ObservableObject
+    {
+        private readonly ObservableCollection<BackupBase> modules = new ObservableCollection<BackupBase>();
+
+        internal RestoreSetViewModel()
+        {
+            Modules = new ReadOnlyObservableCollection<BackupBase>(modules);
+        }
+
+        public ReadOnlyObservableCollection<BackupBase> Modules { get; }
+        public bool HasItems => modules.Count != 0;
+
+        internal bool Contains(BackupBase module) => modules.Contains(module);
+
+        internal void Add(ModuleComparison comparison)
+        {
+            if (comparison == null || !comparison.HasUsableArtifact || modules.Contains(comparison.Module))
+                return;
+
+            modules.Add(comparison.Module);
+            OnPropertyChanged(nameof(HasItems));
+        }
+
+        internal void Remove(BackupBase module)
+        {
+            if (!modules.Remove(module))
+                return;
+
+            OnPropertyChanged(nameof(HasItems));
+        }
+
+        internal void Clear()
+        {
+            if (modules.Count == 0)
+                return;
+
+            modules.Clear();
+            OnPropertyChanged(nameof(HasItems));
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/ResultWorkspaceViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/ResultWorkspaceViewModel.cs
new file mode 100644
index 0000000..8205b88
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/ResultWorkspaceViewModel.cs
@@ -0,0 +1,55 @@
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using System.Windows.Input;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class ResultWorkspaceViewModel
+    {
+        private ResultWorkspaceViewModel(RunSummary summary, IReadOnlyList<ModuleOutcome> outcomes,
+                                         Func<Task> returnToTimelineAsync)
+        {
+            Summary = summary ?? throw new ArgumentNullException(nameof(summary));
+            Outcomes = outcomes ?? Array.Empty<ModuleOutcome>();
+            StatusLabel = StatusLabelFor(Summary);
+            ReturnToTimelineCommand = new AsyncDelegateCommand(
+                returnToTimelineAsync ?? throw new ArgumentNullException(nameof(returnToTimelineAsync)));
+        }
+
+        public RunSummary Summary { get; }
+        public IReadOnlyList<ModuleOutcome> Outcomes { get; }
+        public string StatusLabel { get; }
+        public string Headline => Summary.Headline;
+        public string Detail => Summary.Detail;
+        public RunSeverity Severity => Summary.Severity;
+        public string SeverityText => Severity switch
+        {
+            RunSeverity.Information => "Information",
+            RunSeverity.Warning => "Warning",
+            RunSeverity.Error => "Error",
+            _ => "Information"
+        };
+        public ICommand ReturnToTimelineCommand { get; }
+
+        internal static ResultWorkspaceViewModel From(RunSummary summary,
+                                                      IReadOnlyList<ModuleOutcome> outcomes,
+                                                      Func<Task> returnToTimelineAsync)
+            => new ResultWorkspaceViewModel(summary, outcomes, returnToTimelineAsync);
+
+        private static string StatusLabelFor(RunSummary summary)
+        {
+            if (summary == null)
+                throw new ArgumentNullException(nameof(summary));
+
+            if (summary.State == RunState.Canceled)
+                return "Run canceled, no changes";
+
+            return summary.Headline?.IndexOf("canceled, run incomplete", StringComparison.OrdinalIgnoreCase) >= 0
+                ? "Run canceled, incomplete"
+                : "Run complete";
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/SettingsViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/SettingsViewModel.cs
new file mode 100644
index 0000000..1c77c0f
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/SettingsViewModel.cs
@@ -0,0 +1,41 @@
+using System;
+using System.Collections.Generic;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
+using WinRestoreKit.Wpf.Services;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class SettingsViewModel : ObservableObject
+    {
+        private readonly IThemeService themes;
+        private readonly IReadOnlyList<ThemeMode> availableModes = new[]
+        {
+            ThemeMode.FollowSystem,
+            ThemeMode.Light,
+            ThemeMode.Dark
+        };
+        private ThemeMode selectedTheme;
+
+        internal SettingsViewModel(IThemeService themes)
+        {
+            this.themes = themes ?? throw new ArgumentNullException(nameof(themes));
+            selectedTheme = themes.Mode;
+        }
+
+        public IReadOnlyList<ThemeMode> AvailableModes => availableModes;
+
+        public ThemeMode SelectedTheme
+        {
+            get => selectedTheme;
+            set
+            {
+                if (selectedTheme == value)
+                    return;
+
+                themes.SetMode(value);
+                SetProperty(ref selectedTheme, value, nameof(SelectedTheme));
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs
new file mode 100644
index 0000000..8172468
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/ShellViewModel.cs
@@ -0,0 +1,198 @@
+using DataHelper;
+using System;
+using System.Threading.Tasks;
+using System.Windows;
+using System.Windows.Input;
+using System.Windows.Threading;
+using WinRestoreKit.Wpf.Infrastructure;
+using WinRestoreKit.Wpf.Services;
+using WinRestoreKit.Wpf.ViewModels.Timeline;
+
+namespace WinRestoreKit.Wpf.ViewModels
+{
+    internal sealed class ShellViewModel : ObservableObject
+    {
+        private readonly Dispatcher dispatcher;
+        private readonly Func<Window> ownerProvider;
+        private readonly IWpfDialogService dialogs;
+        private readonly SettingsViewModel settings;
+        private readonly AboutViewModel about;
+        private readonly SnapshotEventCatalog snapshotEventCatalog;
+        private readonly BackupCompletionPublisher completionPublisher;
+        private readonly Func<BackupRunRequest, Task<BackupRunCompletion>> runBackupAsync;
+        private readonly Func<Task> refreshTimelineAsync;
+        private TimelineViewModel timelineWorkspace;
+        private BackupWorkspaceViewModel backupWorkspace;
+
+        internal ShellViewModel(IThemeService themes, WpfUpdatePresenter updates, string currentVersion)
+        {
+            if (themes == null)
+                throw new ArgumentNullException(nameof(themes));
+            if (updates == null)
+                throw new ArgumentNullException(nameof(updates));
+
+            dispatcher = Application.Current?.Dispatcher ?? Dispatcher.CurrentDispatcher;
+            ownerProvider = () => Application.Current?.MainWindow;
+            dialogs = new WpfDialogService(dispatcher, ownerProvider);
+            settings = new SettingsViewModel(themes);
+            about = new AboutViewModel(updates, currentVersion);
+            snapshotEventCatalog = new SnapshotEventCatalog();
+            completionPublisher = new BackupCompletionPublisher(snapshotEventCatalog);
+            WpfAppRestoreDialog.Register(snapshotEventCatalog);
+            runBackupAsync = RunWpfBackupAsync;
+            InitializeCommands();
+        }
+
+        private ShellViewModel(Func<BackupRunRequest, Task<BackupRunCompletion>> runBackup,
+            SnapshotEventCatalog catalog, Func<Task> refreshTimeline)
+        {
+            runBackupAsync = runBackup ?? throw new ArgumentNullException(nameof(runBackup));
+            snapshotEventCatalog = catalog ?? throw new ArgumentNullException(nameof(catalog));
+            completionPublisher = new BackupCompletionPublisher(snapshotEventCatalog);
+            refreshTimelineAsync = refreshTimeline ?? throw new ArgumentNullException(nameof(refreshTimeline));
+            InitializeCommands();
+        }
+
+        public object CurrentWorkspace { get; private set; }
+        public string WorkflowLabel { get; private set; }
+        public ICommand CreateSnapshotCommand { get; private set; }
+        public ICommand ShowTimelineCommand { get; private set; }
+        public ICommand ShowSettingsCommand { get; private set; }
+        public ICommand ShowAboutCommand { get; private set; }
+
+        internal SnapshotEventCatalog SnapshotEventCatalog => snapshotEventCatalog;
+
+        internal static ShellViewModel ForTest(
+            Func<BackupRunRequest, Task<BackupRunCompletion>> runBackup,
+            SnapshotEventCatalog catalog, Func<Task> refreshTimeline)
+            => new ShellViewModel(runBackup, catalog, refreshTimeline);
+
+        internal void SetTimeline(TimelineViewModel value)
+        {
+            timelineWorkspace = value ?? throw new ArgumentNullException(nameof(value));
+            (ShowTimelineCommand as DelegateCommand)?.RaiseCanExecuteChanged();
+            ShowTimeline();
+        }
+
+        internal void NavigateTo(object workspace, string workflowLabel)
+        {
+            if (workspace == null)
+                throw new ArgumentNullException(nameof(workspace));
+            if (string.IsNullOrWhiteSpace(workflowLabel))
+                throw new ArgumentException("A workflow label is required.", nameof(workflowLabel));
+
+            CurrentWorkspace = workspace;
+            WorkflowLabel = workflowLabel;
+            OnPropertyChanged(nameof(CurrentWorkspace));
+            OnPropertyChanged(nameof(WorkflowLabel));
+        }
+
+        internal void ShowTimeline()
+        {
+            if (timelineWorkspace != null)
+                NavigateTo(timelineWorkspace, "Timeline");
+        }
+
+        internal void ShowCompare(ComparisonWorkspaceViewModel workspace)
+            => NavigateTo(workspace ?? throw new ArgumentNullException(nameof(workspace)), "Compare");
+
+        internal void ShowConfirm(ConfirmViewModel confirm)
+            => NavigateTo(confirm ?? throw new ArgumentNullException(nameof(confirm)), "Confirm");
+
+        internal void ShowInlineWorkflowError(string text)
+        {
+            if (string.IsNullOrWhiteSpace(text))
+                throw new ArgumentException("An error message is required.", nameof(text));
+
+            WorkflowLabel = text;
+            OnPropertyChanged(nameof(WorkflowLabel));
+        }
+
+        private void InitializeCommands()
+        {
+            CreateSnapshotCommand = new DelegateCommand(_ => ShowCreateSnapshot(),
+                _ => !RunCoordinator.IsRunning);
+            ShowTimelineCommand = new DelegateCommand(_ => ShowTimeline(), _ => timelineWorkspace != null);
+            ShowSettingsCommand = new DelegateCommand(_ => NavigateTo(settings, "Settings"));
+            ShowAboutCommand = new DelegateCommand(_ => NavigateTo(about, "About"));
+            RunCoordinator.RunningChanged += OnRunningChanged;
+        }
+
+        private void ShowCreateSnapshot()
+        {
+            backupWorkspace = new BackupWorkspaceViewModel(StartBackupAsync, Data.DataRootDir);
+            NavigateTo(backupWorkspace, "Create snapshot");
+        }
+
+        private async Task StartBackupAsync(BackupRunRequest request)
+        {
+            if (!RunCoordinator.TryStart())
+            {
+                backupWorkspace?.ReportAdmissionRejected("Another backup or restore is already running.");
+                return;
+            }
+
+            BackupRunCompletion completion;
+            try
+            {
+                completion = await runBackupAsync(request);
+            }
+            finally
+            {
+                RunCoordinator.SetRunning(false);
+            }
+
+            if (completion == null)
+                throw new InvalidOperationException("The backup run completed without a result.");
+
+            completionPublisher.Publish(completion.AttemptedBackupPath, request.SnapshotName,
+                completion.Summary, DateTime.Now);
+            await RefreshTimelineAsync();
+            NavigateTo(ResultWorkspaceViewModel.From(completion.Summary, completion.Outcomes,
+                ReturnToTimelineAsync), "Snapshot result");
+        }
+
+        private async Task<BackupRunCompletion> RunWpfBackupAsync(BackupRunRequest request)
+        {
+            Window owner = ownerProvider();
+            var progress = new ProgressWorkspaceViewModel(dispatcher, ownerProvider,
+                new RestoreRunDialogService(owner), dialogs);
+            NavigateTo(progress, "Creating snapshot");
+            RunSummary summary = await progress.RunBackupAsync(request);
+            return new BackupRunCompletion(summary, progress.Outcomes, progress.AttemptedBackupPath);
+        }
+
+        private Task ReturnToTimelineAsync()
+        {
+            ShowTimeline();
+            return Task.CompletedTask;
+        }
+
+        private Task RefreshTimelineAsync()
+        {
+            if (refreshTimelineAsync != null)
+                return refreshTimelineAsync();
+
+            return timelineWorkspace?.RefreshAsync() ?? Task.CompletedTask;
+        }
+
+        private void OnRunningChanged(bool running)
+        {
+            Action refresh = () => (CreateSnapshotCommand as DelegateCommand)?.RaiseCanExecuteChanged();
+            if (dispatcher == null || dispatcher.HasShutdownStarted || dispatcher.HasShutdownFinished
+                || dispatcher.CheckAccess())
+            {
+                refresh();
+                return;
+            }
+
+            try
+            {
+                dispatcher.BeginInvoke(refresh);
+            }
+            catch (InvalidOperationException)
+            {
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/Snapshots/SnapshotEventStatus.cs b/src/WinRestoreKit.Wpf/ViewModels/Snapshots/SnapshotEventStatus.cs
new file mode 100644
index 0000000..2ee8b92
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/Snapshots/SnapshotEventStatus.cs
@@ -0,0 +1,72 @@
+using System;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.ViewModels.Snapshots
+{
+    /// <summary>
+    /// Visual weight of a snapshot status. Views pick a glyph shape and a palette from this;
+    /// meaning is never carried by colour alone, so every surface also renders <see cref="SnapshotEventStatus.Label"/>.
+    /// </summary>
+    public enum SnapshotStatusTone
+    {
+        /// <summary>Snapshot is complete and selectable.</summary>
+        Positive,
+
+        /// <summary>Snapshot is usable but incomplete.</summary>
+        Caution,
+
+        /// <summary>The attempt failed; the entry is diagnostic only.</summary>
+        Critical,
+
+        /// <summary>Nothing trustworthy is known about the entry.</summary>
+        Neutral
+    }
+
+    public sealed class SnapshotEventStatus
+    {
+        public SnapshotEventStatus(string label, string shortLabel, SnapshotStatusTone tone, bool isDiagnosticOnly)
+        {
+            Label = label ?? throw new ArgumentNullException(nameof(label));
+            ShortLabel = shortLabel ?? throw new ArgumentNullException(nameof(shortLabel));
+            Tone = tone;
+            IsDiagnosticOnly = isDiagnosticOnly;
+        }
+
+        /// <summary>Full status sentence used for accessible text and dense list columns.</summary>
+        public string Label { get; }
+
+        /// <summary>Condensed status word used inside status pills.</summary>
+        public string ShortLabel { get; }
+
+        public SnapshotStatusTone Tone { get; }
+
+        public bool IsDiagnosticOnly { get; }
+    }
+
+    internal static class SnapshotEventStatusProjection
+    {
+        private static readonly SnapshotEventStatus Verified =
+            new SnapshotEventStatus("Verified", "Verified", SnapshotStatusTone.Positive, false);
+
+        private static readonly SnapshotEventStatus Partial =
+            new SnapshotEventStatus("Partial snapshot", "Partial", SnapshotStatusTone.Caution, false);
+
+        private static readonly SnapshotEventStatus Failed =
+            new SnapshotEventStatus("Backup failed", "Failed", SnapshotStatusTone.Critical, true);
+
+        private static readonly SnapshotEventStatus Unreadable =
+            new SnapshotEventStatus("Details unavailable", "Unreadable", SnapshotStatusTone.Neutral, true);
+
+        internal static SnapshotEventStatus For(SnapshotEventKind kind)
+        {
+            return kind switch
+            {
+                SnapshotEventKind.Verified => Verified,
+                SnapshotEventKind.Partial => Partial,
+                SnapshotEventKind.Failed => Failed,
+                SnapshotEventKind.Unreadable => Unreadable,
+                _ => throw new ArgumentOutOfRangeException(nameof(kind))
+            };
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/Snapshots/SnapshotEventViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/Snapshots/SnapshotEventViewModel.cs
new file mode 100644
index 0000000..1d5bb04
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/Snapshots/SnapshotEventViewModel.cs
@@ -0,0 +1,92 @@
+using System;
+using System.Globalization;
+using WinRestoreKit;
+
+namespace WinRestoreKit.Wpf.ViewModels.Snapshots
+{
+    public sealed class SnapshotEventViewModel
+    {
+        internal SnapshotEventViewModel(SnapshotEvent snapshot)
+        {
+            Event = snapshot ?? throw new ArgumentNullException(nameof(snapshot));
+            Status = SnapshotEventStatusProjection.For(snapshot.Kind);
+            DisplayName = snapshot.DisplayName;
+            CreatedDisplay = FormatCreated(snapshot.Created);
+            MachineName = snapshot.MachineName;
+            CanonicalPath = snapshot.CanonicalPath;
+            DiagnosticReason = snapshot.DiagnosticReason ?? string.Empty;
+            HasDiagnostic = !string.IsNullOrWhiteSpace(DiagnosticReason);
+            SizeDisplay = snapshot.IsSizeComplete ? FormatBytes(snapshot.SizeBytes) : "Unavailable";
+            MetaDisplay = BuildMetaDisplay(snapshot);
+            HasMeta = MetaDisplay.Length > 0;
+            AutomationName = BuildAutomationName();
+        }
+
+        public SnapshotEvent Event { get; }
+
+        public SnapshotEventStatus Status { get; }
+
+        public string DisplayName { get; }
+
+        public DateTime Created => Event.Created;
+
+        public string CreatedDisplay { get; }
+
+        public string MachineName { get; }
+
+        public string CanonicalPath { get; }
+
+        public string SizeDisplay { get; }
+
+        /// <summary>Machine and size joined for the timeline card's secondary line; empty when neither is known.</summary>
+        public string MetaDisplay { get; }
+
+        public bool HasMeta { get; }
+
+        public string DiagnosticReason { get; }
+
+        public bool HasDiagnostic { get; }
+
+        public bool IsRestorable => Event.IsRestorable;
+
+        public string AutomationName { get; }
+
+        private string BuildAutomationName()
+        {
+            string name = DisplayName + ", " + CreatedDisplay + ", " + Status.Label;
+            return HasDiagnostic ? name + ", " + DiagnosticReason : name;
+        }
+
+        // An unreadable entry carries no discoverable creation time. Rendering DateTime.MinValue
+        // as "Monday, January 1, 0001" reads as corrupted data rather than as missing data.
+        private static string FormatCreated(DateTime created)
+            => created == DateTime.MinValue
+                ? "Time unknown"
+                : created.ToString("f", CultureInfo.CurrentCulture);
+
+        private static string BuildMetaDisplay(SnapshotEvent snapshot)
+        {
+            bool hasMachine = !string.IsNullOrWhiteSpace(snapshot.MachineName);
+            if (hasMachine && snapshot.IsSizeComplete)
+                return snapshot.MachineName + "  ·  " + FormatBytes(snapshot.SizeBytes);
+            if (hasMachine)
+                return snapshot.MachineName;
+            return snapshot.IsSizeComplete ? FormatBytes(snapshot.SizeBytes) : string.Empty;
+        }
+
+        private static string FormatBytes(long bytes)
+        {
+            const long Gigabyte = 1024L * 1024L * 1024L;
+            const long Megabyte = 1024L * 1024L;
+            const long Kilobyte = 1024L;
+
+            if (bytes >= Gigabyte)
+                return (bytes / (double)Gigabyte).ToString("0.0", CultureInfo.CurrentCulture) + " GB";
+            if (bytes >= Megabyte)
+                return (bytes / (double)Megabyte).ToString("0.0", CultureInfo.CurrentCulture) + " MB";
+            if (bytes >= Kilobyte)
+                return (bytes / (double)Kilobyte).ToString("0.0", CultureInfo.CurrentCulture) + " KB";
+            return bytes + " B";
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/ViewModels/Timeline/TimelineViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/Timeline/TimelineViewModel.cs
new file mode 100644
index 0000000..7bdc7a3
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/ViewModels/Timeline/TimelineViewModel.cs
@@ -0,0 +1,116 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.ComponentModel;
+using System.Threading;
+using System.Threading.Tasks;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Navigation;
+using WinRestoreKit.Wpf.ViewModels.Snapshots;
+
+namespace WinRestoreKit.Wpf.ViewModels.Timeline
+{
+    public sealed class TimelineViewModel : INotifyPropertyChanged
+    {
+        private readonly ISnapshotEventReader catalog;
+        private readonly ISnapshotPayloadPreparationService preparationService;
+        private readonly ITimelineNavigator navigator;
+        private readonly ObservableCollection<SnapshotEventViewModel> events;
+        private SnapshotEventViewModel selectedEvent;
+        private string selectionError;
+
+        internal TimelineViewModel(ISnapshotEventReader catalog,
+            ISnapshotPayloadPreparationService preparationService, ITimelineNavigator navigator)
+        {
+            this.catalog = catalog ?? throw new ArgumentNullException(nameof(catalog));
+            this.preparationService = preparationService ?? throw new ArgumentNullException(nameof(preparationService));
+            this.navigator = navigator ?? throw new ArgumentNullException(nameof(navigator));
+            events = new ObservableCollection<SnapshotEventViewModel>();
+            Events = new ReadOnlyObservableCollection<SnapshotEventViewModel>(events);
+        }
+
+        public ReadOnlyObservableCollection<SnapshotEventViewModel> Events { get; }
+
+        public SnapshotEventViewModel SelectedEvent
+        {
+            get => selectedEvent;
+            set
+            {
+                if (ReferenceEquals(selectedEvent, value))
+                    return;
+
+                selectedEvent = value;
+                OnPropertyChanged(nameof(SelectedEvent));
+            }
+        }
+
+        public string SelectionError => selectionError;
+
+        public bool HasSelectionError => !string.IsNullOrWhiteSpace(SelectionError);
+
+        public event PropertyChangedEventHandler PropertyChanged;
+
+        internal Task RefreshAsync(CancellationToken cancellationToken = default)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            IReadOnlyList<SnapshotEvent> snapshots = catalog.Read();
+
+            events.Clear();
+            foreach (SnapshotEvent snapshot in snapshots)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                events.Add(new SnapshotEventViewModel(snapshot));
+            }
+
+            SelectedEvent = null;
+            SetSelectionError(null);
+            return Task.CompletedTask;
+        }
+
+        internal async Task OpenSelectedAsync(CancellationToken cancellationToken = default)
+        {
+            SnapshotEventViewModel selected = SelectedEvent;
+            if (selected == null)
+                return;
+
+            SetSelectionError(null);
+            if (!selected.Event.IsRestorable)
+            {
+                navigator.ShowSnapshotDiagnostic(selected.Event);
+                return;
+            }
+
+            SnapshotPayloadPreparation prepared = await preparationService
+                .PrepareAsync(selected.Event, cancellationToken);
+            if (!prepared.IsPrepared)
+            {
+                SetSelectionError(prepared.Error);
+                prepared.Dispose();
+                return;
+            }
+
+            try
+            {
+                navigator.OpenCompare(prepared);
+                prepared = null;
+            }
+            finally
+            {
+                prepared?.Dispose();
+            }
+        }
+
+        private void SetSelectionError(string value)
+        {
+            if (string.Equals(selectionError, value, StringComparison.Ordinal))
+                return;
+
+            selectionError = value;
+            OnPropertyChanged(nameof(SelectionError));
+            OnPropertyChanged(nameof(HasSelectionError));
+        }
+
+        private void OnPropertyChanged(string propertyName)
+            => PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(propertyName));
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Views/AboutView.xaml b/src/WinRestoreKit.Wpf/Views/AboutView.xaml
new file mode 100644
index 0000000..ae4433c
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/AboutView.xaml
@@ -0,0 +1,57 @@
+<UserControl x:Class="WinRestoreKit.Wpf.Views.AboutView"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             AutomationProperties.Name="About workspace">
+  <!-- Shared keys use DynamicResource so the view also loads without an Application instance. -->
+  <ScrollViewer VerticalScrollBarVisibility="Auto" HorizontalScrollBarVisibility="Disabled">
+    <StackPanel MaxWidth="720" HorizontalAlignment="Left" Margin="24,20,24,24">
+      <TextBlock Text="About" Style="{DynamicResource PageTitleStyle}"
+                 Foreground="{DynamicResource TextBrush}" />
+
+      <Border Style="{DynamicResource CardBorderStyle}" Margin="0,18,0,0">
+        <StackPanel>
+          <TextBlock Text="WinRestoreKit" FontSize="18" FontWeight="SemiBold"
+                     Foreground="{DynamicResource TextBrush}" />
+          <TextBlock Text="Create, compare, and restore local snapshots of your Windows setup."
+                     TextWrapping="Wrap" FontSize="13" Margin="0,4,0,0"
+                     Foreground="{DynamicResource MutedTextBrush}" />
+          <Border BorderBrush="{DynamicResource DividerBrush}" BorderThickness="0,1,0,0" Margin="0,16,0,0" />
+          <Grid Margin="0,14,0,0">
+            <Grid.ColumnDefinitions>
+              <ColumnDefinition Width="Auto" />
+              <ColumnDefinition Width="*" />
+            </Grid.ColumnDefinitions>
+            <TextBlock Text="Version" FontSize="13" FontWeight="SemiBold" MinWidth="96"
+                       Foreground="{DynamicResource TextBrush}" />
+            <TextBlock Grid.Column="1" Foreground="{DynamicResource MutedTextBrush}" FontSize="13"
+                       AutomationProperties.Name="Version">
+              <Run Text="Version " />
+              <Run Text="{Binding CurrentVersion, Mode=OneWay}" />
+            </TextBlock>
+          </Grid>
+          <StackPanel Orientation="Horizontal" Margin="0,20,0,0">
+            <Button Content="Check for updates" Command="{Binding CheckForUpdatesCommand}"
+                    Style="{DynamicResource PrimaryButtonStyle}"
+                    AutomationProperties.Name="Check for updates" />
+            <Button Content="Release notes" Command="{Binding OpenReleaseNotesCommand}" Margin="8,0,0,0"
+                    Style="{DynamicResource SecondaryButtonStyle}"
+                    AutomationProperties.Name="Release notes" />
+          </StackPanel>
+          <TextBlock Text="Update checks run only when you ask. Release notes open in your browser."
+                     TextWrapping="Wrap" FontSize="12" Margin="0,10,0,0"
+                     Foreground="{DynamicResource MutedTextBrush}" />
+        </StackPanel>
+      </Border>
+
+      <Border Style="{DynamicResource CardBorderStyle}" Margin="0,12,0,0">
+        <StackPanel>
+          <TextBlock Text="How restore stays safe" Style="{DynamicResource SectionTitleStyle}"
+                     Foreground="{DynamicResource TextBrush}" />
+          <TextBlock Text="Comparing a snapshot never writes to your PC or to the snapshot. Before anything is restored you are shown what will be overwritten, which applications must close, and you consent again in a separate dialog."
+                     TextWrapping="Wrap" FontSize="13" Margin="0,8,0,0"
+                     Foreground="{DynamicResource MutedTextBrush}" />
+        </StackPanel>
+      </Border>
+    </StackPanel>
+  </ScrollViewer>
+</UserControl>
diff --git a/src/WinRestoreKit.Wpf/Views/AboutView.xaml.cs b/src/WinRestoreKit.Wpf/Views/AboutView.xaml.cs
new file mode 100644
index 0000000..2edb78c
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/AboutView.xaml.cs
@@ -0,0 +1,12 @@
+using System.Windows.Controls;
+
+namespace WinRestoreKit.Wpf.Views
+{
+    public partial class AboutView : UserControl
+    {
+        public AboutView()
+        {
+            InitializeComponent();
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Views/AdvancedHistoryView.xaml b/src/WinRestoreKit.Wpf/Views/AdvancedHistoryView.xaml
new file mode 100644
index 0000000..420c034
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/AdvancedHistoryView.xaml
@@ -0,0 +1,158 @@
+<UserControl x:Class="WinRestoreKit.Wpf.Views.AdvancedHistoryView"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             Loaded="OnLoaded"
+             AutomationProperties.Name="Advanced history">
+  <UserControl.Resources>
+    <ResourceDictionary>
+      <ResourceDictionary.MergedDictionaries>
+        <ResourceDictionary Source="/WinRestoreKit.Wpf;component/Resources/SnapshotEventTemplates.xaml" />
+      </ResourceDictionary.MergedDictionaries>
+
+      <!-- Declared locally rather than derived from the app-level implicit style: views are
+           constructed in tests without an Application, where app-level StaticResource would throw. -->
+      <Style x:Key="HistoryRowStyle" TargetType="{x:Type ListViewItem}">
+        <Setter Property="AutomationProperties.Name" Value="{Binding AutomationName}" />
+        <Setter Property="Padding" Value="0,7" />
+        <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+        <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+        <Setter Property="Template">
+          <Setter.Value>
+            <ControlTemplate TargetType="{x:Type ListViewItem}">
+              <Border x:Name="Row"
+                      Background="Transparent"
+                      BorderBrush="{DynamicResource DividerBrush}"
+                      BorderThickness="0,0,0,1"
+                      SnapsToDevicePixels="True">
+                <GridViewRowPresenter Margin="{TemplateBinding Padding}"
+                                      Columns="{TemplateBinding GridView.ColumnCollection}"
+                                      Content="{TemplateBinding Content}" />
+              </Border>
+              <ControlTemplate.Triggers>
+                <Trigger Property="IsMouseOver" Value="True">
+                  <Setter TargetName="Row" Property="Background" Value="{DynamicResource HoverBrush}" />
+                </Trigger>
+                <Trigger Property="IsSelected" Value="True">
+                  <Setter TargetName="Row" Property="Background" Value="{DynamicResource SelectedBrush}" />
+                </Trigger>
+                <Trigger Property="IsKeyboardFocused" Value="True">
+                  <Setter TargetName="Row" Property="BorderBrush" Value="{DynamicResource FocusBrush}" />
+                  <Setter TargetName="Row" Property="BorderThickness" Value="0,0,0,2" />
+                </Trigger>
+              </ControlTemplate.Triggers>
+            </ControlTemplate>
+          </Setter.Value>
+        </Setter>
+      </Style>
+
+      <Style x:Key="HistoryWatermarkStyle" TargetType="{x:Type TextBlock}">
+        <Setter Property="Visibility" Value="Collapsed" />
+        <Style.Triggers>
+          <DataTrigger Binding="{Binding SearchText}" Value="{x:Null}">
+            <Setter Property="Visibility" Value="Visible" />
+          </DataTrigger>
+          <DataTrigger Binding="{Binding SearchText}" Value="">
+            <Setter Property="Visibility" Value="Visible" />
+          </DataTrigger>
+        </Style.Triggers>
+      </Style>
+    </ResourceDictionary>
+  </UserControl.Resources>
+  <Border Background="{DynamicResource WindowBackgroundBrush}"
+          TextElement.Foreground="{DynamicResource TextBrush}"
+          TextElement.FontFamily="{DynamicResource ApplicationFont}"
+          Padding="32,26,32,24">
+    <Grid>
+      <Grid.RowDefinitions>
+        <RowDefinition Height="Auto" />
+        <RowDefinition Height="Auto" />
+        <RowDefinition Height="*" />
+      </Grid.RowDefinitions>
+
+      <StackPanel>
+        <TextBlock Text="Advanced history" Style="{DynamicResource PageTitleStyle}" />
+        <TextBlock Text="The same snapshot events as the timeline, shown with exact timestamps, machines, paths, and sizes."
+                   Margin="0,6,0,0" MaxWidth="720" HorizontalAlignment="Left"
+                   FontSize="13" TextWrapping="Wrap"
+                   Foreground="{DynamicResource MutedTextBrush}" />
+      </StackPanel>
+
+      <Grid Grid.Row="1" Margin="0,20,0,14" HorizontalAlignment="Left" Width="380">
+        <TextBox x:Name="HistorySearchBox"
+                 Text="{Binding SearchText, UpdateSourceTrigger=PropertyChanged}"
+                 AutomationProperties.Name="Search snapshots"
+                 AutomationProperties.HelpText="Search by snapshot name, machine, path, or status." />
+        <TextBlock Text="Search name, machine, path, or status"
+                   Style="{StaticResource HistoryWatermarkStyle}"
+                   Margin="11,0,0,0" VerticalAlignment="Center"
+                   IsHitTestVisible="False" FontSize="13"
+                   FontFamily="{DynamicResource ApplicationFont}"
+                   Foreground="{DynamicResource DisabledTextBrush}" />
+      </Grid>
+
+      <Border Grid.Row="2"
+              Background="{DynamicResource SurfaceBrush}"
+              BorderBrush="{DynamicResource DividerBrush}"
+              BorderThickness="1" CornerRadius="8"
+              SnapsToDevicePixels="True">
+        <ListView x:Name="AdvancedHistoryEventList"
+                  Margin="1"
+                  ItemsSource="{Binding Events}"
+                  SelectedItem="{Binding SelectedEvent, Mode=TwoWay}"
+                  SelectionMode="Single"
+                  Background="Transparent"
+                  BorderThickness="0"
+                  ItemContainerStyle="{StaticResource HistoryRowStyle}"
+                  ScrollViewer.HorizontalScrollBarVisibility="Auto"
+                  AutomationProperties.Name="Snapshot history">
+          <ListView.View>
+            <GridView>
+              <GridViewColumn Header="Timestamp" Width="210">
+                <GridViewColumn.CellTemplate>
+                  <DataTemplate>
+                    <TextBlock Text="{Binding Created, StringFormat={}{0:O}}"
+                               Style="{DynamicResource TechnicalTextStyle}"
+                               TextTrimming="CharacterEllipsis" TextWrapping="NoWrap"
+                               VerticalAlignment="Center" />
+                  </DataTemplate>
+                </GridViewColumn.CellTemplate>
+              </GridViewColumn>
+              <GridViewColumn Header="Machine" Width="130" DisplayMemberBinding="{Binding MachineName}" />
+              <GridViewColumn Header="Path" Width="280">
+                <GridViewColumn.CellTemplate>
+                  <DataTemplate>
+                    <TextBlock Text="{Binding CanonicalPath}"
+                               Style="{DynamicResource TechnicalTextStyle}"
+                               TextTrimming="CharacterEllipsis" TextWrapping="NoWrap"
+                               ToolTip="{Binding CanonicalPath}"
+                               VerticalAlignment="Center" />
+                  </DataTemplate>
+                </GridViewColumn.CellTemplate>
+              </GridViewColumn>
+              <GridViewColumn Header="Status" Width="180">
+                <GridViewColumn.CellTemplate>
+                  <DataTemplate>
+                    <ContentPresenter Content="{Binding Status}"
+                                      ContentTemplate="{StaticResource SnapshotEventStatusTemplate}" />
+                  </DataTemplate>
+                </GridViewColumn.CellTemplate>
+              </GridViewColumn>
+              <GridViewColumn Header="Size" Width="90" DisplayMemberBinding="{Binding SizeDisplay}" />
+              <GridViewColumn Header="Diagnostics" Width="300">
+                <GridViewColumn.CellTemplate>
+                  <DataTemplate>
+                    <TextBlock Text="{Binding DiagnosticReason}"
+                               TextTrimming="CharacterEllipsis" TextWrapping="NoWrap"
+                               ToolTip="{Binding DiagnosticReason}"
+                               VerticalAlignment="Center"
+                               Foreground="{DynamicResource WarningTextBrush}" />
+                  </DataTemplate>
+                </GridViewColumn.CellTemplate>
+              </GridViewColumn>
+            </GridView>
+          </ListView.View>
+        </ListView>
+      </Border>
+    </Grid>
+  </Border>
+</UserControl>
diff --git a/src/WinRestoreKit.Wpf/Views/AdvancedHistoryView.xaml.cs b/src/WinRestoreKit.Wpf/Views/AdvancedHistoryView.xaml.cs
new file mode 100644
index 0000000..d551165
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/AdvancedHistoryView.xaml.cs
@@ -0,0 +1,20 @@
+using System.Windows;
+using System.Windows.Controls;
+using WinRestoreKit.Wpf.ViewModels.History;
+
+namespace WinRestoreKit.Wpf.Views
+{
+    public partial class AdvancedHistoryView : UserControl
+    {
+        public AdvancedHistoryView()
+        {
+            InitializeComponent();
+        }
+
+        private async void OnLoaded(object sender, RoutedEventArgs e)
+        {
+            if (DataContext is AdvancedHistoryViewModel viewModel)
+                await viewModel.RefreshAsync();
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Views/AppRestoreDialog.xaml b/src/WinRestoreKit.Wpf/Views/AppRestoreDialog.xaml
new file mode 100644
index 0000000..e764b4b
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/AppRestoreDialog.xaml
@@ -0,0 +1,172 @@
+<Window x:Class="WinRestoreKit.Wpf.Views.AppRestoreDialog"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        x:ClassModifier="internal"
+        xmlns:vm="clr-namespace:WinRestoreKit.Wpf.ViewModels"
+        Title="Reinstall apps"
+        Width="560"
+        Height="500"
+        MinWidth="500"
+        MinHeight="360"
+        ShowInTaskbar="False"
+        WindowStartupLocation="CenterOwner"
+        Background="{DynamicResource WindowBackgroundBrush}"
+        AutomationProperties.Name="Reinstall apps">
+    <Window.Resources>
+        <Style x:Key="PackageRowStyle" TargetType="{x:Type ListBoxItem}">
+            <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+            <Setter Property="Template">
+                <Setter.Value>
+                    <ControlTemplate TargetType="{x:Type ListBoxItem}">
+                        <Border x:Name="PackageRow" Background="Transparent" Padding="10,5,10,6">
+                            <ContentPresenter />
+                        </Border>
+                        <ControlTemplate.Triggers>
+                            <Trigger Property="IsMouseOver" Value="True">
+                                <Setter TargetName="PackageRow" Property="Background"
+                                        Value="{DynamicResource HoverBrush}" />
+                            </Trigger>
+                        </ControlTemplate.Triggers>
+                    </ControlTemplate>
+                </Setter.Value>
+            </Setter>
+        </Style>
+
+        <Style x:Key="EmptyPackagesHintStyle" TargetType="{x:Type TextBlock}">
+            <Setter Property="Visibility" Value="Collapsed" />
+            <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+            <Setter Property="TextWrapping" Value="Wrap" />
+            <Setter Property="Margin" Value="10,8,10,0" />
+            <Setter Property="VerticalAlignment" Value="Top" />
+            <Style.Triggers>
+                <DataTrigger Binding="{Binding HasItems, ElementName=AppPackageList}" Value="False">
+                    <Setter Property="Visibility" Value="Visible" />
+                </DataTrigger>
+            </Style.Triggers>
+        </Style>
+    </Window.Resources>
+
+    <Grid Margin="24,20,24,20">
+        <Grid.RowDefinitions>
+            <RowDefinition Height="Auto" />
+            <RowDefinition Height="Auto" />
+            <RowDefinition Height="*" />
+            <RowDefinition Height="Auto" />
+            <RowDefinition Height="Auto" />
+        </Grid.RowDefinitions>
+
+        <StackPanel Margin="0,0,0,16">
+            <TextBlock Text="Reinstall apps"
+                       Style="{DynamicResource PageTitleStyle}"
+                       Foreground="{DynamicResource TextBrush}"
+                       FontSize="20"
+                       FontWeight="SemiBold" />
+            <TextBlock Text="Pick a captured app list, then choose which apps to install on this PC."
+                       Style="{DynamicResource BodyTextStyle}"
+                       Foreground="{DynamicResource MutedTextBrush}"
+                       TextWrapping="Wrap"
+                       Margin="0,4,0,0" />
+        </StackPanel>
+
+        <StackPanel Grid.Row="1" Margin="0,0,0,14">
+            <Label Content="App backup source"
+                   Padding="0"
+                   Margin="0,0,0,4"
+                   FontSize="12"
+                   Foreground="{DynamicResource MutedTextBrush}"
+                   Target="{Binding ElementName=AppSourceComboBox}" />
+            <ComboBox x:Name="AppSourceComboBox"
+                      ItemsSource="{Binding Sources}"
+                      SelectedItem="{Binding SelectedSource}"
+                      DisplayMemberPath="DisplayName"
+                      IsEnabled="{Binding CanChooseSource}"
+                      Padding="8,6"
+                      AutomationProperties.Name="App backup source" />
+        </StackPanel>
+
+        <Border Grid.Row="2" Style="{DynamicResource CardBorderStyle}" Padding="8,10,8,10">
+            <Grid>
+                <Grid.RowDefinitions>
+                    <RowDefinition Height="Auto" />
+                    <RowDefinition Height="*" />
+                </Grid.RowDefinitions>
+                <TextBlock Text="Apps to install"
+                           Style="{DynamicResource SectionTitleStyle}"
+                           Foreground="{DynamicResource TextBrush}"
+                           FontSize="14"
+                           FontWeight="SemiBold"
+                           Margin="10,0,10,8" />
+                <Grid Grid.Row="1">
+                    <ListBox x:Name="AppPackageList"
+                             ItemsSource="{Binding Packages}"
+                             IsEnabled="{Binding CanChoosePackages}"
+                             Background="Transparent"
+                             BorderThickness="0"
+                             Padding="0"
+                             HorizontalContentAlignment="Stretch"
+                             ItemContainerStyle="{StaticResource PackageRowStyle}"
+                             ScrollViewer.HorizontalScrollBarVisibility="Disabled"
+                             ScrollViewer.VerticalScrollBarVisibility="Auto"
+                             AutomationProperties.Name="Apps to install">
+                        <ListBox.ItemTemplate>
+                            <DataTemplate DataType="{x:Type vm:AppRestorePackageViewModel}">
+                                <CheckBox IsChecked="{Binding IsSelected, Mode=TwoWay}"
+                                          VerticalContentAlignment="Center"
+                                          AutomationProperties.Name="{Binding Identifier}">
+                                    <TextBlock Text="{Binding Identifier}"
+                                               Style="{DynamicResource TechnicalTextStyle}"
+                                               Foreground="{DynamicResource TextBrush}"
+                                               TextWrapping="Wrap"
+                                               Margin="8,0,0,0" />
+                                </CheckBox>
+                            </DataTemplate>
+                        </ListBox.ItemTemplate>
+                    </ListBox>
+                    <TextBlock Text="This source lists no apps to install."
+                               Style="{StaticResource EmptyPackagesHintStyle}"
+                               IsHitTestVisible="False" />
+                </Grid>
+            </Grid>
+        </Border>
+
+        <Border Grid.Row="3"
+                Margin="0,14,0,0"
+                Padding="12,9,14,10"
+                CornerRadius="6"
+                BorderThickness="1"
+                BorderBrush="{DynamicResource DividerBrush}"
+                Background="{DynamicResource SurfaceBrush}">
+            <TextBlock TextWrapping="Wrap"
+                       Text="{Binding StatusText}"
+                       Style="{DynamicResource BodyTextStyle}"
+                       Foreground="{DynamicResource MutedTextBrush}"
+                       AutomationProperties.Name="App restore status"
+                       AutomationProperties.LiveSetting="Polite" />
+        </Border>
+
+        <StackPanel Grid.Row="4" Orientation="Horizontal" HorizontalAlignment="Right" Margin="0,16,0,0">
+            <Button Margin="0,0,8,0"
+                    Padding="14,6"
+                    MinWidth="150"
+                    Content="Install selected apps"
+                    Style="{DynamicResource PrimaryButtonStyle}"
+                    Command="{Binding InstallCommand}" />
+            <Button Padding="14,6"
+                    MinWidth="110"
+                    Content="{Binding StopCaption}"
+                    Style="{DynamicResource SecondaryButtonStyle}"
+                    Command="{Binding StopOrCloseCommand}">
+                <Button.ContentTemplate>
+                    <!-- StopCaption grows to a full sentence while a stop is pending, so the
+                         caption wraps instead of stretching the dialog. -->
+                    <DataTemplate>
+                        <TextBlock Text="{Binding}"
+                                   TextWrapping="Wrap"
+                                   TextAlignment="Center"
+                                   MaxWidth="230" />
+                    </DataTemplate>
+                </Button.ContentTemplate>
+            </Button>
+        </StackPanel>
+    </Grid>
+</Window>
diff --git a/src/WinRestoreKit.Wpf/Views/AppRestoreDialog.xaml.cs b/src/WinRestoreKit.Wpf/Views/AppRestoreDialog.xaml.cs
new file mode 100644
index 0000000..5996586
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/AppRestoreDialog.xaml.cs
@@ -0,0 +1,53 @@
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Windows;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.ViewModels;
+
+namespace WinRestoreKit.Wpf.Views
+{
+    internal partial class AppRestoreDialog : Window
+    {
+        private readonly AppRestoreDialogViewModel viewModel;
+        private bool closeWhenIdle;
+
+        internal AppRestoreDialog(string payloadPath, IReadOnlyList<SnapshotEvent> snapshots)
+        {
+            InitializeComponent();
+            viewModel = new AppRestoreDialogViewModel(payloadPath, snapshots, Close);
+            viewModel.PropertyChanged += ViewModelPropertyChanged;
+            DataContext = viewModel;
+        }
+
+        protected override void OnClosing(CancelEventArgs e)
+        {
+            bool dispatcherIsStopping = Dispatcher.HasShutdownStarted || Dispatcher.HasShutdownFinished;
+            bool ownerIsTearingDown = Owner != null && !Owner.IsVisible;
+            if (viewModel.IsInstalling && !dispatcherIsStopping && !ownerIsTearingDown)
+            {
+                closeWhenIdle = true;
+                viewModel.RequestStop();
+                e.Cancel = true;
+            }
+
+            base.OnClosing(e);
+        }
+
+        private void ViewModelPropertyChanged(object sender, PropertyChangedEventArgs e)
+        {
+            if (e.PropertyName == nameof(AppRestoreDialogViewModel.Outcome)
+                && viewModel.Outcome != null && !IsVisible)
+            {
+                LogHelper.Instance.LogMessage(viewModel.Outcome.Caption + ": " + viewModel.Outcome.Text);
+            }
+
+            if (closeWhenIdle && e.PropertyName == nameof(AppRestoreDialogViewModel.IsInstalling)
+                && !viewModel.IsInstalling)
+            {
+                closeWhenIdle = false;
+                Close();
+            }
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Views/BackupWorkspaceView.xaml b/src/WinRestoreKit.Wpf/Views/BackupWorkspaceView.xaml
new file mode 100644
index 0000000..bb79674
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/BackupWorkspaceView.xaml
@@ -0,0 +1,343 @@
+<UserControl x:Class="WinRestoreKit.Wpf.Views.BackupWorkspaceView"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             MinWidth="1024"
+             AutomationProperties.Name="Create snapshot"
+             AutomationProperties.AutomationId="BackupWorkspace">
+  <UserControl.Resources>
+    <BooleanToVisibilityConverter x:Key="BooleanToVisibilityConverter" />
+
+    <!-- Scope rows are cards, not highlighted list entries: the check box carries selection,
+         so a selection highlight would state a second, conflicting truth. -->
+    <Style x:Key="ScopeCardContainerStyle" TargetType="{x:Type ListBoxItem}">
+      <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+      <Setter Property="Template">
+        <Setter.Value>
+          <ControlTemplate TargetType="{x:Type ListBoxItem}">
+            <Border x:Name="ScopeCard"
+                    Margin="0,0,0,8"
+                    Padding="14,12,14,14"
+                    CornerRadius="8"
+                    SnapsToDevicePixels="True"
+                    Background="{DynamicResource SurfaceBrush}"
+                    BorderBrush="{DynamicResource DividerBrush}"
+                    BorderThickness="1">
+              <ContentPresenter />
+            </Border>
+            <ControlTemplate.Triggers>
+              <Trigger Property="IsMouseOver" Value="True">
+                <Setter TargetName="ScopeCard" Property="BorderBrush"
+                        Value="{DynamicResource AccentBrush}" />
+              </Trigger>
+              <Trigger Property="IsKeyboardFocusWithin" Value="True">
+                <Setter TargetName="ScopeCard" Property="BorderBrush"
+                        Value="{DynamicResource AccentBrush}" />
+                <Setter TargetName="ScopeCard" Property="BorderThickness" Value="2" />
+                <Setter TargetName="ScopeCard" Property="Padding" Value="13,11,13,13" />
+              </Trigger>
+            </ControlTemplate.Triggers>
+          </ControlTemplate>
+        </Setter.Value>
+      </Setter>
+    </Style>
+
+    <!-- The validation line is an error surface, so it must not leave an empty frame behind
+         when the view model has nothing to report. -->
+    <Style x:Key="ValidationCalloutStyle" TargetType="{x:Type Border}">
+      <Setter Property="Visibility" Value="Visible" />
+      <Setter Property="Padding" Value="12,8,14,9" />
+      <Setter Property="CornerRadius" Value="6" />
+      <Setter Property="BorderThickness" Value="1" />
+      <Setter Property="BorderBrush" Value="{DynamicResource WarningBrush}" />
+      <Setter Property="Background" Value="{DynamicResource SurfaceBrush}" />
+      <Setter Property="HorizontalAlignment" Value="Left" />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding ValidationMessage}" Value="{x:Null}">
+          <Setter Property="Visibility" Value="Collapsed" />
+        </DataTrigger>
+        <DataTrigger Binding="{Binding ValidationMessage}" Value="">
+          <Setter Property="Visibility" Value="Collapsed" />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+  </UserControl.Resources>
+
+  <Border Background="{DynamicResource WindowBackgroundBrush}" Padding="32,26,32,24">
+    <Grid>
+      <Grid.RowDefinitions>
+        <RowDefinition Height="Auto" />
+        <RowDefinition Height="*" />
+        <RowDefinition Height="Auto" />
+      </Grid.RowDefinitions>
+
+      <StackPanel Margin="0,0,0,20">
+        <TextBlock Text="Create snapshot"
+                   Style="{DynamicResource PageTitleStyle}"
+                   Foreground="{DynamicResource TextBrush}"
+                   FontSize="24"
+                   FontWeight="SemiBold" />
+        <TextBlock Text="Choose what this machine captures, then name the snapshot and pick where it is written."
+                   Style="{DynamicResource BodyTextStyle}"
+                   Foreground="{DynamicResource MutedTextBrush}"
+                   TextWrapping="Wrap"
+                   MaxWidth="720"
+                   HorizontalAlignment="Left"
+                   Margin="0,6,0,0" />
+      </StackPanel>
+
+      <Grid Grid.Row="1">
+        <Grid.ColumnDefinitions>
+          <ColumnDefinition Width="*" MinWidth="520" />
+          <ColumnDefinition Width="20" />
+          <ColumnDefinition Width="360" />
+        </Grid.ColumnDefinitions>
+
+        <Border Style="{DynamicResource CardBorderStyle}" Padding="18,16,18,16">
+          <Grid>
+            <Grid.RowDefinitions>
+              <RowDefinition Height="Auto" />
+              <RowDefinition Height="Auto" />
+              <RowDefinition Height="*" />
+            </Grid.RowDefinitions>
+
+            <StackPanel>
+              <TextBlock Text="What to capture"
+                         Style="{DynamicResource SectionTitleStyle}"
+                         Foreground="{DynamicResource TextBrush}"
+                         FontSize="16"
+                         FontWeight="SemiBold" />
+              <TextBlock Text="Each group lists the modules it writes. Groups marked with a caution are opt-in."
+                         Style="{DynamicResource CaptionTextStyle}"
+                         Foreground="{DynamicResource MutedTextBrush}"
+                         TextWrapping="Wrap"
+                         Margin="0,4,0,0" />
+            </StackPanel>
+
+            <WrapPanel Grid.Row="1" Margin="0,14,0,14"
+                       AutomationProperties.Name="Scope presets">
+              <Button x:Name="SelectAllButton"
+                      Content="Select all"
+                      Command="{Binding SelectAllCommand}"
+                      Style="{DynamicResource SecondaryButtonStyle}"
+                      TabIndex="6"
+                      Margin="0,0,8,8"
+                      AutomationProperties.Name="Select all backup scopes"
+                      AutomationProperties.AutomationId="BackupSelectAllButton" />
+              <Button x:Name="ClearSelectionButton"
+                      Content="Clear"
+                      Command="{Binding ClearCommand}"
+                      Style="{DynamicResource SecondaryButtonStyle}"
+                      TabIndex="7"
+                      Margin="0,0,8,8"
+                      AutomationProperties.Name="Clear backup scopes"
+                      AutomationProperties.AutomationId="BackupClearSelectionButton" />
+              <Button x:Name="DeveloperMachineButton"
+                      Content="Developer machine"
+                      Command="{Binding DeveloperMachineCommand}"
+                      Style="{DynamicResource SecondaryButtonStyle}"
+                      TabIndex="8"
+                      Margin="0,0,8,8"
+                      AutomationProperties.Name="Developer machine preset"
+                      AutomationProperties.AutomationId="BackupDeveloperMachineButton" />
+              <Button x:Name="MinimalPrivacySafeButton"
+                      Content="Minimal privacy-safe"
+                      Command="{Binding MinimalPrivacySafeCommand}"
+                      Style="{DynamicResource SecondaryButtonStyle}"
+                      TabIndex="9"
+                      Margin="0,0,0,8"
+                      AutomationProperties.Name="Minimal privacy-safe preset"
+                      AutomationProperties.AutomationId="BackupMinimalPrivacySafeButton" />
+            </WrapPanel>
+
+            <ListBox x:Name="BackupScopeList"
+                     Grid.Row="2"
+                     ItemsSource="{Binding Scopes}"
+                     Background="Transparent"
+                     BorderThickness="0"
+                     Padding="0"
+                     TabIndex="1"
+                     HorizontalContentAlignment="Stretch"
+                     ItemContainerStyle="{StaticResource ScopeCardContainerStyle}"
+                     ScrollViewer.HorizontalScrollBarVisibility="Disabled"
+                     ScrollViewer.VerticalScrollBarVisibility="Auto"
+                     AutomationProperties.Name="Backup scopes"
+                     AutomationProperties.AutomationId="BackupScopeList">
+              <ListBox.ItemTemplate>
+                <DataTemplate>
+                  <CheckBox IsChecked="{Binding IsSelected, Mode=TwoWay}"
+                            VerticalContentAlignment="Top"
+                            AutomationProperties.Name="{Binding Name}">
+                    <StackPanel Margin="8,0,0,0">
+                      <TextBlock Text="{Binding Name}"
+                                 Foreground="{DynamicResource TextBrush}"
+                                 FontWeight="SemiBold"
+                                 TextWrapping="Wrap" />
+                      <TextBlock Text="{Binding Detail}"
+                                 Style="{DynamicResource BodyTextStyle}"
+                                 Foreground="{DynamicResource MutedTextBrush}"
+                                 TextWrapping="Wrap"
+                                 Margin="0,3,0,0" />
+                      <ItemsControl ItemsSource="{Binding Modules}"
+                                    Margin="0,8,0,0"
+                                    AutomationProperties.Name="Modules in this group">
+                        <ItemsControl.ItemsPanel>
+                          <ItemsPanelTemplate>
+                            <WrapPanel />
+                          </ItemsPanelTemplate>
+                        </ItemsControl.ItemsPanel>
+                        <ItemsControl.ItemTemplate>
+                          <DataTemplate>
+                            <Border Style="{DynamicResource PillBorderStyle}" Margin="0,0,6,6">
+                              <TextBlock Text="{Binding Title}"
+                                         Style="{DynamicResource PillTextStyle}"
+                                         Foreground="{DynamicResource MutedTextBrush}" />
+                            </Border>
+                          </DataTemplate>
+                        </ItemsControl.ItemTemplate>
+                      </ItemsControl>
+                      <Border Margin="0,6,0,0"
+                              Padding="10,7,12,8"
+                              CornerRadius="6"
+                              BorderThickness="1"
+                              BorderBrush="{DynamicResource WarningBrush}"
+                              Background="{DynamicResource SurfaceAltBrush}"
+                              Visibility="{Binding HasCaution, Converter={StaticResource BooleanToVisibilityConverter}}">
+                        <StackPanel>
+                          <TextBlock Text="Caution"
