diff --git a/.gitignore b/.gitignore
index 46a7e87..628b4dd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -33,3 +33,6 @@
 # embargo guard denylist — digests of low-entropy tokens are crackable, so the
 # denylist is never committed (see scripts/embargo-guard.mjs)
 /.embargo-guard.local.json
+
+# Root-level tooling artifacts (cockpit/ui has its own ignore for its tree).
+node_modules/
diff --git a/CLAUDE.md b/CLAUDE.md
index d1d3b6d..d293684 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,5 +1,43 @@
 # CLAUDE.md
 
+<!-- BEGIN: ACTIVE-SESSION-PICKUP — remove this block when feat/plugin-runtime (PR #49) merges to main -->
+## Active session pickup
+
+If the current branch is `feat/plugin-runtime` (check with `git rev-parse --abbrev-ref HEAD`), read
+the **State summary** in [`docs/STATUS.md`](docs/STATUS.md) and the **"Smoke run 3"** section of
+[`spikes/SPIKE-RESULTS.md`](spikes/SPIKE-RESULTS.md) before doing anything else.
+
+The one-line version: **the smoke is finished. Part 1 and the packaged Part 2 have both been run,
+and #49 is READY FOR REVIEW with all 18 CI checks green** — it is waiting on a human merge decision,
+nothing else. Run 3 scored **9 PASS / 2 BLOCKED / 2 NOT RUN / 0 FAIL** and closed five defects:
+**D-7** (view-plugins got no state — `DataCloneError` posting Svelte `$state` proxies), **D-8** (the
+packaged bundle shipped **no plugin root at all**, so no shipped build could load a view-plugin),
+**D-2** (every plugin was granted every capability; now fails closed), **D-4** (re-verified packaged:
+exit in 0.23 s cold, 5.27 s with 10 containers), and **D-5** (investigated, **did not reproduce**).
+
+Traps, updated:
+- **Items 1.2 / 1.4a / 1.7 are BLOCKED, not broken**, behind **D-3**: fleetd serves no CORS headers,
+  so no browser `fetch` from the cockpit reaches the daemon. **Pre-existing on `main`** — the FLEET
+  ops grid renders nothing because of this. Don't chase it as a #49 regression; it needs its own issue.
+- **Assert Gate 5 with `docker ps -a`, not `docker ps`.** `docker ps` cannot see the `Created` /
+  `Exited` residue teardown leaves, and that residue breaks the *next* launch with a name conflict.
+- **Quit the cockpit gracefully, never `Stop-Process`,** when testing Gate 5 — a force-kill skips
+  `stop_all_owned` and fabricates a teardown failure.
+- **A clean packaged run shows no AUDIENCE tab, and that is correct.** `PluginManager::roots()` has
+  no packaged resource root by design; app-plugins come from `CC_APP_PLUGINS_DEV` or
+  `~/.command-center/app-plugins`. Set `CC_APP_PLUGINS_DEV` to drive AUDIENCE, and record it as
+  "packaged binary, dev discovery seam".
+- **A release build has no devtools.** F12 does nothing, so any check whose criterion is a console
+  reading is NOT RUN when packaged — decide that up front rather than mid-session.
+- **"CI never builds the app" is FALSE.** `ci.yml:311` runs `tauri build` on all three OSes. What no
+  gate does is look *inside* the bundle — which is exactly how D-8 passed a *successful* build. This
+  is `GAP-132` in [`docs/testing/PLAN.md`](docs/testing/PLAN.md).
+- **"Images are prebuilt so there's no build" is false** — `compose build` runs regardless. Though in
+  run 3 the images already existed and the ramp took ~15 s, not 20 min.
+
+If the branch has changed, this section and its links are stale — delete this block.
+<!-- END: ACTIVE-SESSION-PICKUP -->
+
 Project conventions live in the global `~/.claude/CLAUDE.md` and this project's memory store
 (`MEMORY.md` index, auto-loaded at session start).
 
diff --git a/cockpit/plugin-sdk/index.d.ts b/cockpit/plugin-sdk/index.d.ts
new file mode 100644
index 0000000..c6e7fdc
--- /dev/null
+++ b/cockpit/plugin-sdk/index.d.ts
@@ -0,0 +1,84 @@
+// Type declarations for the cockpit view-plugin SDK (hand-written; the runtime is
+// plain browser ESM in index.js). Mirrors the host bridge protocol.
+
+export type PluginTier = 't1' | 't2' | 't3';
+export type PluginMode = 'demo' | 'real';
+export type PluginUnitAction = 'halt' | 'resume' | 'abandon' | 'ship';
+
+export interface LogDelta {
+  seq: number;
+  stream: string;
+  line: string;
+}
+
+/** A unit projection minus its heavy log (history capped by the host). */
+export interface UnitLite {
+  id: string;
+  task: string;
+  tier: string;
+  phase: string;
+  history: string[];
+  cost: number;
+  usdCap: number;
+  tokensIn: number;
+  tokensOut: number;
+  iters: { build: number; check: number; review: number };
+  findings: { round: number; title: string; severity: string; resolved: boolean }[];
+  oracleFiles: string[];
+  branch?: string;
+  pr?: string;
+  blocked?: string;
+  awaitingSlot: boolean;
+  rateLimited: boolean;
+  error?: string;
+  result?: string;
+  lastSeq: number;
+}
+
+export interface StateMessage {
+  v: 1;
+  type: 'state';
+  full: boolean;
+  changed: UnitLite[];
+  removed: string[];
+  order: string[];
+  degraded: boolean;
+}
+
+export interface CommandAck {
+  v: 1;
+  type: 'command-ack';
+  reqId: string;
+  ok: boolean;
+  reasonClass?: string;
+}
+
+export interface LaunchReq {
+  task: string;
+  tier: PluginTier;
+  mode: PluginMode;
+  min_review_rounds?: number;
+}
+
+export interface PluginClient {
+  apiVersion?: number;
+  capabilities: string[];
+  onState(cb: (s: StateMessage) => void): () => void;
+  onLog(cb: (unitId: string, lines: LogDelta[]) => void): () => void;
+  onReset(cb: () => void): () => void;
+  onAck(cb: (ack: CommandAck) => void): () => void;
+  launch(req: LaunchReq): Promise<CommandAck>;
+  command(unitId: string, action: PluginUnitAction): Promise<CommandAck>;
+}
+
+export interface ConnectOpts {
+  scope?: unknown;
+  parent?: unknown;
+  timeoutMs?: number;
+}
+
+export function connect(opts?: ConnectOpts): Promise<PluginClient>;
+export function attach(
+  port: MessagePort,
+  init?: { apiVersion?: number; capabilities?: string[] },
+): PluginClient;
diff --git a/cockpit/plugin-sdk/index.js b/cockpit/plugin-sdk/index.js
new file mode 100644
index 0000000..6bcc902
--- /dev/null
+++ b/cockpit/plugin-sdk/index.js
@@ -0,0 +1,155 @@
+// @ts-nocheck
+// Cockpit view-plugin SDK (Lane V) — bundled convenience for UNTRUSTED plugins that run
+// in a sandboxed iframe. It speaks the MessagePort protocol the host bridge expects:
+//
+//   connect() → posts `plugin-hello` to the parent, awaits the host's `init` (which
+//   transfers a private MessagePort), replies `ready`, then exposes typed callbacks and
+//   promise-returning command verbs. All traffic after the handshake is on the port.
+//
+// The plugin never sees the daemon URL, host DOM, storage, or network — only this port.
+// `connect()` accepts an injectable `scope`/`parent` purely so it is testable off a real
+// window; in the iframe it defaults to `window` / `window.parent`.
+
+const PROTOCOL_VERSION = 1;
+
+/**
+ * Perform the plugin-announces-ready handshake and resolve to a connected client.
+ * @param {{ scope?: any, parent?: any, timeoutMs?: number }} [opts]
+ * @returns {Promise<PluginClient>}
+ */
+export function connect(opts = {}) {
+  const scope = opts.scope ?? (typeof window !== 'undefined' ? window : undefined);
+  const parent = opts.parent ?? (scope ? scope.parent : undefined);
+  if (!scope || !parent) {
+    return Promise.reject(new Error('cockpit-sdk: no window/parent to connect through'));
+  }
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let timer = null;
+
+    function onMessage(e) {
+      const d = e && e.data;
+      if (!d || d.v !== PROTOCOL_VERSION || d.type !== 'init') return;
+      const port = e.ports && e.ports[0];
+      if (!port) return;
+      settled = true;
+      if (timer !== null) clearTimeout(timer);
+      scope.removeEventListener('message', onMessage);
+      resolve(attach(port, d));
+    }
+
+    scope.addEventListener('message', onMessage);
+    // The plugin announces readiness FIRST (avoids a host `load`-post race). `"*"` is safe:
+    // the hello is non-sensitive and the sandbox frame's real origin is the unusable "null".
+    parent.postMessage({ v: PROTOCOL_VERSION, type: 'plugin-hello' }, '*');
+
+    if (opts.timeoutMs) {
+      timer = setTimeout(() => {
+        if (settled) return;
+        scope.removeEventListener('message', onMessage);
+        reject(new Error('cockpit-sdk: handshake timed out'));
+      }, opts.timeoutMs);
+    }
+  });
+}
+
+/**
+ * Wrap an already-transferred MessagePort as a client. Exposed for tests that drive the
+ * port directly (the normal path is `connect()`).
+ * @param {MessagePort} port
+ * @param {{ apiVersion?: number, capabilities?: string[] }} init
+ * @returns {PluginClient}
+ */
+export function attach(port, init = {}) {
+  const stateCbs = [];
+  const logCbs = [];
+  const resetCbs = [];
+  const ackCbs = [];
+  const pending = new Map(); // reqId → resolve
+  let reqSeq = 0;
+
+  port.onmessage = (e) => {
+    const m = e && e.data;
+    if (!m || m.v !== PROTOCOL_VERSION) return;
+    switch (m.type) {
+      case 'state':
+        for (const cb of stateCbs) cb(m);
+        break;
+      case 'log-append':
+        for (const cb of logCbs) cb(m.unitId, m.lines);
+        break;
+      case 'log-reset':
+        for (const cb of resetCbs) cb();
+        break;
+      case 'command-ack': {
+        for (const cb of ackCbs) cb(m);
+        const resolve = pending.get(m.reqId);
+        if (resolve) {
+          pending.delete(m.reqId);
+          resolve(m);
+        }
+        break;
+      }
+      default:
+        // forward-compatible: ignore unknown host messages
+        break;
+    }
+  };
+  if (port.start) port.start();
+
+  // Reply `ready` — the host answers with a full `state` snapshot.
+  port.postMessage({ v: PROTOCOL_VERSION, type: 'ready' });
+
+  function send(payload) {
+    const reqId = `p${reqSeq++}`;
+    return new Promise((resolve) => {
+      pending.set(reqId, resolve);
+      port.postMessage({ v: PROTOCOL_VERSION, type: 'command', reqId, ...payload });
+    });
+  }
+
+  return {
+    apiVersion: init.apiVersion,
+    capabilities: init.capabilities ?? [],
+    /** Dirty-delta (or full) state pushes: `{ full, changed, removed, order, degraded }`. */
+    onState(cb) {
+      stateCbs.push(cb);
+      return () => {
+        const i = stateCbs.indexOf(cb);
+        if (i >= 0) stateCbs.splice(i, 1);
+      };
+    },
+    /** Append-only log deltas: `(unitId, lines)` where each line is `{ seq, stream, line }`. */
+    onLog(cb) {
+      logCbs.push(cb);
+      return () => {
+        const i = logCbs.indexOf(cb);
+        if (i >= 0) logCbs.splice(i, 1);
+      };
+    },
+    /** Fired on a daemon-stream reconnect: discard per-unit log cursors (a full state follows). */
+    onReset(cb) {
+      resetCbs.push(cb);
+      return () => {
+        const i = resetCbs.indexOf(cb);
+        if (i >= 0) resetCbs.splice(i, 1);
+      };
+    },
+    /** Every `command-ack`, correlated by `reqId` (also resolves the originating promise). */
+    onAck(cb) {
+      ackCbs.push(cb);
+      return () => {
+        const i = ackCbs.indexOf(cb);
+        if (i >= 0) ackCbs.splice(i, 1);
+      };
+    },
+    /** Request a launch. Resolves to the `command-ack` (ok, or rejected with reasonClass). */
+    launch(req) {
+      return send({ launch: req });
+    },
+    /** Request a unit command (halt/resume/abandon/ship). Resolves to its `command-ack`. */
+    command(unitId, action) {
+      return send({ unit: { id: unitId, action } });
+    },
+  };
+}
diff --git a/cockpit/plugin-sdk/package.json b/cockpit/plugin-sdk/package.json
new file mode 100644
index 0000000..28be614
--- /dev/null
+++ b/cockpit/plugin-sdk/package.json
@@ -0,0 +1,16 @@
+{
+  "name": "@cockpit/plugin-sdk",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Bundled convenience SDK for cockpit view plugins (sandboxed-iframe MessagePort client).",
+  "type": "module",
+  "main": "index.js",
+  "module": "index.js",
+  "types": "index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "import": "./index.js"
+    }
+  }
+}
diff --git a/cockpit/ui/src-tauri/Cargo.toml b/cockpit/ui/src-tauri/Cargo.toml
index af109e4..15eca6a 100644
--- a/cockpit/ui/src-tauri/Cargo.toml
+++ b/cockpit/ui/src-tauri/Cargo.toml
@@ -25,7 +25,12 @@ serde_json = "1.0"
 serde = { version = "1.0", features = ["derive"] }
 thiserror = "2"
 log = "0.4"
-tauri = { version = "2.11.2", features = [] }
+# LANE-A (app-plugins): the child-webview embedding layer needs Tauri's `unstable`
+# feature (multiwebview: create/position/show/hide child webviews). `unstable` is
+# explicitly NOT semver-stable, so the version is PINNED with `=` — a patch bump can
+# silently change or remove the unstable webview APIs. Note for CI/upgrade docs: bumping
+# this line requires re-verifying the embedding smoke (spec §6 step 0), not a blind bump.
+tauri = { version = "=2.11.2", features = ["unstable"] }
 tauri-plugin-log = "2"
 tauri-plugin-shell = "2"
 # LANE-P (packaging): activate the updater runtime so the `plugins.updater`
diff --git a/cockpit/ui/src-tauri/app-plugins/audience/app-plugin.json b/cockpit/ui/src-tauri/app-plugins/audience/app-plugin.json
new file mode 100644
index 0000000..361532e
--- /dev/null
+++ b/cockpit/ui/src-tauri/app-plugins/audience/app-plugin.json
@@ -0,0 +1,42 @@
+{
+  "id": "audience",
+  "name": "Audience",
+  "apiVersion": 1,
+  "icon": "icon.svg",
+  "url": "http://localhost:3000",
+
+  "lifecycle": {
+    "managed": true,
+    "cwd": "D:/MajorProjects/CURRENT/audience",
+
+    "build": {
+      "cmd": "docker compose -f docker-compose.prod.yml build",
+      "args": {
+        "NODE_ENV": "development",
+        "AI_PROVIDER": "fake",
+        "MEDIA_PROVIDER": "fake"
+      },
+      "timeout": 1200000
+    },
+
+    "start": "docker compose -f docker-compose.prod.yml up",
+    "stop": "docker compose -f docker-compose.prod.yml down",
+
+    "env": {
+      "NODE_ENV": "development",
+      "AI_PROVIDER": "fake",
+      "MEDIA_PROVIDER": "fake",
+      "DEV_WORKSPACE_ID": "ws_dev_cockpit",
+      "DEV_USER_ID": "user_dev_cockpit"
+    },
+
+    "health": { "url": "http://localhost:8080/health", "okStatus": [200], "timeout": 180000, "interval": 1000 },
+    "ready":  { "url": "http://localhost:3000", "okStatus": [200, 204, 301, 302, 307, 308], "timeout": 180000, "interval": 1000 }
+  },
+
+  "webview": {
+    "popups": "allow",
+    "externalLinks": "in-app",
+    "title": "Audience"
+  }
+}
diff --git a/cockpit/ui/src-tauri/capabilities/default.json b/cockpit/ui/src-tauri/capabilities/default.json
index 703ac70..6722c5e 100644
--- a/cockpit/ui/src-tauri/capabilities/default.json
+++ b/cockpit/ui/src-tauri/capabilities/default.json
@@ -1,23 +1,43 @@
-{
-  "$schema": "../gen/schemas/desktop-schema.json",
-  "identifier": "default",
-  "description": "enables the default permissions",
-  "windows": [
-    "main"
-  ],
-  "permissions": [
-    "core:default",
-    {
-      "identifier": "shell:allow-execute",
-      "allow": [
-        {
-          "name": "binaries/fleetd-serve",
-          "sidecar": true,
-          "args": true
-        }
-      ]
-    },
-    "shell:allow-kill",
-    "updater:default"
-  ]
-}
+[
+  {
+    "$schema": "../gen/schemas/desktop-schema.json",
+    "identifier": "default",
+    "description": "enables the default permissions",
+    "windows": [
+      "main"
+    ],
+    "permissions": [
+      "core:default",
+      {
+        "identifier": "shell:allow-execute",
+        "allow": [
+          {
+            "name": "binaries/fleetd-serve",
+            "sidecar": true,
+            "args": true
+          }
+        ]
+      },
+      "shell:allow-kill",
+      "updater:default"
+    ]
+  },
+  {
+    "identifier": "app-plugins",
+    "description": "Host control of trusted app-plugin child webviews. The glob MUST match the webview-label scheme `app::<id>` (spec §6 step 0). Scoped with `webviews` and NO `windows` so it applies only to app-plugin webviews, never the main shell. Deliberately EXCLUDES core:default and the shell permissions: app content (e.g. Audience) gets no host IPC bridge — spec §5 'no host<->app data bridge'. Only the host-side visibility/position/focus commands the embedding layer (plugin_show/plugin_hide/plugin_set_rect) drives are granted.",
+    "webviews": [
+      "app::*"
+    ],
+    "permissions": [
+      "core:webview:allow-create-webview",
+      "core:webview:allow-set-webview-position",
+      "core:webview:allow-set-webview-size",
+      "core:webview:allow-set-webview-focus",
+      "core:webview:allow-webview-show",
+      "core:webview:allow-webview-hide",
+      "core:webview:allow-webview-position",
+      "core:webview:allow-webview-close",
+      "core:webview:allow-reparent"
+    ]
+  }
+]
diff --git a/cockpit/ui/src-tauri/src/embedding.rs b/cockpit/ui/src-tauri/src/embedding.rs
new file mode 100644
index 0000000..22f0bae
--- /dev/null
+++ b/cockpit/ui/src-tauri/src/embedding.rs
@@ -0,0 +1,153 @@
+// App-plugin child-webview embedding (Lane S integration of the Lane A contract bundle;
+// P3 spike `spike/app-plugins-webview-v2` carry-forward).
+//
+// These three commands are the trusted Rust surface the Svelte shell drives to composite a
+// child webview (a whole first-party web app) under a Svelte-owned content rect.
+//
+// TWO load-bearing findings from the P3 spike are baked in here:
+//  1. The commands are `async`. A *synchronous* command runs on the main (event-loop)
+//     thread, but `add_child` / `set_position` post a message to that same loop and block
+//     on it — a sync command deadlocks itself (the `spike_show` hang). As `async` commands
+//     they run on an async-runtime worker, leaving the loop free to pump webview creation.
+//  2. Inactive webviews are PARKED off-screen, never `hide()`d. WebView2 `hide()`→`show()`
+//     forces a repaint/reload (loses scroll/app state); moving the view off-screen keeps its
+//     render tree warm. A small warm-pool LRU bounds how many kept-warm webviews live.
+//
+// Webview label scheme is `app::<id>` — stable across relaunch/adopt, and matched by the
+// `webviews: ["app::*"]` capability glob in `capabilities/default.json`.
+
+use crate::plugins::manager::PluginManager;
+use std::collections::HashMap;
+use std::sync::Mutex;
+use tauri::{
+    webview::WebviewBuilder, AppHandle, LogicalPosition, LogicalSize, Manager, State, WebviewUrl,
+};
+
+/// The CSS/logical rect the Svelte placeholder reports (device-independent px, relative to
+/// the host window's content area). Mirrors the `DOMRect` fields the shell emits.
+#[derive(Debug, Clone, Copy, serde::Deserialize)]
+pub struct Rect {
+    pub x: f64,
+    pub y: f64,
+    pub width: f64,
+    pub height: f64,
+}
+
+/// How many kept-warm (parked) webviews we keep before destroying the least-recently-used.
+const WARM_CAP: usize = 3;
+/// Park origin: far enough off-screen that no sliver paints, near enough to stay a valid
+/// logical coordinate. The render tree stays ALIVE here (no hide()/show() repaint-reload).
+const PARK_X: f64 = -32000.0;
+const PARK_Y: f64 = -32000.0;
+/// The host window created by tauri.conf.json (its only `windows[]` entry) gets the
+/// default label "main".
+const HOST_WINDOW_LABEL: &str = "main";
+
+/// Webview label for an app plugin. Stable across relaunch/adopt; matches the `app::*`
+/// capability glob.
+pub fn app_label(id: &str) -> String {
+    format!("app::{id}")
+}
+
+/// Warm-pool bookkeeping: MRU-ordered labels + each label's last on-screen rect. Kept as
+/// host state via `.manage(WebviewPool::default())`.
+#[derive(Default)]
+pub struct WebviewPool {
+    lru: Mutex<Vec<String>>,
+    last_rect: Mutex<HashMap<String, Rect>>,
+}
+
+impl WebviewPool {
+    /// Mark `label` most-recently-used and evict past the warm cap (destroying the LRU
+    /// victim's webview so memory is bounded — the next show recreates it).
+    fn touch_and_evict(&self, app: &AppHandle, label: &str, rect: Rect) {
+        self.last_rect
+            .lock()
+            .unwrap()
+            .insert(label.to_string(), rect);
+        let mut lru = self.lru.lock().unwrap();
+        lru.retain(|l| l != label);
+        lru.insert(0, label.to_string());
+        while lru.len() > WARM_CAP {
+            if let Some(victim) = lru.pop() {
+                if let Some(wv) = app.get_webview(&victim) {
+                    let _ = wv.close();
+                }
+                self.last_rect.lock().unwrap().remove(&victim);
+            }
+        }
+    }
+}
+
+/// First show → create the child webview over the reserved rect (call only once the plugin
+/// is `healthy`); later shows → reposition + bring on-screen + focus. Async: webview
+/// create/show MUST run off the main thread (see module docs — sync deadlocks).
+#[tauri::command]
+pub async fn plugin_show(
+    app: AppHandle,
+    mgr: State<'_, PluginManager>,
+    pool: State<'_, WebviewPool>,
+    id: String,
+    rect: Rect,
+) -> Result<(), String> {
+    let label = app_label(&id);
+    if let Some(wv) = app.get_webview(&label) {
+        wv.set_position(LogicalPosition::new(rect.x, rect.y))
+            .map_err(|e| format!("set_position: {e}"))?;
+        wv.set_size(LogicalSize::new(rect.width, rect.height))
+            .map_err(|e| format!("set_size: {e}"))?;
+        wv.set_focus().map_err(|e| format!("set_focus: {e}"))?;
+    } else {
+        let url_str = mgr
+            .url_for(&id)
+            .ok_or_else(|| format!("no url for plugin {id} (launch it first?)"))?;
+        let url: tauri::Url = url_str
+            .parse()
+            .map_err(|e| format!("bad plugin url {url_str}: {e}"))?;
+        let window = app
+            .get_window(HOST_WINDOW_LABEL)
+            .ok_or_else(|| format!("host window '{HOST_WINDOW_LABEL}' not found"))?;
+        // THE `unstable` call: attach a child webview to the existing host window.
+        let wv = window
+            .add_child(
+                WebviewBuilder::new(&label, WebviewUrl::External(url)),
+                LogicalPosition::new(rect.x, rect.y),
+                LogicalSize::new(rect.width, rect.height),
+            )
+            .map_err(|e| format!("add_child: {e}"))?;
+        wv.set_focus().map_err(|e| format!("set_focus: {e}"))?;
+    }
+    pool.touch_and_evict(&app, &label, rect);
+    Ok(())
+}
+
+/// Switch-away / host-overlay-open → PARK off-screen (keep the render tree warm), do NOT
+/// destroy and do NOT `hide()` (which would force a repaint/reload on the next show).
+#[tauri::command]
+pub async fn plugin_hide(app: AppHandle, id: String) -> Result<(), String> {
+    if let Some(wv) = app.get_webview(&app_label(&id)) {
+        wv.set_position(LogicalPosition::new(PARK_X, PARK_Y))
+            .map_err(|e| format!("park: {e}"))?;
+    }
+    Ok(())
+}
+
+/// ResizeObserver-driven: keep the native webview glued to the reserved box on window
+/// resize / layout change. Async for the same main-thread reason as `plugin_show`.
+#[tauri::command]
+pub async fn plugin_set_rect(
+    app: AppHandle,
+    pool: State<'_, WebviewPool>,
+    id: String,
+    rect: Rect,
+) -> Result<(), String> {
+    let label = app_label(&id);
+    if let Some(wv) = app.get_webview(&label) {
+        wv.set_position(LogicalPosition::new(rect.x, rect.y))
+            .map_err(|e| format!("set_position: {e}"))?;
+        wv.set_size(LogicalSize::new(rect.width, rect.height))
+            .map_err(|e| format!("set_size: {e}"))?;
+        pool.last_rect.lock().unwrap().insert(label, rect);
+    }
+    Ok(())
+}
diff --git a/cockpit/ui/src-tauri/src/lib.rs b/cockpit/ui/src-tauri/src/lib.rs
index c5c21aa..11cecdb 100644
--- a/cockpit/ui/src-tauri/src/lib.rs
+++ b/cockpit/ui/src-tauri/src/lib.rs
@@ -1,5 +1,28 @@
+use std::sync::atomic::{AtomicBool, Ordering};
 use tauri::Manager;
 
