Issue #3 (black screen at restore before content paints): - assembleHybridPageHost sets the content WebContentsView background to the theme fill so an un-painted view never shows macOS black over the host fill. - Shared overlay paints a favicon+spinner loading card over the content rect while a never-painted window (fresh/restore/deferred) is loading, removed on settle. Gated on a new firstLoad flag (registry perHostPainted, set on first did-stop-loading) so in-page navigations of already-painted windows keep the old page visible. Favicon sourced from the datastore (new getFaviconForUrl read helper) via page-overlay:active + page:loading; spinner-only fallback. Issue #1 (load-error Retry has no cap): - Registry tracks a per-host outstanding-failure + attempt record (separate from the flickering load-error state) reset only on genuine success or a different failing URL. The page:reload chokepoint caps same-URL Retry at HYBRID_SAME_URL_RETRY_CAP; normal Cmd+R / window-reuse reloads are never throttled. At the cap main publishes page:retry-capped and the overlay disables Retry instead of hammering the URL. No wall-clock timer. Tests: registry unit (first-paint + retry-cap arithmetic/reset/teardown), datastore getFaviconForUrl, and Playwright hybrid-loading-card + hybrid-retry-cap.