diff --git a/Cargo.lock b/Cargo.lock
index 02bb6ca..2b55757 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2581,7 +2581,7 @@ dependencies = [
 
 [[package]]
 name = "rustpad"
-version = "0.2.28"
+version = "0.2.29"
 dependencies = [
  "argon2",
  "aws-config",
diff --git a/Cargo.toml b/Cargo.toml
index 1ad7db3..b608b53 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rustpad"
-version = "0.2.28"
+version = "0.2.29"
 edition = "2024"
 rust-version = "1.94"
 description = "Collaborative Markdown notepad built with Axum, WebSockets and SQLite, PostgreSQL and MySQL"
diff --git a/static/css/styles.css b/static/css/styles.css
index 7825c31..8c70da8 100644
--- a/static/css/styles.css
+++ b/static/css/styles.css
@@ -5104,6 +5104,10 @@ dialog::backdrop {
     padding: 16px;
   }
 
+  .pad-page:not(.hide-preview-line-numbers) .preview {
+    padding-left: 62px;
+  }
+
   .pad-page .editor-footer {
     align-items: center;
     gap: 8px;
diff --git a/static/js/note-editor.js b/static/js/note-editor.js
index d454e59..391a59d 100644
--- a/static/js/note-editor.js
+++ b/static/js/note-editor.js
@@ -1059,10 +1059,15 @@ export function startNoteEditor(adapter) {
     if (!event.matches) setHeaderMenuOpen(false);
   });
   const mobileEditorOptions = document.querySelector("#mobile-editor-options");
+  const markdownMore = document.querySelector(".markdown-more");
+  const mobileToolbarQuery = matchMedia("(max-width: 720px)");
   document.addEventListener("pointerdown", event => {
     if (mobileEditorOptions?.open && !event.target.closest("#mobile-editor-options")) {
       mobileEditorOptions.open = false;
     }
+    if (mobileToolbarQuery.matches && markdownMore?.open && !markdownMore.contains(event.target)) {
+      markdownMore.open = false;
+    }
   }, { passive: true });
   document.addEventListener("keydown", event => {
     if (event.key === "Escape" && mobileEditorOptions?.open) mobileEditorOptions.open = false;
diff --git a/static/js/note-files.js b/static/js/note-files.js
index bee8e26..361e7e0 100644
--- a/static/js/note-files.js
+++ b/static/js/note-files.js
@@ -47,7 +47,7 @@ function safeAttachmentUrl(value) {
     : safePublicUrl(raw, { allowMailto: false });
 }
 
-export function bindNoteFiles({ editor, endpoints, getAccessToken, canDelete, canUpload, toast, onFilesChanged = () => {} }) {
+export function bindNoteFiles({ editor, endpoints, getAccessToken, canDelete, canUpload, toast, onFilesChanged = () => { } }) {
   const dialog = document.querySelector("#files-dialog");
   const list = document.querySelector("#files-list");
   const input = document.querySelector("#file-input");
diff --git a/tests/editor_ui_test.mjs b/tests/editor_ui_test.mjs
deleted file mode 100644
index a21f31e..0000000
--- a/tests/editor_ui_test.mjs
+++ /dev/null
@@ -1,159 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { readFile } from "node:fs/promises";
-
-async function importSource(path) {
-  const source = await readFile(new URL(path, import.meta.url), "utf8");
-  return import(`data:text/javascript;base64,${Buffer.from(source).toString("base64")}`);
-}
-
-class FakeEditor {
-  constructor(value, start = 0, end = start) {
-    this.value = value;
-    this.selectionStart = start;
-    this.selectionEnd = end;
-    this.selectionDirection = "none";
-    this.readOnly = false;
-    this.inputEvents = 0;
-  }
-
-  setRangeText(replacement, start, end, mode) {
-    this.value = `${this.value.slice(0, start)}${replacement}${this.value.slice(end)}`;
-    const caret = mode === "end" ? start + replacement.length : start;
-    this.selectionStart = caret;
-    this.selectionEnd = caret;
-  }
-
-  setSelectionRange(start, end, direction = "none") {
-    this.selectionStart = start;
-    this.selectionEnd = end;
-    this.selectionDirection = direction;
-  }
-
-  dispatchEvent(event) {
-    if (event.type === "input") this.inputEvents += 1;
-    return true;
-  }
-}
-
-const { applyIndentation } = await importSource("../static/js/editor-format.js");
-const markdownSource = await readFile(new URL("../static/js/markdown.js", import.meta.url), "utf8");
