diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 44af14e4..cdf190dd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -404,7 +404,9 @@ jobs:
           mkdir -p build/ext-tester
           EXE=querya-ext-tester
           if [ "${{ runner.os }}" = "Windows" ]; then EXE=querya-ext-tester.exe; fi
-          dart compile exe bin/querya_ext_tester.dart -o "build/ext-tester/$EXE"
+          # Pure Dart in a throwaway package: `dart compile exe` rejects the
+          # app's graph (build hooks in sqlite3 and objective_c).
+          scripts/ci/build_ext_tester.sh "build/ext-tester/$EXE"
           MCP=querya-mcp
           if [ "${{ runner.os }}" = "Windows" ]; then MCP=querya-mcp.exe; fi
           mkdir -p build/mcp
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6e309798..8c1f2cf0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-Everything merged to `dev` since 0.4.18: the NoSQL workbench, SSH tunnelling and Production safeguards, the ER diagram, charts and plans, the MCP server, a rebuilt SQL workspace toolbar, a UI kit, and a round of session and connection correctness fixes.
+### Planned
+
+- Planned 0.5.0 — live Marketplace download and install
+- MCP v2: MongoDB and Redis, extension drivers, Streamable HTTP, writes with confirmation
+- Server-side statement timeouts for editor and browse sessions
+- High-refresh Linux compositor investigations (#980)
+
+## [0.4.19] - 2026-10-11
+
+The NoSQL workbench, SSH tunnelling and Production safeguards, the ER diagram (layout, groups, notes, saved views, DBML and PDF export), charts and plans, the read-only MCP server, a rebuilt SQL workspace toolbar and run modes, one control scale and button family across the UI kit, a first round of leaving `shadcn_flutter`, security fixes (PostgreSQL TLS, the extension sandbox), and a round of session and connection correctness fixes.
 
 ### Added
 
@@ -76,6 +85,7 @@ Everything merged to `dev` since 0.4.18: the NoSQL workbench, SSH tunnelling and
 **Platform, packaging and tooling**
 
 - **Portable mode out of the box** through a `.portable` marker (#1056).
+- **Standalone Flathub manifest and bundle icon (#1060)** in `packaging/linux/flatpak/`.
 - **macOS .dmg** in the release pipeline; **AppStream metainfo** for Flatpak; **signed APT and DNF repositories** from the release workflow.
 - **Team connection profile export / import.**
 - **Extension test harness and CLI runner** (`querya-ext-tester`), published with releases; CI recipes for extension authors.
@@ -94,7 +104,7 @@ Everything merged to `dev` since 0.4.18: the NoSQL workbench, SSH tunnelling and
 - **Flutter is pinned to 3.47.1**, the version the 120 Hz Linux engine is built for.
 - **Dialog footers** — About, Driver manager, Preferences, the connection forms and the small name dialogs use `QueryaDialogActions`: Cancel / Close is ghost, Test connection sits between Cancel and the main action, spacing is 8 px, one divider (#1441).
 - **One height per toolbar row** — the SQL, ERD, chart and results toolbars set one control size, and an icon button is the same control as every other button (#1439, #1440).
-- **ERD view split into parts (#1362)** — layout, routing and geometry moved to `core/erd` (`ErdLayoutEngine`, unit-tested without widgets); cards, relation painter, notes, groups, export data, menus and status bodies are their own files.
+- **ERD view split into parts (#1362)** — layout, routing and geometry moved to `core/erd` (`ErdLayoutEngine`, unit-tested without widgets); cards, relation painter, notes, groups, export data, the export flows (`ErdExporter`: Mermaid, DBML, SVG, PNG, PDF), menus and status bodies are their own files.
 - **SQL workspace toolbar, connection forms and the editor's highlighter lifecycle** are separate, tested units (`SqlWorkspaceToolbar`, form sections for network, credentials and SSL, a highlight controller managed per session).
 - **`QueryaApp.build` has no side effects** — the async loads and one-time work moved out of it.
 