+/// Gate-5 shutdown re-entrancy guard (smoke item 1.9b).
+///
+/// `AppHandle::exit` re-emits `RunEvent::ExitRequested`. If the handler calls
+/// `api.prevent_exit()` unconditionally, the exit it requests re-enters the handler, which
+/// prevents it again — so the process never exits and spins the event loop at ~100% of one
+/// core with no window. Measured in Smoke run 2: 309 s of CPU burned after a graceful close.
+///
+/// The FIRST exit request must be prevented, so teardown gets to run. Every later one must be
+/// allowed through.
+#[derive(Default)]
+pub struct ShutdownGuard(AtomicBool);
+
+impl ShutdownGuard {
+    /// True exactly once — for the first exit request only.
+    pub fn should_prevent_exit(&self) -> bool {
+        !self.0.swap(true, Ordering::SeqCst)
+    }
+}
+
+/// One guard per process; there is exactly one `run()` per process.
+static SHUTDOWN_GUARD: ShutdownGuard = ShutdownGuard(AtomicBool::new(false));
+
 mod plugins;
 // LANE-A → SHELL contract: the dashboard's read-seam Tauri commands (§6.1/§6.2).
 mod dashboard;
@@ -7,6 +30,11 @@ mod dashboard;
 mod sidecar;
 // U4 (spec §4, §6): filesystem discovery + raw reads for the `local` dashboard source.
 mod local_projects;
+// PLUGIN RUNTIME (Lane S integration):
+//  - `view_plugins`: the `ccplugin://` scheme serving sandboxed view-plugin assets (Lane V).
+//  - `embedding`: the app-plugin child-webview show/hide/set_rect commands (Lane A).
+mod embedding;
+mod view_plugins;
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
@@ -16,12 +44,24 @@ pub fn run() {
         // LANE-B → HOST: holds the live fleetd-serve child so the shutdown hook
         // can kill it (no orphaned sidecar) and the supervisor can restart it.
         .manage(sidecar::SidecarSupervisor::default())
+        // PLUGIN RUNTIME (Lane S): warm-pool bookkeeping for app-plugin child webviews.
+        .manage(embedding::WebviewPool::default())
+        // PLUGIN RUNTIME (Lane S): serve sandboxed view-plugin assets over `ccplugin://`
+        // with the plugin-doc CSP + ACAO headers (P4 spike findings). Registered on the
+        // builder so it works in BOTH `tauri dev` and a packaged build.
+        .register_uri_scheme_protocol(view_plugins::SCHEME, |ctx, req| {
+            view_plugins::respond(ctx.app_handle(), req)
+        })
         // LANE-A → SHELL contract: register the dashboard read-seam commands so the
         // frontend's `invoke('halyard_status'|'halyard_queue'|'audience_health'|
         // 'audience_posts')` resolve. Additive only — remove nothing here.
         .invoke_handler(tauri::generate_handler![
             plugins::manager::plugins_list,
             plugins::manager::plugin_launch,
+            // PLUGIN RUNTIME (Lane S): app-plugin child-webview embedding (Lane A bundle).
+            embedding::plugin_show,
+            embedding::plugin_hide,
+            embedding::plugin_set_rect,
             dashboard::halyard_status,
             dashboard::halyard_queue,
             dashboard::audience_health,
@@ -59,6 +99,13 @@ pub fn run() {
         .expect("error while building tauri application")
         .run(|app_handle, event| {
             if let tauri::RunEvent::ExitRequested { api, .. } = event {
+                // `app_handle.exit(0)` below re-emits `ExitRequested`. Preventing that
+                // re-entry too would call this handler forever: the process never exits and
+                // spins the event loop at ~100% of a core with no window (Gate-5 item 1.9b,
+                // measured at 309 s of CPU in Smoke run 2). Let every later request through.
+                if !SHUTDOWN_GUARD.should_prevent_exit() {
+                    return;
+                }
                 api.prevent_exit();
                 // LANE-B → HOST: stop the fleetd-serve sidecar first so the
                 // supervisor doesn't respawn it as we tear down, and no
@@ -87,3 +134,29 @@ pub fn run() {
             }
         });
 }
+
+#[cfg(test)]
+mod shutdown_guard_tests {
+    use super::ShutdownGuard;
+
+    /// Pins Gate-5 item 1.9b. `AppHandle::exit` re-emits `ExitRequested`; if that re-entry is
+    /// prevented too, the handler calls itself forever and the process spins instead of
+    /// exiting. Delete the `swap` in `should_prevent_exit` and this goes red.
+    #[test]
+    fn only_the_first_exit_request_is_prevented() {
+        let guard = ShutdownGuard::default();
+
+        assert!(
+            guard.should_prevent_exit(),
+            "the first ExitRequested must be prevented so teardown can run"
+        );
+        assert!(
+            !guard.should_prevent_exit(),
+            "the exit(0) re-entry must NOT be prevented, or the app never exits"
+        );
+        assert!(
+            !guard.should_prevent_exit(),
+            "every later exit request must also be allowed through"
+        );
+    }
+}
diff --git a/cockpit/ui/src-tauri/src/plugins/manager.rs b/cockpit/ui/src-tauri/src/plugins/manager.rs
index c5ab8f2..8079a55 100644
--- a/cockpit/ui/src-tauri/src/plugins/manager.rs
+++ b/cockpit/ui/src-tauri/src/plugins/manager.rs
@@ -7,7 +7,7 @@ use std::collections::HashMap;
 use std::path::PathBuf;
 use std::sync::Mutex;
 use std::time::{Duration, Instant};
-use tauri::{AppHandle, State};
+use tauri::{AppHandle, Manager, State};
 
 /// One launched plugin's runtime record.
 pub struct Running {
@@ -26,9 +26,17 @@ pub struct PluginManager {
 }
 
 impl PluginManager {
-    /// Discovery roots: the per-user plugins dir. (A dev-list root can be added later.)
+    /// Discovery roots (spec §2 seam: dev list ∪ user dir). Ordered so LATER roots
+    /// win on `id` collision (discovery dedupes with later-wins): the dev-list root is
+    /// placed first and the per-user dir last, so a user-installed plugin overrides a
+    /// dev-checkout one of the same id. The dev-list root is opt-in via the
+    /// `CC_APP_PLUGINS_DEV` env var (points at e.g. this repo's
+    /// `cockpit/ui/src-tauri/app-plugins/`), keeping machine paths out of the binary.
     pub fn roots() -> Vec<PathBuf> {
         let mut v = Vec::new();
+        if let Some(dev) = std::env::var_os("CC_APP_PLUGINS_DEV") {
+            v.push(PathBuf::from(dev));
+        }
         if let Some(home) = home_dir() {
             v.push(home.join(".command-center/app-plugins"));
         }
@@ -57,16 +65,9 @@ impl PluginManager {
         let discovered = self.discovered.lock().unwrap().clone();
         let deadline = Instant::now() + Duration::from_millis(total_deadline_ms);
 