-const alignSource = markdownSource.match(/export function alignPreviewLineNumbers\(root\) \{[\s\S]*?\n\}/)?.[0];
-assert.ok(alignSource, "alignPreviewLineNumbers source must exist");
-const alignPreviewLineNumbers = new Function(`${alignSource.replace("export ", "")}; return alignPreviewLineNumbers;`)();
-
-test("Tab inserts two spaces at the caret", () => {
-  const editor = new FakeEditor("abcd", 2);
-  assert.equal(applyIndentation(editor), true);
-  assert.equal(editor.value, "ab  cd");
-  assert.deepEqual([editor.selectionStart, editor.selectionEnd], [4, 4]);
-  assert.equal(editor.inputEvents, 1);
-});
-
-test("Tab indents every selected line", () => {
-  const editor = new FakeEditor("alpha\nbeta\ngamma", 0, 10);
-  assert.equal(applyIndentation(editor), true);
-  assert.equal(editor.value, "  alpha\n  beta\ngamma");
-  assert.deepEqual([editor.selectionStart, editor.selectionEnd], [2, 14]);
-});
-
-test("Shift+Tab removes up to two spaces from selected lines", () => {
-  const editor = new FakeEditor("  alpha\n beta", 2, 13);
-  assert.equal(applyIndentation(editor, { outdent: true }), true);
-  assert.equal(editor.value, "alpha\nbeta");
-  assert.deepEqual([editor.selectionStart, editor.selectionEnd], [0, 10]);
-});
-
-test("Shift+Tab removes a leading tab", () => {
-  const editor = new FakeEditor("\talpha", 4);
-  assert.equal(applyIndentation(editor, { outdent: true }), true);
-  assert.equal(editor.value, "alpha");
-  assert.deepEqual([editor.selectionStart, editor.selectionEnd], [3, 3]);
-});
-
-test("preview line-number alignment ignores horizontal scroll", () => {
-  const previousGetComputedStyle = globalThis.getComputedStyle;
-  globalThis.getComputedStyle = () => ({ paddingLeft: "62px" });
-  let assigned;
-  const line = {
-    getBoundingClientRect: () => ({ left: 70 }),
-    style: { setProperty: (name, value) => { assigned = [name, value]; } },
-  };
-  const root = {
-    scrollLeft: 80,
-    getBoundingClientRect: () => ({ left: 100 }),
-    querySelectorAll: () => [line],
-  };
-  try {
-    alignPreviewLineNumbers(root);
-    assert.deepEqual(assigned, ["--preview-line-left", "-38px"]);
-  } finally {
-    globalThis.getComputedStyle = previousGetComputedStyle;
-  }
-});
-
-test("compact editor layout starts below 1500px", async () => {
-  const css = await readFile(new URL("../static/css/styles.css", import.meta.url), "utf8");
-  const editorSource = await readFile(new URL("../static/js/note-editor.js", import.meta.url), "utf8");
-  assert.equal((css.match(/@media \(max-width: 1499px\)/g) || []).length, 4);
-  assert.doesNotMatch(css, /@media \(max-width: 1920px\)/);
-  assert.match(editorSource, /compactLayoutQuery = window\.matchMedia\("\(max-width: 1499px\)"\)/);
-  assert.match(editorSource, /compactBubbleQuery = matchMedia\("\(max-width: 1499px\)"\)/);
-});
-
-test("read-only mode blocks every document write path", async () => {
-  const editorHtml = await readFile(new URL("../static/editor.html", import.meta.url), "utf8");
-  const editorSource = await readFile(new URL("../static/js/note-editor.js", import.meta.url), "utf8");
-  assert.match(editorHtml, /<textarea id="editor"[\s\S]*?readonly><\/textarea>/);
-  assert.match(editorSource, /function canEditDocument\(\) \{ return !editor\.readOnly; \}/);
-  assert.match(editorSource, /function scheduleDocumentSave\(\) \{[\s\S]*?if \(!canEditDocument\(\)\) \{[\s\S]*?saveState\.textContent = "Read only";[\s\S]*?return;/);
-  assert.match(editorSource, /function activatePreviewEdit\(target, offset = null\) \{\s*if \(!target \|\| !canEditDocument\(\)\) return;/);
-  assert.match(editorSource, /function commitPreviewEdit\(target,[\s\S]*?if \(!canEditDocument\(\)\) \{ render\(\); return; \}/);
-  assert.match(editorSource, /if \(socket && canEditDocument\(\)\) socket\.update/g);
-  assert.match(editorSource, /setDocumentReadOnly\(true, "Read only — changes not saved"\);[\s\S]*?applyRemote\(lastServerContent, lastServerOwnerMap\);[\s\S]*?queueMicrotask\(connect\);/);
-});
-