+                                     Style="{DynamicResource CaptionTextStyle}"
+                                     FontWeight="SemiBold"
+                                     Foreground="{DynamicResource WarningTextBrush}" />
+                          <TextBlock Text="{Binding CautionNote}"
+                                     Style="{DynamicResource BodyTextStyle}"
+                                     Foreground="{DynamicResource WarningTextBrush}"
+                                     TextWrapping="Wrap"
+                                     Margin="0,2,0,0" />
+                        </StackPanel>
+                      </Border>
+                    </StackPanel>
+                  </CheckBox>
+                </DataTemplate>
+              </ListBox.ItemTemplate>
+            </ListBox>
+          </Grid>
+        </Border>
+
+        <Border Grid.Column="2" Style="{DynamicResource CardBorderStyle}" Padding="18,16,18,18">
+          <ScrollViewer VerticalScrollBarVisibility="Auto" HorizontalScrollBarVisibility="Disabled">
+            <StackPanel>
+              <TextBlock Text="Snapshot details"
+                         Style="{DynamicResource SectionTitleStyle}"
+                         Foreground="{DynamicResource TextBrush}"
+                         FontSize="16"
+                         FontWeight="SemiBold"
+                         Margin="0,0,0,14" />
+
+              <Label Content="Snapshot name (optional)"
+                     Padding="0"
+                     Margin="0,0,0,4"
+                     FontSize="12"
+                     Foreground="{DynamicResource MutedTextBrush}"
+                     Target="{Binding ElementName=SnapshotNameTextBox}" />
+              <TextBox x:Name="SnapshotNameTextBox"
+                       Text="{Binding SnapshotName, UpdateSourceTrigger=PropertyChanged}"
+                       Padding="8,6"
+                       TabIndex="2"
+                       AutomationProperties.Name="Snapshot name"
+                       AutomationProperties.AutomationId="SnapshotNameTextBox" />
+              <TextBlock Text="Left blank, the run names the snapshot from its start time."
+                         Style="{DynamicResource CaptionTextStyle}"
+                         Foreground="{DynamicResource MutedTextBrush}"
+                         TextWrapping="Wrap"
+                         Margin="0,5,0,0" />
+
+              <Label Content="Destination folder"
+                     Padding="0"
+                     Margin="0,18,0,4"
+                     FontSize="12"
+                     Foreground="{DynamicResource MutedTextBrush}"
+                     Target="{Binding ElementName=DestinationTextBox}" />
+              <DockPanel LastChildFill="True">
+                <Button x:Name="BrowseDestinationButton"
+                        Content="Browse"
+                        Click="BrowseDestination_Click"
+                        DockPanel.Dock="Right"
+                        Style="{DynamicResource SecondaryButtonStyle}"
+                        TabIndex="4"
+                        Margin="8,0,0,0"
+                        AutomationProperties.Name="Browse destination"
+                        AutomationProperties.AutomationId="BrowseDestinationButton" />
+                <TextBox x:Name="DestinationTextBox"
+                         Text="{Binding Destination, UpdateSourceTrigger=PropertyChanged}"
+                         Padding="8,6"
+                         TabIndex="3"
+                         AutomationProperties.Name="Destination folder"
+                         AutomationProperties.AutomationId="BackupDestinationTextBox" />
+              </DockPanel>
+
+              <Label Content="Compression"
+                     Padding="0"
+                     Margin="0,18,0,4"
+                     FontSize="12"
+                     Foreground="{DynamicResource MutedTextBrush}"
+                     Target="{Binding ElementName=CompressionComboBox}" />
+              <ComboBox x:Name="CompressionComboBox"
+                        ItemsSource="{Binding CompressionOptions}"
+                        SelectedItem="{Binding Compression}"
+                        Padding="8,6"
+                        TabIndex="5"
+                        AutomationProperties.Name="Compression"
+                        AutomationProperties.AutomationId="CompressionComboBox" />
+              <TextBlock Text="Compression trades snapshot size against the time the run takes."
+                         Style="{DynamicResource CaptionTextStyle}"
+                         Foreground="{DynamicResource MutedTextBrush}"
+                         TextWrapping="Wrap"
+                         Margin="0,5,0,0" />
+            </StackPanel>
+          </ScrollViewer>
+        </Border>
+      </Grid>
+
+      <Border Grid.Row="2"
+              Margin="0,20,0,0"
+              Padding="0,18,0,0"
+              BorderThickness="0,1,0,0"
+              BorderBrush="{DynamicResource DividerBrush}">
+        <Grid>
+          <Grid.ColumnDefinitions>
+            <ColumnDefinition Width="*" />
+            <ColumnDefinition Width="Auto" />
+          </Grid.ColumnDefinitions>
+          <Border Style="{StaticResource ValidationCalloutStyle}"
+                  Margin="0,0,20,0"
+                  VerticalAlignment="Center">
+            <StackPanel Orientation="Horizontal">
+              <TextBlock Text="Cannot start"
+                         Style="{DynamicResource CaptionTextStyle}"
+                         FontWeight="SemiBold"
+                         Foreground="{DynamicResource WarningTextBrush}"
+                         Margin="0,0,10,0"
+                         VerticalAlignment="Center" />
+              <TextBlock Text="{Binding ValidationMessage}"
+                         Style="{DynamicResource BodyTextStyle}"
+                         TextWrapping="Wrap"
+                         MaxWidth="520"
+                         Foreground="{DynamicResource WarningTextBrush}"
+                         AutomationProperties.LiveSetting="Polite"
+                         AutomationProperties.Name="Snapshot validation"
+                         AutomationProperties.AutomationId="BackupValidationMessage" />
+            </StackPanel>
+          </Border>
+          <Button x:Name="CreateSnapshotButton"
+                  Grid.Column="1"
+                  Content="Create snapshot"
+                  Command="{Binding StartCommand}"
+                  Style="{DynamicResource PrimaryButtonStyle}"
+                  TabIndex="10"
+                  MinWidth="160"
+                  AutomationProperties.Name="Create snapshot"
+                  AutomationProperties.AutomationId="CreateSnapshotButton" />
+        </Grid>
+      </Border>
+    </Grid>
+  </Border>
+</UserControl>
diff --git a/src/WinRestoreKit.Wpf/Views/BackupWorkspaceView.xaml.cs b/src/WinRestoreKit.Wpf/Views/BackupWorkspaceView.xaml.cs
new file mode 100644
index 0000000..e15ae0e
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/BackupWorkspaceView.xaml.cs
@@ -0,0 +1,25 @@
+using Microsoft.Win32;
+using System.Windows;
+using System.Windows.Controls;
+using WinRestoreKit.Wpf.ViewModels;
+
+namespace WinRestoreKit.Wpf.Views
+{
+    public partial class BackupWorkspaceView : UserControl
+    {
+        public BackupWorkspaceView()
+        {
+            InitializeComponent();
+        }
+
+        private void BrowseDestination_Click(object sender, RoutedEventArgs e)
+        {
+            if (DataContext is not BackupWorkspaceViewModel workspace)
+                return;
+
+            var dialog = new OpenFolderDialog();
+            if (dialog.ShowDialog() == true)
+                workspace.Destination = dialog.FolderName;
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml b/src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml
new file mode 100644
index 0000000..5d5b9d7
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml
@@ -0,0 +1,564 @@
+<UserControl x:Class="WinRestoreKit.Wpf.Views.ComparisonWorkspaceView"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             AutomationProperties.Name="Snapshot comparison workspace"
+             AutomationProperties.AutomationId="ComparisonWorkspace">
+  <UserControl.Resources>
+    <BooleanToVisibilityConverter x:Key="BooleanToVisibilityConverter" />
+
+    <!-- Evidence state is text + glyph + position, never colour alone. StateLabel carries the
+         Core enum name; the triggers below are the only place NotCaptured becomes readable. -->
+    <Style x:Key="StateGlyphStyle" TargetType="{x:Type TextBlock}">
+      <Setter Property="FontFamily" Value="Segoe Fluent Icons, Segoe MDL2 Assets" />
+      <Setter Property="FontSize" Value="14" />
+      <Setter Property="Text" Value="&#xE72C;" />
+      <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+      <Setter Property="VerticalAlignment" Value="Center" />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding StateLabel}" Value="Changed">
+          <Setter Property="Text" Value="&#xE895;" />
+          <Setter Property="Foreground" Value="{DynamicResource AccentBrush}" />
+        </DataTrigger>
+        <DataTrigger Binding="{Binding StateLabel}" Value="Same">
+          <Setter Property="Text" Value="&#xE73E;" />
+        </DataTrigger>
+        <DataTrigger Binding="{Binding StateLabel}" Value="Unavailable">
+          <Setter Property="Text" Value="&#xE7BA;" />
+          <Setter Property="Foreground" Value="{DynamicResource WarningTextBrush}" />
+        </DataTrigger>
+        <DataTrigger Binding="{Binding StateLabel}" Value="NotCaptured">
+          <Setter Property="Text" Value="&#xE946;" />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+
+    <Style x:Key="StateNameStyle" TargetType="{x:Type TextBlock}">
+      <Setter Property="FontSize" Value="12" />
+      <Setter Property="FontWeight" Value="SemiBold" />
+      <Setter Property="VerticalAlignment" Value="Center" />
+      <Setter Property="Margin" Value="6,0,0,0" />
+      <Setter Property="Text" Value="Checking" />
+      <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding StateLabel}" Value="Changed">
+          <Setter Property="Text" Value="Changed" />
+          <Setter Property="Foreground" Value="{DynamicResource AccentBrush}" />
+        </DataTrigger>
+        <DataTrigger Binding="{Binding StateLabel}" Value="Same">
+          <Setter Property="Text" Value="Same" />
+        </DataTrigger>
+        <DataTrigger Binding="{Binding StateLabel}" Value="Unavailable">
+          <Setter Property="Text" Value="Unavailable" />
+          <Setter Property="Foreground" Value="{DynamicResource WarningTextBrush}" />
+        </DataTrigger>
+        <DataTrigger Binding="{Binding StateLabel}" Value="NotCaptured">
+          <Setter Property="Text" Value="Not captured" />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+
+    <!-- RestoreTargetKind reaches the tray as an enum; never show the member name. -->
+    <Style x:Key="TargetKindStyle" TargetType="{x:Type TextBlock}">
+      <Setter Property="FontSize" Value="11" />
+      <Setter Property="FontWeight" Value="SemiBold" />
+      <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+      <Setter Property="Text" Value="Command" />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding Kind}" Value="RegistryKey">
+          <Setter Property="Text" Value="Registry key" />
+        </DataTrigger>
+        <DataTrigger Binding="{Binding Kind}" Value="Folder">
+          <Setter Property="Text" Value="Folder" />
+        </DataTrigger>
+        <DataTrigger Binding="{Binding Kind}" Value="File">
+          <Setter Property="Text" Value="File" />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+
+    <!-- NeedsConsent is a bool; "True" is not an answer a user can act on. -->
+    <Style x:Key="ConsentNoteStyle" TargetType="{x:Type TextBlock}">
+      <Setter Property="FontSize" Value="12" />
+      <Setter Property="TextWrapping" Value="Wrap" />
+      <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+      <Setter Property="Text" Value="Closes and restarts on its own." />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding NeedsConsent}" Value="True">
+          <Setter Property="Text" Value="You will be asked before this is closed." />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+
+    <Style x:Key="FilterChipStyle" TargetType="{x:Type RadioButton}">
+      <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+      <Setter Property="FontSize" Value="13" />
+      <Setter Property="Padding" Value="12,6" />
+      <Setter Property="SnapsToDevicePixels" Value="True" />
+      <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+      <Setter Property="Template">
+        <Setter.Value>
+          <ControlTemplate TargetType="{x:Type RadioButton}">
+            <Border x:Name="chip" CornerRadius="6" Padding="{TemplateBinding Padding}"
+                    Background="Transparent" BorderThickness="1"
+                    BorderBrush="{DynamicResource DividerBrush}" SnapsToDevicePixels="True">
+              <StackPanel Orientation="Horizontal">
+                <TextBlock x:Name="check" Text="&#xE73E;" FontSize="12" Margin="0,0,6,0"
+                           VerticalAlignment="Center" Visibility="Collapsed"
+                           FontFamily="Segoe Fluent Icons, Segoe MDL2 Assets"
+                           Foreground="{DynamicResource AccentBrush}" />
+                <ContentPresenter VerticalAlignment="Center" />
+              </StackPanel>
+            </Border>
+            <ControlTemplate.Triggers>
+              <Trigger Property="IsMouseOver" Value="True">
+                <Setter TargetName="chip" Property="Background" Value="{DynamicResource SurfaceBrush}" />
+              </Trigger>
+              <Trigger Property="IsChecked" Value="True">
+                <Setter TargetName="chip" Property="Background" Value="{DynamicResource SurfaceBrush}" />
+                <Setter TargetName="chip" Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+                <Setter TargetName="check" Property="Visibility" Value="Visible" />
+                <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+                <Setter Property="FontWeight" Value="SemiBold" />
+              </Trigger>
+              <Trigger Property="IsKeyboardFocused" Value="True">
+                <Setter TargetName="chip" Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+                <Setter TargetName="chip" Property="BorderThickness" Value="2" />
+                <Setter TargetName="chip" Property="Padding" Value="11,5" />
+              </Trigger>
+            </ControlTemplate.Triggers>
+          </ControlTemplate>
+        </Setter.Value>
+      </Setter>
+    </Style>
+
+    <Style x:Key="FlatListBoxStyle" TargetType="{x:Type ListBox}">
+      <Setter Property="Background" Value="Transparent" />
+      <Setter Property="BorderThickness" Value="0" />
+      <Setter Property="Padding" Value="0" />
+      <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+      <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+      <Setter Property="ScrollViewer.HorizontalScrollBarVisibility" Value="Disabled" />
+    </Style>
+
+    <Style x:Key="EvidenceRowStyle" TargetType="{x:Type ListBoxItem}">
+      <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+      <Setter Property="Padding" Value="0" />
+      <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+      <Setter Property="Template">
+        <Setter.Value>
+          <ControlTemplate TargetType="{x:Type ListBoxItem}">
+            <Grid SnapsToDevicePixels="True">
+              <Grid.ColumnDefinitions>
+                <ColumnDefinition Width="4" />
+                <ColumnDefinition Width="*" />
+              </Grid.ColumnDefinitions>
+              <Border x:Name="marker" Grid.Column="0" Background="Transparent" CornerRadius="2,0,0,2" />
+              <Border x:Name="fill" Grid.Column="1" Background="Transparent"
+                      BorderBrush="Transparent" BorderThickness="0,0,0,1">
+                <ContentPresenter Margin="0" />
+              </Border>
+            </Grid>
+            <ControlTemplate.Triggers>
+              <Trigger Property="IsMouseOver" Value="True">
+                <Setter TargetName="fill" Property="Background" Value="{DynamicResource WindowBackgroundBrush}" />
+              </Trigger>
+              <Trigger Property="IsSelected" Value="True">
+                <Setter TargetName="fill" Property="Background" Value="{DynamicResource WindowBackgroundBrush}" />
+                <Setter TargetName="marker" Property="Background" Value="{DynamicResource AccentBrush}" />
+              </Trigger>
+              <Trigger Property="IsKeyboardFocused" Value="True">
+                <Setter TargetName="fill" Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+                <Setter TargetName="fill" Property="BorderThickness" Value="2" />
+              </Trigger>
+            </ControlTemplate.Triggers>
+          </ControlTemplate>
+        </Setter.Value>
+      </Setter>
+    </Style>
+
+    <Style x:Key="RestoreSetRowStyle" TargetType="{x:Type ListBoxItem}">
+      <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+      <Setter Property="Padding" Value="0" />
+      <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+      <Setter Property="Template">
+        <Setter.Value>
+          <ControlTemplate TargetType="{x:Type ListBoxItem}">
+            <Border x:Name="fill" Background="Transparent" BorderBrush="Transparent"
+                    BorderThickness="1" CornerRadius="4" Padding="8,5" SnapsToDevicePixels="True">
+              <ContentPresenter />
+            </Border>
+            <ControlTemplate.Triggers>
+              <Trigger Property="IsMouseOver" Value="True">
+                <Setter TargetName="fill" Property="Background" Value="{DynamicResource WindowBackgroundBrush}" />
+              </Trigger>
+              <Trigger Property="IsSelected" Value="True">
+                <Setter TargetName="fill" Property="Background" Value="{DynamicResource WindowBackgroundBrush}" />
+              </Trigger>
+              <Trigger Property="IsKeyboardFocused" Value="True">
+                <Setter TargetName="fill" Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+              </Trigger>
+            </ControlTemplate.Triggers>
+          </ControlTemplate>
+        </Setter.Value>
+      </Setter>
+    </Style>
+  </UserControl.Resources>
+
+  <Grid Margin="24,20,24,20">
+    <Grid.RowDefinitions>
+      <RowDefinition Height="Auto" />
+      <RowDefinition Height="Auto" />
+      <RowDefinition Height="*" />
+    </Grid.RowDefinitions>
+
+    <!-- Which snapshot the evidence below is measured against. -->
+    <StackPanel Grid.Row="0" Margin="0,0,0,14">
+      <TextBlock Text="Compare" Style="{DynamicResource PageTitleStyle}"
+                 Foreground="{DynamicResource TextBrush}" />
+      <StackPanel Orientation="Horizontal" Margin="0,4,0,0">
+        <TextBlock Text="Current PC against" FontSize="13"
+                   Foreground="{DynamicResource MutedTextBrush}" VerticalAlignment="Center" />
+        <TextBlock Text="{Binding Snapshot.DisplayName}" FontSize="13" FontWeight="SemiBold"
+                   Margin="5,0,0,0" Foreground="{DynamicResource TextBrush}" VerticalAlignment="Center" />
+        <TextBlock Text="{Binding Snapshot.Created, StringFormat='{}{0:d MMM yyyy, HH:mm}'}"
+                   FontSize="13" Margin="10,0,0,0" Foreground="{DynamicResource MutedTextBrush}"
+                   VerticalAlignment="Center" />
+        <TextBlock Text="{Binding Snapshot.MachineName}" FontSize="13" Margin="10,0,0,0"
+                   Foreground="{DynamicResource MutedTextBrush}" VerticalAlignment="Center" />
+        <Border BorderBrush="{DynamicResource WarningBrush}" BorderThickness="1" CornerRadius="6"
+                Padding="8,2" Margin="12,0,0,0" VerticalAlignment="Center">
+          <Border.Style>
+            <Style TargetType="{x:Type Border}">
+              <Setter Property="Visibility" Value="Collapsed" />
+              <Style.Triggers>
+                <DataTrigger Binding="{Binding Snapshot.Kind}" Value="Partial">
+                  <Setter Property="Visibility" Value="Visible" />
+                </DataTrigger>
+              </Style.Triggers>
+            </Style>
+          </Border.Style>
+          <TextBlock Text="Partial snapshot" Style="{DynamicResource PillTextStyle}"
+                     Foreground="{DynamicResource WarningTextBrush}" />
+        </Border>
+      </StackPanel>
+    </StackPanel>
+
+    <!-- Filters lead the keyboard path, exactly as before. -->
+    <Grid Grid.Row="1" Margin="0,0,0,12">
+      <Grid.ColumnDefinitions>
+        <ColumnDefinition Width="Auto" />
+        <ColumnDefinition Width="*" />
+      </Grid.ColumnDefinitions>
+      <StackPanel Orientation="Horizontal">
+        <TextBlock Text="Show" FontSize="13" VerticalAlignment="Center" Margin="0,0,10,0"
+                   Foreground="{DynamicResource MutedTextBrush}" />
+        <RadioButton Content="All modules" GroupName="ComparisonFilter" IsChecked="{Binding IsAllFilter, Mode=TwoWay}"
+                     Style="{StaticResource FilterChipStyle}"
+                     AutomationProperties.Name="Show all compared modules" AutomationProperties.AutomationId="CompareFilterAll" />
+        <RadioButton Content="Changed only" GroupName="ComparisonFilter" Margin="8,0,0,0" IsChecked="{Binding IsChangedOnlyFilter, Mode=TwoWay}"
+                     Style="{StaticResource FilterChipStyle}"
+                     AutomationProperties.Name="Show only changed modules" AutomationProperties.AutomationId="CompareFilterChanged" />
+      </StackPanel>
+      <StackPanel Grid.Column="1" Orientation="Horizontal" HorizontalAlignment="Right" VerticalAlignment="Center">
+        <TextBlock Text="Comparing modules&#8230;" FontSize="13" Margin="0,0,10,0"
+                   Foreground="{DynamicResource MutedTextBrush}"
+                   Visibility="{Binding IsComparing, Converter={StaticResource BooleanToVisibilityConverter}}" />
+        <TextBlock Text="{Binding ComparisonStatus}" FontSize="13"
+                   Foreground="{DynamicResource MutedTextBrush}" />
+      </StackPanel>
+    </Grid>
+
+    <!-- Two panes: evidence on the left, the restore set and detail tray on the right.
+         Children are declared restore set -> continue -> evidence -> tray so the tab order
+         is the one the workspace shipped with; Grid.Column/Row places them visually. -->
+    <Grid Grid.Row="2">
+      <Grid.ColumnDefinitions>
+        <ColumnDefinition Width="*" MinWidth="420" />
+        <ColumnDefinition Width="360" />
+      </Grid.ColumnDefinitions>
+      <Grid.RowDefinitions>
+        <RowDefinition Height="Auto" />
+        <RowDefinition Height="*" />
+      </Grid.RowDefinitions>
+
+      <Border Grid.Column="1" Grid.Row="0" Style="{DynamicResource CardBorderStyle}"
+              Padding="16" Margin="16,0,0,12">
+        <Grid>
+          <Grid.RowDefinitions>
+            <RowDefinition Height="Auto" />
+            <RowDefinition Height="Auto" />
+            <RowDefinition Height="Auto" />
+          </Grid.RowDefinitions>
+          <StackPanel Orientation="Horizontal">
+            <TextBlock Text="Restore set" Style="{DynamicResource SectionTitleStyle}"
+                       Foreground="{DynamicResource TextBrush}" />
+            <TextBlock Margin="8,0,0,0" FontSize="13" VerticalAlignment="Center"
+                       Foreground="{DynamicResource MutedTextBrush}">
+              <Run Text="{Binding RestoreSet.Modules.Count, Mode=OneWay}" />
+              <Run Text="selected" />
+            </TextBlock>
+          </StackPanel>
+
+          <Grid Grid.Row="1" Margin="0,10,0,0">
+            <ListBox ItemsSource="{Binding RestoreSet.Modules}" MinWidth="220" MaxHeight="180"
+                     Style="{StaticResource FlatListBoxStyle}"
+                     ItemContainerStyle="{StaticResource RestoreSetRowStyle}"
+                     AutomationProperties.Name="Modules selected for restore"
+                     AutomationProperties.AutomationId="RestoreSetList">
+              <ListBox.ItemTemplate>
+                <DataTemplate>
+                  <StackPanel Orientation="Horizontal">
+                    <TextBlock Text="&#xE73E;" FontSize="12" Margin="0,0,8,0" VerticalAlignment="Center"
+                               FontFamily="Segoe Fluent Icons, Segoe MDL2 Assets"
+                               Foreground="{DynamicResource AccentBrush}" />
+                    <TextBlock Text="{Binding Title}" FontSize="13" TextTrimming="CharacterEllipsis"
+                               Foreground="{DynamicResource TextBrush}" />
+                  </StackPanel>
+                </DataTemplate>
+              </ListBox.ItemTemplate>
+            </ListBox>
+            <TextBlock Text="Nothing selected yet. Add a module from the list to build a restore set."
+                       TextWrapping="Wrap" FontSize="13" IsHitTestVisible="False"
+                       Foreground="{DynamicResource MutedTextBrush}">
+              <TextBlock.Style>
+                <Style TargetType="{x:Type TextBlock}">
+                  <Setter Property="Visibility" Value="Collapsed" />
+                  <Style.Triggers>
+                    <DataTrigger Binding="{Binding RestoreSet.HasItems}" Value="False">
+                      <Setter Property="Visibility" Value="Visible" />
+                    </DataTrigger>
+                  </Style.Triggers>
+                </Style>
+              </TextBlock.Style>
+            </TextBlock>
+          </Grid>
+
+          <Button Grid.Row="2" Content="Continue to confirm" Command="{Binding ContinueToConfirmCommand}"
+                  IsEnabled="{Binding CanContinueToConfirm}" Margin="0,14,0,0"
+                  HorizontalAlignment="Stretch" Style="{DynamicResource PrimaryButtonStyle}"
+                  AutomationProperties.Name="Review selected modules before restore" AutomationProperties.AutomationId="CompareContinueToConfirmButton" />
+        </Grid>
+      </Border>
+
+      <Border Grid.Column="0" Grid.Row="0" Grid.RowSpan="2" Style="{DynamicResource CardBorderStyle}" Padding="0">
+        <Grid>
+          <Grid.RowDefinitions>
+            <RowDefinition Height="Auto" />
+            <RowDefinition Height="*" />
+          </Grid.RowDefinitions>
+          <Border BorderBrush="{DynamicResource DividerBrush}" BorderThickness="0,0,0,1" Padding="16,12">
+            <StackPanel Orientation="Horizontal">
+              <TextBlock Text="Evidence" Style="{DynamicResource SectionTitleStyle}"
+                         Foreground="{DynamicResource TextBrush}" />
+              <TextBlock Margin="8,0,0,0" FontSize="13" VerticalAlignment="Center"
+                         Foreground="{DynamicResource MutedTextBrush}">
+                <Run Text="{Binding VisibleRows.Count, Mode=OneWay}" />
+                <Run Text="modules" />
+              </TextBlock>
+            </StackPanel>
+          </Border>
+          <Grid Grid.Row="1">
+            <ListBox x:Name="compareModuleList" ItemsSource="{Binding VisibleRows}" SelectedItem="{Binding SelectedRow}"
+                     Style="{StaticResource FlatListBoxStyle}"
+                     ItemContainerStyle="{StaticResource EvidenceRowStyle}"
+                     AutomationProperties.Name="Compared modules"
+                     AutomationProperties.AutomationId="CompareModuleList">
+              <ListBox.ItemTemplate>
+                <DataTemplate>
+                  <Grid Margin="12,10,12,10">
+                    <Grid.ColumnDefinitions>
+                      <ColumnDefinition Width="130" />
+                      <ColumnDefinition Width="*" />
+                      <ColumnDefinition Width="Auto" />
+                    </Grid.ColumnDefinitions>
+                    <StackPanel Orientation="Horizontal" VerticalAlignment="Top" Margin="0,1,8,0">
+                      <TextBlock Style="{StaticResource StateGlyphStyle}" />
+                      <TextBlock Style="{StaticResource StateNameStyle}" />
+                    </StackPanel>
+                    <StackPanel Grid.Column="1">
+                      <StackPanel Orientation="Horizontal">
+                        <TextBlock Text="{Binding Title}" FontWeight="SemiBold" FontSize="14"
+                                   Foreground="{DynamicResource TextBrush}" />
+                        <Border BorderBrush="{DynamicResource AccentBrush}" BorderThickness="1" CornerRadius="6"
+                                Padding="7,1" Margin="8,0,0,0" VerticalAlignment="Center">
+                          <Border.Style>
+                            <Style TargetType="{x:Type Border}">
+                              <Setter Property="Visibility" Value="Collapsed" />
+                              <Style.Triggers>
+                                <DataTrigger Binding="{Binding IsInRestoreSet}" Value="True">
+                                  <Setter Property="Visibility" Value="Visible" />
+                                </DataTrigger>
+                              </Style.Triggers>
+                            </Style>
+                          </Border.Style>
+                          <TextBlock Text="In restore set" Style="{DynamicResource PillTextStyle}"
+                                     Foreground="{DynamicResource AccentBrush}" />
+                        </Border>
+                      </StackPanel>
+                      <TextBlock Text="{Binding ArtifactSummary}" TextWrapping="Wrap" FontSize="12"
+                                 Margin="0,3,0,0" Foreground="{DynamicResource MutedTextBrush}" />
+                      <TextBlock Text="This snapshot has no artifact to restore for this module."
+                                 TextWrapping="Wrap" FontSize="12" Margin="0,3,0,0"
+                                 Foreground="{DynamicResource WarningTextBrush}">
+                        <TextBlock.Style>
+                          <Style TargetType="{x:Type TextBlock}">
+                            <Setter Property="Visibility" Value="Collapsed" />
+                            <Style.Triggers>
+                              <MultiDataTrigger>
+                                <MultiDataTrigger.Conditions>
+                                  <Condition Binding="{Binding IsChecking}" Value="False" />
+                                  <Condition Binding="{Binding CanChangeRestoreSet}" Value="False" />
+                                </MultiDataTrigger.Conditions>
+                                <Setter Property="Visibility" Value="Visible" />
+                              </MultiDataTrigger>
+                            </Style.Triggers>
+                          </Style>
+                        </TextBlock.Style>
+                      </TextBlock>
+                    </StackPanel>
+                    <Button Grid.Column="2" Content="{Binding RestoreActionLabel}" Command="{Binding ToggleRestoreSetCommand}"
+                            IsEnabled="{Binding CanChangeRestoreSet}" VerticalAlignment="Top" Margin="12,0,0,0"
+                            Style="{DynamicResource SecondaryButtonStyle}"
+                            AutomationProperties.Name="{Binding RestoreActionAutomationName}" />
+                  </Grid>
+                </DataTemplate>
+              </ListBox.ItemTemplate>
+            </ListBox>
+            <TextBlock Text="No changed modules yet. Switch to All modules to see every comparison result."
+                       TextWrapping="Wrap" TextAlignment="Center" MaxWidth="320" FontSize="13"
+                       HorizontalAlignment="Center" VerticalAlignment="Center" IsHitTestVisible="False"
+                       Foreground="{DynamicResource MutedTextBrush}">
+              <TextBlock.Style>
+                <Style TargetType="{x:Type TextBlock}">
+                  <Setter Property="Visibility" Value="Collapsed" />
+                  <Style.Triggers>
+                    <DataTrigger Binding="{Binding HasItems, ElementName=compareModuleList}" Value="False">
+                      <Setter Property="Visibility" Value="Visible" />
+                    </DataTrigger>
+                  </Style.Triggers>
+                </Style>
+              </TextBlock.Style>
+            </TextBlock>
+          </Grid>
+        </Grid>
+      </Border>
+
+      <Border Grid.Column="1" Grid.Row="1" Style="{DynamicResource CardBorderStyle}" Padding="0" Margin="16,0,0,0"
+              Visibility="{Binding IsDetailTrayOpen, Converter={StaticResource BooleanToVisibilityConverter}}"
+              AutomationProperties.Name="Selected module details">
+        <Border.Effect>
+          <DropShadowEffect BlurRadius="14" ShadowDepth="0" Opacity="0.14" Color="#FF000000" />
+        </Border.Effect>
+        <ScrollViewer VerticalScrollBarVisibility="Auto" Padding="16">
+          <StackPanel DataContext="{Binding SelectedRow}">
+            <TextBlock Text="{Binding Title}" Style="{DynamicResource SectionTitleStyle}"
+                       TextWrapping="Wrap" Foreground="{DynamicResource TextBrush}" />
+            <TextBlock Text="{Binding Category}" FontSize="12" Margin="0,2,0,0"
+                       Foreground="{DynamicResource MutedTextBrush}" />
+            <StackPanel Orientation="Horizontal" Margin="0,10,0,0">
+              <TextBlock Style="{StaticResource StateGlyphStyle}" />
+              <TextBlock Style="{StaticResource StateNameStyle}" />
+            </StackPanel>
+            <TextBlock Text="{Binding ArtifactSummary}" TextWrapping="Wrap" FontSize="12" Margin="0,8,0,0"
+                       Foreground="{DynamicResource MutedTextBrush}" />
+            <TextBlock Text="{Binding Reason}" TextWrapping="Wrap" FontSize="12" Margin="0,6,0,0"
+                       Foreground="{DynamicResource MutedTextBrush}">
+              <TextBlock.Style>
+                <Style TargetType="{x:Type TextBlock}">
+                  <Style.Triggers>
+                    <DataTrigger Binding="{Binding Reason}" Value="">
+                      <Setter Property="Visibility" Value="Collapsed" />
+                    </DataTrigger>
+                  </Style.Triggers>
+                </Style>
+              </TextBlock.Style>
+            </TextBlock>
+
+            <TextBlock Text="What a restore overwrites" Margin="0,16,0,0" FontSize="12" FontWeight="SemiBold"
+                       Foreground="{DynamicResource TextBrush}" />
+            <ItemsControl ItemsSource="{Binding Impact.Targets}" Margin="0,6,0,0">
+              <ItemsControl.ItemTemplate>
+                <DataTemplate>
+                  <StackPanel Margin="0,0,0,8">
+                    <TextBlock Style="{StaticResource TargetKindStyle}" />
+                    <TextBlock Text="{Binding Path}" TextWrapping="Wrap" Margin="0,1,0,0"
+                               Style="{DynamicResource TechnicalTextStyle}"
+                               Foreground="{DynamicResource TextBrush}" />
+                  </StackPanel>
+                </DataTemplate>
+              </ItemsControl.ItemTemplate>
+            </ItemsControl>
+
+            <StackPanel Margin="0,8,0,0">
+              <StackPanel.Style>
+                <Style TargetType="{x:Type StackPanel}">
+                  <Setter Property="Visibility" Value="Visible" />
+                  <Style.Triggers>
+                    <DataTrigger Binding="{Binding Impact.Processes.Count}" Value="0">
+                      <Setter Property="Visibility" Value="Collapsed" />
+                    </DataTrigger>
+                  </Style.Triggers>
+                </Style>
+              </StackPanel.Style>
+              <TextBlock Text="Applications affected" FontSize="12" FontWeight="SemiBold"
+                         Foreground="{DynamicResource TextBrush}" />
+              <ItemsControl ItemsSource="{Binding Impact.Processes}" Margin="0,6,0,0">
+                <ItemsControl.ItemTemplate>
+                  <DataTemplate>
+                    <StackPanel Margin="0,0,0,8">
+                      <TextBlock Text="{Binding DisplayName}" FontSize="13"
+                                 Foreground="{DynamicResource TextBrush}" />
+                      <TextBlock Style="{StaticResource ConsentNoteStyle}" />
+                    </StackPanel>
+                  </DataTemplate>
+                </ItemsControl.ItemTemplate>
+              </ItemsControl>
+            </StackPanel>
+
+            <TextBlock Text="Explorer restart may be offered after successful writes."
+                       TextWrapping="Wrap" FontSize="12" Margin="0,4,0,0"
+                       Foreground="{DynamicResource MutedTextBrush}"
+                       Visibility="{Binding Impact.RequiresExplorerRestart, Converter={StaticResource BooleanToVisibilityConverter}}" />
+
+            <Border BorderBrush="{DynamicResource WarningBrush}" BorderThickness="1,0,0,0"
+                    Padding="10,2,0,2" Margin="0,12,0,0">
+              <Border.Style>
+                <Style TargetType="{x:Type Border}">
+                  <Style.Triggers>
+                    <DataTrigger Binding="{Binding Impact.WarningMessage}" Value="">
+                      <Setter Property="Visibility" Value="Collapsed" />
+                    </DataTrigger>
+                  </Style.Triggers>
+                </Style>
+              </Border.Style>
+              <TextBlock Text="{Binding Impact.WarningMessage}" TextWrapping="Wrap" FontSize="12"
+                         Foreground="{DynamicResource WarningTextBrush}" />
+            </Border>
+
+            <Button Content="{Binding RestoreActionLabel}" Command="{Binding ToggleRestoreSetCommand}"
+                    IsEnabled="{Binding CanChangeRestoreSet}" Margin="0,16,0,0"
+                    HorizontalAlignment="Stretch" Style="{DynamicResource SecondaryButtonStyle}" />
+          </StackPanel>
+        </ScrollViewer>
+      </Border>
+
+      <Border Grid.Column="1" Grid.Row="1" Margin="16,0,0,0" Padding="16"
+              BorderBrush="{DynamicResource DividerBrush}" BorderThickness="1" CornerRadius="8"
+              Background="Transparent" IsHitTestVisible="False">
+        <Border.Style>
+          <Style TargetType="{x:Type Border}">
+            <Setter Property="Visibility" Value="Collapsed" />
+            <Style.Triggers>
+              <DataTrigger Binding="{Binding IsDetailTrayOpen}" Value="False">
+                <Setter Property="Visibility" Value="Visible" />
+              </DataTrigger>
+            </Style.Triggers>
+          </Style>
+        </Border.Style>
+        <TextBlock Text="Select a module to see its evidence, what a restore overwrites, and which applications it affects."
+                   TextWrapping="Wrap" FontSize="13" VerticalAlignment="Top"
+                   Foreground="{DynamicResource MutedTextBrush}" />
+      </Border>
+    </Grid>
+  </Grid>
+</UserControl>
diff --git a/src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml.cs b/src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml.cs
new file mode 100644
index 0000000..27ac92e
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/ComparisonWorkspaceView.xaml.cs
@@ -0,0 +1,12 @@
+using System.Windows.Controls;
+
+namespace WinRestoreKit.Wpf.Views
+{
+    public partial class ComparisonWorkspaceView : UserControl
+    {
+        public ComparisonWorkspaceView()
+        {
+            InitializeComponent();
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Views/ConfirmView.xaml b/src/WinRestoreKit.Wpf/Views/ConfirmView.xaml
new file mode 100644
index 0000000..ee60af6
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/ConfirmView.xaml
@@ -0,0 +1,342 @@
+<UserControl x:Class="WinRestoreKit.Wpf.Views.ConfirmView"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             Loaded="ConfirmView_Loaded"
+             AutomationProperties.Name="Confirm restore">
+  <!-- Shared keys from Themes/Controls.xaml are referenced with DynamicResource: these views are
+       loaded by tests on a bare STA thread where Application.Current is null, so a StaticResource
+       lookup for an app-level key throws during InitializeComponent. Keys declared below are
+       local to this file and resolve statically. -->
+  <UserControl.Resources>
+    <BooleanToVisibilityConverter x:Key="BooleanToVisibilityConverter" />
+
+    <Style x:Key="ReviewItemStyle" TargetType="{x:Type TextBlock}">
+      <Setter Property="FontSize" Value="13" />
+      <Setter Property="TextWrapping" Value="Wrap" />
+      <Setter Property="Margin" Value="0,0,0,4" />
+      <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    </Style>
+
+    <Style x:Key="GroupCaptionStyle" TargetType="{x:Type TextBlock}">
+      <Setter Property="FontSize" Value="12" />
+      <Setter Property="TextWrapping" Value="Wrap" />
+      <Setter Property="Margin" Value="0,0,0,6" />
+      <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+    </Style>
+
+    <Style x:Key="SectionGlyphStyle" TargetType="{x:Type TextBlock}">
+      <Setter Property="FontFamily" Value="Segoe Fluent Icons, Segoe MDL2 Assets" />
+      <Setter Property="FontSize" Value="12" />
+      <Setter Property="Margin" Value="0,0,10,0" />
+      <Setter Property="VerticalAlignment" Value="Center" />
+    </Style>
+  </UserControl.Resources>
+
+  <Grid Margin="24,20,24,0">
+    <Grid.RowDefinitions>
+      <RowDefinition Height="Auto" />
+      <RowDefinition Height="*" />
+      <RowDefinition Height="Auto" />
+    </Grid.RowDefinitions>
+
+    <StackPanel Grid.Row="0" Margin="0,0,0,16">
+      <TextBlock Text="Review restore impact" Style="{DynamicResource PageTitleStyle}"
+                 Foreground="{DynamicResource TextBrush}" />
+      <StackPanel Orientation="Horizontal" Margin="0,4,0,0">
+        <TextBlock Text="Restoring from" FontSize="13" VerticalAlignment="Center"
+                   Foreground="{DynamicResource MutedTextBrush}" />
+        <TextBlock Text="{Binding Snapshot.DisplayName}" FontSize="13" FontWeight="SemiBold" Margin="5,0,0,0"
+                   VerticalAlignment="Center" Foreground="{DynamicResource TextBrush}" />
+        <TextBlock Text="{Binding Snapshot.Created, StringFormat='{}{0:d MMM yyyy, HH:mm}'}" FontSize="13"
+                   Margin="10,0,0,0" VerticalAlignment="Center" Foreground="{DynamicResource MutedTextBrush}" />
+      </StackPanel>
+
+      <Border Background="{DynamicResource SurfaceBrush}" BorderBrush="{DynamicResource WarningBrush}"
+              BorderThickness="1" CornerRadius="8" Padding="14,10" Margin="0,14,0,0"
+              MaxWidth="880" HorizontalAlignment="Left"
+              Visibility="{Binding IsSourcePartial, Converter={StaticResource BooleanToVisibilityConverter}}">
+        <StackPanel Orientation="Horizontal">
+          <TextBlock Text="&#xE7BA;" FontFamily="Segoe Fluent Icons, Segoe MDL2 Assets" FontSize="15"
+                     VerticalAlignment="Top" Margin="0,1,10,0"
+                     Foreground="{DynamicResource WarningTextBrush}" />
+          <StackPanel>
+            <TextBlock Text="Selected source is partial." TextWrapping="Wrap" FontSize="13" FontWeight="SemiBold"
+                       Foreground="{DynamicResource WarningTextBrush}" />
+            <TextBlock Text="Some modules may be missing from this snapshot. You will be asked to consent again before anything is written."
+                       TextWrapping="Wrap" FontSize="12" Margin="0,3,0,0"
+                       Foreground="{DynamicResource MutedTextBrush}" />
+          </StackPanel>
+        </StackPanel>
+      </Border>
+    </StackPanel>
+
+    <ScrollViewer Grid.Row="1" VerticalScrollBarVisibility="Auto" HorizontalScrollBarVisibility="Disabled">
+      <StackPanel MaxWidth="880" HorizontalAlignment="Left" Margin="0,0,0,16">
+
+        <Border Style="{DynamicResource CardBorderStyle}" Margin="0,0,0,12">
+          <StackPanel>
+            <StackPanel Orientation="Horizontal">
+              <TextBlock Text="Modules to restore" Style="{DynamicResource SectionTitleStyle}"
+                         Foreground="{DynamicResource TextBrush}" />
+              <TextBlock Margin="8,0,0,0" FontSize="13" VerticalAlignment="Center"
+                         Foreground="{DynamicResource MutedTextBrush}">
+                <Run Text="{Binding Modules.Count, Mode=OneWay}" />
+                <Run Text="selected" />
+              </TextBlock>
+            </StackPanel>
+            <ItemsControl x:Name="moduleList" ItemsSource="{Binding Modules}" Margin="0,10,0,0"
+                          AutomationProperties.Name="Modules selected for restore">
+              <ItemsControl.ItemTemplate>
+                <DataTemplate>
+                  <StackPanel Orientation="Horizontal" Margin="0,0,0,5">
+                    <TextBlock Text="&#xE73E;" Style="{StaticResource SectionGlyphStyle}"
+                               Foreground="{DynamicResource AccentBrush}" />
+                    <TextBlock Text="{Binding Title}" Style="{StaticResource ReviewItemStyle}" Margin="0" />
+                  </StackPanel>
+                </DataTemplate>
+              </ItemsControl.ItemTemplate>
+            </ItemsControl>
+            <TextBlock Text="No modules are selected. Go back to Compare and add at least one module."
+                       Margin="0,10,0,0">
+              <TextBlock.Style>
+                <Style TargetType="{x:Type TextBlock}" BasedOn="{StaticResource GroupCaptionStyle}">
+                  <Setter Property="Visibility" Value="Collapsed" />
+                  <Style.Triggers>
+                    <DataTrigger Binding="{Binding HasItems, ElementName=moduleList}" Value="False">
+                      <Setter Property="Visibility" Value="Visible" />
+                    </DataTrigger>
+                  </Style.Triggers>
+                </Style>
+              </TextBlock.Style>
+            </TextBlock>
+          </StackPanel>
+        </Border>
+
+        <Grid>
+          <Grid.Style>
+            <Style TargetType="{x:Type Grid}">
+              <Style.Triggers>
+                <MultiDataTrigger>
+                  <MultiDataTrigger.Conditions>
+                    <Condition Binding="{Binding HasItems, ElementName=consentList}" Value="False" />
+                    <Condition Binding="{Binding HasItems, ElementName=informationalList}" Value="False" />
+                  </MultiDataTrigger.Conditions>
+                  <Setter Property="Visibility" Value="Collapsed" />
+                </MultiDataTrigger>
+              </Style.Triggers>
+            </Style>
+          </Grid.Style>
+          <Border Style="{DynamicResource CardBorderStyle}" Margin="0,0,0,12">
+            <StackPanel>
+              <TextBlock Text="Applications" Style="{DynamicResource SectionTitleStyle}"
+                         Foreground="{DynamicResource TextBrush}" />
+
+              <StackPanel Margin="0,12,0,0">
+                <StackPanel.Style>
+                  <Style TargetType="{x:Type StackPanel}">
+                    <Style.Triggers>
+                      <DataTrigger Binding="{Binding HasItems, ElementName=consentList}" Value="False">
+                        <Setter Property="Visibility" Value="Collapsed" />
+                      </DataTrigger>
+                    </Style.Triggers>
+                  </Style>
+                </StackPanel.Style>
+                <TextBlock Text="You will be asked to close these before anything is written."
+                           Style="{StaticResource GroupCaptionStyle}" />
+                <ItemsControl x:Name="consentList" ItemsSource="{Binding ConsentProcesses}"
+                              AutomationProperties.Name="Applications requiring consent to close">
+                  <ItemsControl.ItemTemplate>
+                    <DataTemplate>
+                      <StackPanel Orientation="Horizontal" Margin="0,0,0,5">
+                        <TextBlock Text="&#xE7BA;" Style="{StaticResource SectionGlyphStyle}"
+                                   Foreground="{DynamicResource WarningTextBrush}" />
+                        <TextBlock Text="{Binding DisplayName}" Style="{StaticResource ReviewItemStyle}" Margin="0" />
+                      </StackPanel>
+                    </DataTemplate>
+                  </ItemsControl.ItemTemplate>
+                </ItemsControl>
+              </StackPanel>
+
+              <StackPanel Margin="0,14,0,0">
+                <StackPanel.Style>
+                  <Style TargetType="{x:Type StackPanel}">
+                    <Style.Triggers>
+                      <DataTrigger Binding="{Binding HasItems, ElementName=informationalList}" Value="False">
+                        <Setter Property="Visibility" Value="Collapsed" />
+                      </DataTrigger>
+                    </Style.Triggers>
+                  </Style>
+                </StackPanel.Style>
+                <TextBlock Text="These close and come back on their own; Windows restarts them."
+                           Style="{StaticResource GroupCaptionStyle}" />
+                <ItemsControl x:Name="informationalList" ItemsSource="{Binding InformationalProcesses}"
+                              AutomationProperties.Name="Applications that will restart themselves">
+                  <ItemsControl.ItemTemplate>
+                    <DataTemplate>
+                      <StackPanel Orientation="Horizontal" Margin="0,0,0,5">
+                        <TextBlock Text="&#xE946;" Style="{StaticResource SectionGlyphStyle}"
+                                   Foreground="{DynamicResource MutedTextBrush}" />
+                        <TextBlock Text="{Binding DisplayName}" Style="{StaticResource ReviewItemStyle}" Margin="0" />
+                      </StackPanel>
+                    </DataTemplate>
+                  </ItemsControl.ItemTemplate>
+                </ItemsControl>
+              </StackPanel>
+            </StackPanel>
+          </Border>
+        </Grid>
+
+        <Grid>
+          <Grid.Style>
+            <Style TargetType="{x:Type Grid}">
+              <Style.Triggers>
+                <DataTrigger Binding="{Binding HasItems, ElementName=explorerList}" Value="False">
+                  <Setter Property="Visibility" Value="Collapsed" />
+                </DataTrigger>
+              </Style.Triggers>
+            </Style>
+          </Grid.Style>
+          <Border Style="{DynamicResource CardBorderStyle}" Margin="0,0,0,12">
+            <StackPanel>
+              <TextBlock Text="Windows Explorer" Style="{DynamicResource SectionTitleStyle}"
+                         Foreground="{DynamicResource TextBrush}" />
+              <TextBlock Text="After a successful write, these modules may offer to restart Explorer so the change appears."
+                         Style="{StaticResource GroupCaptionStyle}" Margin="0,8,0,6" />
+              <ItemsControl x:Name="explorerList" ItemsSource="{Binding ExplorerRestartModules}"
+                            AutomationProperties.Name="Modules that may offer Explorer restart">
+                <ItemsControl.ItemTemplate>
+                  <DataTemplate>
+                    <TextBlock Text="{Binding Title}" Style="{StaticResource ReviewItemStyle}" />
+                  </DataTemplate>
+                </ItemsControl.ItemTemplate>
+              </ItemsControl>
+            </StackPanel>
+          </Border>
+        </Grid>
+
+        <Grid>
+          <Grid.Style>
+            <Style TargetType="{x:Type Grid}">
+              <Style.Triggers>
+                <DataTrigger Binding="{Binding HasItems, ElementName=warningList}" Value="False">
+                  <Setter Property="Visibility" Value="Collapsed" />
+                </DataTrigger>
+              </Style.Triggers>
+            </Style>
+          </Grid.Style>
+          <Border Style="{DynamicResource CardBorderStyle}" Margin="0,0,0,12"
+                  BorderBrush="{DynamicResource WarningBrush}">
+            <StackPanel>
+              <StackPanel Orientation="Horizontal">
+                <TextBlock Text="&#xE7BA;" FontFamily="Segoe Fluent Icons, Segoe MDL2 Assets" FontSize="15"
+                           Margin="0,0,10,0" VerticalAlignment="Center"
+                           Foreground="{DynamicResource WarningTextBrush}" />
+                <TextBlock Text="Before you continue" Style="{DynamicResource SectionTitleStyle}"
+                           Foreground="{DynamicResource TextBrush}" />
+              </StackPanel>
+              <ItemsControl x:Name="warningList" ItemsSource="{Binding ModuleWarnings}" Margin="0,10,0,0"
+                            AutomationProperties.Name="Existing module warnings">
+                <ItemsControl.ItemTemplate>
+                  <DataTemplate>
+                    <StackPanel Margin="0,0,0,10">
+                      <TextBlock Text="{Binding Title}" FontWeight="SemiBold" FontSize="13"
+                                 Foreground="{DynamicResource TextBrush}" />
+                      <TextBlock Text="{Binding Text}" TextWrapping="Wrap" FontSize="12" Margin="0,2,0,0"
+                                 Foreground="{DynamicResource MutedTextBrush}" />
+                    </StackPanel>
+                  </DataTemplate>
+                </ItemsControl.ItemTemplate>
+              </ItemsControl>
+            </StackPanel>
+          </Border>
+        </Grid>
+
+        <Grid>
+          <Grid.Style>
+            <Style TargetType="{x:Type Grid}">
+              <Style.Triggers>
+                <MultiDataTrigger>
+                  <MultiDataTrigger.Conditions>
+                    <Condition Binding="{Binding ProgressText}" Value="" />
+                    <Condition Binding="{Binding Summary}" Value="{x:Null}" />
+                  </MultiDataTrigger.Conditions>
+                  <Setter Property="Visibility" Value="Collapsed" />
+                </MultiDataTrigger>
+              </Style.Triggers>
+            </Style>
+          </Grid.Style>
+          <Border Style="{DynamicResource CardBorderStyle}" Margin="0,0,0,12">
+            <StackPanel>
+              <TextBlock Text="Restore status" Style="{DynamicResource SectionTitleStyle}"
+                         Foreground="{DynamicResource TextBrush}" />
+              <TextBlock Text="{Binding ProgressText}" TextWrapping="Wrap" FontSize="13" Margin="0,10,0,0"
+                         Foreground="{DynamicResource MutedTextBrush}">
+                <TextBlock.Style>
+                  <Style TargetType="{x:Type TextBlock}">
+                    <Style.Triggers>
+                      <DataTrigger Binding="{Binding ProgressText}" Value="">
+                        <Setter Property="Visibility" Value="Collapsed" />
+                      </DataTrigger>
+                    </Style.Triggers>
+                  </Style>
+                </TextBlock.Style>
+              </TextBlock>
+              <StackPanel Margin="0,10,0,0">
+                <StackPanel.Style>
+                  <Style TargetType="{x:Type StackPanel}">
+                    <Style.Triggers>
+                      <DataTrigger Binding="{Binding Summary}" Value="{x:Null}">
+                        <Setter Property="Visibility" Value="Collapsed" />
+                      </DataTrigger>
+                    </Style.Triggers>
+                  </Style>
+                </StackPanel.Style>
+                <TextBlock Text="{Binding Summary.Headline}" FontWeight="SemiBold" FontSize="14" TextWrapping="Wrap"
+                           Foreground="{DynamicResource TextBrush}" />
+                <TextBlock Text="{Binding Summary.Detail}" TextWrapping="Wrap" FontSize="13" Margin="0,4,0,0"
+                           Foreground="{DynamicResource MutedTextBrush}" />
+              </StackPanel>
+            </StackPanel>
+          </Border>
+        </Grid>
+
+        <StackPanel Orientation="Horizontal" Margin="2,2,0,0">
+          <TextBlock Text="&#xE946;" FontFamily="Segoe Fluent Icons, Segoe MDL2 Assets" FontSize="13"
+                     VerticalAlignment="Top" Margin="0,1,10,0"
+                     Foreground="{DynamicResource MutedTextBrush}" />
+          <TextBlock Text="{Binding FidelityCaveat}" TextWrapping="Wrap" FontSize="12" MaxWidth="820"
+                     Foreground="{DynamicResource MutedTextBrush}" />
+        </StackPanel>
+      </StackPanel>
+    </ScrollViewer>
+
+    <Border Grid.Row="2" BorderBrush="{DynamicResource DividerBrush}" BorderThickness="0,1,0,0"
+            Padding="0,14,0,16">
+      <Grid>
+        <Grid.ColumnDefinitions>
+          <ColumnDefinition Width="*" />
+          <ColumnDefinition Width="Auto" />
+        </Grid.ColumnDefinitions>
+        <TextBlock VerticalAlignment="Center" FontSize="13" Foreground="{DynamicResource MutedTextBrush}">
+          <Run Text="{Binding Modules.Count, Mode=OneWay}" />
+          <Run Text="modules will be written from this snapshot." />
+        </TextBlock>
+        <StackPanel Grid.Column="1" Orientation="Horizontal" HorizontalAlignment="Right">
+          <Button Content="Back to compare" Command="{Binding BackToCompareCommand}" IsEnabled="{Binding CanNavigate}"
+                  Style="{DynamicResource SecondaryButtonStyle}" />
+          <Button Content="Cancel restore" Command="{Binding CancelRestoreCommand}" IsEnabled="{Binding IsRestoring}" Margin="8,0,0,0"
+                  Style="{DynamicResource DangerButtonStyle}" />
+          <Button Command="{Binding StartRestoreCommand}" IsEnabled="{Binding CanStartRestore}" Margin="8,0,0,0"
+                  Style="{DynamicResource PrimaryButtonStyle}"
+                  AutomationProperties.Name="Continue to final restore consent" AutomationProperties.AutomationId="ConfirmRestoreButton">
+            <StackPanel Orientation="Horizontal">
+              <TextBlock Text="Continue to restore" VerticalAlignment="Center" />
+              <TextBlock Text="&#xE72A;" FontFamily="Segoe Fluent Icons, Segoe MDL2 Assets" FontSize="12"
+                         Margin="8,0,0,0" VerticalAlignment="Center" />
+            </StackPanel>
+          </Button>
+        </StackPanel>
+      </Grid>
+    </Border>
+  </Grid>
+</UserControl>
diff --git a/src/WinRestoreKit.Wpf/Views/ConfirmView.xaml.cs b/src/WinRestoreKit.Wpf/Views/ConfirmView.xaml.cs
new file mode 100644
index 0000000..cce925b
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/ConfirmView.xaml.cs
@@ -0,0 +1,26 @@
+using System;
+using System.Windows;
+using System.Windows.Controls;
+using WinRestoreKit.Wpf.Services;
+using WinRestoreKit.Wpf.ViewModels;
+
+namespace WinRestoreKit.Wpf.Views
+{
+    public partial class ConfirmView : UserControl
+    {
+        public ConfirmView()
+        {
+            InitializeComponent();
+        }
+
+        private void ConfirmView_Loaded(object sender, RoutedEventArgs e)
+        {
+            ConfirmViewModel viewModel = DataContext as ConfirmViewModel;
+            if (viewModel == null)
+                return;
+
+            Window owner = Window.GetWindow(this) ?? throw new InvalidOperationException("Confirm must be hosted in a Window.");
+            viewModel.AttachRunSurfaces(Dispatcher, () => Window.GetWindow(this), new RestoreRunDialogService(owner));
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Views/Controls/SnapshotEventList.xaml b/src/WinRestoreKit.Wpf/Views/Controls/SnapshotEventList.xaml
new file mode 100644
index 0000000..cee0074
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/Controls/SnapshotEventList.xaml
@@ -0,0 +1,75 @@
+<UserControl x:Class="WinRestoreKit.Wpf.Views.Controls.SnapshotEventList"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
+  <UserControl.Resources>
+    <ResourceDictionary>
+      <ResourceDictionary.MergedDictionaries>
+        <ResourceDictionary Source="/WinRestoreKit.Wpf;component/Resources/SnapshotEventTemplates.xaml" />
+      </ResourceDictionary.MergedDictionaries>
+
+      <!--