-        let handles: Vec<_> = running
+        let handles: Vec<_> = teardown_targets(&running, &discovered)
             .into_iter()
-            .filter(|(_, r)| r.owned)
-            .filter_map(|(id, _r)| {
-                let found = discovered
-                    .iter()
-                    .find(|d| d.manifest.id == id)
-                    .map(|d| (d.manifest.clone(), d.dir.clone()))?;
-                Some(std::thread::spawn(move || stop_one(&found.0, &found.1)))
-            })
+            .map(|(m, dir)| std::thread::spawn(move || stop_one(&m, &dir)))
             .collect();
 
         for h in handles {
@@ -78,6 +79,29 @@ impl PluginManager {
     }
 }
 
+/// Which plugins a teardown pass must stop: OWNED entries resolved against discovery.
+/// Adopted (not-owned) stacks are excluded — the user started those by hand — and a running
+/// id with no surviving discovery record is skipped rather than panicking.
+///
+/// Split out of `stop_all_owned` so the *selection* half of Gate 5 is unit-testable. The
+/// *execution* half (`stop_one`, which shells out to the manifest's `docker compose down`)
+/// needs a Docker daemon; CI has none, so that half stays a human smoke gate.
+fn teardown_targets(
+    running: &HashMap<String, Running>,
+    discovered: &[DiscoveredPlugin],
+) -> Vec<(Manifest, PathBuf)> {
+    running
+        .iter()
+        .filter(|(_, r)| r.owned)
+        .filter_map(|(id, _r)| {
+            discovered
+                .iter()
+                .find(|d| &d.manifest.id == id)
+                .map(|d| (d.manifest.clone(), d.dir.clone()))
+        })
+        .collect()
+}
+
 fn home_dir() -> Option<PathBuf> {
     std::env::var_os("USERPROFILE")
         .or_else(|| std::env::var_os("HOME"))
@@ -121,6 +145,22 @@ pub fn plugins_list(mgr: State<'_, PluginManager>) -> Vec<serde_json::Value> {
     out
 }
 
+/// Dispatch a plugin's start sequence onto a background thread and return immediately.
+///
+/// PHASE-6 SMOKE FINDING (checklist 1.5). This used to call `run_start_sequence` inline, with
+/// a standing note that it "may block up to the probe timeout (~180 s)". The smoke proved it
+/// out: a *synchronous* Tauri command runs on the main event-loop thread — the same P3 finding
+/// that forced the embedding commands to be `async` (see `embedding.rs`) — and the sequence
+/// blocks on `docker compose build` (a 20-minute budget for Audience) plus the health and
+/// ready probe budgets. The entire UI froze from the tab click until the stack came up.
+///
+/// A dedicated OS thread, deliberately not an async-runtime worker: every seam in the sequence
+/// is blocking (`Command::status`, `ureq`, `thread::sleep`), so handing it to the runtime would
+/// starve a worker and merely relocate the stall.
+///
+/// **Ok means "dispatched", not "healthy".** Lifecycle truth reaches the shell only through the
+/// `plugin://state` events the sink emits, which `App.svelte` already subscribes to; it must not
+/// treat this returning as readiness. Pinned by `src/App.appPlugin.test.ts`.
 #[tauri::command]
 pub fn plugin_launch(
     app: AppHandle,
@@ -139,31 +179,241 @@ pub fn plugin_launch(
         return Err(format!("unknown plugin {id}"));
     };
 