-test("narrow editor switches stay compact", async () => {
-  const css = await readFile(new URL("../static/css/styles.css", import.meta.url), "utf8");
-  assert.match(css, /\.pad-page #mode-toggle \{[\s\S]*?width:\s*auto;[\s\S]*?min-width:\s*0;[\s\S]*?white-space:\s*nowrap;/);
-  assert.match(css, /@media \(max-width: 760px\) \{[\s\S]*?\.pad-page \.editor-toolbar \{\s*grid-template-columns:\s*minmax\(0, 1fr\) auto;/);
-  assert.match(css, /@media \(max-width: 760px\) \{[\s\S]*?\.pad-page \.view-switch \{[\s\S]*?display:\s*inline-flex;[\s\S]*?width:\s*max-content;[\s\S]*?justify-self:\s*end;/);
-  assert.doesNotMatch(css, /\.pad-page \.view-switch \{\s*position:\s*static;\s*display:\s*grid;\s*width:\s*100%;/);
-});
-
-test("Full HD scaling keeps Preview visible without compacting the whole editor", async () => {
-  const css = await readFile(new URL("../static/css/styles.css", import.meta.url), "utf8");
-  assert.match(css, /@media \(min-width: 1500px\) and \(max-width: 1699px\) \{[\s\S]*?\.pad-page \.toolbar-group \{[\s\S]*?flex:\s*1 1 auto;[\s\S]*?overflow-x:\s*auto;/);
-  assert.match(css, /@media \(min-width: 1500px\) and \(max-width: 1699px\) \{[\s\S]*?\.pad-page \.toolbar-fill \{\s*display:\s*none;/);
-  assert.match(css, /@media \(min-width: 1500px\) and \(max-width: 1699px\) \{[\s\S]*?\.pad-page :is\(\.editor-controls, \.toolbar-action, \.line-toggle, \.view-switch\) \{\s*flex:\s*0 0 auto;/);
-});
-
-test("Markdown/Text uses the same toolbar action styling as More", async () => {
-  const html = await readFile(new URL("../static/editor.html", import.meta.url), "utf8");
-  const css = await readFile(new URL("../static/css/styles.css", import.meta.url), "utf8");
-  const editorSource = await readFile(new URL("../static/js/note-editor.js", import.meta.url), "utf8");
-  assert.match(html, /id="mode-toggle" class="toolbar-action active"/);
-  assert.doesNotMatch(css, /\.markdown-toggle/);
-  assert.match(css, /\.markdown-more>summary,\s*\.pad-page \.toolbar-action \{/);
-  assert.match(editorSource, /modeToggle\.setAttribute\("aria-pressed", String\(markdown\)\)/);
-});
-
-test("zoomed editor uses compact labels without hiding any view", async () => {
-  const html = await readFile(new URL("../static/editor.html", import.meta.url), "utf8");
-  const css = await readFile(new URL("../static/css/styles.css", import.meta.url), "utf8");
-  const editorSource = await readFile(new URL("../static/js/note-editor.js", import.meta.url), "utf8");
-
-  assert.match(html, /id="mode-toggle"[\s\S]*?control-label-full">Markdown<[\s\S]*?control-label-short" aria-hidden="true">M</);
-  assert.match(html, /data-view="edit"[\s\S]*?>E<[\s\S]*?data-view="split"[\s\S]*?>S<[\s\S]*?data-view="preview"[\s\S]*?>P</);
-  assert.match(css, /@media \(max-width: 1699px\) \{[\s\S]*?\.pad-page :is\(#mode-toggle, \.view-switch\) \.control-label-full \{\s*display:\s*none;/);
-  assert.match(css, /@media \(max-width: 760px\) \{[\s\S]*?grid-template-columns:\s*minmax\(0, 1fr\) auto auto;[\s\S]*?#mode-toggle \{\s*display:\s*inline-flex;[\s\S]*?button\[data-view="split"\][\s\S]*?display:\s*inline-flex;/);
-  assert.match(editorSource, /modeToggle\.querySelector\("\.control-label-short"\)\.textContent = markdown \? "M" : "T";/);
-});
-
-test("history panel wraps long content without horizontal scrolling", async () => {
-  const css = await readFile(new URL("../static/css/styles.css", import.meta.url), "utf8");
-  assert.match(css, /\.history-list \{[\s\S]*?overflow-x:\s*hidden;[\s\S]*?overflow-y:\s*auto;/);
-  assert.match(css, /\.revision \{[\s\S]*?grid-template-columns:\s*12px minmax\(0, 1fr\);/);
-  assert.match(css, /\.revision__meta strong,[\s\S]*?\.revision__preview \{[\s\S]*?overflow-wrap:\s*anywhere;[\s\S]*?word-break:\s*break-word;/);
-  assert.match(css, /\.revision__preview \{[\s\S]*?overflow-x:\s*hidden;[\s\S]*?white-space:\s*pre-wrap;/);
-});
diff --git a/tests/header_ui_test.mjs b/tests/header_ui_test.mjs
deleted file mode 100644
index 50e7d1d..0000000
--- a/tests/header_ui_test.mjs
+++ /dev/null