+        The container contributes no chrome of its own: the card, the rail node, and every
+        selection and focus visual are drawn by SnapshotEventRowTemplate so the row stays
+        one designed object rather than a themed list row inside a themed list box.
+      -->
+      <Style x:Key="TimelineEventItemStyle" TargetType="{x:Type ListBoxItem}">
+        <Setter Property="AutomationProperties.Name" Value="{Binding AutomationName}" />
+        <Setter Property="Padding" Value="0" />
+        <Setter Property="Margin" Value="0" />
+        <Setter Property="Background" Value="Transparent" />
+        <Setter Property="BorderThickness" Value="0" />
+        <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+        <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+        <Setter Property="Template">
+          <Setter.Value>
+            <ControlTemplate TargetType="{x:Type ListBoxItem}">
+              <Grid Background="Transparent">
+                <ContentPresenter HorizontalAlignment="Stretch" />
+              </Grid>
+            </ControlTemplate>
+          </Setter.Value>
+        </Setter>
+      </Style>
+    </ResourceDictionary>
+  </UserControl.Resources>
+  <Grid>
+    <!-- Continuous time axis. Nodes are painted over it with an opaque backing. -->
+    <Border x:Name="TimelineConnector"
+            Width="2"
+            Margin="23,0,0,0"
+            HorizontalAlignment="Left"
+            Background="{DynamicResource DividerBrush}"
+            IsHitTestVisible="False"
+            Visibility="Collapsed" />
+    <ListBox x:Name="TimelineEventList"
+             ItemsSource="{Binding Events}"
+             SelectedItem="{Binding SelectedEvent, Mode=TwoWay}"
+             SelectionMode="Single"
+             AutomationProperties.Name="Snapshots"
+             AutomationProperties.HelpText="Left and Right Arrow move snapshots. Enter opens a verified or partial snapshot; failed and unreadable entries open details."
+             KeyboardNavigation.DirectionalNavigation="Continue"
+             ItemTemplate="{StaticResource SnapshotEventRowTemplate}"
+             ItemContainerStyle="{StaticResource TimelineEventItemStyle}"
+             Background="Transparent"
+             BorderThickness="0"
+             Padding="0"
+             Focusable="True"
+             VirtualizingPanel.IsVirtualizing="False"
+             ScrollViewer.CanContentScroll="False"
+             ScrollViewer.HorizontalScrollBarVisibility="Disabled"
+             ScrollViewer.VerticalScrollBarVisibility="Auto"
+             PreviewKeyDown="OnPreviewKeyDown"
+             SelectionChanged="OnSelectionChanged">
+      <ListBox.Template>
+        <ControlTemplate TargetType="{x:Type ListBox}">
+          <ScrollViewer Focusable="False"
+                        Padding="{TemplateBinding Padding}"
+                        HorizontalScrollBarVisibility="Disabled"
+                        VerticalScrollBarVisibility="Auto">
+            <ItemsPresenter SnapsToDevicePixels="True" />
+          </ScrollViewer>
+        </ControlTemplate>
+      </ListBox.Template>
+    </ListBox>
+  </Grid>
+</UserControl>
diff --git a/src/WinRestoreKit.Wpf/Views/Controls/SnapshotEventList.xaml.cs b/src/WinRestoreKit.Wpf/Views/Controls/SnapshotEventList.xaml.cs
new file mode 100644
index 0000000..0e91838
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/Controls/SnapshotEventList.xaml.cs
@@ -0,0 +1,71 @@
+using System;
+using System.Collections.Specialized;
+using System.Windows;
+using System.Windows.Controls;
+using System.Windows.Input;
+using WinRestoreKit.Wpf.ViewModels.Timeline;
+
+namespace WinRestoreKit.Wpf.Views.Controls
+{
+    public partial class SnapshotEventList : UserControl
+    {
+        // Measured against this control, not the window. At the 1024 px minimum window width the
+        // timeline page reserves 32 px of horizontal padding per side, so the rail stays visible
+        // there and only collapses into a plain status list on genuinely narrow layouts.
+        private const double WideTimelineThreshold = 880;
+
+        public SnapshotEventList()
+        {
+            InitializeComponent();
+            SizeChanged += OnSizeChanged;
+            ((INotifyCollectionChanged)TimelineEventList.Items).CollectionChanged += OnItemsChanged;
+        }
+
+        internal ListBox EventList => TimelineEventList;
+
+        private async void OnPreviewKeyDown(object sender, KeyEventArgs e)
+        {
+            if (e.Key == Key.Left || e.Key == Key.Right)
+            {
+                MoveSelection(e.Key == Key.Left ? -1 : 1);
+                e.Handled = true;
+                return;
+            }
+
+            if (e.Key == Key.Enter && DataContext is TimelineViewModel viewModel)
+            {
+                e.Handled = true;
+                await viewModel.OpenSelectedAsync();
+            }
+        }
+
+        private void OnSelectionChanged(object sender, SelectionChangedEventArgs e)
+        {
+            if (TimelineEventList.SelectedIndex >= 0)
+                TimelineEventList.Focus();
+        }
+
+        private void OnSizeChanged(object sender, SizeChangedEventArgs e) => UpdateConnector(e.NewSize.Width);
+
+        private void OnItemsChanged(object sender, NotifyCollectionChangedEventArgs e) => UpdateConnector(ActualWidth);
+
+        private void UpdateConnector(double width)
+        {
+            // An axis with nothing on it is noise, so the rail only appears once events exist.
+            TimelineConnector.Visibility = width >= WideTimelineThreshold && TimelineEventList.Items.Count > 0
+                ? Visibility.Visible
+                : Visibility.Collapsed;
+        }
+
+        private void MoveSelection(int offset)
+        {
+            if (TimelineEventList.Items.Count == 0)
+                return;
+
+            int selectedIndex = TimelineEventList.SelectedIndex + offset;
+            selectedIndex = Math.Max(0, Math.Min(TimelineEventList.Items.Count - 1, selectedIndex));
+            TimelineEventList.SelectedIndex = selectedIndex;
+            TimelineEventList.ScrollIntoView(TimelineEventList.SelectedItem);
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Views/Dialogs/RestoreConsentDialog.xaml b/src/WinRestoreKit.Wpf/Views/Dialogs/RestoreConsentDialog.xaml
new file mode 100644
index 0000000..a612e48
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/Dialogs/RestoreConsentDialog.xaml
@@ -0,0 +1,86 @@
+<Window x:Class="WinRestoreKit.Wpf.Views.Dialogs.RestoreConsentDialog"
+        x:ClassModifier="internal"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        Title="Restore" WindowStartupLocation="CenterOwner"
+        AutomationProperties.Name="Restore consent"
+        Background="{DynamicResource WindowBackgroundBrush}"
+        Foreground="{DynamicResource TextBrush}"
+        Width="560" MinWidth="480" MaxHeight="720"
+        SizeToContent="Height" ResizeMode="NoResize" ShowInTaskbar="False">
+  <!-- Shared keys use DynamicResource: this dialog is constructed in tests on a bare STA thread
+       with no Application, where a StaticResource lookup for an app-level key would throw. -->
+  <Grid Margin="24">
+    <Grid.RowDefinitions><RowDefinition Height="*"/><RowDefinition Height="Auto"/></Grid.RowDefinitions>
+    <ScrollViewer VerticalScrollBarVisibility="Auto" HorizontalScrollBarVisibility="Disabled"><StackPanel>
+      <StackPanel Orientation="Horizontal">
+        <TextBlock Text="&#xE7BA;" FontFamily="Segoe Fluent Icons, Segoe MDL2 Assets" FontSize="18"
+                   VerticalAlignment="Top" Margin="0,1,12,0"
+                   Foreground="{DynamicResource WarningTextBrush}" />
+        <TextBlock Text="{Binding ConfirmationText}" TextWrapping="Wrap" FontSize="14"
+                   Foreground="{DynamicResource TextBrush}" />
+      </StackPanel>
+
+      <Grid>
+        <Grid.Style>
+          <Style TargetType="{x:Type Grid}">
+            <Style.Triggers>
+              <DataTrigger Binding="{Binding HasItems, ElementName=consentChoiceList}" Value="False">
+                <Setter Property="Visibility" Value="Collapsed" />
+              </DataTrigger>
+            </Style.Triggers>
+          </Style>
+        </Grid.Style>
+        <Border Style="{DynamicResource CardBorderStyle}" Padding="16" Margin="0,18,0,0">
+          <StackPanel>
+            <TextBlock Text="Applications you agree to close" Style="{DynamicResource SectionTitleStyle}"
+                       Foreground="{DynamicResource TextBrush}" />
+            <TextBlock Text="Unselected applications are left running, and the modules that need them are skipped."
+                       TextWrapping="Wrap" FontSize="12" Margin="0,4,0,10"
+                       Foreground="{DynamicResource MutedTextBrush}" />
+            <ItemsControl x:Name="consentChoiceList" ItemsSource="{Binding ConsentChoices}" AutomationProperties.Name="Applications you agree to close">
+              <ItemsControl.ItemTemplate><DataTemplate>
+                <CheckBox Content="{Binding Label}" IsChecked="{Binding IsSelected, Mode=TwoWay}"
+                          Margin="0,0,0,8" Foreground="{DynamicResource TextBrush}" />
+              </DataTemplate></ItemsControl.ItemTemplate>
+            </ItemsControl>
+          </StackPanel>
+        </Border>
+      </Grid>
+
+      <StackPanel Margin="0,16,0,0">
+        <StackPanel.Style>
+          <Style TargetType="{x:Type StackPanel}">
+            <Style.Triggers>
+              <DataTrigger Binding="{Binding HasItems, ElementName=informationalCloseList}" Value="False">
+                <Setter Property="Visibility" Value="Collapsed" />
+              </DataTrigger>
+            </Style.Triggers>
+          </Style>
+        </StackPanel.Style>
+        <TextBlock Text="Applications that may close without consent" FontSize="12" FontWeight="SemiBold"
+                   Foreground="{DynamicResource TextBrush}" />
+        <ItemsControl x:Name="informationalCloseList" ItemsSource="{Binding InformationalCloseLines}" Margin="0,6,0,0"
+                      AutomationProperties.Name="Applications that may close without consent">
+          <ItemsControl.ItemTemplate><DataTemplate>
+            <TextBlock Text="{Binding}" TextWrapping="Wrap" FontSize="12" Margin="0,0,0,4"
+                       Foreground="{DynamicResource MutedTextBrush}" />
+          </DataTemplate></ItemsControl.ItemTemplate>
+        </ItemsControl>
+      </StackPanel>
+
+      <StackPanel Orientation="Horizontal" Margin="0,18,0,0">
+        <TextBlock Text="&#xE946;" FontFamily="Segoe Fluent Icons, Segoe MDL2 Assets" FontSize="13"
+                   VerticalAlignment="Top" Margin="0,1,10,0"
+                   Foreground="{DynamicResource MutedTextBrush}" />
+        <TextBlock Text="{Binding FidelityCaveat}" TextWrapping="Wrap" FontSize="12"
+                   Foreground="{DynamicResource MutedTextBrush}" />
+      </StackPanel>
+    </StackPanel></ScrollViewer>
+    <StackPanel Grid.Row="1" Orientation="Horizontal" HorizontalAlignment="Right" Margin="0,20,0,0">
+      <Button Content="Cancel" IsCancel="True" Style="{DynamicResource SecondaryButtonStyle}" />
+      <Button Content="Restore" IsDefault="False" Click="Restore_Click" Margin="8,0,0,0"
+              Style="{DynamicResource PrimaryButtonStyle}" AutomationProperties.Name="Confirm restore" />
+    </StackPanel>
+  </Grid>
+</Window>
diff --git a/src/WinRestoreKit.Wpf/Views/Dialogs/RestoreConsentDialog.xaml.cs b/src/WinRestoreKit.Wpf/Views/Dialogs/RestoreConsentDialog.xaml.cs
new file mode 100644
index 0000000..c13489d
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/Dialogs/RestoreConsentDialog.xaml.cs
@@ -0,0 +1,65 @@
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Linq;
+using System.Windows;
+using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
+
+namespace WinRestoreKit.Wpf.Views.Dialogs
+{
+    internal sealed class ConsentChoice : ObservableObject
+    {
+        private bool isSelected;
+
+        internal ConsentChoice(RestoreConsentEntry entry)
+        {
+            Entry = entry ?? throw new ArgumentNullException(nameof(entry));
+        }
+
+        internal RestoreConsentEntry Entry { get; }
+        public string Label => Entry.Label;
+        public bool IsSelected
+        {
+            get => isSelected;
+            set
+            {
+                if (isSelected == value)
+                    return;
+
+                isSelected = value;
+                OnPropertyChanged(nameof(IsSelected));
+            }
+        }
+    }
+
+    internal sealed partial class RestoreConsentDialog : Window
+    {
+        private readonly RestorePlan plan;
+        private readonly ObservableCollection<ConsentChoice> consentChoices;
+
+        internal RestoreConsentDialog(RestorePlan plan)
+        {
+            this.plan = plan ?? throw new ArgumentNullException(nameof(plan));
+            consentChoices = new ObservableCollection<ConsentChoice>(this.plan.ConsentEntries.Select(entry => new ConsentChoice(entry)));
+            InitializeComponent();
+            DataContext = this;
+        }
+
+        internal static RestoreConsentDialog Create(Window owner, RestorePlan plan)
+            => new RestoreConsentDialog(plan) { Owner = owner ?? throw new ArgumentNullException(nameof(owner)) };
+
+        public string ConfirmationText => plan.ConfirmationText;
+        public string FidelityCaveat => RestorePlan.FidelityCaveat;
+        public IReadOnlyList<string> InformationalCloseLines => plan.InformationalCloseLines;
+        public IEnumerable ConsentChoices => consentChoices;
+        public IReadOnlyList<string> ConsentedProcessNames
+            => consentChoices.Where(choice => choice.IsSelected).Select(choice => choice.Entry.ProcessName).ToArray();
+
+        private void Restore_Click(object sender, RoutedEventArgs e)
+        {
+            DialogResult = true;
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Views/ProgressWorkspaceView.xaml b/src/WinRestoreKit.Wpf/Views/ProgressWorkspaceView.xaml
new file mode 100644
index 0000000..e530a6e
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/ProgressWorkspaceView.xaml
@@ -0,0 +1,360 @@
+<UserControl x:Class="WinRestoreKit.Wpf.Views.ProgressWorkspaceView"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             AutomationProperties.Name="Snapshot progress"
+             AutomationProperties.AutomationId="ProgressWorkspace">
+  <UserControl.Resources>
+    <BooleanToVisibilityConverter x:Key="BooleanToVisibilityConverter" />
+
+    <!-- Run state is stated in words, never by colour alone, and only one pill is ever shown. -->
+    <Style x:Key="RunningPillStyle" TargetType="{x:Type Border}">
+      <Setter Property="Visibility" Value="Collapsed" />
+      <Setter Property="Padding" Value="10,3,10,4" />
+      <Setter Property="CornerRadius" Value="10" />
+      <Setter Property="BorderThickness" Value="1" />
+      <Setter Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+      <Setter Property="Background" Value="{DynamicResource AccentSoftBrush}" />
+      <Setter Property="VerticalAlignment" Value="Center" />
+      <Style.Triggers>
+        <MultiDataTrigger>
+          <MultiDataTrigger.Conditions>
+            <Condition Binding="{Binding IsPaused}" Value="False" />
+            <Condition Binding="{Binding IsCancellationRequested}" Value="False" />
+          </MultiDataTrigger.Conditions>
+          <Setter Property="Visibility" Value="Visible" />
+        </MultiDataTrigger>
+      </Style.Triggers>
+    </Style>
+
+    <Style x:Key="PausedPillStyle" TargetType="{x:Type Border}">
+      <Setter Property="Visibility" Value="Collapsed" />
+      <Setter Property="Padding" Value="10,3,10,4" />
+      <Setter Property="CornerRadius" Value="10" />
+      <Setter Property="BorderThickness" Value="1" />
+      <Setter Property="BorderBrush" Value="{DynamicResource WarningBrush}" />
+      <Setter Property="Background" Value="{DynamicResource SurfaceAltBrush}" />
+      <Setter Property="VerticalAlignment" Value="Center" />
+      <Style.Triggers>
+        <MultiDataTrigger>
+          <MultiDataTrigger.Conditions>
+            <Condition Binding="{Binding IsPaused}" Value="True" />
+            <Condition Binding="{Binding IsCancellationRequested}" Value="False" />
+          </MultiDataTrigger.Conditions>
+          <Setter Property="Visibility" Value="Visible" />
+        </MultiDataTrigger>
+      </Style.Triggers>
+    </Style>
+
+    <Style x:Key="CancelRequestedPillStyle" TargetType="{x:Type Border}">
+      <Setter Property="Visibility" Value="Collapsed" />
+      <Setter Property="Padding" Value="10,3,10,4" />
+      <Setter Property="CornerRadius" Value="10" />
+      <Setter Property="BorderThickness" Value="1" />
+      <Setter Property="BorderBrush" Value="{DynamicResource WarningBrush}" />
+      <Setter Property="Background" Value="{DynamicResource SurfaceAltBrush}" />
+      <Setter Property="VerticalAlignment" Value="Center" />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding IsCancellationRequested}" Value="True">
+          <Setter Property="Visibility" Value="Visible" />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+
+    <Style x:Key="MetricCaptionStyle" TargetType="{x:Type TextBlock}">
+      <Setter Property="FontSize" Value="11" />
+      <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+    </Style>
+
+    <Style x:Key="MetricValueStyle" TargetType="{x:Type TextBlock}">
+      <Setter Property="FontSize" Value="14" />
+      <Setter Property="Margin" Value="0,2,0,0" />
+      <Setter Property="TextTrimming" Value="CharacterEllipsis" />
+      <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+    </Style>
+
+    <!-- A non-zero count is the exception, so it is what changes weight and colour. -->
+    <Style x:Key="ErrorCountStyle" TargetType="{x:Type TextBlock}" BasedOn="{StaticResource MetricValueStyle}">
+      <Setter Property="FontWeight" Value="SemiBold" />
+      <Setter Property="Foreground" Value="{DynamicResource WarningTextBrush}" />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding Errors}" Value="0">
+          <Setter Property="FontWeight" Value="Normal" />
+          <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+
+    <Style x:Key="WarningCountStyle" TargetType="{x:Type TextBlock}" BasedOn="{StaticResource MetricValueStyle}">
+      <Setter Property="FontWeight" Value="SemiBold" />
+      <Setter Property="Foreground" Value="{DynamicResource WarningTextBrush}" />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding Warnings}" Value="0">
+          <Setter Property="FontWeight" Value="Normal" />
+          <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+
+    <!-- Log rows are read, not picked: no selection highlight, no per-row chrome. -->
+    <Style x:Key="LogRowStyle" TargetType="{x:Type ListBoxItem}">
+      <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+      <Setter Property="Template">
+        <Setter.Value>
+          <ControlTemplate TargetType="{x:Type ListBoxItem}">
+            <Border Background="Transparent" Padding="0,2,0,2">
+              <ContentPresenter />
+            </Border>
+          </ControlTemplate>
+        </Setter.Value>
+      </Setter>
+    </Style>
+
+    <Style x:Key="EmptyLogHintStyle" TargetType="{x:Type TextBlock}">
+      <Setter Property="Visibility" Value="Collapsed" />
+      <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+      <Setter Property="HorizontalAlignment" Value="Left" />
+      <Setter Property="VerticalAlignment" Value="Top" />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding HasItems, ElementName=ProgressLogList}" Value="False">
+          <Setter Property="Visibility" Value="Visible" />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+  </UserControl.Resources>
+
+  <Border Background="{DynamicResource WindowBackgroundBrush}" Padding="32,26,32,24">
+    <Grid>
+      <Grid.RowDefinitions>
+        <RowDefinition Height="Auto" />
+        <RowDefinition Height="Auto" />
+        <RowDefinition Height="Auto" />
+        <RowDefinition Height="*" />
+        <RowDefinition Height="Auto" />
+      </Grid.RowDefinitions>
+
+      <Grid>
+        <Grid.ColumnDefinitions>
+          <ColumnDefinition Width="*" />
+          <ColumnDefinition Width="Auto" />
+        </Grid.ColumnDefinitions>
+        <StackPanel>
+          <TextBlock Text="Snapshot run"
+                     Style="{DynamicResource CaptionTextStyle}"
+                     Foreground="{DynamicResource MutedTextBrush}" />
+          <TextBlock x:Name="ProgressStatusText"
+                     Text="{Binding ProgressText}"
+                     Style="{DynamicResource PageTitleStyle}"
+                     Foreground="{DynamicResource TextBrush}"
+                     FontSize="24"
+                     FontWeight="SemiBold"
+                     TextWrapping="Wrap"
+                     Margin="0,4,0,0"
+                     AutomationProperties.Name="Snapshot progress status"
+                     AutomationProperties.AutomationId="ProgressStatusText"
+                     AutomationProperties.LiveSetting="Polite" />
+        </StackPanel>
+        <StackPanel Grid.Column="1" Orientation="Horizontal" VerticalAlignment="Center"
+                    Margin="20,0,0,0"
+                    AutomationProperties.Name="Run state">
+          <Border Style="{StaticResource RunningPillStyle}">
+            <TextBlock Text="Running"
+                       Style="{DynamicResource PillTextStyle}"
+                       Foreground="{DynamicResource AccentTextBrush}" />
+          </Border>
+          <Border Style="{StaticResource PausedPillStyle}">
+            <TextBlock Text="Paused"
+                       Style="{DynamicResource PillTextStyle}"
+                       Foreground="{DynamicResource WarningTextBrush}" />
+          </Border>
+          <Border Style="{StaticResource CancelRequestedPillStyle}">
+            <TextBlock Text="Cancellation requested"
+                       Style="{DynamicResource PillTextStyle}"
+                       Foreground="{DynamicResource WarningTextBrush}" />
+          </Border>
+        </StackPanel>
+      </Grid>
+
+      <Border Grid.Row="1" Style="{DynamicResource CardBorderStyle}" Padding="20,18,20,18" Margin="0,20,0,0">
+        <StackPanel>
+          <Grid>
+            <Grid.ColumnDefinitions>
+              <ColumnDefinition Width="*" />
+              <ColumnDefinition Width="Auto" />
+            </Grid.ColumnDefinitions>
+            <StackPanel VerticalAlignment="Center">
+              <TextBlock Text="Stage"
+                         Style="{StaticResource MetricCaptionStyle}" />
+              <TextBlock Text="{Binding GroupInfo}"
+                         Style="{DynamicResource BodyTextStyle}"
+                         Foreground="{DynamicResource TextBrush}"
+                         FontSize="15"
+                         FontWeight="SemiBold"
+                         TextWrapping="Wrap"
+                         Margin="0,2,0,0" />
+            </StackPanel>
+            <TextBlock Grid.Column="1"
+                       VerticalAlignment="Bottom"
+                       Margin="20,0,0,0"
+                       FontSize="26"
+                       FontWeight="SemiBold"
+                       Foreground="{DynamicResource TextBrush}"
+                       AutomationProperties.Name="Percent complete">
+              <Run Text="{Binding Percent, Mode=OneWay}" /><Run Text="%" />
+            </TextBlock>
+          </Grid>
+
+          <ProgressBar x:Name="ProgressPercentBar"
+                       Height="8"
+                       Margin="0,14,0,0"
+                       Minimum="0"
+                       Maximum="100"
+                       Value="{Binding Percent, Mode=OneWay}"
+                       Foreground="{DynamicResource AccentBrush}"
+                       Background="{DynamicResource SubtleBrush}"
+                       BorderThickness="0"
+                       AutomationProperties.Name="Snapshot progress percentage"
+                       AutomationProperties.AutomationId="ProgressPercentBar">
+            <ProgressBar.Template>
+              <ControlTemplate TargetType="{x:Type ProgressBar}">
+                <Border CornerRadius="4"
+                        Background="{TemplateBinding Background}"
+                        BorderBrush="{DynamicResource DividerBrush}"
+                        BorderThickness="1"
+                        SnapsToDevicePixels="True">
+                  <Grid x:Name="PART_Track" ClipToBounds="True">
+                    <Border x:Name="PART_Indicator"
+                            HorizontalAlignment="Left"
+                            CornerRadius="3"
+                            Background="{TemplateBinding Foreground}" />
+                  </Grid>
+                </Border>
+              </ControlTemplate>
+            </ProgressBar.Template>
+          </ProgressBar>
+
+          <Grid Margin="0,18,0,0" AutomationProperties.Name="Snapshot progress details">
+            <Grid.ColumnDefinitions>
+              <ColumnDefinition Width="*" />
+              <ColumnDefinition Width="*" />
+              <ColumnDefinition Width="*" />
+              <ColumnDefinition Width="*" />
+              <ColumnDefinition Width="Auto" MinWidth="90" />
+              <ColumnDefinition Width="Auto" MinWidth="90" />
+            </Grid.ColumnDefinitions>
+            <StackPanel Margin="0,0,16,0">
+              <TextBlock Text="Elapsed" Style="{StaticResource MetricCaptionStyle}" />
+              <TextBlock Text="{Binding Elapsed}" Style="{StaticResource MetricValueStyle}" />
+            </StackPanel>
+            <StackPanel Grid.Column="1" Margin="0,0,16,0">
+              <TextBlock Text="Remaining" Style="{StaticResource MetricCaptionStyle}" />
+              <TextBlock Text="{Binding Remaining}" Style="{StaticResource MetricValueStyle}" />
+            </StackPanel>
+            <StackPanel Grid.Column="2" Margin="0,0,16,0">
+              <TextBlock Text="Throughput" Style="{StaticResource MetricCaptionStyle}" />
+              <TextBlock Text="{Binding Throughput}" Style="{StaticResource MetricValueStyle}" />
+            </StackPanel>
+            <StackPanel Grid.Column="3" Margin="0,0,16,0">
+              <TextBlock Text="Bytes written" Style="{StaticResource MetricCaptionStyle}" />
+              <TextBlock Text="{Binding BytesWrittenText}" Style="{StaticResource MetricValueStyle}" />
+            </StackPanel>
+            <StackPanel Grid.Column="4" Margin="0,0,16,0">
+              <TextBlock Text="Errors" Style="{StaticResource MetricCaptionStyle}" />
+              <TextBlock Text="{Binding Errors}" Style="{StaticResource ErrorCountStyle}" />
+            </StackPanel>
+            <StackPanel Grid.Column="5">
+              <TextBlock Text="Warnings" Style="{StaticResource MetricCaptionStyle}" />
+              <TextBlock Text="{Binding Warnings}" Style="{StaticResource WarningCountStyle}" />
+            </StackPanel>
+          </Grid>
+        </StackPanel>
+      </Border>
+
+      <Border Grid.Row="2"
+              Margin="0,12,0,0"
+              Padding="14,10,16,11"
+              CornerRadius="6"
+              BorderThickness="1"
+              BorderBrush="{DynamicResource WarningBrush}"
+              Background="{DynamicResource SurfaceAltBrush}"
+              Visibility="{Binding ExplorerRestartVisible, Converter={StaticResource BooleanToVisibilityConverter}}"
+              AutomationProperties.Name="Explorer restart requirement"
+              AutomationProperties.LiveSetting="Polite">
+        <StackPanel>
+          <TextBlock Text="Explorer restart required"
+                     Style="{DynamicResource CaptionTextStyle}"
+                     FontWeight="SemiBold"
+                     Foreground="{DynamicResource WarningTextBrush}" />
+          <TextBlock Text="Restored settings apply after Windows Explorer restarts."
+                     Style="{DynamicResource BodyTextStyle}"
+                     Foreground="{DynamicResource WarningTextBrush}"
+                     TextWrapping="Wrap"
+                     Margin="0,2,0,0" />
+        </StackPanel>
+      </Border>
+
+      <Border Grid.Row="3" Style="{DynamicResource CardBorderStyle}" Padding="20,16,20,16" Margin="0,12,0,0">
+        <Grid>
+          <Grid.RowDefinitions>
+            <RowDefinition Height="Auto" />
+            <RowDefinition Height="*" />
+          </Grid.RowDefinitions>
+          <StackPanel Margin="0,0,0,10">
+            <TextBlock Text="Run log"
+                       Style="{DynamicResource SectionTitleStyle}"
+                       Foreground="{DynamicResource TextBrush}"
+                       FontSize="15"
+                       FontWeight="SemiBold" />
+            <TextBlock Text="Exact messages written by the engine while the run is active."
+                       Style="{DynamicResource CaptionTextStyle}"
+                       Foreground="{DynamicResource MutedTextBrush}"
+                       Margin="0,3,0,0" />
+          </StackPanel>
+          <Grid Grid.Row="1">
+            <ListBox x:Name="ProgressLogList"
+                     ItemsSource="{Binding LogLines}"
+                     Background="Transparent"
+                     BorderThickness="0"
+                     Padding="0"
+                     HorizontalContentAlignment="Stretch"
+                     ItemContainerStyle="{StaticResource LogRowStyle}"
+                     ScrollViewer.HorizontalScrollBarVisibility="Disabled"
+                     ScrollViewer.VerticalScrollBarVisibility="Auto"
+                     AutomationProperties.Name="Snapshot run log"
+                     AutomationProperties.AutomationId="ProgressLogList"
+                     AutomationProperties.LiveSetting="Polite">
+              <ListBox.ItemTemplate>
+                <DataTemplate>
+                  <TextBlock Text="{Binding Text}"
+                             Style="{DynamicResource TechnicalTextStyle}"
+                             Foreground="{DynamicResource TextBrush}"
+                             TextWrapping="Wrap" />
+                </DataTemplate>
+              </ListBox.ItemTemplate>
+            </ListBox>
+            <TextBlock Text="No log messages yet. Lines appear here as the run reports them."
+                       Style="{StaticResource EmptyLogHintStyle}"
+                       IsHitTestVisible="False" />
+          </Grid>
+        </Grid>
+      </Border>
+
+      <StackPanel Grid.Row="4" Orientation="Horizontal" HorizontalAlignment="Right" Margin="0,18,0,0">
+        <Button x:Name="PauseRunButton"
+                Content="{Binding PauseCaption}"
+                Command="{Binding PauseCommand}"
+                Style="{DynamicResource SecondaryButtonStyle}"
+                MinWidth="110"
+                AutomationProperties.Name="Pause or resume snapshot"
+                AutomationProperties.AutomationId="PauseRunButton" />
+        <Button x:Name="CancelRunButton"
+                Content="Cancel"
+                Command="{Binding CancelCommand}"
+                Style="{DynamicResource DangerButtonStyle}"
+                MinWidth="110"
+                Margin="8,0,0,0"
+                AutomationProperties.Name="Cancel snapshot"
+                AutomationProperties.AutomationId="CancelRunButton" />
+      </StackPanel>
+    </Grid>
+  </Border>
+</UserControl>
diff --git a/src/WinRestoreKit.Wpf/Views/ProgressWorkspaceView.xaml.cs b/src/WinRestoreKit.Wpf/Views/ProgressWorkspaceView.xaml.cs
new file mode 100644
index 0000000..1e625f4
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/ProgressWorkspaceView.xaml.cs
@@ -0,0 +1,12 @@
+using System.Windows.Controls;
+
+namespace WinRestoreKit.Wpf.Views
+{
+    public partial class ProgressWorkspaceView : UserControl
+    {
+        public ProgressWorkspaceView()
+        {
+            InitializeComponent();
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Views/ResultWorkspaceView.xaml b/src/WinRestoreKit.Wpf/Views/ResultWorkspaceView.xaml
new file mode 100644
index 0000000..3fe8083
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/ResultWorkspaceView.xaml
@@ -0,0 +1,230 @@
+<UserControl x:Class="WinRestoreKit.Wpf.Views.ResultWorkspaceView"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             AutomationProperties.Name="Snapshot results"
+             AutomationProperties.AutomationId="ResultWorkspace">
+  <UserControl.Resources>
+    <!-- Severity is spelled out by the view model; the frame only echoes it, never replaces it. -->
+    <Style x:Key="SeverityPillStyle" TargetType="{x:Type Border}">
+      <Setter Property="Padding" Value="10,3,10,4" />
+      <Setter Property="CornerRadius" Value="10" />
+      <Setter Property="BorderThickness" Value="1" />
+      <Setter Property="BorderBrush" Value="{DynamicResource AccentBrush}" />
+      <Setter Property="Background" Value="{DynamicResource AccentSoftBrush}" />
+      <Setter Property="HorizontalAlignment" Value="Left" />
+      <Setter Property="VerticalAlignment" Value="Center" />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding Severity}" Value="Warning">
+          <Setter Property="BorderBrush" Value="{DynamicResource WarningBrush}" />
+          <Setter Property="Background" Value="{DynamicResource SurfaceAltBrush}" />
+        </DataTrigger>
+        <DataTrigger Binding="{Binding Severity}" Value="Error">
+          <Setter Property="BorderBrush" Value="{DynamicResource DangerBrush}" />
+          <Setter Property="Background" Value="{DynamicResource SurfaceAltBrush}" />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+
+    <Style x:Key="SeverityTextStyle" TargetType="{x:Type TextBlock}">
+      <Setter Property="FontSize" Value="12" />
+      <Setter Property="FontWeight" Value="SemiBold" />
+      <Setter Property="Foreground" Value="{DynamicResource AccentTextBrush}" />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding Severity}" Value="Warning">
+          <Setter Property="Foreground" Value="{DynamicResource WarningTextBrush}" />
+        </DataTrigger>
+        <DataTrigger Binding="{Binding Severity}" Value="Error">
+          <Setter Property="Foreground" Value="{DynamicResource DangerTextBrush}" />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+
+    <Style x:Key="OutcomeCardContainerStyle" TargetType="{x:Type ListBoxItem}">
+      <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+      <Setter Property="Template">
+        <Setter.Value>
+          <ControlTemplate TargetType="{x:Type ListBoxItem}">
+            <Border x:Name="OutcomeCard"
+                    Margin="0,0,0,8"
+                    Padding="14,11,14,12"
+                    CornerRadius="8"
+                    SnapsToDevicePixels="True"
+                    Background="{DynamicResource SurfaceBrush}"
+                    BorderBrush="{DynamicResource DividerBrush}"
+                    BorderThickness="1">
+              <ContentPresenter />
+            </Border>
+            <ControlTemplate.Triggers>
+              <Trigger Property="IsKeyboardFocusWithin" Value="True">
+                <Setter TargetName="OutcomeCard" Property="BorderBrush"
+                        Value="{DynamicResource AccentBrush}" />
+                <Setter TargetName="OutcomeCard" Property="BorderThickness" Value="2" />
+                <Setter TargetName="OutcomeCard" Property="Padding" Value="13,10,13,11" />
+              </Trigger>
+            </ControlTemplate.Triggers>
+          </ControlTemplate>
+        </Setter.Value>
+      </Setter>
+    </Style>
+
+    <!-- Module state is a word, chosen here so no enum identifier ever reaches the screen. -->
+    <Style x:Key="OutcomeStatePillStyle" TargetType="{x:Type Border}">
+      <Setter Property="Padding" Value="9,2,9,3" />
+      <Setter Property="CornerRadius" Value="10" />
+      <Setter Property="BorderThickness" Value="1" />
+      <Setter Property="BorderBrush" Value="{DynamicResource DividerBrush}" />
+      <Setter Property="Background" Value="{DynamicResource SubtleBrush}" />
+      <Setter Property="VerticalAlignment" Value="Top" />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding Result.State}" Value="Failed">
+          <Setter Property="BorderBrush" Value="{DynamicResource DangerBrush}" />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+
+    <Style x:Key="OutcomeStateTextStyle" TargetType="{x:Type TextBlock}">
+      <Setter Property="FontSize" Value="12" />
+      <Setter Property="FontWeight" Value="SemiBold" />
+      <Setter Property="Text" Value="Succeeded" />
+      <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding Result.State}" Value="Skipped">
+          <Setter Property="Text" Value="Skipped" />
+          <Setter Property="FontWeight" Value="Normal" />
+          <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+        </DataTrigger>
+        <DataTrigger Binding="{Binding Result.State}" Value="Failed">
+          <Setter Property="Text" Value="Failed" />
+          <Setter Property="Foreground" Value="{DynamicResource DangerTextBrush}" />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+
+    <Style x:Key="EmptyOutcomesHintStyle" TargetType="{x:Type TextBlock}">
+      <Setter Property="Visibility" Value="Collapsed" />
+      <Setter Property="Foreground" Value="{DynamicResource MutedTextBrush}" />
+      <Setter Property="HorizontalAlignment" Value="Left" />
+      <Setter Property="VerticalAlignment" Value="Top" />
+      <Setter Property="TextWrapping" Value="Wrap" />
+      <Style.Triggers>
+        <DataTrigger Binding="{Binding HasItems, ElementName=RunOutcomesList}" Value="False">
+          <Setter Property="Visibility" Value="Visible" />
+        </DataTrigger>
+      </Style.Triggers>
+    </Style>
+  </UserControl.Resources>
+
+  <Border Background="{DynamicResource WindowBackgroundBrush}" Padding="32,26,32,24">
+    <Grid>
+      <Grid.RowDefinitions>
+        <RowDefinition Height="Auto" />
+        <RowDefinition Height="Auto" />
+        <RowDefinition Height="*" />
+        <RowDefinition Height="Auto" />
+      </Grid.RowDefinitions>
+
+      <Border Style="{DynamicResource CardBorderStyle}" Padding="22,18,22,20">
+        <StackPanel MaxWidth="900" HorizontalAlignment="Left">
+          <StackPanel Orientation="Horizontal">
+            <Border Style="{StaticResource SeverityPillStyle}">
+              <TextBlock x:Name="RunSeverityText"
+                         Text="{Binding SeverityText}"
+                         Style="{StaticResource SeverityTextStyle}"
+                         AutomationProperties.Name="Run severity"
+                         AutomationProperties.AutomationId="RunSeverityText" />
+            </Border>
+            <TextBlock Text="{Binding StatusLabel}"
+                       Style="{DynamicResource CaptionTextStyle}"
+                       Foreground="{DynamicResource MutedTextBrush}"
+                       VerticalAlignment="Center"
+                       Margin="12,0,0,0"
+                       AutomationProperties.Name="Run status" />
+          </StackPanel>
+          <TextBlock x:Name="RunHeadlineText"
+                     Text="{Binding Headline}"
+                     Style="{DynamicResource PageTitleStyle}"
+                     Foreground="{DynamicResource TextBrush}"
+                     FontSize="24"
+                     FontWeight="SemiBold"
+                     TextWrapping="Wrap"
+                     Margin="0,14,0,0"
+                     AutomationProperties.Name="Run headline"
+                     AutomationProperties.AutomationId="RunHeadlineText" />
+          <TextBlock x:Name="RunDetailText"
+                     Text="{Binding Detail}"
+                     Style="{DynamicResource BodyTextStyle}"
+                     Foreground="{DynamicResource MutedTextBrush}"
+                     TextWrapping="Wrap"
+                     Margin="0,8,0,0"
+                     AutomationProperties.Name="Run detail"
+                     AutomationProperties.AutomationId="RunDetailText" />
+        </StackPanel>
+      </Border>
+
+      <TextBlock Grid.Row="1"
+                 Text="Module results"
+                 Style="{DynamicResource SectionTitleStyle}"
+                 Foreground="{DynamicResource TextBrush}"
+                 FontSize="16"
+                 FontWeight="SemiBold"
+                 Margin="0,22,0,10" />
+
+      <Grid Grid.Row="2">
+        <ListBox x:Name="RunOutcomesList"
+                 ItemsSource="{Binding Outcomes}"
+                 Background="Transparent"
+                 BorderThickness="0"
+                 Padding="0"
+                 HorizontalContentAlignment="Stretch"
+                 ItemContainerStyle="{StaticResource OutcomeCardContainerStyle}"
+                 ScrollViewer.HorizontalScrollBarVisibility="Disabled"
+                 ScrollViewer.VerticalScrollBarVisibility="Auto"
+                 AutomationProperties.Name="Module outcomes"
+                 AutomationProperties.AutomationId="RunOutcomesList">
+          <ListBox.ItemTemplate>
+            <DataTemplate>
+              <Grid>
+                <Grid.ColumnDefinitions>
+                  <ColumnDefinition Width="*" />
+                  <ColumnDefinition Width="Auto" />
+                </Grid.ColumnDefinitions>
+                <StackPanel Margin="0,0,16,0">
+                  <TextBlock Text="{Binding Title}"
+                             Foreground="{DynamicResource TextBrush}"
+                             FontWeight="SemiBold"
+                             TextWrapping="Wrap" />
+                  <TextBlock Text="{Binding Result.Reason}"
+                             Style="{DynamicResource BodyTextStyle}"
+                             Foreground="{DynamicResource MutedTextBrush}"
+                             TextWrapping="Wrap"
+                             Margin="0,3,0,0" />
+                </StackPanel>
+                <Border Grid.Column="1" Style="{StaticResource OutcomeStatePillStyle}">
+                  <TextBlock Style="{StaticResource OutcomeStateTextStyle}" />
+                </Border>
+              </Grid>
+            </DataTemplate>
+          </ListBox.ItemTemplate>
+        </ListBox>
+        <TextBlock Text="No module results were recorded for this run."
+                   Style="{StaticResource EmptyOutcomesHintStyle}"
+                   IsHitTestVisible="False" />
+      </Grid>
+
+      <Border Grid.Row="3"
+              Margin="0,20,0,0"
+              Padding="0,18,0,0"
+              BorderThickness="0,1,0,0"
+              BorderBrush="{DynamicResource DividerBrush}">
+        <Button x:Name="ReturnTimelineButton"
+                Content="Back to Timeline"
+                Command="{Binding ReturnToTimelineCommand}"
+                Style="{DynamicResource PrimaryButtonStyle}"
+                MinWidth="160"
+                HorizontalAlignment="Right"
+                AutomationProperties.Name="Back to Timeline"
+                AutomationProperties.AutomationId="ReturnTimelineButton" />
+      </Border>
+    </Grid>
+  </Border>
+</UserControl>
diff --git a/src/WinRestoreKit.Wpf/Views/ResultWorkspaceView.xaml.cs b/src/WinRestoreKit.Wpf/Views/ResultWorkspaceView.xaml.cs
new file mode 100644
index 0000000..d011cc6
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/ResultWorkspaceView.xaml.cs
@@ -0,0 +1,12 @@
+using System.Windows.Controls;
+
+namespace WinRestoreKit.Wpf.Views
+{
+    public partial class ResultWorkspaceView : UserControl
+    {
+        public ResultWorkspaceView()
+        {
+            InitializeComponent();
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Views/SettingsView.xaml b/src/WinRestoreKit.Wpf/Views/SettingsView.xaml
new file mode 100644
index 0000000..f9bd6ad
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/SettingsView.xaml
@@ -0,0 +1,69 @@
+<UserControl x:Class="WinRestoreKit.Wpf.Views.SettingsView"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             AutomationProperties.Name="Settings workspace">
+  <ScrollViewer VerticalScrollBarVisibility="Auto" HorizontalScrollBarVisibility="Disabled">
+    <StackPanel MaxWidth="720" HorizontalAlignment="Left" Margin="24,20,24,24">
+      <TextBlock Text="Settings" Style="{DynamicResource PageTitleStyle}"
+                 Foreground="{DynamicResource TextBrush}" />
+      <TextBlock Text="Preferences apply immediately and are kept for the next time you open WinRestoreKit."
+                 TextWrapping="Wrap" FontSize="13" Margin="0,4,0,0"
+                 Foreground="{DynamicResource MutedTextBrush}" />
+
+      <Border Style="{DynamicResource CardBorderStyle}" Margin="0,18,0,0">
+        <StackPanel>
+          <TextBlock Text="Appearance" Style="{DynamicResource SectionTitleStyle}"
+                     Foreground="{DynamicResource TextBrush}" />
+          <Grid Margin="0,14,0,0">
+            <Grid.ColumnDefinitions>
+              <ColumnDefinition Width="*" />
+              <ColumnDefinition Width="Auto" />
+            </Grid.ColumnDefinitions>
+            <StackPanel VerticalAlignment="Center" Margin="0,0,24,0">
+              <Label Content="Theme" Target="{Binding ElementName=themeSelector}" Padding="0"
+                     FontWeight="SemiBold" FontSize="13"
+                     Foreground="{DynamicResource TextBrush}" AutomationProperties.Name="Theme label" />
+              <TextBlock Text="Follow system matches your Windows light or dark setting. Light and Dark stay fixed regardless of Windows."
+                         TextWrapping="Wrap" FontSize="12" Margin="0,4,0,0"
+                         Foreground="{DynamicResource MutedTextBrush}" />
+            </StackPanel>
+            <ComboBox x:Name="themeSelector" Grid.Column="1" ItemsSource="{Binding AvailableModes}"
+                      SelectedItem="{Binding SelectedTheme, Mode=TwoWay}"
+                      MinWidth="180" VerticalAlignment="Center"
+                      AutomationProperties.Name="Theme">
+              <ComboBox.ItemTemplate>
+                <DataTemplate>
+                  <TextBlock>
+                    <TextBlock.Style>
+                      <Style TargetType="TextBlock">
+                        <Setter Property="Text" Value="Follow system" />
+                        <Style.Triggers>
+                          <DataTrigger Binding="{Binding}" Value="Light">
+                            <Setter Property="Text" Value="Light" />
+                          </DataTrigger>
+                          <DataTrigger Binding="{Binding}" Value="Dark">
+                            <Setter Property="Text" Value="Dark" />
+                          </DataTrigger>
+                        </Style.Triggers>
+                      </Style>
+                    </TextBlock.Style>
+                  </TextBlock>
+                </DataTemplate>
+              </ComboBox.ItemTemplate>
+            </ComboBox>
+          </Grid>
+        </StackPanel>
+      </Border>
+
+      <Border Style="{DynamicResource CardBorderStyle}" Margin="0,12,0,0">
+        <StackPanel>
+          <TextBlock Text="Where snapshots live" Style="{DynamicResource SectionTitleStyle}"
+                     Foreground="{DynamicResource TextBrush}" />
+          <TextBlock Text="Snapshots stay on this PC in the folder you pick when you create one. Nothing is uploaded, and WinRestoreKit never writes into a snapshot while comparing."
+                     TextWrapping="Wrap" FontSize="13" Margin="0,8,0,0"
+                     Foreground="{DynamicResource MutedTextBrush}" />
+        </StackPanel>
+      </Border>
+    </StackPanel>
+  </ScrollViewer>
+</UserControl>
diff --git a/src/WinRestoreKit.Wpf/Views/SettingsView.xaml.cs b/src/WinRestoreKit.Wpf/Views/SettingsView.xaml.cs
new file mode 100644
index 0000000..66e81ca
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/SettingsView.xaml.cs
@@ -0,0 +1,12 @@
+using System.Windows.Controls;
+
+namespace WinRestoreKit.Wpf.Views
+{
+    public partial class SettingsView : UserControl
+    {
+        public SettingsView()
+        {
+            InitializeComponent();
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/Views/TimelineView.xaml b/src/WinRestoreKit.Wpf/Views/TimelineView.xaml
new file mode 100644
index 0000000..e8da4d8
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/TimelineView.xaml
@@ -0,0 +1,98 @@
+<UserControl x:Class="WinRestoreKit.Wpf.Views.TimelineView"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:controls="clr-namespace:WinRestoreKit.Wpf.Views.Controls"
+             Loaded="OnLoaded"
+             AutomationProperties.Name="Timeline">
+  <UserControl.Resources>
+    <ResourceDictionary>
+      <ResourceDictionary.MergedDictionaries>
+        <ResourceDictionary Source="/WinRestoreKit.Wpf;component/Resources/SnapshotEventTemplates.xaml" />
+      </ResourceDictionary.MergedDictionaries>
+
+      <Style x:Key="TimelineEmptyStateStyle" TargetType="{x:Type Border}">
+        <Setter Property="Visibility" Value="Collapsed" />
+        <Style.Triggers>
+          <DataTrigger Binding="{Binding Events.Count}" Value="0">
+            <Setter Property="Visibility" Value="Visible" />
+          </DataTrigger>
+        </Style.Triggers>
+      </Style>
+    </ResourceDictionary>
+  </UserControl.Resources>
+  <Border Background="{DynamicResource WindowBackgroundBrush}"
+          TextElement.Foreground="{DynamicResource TextBrush}"
+          TextElement.FontFamily="{DynamicResource ApplicationFont}"
+          Padding="32,26,32,24">
+    <!-- Reading column, left aligned. The page is a list of moments, not a dashboard pane. -->
+    <Grid MaxWidth="1000" HorizontalAlignment="Left">
+      <Grid.RowDefinitions>
+        <RowDefinition Height="Auto" />
+        <RowDefinition Height="*" />
+        <RowDefinition Height="Auto" />
+      </Grid.RowDefinitions>
+
+      <StackPanel>
+        <TextBlock Text="Timeline" Style="{DynamicResource PageTitleStyle}" />
+        <TextBlock Text="Every restore point recorded on this PC, newest first. Select one to compare it with the current system."
+                   Margin="0,6,0,0" MaxWidth="640" HorizontalAlignment="Left"
+                   FontSize="13" TextWrapping="Wrap"
+                   Foreground="{DynamicResource MutedTextBrush}" />
+      </StackPanel>
+
+      <Grid Grid.Row="1" Margin="0,22,0,0">
+        <controls:SnapshotEventList x:Name="SnapshotEventListControl" />
+
+        <Border x:Name="TimelineEmptyState"
+                Style="{StaticResource TimelineEmptyStateStyle}"
+                HorizontalAlignment="Left" VerticalAlignment="Top"
+                MaxWidth="580" Padding="22,19,24,21"
+                Background="{DynamicResource SurfaceBrush}"
+                BorderBrush="{DynamicResource DividerBrush}"
+                BorderThickness="1" CornerRadius="8"
+                SnapsToDevicePixels="True"
+                AutomationProperties.Name="No restore points yet"
+                AutomationProperties.LiveSetting="Polite">
+          <StackPanel>
+            <StackPanel Orientation="Horizontal">
+              <!-- An empty rail: the same axis and node language the populated list uses. -->
+              <Grid Width="16" Height="18" VerticalAlignment="Center">
+                <Border Width="2" HorizontalAlignment="Center"
+                        Background="{DynamicResource DividerBrush}" />
+                <Ellipse Width="12" Height="12" HorizontalAlignment="Center" VerticalAlignment="Center"
+                         Fill="{DynamicResource SurfaceBrush}"
+                         Stroke="{DynamicResource StrongDividerBrush}" StrokeThickness="2" />
+              </Grid>
+              <TextBlock Text="No restore points yet"
+                         Margin="12,0,0,0" VerticalAlignment="Center"
+                         FontSize="15" FontWeight="SemiBold"
+                         Foreground="{DynamicResource TextBrush}" />
+            </StackPanel>
+            <TextBlock Text="Nothing has been captured on this PC. Choose Create snapshot in the command bar above to record the current system; it appears here as a verified restore point you can compare against."
+                       Margin="0,10,0,0" FontSize="12.5" TextWrapping="Wrap"
+                       Foreground="{DynamicResource MutedTextBrush}" />
+            <TextBlock Text="Failed and unreadable attempts are listed here too, so problems stay visible instead of looking like nothing happened."
+                       Margin="0,8,0,0" FontSize="12" TextWrapping="Wrap"
+                       Foreground="{DynamicResource MutedTextBrush}" />
+          </StackPanel>
+        </Border>
+      </Grid>
+
+      <Border Grid.Row="2"
+              Visibility="{Binding HasSelectionError, Converter={StaticResource BooleanToVisibilityConverter}}"
+              Margin="48,14,0,0" Padding="12,9,14,10"
+              CornerRadius="6" BorderThickness="3,0,0,0"
+              Background="{DynamicResource DangerSoftBrush}"
+              BorderBrush="{DynamicResource DangerBrush}"
+              SnapsToDevicePixels="True">
+        <TextBlock x:Name="SelectionErrorText"
+                   Text="{Binding SelectionError}"
+                   Visibility="{Binding HasSelectionError, Converter={StaticResource BooleanToVisibilityConverter}}"
+                   AutomationProperties.LiveSetting="Polite"
+                   Foreground="{DynamicResource DangerTextBrush}"
+                   FontSize="12.5"
+                   TextWrapping="Wrap" />
+      </Border>
+    </Grid>
+  </Border>
+</UserControl>
diff --git a/src/WinRestoreKit.Wpf/Views/TimelineView.xaml.cs b/src/WinRestoreKit.Wpf/Views/TimelineView.xaml.cs
new file mode 100644
index 0000000..9808de1
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/Views/TimelineView.xaml.cs
@@ -0,0 +1,22 @@
+using System;
+using System.Windows;
+using System.Windows.Controls;
+using WinRestoreKit.Wpf.ViewModels.Timeline;
+
+namespace WinRestoreKit.Wpf.Views
+{
+    public partial class TimelineView : UserControl
+    {
+        public TimelineView()
+        {
+            InitializeComponent();
+            RegisterName("TimelineEventList", SnapshotEventListControl.EventList);
+        }
+
+        private async void OnLoaded(object sender, RoutedEventArgs e)
+        {
+            if (DataContext is TimelineViewModel viewModel)
+                await viewModel.RefreshAsync();
+        }
+    }
+}
diff --git a/src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj b/src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj
new file mode 100644
index 0000000..92aa7c0
--- /dev/null
+++ b/src/WinRestoreKit.Wpf/WinRestoreKit.Wpf.csproj
@@ -0,0 +1,26 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>WinExe</OutputType>
+    <TargetFramework>net8.0-windows</TargetFramework>
+    <UseWPF>true</UseWPF>
+    <RootNamespace>WinRestoreKit.Wpf</RootNamespace>
+    <AssemblyName>WinRestoreKit.Wpf</AssemblyName>
+    <ApplicationManifest>..\WinRestoreKit\app.manifest</ApplicationManifest>
+    <ApplicationIcon>..\WinRestoreKit\WinRestoreKit.ico</ApplicationIcon>
+    <RuntimeIdentifier>win-x64</RuntimeIdentifier>
+    <SelfContained>true</SelfContained>
+    <PublishSingleFile>true</PublishSingleFile>
+    <IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract>
+    <EnableCompressionInSingleFile>true</EnableCompressionInSingleFile>
+    <PublishTrimmed>false</PublishTrimmed>
+    <Nullable>disable</Nullable>
+    <ImplicitUsings>disable</ImplicitUsings>
+    <Platforms>AnyCPU</Platforms>
+    <Deterministic>true</Deterministic>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\WinRestoreKit.Application\WinRestoreKit.Application.csproj" />
+    <ProjectReference Include="..\WinRestoreKit.Core\WinRestoreKit.Core.csproj" />
+    <Resource Include="..\WinRestoreKit\Fonts\IBMPlexMono-Regular.ttf" Link="Fonts\IBMPlexMono-Regular.ttf" />
+  </ItemGroup>
+</Project>
diff --git a/src/WinRestoreKit.sln b/src/WinRestoreKit.sln
index cf5c34a..7a3f0d0 100644
--- a/src/WinRestoreKit.sln
+++ b/src/WinRestoreKit.sln
@@ -9,6 +9,10 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "WinRestoreKit.Tests", "WinR
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "WinRestoreKit.Core", "WinRestoreKit.Core\WinRestoreKit.Core.csproj", "{1FAD4433-713A-4A94-83F1-3D4715A7CFAF}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "WinRestoreKit.Application", "WinRestoreKit.Application\WinRestoreKit.Application.csproj", "{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "WinRestoreKit.Wpf", "WinRestoreKit.Wpf\WinRestoreKit.Wpf.csproj", "{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -83,6 +87,46 @@ Global
 		{1FAD4433-713A-4A94-83F1-3D4715A7CFAF}.Release|x64.Build.0 = Release|Any CPU
 		{1FAD4433-713A-4A94-83F1-3D4715A7CFAF}.Release|x86.ActiveCfg = Release|Any CPU
 		{1FAD4433-713A-4A94-83F1-3D4715A7CFAF}.Release|x86.Build.0 = Release|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Debug|ARM.ActiveCfg = Debug|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Debug|ARM.Build.0 = Debug|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Debug|ARM64.ActiveCfg = Debug|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Debug|ARM64.Build.0 = Debug|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Debug|x64.Build.0 = Debug|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Debug|x86.Build.0 = Debug|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Release|Any CPU.Build.0 = Release|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Release|ARM.ActiveCfg = Release|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Release|ARM.Build.0 = Release|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Release|ARM64.ActiveCfg = Release|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Release|ARM64.Build.0 = Release|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Release|x64.ActiveCfg = Release|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Release|x64.Build.0 = Release|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Release|x86.ActiveCfg = Release|Any CPU
+		{A1E91A1C-8A8D-4F60-AEF9-A5D6D32A704A}.Release|x86.Build.0 = Release|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Debug|ARM.ActiveCfg = Debug|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Debug|ARM.Build.0 = Debug|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Debug|ARM64.ActiveCfg = Debug|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Debug|ARM64.Build.0 = Debug|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Debug|x64.Build.0 = Debug|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Debug|x86.Build.0 = Debug|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Release|Any CPU.Build.0 = Release|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Release|ARM.ActiveCfg = Release|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Release|ARM.Build.0 = Release|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Release|ARM64.ActiveCfg = Release|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Release|ARM64.Build.0 = Release|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Release|x64.ActiveCfg = Release|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Release|x64.Build.0 = Release|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Release|x86.ActiveCfg = Release|Any CPU
+		{B2F0F9B0-5F5A-4A13-90B5-1F8E1EB6F791}.Release|x86.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
diff --git a/src/WinRestoreKit/Forms/RestAppsForm.cs b/src/WinRestoreKit/Forms/RestAppsForm.cs
index 839fbd7..e402d9a 100644
--- a/src/WinRestoreKit/Forms/RestAppsForm.cs
+++ b/src/WinRestoreKit/Forms/RestAppsForm.cs
@@ -1,55 +1,30 @@
-using WinRestoreKit;
 using Conf;
 using DataHelper;
-using Newtonsoft.Json.Linq;
 using System;
 using System.Collections.Generic;
 using System.Drawing;
-using System.IO;
 using System.Linq;
 using System.Threading.Tasks;
 using System.Windows.Forms;
+using WinRestoreKit;
 