-    let probe = HttpProbe;
-    let clock = RealClock::new();
-    let sink = TauriEventSink { app: app.clone() };
-    let images_present = probe.probe(&disc.manifest.lifecycle.health.url).is_some();
-
-    // NOTE: this call is synchronous and may block up to the probe timeout (~180 s).
-    // If that proves problematic in the Phase-6 smoke it can move to a background task.
-    let outcome = run_start_sequence(
-        &disc.manifest,
-        &disc.dir,
-        &probe,
-        &mgr.spawner,
-        &clock,
-        &sink,
-        images_present,
-    );
-    match outcome {
-        StartOutcome::Healthy { owned, child_id } => {
+    // `mgr` is borrowed from this invocation and cannot cross the thread boundary; the handle
+    // can, so the worker re-acquires the manager from it.
+    std::thread::spawn(move || {
+        let mgr = app.state::<PluginManager>();
+        let probe = HttpProbe;
+        let clock = RealClock::new();
+        let sink = TauriEventSink { app: app.clone() };
+        let images_present = probe.probe(&disc.manifest.lifecycle.health.url).is_some();
+
+        let outcome = run_start_sequence(
+            &disc.manifest,
+            &disc.dir,
+            &probe,
+            &mgr.spawner,
+            &clock,
+            &sink,
+            images_present,
+        );
+        if let StartOutcome::Healthy { owned, child_id } = outcome {
             mgr.running
                 .lock()
                 .unwrap()
-                .insert(id, Running { child_id, owned });
-            // Phase 6 shows the webview here (once healthy).
-            Ok(())
+                .insert(disc.manifest.id.clone(), Running { child_id, owned });
         }
-        StartOutcome::Error(e) => Err(e),
+        // On Error the sink has already emitted `error`; the shell reacts to that event. There
+        // is no caller left to return it to.
+    });
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::plugins::discovery::discover;
+    use crate::plugins::manifest::Popups;
+    use std::path::Path;
+
+    /// The shipped Audience proving manifest lives in the repo (dev-list root) and must
+    /// parse, validate, and carry the credential-free dev posture (spec §2 + audience
+    /// digest): fake providers baked as BUILD args, and devAuth selected at runtime env.
+    #[test]
+    fn shipped_audience_manifest_is_credential_free_dev() {
+        let path =
+            Path::new(env!("CARGO_MANIFEST_DIR")).join("app-plugins/audience/app-plugin.json");
+        let text = std::fs::read_to_string(&path)
+            .unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
+        let m = Manifest::from_json(&text).expect("audience manifest parses");
+        m.validate().expect("audience manifest validates");
+
+        assert_eq!(m.id, "audience");
+        let lc = &m.lifecycle;
+
+        // Fake providers are BUILD args (baked into the image — a runtime env can't flip a
+        // prod-built Next image to devAuth/fake; spec §2 "build vs runtime env").
+        let build = lc.build.as_ref().expect("audience has a build step");
+        assert_eq!(
+            build.args.get("NODE_ENV").map(String::as_str),
+            Some("development")
+        );
+        assert_eq!(
+            build.args.get("AI_PROVIDER").map(String::as_str),
+            Some("fake")
+        );
+        assert_eq!(
+            build.args.get("MEDIA_PROVIDER").map(String::as_str),
+            Some("fake")
+        );
+
+        // devAuth is selected at runtime (NODE_ENV) and fabricates an identity from
+        // DEV_WORKSPACE_ID/DEV_USER_ID (audience digest) — so no Clerk cookie is needed.
+        assert_eq!(
+            lc.env.get("NODE_ENV").map(String::as_str),
+            Some("development")
+        );
+        assert!(lc.env.contains_key("DEV_WORKSPACE_ID"));
+        assert!(lc.env.contains_key("DEV_USER_ID"));
+
+        // Audience root `/` 302-redirects to /dashboard → the ready probe must accept 3xx
+        // or a perfectly healthy Next server is marked `error` (spec §2, critique R1 #3).
+        assert!(lc.ready.ok_status.contains(&302));
+        assert_eq!(lc.health.ok_status, vec![200]);
+
+        // OAuth popups must share the app's session partition (spec §4) → popups allowed.
+        assert_eq!(m.webview.popups, Popups::Allow);
+    }
+
+    /// `CC_APP_PLUGINS_DEV` adds a dev-list discovery root; discovery finds a manifest
+    /// placed under it. (Verifies the dev seam wired into `roots()` end-to-end.)
+    #[test]
+    fn dev_list_root_is_discovered() {
+        let tmp = std::env::temp_dir().join("appplugins_devroot_test");
+        let _ = std::fs::remove_dir_all(&tmp);
+        std::fs::create_dir_all(tmp.join("audience")).unwrap();
+        let text = std::fs::read_to_string(
+            Path::new(env!("CARGO_MANIFEST_DIR")).join("app-plugins/audience/app-plugin.json"),
+        )
+        .unwrap();
+        std::fs::write(tmp.join("audience/app-plugin.json"), text).unwrap();
+
+        let found = discover(&[tmp.as_path()]);
+        assert_eq!(found.len(), 1);
+        assert_eq!(found[0].manifest.id, "audience");
+    }
+
+    // ---- Gate 5: teardown selection -------------------------------------------------
+    //
+    // Gate 5 ("quit the app, confirm `docker ps` is clean") is the one merge blocker on the
+    // plugin runtime that had no automated coverage at all. It splits in two: WHICH stacks a
+    // teardown pass picks, and WHETHER `docker compose down` actually brings them down. Only
+    // the first half can be tested without a Docker daemon — CI has none — so that is what
+    // these pin. The execution half stays a human smoke item.
+
+    /// A manifest with no `stop` command, so `stop_one` is a no-op and these tests never
+    /// shell out to anything.
+    fn manifest(id: &str) -> Manifest {
+        let text = serde_json::json!({
+            "id": id, "name": id, "apiVersion": 1,
+            "url": "http://localhost:3000",
+            "lifecycle": {
+                "cwd": "/x", "start": "up", "env": {},
+                "health": { "url": "h", "okStatus": [200], "timeout": 5000, "interval": 1000 },
+                "ready":  { "url": "r", "okStatus": [200], "timeout": 5000, "interval": 1000 }
+            }
+        })
+        .to_string();
+        Manifest::from_json(&text).expect("fixture manifest parses")
+    }
+
+    fn discovered(ids: &[&str]) -> Vec<DiscoveredPlugin> {
+        ids.iter()
+            .map(|id| DiscoveredPlugin {
+                dir: PathBuf::from(format!("/plugins/{id}")),
+                manifest: manifest(id),
+            })
+            .collect()
+    }
+
+    fn running(entries: &[(&str, bool)]) -> HashMap<String, Running> {
+        entries
+            .iter()
+            .map(|(id, owned)| {
+                (
+                    (*id).to_string(),
+                    Running {
+                        child_id: Some(1),
+                        owned: *owned,
+                    },
+                )
+            })
+            .collect()
+    }
+
+    /// Only OWNED stacks are torn down. An adopted stack — one that was already up when the
+    /// start sequence ran, so the user owns it — must be left running on quit.
+    #[test]
+    fn teardown_selects_owned_and_leaves_adopted_running() {
+        let targets = teardown_targets(
+            &running(&[("audience", true), ("adopted", false)]),
+            &discovered(&["audience", "adopted"]),
+        );
+        let ids: Vec<&str> = targets.iter().map(|(m, _)| m.id.as_str()).collect();
+        assert_eq!(ids, vec!["audience"]);
+    }
+
+    /// A running id whose discovery record has vanished (plugin dir deleted or renamed while
+    /// the app was up) is skipped, not panicked on. Teardown runs inside the shutdown handler,
+    /// where a panic would strand every container that had not been reached yet.
+    #[test]
+    fn teardown_skips_running_id_with_no_discovery_record() {
+        let targets = teardown_targets(
+            &running(&[("audience", true), ("vanished", true)]),
+            &discovered(&["audience"]),
+        );
+        let ids: Vec<&str> = targets.iter().map(|(m, _)| m.id.as_str()).collect();
+        assert_eq!(ids, vec!["audience"]);
+    }
+
+    /// EVERY owned stack is selected, not just the first — a partial teardown is precisely the
+    /// orphaned-container failure Gate 5 exists to catch.
+    #[test]
+    fn teardown_selects_every_owned_stack() {
+        let targets = teardown_targets(
+            &running(&[("a", true), ("b", true), ("c", true)]),
+            &discovered(&["a", "b", "c"]),
+        );
+        let mut ids: Vec<&str> = targets.iter().map(|(m, _)| m.id.as_str()).collect();
+        ids.sort_unstable();
+        assert_eq!(ids, vec!["a", "b", "c"]);
+    }
+
+    /// The resolved teardown cwd is the manifest's, not the process's — `docker compose down`
+    /// only finds the right stack if it runs where the compose file lives.
+    #[test]
+    fn teardown_target_carries_the_plugins_own_directory() {
+        let targets = teardown_targets(&running(&[("audience", true)]), &discovered(&["audience"]));
+        let (m, dir) = &targets[0];
+        assert_eq!(dir, &PathBuf::from("/plugins/audience"));
+        assert_eq!(m.resolved_cwd(dir), PathBuf::from("/x")); // absolute cwd wins over the dir
+    }
+
+    /// `stop_all_owned` empties the running map — including adopted entries, which are
+    /// forgotten rather than stopped. Documents the `mem::take`: after one pass the manager
+    /// tracks nothing.
+    #[test]
+    fn stop_all_owned_clears_the_running_map_including_adopted() {
+        let mgr = PluginManager::default();
+        *mgr.discovered.lock().unwrap() = discovered(&["audience", "adopted"]);
+        *mgr.running.lock().unwrap() = running(&[("audience", true), ("adopted", false)]);
+
+        mgr.stop_all_owned(5_000);
+
+        assert!(mgr.running.lock().unwrap().is_empty());
+    }
+
+    /// Shutdown re-entrancy. `stop_all_owned` is called from the `ExitRequested` handler on the
+    /// main event-loop thread (`lib.rs`) with a 30 s budget, so a second pass must not re-spend
+    /// it. Bears on the open Gate-5 process-exit anomaly (the `app` process outliving the
+    /// window): whatever holds the process open, this test rules out a teardown pass blocking
+    /// the loop a second time.
+    #[test]
+    fn stop_all_owned_is_idempotent_and_the_second_pass_is_immediate() {
+        let mgr = PluginManager::default();
+        *mgr.discovered.lock().unwrap() = discovered(&["audience"]);
+        *mgr.running.lock().unwrap() = running(&[("audience", true)]);
+
+        mgr.stop_all_owned(5_000);
+        let t = Instant::now();
+        mgr.stop_all_owned(5_000);
+
+        assert!(
+            t.elapsed() < Duration::from_millis(250),
+            "second teardown pass took {:?}; it should find nothing to do",
+            t.elapsed()
+        );
+        assert!(mgr.running.lock().unwrap().is_empty());
     }
 }
diff --git a/cockpit/ui/src-tauri/src/view_plugins.rs b/cockpit/ui/src-tauri/src/view_plugins.rs
new file mode 100644
index 0000000..1ee6a2e
--- /dev/null
+++ b/cockpit/ui/src-tauri/src/view_plugins.rs
@@ -0,0 +1,140 @@
+// View-plugin asset scheme `ccplugin://` (Lane S integration of the Lane V contract bundle;
+// P4 spike `spike/view-plugins-handshake` carry-forward).
+//
+// A sandboxed view-plugin runs in an `<iframe sandbox="allow-scripts">` whose `src` is
+// `ccplugin://localhost/<id>/<path>`. On Windows/WebView2 (primary target) that resolves to
+// the distinct origin `http://ccplugin.localhost/...`; every plugin shares that origin
+// (`<id>` is a path). This handler serves the plugin's static assets from disk with the
+// plugin-document CSP + CORS header.
+//
+// THREE load-bearing findings from the P4 spike are baked in here (each cost a dropped
+// handshake run to discover — do not "simplify" them away):
+//  1. `script-src` names the concrete origin `http://ccplugin.localhost`, NOT `'self'`. A
+//     `sandbox="allow-scripts"` iframe has an OPAQUE ("null") origin, and CSP `'self'`
+//     matches the document origin — which, being opaque, matches nothing.
+//  2. Every response carries `Access-Control-Allow-Origin: *`. Opaque-origin module scripts
+//     (the `<script type=module src=sdk.js>` entry) are ALWAYS fetched in CORS mode; without
+//     ACAO the fetch is rejected, `sdk.js` never runs, no `plugin-hello` posts, and every
+//     handshake times out.
+//  3. The plugin-document CSP is delivered as a RESPONSE HEADER (never a `<meta>` the plugin
+//     could rewrite). `connect-src 'none'` is what makes the no-network guarantee provable.
+
+use std::path::PathBuf;
+use tauri::http::{Request, Response};
+use tauri::{AppHandle, Manager};
+
+/// The custom URI scheme the host iframe points at. Registered on the Tauri builder.
+pub const SCHEME: &str = "ccplugin";
+
+/// The plugin-document Content-Security-Policy (see finding #1/#3 above).
+const PLUGIN_CSP: &str = "default-src 'none'; script-src 'self' http://ccplugin.localhost; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
+
+fn mime_for(sub: &str) -> &'static str {
+    match sub.rsplit('.').next() {
+        Some("html") | Some("htm") => "text/html",
+        Some("js") | Some("mjs") => "text/javascript",
+        Some("css") => "text/css",
+        Some("json") => "application/json",
+        Some("svg") => "image/svg+xml",
+        Some("png") => "image/png",
+        Some("jpg") | Some("jpeg") => "image/jpeg",
+        Some("gif") => "image/gif",
+        Some("woff2") => "font/woff2",
+        Some("wasm") => "application/wasm",
+        _ => "application/octet-stream",
+    }
+}
+
+/// Roots that hold view-plugin static assets; each `<id>` is a subdir. Searched in order,
+/// first hit wins:
+///  - `CC_VIEW_PLUGINS_DEV` (dev seam — point at the repo `plugins/` dir),
+///  - the packaged resource dir `plugins/`,
+///  - the per-user `~/.command-center/plugins`.
+fn plugin_roots(app: &AppHandle) -> Vec<PathBuf> {
+    let mut v = Vec::new();
+    if let Some(dev) = std::env::var_os("CC_VIEW_PLUGINS_DEV") {
+        v.push(PathBuf::from(dev));
+    }
+    if let Ok(res) = app.path().resource_dir() {
+        v.push(res.join("plugins"));
+    }
+    if let Some(home) = std::env::var_os("USERPROFILE").or_else(|| std::env::var_os("HOME")) {
+        v.push(PathBuf::from(home).join(".command-center/plugins"));
+    }
+    v
+}
+
+/// The shared plugin SDK, served same-origin as `<id>/sdk.js` so every plugin can
+/// `import './sdk.js'`. Dev: `CC_PLUGIN_SDK` (repo `cockpit/plugin-sdk/index.js`);
+/// packaged: the resource dir `plugin-sdk/index.js`.
+fn sdk_bytes(app: &AppHandle) -> Option<Vec<u8>> {
+    if let Some(p) = std::env::var_os("CC_PLUGIN_SDK") {
+        if let Ok(b) = std::fs::read(PathBuf::from(p)) {
+            return Some(b);
+        }
+    }
+    if let Ok(res) = app.path().resource_dir() {
+        if let Ok(b) = std::fs::read(res.join("plugin-sdk/index.js")) {
+            return Some(b);
+        }
+    }
+    None
+}
+
+fn built(status: u16, mime: &str, body: Vec<u8>) -> Response<Vec<u8>> {
+    Response::builder()
+        .status(status)
+        .header("Content-Type", mime)
+        .header("Content-Security-Policy", PLUGIN_CSP)
+        // Opaque-origin (sandboxed) iframe fetches its module graph in CORS mode (finding #2).
+        .header("Access-Control-Allow-Origin", "*")
+        .body(body)
+        .expect("static response is always well-formed")
+}
+
+fn not_found() -> Response<Vec<u8>> {
+    built(404, "text/plain", b"cc view-plugin: not found".to_vec())
+}
+
+/// Serve one asset for `ccplugin://localhost/<id>/<path>`. Registered via
+/// `.register_uri_scheme_protocol(SCHEME, |ctx, req| respond(ctx.app_handle(), req))`.
+pub fn respond(app: &AppHandle, request: Request<Vec<u8>>) -> Response<Vec<u8>> {
+    // uri().path() == "/<id>/<path...>"
+    let rel = request.uri().path().trim_start_matches('/');
+    let mut parts = rel.splitn(2, '/');
+    let id = parts.next().unwrap_or("");
+    let mut sub = parts.next().unwrap_or("").to_string();
+    if id.is_empty() {
+        return not_found();
+    }
+    if sub.is_empty() {
+        sub = "index.html".to_string();
+    }
+    // Reject path traversal / odd components — the id and every sub segment must be plain.
+    if id == ".." || id.contains('/') || id.contains('\\') {
+        return not_found();
+    }
+    if sub
+        .split('/')
+        .any(|c| c.is_empty() || c == "." || c == "..")
+        || sub.contains('\\')
+    {
+        return not_found();
+    }
+
+    // The SDK is a special same-origin asset shared across all plugins.
+    if sub == "sdk.js" {
+        return match sdk_bytes(app) {
+            Some(body) => built(200, "text/javascript", body),
+            None => not_found(),
+        };
+    }
+
+    for root in plugin_roots(app) {
+        let candidate = root.join(id).join(&sub);
+        if let Ok(body) = std::fs::read(&candidate) {
+            return built(200, mime_for(&sub), body);
+        }
+    }
+    not_found()
+}
diff --git a/cockpit/ui/src-tauri/tauri.conf.json b/cockpit/ui/src-tauri/tauri.conf.json
index 636c87c..c73a7a8 100644
--- a/cockpit/ui/src-tauri/tauri.conf.json
+++ b/cockpit/ui/src-tauri/tauri.conf.json
@@ -23,13 +23,17 @@
       }
     ],
     "security": {
-      "csp": null
+      "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' ws://127.0.0.1:8787 http://127.0.0.1:8787; frame-src http://ccplugin.localhost"
     }
   },
   "bundle": {
     "active": true,
     "targets": ["msi", "nsis", "app", "dmg", "appimage", "deb"],
     "externalBin": ["binaries/fleetd-serve"],
+    "resources": {
+      "../../../plugins/reference/": "plugins/reference/",
+      "../../plugin-sdk/index.js": "plugin-sdk/index.js"
+    },
     "icon": [
       "icons/32x32.png",
       "icons/128x128.png",
diff --git a/cockpit/ui/src-tauri/tests/packaged_plugin_root.rs b/cockpit/ui/src-tauri/tests/packaged_plugin_root.rs
new file mode 100644
index 0000000..bdff120
--- /dev/null
+++ b/cockpit/ui/src-tauri/tests/packaged_plugin_root.rs
@@ -0,0 +1,106 @@
+//! Guard test: the packaged bundle must actually contain the view-plugin runtime's assets.
+//!
+//! `view_plugins::plugin_roots` searches, in order:
+//!
+//!   1. `CC_VIEW_PLUGINS_DEV` — the dev seam, an env var pointing at the repo `plugins/` dir,
+//!   2. `resource_dir()/plugins` — the packaged path, i.e. whatever `bundle.resources` ships,
+//!   3. `~/.command-center/plugins` — a per-user override.
+//!
+//! In `tauri dev` the env var is set, so the runtime works and every automated gate is green.
+//! A packaged build sets no `CC_*` vars, so it falls through to the resource dir — and
+//! `bundle.resources` did not exist at all. `plugins/` and `plugin-sdk/index.js` were never
+//! bundled, so `ccplugin://localhost/reference/index.html` 404'd, the frame stayed blank, and
+//! `sdk_bytes()` found no SDK, so `plugin-hello` never posted and every handshake timed out.
+//!
+//! That is D-8, and it is the fourth instance of one pattern in this branch (see D-1, D-2, D-7
+//! in `spikes/SPIKE-RESULTS.md`): something is exercised only on the dev path and was never
+//! wired for the path that ships.
+//!
+//! CI *does* bundle the app — `tauri build` runs on all three OSes and uploads the artifacts.
+//! What no gate did was look INSIDE the bundle. The build succeeded exactly as before; it just
+//! shipped an app with no plugin root. A green `tauri build` says "it compiled and packaged",
+//! never "it packaged the right files".
+//!
+//! This test makes the class mechanical: delete either mapping from `tauri.conf.json` and this
+//! goes red immediately, instead of surfacing as a blank pane in a packaged smoke weeks later.
+
+use std::fs;
+use std::path::Path;
+
+/// `bundle.resources` entries required for the view-plugin runtime to work when packaged.
+/// Key = repo-relative source (as written in `tauri.conf.json`), value = destination under
+/// the app's `resource_dir()`. The destinations are what `plugin_roots` / `sdk_bytes` read.
+const REQUIRED_RESOURCES: &[(&str, &str)] = &[
+    ("../../../plugins/reference/", "plugins/reference/"),
+    ("../../plugin-sdk/index.js", "plugin-sdk/index.js"),
+];
+
+fn config() -> serde_json::Value {
+    let path = Path::new(env!("CARGO_MANIFEST_DIR")).join("tauri.conf.json");
+    let raw =
+        fs::read_to_string(&path).unwrap_or_else(|e| panic!("cannot read {}: {e}", path.display()));
+    serde_json::from_str(&raw)
+        .unwrap_or_else(|e| panic!("{} is not valid JSON: {e}", path.display()))
+}
+
+#[test]
+fn packaged_bundle_ships_the_view_plugin_root_and_sdk() {
+    let cfg = config();
+    let resources = cfg
+        .get("bundle")
+        .and_then(|b| b.get("resources"))
+        .unwrap_or_else(|| {
+            panic!(
+                "tauri.conf.json has no `bundle.resources`. A packaged build then has no \
+                 `resource_dir()/plugins` and no `plugin-sdk/index.js`, so every view-plugin \
+                 404s and every handshake times out (D-8). Required: {REQUIRED_RESOURCES:?}"
+            )
+        });
+    let map = resources
+        .as_object()
+        .expect("`bundle.resources` must be an object mapping source -> destination");
+
+    for (src, dest) in REQUIRED_RESOURCES {
+        let got = map.get(*src).and_then(|v| v.as_str()).unwrap_or_else(|| {
+            panic!(
+                "`bundle.resources` is missing the mapping {src:?} -> {dest:?}. Without it the \
+                 packaged view-plugin runtime cannot load. Present mappings: {:?}",
+                map.keys().collect::<Vec<_>>()
+            )
+        });
+        assert_eq!(
+            got, *dest,
+            "`bundle.resources[{src:?}]` must land at {dest:?} - that is the path \
+             `plugin_roots`/`sdk_bytes` read at runtime"
+        );
+    }
+}
+
+/// The sources named above must exist in the repo, or the bundler silently ships nothing.
+#[test]
+fn declared_resource_sources_exist_on_disk() {
+    let manifest = Path::new(env!("CARGO_MANIFEST_DIR"));
+    for (src, _) in REQUIRED_RESOURCES {
+        let p = manifest.join(src);
+        assert!(
+            p.exists(),
+            "`bundle.resources` names {src:?}, which resolves to {} - but nothing is there, so \
+             the packaged app would ship an empty plugin root",
+            p.display()
+        );
+    }
+}
+
+/// The reference plugin's entry point and the SDK it imports must both be present. These are
+/// the two exact files a packaged handshake needs: the document, and the module it loads.
+#[test]
+fn reference_plugin_entry_and_sdk_are_present() {
+    let manifest = Path::new(env!("CARGO_MANIFEST_DIR"));
+    for rel in [
+        "../../../plugins/reference/index.html",
+        "../../plugin-sdk/index.js",
+    ] {
+        let p = manifest.join(rel);
+        assert!(p.exists(), "missing {} ({})", rel, p.display());
+    }
+}
diff --git a/cockpit/ui/src-tauri/tests/tauri_command_threading.rs b/cockpit/ui/src-tauri/tests/tauri_command_threading.rs
new file mode 100644
index 0000000..3a59ace
--- /dev/null
+++ b/cockpit/ui/src-tauri/tests/tauri_command_threading.rs
@@ -0,0 +1,229 @@
+//! Guard test: no new `#[tauri::command]` may block the main event-loop thread.
+//!
+//! A *synchronous* `#[tauri::command]` is invoked on Tauri's main event-loop thread, so any
+//! blocking work inside it freezes the whole window. This project has now hit that defect
+//! twice:
+//!
+//!   1. The embedding commands (P3) — fixed by making them `async`.
+//!   2. `plugin_launch` (Phase-6 smoke item 1.5) — a `docker compose build` with a 20-minute
+//!      budget ran inline, freezing the UI from the tab click until the stack came up. Fixed
+//!      in `db74a47` by dispatching the start sequence to a dedicated OS thread. See
+//!      `spikes/SPIKE-RESULTS.md` → "Smoke run 1".
+//!
+//! Both were caught by a human watching a window, and both passed every automated gate on the
+//! way in. This test makes the *class* mechanical. A command is acceptable when it is either:
+//!
+//!   * `async fn` — Tauri runs it on a worker, off the event loop; or
+//!   * dispatching — it hands its work to a thread and returns.
+//!
+//! Anything else must be named in `MAIN_THREAD_DEBT`.
+//!
+//! **This is a ratchet, not a clean bill of health.** The list below is the debt that already
+//! existed when the guard was written; the entries marked UNBOUNDED are genuine freeze risks
+//! that simply have not been fixed yet. The value is that a *new* blocking command fails here
+//! immediately, instead of waiting to be discovered as a frozen window six weeks later.
+//!
+//! It also pins the 1.5 fix from the Rust side: delete the `thread::spawn` from
+//! `plugin_launch` and this test goes red, because the command becomes sync, non-dispatching,
+//! and absent from the list.
+
+use std::fs;
+use std::path::{Path, PathBuf};
+
+/// Synchronous commands that predate this guard, and why each is tolerated.
+///
+/// Do NOT add an entry here to make a red build green — make the command `async` instead, or
+/// dispatch its work to a thread. An entry is a promise that someone looked and decided the
+/// freeze risk was acceptable.
+const MAIN_THREAD_DEBT: &[(&str, &str)] = &[
+    (
+        "plugins_list",
+        "BOUNDED: read_dir over at most two shallow roots, one small JSON parse per entry. \
+         No network, no subprocess. Cost is a few milliseconds.",
+    ),
+    (
+        "halyard_status",
+        "UNBOUNDED: spawns the halyard CLI via Command::output() with NO timeout. A hung or \
+         slow CLI freezes the window for as long as it hangs — the same shape as the 1.5 \
+         defect, just with a different blocking call.",
+    ),
+    (
+        "halyard_queue",
+        "UNBOUNDED: same call path as halyard_status, same risk.",
+    ),
+    (
+        "scan_local_projects",
+        "UNBOUNDED: recursive walkdir over operator-configured scan roots, plus a file read \
+         per project found. Cost scales with the size of the operator's disk, not with \
+         anything this repo controls.",
+    ),
+];
+
+#[derive(Debug)]
+struct TauriCommand {
+    name: String,
+    is_async: bool,
+    dispatches: bool,
+    file: String,
+    line: usize,
+}
+
+impl TauriCommand {
+    /// Runs off the event loop one way or the other.
+    fn is_safe(&self) -> bool {
+        self.is_async || self.dispatches
+    }
+}
+
+#[test]
+fn no_new_command_blocks_the_main_event_loop() {
+    let commands = collect_commands();
+
+    assert!(
+        !commands.is_empty(),
+        "found no #[tauri::command] at all — the scanner is broken, not the code"
+    );
+
+    let offenders: Vec<&TauriCommand> = commands
+        .iter()
+        .filter(|c| !c.is_safe())
+        .filter(|c| !MAIN_THREAD_DEBT.iter().any(|(name, _)| *name == c.name))
+        .collect();
+
+    assert!(
+        offenders.is_empty(),
+        "\n\
+         These #[tauri::command] functions are synchronous and do not dispatch their work, so\n\
+         they run on Tauri's main event-loop thread. If any of them blocks — a subprocess, an\n\
+         HTTP call, a filesystem walk — the entire window freezes for that long.\n\n\
+         {}\n\n\
+         Fix by making the command `async fn` (Tauri then runs it on a worker), or by handing\n\
+         the blocking work to a thread and returning immediately, as `plugin_launch` does.\n\
+         Only add to MAIN_THREAD_DEBT in tests/tauri_command_threading.rs if you have looked\n\
+         at the work it does and concluded the freeze risk is genuinely acceptable.\n",
+        offenders
+            .iter()
+            .map(|c| format!("  - {} ({}:{})", c.name, c.file, c.line))
+            .collect::<Vec<_>>()
+            .join("\n")
+    );
+}
+
+/// Keeps the debt list honest: an entry that no longer names a sync command is stale, either
+/// because the command was fixed (delete the entry and keep the win) or renamed/removed.
+#[test]
+fn the_debt_list_has_no_stale_entries() {
+    let commands = collect_commands();
+
+    let stale: Vec<&str> = MAIN_THREAD_DEBT
+        .iter()
+        .map(|(name, _)| *name)
+        .filter(|name| !commands.iter().any(|c| c.name == *name && !c.is_safe()))
+        .collect();
+
+    assert!(
+        stale.is_empty(),
+        "\n\
+         MAIN_THREAD_DEBT names commands that are no longer synchronous main-thread commands:\n\
+         {}\n\n\
+         If one was fixed, delete its entry so the ratchet tightens. If one was renamed or\n\
+         removed, delete its entry too.\n",
+        stale
+            .iter()
+            .map(|n| format!("  - {n}"))
+            .collect::<Vec<_>>()
+            .join("\n")
+    );
+}
+
+fn collect_commands() -> Vec<TauriCommand> {
+    let src = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+    let mut files = Vec::new();
+    rs_files(&src, &mut files);
+    files.sort();
+
+    let mut out = Vec::new();
+    for path in &files {
+        let Ok(text) = fs::read_to_string(path) else {
+            continue;
+        };
+        let rel = path
+            .strip_prefix(&src)
+            .unwrap_or(path)
+            .to_string_lossy()
+            .replace('\\', "/");
+        scan_source(&rel, &text, &mut out);
+    }
+    out
+}
+
+fn rs_files(dir: &Path, out: &mut Vec<PathBuf>) {
+    let Ok(entries) = fs::read_dir(dir) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let path = entry.path();
+        if path.is_dir() {
+            rs_files(&path, out);
+        } else if path.extension().is_some_and(|e| e == "rs") {
+            out.push(path);
+        }
+    }
+}
+
+fn scan_source(file: &str, text: &str, out: &mut Vec<TauriCommand>) {
+    let lines: Vec<&str> = text.lines().collect();
+
+    for (i, line) in lines.iter().enumerate() {
+        if line.trim() != "#[tauri::command]" {
+            continue;
+        }
+        // The signature is the next line declaring a fn (attributes may sit between).
+        let Some(sig_idx) = (i + 1..lines.len()).find(|&j| lines[j].contains("fn ")) else {
+            continue;
+        };
+        let sig = lines[sig_idx];
+        let Some(name) = fn_name(sig) else { continue };
+
+        out.push(TauriCommand {
+            name,
+            is_async: sig.contains("async fn"),
+            dispatches: body_after(&lines, sig_idx).contains("thread::spawn"),
+            file: file.to_string(),
+            line: sig_idx + 1,
+        });
+    }
+}
+
+fn fn_name(sig: &str) -> Option<String> {
+    let after = sig.split("fn ").nth(1)?;
+    let name: String = after
+        .chars()
+        .take_while(|c| c.is_alphanumeric() || *c == '_')
+        .collect();
+    (!name.is_empty()).then_some(name)
+}
+
+/// The function body: from the first `{` at or after the signature to its matching `}`.
+/// Brace counting is naive about braces inside strings and comments, which is fine here —
+/// the only question asked of the result is whether it contains `thread::spawn`.
+fn body_after(lines: &[&str], sig_idx: usize) -> String {
+    let rest = lines[sig_idx..].join("\n");
+    let Some(start) = rest.find('{') else {
+        return String::new();
+    };
+    let mut depth = 0i32;
+    for (offset, ch) in rest[start..].char_indices() {
+        match ch {
+            '{' => depth += 1,
+            '}' => {
+                depth -= 1;
+                if depth == 0 {
+                    return rest[start..start + offset + 1].to_string();
+                }
+            }
+            _ => {}
+        }
+    }
+    rest[start..].to_string()
+}
diff --git a/cockpit/ui/src/App.appPlugin.test.ts b/cockpit/ui/src/App.appPlugin.test.ts
new file mode 100644
index 0000000..91af774
--- /dev/null
+++ b/cockpit/ui/src/App.appPlugin.test.ts
@@ -0,0 +1,121 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+
+// App.appPlugin integration: activating an app-plugin tab must never block the shell on the
+// plugin's start sequence, and must never composite the child webview before the plugin is
+// actually serving. Found by the Phase-6 interactive smoke (checklist 1.5): `plugin_launch`
+// was a *synchronous* Tauri command, so it ran on the main event-loop thread and froze the
+// whole UI for the duration of `docker compose build` + the health/ready probe budget.
+//
+// The fix makes `plugin_launch` return as soon as the sequence is spawned. That changes its
+// contract: it is a *dispatch ack*, NOT a completion signal. These tests pin the consequence —
+// lifecycle truth arrives only via `plugin://state` events.
+//
+// The Tauri mocks must be installed before App.svelte is imported (it imports invoke/listen at
+// module scope), hence `vi.hoisted` for the state the factories close over.
+const { invokeMock, listeners } = vi.hoisted(() => ({
+  invokeMock: vi.fn(),
+  listeners: new Map<string, (e: { payload: { id: string; state: string } }) => void>(),
+}));
+
+vi.mock('@tauri-apps/api/core', () => ({
+  invoke: (cmd: string, args?: unknown) => invokeMock(cmd, args),
+}));
+vi.mock('@tauri-apps/api/event', () => ({
+  listen: (name: string, cb: (e: { payload: { id: string; state: string } }) => void) => {
+    listeners.set(name, cb);
+    return Promise.resolve(() => listeners.delete(name));
+  },
+}));
+
+import { tick } from 'svelte';
+import { render, cleanup, waitFor, fireEvent } from '@testing-library/svelte';
+import App from './App.svelte';
+import { fleet } from './lib/store.svelte';
+import * as api from './lib/api';
+
+const AUDIENCE = { id: 'audience', name: 'Audience', icon: '', url: 'http://localhost:3000' };
+const TAB = 'switch-app:audience';
+
+/** Push a `plugin://state` event the way the Rust `TauriEventSink` does. */
+function emitState(id: string, state: string) {
+  listeners.get('plugin://state')?.({ payload: { id, state } });
+}
+
+/** invoke() calls recorded for one command name. */
+const calls = (cmd: string) => invokeMock.mock.calls.filter((c) => c[0] === cmd);
+
+beforeEach(() => {
+  // jsdom has no ResizeObserver; the rect-glue $effect constructs one as soon as an app tab
+  // is active. A no-op stub keeps that effect from throwing (rect glue is a GUI concern —
+  // it is covered by smoke checklist 1.6, not here).
+  vi.stubGlobal(
+    'ResizeObserver',
+    class {
+      observe() {}
+      unobserve() {}
+      disconnect() {}
+    },
+  );
+
+  // Stub the network so App.onMount's fleet.start() is inert in jsdom (as in App.overlay.test).
+  vi.spyOn(api, 'health').mockRejectedValue(new Error('no daemon in test'));
+  vi.spyOn(api, 'listUnits').mockResolvedValue([]);
+  fleet.units = {};
+  fleet.order = [];
+  fleet.selectedId = null;
+  fleet.pendingLaunch = null;
+
+  listeners.clear();
+  invokeMock.mockReset();
+  invokeMock.mockImplementation((cmd: string) => {
+    if (cmd === 'plugins_list') return Promise.resolve([AUDIENCE]);
+    // Every other command (plugin_launch/show/hide/set_rect, scan_local_projects) acks.
+    return Promise.resolve(undefined);
+  });
+});
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+});
+
+describe('App app-plugin activation', () => {
+  it('does not composite the webview until the plugin reports healthy', async () => {
+    const { getByTestId } = render(App);
+    await waitFor(() => expect(getByTestId(TAB)).not.toBeNull());
+
+    await fireEvent.click(getByTestId(TAB));
+    await waitFor(() => expect(calls('plugin_launch')).toHaveLength(1));
+
+    // `plugin_launch` resolving means "sequence dispatched", not "app is up". Compositing
+    // here would point the child webview at a URL that is not serving yet.
+    expect(calls('plugin_show')).toHaveLength(0);
+
+    // Intermediate lifecycle states must not composite either.
+    emitState('audience', 'building');
+    await tick();
+    emitState('audience', 'starting');
+    await tick();
+    expect(calls('plugin_show')).toHaveLength(0);
+
+    // Only `healthy` composites.
+    emitState('audience', 'healthy');
+    await waitFor(() => expect(calls('plugin_show')).toHaveLength(1));
+  });
+
+  it('never composites the webview when the start sequence fails', async () => {
+    const { getByTestId } = render(App);
+    await waitFor(() => expect(getByTestId(TAB)).not.toBeNull());
+
+    await fireEvent.click(getByTestId(TAB));
+    await waitFor(() => expect(calls('plugin_launch')).toHaveLength(1));
+
+    emitState('audience', 'building');
+    await tick();
+    emitState('audience', 'error');
+    await tick();
+
+    expect(calls('plugin_show')).toHaveLength(0);
+  });
+});
diff --git a/cockpit/ui/src/App.svelte b/cockpit/ui/src/App.svelte
index 75902a9..e8922d1 100644
--- a/cockpit/ui/src/App.svelte
+++ b/cockpit/ui/src/App.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
-  import { onMount } from 'svelte';
+  import { onMount, tick } from 'svelte';
   import { invoke } from '@tauri-apps/api/core';
+  import { listen } from '@tauri-apps/api/event';
   import { FLEET_BASE } from './lib/api';
   import { phaseClass, progress, isTerminal } from './lib/fleet';
   import type { CommandName } from './lib/types';
@@ -10,6 +11,10 @@
   import ApprovalOverlay, { type ApprovalRequest } from './lib/ApprovalOverlay.svelte';
   import { tauriHalyardReader, tauriAudienceReader } from './lib/dashboard/api';
   import type { LocalReader, LocalProjectDoc } from './lib/dashboard/adapters/local';
+  // PLUGIN RUNTIME (Lane S): the sandboxed view-plugin bridge (Lane V) + app-plugin
+  // discovery (Lane A). The one topbar switcher unifies host views + both plugin kinds.
+  import { PluginBridge, makeFleetHost } from './lib/bridge';
+  import { discoverFrom } from './lib/loader';
 