@@ -1,29 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { readFile } from "node:fs/promises";
-
-const css = await readFile(new URL("../static/css/styles.css", import.meta.url), "utf8");
-
-function rule(selector) {
-  const escaped = selector.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const match = css.match(new RegExp(`${escaped}\\s*\\{([^}]*)\\}`));
-  assert.ok(match, `Missing CSS rule: ${selector}`);
-  return match[1];
-}
-
-test("top-level page headers share one compact height", () => {
-  assert.match(css, /--top-header-height:\s*54px;/);
-  for (const selector of [".site-header", ".app-header", ".public-header"]) {
-    assert.match(rule(selector), /min-height:\s*var\(--top-header-height\)/);
-  }
-});
-
-test("header actions use the shared compact control height", () => {
-  assert.match(css, /--top-header-control-height:\s*34px;/);
-  assert.match(css, /\.app-header \.secondary-button,[\s\S]*?min-height:\s*var\(--top-header-control-height\)/);
-  assert.match(css, /\.public-header \.secondary-button,[\s\S]*?min-height:\s*var\(--top-header-control-height\)/);
-});
-
-test("small screens retain taller header controls", () => {
-  assert.match(css, /@media \(max-width: 720px\)[\s\S]*?\.public-header \.secondary-button,[\s\S]*?min-height:\s*36px;/);
-});
diff --git a/tests/share_session_sql_test.py b/tests/share_session_sql_test.py
deleted file mode 100755
index d8f8411..0000000
--- a/tests/share_session_sql_test.py
+++ /dev/null
@@ -1,210 +0,0 @@
-#!/usr/bin/env python3
-from __future__ import annotations
-
-import hashlib
-import re
-import sqlite3
-from datetime import datetime, timezone
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parents[1]
-MIGRATIONS = ROOT / "migrations" / "sqlite"
-SQLITE_QUERIES = ROOT / "src" / "queries" / "sqlite.rs"
-
-
-def query(name: str) -> str:
-    source = SQLITE_QUERIES.read_text()
-    pattern = rf'Query::{re.escape(name)}\s*=>\s*\{{\s*r#"(.*?)"#\s*\}}'
-    match = re.search(pattern, source, re.S)
-    if not match:
-        raise AssertionError(f"Query::{name} not found")
-    return match.group(1)
-
-
-def parse_rfc3339(value: str) -> datetime:
-    parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
-    if parsed.tzinfo is None:
-        raise ValueError("timestamp must include timezone")
-    return parsed.astimezone(timezone.utc)
-
-
-def active_permission(row: tuple[str, str, str | None] | None, now: datetime) -> str | None:
-    if row is None:
-        return None
-    permission, session_expires_at, link_expires_at = row
-    try:
-        if parse_rfc3339(session_expires_at) <= now:
-            return None
-        if link_expires_at is not None and parse_rfc3339(link_expires_at) <= now:
-            return None
-    except ValueError:
-        return None
-    return permission if permission in {"ro", "rw"} else None
-
-
-def link_active(expires_at: str | None, now: datetime) -> bool:
-    if expires_at is None:
-        return True
-    try:
-        return parse_rfc3339(expires_at) > now
-    except ValueError:
-        return False
-
-
-def apply(connection: sqlite3.Connection, paths: list[Path]) -> None:
-    for path in paths:
-        connection.executescript(path.read_text())
-
-
-def main() -> None:
-    migrations = sorted(MIGRATIONS.glob("*.sql"))
-    before_sessions = [path for path in migrations if path.name < "0026_share_link_sessions.sql"]
-    session_migration = MIGRATIONS / "0026_share_link_sessions.sql"
-    label_migration = MIGRATIONS / "0027_share_link_labels.sql"
-
-    db = sqlite3.connect(":memory:")
-    db.execute("PRAGMA foreign_keys = ON")
-    apply(db, before_sessions)
-    db.execute(
-        "INSERT INTO users (nickname, nickname_key, email, email_key, password_hash) "
-        "VALUES (?, ?, ?, ?, ?)",
-        ("Owner", "owner", "owner@example.test", "owner@example.test", "hash"),
-    )
-
-    raw_link = "legacy-share-token"
-    share_hash = hashlib.sha256(raw_link.encode()).hexdigest()
-    db.execute(
-        "INSERT INTO resource_share_links "
-        "(token_hash, resource_kind, resource_slug, permission, expires_at, created_by) "