 namespace Views
 {
     public partial class RestAppsForm : Form
     {
         private static readonly LogHelper logger = LogHelper.Instance;
-
-        /// <summary>
-        /// True from the moment the install loop starts until it has finished or been stopped.
-        /// </summary>
-        /// <remarks>
-        /// The loop used to be async void and was called un-awaited, so nothing disabled the Restore
-        /// button while it ran. A second click therefore started a SECOND concurrent loop over the
-        /// same ticked packages - and this app runs elevated, so that is two elevated winget install
-        /// loops fighting over the same package store.
-        /// </remarks>
-        private bool installing;
-
         private readonly string restoreSourcePath;
+        private bool installing;
+        private bool stopRequested;
+        private bool closeWhenIdle;
+        private bool hasBeenShown;
+        private string pendingProblemMessage;
 
         private sealed class BackupSource
         {
-            public BackupSource(string path, bool isRestoreSource)
-            {
-                Path = path;
-                IsRestoreSource = isRestoreSource;
-            }
-
-            public string Path { get; }
-
-            public bool IsRestoreSource { get; }
-
-            public override string ToString()
-            {
-                if (IsRestoreSource)
-                    return "Selected restore source";
-
-                return System.IO.Path.GetFileName(Path.TrimEnd(
-                    System.IO.Path.DirectorySeparatorChar,
-                    System.IO.Path.AltDirectorySeparatorChar));
-            }
+            internal BackupSource(AppRestoreSource source) => Source = source;
+            internal AppRestoreSource Source { get; }
+            public override string ToString() => Source.DisplayName;
         }
 