   // U4: local-source reader, backed by the `scan_local_projects` Tauri command.
   // Lazy like the other Tauri-backed readers (tauriHalyardReader/tauriAudienceReader
@@ -20,16 +25,116 @@
     scan: () => invoke<LocalProjectDoc[]>('scan_local_projects', { config: { scanRoots: ['D:/MajorProjects'], maxDepth: 5, pins: [], excludes: [] } }),
   };
 
-  // ── top-level view switcher (Lane A) ─────────────────────────────
-  // Fleet = the inline cockpit below; Projects = the read-only Project Dashboard.
-  // Both project the SAME shared `fleet` store, so switching never loses state.
+  // ── unified top-level switcher (Lane S) ──────────────────────────
+  // ONE switcher spans four kinds of destination, all through the existing Switcher
+  // component (so the Fleet/Projects regression canary is untouched):
+  //   • host views   — Fleet (inline ops grid, default) + Projects (dashboard), in-DOM.
+  //   • view-plugins — sandboxed `<iframe>` served over `ccplugin://` (Lane V runtime).
+  //   • app-plugins  — trusted native child webviews composited over a reserved rect (Lane A).
+  // Exactly one destination is active at a time. Host views + the fleet store are never
+  // torn down on a switch, so returning to Fleet preserves units/sockets/selection.
   type ViewId = 'fleet' | 'projects';
   let view = $state<ViewId>('fleet');
 
-  const views: ViewEntry[] = [
+  // View-plugins (Lane V): discovered from a dev index of raw manifests, validated +
+  // capability-negotiated by the loader. Forced to the `packaged` env so `src` is the
+  // `ccplugin://localhost/<id>/<entry>` scheme — which our Rust handler serves in BOTH
+  // `tauri dev` and packaged builds (matches the host CSP `frame-src`). NOTE: this static
+  // index is the reference dogfood plugin; a Vite plugin that scans `plugins/*/manifest.json`
+  // into this index is the remaining dev-seam follow-up.
+  const VIEW_PLUGIN_INDEX: unknown[] = [
+    {
+      id: 'reference',
+      name: 'Reference',
+      version: '0.1.0',
+      apiVersion: 1,
+      capabilities: ['log-append'],
+      entry: 'index.html',
+    },
+  ];
+  const viewPlugins = discoverFrom('packaged', VIEW_PLUGIN_INDEX).plugins;
+  let activeViewPlugin = $state<string | null>(null); // plugin id, or null when a host/app view is active
+
+  // App-plugins (Lane A): discovered from Rust (`plugins_list`); each is a native child
+  // webview shown over a Svelte-reserved rect. `pluginState` mirrors the `plugin://state`
+  // lifecycle enum; `activeApp` is the id of the app whose webview is currently on-screen.
+  type AppTab = { id: string; name: string; icon: string; url: string };
+  let appTabs = $state<AppTab[]>([]);
+  let pluginState = $state<Record<string, string>>({}); // id -> "building"|"starting"|…|"healthy"|"error"
+  let activeApp = $state<string | null>(null);
+  let rectEl = $state<HTMLDivElement | null>(null); // the reserved content rect the webview tracks
+
+  // View-plugin bridge (Lane V): the `plugin-hello`→`init`→`PluginSession` handshake around
+  // the active iframe. Rebuilt whenever the active view-plugin changes; destroyed on leave.
+  let pluginFrame = $state<HTMLIFrameElement | null>(null);
+
+  // The one Switcher's entries + which is active, derived across all three destination kinds.
+  const switcherViews = $derived<ViewEntry[]>([
     { id: 'fleet', label: 'FLEET' },
     { id: 'projects', label: 'PROJECTS' },
-  ];
+    ...viewPlugins.map((p) => ({ id: `view:${p.manifest.id}`, label: p.manifest.name.toUpperCase() })),
+    ...appTabs.map((t) => ({ id: `app:${t.id}`, label: t.name.toUpperCase() })),
+  ]);
+  const activeSwitcherId = $derived(
+    activeApp ? `app:${activeApp}` : activeViewPlugin ? `view:${activeViewPlugin}` : view,
+  );
+
+  function toRect(r: DOMRect) {
+    return { x: r.x, y: r.y, width: r.width, height: r.height };
+  }
+
+  // Leave the active app webview (if any): park it off-screen (keep-warm), clear activeApp.
+  async function leaveApp() {
+    if (activeApp) {
+      const id = activeApp;
+      activeApp = null;
+      await invoke('plugin_hide', { id });
+    }
+  }
+
+  // Select a host view (Fleet/Projects): park any app webview, drop any view-plugin.
+  async function selectHostView(v: ViewId) {
+    await leaveApp();
+    activeViewPlugin = null;
+    view = v;
+  }
+
+  // Select a view-plugin: park any app webview, mount its sandboxed iframe (the bridge
+  // `$effect` below wires the handshake once the frame is in the DOM).
+  async function selectViewPlugin(id: string) {
+    await leaveApp();
+    activeViewPlugin = id;
+  }
+
+  // Select an app-plugin: drop any view-plugin, keep the in-DOM base mounted, and dispatch the
+  // plugin's start sequence if it isn't up yet.
+  //
+  // `plugin_launch` returns as soon as the sequence is dispatched — it runs on a Rust background
+  // thread, because doing it inline froze the whole UI for the length of `docker compose build`
+  // (smoke checklist 1.5). So it is NOT a readiness signal and this must not mark the plugin
+  // healthy. Lifecycle truth arrives as `plugin://state` events, and the compositing `$effect`
+  // below shows the webview the moment the state reaches `healthy`.
+  async function selectApp(id: string) {
+    if (activeApp && activeApp !== id) await invoke('plugin_hide', { id: activeApp });
+    activeViewPlugin = null;
+    activeApp = id;
+    await tick(); // let the reserved rect mount so the compositing effect can measure it
+    if (pluginState[id] === 'healthy') return; // already up — the effect composites it
+    try {
+      await invoke('plugin_launch', { id });
+    } catch {
+      pluginState = { ...pluginState, [id]: 'error' };
+    }
+  }
+
+  function onSwitch(id: string) {
+    if (id.startsWith('view:')) void selectViewPlugin(id.slice('view:'.length));
+    else if (id.startsWith('app:')) void selectApp(id.slice('app:'.length));
+    else void selectHostView(id as ViewId);
+  }
+
+  // True only for the default host Fleet ops grid (drives the topbar stats + regression canary).
+  const onFleet = $derived(view === 'fleet' && !activeViewPlugin && !activeApp);
 
   // The fleet store is the single source of fleet truth, shared across views. It owns
   // its own WebSocket streams; we connect once on app mount and tear down on app
@@ -39,6 +144,28 @@
     return () => fleet.dispose();
   });
 
+  // Discover app-plugins from Rust and subscribe to their lifecycle-state events. Guarded:
+  // in a plain-browser dev context (no Tauri) these calls reject and we simply show no app
+  // tabs — the host views and view-plugins are unaffected.
+  onMount(() => {
+    let un: (() => void) | undefined;
+    void (async () => {
+      try {
+        appTabs = await invoke<AppTab[]>('plugins_list');
+      } catch {
+        appTabs = [];
+      }
+      try {
+        un = await listen<{ id: string; state: string }>('plugin://state', (e) => {
+          pluginState = { ...pluginState, [e.payload.id]: e.payload.state };
+        });
+      } catch {
+        /* no Tauri event bus (browser dev) — state chips stay at their defaults */
+      }
+    })();
+    return () => un?.();
+  });
+
   // Convenience aliases so the Fleet markup below reads like before, but every read
   // goes through the shared store.
   const list = $derived(fleet.list);
@@ -95,6 +222,59 @@
   // subtree cannot receive input. A backdrop + z-index alone does NOT do this.
   const overlayOpen = $derived(approvalRequest !== null);
 
+  // The active view-plugin's sandboxed-iframe `src` (ccplugin://…), or null.
+  const activeViewPluginSrc = $derived(
+    activeViewPlugin
+      ? (viewPlugins.find((p) => p.manifest.id === activeViewPlugin)?.src ?? null)
+      : null,
+  );
+
+  // View-plugin bridge (Lane V): while a view-plugin is active and its iframe is mounted, run
+  // the `plugin-hello`→`init`→`PluginSession` handshake. `makeFleetHost` hands the plugin the
+  // policed command sink; `onKill` (inbound flood or teardown) reverts to the trusted ops grid.
+  $effect(() => {
+    if (!activeViewPlugin || !pluginFrame) return;
+    const bridge = new PluginBridge(pluginFrame, makeFleetHost(fleet), {
+      // D-2: the manifest's negotiated grant, not the host set. `discoverFrom` computed
+      // this per plugin and nothing ever passed it, so `init` shipped every host
+      // capability to every plugin. `?? []` keeps the fail-closed posture if the active
+      // id somehow has no discovered entry.
+      capabilities:
+        viewPlugins.find((p) => p.manifest.id === activeViewPlugin)?.grantedCapabilities ?? [],
+      onKill: () => {
+        activeViewPlugin = null;
+        view = 'fleet';
+      },
+    });
+    return () => bridge.destroy();
+  });
+
+  // App-plugin compositing (Lane A): a native child webview cannot be covered by CSS z-index,
+  // so a host overlay must trigger a Rust PARK of the active app webview (and a restore on
+  // close). This is the overlay-open/close signal crossing the native boundary.
+  $effect(() => {
+    if (!activeApp || !rectEl) return;
+    const id = activeApp;
+    const el = rectEl;
+    if (overlayOpen) {
+      void invoke('plugin_hide', { id });
+    } else if (pluginState[id] === 'healthy') {
+      void invoke('plugin_show', { id, rect: toRect(el.getBoundingClientRect()) });
+    }
+  });
+
+  // Keep the native app webview glued to the reserved rect on any resize/layout change.
+  $effect(() => {
+    if (!activeApp || !rectEl) return;
+    const id = activeApp;
+    const el = rectEl;
+    const ro = new ResizeObserver(() => {
+      void invoke('plugin_set_rect', { id, rect: toRect(el.getBoundingClientRect()) });
+    });
+    ro.observe(el);
+    return () => ro.disconnect();
+  });
+
   function onApprove() {
     if (!approvalRequest) return;
     if (approvalRequest.kind === 'oracle') {
@@ -154,9 +334,9 @@
     <div class="brand">
       <span class="glyph">◢◤</span>
       <span class="wordmark disp">FLEET&nbsp;COMMAND</span>
-      <Switcher {views} active={view} onselect={(id) => (view = id as ViewId)} />
+      <Switcher views={switcherViews} active={activeSwitcherId} onselect={onSwitch} />
     </div>
-    {#if view === 'fleet'}
+    {#if onFleet}
       <div class="stats">
         <div class="stat"><b class="disp">{activeCount}</b><span>ACTIVE</span></div>
         <div class="stat"><b class="disp">{list.length}</b><span>UNITS</span></div>
@@ -174,7 +354,24 @@
     {/if}
   </header>
 