-        "VALUES (?, 'workspace', 'private-space', 'ro', NULL, 1)",
-        (share_hash,),
-    )
-    db.executescript(session_migration.read_text())
-    db.executescript(label_migration.read_text())
-    columns = {row[1] for row in db.execute("PRAGMA table_info(resource_share_links)")}
-    assert "token" not in columns, "fresh schema must not contain a plaintext token column"
-    assert "label" in columns, "share links must support labels"
-
-    source_sql = query("SHARE_LINK_SESSION_SOURCE")
-    insert_sql = query("SHARE_SESSION_INSERT")
-    permission_sql = query("SHARE_SESSION_PERMISSION")
-    revoke_sessions_sql = query("SHARE_SESSIONS_DELETE_BY_LINK")
-    delete_expired_sql = query("SHARE_SESSIONS_DELETE_EXPIRED")
-    link_insert_sql = query("SHARE_LINK_INSERT")
-    sharing_list_sql = query("RESOURCE_SHARING_LINKS")
-
-    now = datetime(2026, 8, 2, 23, 0, tzinfo=timezone.utc)
-    source = db.execute(source_sql, (share_hash, "workspace", "private-space")).fetchone()
-    assert source == (share_hash, "ro", None)
-
-    session_raw = "opaque-browser-session"
-    session_hash = hashlib.sha256(session_raw.encode()).hexdigest()
-    db.execute(
-        insert_sql,
-        (
-            session_hash,
-            share_hash,
-            "workspace",
-            "private-space",
-            "2026-08-03T00:00:00+00:00",
-        ),
-    )
-
-    def permission(slug: str = "private-space") -> str | None:
-        row = db.execute(permission_sql, (session_hash, "workspace", slug)).fetchone()
-        return active_permission(row, now)
-
-    assert permission() == "ro", "ro share session must remain read-only"
-    assert permission("another-space") is None, "session must be scoped to one resource"
-
-    db.execute(
-        "UPDATE resource_share_links SET permission = 'rw' WHERE token_hash = ?", (share_hash,)
-    )
-    assert permission() == "rw", "ro -> rw change must affect active sessions immediately"
-    db.execute(
-        "UPDATE resource_share_links SET permission = 'ro' WHERE token_hash = ?", (share_hash,)
-    )
-    assert permission() == "ro", "rw -> ro change must remove write access immediately"
-
-    db.execute(
-        "UPDATE resource_share_sessions SET expires_at = ? WHERE session_token_hash = ?",
-        ("2026-08-02T22:59:59+00:00", session_hash),
-    )
-    assert permission() is None, "expired browser session must be denied"
-    db.execute(
-        "UPDATE resource_share_sessions SET expires_at = ? WHERE session_token_hash = ?",
-        ("2026-08-03T00:00:00+00:00", session_hash),
-    )
-
-    # Offset timestamps are parsed chronologically rather than compared as text.
-    db.execute(
-        "UPDATE resource_share_links SET expires_at = ? WHERE token_hash = ?",
-        ("2026-08-03T01:30:00+02:00", share_hash),
-    )
-    row = db.execute(permission_sql, (session_hash, "workspace", "private-space")).fetchone()
-    assert active_permission(row, now) == "ro"
-    later = datetime(2026, 8, 2, 23, 31, tzinfo=timezone.utc)
-    assert active_permission(row, later) is None, "expired link must invalidate its sessions"
-
-    db.execute(
-        "UPDATE resource_share_links SET expires_at = 'not-a-date' WHERE token_hash = ?",
-        (share_hash,),
-    )
-    row = db.execute(permission_sql, (session_hash, "workspace", "private-space")).fetchone()
-    assert active_permission(row, now) is None, "malformed expiration must fail closed"
-    assert not link_active("not-a-date", now)
-
-    db.execute(
-        "UPDATE resource_share_links SET expires_at = NULL, revoked_at = ? WHERE token_hash = ?",
-        ("2026-08-02T23:05:00+00:00", share_hash),
-    )
-    assert db.execute(permission_sql, (session_hash, "workspace", "private-space")).fetchone() is None
-    deleted = db.execute(
-        revoke_sessions_sql, (share_hash, "workspace", "private-space")
-    ).rowcount
-    assert deleted == 1, "revoking a link must remove all derived sessions"
-
-    # Newly created links persist only the hash and an optional identifying label.