         public RestAppsForm() : this(null)
@@ -59,629 +34,93 @@ public RestAppsForm() : this(null)
         internal RestAppsForm(string restoreSourcePath)
         {
             this.restoreSourcePath = restoreSourcePath;
-
             InitializeComponent();
-
-            // Load back ups. This reaches comboBackups.SelectedIndex = 0, which fires the
-            // Designer-wired SelectedIndexChanged and so populates the list.
-            //
-            // There is deliberately no second subscription of that handler to comboBackups.Click.
-            // The combo is a DropDownList, so ANY click on it fired Click; the handler begins by
-            // clearing listApps, which is a CheckedListBox. Opening the dropdown therefore wiped
-            // every box the user had ticked, inside a dialog whose only purpose is ticking a subset.
             LoadBackups();
-
-            // Load styling
             SetStyle();
         }
 
-        /// <summary>Set by Cancel or by closing the window: stop after the current package.</summary>
-        /// <remarks>
-        /// Deliberately "after the current one" rather than an abort. A winget install that is
-        /// half-way through has already changed this machine; killing it would leave a partially
-        /// installed package that no summary could describe honestly.
-        /// </remarks>
-        private bool stopRequested;
-
-        /// <summary>The user closed the window mid-install; close for real once the loop is idle.</summary>
-        private bool closeWhenIdle;
-
-        /// <summary>True once OnShown has run, i.e. once this window can actually own a dialog.</summary>
-        private bool hasBeenShown;
-
-        /// <summary>
-        /// A problem found before the window existed, still owed to the user. Null once reported.
-        /// </summary>
-        private string pendingProblemMessage;
-
-        /// <summary>
-        /// Adds the selected restore source before the legacy backup folders without duplicates.
-        /// </summary>
-        internal static IReadOnlyList<string> BackupSources(
-            string restoreSourcePath,
-            IEnumerable<string> legacyBackupPaths)
-        {
-            List<string> sources = new List<string>();
-
-            AddSource(sources, restoreSourcePath);
-
-            if (legacyBackupPaths != null)
-            {
-                foreach (string legacyBackupPath in legacyBackupPaths)
-                    AddSource(sources, legacyBackupPath);
-            }
-
-            return sources;
-        }
-
-        private static void AddSource(ICollection<string> sources, string path)
-        {
-            if (string.IsNullOrWhiteSpace(path)
-                || sources.Any(source => string.Equals(source, path, StringComparison.OrdinalIgnoreCase)))
-            {
-                return;
-            }
-
-            sources.Add(path);
-        }
-
         internal void LoadBackups()
         {
             comboBackups.Items.Clear();
-
-            IEnumerable<string> legacyBackups = Directory.Exists(Data.DataRootDir)
-                ? Directory.GetDirectories(Data.DataRootDir)
-                : Enumerable.Empty<string>();
-
-            IReadOnlyList<string> sources = BackupSources(restoreSourcePath, legacyBackups);
-
-            for (int i = 0; i < sources.Count; i++)
-            {
-                comboBackups.Items.Add(new BackupSource(
-                    sources[i],
-                    i == 0 && !string.IsNullOrWhiteSpace(restoreSourcePath)));
-            }
-
+            IReadOnlyList<AppRestoreSource> sources = AppRestoreService.BuildSources(restoreSourcePath,
+                new SnapshotEventCatalog().Read());
+            foreach (AppRestoreSource source in sources)
+                comboBackups.Items.Add(new BackupSource(source));
             if (comboBackups.Items.Count > 0)
                 comboBackups.SelectedIndex = 0;
         }
 