-  {#if view === 'projects'}
+  {#if activeViewPlugin}
+    <!-- View-plugin: untrusted, sandboxed iframe (opaque "null" origin — allow-scripts only,
+         never allow-same-origin) served over ccplugin://. It lives INSIDE the inert content
+         subtree, so an open host overlay removes it from focus/hit-testing entirely. -->
+    <iframe
+      bind:this={pluginFrame}
+      class="plugin-frame"
+      title="view plugin: {activeViewPlugin}"
+      sandbox="allow-scripts"
+      src={activeViewPluginSrc ?? 'about:blank'}
+      data-testid="view-plugin-frame"
+    ></iframe>
+  {:else if activeApp}
+    <!-- App-plugin: a trusted native child webview is composited OVER this reserved rect by
+         Rust (z-index can't cross the native boundary). The box stays empty; a ResizeObserver
+         keeps the webview glued to it and a host overlay parks it off-screen. -->
+    <div class="app-rect" bind:this={rectEl} data-testid="app-plugin-rect"></div>
+  {:else if view === 'projects'}
     <!-- Projects: the read-only Project Dashboard. Mounts with the real Tauri-backed
          readers, seeds its fleet lane from the shared store, and advances live off the
          store's `phase_changed` stream (no second socket). The store stays alive while
@@ -350,6 +547,11 @@
   .hb.bad { color: var(--red); border-color: rgba(255, 93, 108, 0.45); }
 