@@ -118,11 +128,13 @@ Everything merged to `dev` since 0.4.18: the NoSQL workbench, SSH tunnelling and
 - **SQLite** — columns with the same name stay separate in query results (#1144).
 - **Updater and Windows** — the Linux bundle replace preserves `QueryaData` and `.portable` (#1055); file associations and registry writes are optional (#1054).
 - **Packaging** — desktop and icon caches are refreshed after install and removal.
+- **Run on an empty editor says so (#1478)** — *Nothing to run* instead of silence; the status bar follows the active tab and no longer shows another tab's rows and time or repeats the row count (#1479).
 - **Removing a connection** asks first and leaves its workspace; *Remove connection* is a destructive menu item.
 - **SQL workspace** — the status bar no longer keeps *Running query…* after a failed run; a long query error scrolls instead of overflowing the results pane; a code editor that fills its space starts its text at the top.
 - **Editor** — no duplicate `onChanged`, no false cursor jumps, default highlighting on (#1430); MongoDB documents in JSON mode are highlighted (#1432).
 - **Data grid** — the WHERE clause of an edit uses the column's real type and tells the string `'NULL'` from SQL `NULL`; the value panel no longer validates twice (#1431).
 - **UI** — export and copy menu buttons have one chevron; the tab strip draws its focus ring only for keyboard focus (#1438); dropdown menus are at least as wide as their trigger (#1444); form rules use the theme's border colour, not black, in the light theme (#1443); the new-connection wizard search is the standard search field (#1442).
+- **Look and feel** — a disabled primary button is a grey chip with a readable label; the SQL toolbar badge reads *Auto-commit* / *Manual commit* before the first run; below 1100 px the ERD toolbar shows *Note*, *Auto layout* and the group buttons as icons so *Export* does not wrap alone; Preferences MCP buttons are the same size as the rest.
 - **Startup recovery** — when the local database cannot be opened, the app shows a recovery screen instead of failing silently.
 - **Updater (Windows)** — an in-place update mirrors the new bundle, so obsolete DLLs and assets are removed.
 - **SSH** — a failed tunnel closes its sockets and the jump socket, a missing key file is reported, concurrent callers share one dial, and a local forwarder that survived a failed keep-alive is closed; a dropped socket marks the session closed (`isConnected`).
@@ -149,16 +161,9 @@ Everything merged to `dev` since 0.4.18: the NoSQL workbench, SSH tunnelling and
 
 - **E2E suite** (`test/e2e`, run in CI and gating `release`): connection lifecycle and forms of every type, folders, SSH bastion tunnel, credential scrubbing, SQL workspaces and export, command palette, extensions sandbox, Redis CLI and key tree, Mongo viewer, index manager, aggregations, CRUD, theme import, shutdown.
 - **Test sections** run as parallel jobs; self-hosted runners; a MySQL server and bubblewrap for the live database and sandbox tests.
-- **Guards** — UI kit usage, and `core/` and `shared/` free of `features/` and `app/` imports; `lib/shared` must not import `shadcn_flutter` (a ratchet); no raw `Divider` outside the kit.
+- **Guards** — UI kit usage, and `core/` and `shared/` free of `features/` and `app/` imports; `lib/shared` must not import `shadcn_flutter` (a ratchet); no raw `Divider`, no shadcn or raw Material buttons, no `*Button` class outside the kit (two allowed) and no literal tooltip delay (`test/guards/`).
 - **Benchmarks** compare build time over interleaved runs and cover ERD, charts and multi-tab SQL scenarios.
 
-### Planned
-
-- Planned 0.5.0 — live Marketplace download and install
-- MCP v2: MongoDB and Redis, extension drivers, Streamable HTTP, writes with confirmation
-- Server-side statement timeouts for editor and browse sessions
-- High-refresh Linux compositor investigations (#980)
-
 ## [0.4.18] - 2026-09-28
 
 Shell and motion performance (sidebar layout isolation and offstage rendering), data-loss guard rails, driver session correctness, and high-refresh grid reliability.
diff --git a/bin/querya_ext_tester.dart b/bin/querya_ext_tester.dart
index 95681fbd..4417754f 100644
--- a/bin/querya_ext_tester.dart
+++ b/bin/querya_ext_tester.dart
@@ -31,7 +31,13 @@ Options:
   -h, --help                show this help
 ''';
 