-        // Some UI nicety
         private void SetStyle()
         {
-            // Built after startup, so it is not in the shell's tree and themes itself.
             Theme.Apply(this);
-
-            BackColor =
-            listApps.BackColor =
-                Ui.RailSurface;
-        }
-
-
-        /// <summary>
-        /// Where the app export lives for the backup folder at <paramref name="backupFolder"/>.
-        /// </summary>
-        /// <remarks>
-        /// Goes through AppStoreApps.ExportPathIn so this reader cannot disagree with the writer
-        /// about the filename. It previously did, in two different ways at once: one call site
-        /// looked for ".JSON" and built its path by concatenating a separator, the other for
-        /// ".json" via Path.Combine.
-        /// </remarks>
-        internal static string ExportPathFor(string backupFolder)
-            => AppStoreApps.ExportPathIn(backupFolder ?? string.Empty);
-
-        /// <summary>
-        /// Whether an app export was read, was simply not there, or could not be used.
-        /// </summary>
-        /// <remarks>
-        /// Three states, not two. An export that is ABSENT is not a problem: this dialog is
-        /// reachable standalone from the module tree, and most backup folders legitimately contain
-        /// no app export because the user never ticked that module. Collapsing Absent into
-        /// Unreadable would raise an error dialog on the ordinary case - the absence-is-normal flag
-        /// collapse this codebase keeps having to un-collapse.
-        /// </remarks>
-        internal enum AppExportState
-        {
-            /// <summary>The file was read and had a Packages array (possibly an empty one).</summary>
-            Ok,
-
-            /// <summary>No file there. Normal, and never a dialog.</summary>
-            Absent,
-
-            /// <summary>There was something there, and it could not be used.</summary>
-            Unreadable
-        }
-
-        /// <summary>
-        /// The result of looking for one backup's app export. Never null, never carries null ids.
-        /// </summary>
-        internal sealed class AppExport
-        {
-            private AppExport(AppExportState state, IReadOnlyList<string> ids, string message)
-            {
-                State = state;
-                PackageIdentifiers = ids ?? new string[0];
-                Message = message;
-            }
-
-            internal AppExportState State { get; }
-
-            /// <summary>Package ids in file order. Empty rather than null in every state.</summary>
-            internal IReadOnlyList<string> PackageIdentifiers { get; }
-
-            /// <summary>Human-readable text for the log, and for the dialog when this is a problem.</summary>
-            internal string Message { get; }
-
-            /// <summary>Whether the user needs to be told with a dialog rather than only a log line.</summary>
-            internal bool IsProblem => State == AppExportState.Unreadable;
-
-            internal static AppExport Ok(IReadOnlyList<string> ids, string message)
-                => new AppExport(AppExportState.Ok, ids, message);
-
-            internal static AppExport Absent(string message)
-                => new AppExport(AppExportState.Absent, null, message);
-
-            internal static AppExport Unreadable(string message)
-                => new AppExport(AppExportState.Unreadable, null, message);
-
-            /// <summary>
-            /// Reads the export at <paramref name="path"/>. Total: it never throws.
-            /// </summary>
-            /// <remarks>
-            /// Totality is the point, not tidiness. This runs during CONSTRUCTION - LoadBackups sets
-            /// SelectedIndex, which fires the handler that calls this - so it executes before any
-            /// window exists, on a path where .NET 8 turns an escaping exception into process
-            /// termination with no window ever having been shown. Everything that touches the disk
-            /// or the parser is therefore inside a catch: ReadAllText throws on a locked file, a
-            /// directory, a malformed path or a permissions failure, and JObject.Parse throws on
-            /// anything that is not JSON.
-            ///
-            /// Absence is decided by the exception the READ raises, not by File.Exists. File.Exists
-            /// answers false for a file it was not allowed to look at, so it folds "there is nothing
-            /// here" together with "I was not allowed to find out" - and only the first of those is
-            /// normal. Believing the second one listed no apps while telling the user, in the one
-            /// line they would read, that this backup CONTAINS no app export: a claim about what is
-            /// in the folder, made without having been able to see it. Same rule the modules follow,
-            /// where a target that could not be probed is never reported as an absence.
-            /// </remarks>
-            internal static AppExport Read(string path)
-            {
-                if (string.IsNullOrWhiteSpace(path))
-                    return Absent("No app export path could be worked out, so no apps are listed.");
-
-                string json;
-
-                try
-                {
-                    json = File.ReadAllText(path);
-                }
-                catch (FileNotFoundException)
-                {
-                    // The one exception that is genuinely an absence: the folder opened, and the
-                    // export is not in it. Not a problem, and not a dialog. The path is named so the
-                    // log says which folder was looked in.
-                    return Absent("This backup contains no app export (" + path +
-                                  "), so there are no apps to list for it.");
-                }
-                catch (Exception ex)
-                {
-                    // Something is there, or something stopped us finding out - either way nothing
-                    // is known about its contents, which is deliberately not the same as reporting
-                    // it as an invalid file.
-                    //
-                    // DirectoryNotFoundException lands HERE rather than in the absence above, and
-                    // the distinction is the whole point. LoadBackups enumerated this folder off
-                    // disk moments ago, so the folder existing is not in question - it going missing
-                    // between then and now means the drive was pulled, the network path dropped or
-                    // the letter stopped resolving. That is the world changing underneath us, not a
-                    // backup that happens to contain no apps, and reporting it as the latter would
-                    // be the same confident claim about unseen contents that removing File.Exists
-                    // was meant to end.
-                    return Unreadable("Could not read the app export at " + path + ": " + ex.Message);
-                }
-
-                try
-                {
-                    return Parse(json, path);
-                }
-                catch (Exception ex)
-                {
-                    // Parse states its own problems, so reaching here means one it did not
-                    // anticipate - a JSON shape that makes a token accessor throw. Still no escape
-                    // route: this whole method runs before any window exists.
-                    return Unreadable("Could not make sense of the app export at " + path + ": " + ex.Message);
-                }
-            }
-
-            /// <summary>
-            /// Turns the text of an export into package identifiers, or into a stated problem.
-            /// </summary>
-            /// <remarks>
-            /// Mirrors AppStoreApps.Verify: the same shape decides the same way on both sides, so a
-            /// file the backup called good is a file this dialog can list. An EMPTY Packages array
-            /// is Ok - a machine with no winget packages is a fact, not a fault - while a MISSING
-            /// Packages array is not, because that file cannot restore anything.
-            /// </remarks>
-            internal static AppExport Parse(string json, string path)
-            {
-                if (string.IsNullOrWhiteSpace(json))
-                    return Unreadable("The app export at " + path + " is empty.");
-
-                JArray packages;
-
-                try
-                {
-                    packages = JObject.Parse(json)["Sources"]?.FirstOrDefault()?["Packages"] as JArray;
-                }
-                catch (Exception ex)
-                {
-                    return Unreadable("The app export at " + path + " is not valid JSON: " + ex.Message);
-                }
-
-                if (packages == null)
-                {
-                    return Unreadable("The app export at " + path +
-                                      " has no list of packages in it, so nothing could be restored from it.");
-                }
-
-                // Entries with no PackageIdentifier are dropped rather than listed. A blank row is
-                // tickable, and a ticked blank row reaches winget install --id "".
-                List<string> ids = new List<string>();
-
-                foreach (JToken package in packages)
-                {
-                    string id = package?.Value<string>("PackageIdentifier");
-
-                    if (!string.IsNullOrWhiteSpace(id))
-                        ids.Add(id);
-                }
-
-                return Ok(ids, "Read " + ids.Count + " app(s) from " + path + ".");
-            }
-        }
-
-        /// <summary>
-        /// What the list and the Restore button should show for a given export.
-        /// </summary>
-        internal sealed class ListState
-        {
-            internal ListState(IReadOnlyList<string> items, bool restoreEnabled)
-            {
-                Items = items ?? new string[0];
-                RestoreEnabled = restoreEnabled;
-            }
-
-            internal IReadOnlyList<string> Items { get; }
-
-            internal bool RestoreEnabled { get; }
-        }
-
-        /// <remarks>
-        /// Pure, so the rule can be tested without a message loop. Restore is enabled only when
-        /// there is at least one app to install: an absent export, an unreadable one, and a
-        /// genuinely empty one all leave a button that would do nothing, and the Designer starts it
-        /// disabled so this method can only ever turn it on.
-        /// </remarks>
-        internal static ListState ComposeListState(AppExport export)
-        {
-            if (export == null)
-                return new ListState(null, false);
-
-            return new ListState(export.PackageIdentifiers, export.PackageIdentifiers.Count > 0);
+            BackColor = listApps.BackColor = Ui.RailSurface;
         }
 
         private void comboBackups_SelectedIndexChanged(object sender, EventArgs e)
         {
-            BackupSource selectedBackup = comboBackups.SelectedItem as BackupSource;
-
-            if (selectedBackup == null)
-            {
-                ApplyExport(AppExport.Absent(null));
-                return;
-            }
-
-            ApplyExport(AppExport.Read(ExportPathFor(selectedBackup.Path)));
+            BackupSource selected = comboBackups.SelectedItem as BackupSource;
+            ApplyExport(selected == null
+                ? AppExport.Absent("No app backup source is selected.")
+                : AppRestoreService.ReadFromSource(selected.Source.Path));
         }
 
         private void ApplyExport(AppExport export)
         {
-            ListState state = ComposeListState(export);
-
+            AppRestoreListState state = AppRestoreService.ComposeListState(export);
             listApps.Items.Clear();
+            foreach (string identifier in state.Items)
+                listApps.Items.Add(identifier);
+            btnRestore.Enabled = state.InstallEnabled;
+            logger.LogMessage(export.Message);
 
-            foreach (string id in state.Items)
-                listApps.Items.Add(id);
-
-            btnRestore.Enabled = state.RestoreEnabled;
-
-            if (export.Message != null)
+            switch (AppRestoreService.RouteProblem(export, hasBeenShown))
             {
-                // LogMessage, not Log: this text carries a file path and can carry a Newtonsoft
-                // parse error, and JSON is made of braces. Log treats its first argument as a format
-                // string, so a single brace throws inside the logger and the line is routed to
-                // Console.WriteLine - invisible in a WinForms app. The one message a user needs in
-                // order to diagnose a broken export was precisely the one being swallowed.
-                logger.LogMessage(export.Message);
-            }
-
-            // Absent is not a problem, so it never reaches a dialog - only Unreadable does.
-            //
-            // WHERE that dialog is raised depends on whether a window exists yet. This method runs
-            // during construction (LoadBackups sets SelectedIndex, which fires the handler), which
-            // is before AStoreApps has called ShowDialog. Showing it here passed `this` as owner,
-            // forcing handle creation on an unshown form: the dialog got an effectively invisible
-            // owner and could paint BEHIND the main window - which, during an orchestrated restore,
-            // is disabled. The user saw a frozen app with no visible cause and no way forward.
-            //
-            // So the state above is still computed during construction exactly as before; only the
-            // dialog is deferred to OnShown.
-            switch (RouteProblem(export, hasBeenShown))
-            {
-                case ProblemRouting.ShowNow:
-                    // Cleared first, so the message cannot also be sitting queued for OnShown.
+                case AppRestoreProblemRouting.ShowNow:
                     pendingProblemMessage = null;
                     ShowProblem(export.Message);
                     break;
-
-                case ProblemRouting.Defer:
+                case AppRestoreProblemRouting.Defer:
                     pendingProblemMessage = export.Message;
                     break;
-
                 default:
-                    // A read that came back clean withdraws a problem queued but not yet reported.
-                    // Unreachable today (one ApplyExport runs before Shown), but a stale queued
-                    // message would otherwise surface a dialog about a backup the user moved off.
                     pendingProblemMessage = null;
                     break;
             }
         }
 
-        /// <summary>Where a problem found by <see cref="ApplyExport"/> should be reported.</summary>
-        internal enum ProblemRouting
-        {
-            /// <summary>Nothing to report. Absent exports land here, and never raise a dialog.</summary>
-            None,
-
-            /// <summary>A window exists: report it immediately, as picking a bad backup always did.</summary>
-            ShowNow,
-
-            /// <summary>No window yet: hold it until OnShown, where it can be owned and seen.</summary>
-            Defer
-        }
-
-        /// <remarks>
-        /// Pure, so the rule that cost a hung-looking app can be tested without a message loop.
-        ///
-        /// Absent maps to None, not Defer. It is the ORDINARY case - this dialog is reachable
-        /// standalone and most backup folders hold no app export - so deferring it would just move a
-        /// spurious dialog rather than remove it. Only Unreadable is ever routed anywhere.
-        /// </remarks>
-        internal static ProblemRouting RouteProblem(AppExport export, bool hasBeenShown)
-        {
-            if (export == null || !export.IsProblem)
-                return ProblemRouting.None;
-
-            return hasBeenShown ? ProblemRouting.ShowNow : ProblemRouting.Defer;
-        }
-
-        /// <remarks>
-        /// The one place the problem dialog is raised, so "reported once" is a property of this
-        /// method's single caller set rather than of two call sites agreeing.
-        /// </remarks>
         private void ShowProblem(string message)
-        {
-            MessageBox.Show(this, message, "The app list could not be read",
+            => MessageBox.Show(this, message, "The app list could not be read",
                 MessageBoxButtons.OK, MessageBoxIcon.Warning);
-        }
 
-        /// <remarks>
-        /// Anything found while the form was being built is surfaced here, once the window is real
-        /// and visible and can genuinely own a modal dialog. The pending message is cleared BEFORE
-        /// it is shown, so a re-entrant Shown could not report the same problem twice.
-        /// </remarks>
         protected override void OnShown(EventArgs e)
         {
             base.OnShown(e);
-
             hasBeenShown = true;
-
             string problem = pendingProblemMessage;
             pendingProblemMessage = null;
-
             if (problem != null)
                 ShowProblem(problem);
         }
 
-        /// <summary>
-        /// What went wrong with one package, or null if it installed.
-        /// </summary>
-        /// <remarks>
-        /// Mirrors AStoreApps.Verify branch for branch, and for the same reason: "did not start" and
-        /// "started and we lost track of it" are different facts about whether this machine was
-        /// changed. A package winget may have half-installed must not be reported as untouched.
-        /// </remarks>
-        internal static string Describe(ProcessOutcome outcome)
-        {
-            if (outcome == null)
-                return "winget returned no outcome";
-
-            if (!outcome.Started)
-                return "could not run winget: " + outcome.Error;
-
-            if (outcome.TimedOut)
-                return "winget did not finish, and was stopped";
-
-            if (outcome.Error != null)
-                return "winget ran but its outcome could not be determined: " + outcome.Error;
-
-            if (outcome.ExitCode != 0)
-                return "winget exited with code " + outcome.ExitCode;
-
-            return null;
-        }
-
-        /// <summary>The summary shown once the install loop has finished or been stopped.</summary>
-        internal sealed class OutcomeMessage
+        private async Task RestorePackagesAsync()
         {
-            internal OutcomeMessage(string caption, string text, MessageBoxIcon icon)
-            {
-                Caption = caption;
-                Text = text;
-                Icon = icon;
-            }
-
-            internal string Caption { get; }
-
-            internal string Text { get; }
-
-            internal MessageBoxIcon Icon { get; }
+            string[] selectedPackages = listApps.CheckedItems.Cast<string>()
+                .Where(identifier => !string.IsNullOrWhiteSpace(identifier)).ToArray();
+            AppRestoreOutcome outcome = await AppRestoreService.InstallAsync(selectedPackages,
+                () => stopRequested);
+            Report(outcome.Text, outcome.Caption, ToIcon(outcome.Severity));
         }
 
-        /// <summary>
-        /// Composes the end-of-run summary from what was asked for, what was tried, and what failed.
-        /// </summary>
-        /// <remarks>
-        /// Three numbers rather than two, because "failed" and "never started" are different things
-        /// and neither may swallow the other. Stopping after five of twenty packages leaves fifteen
-        /// that were never attempted: calling those fifteen failures would be a false alarm, and
-        /// folding them into the five would hide a real one.
-        ///
-        /// Says "installed" rather than "restored": winget install on a package that is already
-        /// present upgrades it to the current version, and nothing here pins the backed-up version,
-        /// so the machine is not put back the way it was.
-        /// </remarks>
-        internal static OutcomeMessage ComposeOutcome(int requested, int attempted, IReadOnlyList<string> failures)
+        private static MessageBoxIcon ToIcon(RunSeverity severity) => severity switch
         {
-            int failed = failures?.Count ?? 0;
-            string failureList = failures == null ? string.Empty : string.Join("\n", failures);
-            bool stoppedEarly = attempted < requested;
-            int notStarted = requested - attempted;
-
-            if (requested == 0)
-            {
-                return new OutcomeMessage("Nothing to do",
-                    "No apps were ticked, so nothing was installed.", MessageBoxIcon.Information);
-            }
-
-            if (stoppedEarly)
-            {
-                string stopped = $"Stopped after {attempted} of {requested} app(s). " +
-                                 $"The remaining {notStarted} were not started.";
+            RunSeverity.Error => MessageBoxIcon.Error,
+            RunSeverity.Warning => MessageBoxIcon.Warning,
+            _ => MessageBoxIcon.Information
+        };
 
-                if (failed == 0)
-                {
-                    return new OutcomeMessage("Stopped",
-                        stopped + $"\n\nwinget installed {attempted} app(s).",
-                        MessageBoxIcon.Information);
-                }
-
-                // Both facts survive: what was stopped, and what failed among what was tried.
-                return new OutcomeMessage("Stopped, and some apps failed",
-                    stopped + $"\n\n{failed} of the {attempted} attempted failed:\n\n{failureList}",
-                    MessageBoxIcon.Warning);
-            }
-
-            if (failed == 0)
-            {
-                return new OutcomeMessage("Done",
-                    $"winget installed {attempted} app(s).\n\nAlready-installed apps are upgraded to the current version rather than put back at the backed-up one.",
-                    MessageBoxIcon.Information);
-            }
-
-            return new OutcomeMessage("Some apps did not install",
-                $"{failed} of {attempted} app(s) did not install:\n\n{failureList}",
-                MessageBoxIcon.Warning);
-        }
-
-        /// <remarks>
-        /// A Task, awaited by the click handler, rather than the async void it was. As async void it
-        /// was called un-awaited inside the caller's try, so the caller's catch stopped covering it
-        /// at the first await - an exception from the install loop escaped to the message loop
-        /// instead of reaching the handler that was written to report it.
-        /// </remarks>
-        private async Task RestorePackagesAsync()
-        {
-            List<string> selectedPackages = listApps.CheckedItems
-                .Cast<string>()
-                .Where(id => !string.IsNullOrWhiteSpace(id))
-                .ToList();
-
-            int requested = selectedPackages.Count;
-            int attempted = 0;
-
-            // Every package's outcome is inspected. This used to discard the returned
-            // ProcessOutcome entirely, so with winget missing the loop completed instantly
-            // having installed nothing and told the user nothing - a dialog that closed as
-            // though every package had been installed.
-            List<string> failures = new List<string>();
-
-            foreach (string packageIdentifier in selectedPackages)
-            {
-                if (stopRequested)
-                    break;
-
-                attempted++;
-
-                // RunWingetAsync already runs on a background thread, so no outer Task.Run is
-                // needed. The window is shown: an install is long, and winget's own progress is
-                // the only progress reporting this dialog has.
-                ProcessOutcome outcome = await Utils.RunWingetAsync(
-                    true,
-                    "install",
-                    "--id", packageIdentifier,
-                    "--accept-source-agreements",
-                    "--accept-package-agreements");
-
-                string problem = Describe(outcome);
-
-                if (problem != null)
-                    failures.Add(packageIdentifier + ": " + problem);
-            }
-
-            OutcomeMessage summary = ComposeOutcome(requested, attempted, failures);
-
-            Report(summary.Text, summary.Caption, summary.Icon);
-        }
-
-        /// <summary>
-        /// Whether this form is still in a state where it can own a modal dialog.
-        /// </summary>
-        /// <remarks>
-        /// Pure, so the rule can be tested without a message loop - the same reason ShouldDeferClose
-        /// is pure.
-        ///
-        /// Visible is in here, and it is the condition that actually fires. Both callers open this
-        /// form with ShowDialog and neither disposes it, and ShowDialog does not dispose on its own:
-        /// Close on a modal form HIDES it. So after a close this dialog gets no vote on -
-        /// Application.Exit, the owning form tearing down, Windows shutting down - IsDisposed and
-        /// Disposing are both still false while the window is closed and invisible. A guard that
-        /// tested only those would fall straight through and raise a modal owned by an invisible
-        /// window, which Windows Forms serves by recreating a handle for it. That is the ownerless
-        /// dialog that can paint behind a disabled main window, leaving an app that looks hung with
-        /// no visible cause - the exact defect the OnShown deferral above exists to prevent,
-        /// reintroduced on the summary path.
-        /// </remarks>
         internal static bool CanOwnADialog(bool isDisposed, bool disposing, bool visible)
             => !isDisposed && !disposing && visible;
 
-        /// <summary>
-        /// Says something to the user, in a window while there still is one and in the log otherwise.
-        /// </summary>
-        /// <remarks>
-        /// The window can be gone by the time the install loop finishes; see CanOwnADialog for how.
-        /// Showing a MessageBox anyway is either a crash (disposed owner, from an async void handler,
-        /// which ends the process) or a hidden modal, so neither is available and the text has to go
-        /// somewhere else.
-        ///
-        /// KNOWN LIMIT, not a guarantee: the log is a RichTextBox on the main window and nothing else.
-        /// When the form went away because the APP is going away, that control is being torn down too,
-        /// so LogHelper's own guard catches the disposed target and routes the line to Console.Write -
-        /// invisible in a Windows Forms app with no console. On that path the summary naming which
-        /// packages failed is lost, and this fallback does not save it. It is still worth having,
-        /// because the form can also be closed while the app lives on, and it is written down rather
-        /// than assumed away: making it hold in every case needs a persistent log file, which is a
-        /// filed item and not something to half-build here.
-        /// </remarks>
         private void Report(string text, string caption, MessageBoxIcon icon)
         {
             if (!CanOwnADialog(IsDisposed, Disposing, Visible))
@@ -689,35 +128,24 @@ private void Report(string text, string caption, MessageBoxIcon icon)
                 logger.LogMessage(caption + ": " + text);
                 return;
             }
-
             MessageBox.Show(this, text, caption, MessageBoxButtons.OK, icon);
         }
 
         private async void btnRestore_Click(object sender, EventArgs e)
         {
-            // Re-entrancy guard. The button is disabled for the duration below, but a guard on the
-            // state itself is what makes that a rule rather than a side effect of the UI.
             if (installing)
                 return;
-
-            // Let us ensure backup is selected
-            string selectedBackup = comboBackups.SelectedItem?.ToString();
-            if (string.IsNullOrEmpty(selectedBackup))
+            if (comboBackups.SelectedItem == null)
             {
-                MessageBox.Show(this, "Please select a backup to restore.", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
+                MessageBox.Show(this, "Please select a backup to restore.", "Error",
+                    MessageBoxButtons.OK, MessageBoxIcon.Error);
                 return;
             }
 
-            // The ticked boxes are the source of what gets installed. The old code re-read and
-            // re-parsed the export here to build a list, passed it to RestorePackages - and
-            // RestorePackages ignored the parameter and read the checkboxes anyway. The parse is
-            // gone; what it incidentally provided, a check that the export still exists, is covered
-            // by the fact that Restore is only ever enabled when that read produced apps to tick.
             installing = true;
             stopRequested = false;
             closeWhenIdle = false;
             SetInstallingUi(true);
-
             try
             {
                 await RestorePackagesAsync();
@@ -728,111 +156,50 @@ private async void btnRestore_Click(object sender, EventArgs e)
             }
             finally
             {
-                // Every exit path, including the catch above: leaving the dialog permanently
-                // disabled after one failure would strand the user in a window whose only working
-                // control is the close box.
                 installing = false;
                 stopRequested = false;
-
-                // Unless there is no window left to leave in any state. Touching the controls of a
-                // disposed form throws, and this finally runs on an async void path where that ends
-                // the process rather than surfacing anywhere. See CanOwnADialog for how the form can
-                // be gone while the loop is still running.
-                //
-                // Disposal only, deliberately - not the Visible test Report uses. Re-enabling the
-                // controls of a form that is merely hidden is harmless and leaves it correct if it
-                // is ever shown again, and Close on an already-closed form is a no-op. It is owning
-                // a MODAL that a hidden window cannot do, which is why only that call site is
-                // stricter.
                 if (!IsDisposed && !Disposing)
                 {
                     SetInstallingUi(false);
-
                     if (closeWhenIdle)
                         Close();
                 }
             }
         }
 
-        /// <remarks>
-        /// Cancel is repurposed rather than joined by a third button: adding one would change the
-        /// Designer's layout and tab order, and "Cancel" during a multi-minute install is exactly
-        /// the button a user reaches for when they want it to stop.
-        /// </remarks>
         private void SetInstallingUi(bool busy)
         {
             comboBackups.Enabled = !busy;
             listApps.Enabled = !busy;
             btnRestore.Enabled = !busy && listApps.Items.Count > 0;
-
             btnCancel.Enabled = true;
             btnCancel.Text = busy ? "Stop after the current app" : "Cancel";
         }
 
-        /// <summary>
-        /// The Cancel button's caption once a stop has been asked for.
-        /// </summary>
-        /// <remarks>
-        /// Says the wait ends either way. stopRequested is only read BETWEEN packages, so a wedged
-        /// winget holds this dialog until RunWingetAsync's timeout kills it - a wait the user should
-        /// know is bounded by something other than the install itself. No duration is quoted: the
-        /// timeout is a private constant in WindowsHelper, and a number copied here would be a
-        /// second source of truth for it, free to drift the moment the real one is tuned.
-        ///
-        /// The alternative - checking stopRequested mid-package - would mean killing winget
-        /// part-way through, leaving a half-installed package no summary could describe honestly.
-        /// Waiting is the lesser harm; saying so is the fix.
-        /// </remarks>
         internal const string StoppingText = "Stopping after the current app (or its timeout)";
 
         private void btnCancel_Click(object sender, EventArgs e)
         {
             if (!installing)
             {
-                this.Close();
+                Close();
                 return;
             }
-
             stopRequested = true;
             btnCancel.Enabled = false;
             btnCancel.Text = StoppingText;
         }
 
-        /// <summary>
-        /// Whether a close must be held back until the install loop is idle.
-        /// </summary>
-        /// <remarks>
-        /// Pure, so the rule can be tested without a message loop.
-        ///
-        /// UserClosing ONLY. The handler used to check nothing but the installing flag, so it
-        /// vetoed every other CloseReason too: a mid-install Application.Exit, a close of the
-        /// owning MainForm, and an MDI teardown were all silently refused - the app simply appeared
-        /// to hang - and WindowsShutDown was refused until Windows overrode it, having first shown
-        /// the user a blocked-shutdown screen naming WinRestoreKit. None of those closes is something
-        /// this dialog gets a vote on; only a user closing THIS window is.
-        /// </remarks>
         internal static bool ShouldDeferClose(bool installing, CloseReason reason)
             => installing && reason == CloseReason.UserClosing;
 
-        /// <remarks>
-        /// A user closing this window mid-install asks the loop to stop after the current package
-        /// and defers the close until it has. Letting the form tear down underneath a running loop
-        /// would leave an elevated winget install owned by a disposed window, and the summary -
-        /// including any failures - would never be shown.
-        /// </remarks>
         private void RestAppsForm_FormClosing(object sender, FormClosingEventArgs e)
         {
             if (!installing)
                 return;
-
-            // The loop is asked to stop after the current package on ANY close - an app that is
-            // going away should not keep installing. What the CloseReason decides is whether the
-            // close WAITS for it.
             stopRequested = true;
-
             if (!ShouldDeferClose(installing, e.CloseReason))
                 return;
-
             e.Cancel = true;
             closeWhenIdle = true;
             btnCancel.Enabled = false;
diff --git a/src/WinRestoreKit/Helpers/UpdateCheck.cs b/src/WinRestoreKit/Helpers/UpdateCheck.cs
deleted file mode 100644
index 74a658e..0000000
--- a/src/WinRestoreKit/Helpers/UpdateCheck.cs
+++ /dev/null
@@ -1,138 +0,0 @@
-using DataHelper;
-using System;
-using System.Net.Http;
-using System.Threading.Tasks;
-using System.Windows.Forms;
-
-namespace WinRestoreKit
-{
-    /// <summary>
-    /// The interactive half of the update check: everything that talks to the user, and the version
-    /// comparison that decides what it says.
-    /// </summary>
-    /// <remarks>
-    /// This lived on <see cref="Data"/> until Phase 4 PR 2, for two reasons that both point the same
-    /// way. It is almost entirely MessageBoxes, and Data is engine code that no longer references
-    /// WinForms; and it calls <see cref="Program"/>, which is the application entry point and cannot
-    /// be reached from a library the application itself depends on.
-    ///
-    /// Phase 4 retargeted it at the GitHub Releases API and replaced WebClient with HttpClient. The
-    /// Releases API is the PRIMARY source and Properties/AssemblyInfo.cs is the FALLBACK, taken on
-    /// any primary failure at all - non-2xx (including the rate-limit 403 that shared IPs hit),
-    /// timeout, malformed JSON, or an empty tag.
-    ///
-    /// The fallback is not legacy baggage inherited from Appcopier: WinRestoreKit is a new
-    /// application starting at 0.0.1 and has no deployed clients of its own to keep compatible.
-    /// It is kept because the rate-limit 403 is common on shared and corporate IPs, and because
-    /// once the repository is public but before the first Release is published it is the only
-    /// source that can answer at all: the Releases API has nothing to return, while main already
-    /// carries an AssemblyFileVersion.
-    ///
-    /// Neither source can answer while nicolasestrem/WinRestoreKit is PRIVATE. Both requests are
-    /// unauthenticated (a User-Agent and nothing else), so api.github.com and
-    /// raw.githubusercontent.com both 404, and the check reports a failure to the user. The whole
-    /// update path only starts working when the repository is published.
-    ///
-    /// The five message texts name WinRestoreKit clearly, and both sides of the comparison still go through
-    /// Program.NormalizeVersion - normalizing only one side makes an up-to-date client report a
-    /// phantom update on every check.
-    /// </remarks>
-    internal static class UpdateCheck
-    {
-        /// <summary>
-        /// One client for the whole process; a new one per call leaks sockets in TIME_WAIT.
-        /// </summary>
-        /// <remarks>
-        /// The User-Agent is not optional: api.github.com answers 403 to a request without one.
-        /// </remarks>
-        private static readonly HttpClient Client = CreateClient();
-
-        private static HttpClient CreateClient()
-        {
-            HttpClient client = new HttpClient { Timeout = TimeSpan.FromSeconds(10) };
-            client.DefaultRequestHeaders.UserAgent.ParseAdd(Data.UserAgent);
-            return client;
-        }
-
-        internal static async Task CheckForUpdatesAsync()
-        {
-            // Probed ONCE, and the else below must stay an else. IsInet returns bool, not bool?, so
-            // an "else if (IsInet() == false)" is not a third case - it is a second five-second
-            // synchronous probe on the UI thread, and it only ever runs for the offline user who
-            // already waited out the first one. That doubled the freeze to ten seconds before the
-            // "problem on Internet connection" message appeared.
-            if (Data.IsInet())
-            {
-                try
-                {
-                    string parsed = await ReadLatestVersionAsync();
-
-                    if (string.IsNullOrWhiteSpace(parsed))
-                    {
-                        // Neither source held a version we could read. Saying so beats the old
-                        // behavior, which compared "" against the current version, found them
-                        // unequal, and offered a download for a nonexistent release.
-                        MessageBox.Show(
-                            "Could not read the latest WinRestoreKit version number from the update file.",
-                            "WinRestoreKit Update", MessageBoxButtons.OK, MessageBoxIcon.Warning);
-                        return;
-                    }
-
-                    // Both sides go through the same normalization. Comparing a raw remote string
-                    // against a normalized local one means a four-part or suffixed version upstream
-                    // would never match, and every up-to-date user would be offered a phantom
-                    // update on every check, forever.
-                    string latestVersion = Program.NormalizeVersion(parsed);
-                    string currentVersion = Program.GetCurrentVersionTostring();
-
-                    if (latestVersion == currentVersion)                          // Up-to-date
-                    {
-                        MessageBox.Show("No new WinRestoreKit updates are available.", "WinRestoreKit Update", MessageBoxButtons.OK, MessageBoxIcon.Information);
-                    }
-                    else                                                          // Update available
-                    {
-                        if (MessageBox.Show($"WinRestoreKit version {latestVersion} is available.\nDo you want to open the download page?", "WinRestoreKit Update Available", MessageBoxButtons.YesNo, MessageBoxIcon.Information, MessageBoxDefaultButton.Button1) == DialogResult.Yes)
-                            Utils.OpenUrl(Data.Uri.URL_GITLATEST);
-                    }
-                }
-                catch (Exception ex)
-                {
-                    MessageBox.Show($"Checking for WinRestoreKit updates failed.\n{ex.Message}");
-                }
-            }
-            else
-            {
-                MessageBox.Show("Problem with the internet connection: checking for WinRestoreKit updates failed.");
-            }
-        }
-
-        /// <summary>
-        /// The newest published version: the Releases API tag, or the AssemblyInfo version when that
-        /// path fails for any reason.
-        /// </summary>
-        private static async Task<string> ReadLatestVersionAsync()
-        {
-            try
-            {
-                using (HttpResponseMessage response = await Client.GetAsync(Data.Uri.URL_GITAPI_LATEST))
-                {
-                    response.EnsureSuccessStatusCode();
-
-                    string tag = Data.ParseLatestReleaseTag(await response.Content.ReadAsStringAsync());
-
-                    if (!string.IsNullOrWhiteSpace(tag))
-                        return tag;
-                }
-            }
-            catch (Exception)
-            {
-                // Any primary failure falls through to the raw AssemblyInfo on main, which is the
-                // only source that answers before the first GitHub Release exists.
-                // Swallowed deliberately and narrowly: the fallback below reports its own failure to
-                // the caller's catch, so a total outage is still surfaced rather than hidden.
-            }
-
-            return Data.ParseLatestVersion(await Client.GetStringAsync(Data.Uri.URL_ASSEMBLY));
-        }
-    }
-}
diff --git a/src/WinRestoreKit/Helpers/WinFormsUpdatePresenter.cs b/src/WinRestoreKit/Helpers/WinFormsUpdatePresenter.cs
new file mode 100644
index 0000000..4c13e97
--- /dev/null
+++ b/src/WinRestoreKit/Helpers/WinFormsUpdatePresenter.cs
@@ -0,0 +1,76 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Windows.Forms;
+using DataHelper;
+
+namespace WinRestoreKit
+{
+    internal sealed class WinFormsUpdatePresenter
+    {
+        private readonly IUpdateCheckService updates;
+        private readonly IWin32Window owner;
+        private readonly string currentVersion;
+
+        internal WinFormsUpdatePresenter(IUpdateCheckService updates, IWin32Window owner,
+                                        string currentVersion)
+        {
+            this.updates = updates ?? throw new ArgumentNullException(nameof(updates));
+            this.owner = owner ?? throw new ArgumentNullException(nameof(owner));
+            this.currentVersion = currentVersion;
+        }
+
+        internal async Task CheckAsync(CancellationToken cancellationToken)
+        {
+            UpdateCheckResult result = await updates.CheckAsync(currentVersion, cancellationToken);
+            if (!CanShowDialog())
+                return;
+
+            switch (result.Verdict)
+            {
+                case UpdateVerdict.CannotDetermineCurrentVersion:
+                    MessageBox.Show(owner,
+                        "The installed WinRestoreKit version could not be determined, so no update download can be offered.",
+                        "WinRestoreKit Update", MessageBoxButtons.OK, MessageBoxIcon.Warning);
+                    return;
+                case UpdateVerdict.LatestVersionUnreadable:
+                    if (!string.IsNullOrWhiteSpace(result.ErrorMessage))
+                    {
+                        MessageBox.Show(owner,
+                            "Checking for WinRestoreKit updates failed.\n" + result.ErrorMessage,
+                            "WinRestoreKit Update", MessageBoxButtons.OK, MessageBoxIcon.Error);
+                    }
+                    else
+                    {
+                        MessageBox.Show(owner,
+                            "Could not read the latest WinRestoreKit version number from the update file.",
+                            "WinRestoreKit Update", MessageBoxButtons.OK, MessageBoxIcon.Warning);
+                    }
+
+                    return;
+                case UpdateVerdict.UpToDate:
+                    MessageBox.Show(owner, "No new WinRestoreKit updates are available.",
+                        "WinRestoreKit Update", MessageBoxButtons.OK, MessageBoxIcon.Information);
+                    return;
+                case UpdateVerdict.UpdateAvailable:
+                    if (MessageBox.Show(owner,
+                        "WinRestoreKit version " + result.LatestVersion +
+                        " is available.\nDo you want to open the download page?",
+                        "WinRestoreKit Update Available", MessageBoxButtons.YesNo,
+                        MessageBoxIcon.Information, MessageBoxDefaultButton.Button1) == DialogResult.Yes)
+                    {
+                        Utils.OpenUrl(Data.Uri.URL_GITLATEST);
+                    }
+
+                    return;
+                default:
+                    throw new InvalidOperationException("The update result has an unknown verdict.");
+            }
+        }
+
+        private bool CanShowDialog()
+        {
+            return !(owner is Control control) || (!control.IsDisposed && control.Visible);
+        }
+    }
+}
diff --git a/src/WinRestoreKit/MainForm.cs b/src/WinRestoreKit/MainForm.cs
index 9636867..5bc11ef 100644
--- a/src/WinRestoreKit/MainForm.cs
+++ b/src/WinRestoreKit/MainForm.cs
@@ -4,7 +4,6 @@
 using System.Collections.Generic;
 using System.Drawing;
 using System.IO;
-using System.Threading.Tasks;
 using System.Windows.Forms;
 using Views;
 