   .grid { flex: 1; display: grid; grid-template-columns: 300px 1fr 360px; min-height: 0; }
+
+  /* View-plugin sandboxed iframe fills the content region below the 52px topbar. */
+  .plugin-frame { flex: 1; min-height: 0; width: 100%; border: 0; background: var(--bg); }
+  /* App-plugin reserved rect: the native child webview composites over this empty box. */
+  .app-rect { flex: 1; min-height: 0; }
   .panel { background: var(--panel); display: flex; flex-direction: column; min-height: 0; }
   .left { border-right: 1px solid var(--line-1); padding: 16px; gap: 14px; overflow-y: auto; }
   .right { border-left: 1px solid var(--line-1); padding: 14px; gap: 10px; }
diff --git a/cockpit/ui/src/lib/bridge.proxy.svelte.test.ts b/cockpit/ui/src/lib/bridge.proxy.svelte.test.ts
new file mode 100644
index 0000000..927a531
--- /dev/null
+++ b/cockpit/ui/src/lib/bridge.proxy.svelte.test.ts
@@ -0,0 +1,83 @@
+import { describe, it, expect } from 'vitest';
+import { PluginSession, makeFleetHost, type HostMessage } from './bridge';
+import { FleetStore } from './store.svelte';
+import { newUnit } from './fleet';
+
+// D-7 regression lane. `bridge.test.ts` drives a hand-rolled `BridgeHost` fake whose units
+// are plain objects, so it can never reproduce the production failure: `makeFleetHost` hands
+// the session `store.units[id]` and `store.order`, which are Svelte 5 `$state` PROXIES, and
+// a proxy is not structured-cloneable. `postMessage` therefore threw `DataCloneError` inside
+// `onReady` — before the tick timer was ever installed — so the plugin got no state AND no
+// ticks. These tests use the real store and a real MessagePort for exactly that reason.
+
+function seed(store: FleetStore, id: string, task = 'build the thing') {
+  store.units[id] = newUnit(id, task, 'T1');
+  store.order = [...store.order, id];
+}
+
+describe('PluginSession over a real MessagePort, backed by real $state units', () => {
+  it('posts a full snapshot without throwing DataCloneError', () => {
+    const chan = new MessageChannel();
+    const cleanup = $effect.root(() => {
+      const store = new FleetStore();
+      seed(store, 'u1');
+      // Populate the proxy-backed array fields that `toUnitLite` passes through by
+      // reference - these are what actually fail to clone.
+      store.units['u1'].history.push('spec');
+      store.units['u1'].findings.push({
+        round: 1,
+        title: 'a finding',
+        severity: 'minor',
+        resolved: false,
+      });
+      store.units['u1'].oracleFiles.push('t/a.test.js');
+
+      const session = new PluginSession(chan.port1, makeFleetHost(store), { autoTick: false });
+      expect(() => session.sendFullState()).not.toThrow();
+    });
+    cleanup();
+    chan.port1.close();
+    chan.port2.close();
+  });
+
+  it('actually delivers the unit to the plugin side of the port', async () => {
+    const chan = new MessageChannel();
+    const received: HostMessage[] = [];
+    // Wait on the CONDITION (a message arrived), never on a fixed delay. Port delivery is
+    // async and a `setTimeout(0)` races it - that made this test intermittently red.
+    let seen: () => void;
+    const delivered = new Promise<void>((r) => (seen = r));
+    chan.port2.onmessage = (e: MessageEvent) => {
+      received.push(e.data as HostMessage);
+      seen();
+    };
+    chan.port2.start();
+
+    const cleanup = $effect.root(() => {
+      const store = new FleetStore();
+      seed(store, 'u1');
+      store.units['u1'].oracleFiles.push('t/a.test.js');
+      const session = new PluginSession(chan.port1, makeFleetHost(store), { autoTick: false });
+      session.sendFullState();
+    });
+
+    await Promise.race([
+      delivered,
+      new Promise((_, reject) =>
+        setTimeout(() => reject(new Error('no host message arrived on the port within 5s')), 5000),
+      ),
+    ]);
+    cleanup();
+
+    const state = received.find((m) => m.type === 'state');
+    expect(state, 'plugin received no state message at all').toBeDefined();
+    const msg = state as Extract<HostMessage, { type: 'state' }>;
+    expect(msg.full).toBe(true);
+    expect(msg.order).toEqual(['u1']);
+    expect(msg.changed[0]?.id).toBe('u1');
+    expect(msg.changed[0]?.oracleFiles).toEqual(['t/a.test.js']);
+
+    chan.port1.close();
+    chan.port2.close();
+  });
+});
diff --git a/cockpit/ui/src/lib/bridge.test.ts b/cockpit/ui/src/lib/bridge.test.ts
new file mode 100644
index 0000000..5d80e2d
--- /dev/null
+++ b/cockpit/ui/src/lib/bridge.test.ts
@@ -0,0 +1,428 @@
+import { describe, it, expect, vi } from 'vitest';
+import {
+  PROTOCOL_VERSION,
+  HOST_API_VERSION,
+  HOST_CAPABILITIES,
+  TokenBucket,
+  FloodMeter,
+  policeCommand,
+  toUnitLite,
+  PluginSession,
+  PluginBridge,
+  type BridgeHost,
+  type HostMessage,
+  type UnitLite,
+} from './bridge';
+import { newUnit, type Unit } from './fleet';
+import type { CreateReq } from './api';
+import type { CommandName } from './types';
+
+// ── a minimal in-memory BridgeHost fake ───────────────────────────────────────
+interface HostBag {
+  host: BridgeHost;
+  units: Record<string, Unit>;
+  state: { dirty: string[]; degraded: boolean };
+  logs: Record<string, { seq: number; stream: string; line: string }[]>;
+  launches: CreateReq[];
+  commands: [string, CommandName][];
+  staged: CreateReq[];
+}
+
+function makeHost(): HostBag {
+  const units: Record<string, Unit> = {};
+  const state = { dirty: [] as string[], degraded: false };
+  const logs: Record<string, { seq: number; stream: string; line: string }[]> = {};
+  const launches: CreateReq[] = [];
+  const commands: [string, CommandName][] = [];
+  const staged: CreateReq[] = [];
+  const host: BridgeHost = {
+    order: () => Object.keys(units),
+    unit: (id) => units[id],
+    drainDirty: () => {
+      const d = state.dirty;
+      state.dirty = [];
+      return d;
+    },
+    logsSince: (id, since) => (logs[id] ?? []).filter((l) => l.seq > since),
+    degraded: () => state.degraded,
+    launch: async (req) => {
+      launches.push(req);
+      return 'new-unit';
+    },
+    command: async (id, name) => {
+      commands.push([id, name]);
+    },
+    requestRealLaunch: (req) => {
+      staged.push(req);
+    },
+  };
+  return { host, units, state, logs, launches, commands, staged };
+}
+
+const wait = () => new Promise((r) => setTimeout(r, 0));
+
+// A MessagePort round-trip can span more than one macrotask in jsdom, so poll for the
+// condition rather than assuming a fixed number of ticks.
+async function waitFor(pred: () => boolean, tries = 100): Promise<boolean> {
+  for (let i = 0; i < tries; i++) {
+    if (pred()) return true;
+    await wait();
+  }
+  return pred();
+}
+
+// Collect messages the host sends to the plugin end of a channel.
+function pluginEnd(port: MessagePort): { received: HostMessage[]; port: MessagePort } {
+  const received: HostMessage[] = [];
+  port.onmessage = (e: MessageEvent) => received.push(e.data as HostMessage);
+  port.start?.();
+  return { received, port };
+}
+
+const hasFull = (r: HostMessage[]) => r.some((m) => m.type === 'state' && m.full);
+const findAck = (r: HostMessage[]) => r.find((m) => m.type === 'command-ack') as
+  | Extract<HostMessage, { type: 'command-ack' }>
+  | undefined;
+
+describe('toUnitLite', () => {
+  it('drops the heavy log and caps history', () => {
+    const u = newUnit('u1', 'task', 'T1');
+    u.log = [{ stream: 'agent', line: 'x' }];
+    u.history = Array.from({ length: 100 }, () => 'building' as const);
+    const lite = toUnitLite(u, 10) as UnitLite & { log?: unknown };
+    expect(lite.log).toBeUndefined();
+    expect(lite.history).toHaveLength(10);
+    expect(lite.id).toBe('u1');
+  });
+});
+
+describe('TokenBucket', () => {
+  it('allows up to capacity, then denies until refill', () => {
+    const b = new TokenBucket(2, 1, 0); // 2 tokens, 1/sec
+    expect(b.take(0)).toBe(true);
+    expect(b.take(0)).toBe(true);
+    expect(b.take(0)).toBe(false); // dry
+    expect(b.take(1000)).toBe(true); // +1 token after 1s
+    expect(b.take(1000)).toBe(false);
+  });
+});
+
+describe('FloodMeter', () => {
+  it('fires only once the per-second ceiling is exceeded', () => {
+    const f = new FloodMeter(3);
+    expect(f.hit(0)).toBe(false);
+    expect(f.hit(0)).toBe(false);
+    expect(f.hit(0)).toBe(false);
+    expect(f.hit(0)).toBe(true); // 4th within the window > ceiling 3
+  });
+
+  it('slides the window so old hits expire', () => {
+    const f = new FloodMeter(2);
+    f.hit(0);
+    f.hit(0);
+    expect(f.hit(2000)).toBe(false); // earlier hits aged out
+  });
+});
+
+describe('policeCommand — the trust boundary', () => {
+  const ctx = { hasUnit: (id: string) => id === 'known' };
+
+  it('accepts a well-formed demo launch', () => {
+    const r = policeCommand(
+      { v: 1, type: 'command', reqId: 'r1', launch: { task: 'do it', tier: 't1', mode: 'demo' } },
+      ctx,
+    );
+    expect(r).toEqual({ ok: true, kind: 'launch', req: { task: 'do it', tier: 't1', mode: 'demo', min_review_rounds: 2 } });
+  });
+
+  it('accepts a valid unit command on a known id', () => {
+    const r = policeCommand({ v: 1, type: 'command', reqId: 'r1', unit: { id: 'known', action: 'halt' } }, ctx);
+    expect(r).toEqual({ ok: true, kind: 'unit', unitId: 'known', action: 'halt' });
+  });
+
+  it('rejects a host-only verb (approve_oracle) as an authority violation', () => {
+    const r = policeCommand({ v: 1, type: 'command', reqId: 'r1', unit: { id: 'known', action: 'approve_oracle' } }, ctx);
+    expect(r).toEqual({ ok: false, reasonClass: 'authority' });
+  });
+
+  it('rejects an unknown unit action as unknown-type', () => {
+    const r = policeCommand({ v: 1, type: 'command', reqId: 'r1', unit: { id: 'known', action: 'nuke' } }, ctx);
+    expect(r).toEqual({ ok: false, reasonClass: 'unknown-type' });
+  });
+
+  it('rejects a command against an unknown unit id', () => {
+    const r = policeCommand({ v: 1, type: 'command', reqId: 'r1', unit: { id: 'ghost', action: 'halt' } }, ctx);
+    expect(r).toEqual({ ok: false, reasonClass: 'unknown-id' });
+  });
+
+  it('rejects an over-bound task', () => {
+    const r = policeCommand(
+      { v: 1, type: 'command', reqId: 'r1', launch: { task: 'x'.repeat(3000), tier: 't1', mode: 'demo' } },
+      ctx,
+    );
+    expect(r).toEqual({ ok: false, reasonClass: 'over-bound' });
+  });
+
+  it('rejects malformed shapes (bad version, both/neither payload, empty task, bad tier)', () => {
+    expect(policeCommand({ v: 2, type: 'command', reqId: 'r' }, ctx).ok).toBe(false);
+    expect(policeCommand({ v: 1, type: 'command', reqId: 'r' }, ctx)).toEqual({ ok: false, reasonClass: 'malformed' });
+    expect(
+      policeCommand({ v: 1, type: 'command', reqId: 'r', launch: { task: 'a', tier: 't1', mode: 'demo' }, unit: { id: 'known', action: 'halt' } }, ctx).ok,
+    ).toBe(false);
+    expect(policeCommand({ v: 1, type: 'command', reqId: 'r', launch: { task: '   ', tier: 't1', mode: 'demo' } }, ctx)).toEqual({ ok: false, reasonClass: 'malformed' });
+    expect(policeCommand({ v: 1, type: 'command', reqId: 'r', launch: { task: 'a', tier: 'gold', mode: 'demo' } }, ctx).ok).toBe(false);
+    expect(policeCommand(null, ctx)).toEqual({ ok: false, reasonClass: 'malformed' });
+  });
+
+  it('rejects a task carrying control characters', () => {
+    const task = `bad${String.fromCharCode(0)}null`; // embedded NUL
+    const r = policeCommand({ v: 1, type: 'command', reqId: 'r1', launch: { task, tier: 't1', mode: 'demo' } }, ctx);
+    expect(r).toEqual({ ok: false, reasonClass: 'malformed' });
+  });
+});
+
+describe('PluginSession over a real MessageChannel', () => {
+  it('sends a full snapshot on ready and echoes host capabilities in init separately', async () => {
+    const { host, units } = makeHost();
+    units['u1'] = newUnit('u1', 'task one', 'T1');
+    const ch = new MessageChannel();
+    const plugin = pluginEnd(ch.port2);
+    const session = new PluginSession(ch.port1, host, { autoTick: false });
+    session.start();
+
+    ch.port2.postMessage({ v: 1, type: 'ready' });
+    await waitFor(() => hasFull(plugin.received));
+
+    const full = plugin.received.find((m) => m.type === 'state' && m.full);
+    expect(full).toBeTruthy();
+    expect((full as Extract<HostMessage, { type: 'state' }>).changed.map((u) => u.id)).toEqual(['u1']);
+    session.destroy();
+  });
+
+  it('handshake→ready→full-snapshot succeeds 100× with zero drops', async () => {
+    let delivered = 0;
+    for (let i = 0; i < 100; i++) {
+      const { host, units } = makeHost();
+      units['u1'] = newUnit('u1', 't', 'T1');
+      const ch = new MessageChannel();
+      const plugin = pluginEnd(ch.port2);
+      const session = new PluginSession(ch.port1, host, { autoTick: false });
+      session.start();
+      ch.port2.postMessage({ v: 1, type: 'ready' });
+      if (await waitFor(() => hasFull(plugin.received))) delivered++;
+      session.destroy();
+    }
+    expect(delivered).toBe(100);
+  });
+
+  it('pushes a dirty-delta state on tick containing only changed units', async () => {
+    const bag = makeHost();
+    const { host, units } = bag;
+    units['u1'] = newUnit('u1', 't', 'T1');
+    units['u2'] = newUnit('u2', 't', 'T1');
+    const ch = new MessageChannel();
+    const plugin = pluginEnd(ch.port2);
+    const session = new PluginSession(ch.port1, host, { autoTick: false });
+    session.start();
+    ch.port2.postMessage({ v: 1, type: 'ready' });
+    await waitFor(() => hasFull(plugin.received));
+    plugin.received.length = 0;
+
+    // Only u1 changed since the snapshot.
+    units['u1'].phase = 'building';
+    bag.state.dirty = ['u1'];
+    session.tick();
+    await waitFor(() => plugin.received.some((m) => m.type === 'state'));
+
+    const delta = plugin.received.find((m) => m.type === 'state') as Extract<HostMessage, { type: 'state' }>;
+    expect(delta.full).toBe(false);
+    expect(delta.changed.map((u) => u.id)).toEqual(['u1']);
+    session.destroy();
+  });
+
+  it('emits log-append for new lines and log-reset on reset()', async () => {
+    const bag = makeHost();
+    const { host, units, logs } = bag;
+    units['u1'] = newUnit('u1', 't', 'T1');
+    logs['u1'] = [
+      { seq: 1, stream: 'agent', line: 'first' },
+      { seq: 2, stream: 'agent', line: 'second' },
+    ];
+    const ch = new MessageChannel();
+    const plugin = pluginEnd(ch.port2);
+    const session = new PluginSession(ch.port1, host, { autoTick: false });
+    session.start();
+    ch.port2.postMessage({ v: 1, type: 'ready' });
+    await waitFor(() => hasFull(plugin.received));
+
+    bag.state.dirty = ['u1'];
+    session.tick();
+    await waitFor(() => plugin.received.some((m) => m.type === 'log-append'));
+    const append = plugin.received.find((m) => m.type === 'log-append') as Extract<HostMessage, { type: 'log-append' }>;
+    expect(append.lines.map((l) => l.seq)).toEqual([1, 2]);
+
+    plugin.received.length = 0;
+    session.reset();
+    await waitFor(() => plugin.received.some((m) => m.type === 'log-reset') && hasFull(plugin.received));
+    expect(plugin.received.some((m) => m.type === 'log-reset')).toBe(true);
+    expect(hasFull(plugin.received)).toBe(true);
+    session.destroy();
+  });
+
+  it('policed demo launch reaches the sink and is acked ok', async () => {
+    const bag = makeHost();
+    const ch = new MessageChannel();
+    const plugin = pluginEnd(ch.port2);
+    const session = new PluginSession(ch.port1, bag.host, { autoTick: false });
+    session.start();
+    ch.port2.postMessage({ v: 1, type: 'ready' });
+    await waitFor(() => hasFull(plugin.received));
+
+    ch.port2.postMessage({ v: 1, type: 'command', reqId: 'q1', launch: { task: 'go', tier: 't1', mode: 'demo' } });
+    await waitFor(() => findAck(plugin.received) !== undefined);
+    expect(findAck(plugin.received)).toMatchObject({ reqId: 'q1', ok: true });
+    expect(bag.launches).toHaveLength(1);
+    session.destroy();
+  });
+
+  it('a real launch is staged for host confirm and acked rejected (not executed)', async () => {
+    const bag = makeHost();
+    const ch = new MessageChannel();
+    const plugin = pluginEnd(ch.port2);
+    const session = new PluginSession(ch.port1, bag.host, { autoTick: false });
+    session.start();
+    ch.port2.postMessage({ v: 1, type: 'ready' });
+    await waitFor(() => hasFull(plugin.received));
+
+    ch.port2.postMessage({ v: 1, type: 'command', reqId: 'q2', launch: { task: 'go', tier: 't1', mode: 'real' } });
+    await waitFor(() => findAck(plugin.received) !== undefined);
+    expect(findAck(plugin.received)).toMatchObject({ reqId: 'q2', ok: false, reasonClass: 'real-requires-confirm' });
+    expect(bag.launches).toHaveLength(0); // NOT executed
+    expect(bag.staged).toHaveLength(1); // staged for the host overlay
+    session.destroy();
+  });
+
+  it('acks a rejection with the policy reasonClass (unknown-id)', async () => {
+    const bag = makeHost();
+    const ch = new MessageChannel();
+    const plugin = pluginEnd(ch.port2);
+    const session = new PluginSession(ch.port1, bag.host, { autoTick: false });
+    session.start();
+    ch.port2.postMessage({ v: 1, type: 'ready' });
+    await waitFor(() => hasFull(plugin.received));
+
+    ch.port2.postMessage({ v: 1, type: 'command', reqId: 'q3', unit: { id: 'ghost', action: 'halt' } });
+    await waitFor(() => findAck(plugin.received) !== undefined);
+    expect(findAck(plugin.received)).toMatchObject({ reqId: 'q3', ok: false, reasonClass: 'unknown-id' });
+    expect(bag.commands).toHaveLength(0);
+    session.destroy();
+  });
+
+  it('an inbound flood kills the plugin (port close + onKill)', async () => {
+    const bag = makeHost();
+    const ch = new MessageChannel();
+    pluginEnd(ch.port2);
+    const onKill = vi.fn();
+    const session = new PluginSession(ch.port1, bag.host, { autoTick: false, floodCeiling: 5, onKill });
+    session.start();
+    ch.port2.postMessage({ v: 1, type: 'ready' });
+    await wait();
+
+    for (let i = 0; i < 50; i++) {
+      ch.port2.postMessage({ v: 1, type: 'command', reqId: `f${i}`, unit: { id: 'x', action: 'halt' } });
+    }
+    await waitFor(() => onKill.mock.calls.length > 0);
+    expect(onKill).toHaveBeenCalledWith('flood');
+    expect(session.isAlive).toBe(false);
+  });
+});
+
+describe('PluginBridge window handshake (hello → init + port)', () => {
+  it('replies init only to a hello from OUR frame, transferring a port', async () => {
+    const bag = makeHost();
+    let initMsg: HostMessage | null = null;
+    let transferred: MessagePort | null = null;
+    const contentWindow = {
+      postMessage: (msg: unknown, _o: string, transfer?: Transferable[]) => {
+        initMsg = msg as HostMessage;
+        transferred = (transfer?.[0] as MessagePort) ?? null;
+      },
+    };
+    const bridge = new PluginBridge({ contentWindow }, bag.host, { autoTick: false });
+
+    // A hello from a DIFFERENT source is ignored.
+    bridge.onWindowMessage({ data: { v: 1, type: 'plugin-hello' }, source: {} });
+    expect(bridge.active).toBeNull();
+
+    // A hello from our frame completes the handshake.
+    bridge.onWindowMessage({ data: { v: 1, type: 'plugin-hello' }, source: contentWindow });
+    expect(bridge.active).not.toBeNull();
+    // Capabilities are asserted in the D-2 block below. This bridge is constructed without a
+    // grant, and the fallback is now fail-closed — this line previously asserted the FULL host
+    // set here, which encoded the D-2 defect as expected behaviour (the same mistake
+    // `loader.test.ts:52` made for D-1).
+    expect(initMsg).toMatchObject({ type: 'init', apiVersion: HOST_API_VERSION, capabilities: [] });
+    expect(transferred).toBeTruthy();
+
+    // The transferred port is live: driving ready over it yields a snapshot.
+    const plugin = pluginEnd(transferred!);
+    transferred!.postMessage({ v: PROTOCOL_VERSION, type: 'ready' });
+    await waitFor(() => hasFull(plugin.received));
+    expect(hasFull(plugin.received)).toBe(true);
+
+    bridge.destroy();
+  });
+
+  it('ignores a second hello (handshake is once-only)', () => {
+    const bag = makeHost();
+    let posts = 0;
+    const contentWindow = { postMessage: () => { posts++; } };
+    const bridge = new PluginBridge({ contentWindow }, bag.host, { autoTick: false });
+    bridge.onWindowMessage({ data: { v: 1, type: 'plugin-hello' }, source: contentWindow });
+    bridge.onWindowMessage({ data: { v: 1, type: 'plugin-hello' }, source: contentWindow });
+    expect(posts).toBe(1);
+    bridge.destroy();
+  });
+});
+
+// ── D-2: the manifest's capability grant must actually reach the plugin ───────
+//
+// `discoverFrom` computes `grantedCapabilities` per plugin (`loader.ts:140`), but nothing
+// passed it to the bridge, so `init` shipped the FULL host set to every plugin regardless of
+// what its manifest asked for. Observed live in both the dev and packaged smokes: a plugin
+// whose manifest requests only `log-append` was granted `real-launch-confirm` as well.
+//
+// The fallback is now fail-CLOSED. A bridge constructed without an explicit grant offers
+// nothing, so forgetting to pass the grant can never again silently widen it.
+describe('PluginBridge capability grant (D-2)', () => {
+  function handshake(opts: Record<string, unknown>): HostMessage {
+    const bag = makeHost();
+    let initMsg: HostMessage | null = null;
+    const contentWindow = {
+      postMessage: (msg: unknown) => {
+        initMsg = msg as HostMessage;
+      },
+    };
+    const bridge = new PluginBridge({ contentWindow }, bag.host, { autoTick: false, ...opts });
+    bridge.onWindowMessage({ data: { v: 1, type: 'plugin-hello' }, source: contentWindow });
+    bridge.destroy();
+    return initMsg!;
+  }
+
+  it('ships exactly the negotiated grant, not the host set', () => {
+    const init = handshake({ capabilities: ['log-append'] });
+    expect(init).toMatchObject({ type: 'init', capabilities: ['log-append'] });