-    second_raw = "one-time-returned-token"
-    second_hash = hashlib.sha256(second_raw.encode()).hexdigest()
-    db.execute(
-        link_insert_sql,
-        (second_hash, "QA link", "workspace", "second-space", "rw", None, 1),
-    )
-    assert db.execute(
-        "SELECT label, permission FROM resource_share_links WHERE token_hash = ?", (second_hash,)
-    ).fetchone() == ("QA link", "rw")
-    listed_link = db.execute(sharing_list_sql, ("workspace", "second-space")).fetchone()
-    assert listed_link == (
-        second_hash,
-        "QA link",
-        "rw",
-        None,
-        listed_link[4],
-    ), "management listing must return the label but never a plaintext share token"
-
-    db.execute(
-        insert_sql,
-        (
-            hashlib.sha256(b"expired-row").hexdigest(),
-            second_hash,
-            "workspace",
-            "second-space",
-            "2026-08-02T22:00:00+00:00",
-        ),
-    )
-    db.execute(delete_expired_sql, ("2026-08-02T23:00:00+00:00",))
-    assert db.execute(
-        "SELECT COUNT(*) FROM resource_share_sessions WHERE share_token_hash = ?", (second_hash,)
-    ).fetchone() == (0,), "expired session cleanup must remove stale rows"
-
-    db.execute("DELETE FROM resource_share_links WHERE token_hash = ?", (second_hash,))
-    assert db.execute(
-        "SELECT COUNT(*) FROM resource_share_sessions WHERE share_token_hash = ?", (second_hash,)
-    ).fetchone() == (0,), "link deletion must cascade to sessions"
-
-    print("share session SQL regression tests: 17 passed")
-
-
-if __name__ == "__main__":
-    main()
diff --git a/tests/share_session_static_test.py b/tests/share_session_static_test.py
deleted file mode 100755
index 62afdc6..0000000
--- a/tests/share_session_static_test.py
+++ /dev/null
@@ -1,175 +0,0 @@
-#!/usr/bin/env python3
-from __future__ import annotations
-
-import re
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parents[1]
-
-
-def read(path: str) -> str:
-    return (ROOT / path).read_text()
-
-
-def query_sql(backend: str, name: str) -> str:
-    source = read(f"src/queries/{backend}.rs")
-    match = re.search(
-        rf'Query::{re.escape(name)}\s*=>\s*\{{\s*r#"(.*?)"#\s*\}}',
-        source,
-        re.S,
-    )
-    if not match:
-        raise AssertionError(f"{backend}: Query::{name} missing")
-    return match.group(1)
-
-
-def main() -> None:
-    names = {
-        "SHARE_LINK_INSERT": 7,
-        "SHARE_LINK_UPDATE": 6,
-        "SHARE_LINK_PERMISSION": 3,
-        "SHARE_LINK_SESSION_SOURCE": 3,
-        "SHARE_SESSION_INSERT": 5,
-        "SHARE_SESSION_PERMISSION": 3,
-        "SHARE_SESSIONS_DELETE_BY_LINK": 3,
-        "SHARE_SESSIONS_DELETE_EXPIRED": 1,
-    }
-    for backend in ("sqlite", "mysql"):
-        for name, expected in names.items():
-            sql = query_sql(backend, name)
-            assert sql.count("?") == expected, (backend, name, sql)
-    for name, expected in names.items():
-        sql = query_sql("postgres", name)
-        parameters = [int(value) for value in re.findall(r"\$(\d+)", sql)]
-        assert sorted(set(parameters)) == list(range(1, expected + 1)), (name, sql)
-
-    auth = read("src/auth/mod.rs")
-    register_response = auth[auth.index("pub struct RegisterResponse"):auth.index("pub async fn identity")]
-    assert "token:" not in register_response
-    assert ".bind(&token)" not in auth[auth.index("pub async fn create_share_link"):auth.index("pub async fn update_share_link")]
-    assert '"token":row.token' not in auth
-    assert "token: Option<String>" not in auth[auth.index("struct SharingLinkRow"):auth.index("struct ShareLinkSessionSource")]
-    assert "normalize_share_expiration" in auth
-    assert "SHARE_SESSIONS_DELETE_BY_LINK" in auth
-    assert "share_session_permission" in auth
-    assert "invalid share session expiration in database" in auth
-    assert "invalid share session permission in database" in auth
-    assert "valid_share_token" in auth
-    assert 'format!("share-session-client:{client_key}")' in auth
-    create_link = auth[auth.index("pub async fn create_share_link"):auth.index("pub async fn update_share_link")]
-    assert "no-store, max-age=0" in create_link
-    assert '"token_hash":token_hash' in create_link
-    assert '"token":token' not in create_link
-    assert '"label":label' in create_link
-    create_session = auth[auth.index("pub async fn create_share_session"):auth.index("async fn share_session_permission")]
-    assert "existing_session_token" not in create_session
-    assert 'source.permission == "ro"' not in create_session