@@ -40,7 +39,6 @@ public MainForm()
             homePage = new HomePageView(GoToBackUp, GoToHistory, ShowRestoreWizard);
             navigationButtons = new[] { btnHome, btnBackUp, btnProgress, btnRestore, btnHistory, btnAbout };
 
-            backupPage.ShowRestoreView = ShowRestoreWizard;
             backupPage.StartBackupRequested = StartBackup;
             wizardStep2.StartRestoreRequested = StartRestore;
             navigation.Root = homePage;
@@ -55,7 +53,7 @@ public MainForm()
 
         private void MainForm_Shown(object sender, EventArgs e)
         {
-            lblVersion.Text = GetMinorVersion(Program.GetCurrentVersionTostring());
+            lblVersion.Text = GetMinorVersion(VersionInfo.GetCurrentVersion(typeof(MainForm).Assembly));
             RefreshDestinationStatus();
             ShowHome();
             Theme.ApplyTitleBar(this);
@@ -381,21 +379,6 @@ private static string GetMinorVersion(string version)
             return secondDotIndex == -1 ? "Version " + version : "Version " + version.Substring(0, secondDotIndex);
         }
 
-        /// <summary>
-        /// Runs the existing interactive update check without leaking an exception to a future About page.
-        /// </summary>
-        internal async Task<string> CheckForUpdatesAsync()
-        {
-            try
-            {
-                await UpdateCheck.CheckForUpdatesAsync();
-                return "Update check completed.";
-            }
-            catch (Exception)
-            {
-                return "Update check failed.";
-            }
-        }
 
         private void MainForm_FormClosed(object sender, FormClosedEventArgs e)
         {
diff --git a/src/WinRestoreKit/Program.cs b/src/WinRestoreKit/Program.cs
index a5e68bc..1d95f97 100644
--- a/src/WinRestoreKit/Program.cs
+++ b/src/WinRestoreKit/Program.cs
@@ -1,7 +1,6 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
-using System.Reflection;
 using System.Threading.Tasks;
 using System.Windows.Forms;
 using Views;
@@ -10,68 +9,6 @@ namespace WinRestoreKit
 {
     internal static class Program
     {
-        /// <summary>
-        /// Get app version
-        /// </summary>
-        /// <remarks>
-        /// Reads AssemblyFileVersion directly, which is the exact attribute Data.ParseLatestVersion
-        /// scrapes out of the remote Properties/AssemblyInfo.cs. The two are expected to DIFFER, on
-        /// any install running an older build: that gap is the update. The point of using the same
-        /// attribute on both sides is that a difference is then always a real version difference,
-        /// never an artefact of comparing two different fields.
-        ///
-        /// That holds only for the update check's FALLBACK. Its primary source is the GitHub
-        /// release tag, a separate hand-entered value that never reads this attribute, so a
-        /// difference there can equally well be a mistyped tag. Only the release process keeps the
-        /// tag, this attribute and main in step. See .claude/skills/release/SKILL.md.
-        /// Application.ProductVersion is deliberately not used
-        /// as the primary source: on .NET 5+ it prefers AssemblyInformationalVersion, which the SDK may
-        /// decorate with a "+&lt;commit-sha&gt;" suffix that would make new Version(...) throw.
-        /// </remarks>
-        internal static string GetCurrentVersionTostring()
-            => NormalizeVersion(
-                typeof(Program).Assembly.GetCustomAttribute<AssemblyFileVersionAttribute>()?.Version
-                ?? Application.ProductVersion);
-
-        /// <summary>
-        /// Reduces a raw version string to the three-part form used throughout the app.
-        /// </summary>
-        /// <remarks>
-        /// This runs during MainForm construction, so it must not throw: an exception here is a
-        /// startup crash with no UI to report it. Every input that cannot be reduced to three
-        /// components is therefore passed through unchanged rather than parsed.
-        ///
-        /// Deliberately NOT substituted with a realistic-looking placeholder like "0.0.0" on
-        /// failure. Any unusable version makes the update check offer a phantom update - that much
-        /// is unavoidable here, since the comparison in UpdateCheck.CheckForUpdatesAsync is a
-        /// string ==. What the
-        /// choice buys is diagnosis: "unknown" in the title bar says the app cannot determine its
-        /// own version, whereas "0.0.0" reads as a real installed version and sends whoever
-        /// investigates the repeating update prompt looking in the wrong place entirely.
-        /// </remarks>
-        internal static string NormalizeVersion(string rawVersion)
-        {
-            if (string.IsNullOrWhiteSpace(rawVersion))
-                return UnknownVersion;
-
-            string raw = rawVersion.Trim();
-
-            // Strip any SemVer build/prerelease suffix ("1.2.3+sha", "1.2.3-preview") before parsing.
-            int suffix = raw.IndexOfAny(new[] { '+', '-' });
-            string candidate = suffix >= 0 ? raw.Substring(0, suffix) : raw;
-
-            // Build is -1 when fewer than three components were supplied, and ToString(3) throws on
-            // those - so "1.2" has to fail this check, not just parse successfully.
-            return Version.TryParse(candidate, out Version parsed) && parsed.Build >= 0
-                ? parsed.ToString(3)
-                : raw;
-        }
-
-        /// <summary>
-        /// Shown when the assembly carries no usable version at all. Chosen so it cannot be mistaken
-        /// for a real version number by a user reading the title bar.
-        /// </summary>
-        internal const string UnknownVersion = "unknown";
 
         /// <summary>
         /// Builds the text shown when the app fails before its window exists.
@@ -116,8 +53,8 @@ private static void RegisterUiSeams()
                     MessageBoxButtons.OK,
                     MessageBoxIcon.Warning);
 
-            // AppStoreApps.RestoreAsync deliberately returns a completed Task so this runs on the
-            // caller's STA thread rather than an MTA pool thread - see the remarks there.
+            // AppStoreApps' owner-aware RestoreAsync deliberately returns a completed Task so this
+            // runs on the caller's STA thread rather than an MTA pool thread - see its remarks.
             //
             // ShowDialog, unlike Show, does NOT dispose the form when it closes - it keeps the
             // instance alive so the caller can still read its state, which is why this one needs
@@ -125,11 +62,11 @@ private static void RegisterUiSeams()
             // never did, so every restore of that module leaked the form's window handle and
             // every GDI object on it for the life of the process. Reaching the same dialog again
             // from a later restore in the same session leaked another.
-            Conf.AppStoreApps.RestoreDialog = sourcePath =>
+            Conf.AppStoreApps.RestoreDialog = (sourcePath, owner) =>
             {
                 using (RestAppsForm restoreApps = new RestAppsForm(sourcePath))
                 {
-                    restoreApps.ShowDialog();
+                    restoreApps.ShowDialog((IWin32Window)owner);
                 }
             };
         }
diff --git a/src/WinRestoreKit/Views/AboutPageView.cs b/src/WinRestoreKit/Views/AboutPageView.cs
index d75c6b7..f006596 100644
--- a/src/WinRestoreKit/Views/AboutPageView.cs
+++ b/src/WinRestoreKit/Views/AboutPageView.cs
@@ -4,6 +4,7 @@
 using System.Drawing;
 using System.IO;
 using System.Security.Principal;
+using System.Threading;
 using System.Windows.Forms;
 using WinRestoreKit;
 
@@ -138,7 +139,7 @@ private Control BuildIdentityColumn()
                 ForeColor = Theme.Current.TextMuted,
                 Margin = new Padding(0, 0, 0, Ui.SpaceS),
                 MaximumSize = new Size(270, 0),
-                Text = "VERSION " + Program.GetCurrentVersionTostring()
+                Text = "VERSION " + VersionInfo.GetCurrentVersion(typeof(AboutPageView).Assembly)
                     + Environment.NewLine + "BUILD " + BuildIdentity()
                     + Environment.NewLine + "OS " + Environment.OSVersion.VersionString
             };
@@ -350,7 +351,11 @@ private async void checkForUpdatesButton_Click(object sender, EventArgs e)
 
             try
             {
-                await UpdateCheck.CheckForUpdatesAsync();
+                WinFormsUpdatePresenter updates = new WinFormsUpdatePresenter(
+                    new UpdateCheckService(),
+                    this,
+                    VersionInfo.GetCurrentVersion(typeof(AboutPageView).Assembly));
+                await updates.CheckAsync(CancellationToken.None);
                 SetUpdateStatus("UPDATE CHECK FINISHED.", Theme.Current.Accent700);
             }
             catch (Exception ex)
@@ -379,14 +384,7 @@ private void openLogFolderButton_Click(object sender, EventArgs e)
 
         private static void releaseNotesLink_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e)
         {
-            try
-            {
-                Process.Start(new ProcessStartInfo(ReleasesUrl) { UseShellExecute = true });
-            }
-            catch (Exception)
-            {
-                // Opening a browser is best-effort. The user can still copy the visible release URL.
-            }
+            Utils.OpenUrl(ReleasesUrl);
         }
 
         private void SetUpdateStatus(string text, Color color)
@@ -405,7 +403,7 @@ private void ApplyPalette()
         }
 
         private static string BuildIdentity()
-            => typeof(Program).Assembly.GetName().Version?.ToString() ?? "Unknown";
+            => typeof(AboutPageView).Assembly.GetName().Version?.ToString() ?? "Unknown";
 
         private static bool IsElevated()
         {
diff --git a/src/WinRestoreKit/Views/BackupPageView.cs b/src/WinRestoreKit/Views/BackupPageView.cs
index 78d6801..42aa1ca 100644
--- a/src/WinRestoreKit/Views/BackupPageView.cs
+++ b/src/WinRestoreKit/Views/BackupPageView.cs
@@ -3,10 +3,11 @@
 using System;
 using System.Collections.Generic;
 using System.Drawing;
-using System.Globalization;
 using System.Linq;
 using System.Windows.Forms;
 using WinRestoreKit;
+using ApplicationScopeGroupRow = WinRestoreKit.ScopeGroupRow;
+using ApplicationScopeGroups = WinRestoreKit.ScopeGroups;
 
 namespace Views
 {
@@ -19,10 +20,9 @@ namespace Views
     /// </remarks>
     public partial class BackupPageView : UserControl
     {
-        private readonly IReadOnlyList<ScopeGroupRow> scopeGroups;
-        private readonly Dictionary<ScopeGroupRow, CustomCheckbox> scopeToggles = new();
+        private readonly IReadOnlyList<ApplicationScopeGroupRow> scopeGroups;
+        private readonly Dictionary<ApplicationScopeGroupRow, CustomCheckbox> scopeToggles = new();
         private readonly Label selectionSummary;
-        private readonly Label estimateValue;
         private readonly Label validationMessage;
         private readonly TextBox snapshotNameInput;
         private readonly TextBox destinationInput;
@@ -33,14 +33,10 @@ public partial class BackupPageView : UserControl
         /// </summary>
         internal Action<IReadOnlyList<BackupBase>, string, SnapshotCompression, string> StartBackupRequested;
 
-        /// <summary>
-        /// Retained for callers that supply the restore-wizard navigation seam.
-        /// </summary>
-        internal Action ShowRestoreView = () => { };
 
         public BackupPageView()
         {
-            scopeGroups = ScopeGroups.Build();
+            scopeGroups = ApplicationScopeGroups.Build();
 
             BackColor = Theme.Current.Bg;
             Dock = DockStyle.Fill;
@@ -83,7 +79,7 @@ public BackupPageView()
             content.Controls.Add(scopes, 0, 0);
 
             BlueprintFrame options = CreateOptionsPanel(out snapshotNameInput, out destinationInput,
-                out compressionSelector, out estimateValue, out validationMessage);
+                out compressionSelector, out validationMessage);
             options.Margin = new Padding(Ui.SpaceL, 0, 0, 0);
             content.Controls.Add(options, 1, 0);
 
@@ -168,7 +164,7 @@ private Panel CreateScopesPanel(out Label summary)
 
             for (int index = 0; index < scopeGroups.Count; index++)
             {
-                ScopeGroupRow group = scopeGroups[index];
+                ApplicationScopeGroupRow group = scopeGroups[index];
                 Panel row = CreateScopeRow(group, index, out CustomCheckbox toggle);
                 scopeToggles.Add(group, toggle);
                 rows.Controls.Add(row);
@@ -179,7 +175,7 @@ private Panel CreateScopesPanel(out Label summary)
             return panel;
         }
 
-        private Panel CreateScopeRow(ScopeGroupRow group, int index, out CustomCheckbox toggle)
+        private Panel CreateScopeRow(ApplicationScopeGroupRow group, int index, out CustomCheckbox toggle)
         {
             int rowHeight = string.IsNullOrWhiteSpace(group.CautionNote) ? 68 : 106;
             Panel row = new Panel
@@ -238,33 +234,19 @@ private Panel CreateScopeRow(ScopeGroupRow group, int index, out CustomCheckbox
                     UseMnemonic = false
                 };
             }
-            Label size = new Label
-            {
-                Anchor = AnchorStyles.Top | AnchorStyles.Right,
-                Font = Ui.MonoSmall(),
-                ForeColor = Theme.Current.TextMuted,
-                Location = new Point(0, 25),
-                Size = new Size(74, 20),
-                Text = group.SizeLabel,
-                TextAlign = ContentAlignment.MiddleRight,
-                UseMnemonic = false
-            };
             row.SizeChanged += (sender, args) =>
             {
-                int detailWidth = Math.Max(120, row.ClientSize.Width - 132);
+                int detailWidth = Math.Max(120, row.ClientSize.Width - 56);
                 name.Width = detailWidth;
                 detail.Width = detailWidth;
                 if (caution != null)
                     caution.Width = detailWidth;
-
-                size.Left = row.ClientSize.Width - size.Width - Ui.SpaceM;
             };
 
             EventHandler toggleRow = (sender, args) => rowToggle.Checked = !rowToggle.Checked;
             row.Click += toggleRow;
             name.Click += toggleRow;
             detail.Click += toggleRow;
-            size.Click += toggleRow;
             if (caution != null)
                 caution.Click += toggleRow;
 
@@ -274,13 +256,11 @@ private Panel CreateScopeRow(ScopeGroupRow group, int index, out CustomCheckbox
             if (caution != null)
                 row.Controls.Add(caution);
 
-            row.Controls.Add(size);
             return row;
         }
 
         private BlueprintFrame CreateOptionsPanel(out TextBox snapshotName, out TextBox destination,
-                                                  out SegmentedControl compression, out Label estimate,
-                                                  out Label message)
+                                                  out SegmentedControl compression, out Label message)
         {
             BlueprintFrame frame = new BlueprintFrame
             {
@@ -317,7 +297,6 @@ private BlueprintFrame CreateOptionsPanel(out TextBox snapshotName, out TextBox
                 SelectedIndex = 1,
                 Name = "compressionSelector"
             };
-            compression.SelectedIndexChanged += (sender, args) => RefreshSelectionSummary();
 
             options.Controls.Add(CreateOptionLabel("SNAPSHOT NAME"), 0, 0);
             options.SetColumnSpan(snapshotName, 2);
@@ -333,35 +312,18 @@ private BlueprintFrame CreateOptionsPanel(out TextBox snapshotName, out TextBox
             options.SetColumnSpan(compression, 2);
             options.Controls.Add(compression, 0, 7);
 
-            Panel footer = new Panel { Dock = DockStyle.Fill, Height = 78, Margin = new Padding(0, Ui.SpaceL, 0, 0) };
-            Label estimateCaption = new Label
-            {
-                AutoSize = true,
-                Text = "ESTIMATED TOTAL",
-                Font = Ui.Kicker(),
-                ForeColor = Theme.Current.TextMuted,
-                Location = new Point(0, 0)
-            };
-            estimate = new Label
-            {
-                AutoSize = true,
-                Font = Ui.Mono(),
-                ForeColor = Theme.Current.Text,
-                Location = new Point(0, 18)
-            };
+            Panel footer = new Panel { Dock = DockStyle.Fill, Margin = new Padding(0, Ui.SpaceL, 0, 0) };
             Label messageLabel = new Label
             {
                 AutoEllipsis = true,
                 ForeColor = Theme.Current.Accent2_600,
                 Font = Ui.MonoSmall(),
-                Location = new Point(0, 40),
+                Location = new Point(0, 0),
                 Size = new Size(10, 19),
                 Visible = false
             };
             message = messageLabel;
             footer.SizeChanged += (sender, args) => messageLabel.Width = footer.ClientSize.Width;
-            footer.Controls.Add(estimateCaption);
-            footer.Controls.Add(estimate);
             footer.Controls.Add(message);
             options.SetColumnSpan(footer, 2);
             options.Controls.Add(footer, 0, 8);
@@ -507,59 +469,6 @@ private void RefreshSelectionSummary()
         {
             int selected = scopeToggles.Values.Count(toggle => toggle.Checked);
             selectionSummary.Text = selected + " of " + scopeGroups.Count + " groups";
-            estimateValue.Text = EstimateSelection();
-        }
-
-        private string EstimateSelection()
-        {
-            long totalBytes = 0;
-            foreach (ScopeGroupRow group in scopeGroups)
-            {
-                if (!scopeToggles[group].Checked || !TryParseSize(group.SizeLabel, out long bytes))
-                    return "--";
-
-                totalBytes += bytes;
-            }
-
-            return FormatSize(totalBytes);
-        }
-
-        private static bool TryParseSize(string label, out long bytes)
-        {
-            bytes = 0;
-            string[] parts = (label ?? string.Empty).Trim().Split(' ', StringSplitOptions.RemoveEmptyEntries);
-            if (parts.Length != 2 || !double.TryParse(parts[0], NumberStyles.Number, CultureInfo.InvariantCulture, out double value))
-                return false;
-
-            double multiplier = parts[1].ToUpperInvariant() switch
-            {
-                "B" => 1d,
-                "KB" => 1024d,
-                "MB" => 1024d * 1024d,
-                "GB" => 1024d * 1024d * 1024d,
-                _ => 0d
-            };
-            if (multiplier == 0d || value < 0d || value > long.MaxValue / multiplier)
-                return false;
-
-            bytes = (long)Math.Round(value * multiplier, MidpointRounding.AwayFromZero);
-            return true;
-        }
-
-        private static string FormatSize(long bytes)
-        {
-            const long Gigabyte = 1024L * 1024L * 1024L;
-            const long Megabyte = 1024L * 1024L;
-            const long Kilobyte = 1024L;
-
-            if (bytes >= Gigabyte)
-                return (bytes / (double)Gigabyte).ToString("0.0", CultureInfo.InvariantCulture) + " GB";
-            if (bytes >= Megabyte)
-                return (bytes / (double)Megabyte).ToString("0.0", CultureInfo.InvariantCulture) + " MB";
-            if (bytes >= Kilobyte)
-                return (bytes / (double)Kilobyte).ToString("0.0", CultureInfo.InvariantCulture) + " KB";
-
-            return bytes + " B";
         }
 
         private void SetValidationMessage(string text)
@@ -577,7 +486,7 @@ internal void SelectModulesByTypeName(IReadOnlyList<string> moduleTypeNames)
                 moduleTypeNames?.Where(name => !string.IsNullOrWhiteSpace(name)) ?? Array.Empty<string>(),
                 StringComparer.Ordinal);
 
-            foreach (ScopeGroupRow group in scopeGroups)
+            foreach (ApplicationScopeGroupRow group in scopeGroups)
             {
                 scopeToggles[group].Checked = group.Modules.Any(module =>
                     wanted.Contains(module.GetType().Name));
diff --git a/src/WinRestoreKit/Views/BackupPresets.cs b/src/WinRestoreKit/Views/BackupPresets.cs
deleted file mode 100644
index 29f95cc..0000000
--- a/src/WinRestoreKit/Views/BackupPresets.cs
+++ /dev/null
@@ -1,39 +0,0 @@
-using System.Collections.Generic;
-
-namespace Views
-{
-    /// <summary>
-    /// Named selections of module type names: pure UI curation, no engine concept. "Everything on
-    /// this PC" is not a list - it is today's Select-available (<c>SelectInstalled</c>) - so only the
-    /// two membership lists live here.
-    /// </summary>
-    /// <remarks>
-    /// Membership is a deliberate curation decision the reviewer must see apart from the layout diff,
-    /// which is why presets ship in their own PR after the Backup page rebuild. Changing membership is
-    /// a one-line edit here plus its literal test.
-    /// </remarks>
-    internal static class BackupPresets
-    {
-        /// <summary>Type names for the Developer machine preset.</summary>
-        internal static readonly IReadOnlyList<string> DeveloperMachine = new[]
-        {
-            "ETerminal",
-            "EVSCode",
-            "ESsh",
-            "EEnvironment",
-            "EHosts"
-        };
-
-        /// <summary>
-        /// Type names EXCLUDED by Minimal privacy-safe: the Windows Update client identity, both env
-        /// var variants, and the Wi-Fi keys.
-        /// </summary>
-        internal static readonly IReadOnlyList<string> MinimalPrivacySafeExclusions = new[]
-        {
-            "WUpdates",
-            "EEnvironment",
-            "EEnvironmentFiltered",
-            "CWiFiConf"
-        };
-    }
-}
diff --git a/src/WinRestoreKit/Views/ProgressPageView.cs b/src/WinRestoreKit/Views/ProgressPageView.cs
index 33b9b53..87b14f0 100644
--- a/src/WinRestoreKit/Views/ProgressPageView.cs
+++ b/src/WinRestoreKit/Views/ProgressPageView.cs
@@ -565,7 +565,7 @@ private void RenderSummary(RunSummary summary, IReadOnlyList<ModuleOutcome> outc
             summaryShown = true;
             kickerLabel.Text = SummaryKicker(summary);
             titleLabel.Text = summary.Headline.ToUpperInvariant();
-            titleLabel.ForeColor = summary.State == RunState.Problems || summary.State == RunState.DidNotRun
+            titleLabel.ForeColor = summary.Severity == RunSeverity.Warning
                 ? Theme.Current.Accent2_600
                 : Theme.Current.Text;
             resultsHeadline.Text = summary.Headline;
@@ -740,7 +740,7 @@ void IRunUi.SetProgressDetail(string groupInfo, string elapsedValue, string rema
             });
         }
 
-        IWin32Window IRunUi.Owner => (IWin32Window)FindForm() ?? this;
+        object IRunUi.DialogOwner => (object)FindForm() ?? this;
 
         void IRunUi.ShowSummary(RunSummary summary, string caption, IReadOnlyList<ModuleOutcome> outcomes)
         {
diff --git a/src/WinRestoreKit/Views/RestoreWizardStep2View.cs b/src/WinRestoreKit/Views/RestoreWizardStep2View.cs
index 7250056..d5d703d 100644
--- a/src/WinRestoreKit/Views/RestoreWizardStep2View.cs
+++ b/src/WinRestoreKit/Views/RestoreWizardStep2View.cs
@@ -258,9 +258,11 @@ internal void LoadFolder(BackupFolder folder)
 
         private Control MakeRow(RestoreContentsRow row)
         {
-            string caption = row.HasBackup
-                ? row.Module.Title
-                : row.Module.Title + " (nothing in this snapshot)";
+            string caption = row.CouldNotBeRead
+                ? row.Module.Title + " (could not be read)"
+                : row.HasBackup
+                    ? row.Module.Title
+                    : row.Module.Title + " (nothing in this snapshot)";
 
             CustomCheckbox checkbox = new CustomCheckbox
             {
@@ -278,7 +280,7 @@ private Control MakeRow(RestoreContentsRow row)
                 AutoSize = true,
                 Anchor = AnchorStyles.Left,
                 Font = Ui.BodyBold(),
-                ForeColor = row.HasBackup ? Theme.Current.Text : Theme.Current.TextMuted,
+                ForeColor = row.HasBackup || row.CouldNotBeRead ? Theme.Current.Text : Theme.Current.TextMuted,
                 Margin = new Padding(0, 0, Ui.SpaceS, 0),
                 Text = caption,
             };
@@ -332,7 +334,7 @@ private Control MakeRow(RestoreContentsRow row)
             FlowLayoutPanel content = CreateVerticalFlow();
             content.Controls.Add(rowTop);
 
-            if (row.HasBackup && !string.IsNullOrWhiteSpace(row.Warning))
+            if ((row.HasBackup || row.CouldNotBeRead) && !string.IsNullOrWhiteSpace(row.Warning))
             {
                 AccentLabel rowWarning = new AccentLabel
                 {
diff --git a/src/WinRestoreKit/WinRestoreKit.csproj b/src/WinRestoreKit/WinRestoreKit.csproj
index 2321e8f..09d18c7 100644
--- a/src/WinRestoreKit/WinRestoreKit.csproj
+++ b/src/WinRestoreKit/WinRestoreKit.csproj
@@ -46,6 +46,7 @@
 
   <ItemGroup>
     <ProjectReference Include="..\WinRestoreKit.Core\WinRestoreKit.Core.csproj" />
+    <ProjectReference Include="..\WinRestoreKit.Application\WinRestoreKit.Application.csproj" />
   </ItemGroup>
 
 </Project>

From d9cbcac3d7743c3d3b951fb034647e99b5a37a1f Mon Sep 17 00:00:00 2001
From: nicolasestrem <103498114+nicolasestrem@users.noreply.github.com>
Date: Sun, 9 Aug 2026 21:38:30 +0200
Subject: [PATCH 3/4] =?UTF-8?q?Create=20WinRestoreKit=20=E2=80=94=20Your?=
 =?UTF-8?q?=20Windows=20setup,=20saved=20locally.html?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...24 Your Windows setup, saved locally.html" | 568 ++++++++++++++++++
 1 file changed, 568 insertions(+)
 create mode 100644 "WinRestoreKit \342\200\224 Your Windows setup, saved locally.html"