-Future<int> main(List<String> args) async {
+/// The exit code is set through `exitCode`: a Dart `main` cannot return one
+/// (the `Future<int>` it used to return was ignored, so a failed run exited 0).
+Future<void> main(List<String> args) async {
+  exitCode = await _run(args);
+}
+
+Future<int> _run(List<String> args) async {
   String? dir;
   var target = '0.5.0';
   String? connect;
diff --git a/docs/release-checklist.md b/docs/release-checklist.md
index 928fe959..cd7ef0ce 100644
--- a/docs/release-checklist.md
+++ b/docs/release-checklist.md
@@ -1,10 +1,25 @@
-# Pre-release checklist (release **0.4.18**)
+# Pre-release checklist (release **0.4.19**)
 
-Use this before tagging **`0.4.18`** or running the **Release** workflow.
+Use this before tagging **`0.4.19`** or running the **Release** workflow.
 See [tags-and-releases.md](tags-and-releases.md), [CHANGELOG.md](../CHANGELOG.md).
 Manual 120 Hz DevTools QA: issue [#739](https://github.com/QueryaHub/Querya-Desktop/issues/739) (does not block this cut).
 
-## Product smoke (manual) — 0.4.18
+## Product smoke (manual) — 0.4.19
+
+- [ ] **Buttons and controls (#1331)** — in the SQL toolbar, results bar, ERD toolbar and Preferences every control of a row has one height; hover, pressed, keyboard focus ring (Tab, not mouse click) and disabled states look the same on primary / secondary / ghost / destructive; icon buttons show a tooltip.
+- [ ] **Dialog footers (#1441)** — Cancel / Close is ghost, the main action is the only filled button; Esc cancels, Enter confirms (About, Driver manager, Preferences, a connection form, new folder).
+- [ ] **Toast (#1466)** — an export, a copy and an error show a toast that stacks, closes by itself and by its button; Motion Off shows it at once.
+- [ ] **Light theme** — rules in connection forms and dialogs are visible (not black); dropdown menus are not narrower than their field.
+- [ ] **Run modes (#1148)** — Ctrl+Enter runs the statement at the caret, F5 the script statement by statement; Run on an empty editor says *Nothing to run*; the status bar follows the active tab.
+- [ ] **SQL toolbar (#1150)** — one row at 1000 px and at 800 px; the transaction badge and Commit / Rollback only while a transaction is open.
+- [ ] **ER diagram** — open from a SQLite and a PostgreSQL connection; group, note, saved view; Export → SVG, PNG, PDF, DBML; the toolbar stays on one row at ~1000 px.
+- [ ] **Connections** — removing a connection asks first; *Test connection* of an edited connection uses the saved password; an SSH tunnel failure names the bastion.
+- [ ] **PostgreSQL TLS** — with a root CA set, the connection verifies the server (`verify-full`).
+- [ ] **Startup recovery** — with an unreadable local database the app opens the recovery screen instead of crashing.
+- [ ] **MCP server** — enable it, copy a client config, one `list_tables` call from a client; the activity log shows it.
+- [ ] **Packaging** — `.deb` / `.rpm` install, `bubblewrap` is recommended; the Flathub manifest in `packaging/linux/flatpak/` is updated with the release zip's URL and `sha256` after the tag (see below).
+
+## Product smoke (manual) — 0.4.18 (regression)
 
 - [ ] **Sidebar toggle layout isolation (#984)** — Ctrl+B toggles sidebar smoothly with zero LayoutBuilder rebuilds in workspace; build time < 0.5ms.
 - [ ] **LazyOffstage (#1004)** — inactive workspace layers stay offstage and skip redundant layouts.
@@ -70,14 +85,15 @@ Verify the 0.4.4 motion tokens, smooth animations, and high refresh rate support
 
 ## Versioning and release
 
-- [x] `pubspec.yaml` on the 0.4.18 track is **`0.4.18+1`**.
-- [ ] After merge to `main`, confirm **Auto Version Bump** yields a **0.4.19+…** placeholder.
-- [ ] **Tag** `0.4.18` is placed on the **main merge commit that includes `0.4.18+1`** (not the auto-bump commit).
+- [x] `pubspec.yaml` on the 0.4.19 track is **`0.4.19+2`** (the same as `main` after the bump that followed 0.4.18, so the merge has no version conflict).
+- [ ] After merge to `main`, confirm **Auto Version Bump** yields a **0.4.20+…** placeholder.
+- [ ] **Tag** `0.4.19` is placed on the **main merge commit that includes `0.4.19+2`** (not the auto-bump commit).
 - [ ] Run the **Release** workflow via that tag (see [tags-and-releases.md](tags-and-releases.md)).
 - [ ] Verify **portable** zips (`*-linux.zip`, `*-windows.zip`, `*-macos.zip`), **installable** artifacts (`*.AppImage`, `*.deb`, `*.rpm`, `*.flatpak`, `*-windows-setup.exe`), and `SHA256SUMS.txt` on the GitHub Release.
+- [ ] After the release, set the release zip's URL and `sha256` in `packaging/linux/flatpak/com.queryahub.querya_desktop.flathub.yml` (and the `metainfo.xml` release entry is already `0.4.19`); the Flathub submission (flathub/flathub#10606) is separate and has open lint errors (HTTPS on `queryahub.com` or another app id, no `--filesystem=home`, a supported GNOME runtime).
 
