diff --git a/l4d2web/tests/e2e/test_files_overlay.py b/l4d2web/tests/e2e/test_files_overlay.py
index 2dbd3bc..ca19ec4 100644
--- a/l4d2web/tests/e2e/test_files_overlay.py
+++ b/l4d2web/tests/e2e/test_files_overlay.py
@@ -453,3 +453,50 @@ def test_modal_close_on_escape_preserves_no_state(page: Page, files_overlay_serv
     _wait_for_routed_editor(page)
     reopened = page.evaluate("() => window.__filesEditor.getValue()")
     assert reopened == original_content
+
+
+def test_drag_row_to_folder_moves_file(page: Page, files_overlay_server) -> None:
+    """Drag the server.cfg row from the overlay root onto the cfg/
+    folder row. Asserts the file actually moved on disk AND the tree
+    reflects the move after the debounced HTMX refresh.
+
+    Exercises the internal-drag path in uploads.js:332-366 — the
+    `dataTransfer.setData("application/x-files-overlay", path)` →
+    `getData` round-trip → POST /files/move → schedule refresh of
+    both parents. Playwright's `locator.drag_to()` synthesizes the
+    `setData/getData` contract that this path relies on (it does NOT
+    require `webkitGetAsEntry`, which Playwright cannot fake).
+
+    Tree DOM gotcha: the cfg folder is collapsed by default, so its
+    children div is `hidden`. `scheduleRefresh("cfg")` still swaps
+    HTML into the hidden div — the new row exists in the DOM, just
+    not visible to a `to_be_visible` assertion. Using `to_have_count`
+    instead of `to_be_visible` accommodates this.
+    """
+    base = files_overlay_server["base_url"]
+    overlay_id = files_overlay_server["overlay_id"]
+    overlay_root = files_overlay_server["overlay_root"]
+    original_content = (overlay_root / "server.cfg").read_text()
+    _open_overlay(page, base, overlay_id)
+
+    # Scope to the row <li>, not any inner button — delete-action
+    # buttons also carry data-target-path + data-row-kind, so a bare
+    # attribute selector resolves to multiple elements and trips
+    # strict mode.
+    source = page.locator('li.file-tree-row-file[data-target-path="server.cfg"]')
+    target = page.locator('li.file-tree-row-dir[data-target-path="cfg"]')
+    source.drag_to(target)
+
+    # Wait for both refreshes to land: old row gone from root, new row
+    # present (though hidden) inside cfg's children div.
+    expect(
+        page.locator('.file-tree-row-file[data-target-path="server.cfg"]')
+    ).to_have_count(0, timeout=5000)
+    expect(
+        page.locator('.file-tree-row-file[data-target-path="cfg/server.cfg"]')
+    ).to_have_count(1, timeout=5000)
+
+    # Disk is the load-bearing assertion — proves /files/move actually
+    # moved bytes, not just shuffled DOM rows.
+    assert not (overlay_root / "server.cfg").exists()
+    assert (overlay_root / "cfg" / "server.cfg").read_text() == original_content