diff --git "a/WinRestoreKit \342\200\224 Your Windows setup, saved locally.html" "b/WinRestoreKit \342\200\224 Your Windows setup, saved locally.html"
new file mode 100644
index 0000000..1b79f0d
--- /dev/null
+++ "b/WinRestoreKit \342\200\224 Your Windows setup, saved locally.html"	
@@ -0,0 +1,568 @@
+<!DOCTYPE html>
+<!-- saved from url=(0089)file:///C:/Users/nicol/Documents/GitHub/WinRestoreKit/assets/WinRestoreKit-one-pager.html -->
+<html lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+  
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>WinRestoreKit — Your Windows setup, saved locally</title>
+  <style>
+    :root {
+      --ink: #0b1524;
+      --paper: #f7f9fc;
+      --surface: #ffffff;
+      --blue: #3569d8;
+      --blue-dark: #1f4fae;
+      --slate: #64748a;
+      --line: #d8e0ea;
+      --soft-blue: #eaf0ff;
+      --coral: #d95e55;
+      --soft-coral: #fff0ee;
+      --green: #157a62;
+    }
+
+    * { box-sizing: border-box; }
+
+    html, body {
+      margin: 0;
+      min-height: 100%;
+      background: #dfe5ed;
+      color: var(--ink);
+      font-family: "Segoe UI Variable Text", "Segoe UI", Arial, sans-serif;
+      -webkit-font-smoothing: antialiased;
+    }
+
+    body {
+      display: grid;
+      place-items: center;
+      padding: 24px;
+    }
+
+    .sheet {
+      position: relative;
+      width: 210mm;
+      height: 297mm;
+      overflow: hidden;
+      background: var(--paper);
+      box-shadow: 0 18px 60px rgba(11, 21, 36, 0.18);
+      display: grid;
+      grid-template-rows: auto auto auto 1fr auto;
+      gap: 0;
+      padding: 13mm 14mm 10mm;
+    }
+
+    .sheet::before {
+      content: "";
+      position: absolute;
+      inset: 0 auto 0 0;
+      width: 3mm;
+      background: var(--blue);
+    }
+
+    .topbar {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      padding-bottom: 7mm;
+      border-bottom: 1px solid var(--line);
+    }
+
+    .brand {
+      display: flex;
+      align-items: center;
+      gap: 10px;
+      font-family: "Segoe UI Variable Display", "Segoe UI", sans-serif;
+      font-size: 18px;
+      font-weight: 720;
+      letter-spacing: -0.02em;
+    }
+
+    .mark {
+      width: 28px;
+      height: 28px;
+      display: grid;
+      place-items: center;
+      border-radius: 7px;
+      background: var(--ink);
+      color: #fff;
+    }
+
+    .meta {
+      display: flex;
+      gap: 14px;
+      color: var(--slate);
+      font: 650 9px/1.2 "Cascadia Mono", "Consolas", monospace;
+      letter-spacing: 0.07em;
+      text-transform: uppercase;
+    }
+
+    .hero {
+      display: grid;
+      grid-template-columns: 1.55fr 0.75fr;
+      gap: 11mm;
+      align-items: end;
+      padding: 11mm 0 8mm;
+    }
+
+    .eyebrow {
+      margin: 0 0 3mm;
+      color: var(--blue-dark);
+      font: 700 10px/1.2 "Cascadia Mono", "Consolas", monospace;
+      letter-spacing: 0.12em;
+      text-transform: uppercase;
+    }
+
+    h1 {
+      margin: 0;
+      max-width: 125mm;
+      font-family: "Segoe UI Variable Display", "Segoe UI", sans-serif;
+      font-size: 38px;
+      line-height: 0.99;
+      letter-spacing: -0.045em;
+      font-weight: 760;
+    }
+
+    .hero-copy {
+      margin: 5mm 0 0;
+      max-width: 122mm;
+      color: #39485d;
+      font-size: 15px;
+      line-height: 1.48;
+    }
+
+    .hero-copy strong { color: var(--ink); }
+
+    .local-seal {
+      align-self: stretch;
+      border: 1px solid var(--line);
+      border-radius: 12px;
+      background: var(--surface);
+      padding: 5mm;
+      display: flex;
+      flex-direction: column;
+      justify-content: space-between;
+    }
+
+    .local-seal svg {
+      width: 34px;
+      height: 34px;
+      color: var(--blue);
+    }
+
+    .seal-kicker {
+      margin-top: 8mm;
+      color: var(--green);
+      font: 700 9px/1.2 "Cascadia Mono", "Consolas", monospace;
+      letter-spacing: 0.09em;
+      text-transform: uppercase;
+    }
+
+    .seal-title {
+      margin: 1.5mm 0 0;
+      font-size: 20px;
+      line-height: 1.05;
+      font-weight: 740;
+      letter-spacing: -0.03em;
+    }
+
+    .seal-copy {
+      margin: 2.5mm 0 0;
+      color: var(--slate);
+      font-size: 10.5px;
+      line-height: 1.45;
+    }
+
+    .rail {
+      position: relative;
+      margin: 0 -3mm;
+      padding: 7mm 6mm 6mm;
+      background: var(--ink);
+      color: #fff;
+      border-radius: 14px;
+      overflow: hidden;
+    }
+
+    .rail-head {
+      display: flex;
+      align-items: baseline;
+      justify-content: space-between;
+      gap: 20px;
+      margin-bottom: 6mm;
+    }
+
+    .rail-head h2 {
+      margin: 0;
+      font-size: 18px;
+      line-height: 1.1;
+      letter-spacing: -0.025em;
+    }
+
+    .folder-name {
+      color: #aebdd1;
+      font: 600 8.5px/1.2 "Cascadia Mono", "Consolas", monospace;
+    }
+
+    .timeline {
+      position: relative;
+      display: grid;
+      grid-template-columns: repeat(4, 1fr);
+      gap: 5mm;
+    }
+
+    .timeline::before {
+      content: "";
+      position: absolute;
+      top: 7px;
+      left: 7px;
+      right: 7px;
+      height: 2px;
+      background: #40516a;
+    }
+
+    .step { position: relative; z-index: 1; }
+
+    .dot {
+      width: 16px;
+      height: 16px;
+      border: 4px solid var(--ink);
+      outline: 2px solid #6880a0;
+      border-radius: 50%;
+      background: #8da0b8;
+      margin-bottom: 3mm;
+    }
+
+    .step:nth-child(2) .dot,
+    .step:nth-child(3) .dot { background: #7aa0ff; outline-color: #7aa0ff; }
+    .step:nth-child(4) .dot { background: #5ad0ad; outline-color: #5ad0ad; }
+
+    .step b {
+      display: block;
+      font-size: 11px;
+      line-height: 1.2;
+    }
+
+    .step span {
+      display: block;
+      margin-top: 1.5mm;
+      color: #aebdd1;
+      font-size: 9px;
+      line-height: 1.35;
+    }
+
+    .body-grid {
+      min-height: 0;
+      display: grid;
+      grid-template-columns: 1.05fr 0.95fr;
+      gap: 10mm;
+      padding-top: 8mm;
+    }
+
+    h3 {
+      margin: 0 0 4mm;
+      font-size: 15px;
+      line-height: 1.2;
+      letter-spacing: -0.02em;
+    }
+
+    .feature-list {
+      display: grid;
+      gap: 4mm;
+    }
+
+    .feature {
+      display: grid;
+      grid-template-columns: 25px 1fr;
+      gap: 3mm;
+      align-items: start;
+    }
+
+    .feature-icon {
+      width: 25px;
+      height: 25px;
+      display: grid;
+      place-items: center;
+      border-radius: 7px;
+      background: var(--soft-blue);
+      color: var(--blue-dark);
+      font: 750 10px/1 "Cascadia Mono", "Consolas", monospace;
+    }
+
+    .feature b {
+      display: block;
+      font-size: 11px;
+      line-height: 1.25;
+    }
+
+    .feature p {
+      margin: 1mm 0 0;
+      color: var(--slate);
+      font-size: 9.5px;
+      line-height: 1.42;
+    }
+
+    .coverage {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 2mm;
+      margin-top: 5mm;
+    }
+
+    .coverage span {
+      padding: 1.5mm 2.5mm;
+      border: 1px solid var(--line);
+      border-radius: 999px;
+      background: var(--surface);
+      color: #3f5066;
+      font-size: 8.5px;
+      line-height: 1;
+    }
+
+    .truth-box {
+      border-top: 3px solid var(--coral);
+      border-radius: 9px;
+      background: var(--soft-coral);
+      padding: 5mm;
+    }
+
+    .truth-label {
+      color: var(--coral);
+      font: 700 8.5px/1.2 "Cascadia Mono", "Consolas", monospace;
+      letter-spacing: 0.1em;
+      text-transform: uppercase;
+    }
+
+    .truth-box h3 { margin: 2mm 0 2.5mm; }
+
+    .truth-box p {
+      margin: 0;
+      color: #60413e;
+      font-size: 9.5px;
+      line-height: 1.48;
+    }
+
+    .proofs {
+      display: grid;
+      grid-template-columns: 1fr 1fr;
+      gap: 2.5mm;
+      margin-top: 4mm;
+    }
+
+    .proof {
+      padding: 3mm;
+      border: 1px solid var(--line);
+      border-radius: 8px;
+      background: var(--surface);
+    }
+
+    .proof strong {
+      display: block;
+      color: var(--blue-dark);
+      font: 750 12px/1.1 "Segoe UI Variable Display", "Segoe UI", sans-serif;
+    }
+
+    .proof span {
+      display: block;
+      margin-top: 1mm;
+      color: var(--slate);
+      font-size: 8.5px;
+      line-height: 1.25;
+    }
+
+    .cta {
+      display: grid;
+      grid-template-columns: 1fr auto;
+      gap: 8mm;
+      align-items: center;
+      margin-top: 7mm;
+      padding-top: 5mm;
+      border-top: 1px solid var(--line);
+    }
+
+    .cta h2 {
+      margin: 0;
+      font-size: 18px;
+      line-height: 1.1;
+      letter-spacing: -0.025em;
+    }
+
+    .cta p {
+      margin: 1.5mm 0 0;
+      color: var(--slate);
+      font-size: 9px;
+      line-height: 1.35;
+    }
+
+    .download {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      padding: 3.6mm 5mm;
+      border-radius: 8px;
+      background: var(--blue);
+      color: #fff;
+      text-decoration: none;
+      font-size: 10px;
+      font-weight: 720;
+      white-space: nowrap;
+    }
+
+    .fine-print {
+      grid-column: 1 / -1;
+      margin-top: 1mm;
+      color: #7a8798;
+      font-size: 7.6px;
+      line-height: 1.35;
+    }
+
+    a:focus-visible {
+      outline: 3px solid var(--coral);
+      outline-offset: 3px;
+    }
+
+    @media (max-width: 900px) {
+      body { padding: 0; background: var(--paper); }
+      .sheet {
+        width: 100%;
+        height: auto;
+        min-height: 100vh;
+        padding: 32px 28px;
+        box-shadow: none;
+      }
+      .hero, .body-grid { grid-template-columns: 1fr; }
+      .local-seal { min-height: 180px; }
+      .timeline { grid-template-columns: 1fr 1fr; row-gap: 22px; }
+      .timeline::before { display: none; }
+      .meta { display: none; }
+      .cta { grid-template-columns: 1fr; }
+      .download { justify-self: start; }
+    }
+
+    @media (prefers-reduced-motion: no-preference) {
+      .download { transition: background-color 140ms ease, transform 140ms ease; }
+      .download:hover { background: var(--blue-dark); transform: translateY(-1px); }
+    }
+
+    @page { size: A4; margin: 0; }
+
+    @media print {
+      html, body { width: 210mm; height: 297mm; background: #fff; }
+      body { padding: 0; display: block; }
+      .sheet { box-shadow: none; }
+      .download { print-color-adjust: exact; -webkit-print-color-adjust: exact; }
+      * { print-color-adjust: exact; -webkit-print-color-adjust: exact; }
+    }
+  </style>
+</head>
+<body>
+  <main class="sheet" aria-labelledby="headline">
+    <header class="topbar">
+      <div class="brand">
+        <span class="mark" aria-hidden="true">
+          <svg viewBox="0 0 24 24" width="18" height="18" fill="none" stroke="currentColor" stroke-width="1.8">
+            <path d="M5 8.5 12 4l7 4.5v7L12 20l-7-4.5z"></path>
+            <path d="M8.5 12.4 11 15l4.8-5"></path>
+          </svg>
+        </span>
+        WinRestoreKit
+      </div>
+      <div class="meta" aria-label="Product facts">
+        <span>Windows 11 x64</span>
+        <span>Open source</span>
+        <span>MIT licence</span>
+      </div>
+    </header>
+
+    <section class="hero">
+      <div>
+        <p class="eyebrow">Back up the details that make Windows yours</p>
+        <h1 id="headline">Your Windows setup, saved locally.</h1>
+        <p class="hero-copy">
+          WinRestoreKit backs up the settings that make a PC feel familiar—then helps restore
+          <strong>only the modules you choose.</strong> No cloud account. No telemetry. No .NET install.
+        </p>
+      </div>
+
+      <aside class="local-seal" aria-label="Local by design">
+        <svg viewBox="0 0 32 32" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true">
+          <path d="M8 14v-3a8 8 0 0 1 16 0v3"></path>
+          <rect x="5" y="14" width="22" height="14" rx="4"></rect>
+          <circle cx="16" cy="21" r="2"></circle>
+          <path d="M16 23v2"></path>
+        </svg>
+        <div>
+          <div class="seal-kicker">Local by design</div>
+          <div class="seal-title">Your files stay with you.</div>
+          <p class="seal-copy">Each timestamped local backup includes a machine-readable manifest and log, plus copied files and registry exports in a folder or compressed payload.</p>
+        </div>
+      </aside>
+    </section>
+
+    <section class="rail" aria-labelledby="rail-title">
+      <div class="rail-head">
+        <h2 id="rail-title">A restore path you can understand</h2>
+        <span class="folder-name">backup_2026-08-09_1430</span>
+      </div>
+      <div class="timeline">
+        <div class="step"><div class="dot"></div><b>Choose</b><span>Pick a preset or select individual modules.</span></div>
+        <div class="step"><div class="dot"></div><b>Capture</b><span>Create a lightweight, timestamped local backup.</span></div>
+        <div class="step"><div class="dot"></div><b>Review</b><span>See what restore will overwrite before you consent.</span></div>
+        <div class="step"><div class="dot"></div><b>Restore</b><span>Protect the current state with a pre-restore snapshot.</span></div>
+      </div>
+    </section>
+
+    <section class="body-grid">
+      <div>
+        <h3>Back up more than a wallpaper</h3>
+        <div class="feature-list">
+          <div class="feature">
+            <div class="feature-icon">01</div>
+            <div><b>Windows personality</b><p>Taskbar, themes, visual effects, regional preferences, accessibility settings, and more.</p></div>
+          </div>
+          <div class="feature">
+            <div class="feature-icon">02</div>
+            <div><b>Devices and connections</b><p>Printers, mouse and keyboard settings, Wi-Fi credentials, mapped drives, and network configuration.</p></div>
+          </div>
+          <div class="feature">
+            <div class="feature-icon">03</div>
+            <div><b>Apps and developer tools</b><p>Selected app settings, terminal and VS Code data, SSH configuration, hosts file, and a winget package list.</p></div>
+          </div>
+          <div class="feature">
+            <div class="feature-icon">04</div>
+            <div><b>Evidence with every run</b><p>Human-readable logs plus <code>backup_manifest.json</code> record what succeeded, skipped, or failed.</p></div>
+          </div>
+        </div>
+        <div class="coverage" aria-label="Feature highlights">
+          <span>Selective modules</span><span>Presets</span><span>History timeline</span>
+          <span>Power plans</span><span>Local folders</span><span>Single executable</span>
+        </div>
+      </div>
+
+      <div>
+        <div class="truth-box">
+          <div class="truth-label">Safety without spin</div>
+          <h3>Know what restore can—and cannot—undo.</h3>
+          <p>Before changes begin, WinRestoreKit states what will be overwritten, asks for consent, and creates a pre-restore snapshot. Registry imports and folder copies are additive, so the app says plainly when restoring a snapshot cannot remove newly added values or files.</p>
+        </div>
+        <div class="proofs" aria-label="Product proof points">
+          <div class="proof"><strong>Backups stay local</strong><span>No cloud account or telemetry</span></div>
+          <div class="proof"><strong>1 executable</strong><span>Self-contained Windows download</span></div>
+          <div class="proof"><strong>Pick the scope</strong><span>Preset or module-by-module</span></div>
+          <div class="proof"><strong>Undo point</strong><span>Automatic snapshot before restore</span></div>
+        </div>
+      </div>
+    </section>
+
+    <footer class="cta">
+      <div>
+        <h2>Keep your Windows setup in your hands.</h2>
+        <p>Download the latest release or inspect the source on GitHub.</p>
+      </div>
+      <a class="download" href="https://github.com/nicolasestrem/WinRestoreKit/releases/latest">
+        Download WinRestoreKit.exe <span aria-hidden="true">→</span>
+      </a>
+      <div class="fine-print">
+        Requires Windows 11 x64 and administrator privileges. Windows 10 may work but is untested. The current binary is not code-signed, so SmartScreen may show a first-run warning. Source and licence: github.com/nicolasestrem/WinRestoreKit
+      </div>
+    </footer>
+  </main>
+
+
+</body></html>
\ No newline at end of file

From ef1b4f60c11eaedcd3794cd01390b4c66c0fcf21 Mon Sep 17 00:00:00 2001
From: nicolasestrem <103498114+nicolasestrem@users.noreply.github.com>
Date: Sun, 9 Aug 2026 21:47:43 +0200
Subject: [PATCH 4/4] fix(review): address PR #7 review feedback

Codex P1:
- WpfThemeService: marshal system-theme reapply onto the application
  dispatcher (SystemEvents fires off the UI thread; resource-dictionary
  swaps there can terminate the process). Mirrors the WinForms handler.
- BackupFolders: a bad default root no longer aborts the whole multi-root
  scan; custom/external roots are still enumerated so their backups remain
  restorable. The reason surfaces only when no root was readable.

Tests (Claude):
- Restore AppStoreApps.Verify ladder coverage (bad exit code, no file,
  empty file, no Packages array, invalid JSON) and the good-export path.
- Restore Failed-not-Skipped coverage for Restore (no dialog registered,
  null owner).

OpenCode:
- Declare Newtonsoft.Json explicitly in WinRestoreKit.Application
  (AppRestoreService uses it directly; was arriving only transitively).
- Timeline/AdvancedHistory ViewModels now inherit ObservableObject like
  every other ViewModel (made internal sealed to match the siblings and
  satisfy base-class accessibility).

986 passed, 0 failed, 0 skipped; Release build 0 warnings, 0 errors.
---
 CLAUDE.md                                     |  2 +-
 .../Snapshots/BackupFolders.cs                | 20 ++--
 .../WinRestoreKit.Application.csproj          |  4 +
 .../AppRestoreDialogTests.cs                  | 94 +++++++++++++++++++
 .../BackupFoldersReadTests.cs                 | 33 +++++++
 src/WinRestoreKit.Tests/ThemeServiceTests.cs  | 41 ++++++++
 .../Services/WpfThemeService.cs               | 25 ++++-
 .../History/AdvancedHistoryViewModel.cs       | 25 +----
 .../ViewModels/Timeline/TimelineViewModel.cs  | 18 +---
 9 files changed, 212 insertions(+), 50 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 815211b..6cfcbc7 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -38,7 +38,7 @@ Output lands in `src\WinRestoreKit\bin\<Configuration>\net8.0-windows\`. This de
 
 Releases are different: they ship **self-contained single-file**, so end users install nothing. The `/release` skill has the exact publish command and the flags it depends on - all of them matter, and the artifact must come out as exactly one ~69 MB `WinRestoreKit.exe`. Never ship the framework-dependent `bin\Release\` exe; on its own it cannot start. Do not add `PublishTrimmed` - WinForms resolves types by reflection and is not trim-safe.
 
-The only runtime NuGet dependency is Newtonsoft.Json, declared as a `<PackageReference>` in both the app and Core projects at the same version (`packages.config` is gone). Tests are xUnit, in `src/WinRestoreKit.Tests`. There is no linter.
+The only runtime NuGet dependency is Newtonsoft.Json, declared as a `<PackageReference>` in the app, Application, and Core projects at the same version (`packages.config` is gone). Tests are xUnit, in `src/WinRestoreKit.Tests`. There is no linter.
 
 `src/WinRestoreKit/Properties/AssemblyInfo.cs` is hand-maintained and the **app** `WinRestoreKit.csproj` sets `<GenerateAssemblyInfo>false</GenerateAssemblyInfo>` - this is load-bearing for the update checker (see "Data flow and paths"). It must not move to Core: the file must stay at its exact path with its exact line format because it is the update checker's raw fallback source. `WinRestoreKit.Core.csproj` leaves `GenerateAssemblyInfo` at its default on purpose, since no client fetches anything from it and the generated `SupportedOSPlatform` attribute is what keeps CA1416 honest there. Never set `Version`/`AssemblyVersion`/`FileVersion`/`InformationalVersion` in the csproj, and never add an `AssemblyInformationalVersion` attribute; both would create a second, silently diverging version source. The csproj carries comments explaining this and…
 
diff --git a/src/WinRestoreKit.Application/Snapshots/BackupFolders.cs b/src/WinRestoreKit.Application/Snapshots/BackupFolders.cs
index 820fe5d..38ad363 100644
--- a/src/WinRestoreKit.Application/Snapshots/BackupFolders.cs
+++ b/src/WinRestoreKit.Application/Snapshots/BackupFolders.cs
@@ -52,7 +52,7 @@ internal static BackupFolders Read()
             }
 
             int inspectedRoots = 0;
-            string unreadableCustomRootReason = null;
+            string unreadableReason = null;
 
             for (int rootIndex = 0; rootIndex < roots.Count; rootIndex++)
             {
@@ -75,14 +75,13 @@ internal static BackupFolders Read()
                 }
                 catch (Exception ex)
                 {
+                    // Record the failure and keep scanning. A bad default root must not abort the
+                    // whole scan: backups living on a remembered custom or external root would
+                    // vanish from Timeline and become unrestorable. The reason is surfaced only when
+                    // NO root was readable; otherwise the readable roots' backups are listed and this
+                    // failure is retained in UnreadableRoots for diagnostics.
                     unreadableRoots.Add(new UnreadableBackupRoot(CanonicalizeRoot(root), ex.Message));
-
-                    if (isDefaultRoot)
-                    {
-                        return new BackupFolders(backups, snapshots, ex.Message, unreadableRoots);
-                    }
-
-                    unreadableCustomRootReason ??= ex.Message;
+                    unreadableReason ??= ex.Message;
                     continue;
                 }
 
@@ -105,9 +104,8 @@ internal static BackupFolders Read()
                 }
             }
 
-            if (inspectedRoots == 0 && unreadableCustomRootReason != null)
-                return new BackupFolders(backups, snapshots, unreadableCustomRootReason, unreadableRoots);
-
+            if (inspectedRoots == 0 && unreadableReason != null)
+                return new BackupFolders(backups, snapshots, unreadableReason, unreadableRoots);
             backups.Sort(NewestFirst);
             snapshots.Sort(NewestFirst);
 
diff --git a/src/WinRestoreKit.Application/WinRestoreKit.Application.csproj b/src/WinRestoreKit.Application/WinRestoreKit.Application.csproj
index 126728c..9540c83 100644
--- a/src/WinRestoreKit.Application/WinRestoreKit.Application.csproj
+++ b/src/WinRestoreKit.Application/WinRestoreKit.Application.csproj
@@ -11,4 +11,8 @@
   <ItemGroup>
     <ProjectReference Include="..\WinRestoreKit.Core\WinRestoreKit.Core.csproj" />
   </ItemGroup>
+  <ItemGroup>
+    <!-- Same version as Core. AppRestoreService parses winget export JSON directly. -->
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+  </ItemGroup>
 </Project>
diff --git a/src/WinRestoreKit.Tests/AppRestoreDialogTests.cs b/src/WinRestoreKit.Tests/AppRestoreDialogTests.cs
index d1df104..7afbd57 100644
--- a/src/WinRestoreKit.Tests/AppRestoreDialogTests.cs
+++ b/src/WinRestoreKit.Tests/AppRestoreDialogTests.cs
@@ -166,5 +166,99 @@ public void RestoreDialogCoreSeamRemainsInteractive()
                 Directory.Delete(root, true);
             }
         }
+
+        [Fact]
+        public void Verify_NamesEveryWayTheExportCanFail()
+        {
+            string root = NewTempDir();
+            try
+            {
+                string path = AppStoreApps.ExportPathIn(root);
+
+                // An exit code is not evidence: every rung of the ladder is checked against the
+                // artifact, not the exit code, and the exit code is not the only thing checked.
+                AssertFailedReason(AppStoreApps.Verify(ProcessOutcome.NeverStarted("no winget"), path), "could not run");
+                AssertFailedReason(AppStoreApps.Verify(ProcessOutcome.Timeout(), path), "did not finish");
+                AssertFailedReason(AppStoreApps.Verify(ProcessOutcome.OutcomeUnknown("pipe closed"), path), "could not be determined");
+                AssertFailedReason(AppStoreApps.Verify(ProcessOutcome.Ran(1), path), "exited with code 1");
+
+                // Exit code 0 with nothing to show for it.
+                AssertFailedReason(AppStoreApps.Verify(ProcessOutcome.Ran(0), path), "wrote no file");
+
+                File.WriteAllText(path, "");
+                AssertFailedReason(AppStoreApps.Verify(ProcessOutcome.Ran(0), path), "empty file");
+
+                File.WriteAllText(path, "{\"Sources\":[{}]}");
+                AssertFailedReason(AppStoreApps.Verify(ProcessOutcome.Ran(0), path), "no list of packages");
+
+                File.WriteAllText(path, "not json");
+                AssertFailedReason(AppStoreApps.Verify(ProcessOutcome.Ran(0), path), "not valid JSON");
+            }
+            finally { Directory.Delete(root, true); }
+        }
+
+        [Fact]
+        public void Verify_AGoodExport_Succeeds()
+        {
+            string root = NewTempDir();
+            try
+            {
+                string path = AppStoreApps.ExportPathIn(root);
+                File.WriteAllText(path, ExportWith("A.One", "B.Two"));
+
+                StepResult result = AppStoreApps.Verify(ProcessOutcome.Ran(0), path);
+                Assert.Equal(ResultState.Succeeded, result.State);
+                Assert.Contains("exported 2", result.Reason);
+            }
+            finally { Directory.Delete(root, true); }
+        }
+
+        [Fact]
+        public void Restore_WithNoDialogRegistered_FailsRatherThanClaimingSkipped()
+        {
+            Action<string, object> previous = AppStoreApps.RestoreDialog;
+            string root = NewTempDir();
+            try
+            {
+                AppStoreApps.RestoreDialog = null;
+
+                ModuleResult result = new AppStoreApps().Restore(root);
+                Assert.Equal(ResultState.Failed, result.State);
+                Assert.Contains("not available", result.Reason);
+            }
+            finally
+            {
+                AppStoreApps.RestoreDialog = previous;
+                Directory.Delete(root, true);
+            }
+        }
+
+        [Fact]
+        public void Restore_WithNullOwner_FailsRatherThanClaimingSkipped()
+        {
+            Action<string, object> previous = AppStoreApps.RestoreDialog;
+            string root = NewTempDir();
+            try
+            {
+                bool dialogWasInvoked = false;
+                AppStoreApps.RestoreDialog = (path, owner) => dialogWasInvoked = true;
+
+                ModuleResult result = new AppStoreApps().Restore(root, null);
+                Assert.Equal(ResultState.Failed, result.State);
+                Assert.Contains("owning application window", result.Reason);
+                Assert.False(dialogWasInvoked);
+            }
+            finally
+            {
+                AppStoreApps.RestoreDialog = previous;
+                Directory.Delete(root, true);
+            }
+        }
+
+        private static void AssertFailedReason(StepResult result, string reasonFragment)
+        {
+            Assert.Equal(ResultState.Failed, result.State);
+            Assert.Contains(reasonFragment, result.Reason);
+        }
     }
 }
diff --git a/src/WinRestoreKit.Tests/BackupFoldersReadTests.cs b/src/WinRestoreKit.Tests/BackupFoldersReadTests.cs
index 5bcfd38..228ea71 100644
--- a/src/WinRestoreKit.Tests/BackupFoldersReadTests.cs
+++ b/src/WinRestoreKit.Tests/BackupFoldersReadTests.cs
@@ -35,6 +35,39 @@ public void Read_UnreadableCustomRootKeepsReadableDefaultRoot()
             }
         }
 
+        [Fact]
+        public void Read_UnreadableDefaultRootKeepsReadableCustomRoot()
+        {
+            string parent = NewTempDirectory();
+            string unreadableDefaultRoot = Path.Combine(parent, "default-root-file");
+            string customRoot = Directory.CreateDirectory(Path.Combine(parent, "custom")).FullName;
+            string backup = Directory.CreateDirectory(
+                Path.Combine(customRoot, "2024-01-02 - 03.04 (3)")).FullName;
+            File.WriteAllText(unreadableDefaultRoot, "not a directory");
+
+            try
+            {
+                RunWithConfiguredRoots(unreadableDefaultRoot, new[] { customRoot }, () =>
+                {
+                    BackupFolders folders = BackupFolders.Read();
+
+                    // The unreadable default root must not abort the scan: the custom root's backup
+                    // is still listed, the failure is retained for diagnostics, and no reason is
+                    // surfaced because at least one root was readable.
+                    Assert.Null(folders.UnreadableReason);
+                    Assert.Contains(folders.Backups, folder =>
+                        string.Equals(folder.Path, backup, StringComparison.OrdinalIgnoreCase));
+                    UnreadableBackupRoot failed = Assert.Single(folders.UnreadableRoots);
+                    Assert.EndsWith("default-root-file", failed.CanonicalPath,
+                        StringComparison.OrdinalIgnoreCase);
+                });
+            }
+            finally
+            {
+                Directory.Delete(parent, true);
+            }
+        }
+
         [Fact]
         public void Read_UnreadableDefaultRootReportsActualReason()
         {
diff --git a/src/WinRestoreKit.Tests/ThemeServiceTests.cs b/src/WinRestoreKit.Tests/ThemeServiceTests.cs
index 65ee88d..8d0bdb0 100644
--- a/src/WinRestoreKit.Tests/ThemeServiceTests.cs
+++ b/src/WinRestoreKit.Tests/ThemeServiceTests.cs
@@ -1,5 +1,8 @@
 using System;
+using System.Threading.Tasks;
 using System.Windows;
+using System.Windows.Threading;
+using Microsoft.Win32;
 using WinRestoreKit;
 using WinRestoreKit.Wpf.Services;
 using Xunit;
@@ -26,6 +29,35 @@ public void WpfThemeService_UsesSystemDarkOnlyWhenModeFollowsSystem()
             });
         }
 
+        [Fact]
+        public void WpfThemeService_SystemThemeChangeIsReappliedOnDispatcher()
+        {
+            WpfTestHost.Run(() =>
+            {
+                Dispatcher dispatcher = Dispatcher.CurrentDispatcher;
+                ResourceDictionary resources = new ResourceDictionary();
+                FakeThemeSettings settings = new FakeThemeSettings(ThemeMode.FollowSystem);
+                MutableSystemThemeDetector detector = new MutableSystemThemeDetector(isDark: false);
+
+                using (WpfThemeService service = new WpfThemeService(resources, settings, detector, dispatcher))
+                {
+                    Assert.Equal(ThemeMode.Light, service.EffectiveMode);
+
+                    detector.IsDark = true;
+
+                    // SystemEvents raises on its own thread; fire the handler off the dispatcher, then
+                    // push a frame so the marshaled reapply runs on the UI thread before we assert.
+                    Task.Run(() => service.SystemEvents_UserPreferenceChanged(null,
+                        new UserPreferenceChangedEventArgs(UserPreferenceCategory.General))).Wait();
+                    DispatcherFrame frame = new DispatcherFrame();
+                    dispatcher.BeginInvoke(DispatcherPriority.Background, new Action(() => frame.Continue = false));
+                    Dispatcher.PushFrame(frame);
+
+                    Assert.Equal(ThemeMode.Dark, service.EffectiveMode);
+                }
+            });
+        }
+
         private sealed class FakeThemeSettings : IThemeSettings
         {
             private ThemeMode mode;
@@ -45,5 +77,14 @@ private sealed class FakeSystemThemeDetector : ISystemThemeDetector
 
             public bool IsDarkAppsTheme() => isDark;
         }
+
+        private sealed class MutableSystemThemeDetector : ISystemThemeDetector
+        {
+            internal bool IsDark { get; set; }
+
+            internal MutableSystemThemeDetector(bool isDark) => IsDark = isDark;
+
+            public bool IsDarkAppsTheme() => IsDark;
+        }
     }
 }
diff --git a/src/WinRestoreKit.Wpf/Services/WpfThemeService.cs b/src/WinRestoreKit.Wpf/Services/WpfThemeService.cs
index 6ce422a..c8ad5fd 100644
--- a/src/WinRestoreKit.Wpf/Services/WpfThemeService.cs
+++ b/src/WinRestoreKit.Wpf/Services/WpfThemeService.cs
@@ -1,5 +1,6 @@
 using System;
 using System.Windows;
+using System.Windows.Threading;
 using Microsoft.Win32;
 using WinRestoreKit;
 
@@ -10,15 +11,23 @@ internal sealed class WpfThemeService : IThemeService
         private readonly ResourceDictionary resources;
         private readonly IThemeSettings settings;
         private readonly ISystemThemeDetector systemTheme;
+        private readonly Dispatcher uiDispatcher;
         private ResourceDictionary activeThemeDictionary;
         private bool disposed;
 
         internal WpfThemeService(ResourceDictionary resources, IThemeSettings settings,
                                  ISystemThemeDetector systemTheme)
+            : this(resources, settings, systemTheme, Application.Current?.Dispatcher)
+        {
+        }
+
+        internal WpfThemeService(ResourceDictionary resources, IThemeSettings settings,
+                                 ISystemThemeDetector systemTheme, Dispatcher uiDispatcher)
         {
             this.resources = resources ?? throw new ArgumentNullException(nameof(resources));
             this.settings = settings ?? throw new ArgumentNullException(nameof(settings));
             this.systemTheme = systemTheme ?? throw new ArgumentNullException(nameof(systemTheme));
+            this.uiDispatcher = uiDispatcher;
 
             Mode = settings.ReadThemeMode();
             SystemEvents.UserPreferenceChanged += SystemEvents_UserPreferenceChanged;
@@ -47,10 +56,20 @@ public void Dispose()
             disposed = true;
         }
 
-        private void SystemEvents_UserPreferenceChanged(object sender, UserPreferenceChangedEventArgs e)
+        // SystemEvents raises UserPreferenceChanged on its own thread, not the UI dispatcher. WPF
+        // resource dictionaries belong to the UI thread, so applying a theme there is a cross-thread
+        // access that can terminate the process. Marshal the reapply onto the application dispatcher,
+        // mirroring the WinForms handler's BeginInvoke.
+        internal void SystemEvents_UserPreferenceChanged(object sender, UserPreferenceChangedEventArgs e)
         {
-            if (Mode == ThemeMode.FollowSystem)
-                ApplyEffectiveMode();
+            if (Mode != ThemeMode.FollowSystem)
+                return;
+
+            Dispatcher dispatcher = uiDispatcher;
+            if (dispatcher == null)
+                return;
+
+            dispatcher.BeginInvoke(new Action(ApplyEffectiveMode));
         }
 
         private void ApplyEffectiveMode()
diff --git a/src/WinRestoreKit.Wpf/ViewModels/History/AdvancedHistoryViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/History/AdvancedHistoryViewModel.cs
index 77fba5e..71f1e67 100644
--- a/src/WinRestoreKit.Wpf/ViewModels/History/AdvancedHistoryViewModel.cs
+++ b/src/WinRestoreKit.Wpf/ViewModels/History/AdvancedHistoryViewModel.cs
@@ -6,11 +6,12 @@
 using System.Threading;
 using System.Threading.Tasks;
 using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
 using WinRestoreKit.Wpf.ViewModels.Snapshots;
 
 namespace WinRestoreKit.Wpf.ViewModels.History
 {
-    public sealed class AdvancedHistoryViewModel : INotifyPropertyChanged
+    internal sealed class AdvancedHistoryViewModel : ObservableObject
     {
         private readonly ISnapshotEventReader catalog;
         private readonly ObservableCollection<SnapshotEventViewModel> events;
@@ -32,30 +33,17 @@ public string SearchText
             get => searchText;
             set
             {
-                if (string.Equals(searchText, value, StringComparison.Ordinal))
-                    return;
-
-                searchText = value;
-                Events.Refresh();
-                OnPropertyChanged(nameof(SearchText));
+                if (SetProperty(ref searchText, value, nameof(SearchText)))
+                    Events.Refresh();
             }
         }
 
         public SnapshotEventViewModel SelectedEvent
         {
             get => selectedEvent;
-            set
-            {
-                if (ReferenceEquals(selectedEvent, value))
-                    return;
-
-                selectedEvent = value;
-                OnPropertyChanged(nameof(SelectedEvent));
-            }
+            set => SetProperty(ref selectedEvent, value, nameof(SelectedEvent));
         }
 
-        public event PropertyChangedEventHandler PropertyChanged;
-
         internal Task RefreshAsync(CancellationToken cancellationToken = default)
         {
             cancellationToken.ThrowIfCancellationRequested();
@@ -89,8 +77,5 @@ private bool MatchesSearch(object item)
 
         private static bool Contains(string value, string query)
             => value != null && value.IndexOf(query, StringComparison.OrdinalIgnoreCase) >= 0;
-
-        private void OnPropertyChanged(string propertyName)
-            => PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(propertyName));
     }
 }
diff --git a/src/WinRestoreKit.Wpf/ViewModels/Timeline/TimelineViewModel.cs b/src/WinRestoreKit.Wpf/ViewModels/Timeline/TimelineViewModel.cs
index 7bdc7a3..6e2c67c 100644
--- a/src/WinRestoreKit.Wpf/ViewModels/Timeline/TimelineViewModel.cs
+++ b/src/WinRestoreKit.Wpf/ViewModels/Timeline/TimelineViewModel.cs
@@ -1,16 +1,16 @@
 using System;
 using System.Collections.Generic;
 using System.Collections.ObjectModel;
-using System.ComponentModel;
 using System.Threading;
 using System.Threading.Tasks;
 using WinRestoreKit;
+using WinRestoreKit.Wpf.Infrastructure;
 using WinRestoreKit.Wpf.Navigation;
 using WinRestoreKit.Wpf.ViewModels.Snapshots;
 
 namespace WinRestoreKit.Wpf.ViewModels.Timeline
 {
-    public sealed class TimelineViewModel : INotifyPropertyChanged
+    internal sealed class TimelineViewModel : ObservableObject
     {
         private readonly ISnapshotEventReader catalog;
         private readonly ISnapshotPayloadPreparationService preparationService;
@@ -34,22 +34,13 @@ internal TimelineViewModel(ISnapshotEventReader catalog,
         public SnapshotEventViewModel SelectedEvent
         {
             get => selectedEvent;
-            set
-            {
-                if (ReferenceEquals(selectedEvent, value))
-                    return;
-
-                selectedEvent = value;
-                OnPropertyChanged(nameof(SelectedEvent));
-            }
+            set => SetProperty(ref selectedEvent, value, nameof(SelectedEvent));
         }
 
         public string SelectionError => selectionError;
 
         public bool HasSelectionError => !string.IsNullOrWhiteSpace(SelectionError);
 
-        public event PropertyChangedEventHandler PropertyChanged;
-
         internal Task RefreshAsync(CancellationToken cancellationToken = default)
         {
             cancellationToken.ThrowIfCancellationRequested();
@@ -109,8 +100,5 @@ private void SetSelectionError(string value)
             OnPropertyChanged(nameof(SelectionError));
             OnPropertyChanged(nameof(HasSelectionError));
         }
-
-        private void OnPropertyChanged(string propertyName)
-            => PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(propertyName));
     }
 }