 ## Docs
 
-- [x] [CHANGELOG.md](../CHANGELOG.md) has a dated **`## [0.4.18]`** section for the release (CI copies it into the GitHub Release body).
+- [x] [CHANGELOG.md](../CHANGELOG.md) has a dated **`## [0.4.19]`** section for the release (CI copies it into the GitHub Release body); `scripts/extract-changelog-section.sh 0.4.19` finds it.
 - [x] [security.md](security.md) still matches behavior if storage changed.
-- [x] [roadmap.md](roadmap.md) marks 0.4.18 as this cut and 0.5.0 as next.
+- [x] [roadmap.md](roadmap.md) marks 0.4.19 as this cut and 0.5.0 as next.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index cc5568cf..83353eff 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -2,8 +2,8 @@
 
 Living document for planned work. Not a commitment order; adjust as priorities change.
 
-**GitHub Latest Release:** [0.4.17](https://github.com/QueryaHub/Querya-Desktop/releases/tag/0.4.17) (2026-09-20).  
-**This cut:** **0.4.18** — shell/motion perf (<0.5ms build), data-loss guards, driver session correctness, and high-refresh grid reliability — [CHANGELOG.md](../CHANGELOG.md) `[0.4.18]`.  
+**GitHub Latest Release:** [0.4.18](https://github.com/QueryaHub/Querya-Desktop/releases/tag/0.4.18) (2026-09-28).  
+**This cut:** **0.4.19** — NoSQL workbench, SSH and Production safeguards, ER diagram, MCP server, SQL run modes and toolbar, one control scale and button family (UI kit), security fixes — [CHANGELOG.md](../CHANGELOG.md) `[0.4.19]`.  
 **Next product release:** **0.5.0** — live Marketplace download and install — see below.
 
 ## Theme system
@@ -31,7 +31,8 @@ Living document for planned work. Not a commitment order; adjust as priorities c
 - **Shipped in 0.4.13–0.4.15:** interactive Data Grid, fluid motion, multi-tab SQL, preferences/keymap — [CHANGELOG.md](../CHANGELOG.md).
 - **Shipped in 0.4.16:** Table Browser in-place DML, Command Palette + Quick Switcher, workspace chrome / connections-tree parity, Mongo per-field Save to DB, updater hardening — [CHANGELOG.md](../CHANGELOG.md) `[0.4.16]`.
 - **Shipped in 0.4.17:** driver/grid correctness after 0.4.16 — schema vs PK (#772), SQLite `rowid` (#774), Mongo writes/filter/discard (#776/#778/#782/#783), Postgres/MySQL/SQLite/Redis session and type round-trips — [CHANGELOG.md](../CHANGELOG.md) `[0.4.17]`.
-- **0.4.18 (this cut):** shell/motion perf (<0.5ms build, #984/#1004), data-loss guard rails (#867–#873, #910, #912, #1007), driver correctness, and grid reliability (#1005–#1011) — [CHANGELOG.md](../CHANGELOG.md) `[0.4.18]`.
+- **Shipped in 0.4.18:** shell/motion perf (<0.5ms build, #984/#1004), data-loss guard rails (#867–#873, #910, #912, #1007), driver correctness, and grid reliability (#1005–#1011) — [CHANGELOG.md](../CHANGELOG.md) `[0.4.18]`.
+- **0.4.19 (this cut):** NoSQL workbench (Mongo viewer, aggregations, indexes, Redis CLI), SSH tunnelling and Production safeguards, ER diagram (groups, notes, saved views, DBML / PDF export), read-only MCP server, SQL run modes and one-row toolbar, UI kit (control scale, `QueryaButton` family, own toast and text styles), PostgreSQL TLS and sandbox fixes — [CHANGELOG.md](../CHANGELOG.md) `[0.4.19]`.
 - **Planned 0.5.0:** Marketplace Launch — live download, `sha256` validation, install themes (and later DB drivers) from the network.
 
