siyabendoezdemir · Oct 10, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
diff --git a/FEATURES.md b/FEATURES.md
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
@@ -16,8 +16,9 @@ BrowserWindow (frameless; hiddenInset traffic lights on macOS)
 - **Main process** (`src/main`) owns all state, all web contents, sessions, windows, menus, shortcuts and persistence.
 - **Shell renderer** (`src/renderer`, `?view=shell`) draws the sidebar and an empty rounded "frame". It measures the frame (and split panes) and reports pane rectangles to main (`layout.panes` event). Main then places the native tab views exactly over them. Pages are never iframes.
 - **Overlay renderer** (`?view=overlay`) is a transparent full-window view above the tabs. It's shown only while something floats (command bar, Peek card chrome, menus). Clicking its backdrop closes it.
+- **Views over the pages**, bottom to top: the tab views; the page's small views (page tools, permission prompt, loading indicator, link pill: `WindowManager.createUiView` and kin); a page cover while one is open (the Library, `WindowManager.setPageCover`), which those small views go under; then a Peek, the floating sidebar card and the overlay.
 - **Other renderer views**: `mini` (Mini Window chrome) and `settings` (settings window). They come from the same bundle and are selected by the `view` query.
-- **Preload** (`src/preload/shell.ts`) runs sandboxed with context isolation. It exposes `window.orbit` (`OrbitBridge` in `src/shared/rpc.ts`) only to Orbit UI contents. Web pages get **no preload**. IPC handlers reject any sender that isn't registered Orbit UI.
+- **Preload** (`src/preload/shell.ts`) runs sandboxed with context isolation. It exposes `window.orbit` (`OrbitBridge` in `src/shared/rpc.ts`) only to Orbit UI contents, and its `orbit:*` IPC handlers reject any sender that isn't registered Orbit UI. Web pages get one preload of their own, `src/preload/page.ts` (NV-15), on D40's terms. It runs in main frames only and adds nothing to page globals: it patches only the built-ins NV-15 needs (`Notification.permission`, `Notification.requestPermission`, the `Notification` constructor, with its prototype's `constructor` pointing back at it, and `PermissionStatus.prototype.state`), so a permission the user hasn't decided reads "default"/"prompt" as in Chromium and a click on one of the page's notifications reaches main. It talks to main only over its own `orbit-page:*` channels, separate from the UI's `orbit:*` channels, and main takes the origin and profile from `event.senderFrame`, never from the message.
 
 ## 2. State: one store, patches out
 
@@ -118,7 +119,11 @@ Rules: no synchronous disk I/O on hot paths after boot, no full-state broadcasts
 
 ## 10. Security baseline
 
-Sandboxed, context-isolated renderers everywhere. No Node in pages. Pages never get a preload. IPC accepts registered Orbit UI senders only. UI renderers can't navigate or open windows. Permission prompts are per origin. Tweak JS (user-authored, per site) is injected only through `webFrame.executeJavaScript` in an isolated world, never with Node. Extensions use Electron's built-in extension support plus Orbit's own (MIT) API shims (D3: no GPL dependency).
+Sandboxed, context-isolated renderers everywhere. No Node in pages. Pages get one preload, `src/preload/page.ts`, on D40's terms: main frames only, nothing added to page globals, built-ins patched only where the spec needs Chromium's behaviour (captured before the page runs, `Reflect.apply` included), and its own `orbit-page:*` channels. Main takes a page's origin and profile from the sender frame (`event.senderFrame`), never from the message, and each channel either returns read-only state for that origin or carries a request main checks against its own state before acting. Its uses, all of them (any other channel, patch or global is a lead decision, D40):
+- `orbit-page:permission` (NV-15): a synchronous read of how a permission reads for the sending frame's own origin and profile ("prompt" while the user hasn't decided). Read-only.
+- `orbit-page:notification-click` (NV-15): a trusted click on one of the page's notifications. Main brings the tab forward only for a site allowed to show notifications, and at most once per `NOTIFICATION_CLICK_GAP_MS` per tab.
+
+The UI's `orbit:*` IPC accepts registered Orbit UI senders only. UI renderers can't navigate or open windows. Permission prompts are per origin. Tweak JS (user-authored, per site) is injected only through `webFrame.executeJavaScript` in an isolated world, never with Node. Extensions use Electron's built-in extension support plus Orbit's own (MIT) API shims (D3: no GPL dependency).
 
 ## 11. Packaging and updates