-    assert "resource_is_public_unprotected(state, kind, slug).await?" in create_session
-    assert create_session.index("resource_is_public_unprotected") < create_session.index("valid_share_token")
-    create_link = auth[auth.index("pub async fn create_share_link"):auth.index("pub async fn update_share_link")]
-    update_link = auth[auth.index("pub async fn update_share_link"):auth.index("pub async fn revoke_share_link")]
-    revoke_link = auth[auth.index("pub async fn revoke_share_link"):auth.index("fn validate_permission")]
-    for management_handler in (create_link, update_link, revoke_link):
-        assert "ensure_share_links_enabled" in management_handler
-    assert "Direct share links are disabled for public resources without a password." in auth
-    share_access = auth[auth.index("pub async fn share_access_permission"):auth.index("pub async fn share_link_permission")]
-    assert "resource_is_public_unprotected(state, kind, slug).await?" in share_access
-    sharing = auth[auth.index("pub async fn resource_sharing"):auth.index("pub async fn create_share_link")]
-    assert '"share_links_enabled":share_links_enabled' in sharing
-    assert "if share_links_enabled" in sharing
-    assert "Vec::new()" in sharing
-    privacy = auth[auth.index("pub async fn set_resource_privacy"):auth.index("pub async fn share_resource_users")]
-    assert "SHARE_LINK" not in privacy
-    assert "SHARE_SESSION" not in privacy
-
-    api = read("src/api/mod.rs")
-    assert "combined_token_access_level" not in api
-    request_access = api[api.index("async fn request_access_level"):api.index("fn access_level_name")]
-    for required in ("share_session_token", "resource_token", "authorization_token", "account_token_access_level"):
-        assert required in request_access
-
-    access_tokens = read("src/api/access_tokens.rs")
-    assert "verify_password_access_token" in access_tokens
-    assert "verify_resource_access_token" not in access_tokens
-    assert "workspace.password_hash.is_some()" in access_tokens
-    assert "pad.password_hash.is_some()" in access_tokens
-
-    database = read("src/db/mod.rs")
-    workspace_password = database[database.index("pub fn verify_workspace_password"):database.index("pub async fn list_notes")]
-    pad_password = database[database.index("pub fn verify_pad_password"):database.index("pub async fn save_pad_revision")]
-    assert "(None, _) => false" in workspace_password
-    assert "(None, _) => false" in pad_password
-    assert "missing_password_does_not_grant_password_access" in database
-
-    websocket = read("src/websocket/mod.rs") + read("src/websocket/pad.rs")
-    assert "cookie_share_session_token" in websocket
-    assert "cookie_password_token" in websocket
-    assert "explicit_access_token.or(" not in websocket
-    assert "verify_password_access_token" in websocket
-    assert "Access expired or revoked" in websocket
-    assert "access_refresh" in websocket
-    assert websocket.count("update=updates.recv()=>{") == 2
-    assert websocket.count('message:"Access expired or revoked"') >= 6
-    current_access = read("src/websocket/mod.rs")[read("src/websocket/mod.rs").index("async fn current_resource_access"):read("src/websocket/mod.rs").index("// Merged from note.rs")]
-    assert "resource_is_public_unprotected(state, kind, slug)" in current_access
-    assert "public_unprotected: bool" not in current_access
-
-    pages = read("src/app/pages.rs")
-    assert "canonical_resource_url" in pages
-    assert "RawQuery" in pages
-    assert "share_token_from_query" in pages
-    assert "decode_query_component" in pages
-    assert "share_session_cookie" in pages
-    assert "Ok(None) => None" in pages
-    assert "clear_share_session_cookie" not in pages
-    assert "no-store, max-age=0" in pages
-    assert "no-referrer" in pages
-    assert 'decode_query_component(name).as_deref() != Some("share")' in pages
-
-    security = read("src/security.rs")
-    assert "__Host-rustpad_share_" in security
-    assert "HttpOnly; Secure; SameSite=Lax" in security
-    assert "clear_share_session_cookie" not in security
-
-    for backend in ("sqlite", "postgres", "mysql"):
-        sharing_list = query_sql(backend, "RESOURCE_SHARING_LINKS")
-        assert not re.search(r"(?:^|,)\s*(?:CAST\()?token\b", sharing_list)
-        legacy_migration = read(f"migrations/{backend}/0012_share_link_tokens.sql")
-        assert "ADD COLUMN token" not in legacy_migration
-        migration = read(f"migrations/{backend}/0026_share_link_sessions.sql")
-        assert "resource_share_links SET token" not in migration
-        assert "session_token_hash" in migration