 ## Query history and favorites
diff --git a/packaging/linux/aur/PKGBUILD b/packaging/linux/aur/PKGBUILD
index 52022006..6a8ada31 100644
--- a/packaging/linux/aur/PKGBUILD
+++ b/packaging/linux/aur/PKGBUILD
@@ -2,7 +2,7 @@
 # AUR package — installs the official Release portable Linux zip under /opt.
 # pkgver is synced by version-bump.yml; CI publishes real sha256sums on Release.
 pkgname=querya-desktop
-pkgver=0.4.18
+pkgver=0.4.22
 pkgrel=1
 pkgdesc="Multi-database desktop client (PostgreSQL, MySQL, Redis, MongoDB, SQLite)"
 arch=('x86_64')
diff --git a/packaging/linux/flatpak/com.queryahub.querya_desktop.metainfo.xml b/packaging/linux/flatpak/com.queryahub.querya_desktop.metainfo.xml
index 61bb49ff..d8a6efd4 100644
--- a/packaging/linux/flatpak/com.queryahub.querya_desktop.metainfo.xml
+++ b/packaging/linux/flatpak/com.queryahub.querya_desktop.metainfo.xml
@@ -30,6 +30,7 @@
     <binary>querya_desktop</binary>
   </provides>
   <releases>
+    <release version="0.4.19" date="2026-10-11"/>
     <release version="0.4.18" date="2026-09-28"/>
   </releases>
 </component>
diff --git a/pubspec.yaml b/pubspec.yaml
index 14821894..1a80a8f5 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -1,7 +1,7 @@
 name: querya_desktop
 description: Lightweight desktop SQL/NoSQL client. Flutter (Dart).
 publish_to: 'none' # app, never published to pub.dev (allows path dependencies)
-version: 0.4.18+1
+version: 0.4.22+5
 
 
 
@@ -60,6 +60,11 @@ dependency_overrides:
 
 flutter:
   uses-material-design: true
+  config:
+    # The vendored refresh_rate plugin's Package.swift points its target at
+    # ../Classes, outside the package root, so Swift Package Manager (on by
+    # default since Flutter 3.47) cannot resolve it; macOS builds use CocoaPods.
+    enable-swift-package-manager: false
   assets:
     - assets/images/
     - assets/themes/
diff --git a/scripts/ci/build_ext_tester.sh b/scripts/ci/build_ext_tester.sh
new file mode 100755
index 00000000..9fac212e
--- /dev/null
+++ b/scripts/ci/build_ext_tester.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Compiles querya-ext-tester to one static executable.
+#
+#   scripts/ci/build_ext_tester.sh build/ext-tester/querya-ext-tester
+#
+# `dart compile exe` refuses a package graph that has build hooks (sqlite3,
+# objective_c), and the app's graph has them. The tester itself is pure Dart
+# (lib/core/extensions + `package:path`), so it is built from a throwaway
+# package that is named like the app, holds only lib/core/extensions and
+# depends on `path`. Run it from the repository root; the output path is
+# relative to it.
+set -euo pipefail
+
+OUT="${1:?usage: build_ext_tester.sh <output-file, relative to the repo root>}"
+WORK="build/ext-tester-src"
+
+rm -rf "$WORK"
+mkdir -p "$WORK/lib/core" "$WORK/bin" "$(dirname "$OUT")"
+cp -R lib/core/extensions "$WORK/lib/core/extensions"
+cp bin/querya_ext_tester.dart "$WORK/bin/querya_ext_tester.dart"
+
+cat > "$WORK/pubspec.yaml" <<'YAML'
+name: querya_desktop
+description: Throwaway package that builds querya-ext-tester (see scripts/ci/build_ext_tester.sh).
+publish_to: none
+environment:
+  sdk: '>=3.5.0 <4.0.0'
+dependencies:
+  path: ^1.9.0
+YAML
+
+# The work directory is two levels below the repository root.
+(cd "$WORK" && dart pub get && dart compile exe bin/querya_ext_tester.dart -o "../../$OUT")
+rm -rf "$WORK"