-        assert "ON DELETE CASCADE" in migration
-        label_migration = read(f"migrations/{backend}/0027_share_link_labels.sql")
-        assert "ADD COLUMN label" in label_migration
-
-    home_js = read("static/js/home.js")
-    assert "createdLinkValues" in home_js
-    assert "result.token_hash" in home_js
-    assert "data-copy-link" in home_js
-    assert "The full address is not stored" in home_js
-    assert 'name="label"' in home_js
-    assert "token_hash: linkRow.dataset.linkTokenHash" in home_js
-    assert "Link created, displayed below and copied." in home_js
-    assert "data-direct-links-disabled" in home_js
-    assert "d.share_links_enabled !== false" in home_js
-    assert "Existing links are preserved and become active again" in home_js
-
-    workspace_js = read("static/js/workspace.js")
-    note_js = read("static/js/note-editor.js")
-    assert 'info.access_level === "none"' in workspace_js
-    assert note_js.count('info.access_level === "none"') >= 2
-
-    main_rs = read("src/main.rs")
-    assert "https://git.linuxiarz.pl/gru/rustpad/src/branch/master/LICENSE.md" in main_rs
-
-    app = read("src/app/mod.rs")
-    assert "PathOnlyMakeSpan" in app
-    assert "request.uri().path()" in app
-    assert "TraceLayer::new_for_http().make_span_with(PathOnlyMakeSpan)" in app
-
-    print("share session static regression tests: passed")
-
-
-if __name__ == "__main__":
-    main()
diff --git a/tests/share_url_test.mjs b/tests/share_url_test.mjs
deleted file mode 100644
index 9da4bab..0000000
--- a/tests/share_url_test.mjs
+++ /dev/null
@@ -1,90 +0,0 @@
-import assert from "node:assert/strict";
-import { readFile } from "node:fs/promises";
-import test from "node:test";
-
-const origin = "https://pad.example";
-let currentUrl;
-let historyCall;
-let dispatchedEvent;
-
-globalThis.CustomEvent = class CustomEvent {
-  constructor(type, init = {}) {
-    this.type = type;
-    this.detail = init.detail;
-  }
-};
-
-globalThis.window = {
-  location: null,
-  history: {
-    pushState(state, _title, url) {
-      historyCall = { method: "pushState", state };
-      setLocation(url);
-    },
-    replaceState(state, _title, url) {
-      historyCall = { method: "replaceState", state };
-      setLocation(url);
-    },
-  },
-  dispatchEvent(event) {
-    dispatchedEvent = event;
-  },
-};
-
-function setLocation(value) {
-  currentUrl = new URL(value, origin);
-  window.location = {
-    get href() { return currentUrl.href; },
-    get search() { return currentUrl.search; },
-  };
-}
-
-function resetWindow(value) {
-  setLocation(value);
-  historyCall = undefined;
-  dispatchedEvent = undefined;
-}
-
-const source = await readFile(new URL("../static/js/url-state.js", import.meta.url), "utf8");
-const moduleUrl = `data:text/javascript;base64,${Buffer.from(source).toString("base64")}`;
-const { currentShareUrl, readEditorState, writeEditorState } = await import(moduleUrl);
-
-test("editor state reads supported values", () => {
-  resetWindow("/w/demo/n/note?view=preview&mode=text");
-  assert.deepEqual(readEditorState(), { view: "preview", mode: "text" });
-});
-
-test("editor state rejects unsupported values", () => {
-  resetWindow("/w/demo/n/note?view=invalid&mode=html");
-  assert.deepEqual(readEditorState(), { view: "split", mode: "markdown" });
-});
-
-test("writing editor state preserves unrelated query and hash", () => {
-  resetWindow("/w/demo/n/note?filter=recent#section");
-  const result = new URL(writeEditorState({ view: "edit", mode: "text" }));
-
-  assert.equal(result.searchParams.get("filter"), "recent");
-  assert.equal(result.searchParams.get("view"), "edit");
-  assert.equal(result.searchParams.get("mode"), "text");
-  assert.equal(result.hash, "#section");
-  assert.equal(historyCall.method, "pushState");
-  assert.deepEqual(historyCall.state, { view: "edit", mode: "text" });
-  assert.equal(dispatchedEvent.type, "rustpad:urlchange");
-});
-
-test("replace mode uses replaceState", () => {
-  resetWindow("/p/demo");
-  writeEditorState({ view: "split", mode: "markdown" }, { replace: true });
-  assert.equal(historyCall.method, "replaceState");
-});
-
-test("current share URL adds view state without inventing access tokens", () => {
-  resetWindow("/w/demo/n/note?filter=recent#section");
-  const result = new URL(currentShareUrl({ view: "preview", mode: "markdown" }));
-
-  assert.equal(result.searchParams.get("filter"), "recent");
-  assert.equal(result.searchParams.get("view"), "preview");
-  assert.equal(result.searchParams.get("mode"), "markdown");
-  assert.equal(result.searchParams.has("share"), false);
-  assert.equal(result.hash, "#section");
-});