+    // The precise defect: `real-launch-confirm` leaking to a plugin that never asked.
+    expect((init as { capabilities: string[] }).capabilities).not.toContain('real-launch-confirm');
+  });
+
+  it('fails CLOSED when no grant is passed', () => {
+    const init = handshake({});
+    expect((init as { capabilities: string[] }).capabilities).toEqual([]);
+  });
+
+  it('an empty grant stays empty', () => {
+    const init = handshake({ capabilities: [] });
+    expect((init as { capabilities: string[] }).capabilities).toEqual([]);
+  });
+});
diff --git a/cockpit/ui/src/lib/bridge.ts b/cockpit/ui/src/lib/bridge.ts
new file mode 100644
index 0000000..75ff087
--- /dev/null
+++ b/cockpit/ui/src/lib/bridge.ts
@@ -0,0 +1,629 @@
+// View-plugin MessagePort bridge + command policy (Lane V).
+//
+// A view plugin is UNTRUSTED UI in a sandboxed iframe (`allow-scripts`, never
+// `allow-same-origin` → opaque "null" origin). Its only channel to the host is a
+// MessagePort transferred at handshake. The host identifies the plugin by HOLDING the
+// port (not by `event.origin`, which is "null" and unusable for auth), and it POLICES
+// every command before it reaches the store's single command sink.
+//
+// Handshake (plugin-announces-ready — avoids the `load`-event post race):
+//   1. Host attaches a window `message` listener, then creates the sandboxed iframe.
+//   2. The plugin posts a window-level `plugin-hello` to `parent`.
+//   3. The host replies `init` TRANSFERRING port2; thereafter all traffic is on the port.
+//
+// This module has three testable layers:
+//   • pure policy + rate/flood primitives (`policeCommand`, `TokenBucket`, `FloodMeter`),
+//   • `PluginSession` — everything that happens over an established MessagePort,
+//   • `PluginBridge` — the window `plugin-hello` → `init`+port dance around a `PluginSession`.
+
+import type { CreateReq } from './api';
+import type { Unit } from './fleet';
+import type { CommandName } from './types';
+import type { FleetStore, LogDelta } from './store.svelte';
+
+export const PROTOCOL_VERSION = 1 as const;
+/** The apiVersion the host implements; a manifest asking for anything else is refused. */
+export const HOST_API_VERSION = 1;
+/** The named capability set the host advertises in `init` (grows without apiVersion breaks). */
+export const HOST_CAPABILITIES = ['log-append', 'real-launch-confirm'] as const;
+
+export type PluginTier = 't1' | 't2' | 't3';
+export type PluginMode = 'demo' | 'real';
+export type PluginUnitAction = 'halt' | 'resume' | 'abandon' | 'ship';
+
+/** Host-only command verbs a plugin may NEVER issue (the overlay owns these). */
+export const HOST_ONLY_ACTIONS = ['approve_oracle', 'reject_oracle'];
+/** Unit verbs a plugin MAY request (still policed for shape/id/rate). */
+export const PLUGIN_UNIT_ACTIONS: PluginUnitAction[] = ['halt', 'resume', 'abandon', 'ship'];
+/** Upper bound on a plugin-supplied `task` string. */
+export const MAX_TASK_LEN = 2000;
+/** How many phase entries `UnitLite.history` carries (a generous bounded phase walk). */
+export const HISTORY_CAP = 64;
+
+// ── wire messages ────────────────────────────────────────────────────────────
+// host → plugin
+export interface InitMsg {
+  v: 1;
+  type: 'init';
+  apiVersion: number;
+  capabilities: string[];
+}
+export interface StateMsg {
+  v: 1;
+  type: 'state';
+  /** true = full snapshot (resets the plugin's per-unit baseline); false = dirty delta. */
+  full: boolean;
+  changed: UnitLite[];
+  /** Reserved-always-empty this cycle (the store never deletes units). */
+  removed: string[];
+  order: string[];
+  /** Coarse daemon health — the literal key/version stay host-side (no recon). */
+  degraded: boolean;
+}
+export interface LogAppendMsg {
+  v: 1;
+  type: 'log-append';
+  unitId: string;
+  lines: LogDelta[];
+}
+export interface LogResetMsg {
+  v: 1;
+  type: 'log-reset';
+}
+export interface CommandAckMsg {
+  v: 1;
+  type: 'command-ack';
+  reqId: string;
+  ok: boolean;
+  reasonClass?: string;
+}
+export type HostMessage = InitMsg | StateMsg | LogAppendMsg | LogResetMsg | CommandAckMsg;
+
+// plugin → host
+export interface HelloMsg {
+  v: 1;
+  type: 'plugin-hello';
+}
+export interface ReadyMsg {
+  v: 1;
+  type: 'ready';
+}
+export interface CommandMsg {
+  v: 1;
+  type: 'command';
+  /** Opaque, plugin-scoped correlation id — echoed in `command-ack`. NOT the host cmd_id. */
+  reqId: string;
+  launch?: { task: string; tier: PluginTier; mode: PluginMode; min_review_rounds?: number };
+  unit?: { id: string; action: PluginUnitAction };
+}
+
+/** `UnitLite` = a unit minus its (heavy, untagged) `log`; `history` is capped by the bridge. */
+export type UnitLite = Omit<Unit, 'log'>;
+
+export function toUnitLite(u: Unit, historyCap = HISTORY_CAP): UnitLite {
+  return {
+    id: u.id,
+    task: u.task,
+    tier: u.tier,
+    phase: u.phase,
+    history: u.history.slice(-historyCap),
+    cost: u.cost,
+    usdCap: u.usdCap,
+    tokensIn: u.tokensIn,
+    tokensOut: u.tokensOut,
+    iters: u.iters,
+    findings: u.findings,
+    oracleFiles: u.oracleFiles,
+    branch: u.branch,
+    pr: u.pr,
+    blocked: u.blocked,
+    awaitingSlot: u.awaitingSlot,
+    rateLimited: u.rateLimited,
+    error: u.error,
+    result: u.result,
+    lastSeq: u.lastSeq,
+  };
+}
+
+// ── rate / flood primitives ──────────────────────────────────────────────────
+
+/** Token bucket for ACCEPTED commands (a second, stricter bucket guards `launch`). */
+export class TokenBucket {
+  private tokens: number;
+  private last: number;
+  constructor(
+    private readonly capacity: number,
+    private readonly refillPerSec: number,
+    now: number = Date.now(),
+  ) {
+    this.tokens = capacity;
+    this.last = now;
+  }
+
+  /** Consume `cost` tokens; returns false (and consumes nothing) if the bucket is dry. */
+  take(now: number = Date.now(), cost = 1): boolean {
+    const elapsed = Math.max(0, now - this.last) / 1000;
+    this.tokens = Math.min(this.capacity, this.tokens + elapsed * this.refillPerSec);
+    this.last = now;
+    if (this.tokens >= cost) {
+      this.tokens -= cost;
+      return true;
+    }
+    return false;
+  }
+}
+
+/**
+ * Inbound port-message ceiling measured BEFORE policy — a flood can't be deserialized
+ * into a host-thread stall. Sliding one-second window; `hit()` returns true when the
+ * ceiling is exceeded (the session then `port.close()`s the plugin).
+ */
+export class FloodMeter {
+  private times: number[] = [];
+  constructor(private readonly ceilingPerSec: number) {}
+
+  hit(now: number = Date.now()): boolean {
+    this.times.push(now);
+    const cutoff = now - 1000;
+    let drop = 0;
+    while (drop < this.times.length && this.times[drop] < cutoff) drop++;
+    if (drop) this.times.splice(0, drop);
+    return this.times.length > this.ceilingPerSec;
+  }
+}
+
+// ── command policy (the trust boundary — a policy, not just a schema check) ────
+
+export type PolicyResult =
+  | { ok: true; kind: 'launch'; req: CreateReq }
+  | { ok: true; kind: 'unit'; unitId: string; action: PluginUnitAction }
+  | { ok: false; reasonClass: string };
+
+export interface PolicyContext {
+  /** Does this unit id exist in the host's FleetState? */
+  hasUnit(id: string): boolean;
+}
+
+function isPrintable(s: string): boolean {
+  // Reject control chars (except tab 0x09, newline 0x0a, carriage-return 0x0d) so a
+  // plugin cannot smuggle escapes/nulls into a task string.
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c === 0x09 || c === 0x0a || c === 0x0d) continue;
+    if (c < 0x20 || c === 0x7f) return false;
+  }
+  return true;
+}
+
+/**
+ * Validate a plugin `command` for SHAPE, AUTHORITY, and BOUNDS. Stateless and pure —
+ * cost/`real` gating and rate limiting are stateful and enforced by the session. Returns
+ * a discriminated result the session turns into a store call + `command-ack`.
+ *
+ * reasonClass vocabulary: `malformed` · `authority` (host-only verb) · `unknown-type`
+ * (unknown unit action) · `unknown-id` · `over-bound` (task too long).
+ */
+export function policeCommand(msg: unknown, ctx: PolicyContext): PolicyResult {
+  if (typeof msg !== 'object' || msg === null) return { ok: false, reasonClass: 'malformed' };
+  const m = msg as Record<string, unknown>;
+  if (m.v !== PROTOCOL_VERSION || m.type !== 'command') return { ok: false, reasonClass: 'malformed' };
+  if (typeof m.reqId !== 'string' || m.reqId.length === 0) return { ok: false, reasonClass: 'malformed' };
+
+  const hasLaunch = m.launch !== undefined;
+  const hasUnit = m.unit !== undefined;
+  if (hasLaunch === hasUnit) return { ok: false, reasonClass: 'malformed' }; // exactly one
+
+  if (hasUnit) {
+    const u = m.unit as Record<string, unknown>;
+    if (typeof u?.id !== 'string' || typeof u?.action !== 'string') {
+      return { ok: false, reasonClass: 'malformed' };
+    }
+    if (HOST_ONLY_ACTIONS.includes(u.action)) return { ok: false, reasonClass: 'authority' };
+    if (!PLUGIN_UNIT_ACTIONS.includes(u.action as PluginUnitAction)) {
+      return { ok: false, reasonClass: 'unknown-type' };
+    }
+    if (!ctx.hasUnit(u.id)) return { ok: false, reasonClass: 'unknown-id' };
+    return { ok: true, kind: 'unit', unitId: u.id, action: u.action as PluginUnitAction };
+  }
+
+  const l = m.launch as Record<string, unknown>;
+  if (typeof l?.task !== 'string') return { ok: false, reasonClass: 'malformed' };
+  if (l.task.trim().length === 0 || !isPrintable(l.task)) return { ok: false, reasonClass: 'malformed' };
+  if (l.task.length > MAX_TASK_LEN) return { ok: false, reasonClass: 'over-bound' };
+  if (l.tier !== 't1' && l.tier !== 't2' && l.tier !== 't3') return { ok: false, reasonClass: 'malformed' };
+  if (l.mode !== 'demo' && l.mode !== 'real') return { ok: false, reasonClass: 'malformed' };
+  let rounds = 2;
+  if (l.min_review_rounds !== undefined) {
+    if (typeof l.min_review_rounds !== 'number' || !Number.isInteger(l.min_review_rounds) || l.min_review_rounds < 1 || l.min_review_rounds > 6) {
+      return { ok: false, reasonClass: 'over-bound' };
+    }
+    rounds = l.min_review_rounds;
+  }
+  return {
+    ok: true,
+    kind: 'launch',
+    req: { task: l.task, tier: l.tier, mode: l.mode, min_review_rounds: rounds },
+  };
+}
+
+// ── host adapter ─────────────────────────────────────────────────────────────
+
+/**
+ * The narrow surface the bridge needs from the host store — so the session is testable
+ * against a fake and the store stays the single owner of fleet state + command sink.
+ */
+export interface BridgeHost {
+  order(): string[];
+  unit(id: string): Unit | undefined;
+  drainDirty(): string[];
+  logsSince(id: string, sinceSeq: number): LogDelta[];
+  /** Coarse daemon health only — never the literal key/version. */
+  degraded(): boolean;
+  launch(req: CreateReq): Promise<string>;
+  command(unitId: string, name: CommandName): Promise<void>;
+  requestRealLaunch(req: CreateReq): void;
+}
+
+/** Adapt the real `FleetStore` singleton into a `BridgeHost`. */
+export function makeFleetHost(store: FleetStore): BridgeHost {
+  return {
+    order: () => store.order,
+    unit: (id) => store.units[id],
+    drainDirty: () => store.drainDirty(),
+    logsSince: (id, since) => store.logsSince(id, since),
+    degraded: () => {
+      const d = store.daemon;
+      return !d || !d.docker || !d.anthropic_key;
+    },
+    launch: (req) => store.launch(req),
+    command: (id, name) => store.cmd(name, id),
+    requestRealLaunch: (req) => store.requestRealLaunch(req),
+  };
+}
+
+// ── session ──────────────────────────────────────────────────────────────────
+
+export interface SessionOpts {
+  /** State/log push cadence (ms). */
+  tickMs?: number;
+  /** Start the internal tick timer on `ready` (false = drive `tick()` manually in tests). */
+  autoTick?: boolean;
+  /** Inbound msgs/sec ceiling before `port.close()` kill. */
+  floodCeiling?: number;
+  /** Accepted-command token bucket size + refill/sec. */
+  bucketCapacity?: number;
+  bucketRefillPerSec?: number;
+  /** Stricter bucket for `launch`. */
+  launchBucketCapacity?: number;
+  launchBucketRefillPerSec?: number;
+  /** Host capabilities to echo in `init` (defaults to `HOST_CAPABILITIES`). */
+  capabilities?: string[];
+  /** Called when the plugin is killed (flood/destroy) so the host can revert to ops grid. */
+  onKill?: (reason: string) => void;
+  now?: () => number;
+}
+
+const DEFAULTS = {
+  tickMs: 60,
+  floodCeiling: 200,
+  bucketCapacity: 20,
+  bucketRefillPerSec: 10,
+  launchBucketCapacity: 3,
+  launchBucketRefillPerSec: 0.5,
+};
+
+/**
+ * Everything that happens over an established MessagePort: the `ready` handshake tail,
+ * dirty-delta `state` pushes, `log-append`/`log-reset`, and policed `command` → sink →
+ * `command-ack`. Constructed with `port1`; the plugin holds `port2`.
+ */
+export class PluginSession {
+  private ready = false;
+  private alive = true;
+  private timer: ReturnType<typeof setInterval> | null = null;
+  private readonly flood: FloodMeter;
+  private readonly bucket: TokenBucket;
+  private readonly launchBucket: TokenBucket;
+  private readonly now: () => number;
+  private readonly tickMs: number;
+  private readonly autoTick: boolean;
+  private readonly capabilities: string[];
+  // Per-unit last-emitted `UnitLite` JSON — suppresses no-op deltas (the "only changed
+  // units" payload AC). A full snapshot resets this baseline.
+  private emitted: Record<string, string> = {};
+  // Per-unit log seq cursor: the highest seq already delivered via `log-append`.
+  private logCursor: Record<string, number> = {};
+
+  constructor(
+    private readonly port: MessagePort,
+    private readonly host: BridgeHost,
+    opts: SessionOpts = {},
+  ) {
+    this.now = opts.now ?? Date.now;
+    this.tickMs = opts.tickMs ?? DEFAULTS.tickMs;
+    this.autoTick = opts.autoTick ?? true;
+    this.capabilities = opts.capabilities ?? [...HOST_CAPABILITIES];
+    this.flood = new FloodMeter(opts.floodCeiling ?? DEFAULTS.floodCeiling);
+    this.bucket = new TokenBucket(
+      opts.bucketCapacity ?? DEFAULTS.bucketCapacity,
+      opts.bucketRefillPerSec ?? DEFAULTS.bucketRefillPerSec,
+      this.now(),
+    );
+    this.launchBucket = new TokenBucket(
+      opts.launchBucketCapacity ?? DEFAULTS.launchBucketCapacity,
+      opts.launchBucketRefillPerSec ?? DEFAULTS.launchBucketRefillPerSec,
+      this.now(),
+    );
+    this.onKill = opts.onKill;
+  }
+
+  private onKill?: (reason: string) => void;
+
+  /** Begin receiving on the port. The plugin replies `ready`; then we snapshot + tick. */
+  start(): void {
+    this.port.onmessage = (e: MessageEvent) => this.handleMessage(e.data);
+    this.port.start?.();
+  }
+
+  private handleMessage(data: unknown): void {
+    if (!this.alive) return;
+    // Flood ceiling is measured BEFORE any parsing/policy — the whole point is that a
+    // flood can't even be deserialized into a host-thread stall.
+    if (this.flood.hit(this.now())) {
+      this.kill('flood');
+      return;
+    }
+    const m = data as Record<string, unknown> | null;
+    if (!m || m.v !== PROTOCOL_VERSION) return;
+    if (m.type === 'ready') {
+      this.onReady();
+    } else if (m.type === 'command') {
+      void this.onCommand(m);
+    }
+    // unknown types are ignored (forward-compatible)
+  }
+
+  private onReady(): void {
+    if (this.ready) return;
+    this.ready = true;
+    this.sendFullState();
+    if (this.autoTick) {
+      this.timer = setInterval(() => this.tick(), this.tickMs);
+    }
+  }
+
+  /** Post a FULL snapshot and reset the per-unit delta baseline. */
+  sendFullState(): void {
+    const changed: UnitLite[] = [];
+    for (const id of this.host.order()) {
+      const u = this.host.unit(id);
+      if (!u) continue;
+      const lite = toUnitLite(u);
+      this.emitted[id] = JSON.stringify(lite);
+      changed.push(lite);
+    }
+    this.post({
+      v: 1,
+      type: 'state',
+      full: true,
+      changed,
+      removed: [],
+      order: this.host.order(),
+      degraded: this.host.degraded(),
+    });
+  }
+
+  /**
+   * Drain the store's dirty set and push a per-unit `state` delta (only units whose
+   * `UnitLite` actually changed) plus `log-append` for any new seq-tagged log lines.
+   */
+  tick(): void {
+    if (!this.ready || !this.alive) return;
+    const ids = this.host.drainDirty();
+    const changed: UnitLite[] = [];
+    for (const id of ids) {
+      const u = this.host.unit(id);
+      if (!u) continue;
+      const lite = toUnitLite(u);
+      const json = JSON.stringify(lite);
+      if (json !== this.emitted[id]) {
+        this.emitted[id] = json;
+        changed.push(lite);
+      }
+      // Log deltas are independent of the state-delta suppression above.
+      const cursor = this.logCursor[id] ?? 0;
+      const lines = this.host.logsSince(id, cursor);
+      if (lines.length) {
+        this.logCursor[id] = lines[lines.length - 1].seq;
+        this.post({ v: 1, type: 'log-append', unitId: id, lines });
+      }
+    }
+    if (changed.length) {
+      this.post({
+        v: 1,
+        type: 'state',
+        full: false,
+        changed,
+        removed: [],
+        order: this.host.order(),
+        degraded: this.host.degraded(),
+      });
+    }
+  }
+
+  /** On a daemon-stream reconnect: tell the plugin to discard cursors, then full-snapshot. */
+  reset(): void {
+    this.logCursor = {};
+    this.post({ v: 1, type: 'log-reset' });
+    this.emitted = {};
+    this.sendFullState();
+  }
+
+  private async onCommand(m: Record<string, unknown>): Promise<void> {
+    const result = policeCommand(m, { hasUnit: (id) => this.host.unit(id) !== undefined });
+    const reqId = typeof m.reqId === 'string' ? m.reqId : '';
+    if (!result.ok) {
+      this.ack(reqId, false, result.reasonClass);
+      return;
+    }
+    if (result.kind === 'launch') {
+      // Stricter launch bucket + the general bucket.
+      if (!this.launchBucket.take(this.now()) || !this.bucket.take(this.now())) {
+        this.ack(reqId, false, 'rate-limited');
+        return;
+      }
+      // Cost/`real`: a plugin `launch` is demo-only. A `real` request is STAGED for the
+      // host's real-launch confirm overlay (host-owned) and acked rejected so the
+      // plugin's promise resolves ("blocked pending confirm") instead of hanging.
+      if (result.req.mode === 'real') {
+        this.host.requestRealLaunch(result.req);
+        this.ack(reqId, false, 'real-requires-confirm');
+        return;
+      }
+      try {
+        await this.host.launch(result.req);
+        this.ack(reqId, true);
+      } catch {
+        this.ack(reqId, false, 'sink-error');
+      }
+      return;
+    }
+    // unit command
+    if (!this.bucket.take(this.now())) {
+      this.ack(reqId, false, 'rate-limited');
+      return;
+    }
+    try {
+      await this.host.command(result.unitId, result.action);
+      this.ack(reqId, true);
+    } catch {
+      this.ack(reqId, false, 'sink-error');
+    }
+  }
+
+  private ack(reqId: string, ok: boolean, reasonClass?: string): void {
+    const msg: CommandAckMsg = { v: 1, type: 'command-ack', reqId, ok };
+    if (reasonClass !== undefined) msg.reasonClass = reasonClass;
+    this.post(msg);
+  }
+
+  /**
+   * Svelte 5 `$state` proxies are not structured-cloneable, and `makeFleetHost` hands this
+   * session live store proxies (`store.units[id]`, `store.order`). Posting one throws
+   * `DataCloneError`; raised from `onReady` that killed the whole state channel before the
+   * tick timer was installed (D-7). Every outbound payload is plain JSON data by contract —
+   * `UnitLite` is already JSON-serialised for delta suppression — so a round-trip is both
+   * sufficient and the cheapest guarantee that no proxy reaches `postMessage`. Done here,
+   * at the single choke point, so `state`, `log-append`, `order` and `degraded` are all
+   * covered rather than one call site.
+   */
+  private post(msg: HostMessage): void {
+    if (!this.alive) return;
+    this.port.postMessage(JSON.parse(JSON.stringify(msg)) as HostMessage);
+  }
+
+  /** Kill the plugin: stop the tick, close the port, notify the host (→ ops-grid revert). */
+  kill(reason: string): void {
+    if (!this.alive) return;
+    this.alive = false;
+    if (this.timer !== null) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+    try {
+      this.port.close();
+    } catch {
+      /* already closed */
+    }
+    this.onKill?.(reason);
+  }
+
+  /** Clean unmount (view switch): identical teardown, reason `destroy`. */
+  destroy(): void {
+    this.kill('destroy');
+  }
+
+  get isReady(): boolean {
+    return this.ready;
+  }
+  get isAlive(): boolean {
+    return this.alive;
+  }
+  /** The host capability set echoed to the plugin (for tests/introspection). */
+  get advertisedCapabilities(): string[] {
+    return this.capabilities;
+  }
+}
+
+// ── window-level bridge (hello → init+port → session) ─────────────────────────
+
+/** The subset of an `<iframe>` the bridge needs (so it's fakeable in tests). */
+export interface FrameLike {
+  contentWindow:
+    | { postMessage(msg: unknown, targetOrigin: string, transfer?: Transferable[]): void }
+    | null;
+}
+
+/**
+ * Wires the window-level `plugin-hello` → `init` (with transferred port) handshake around
+ * a `PluginSession`. Identity is bound to `frame.contentWindow` (`event.source`) — the
+ * only trustworthy handle, since the sandboxed frame's origin is the unusable "null".
+ */
+export class PluginBridge {
+  private session: PluginSession | null = null;
+  private readonly listener: (e: MessageEvent) => void;
+
+  constructor(
+    private readonly frame: FrameLike,
+    private readonly host: BridgeHost,
+    private readonly opts: SessionOpts = {},
+  ) {
+    this.listener = (e) => this.onWindowMessage(e);
+    if (typeof window !== 'undefined') {
+      window.addEventListener('message', this.listener as EventListener);
+    }
+  }
+
+  /**
+   * Handle a window `message`. Exposed (not just wired to `window`) so tests can drive the
+   * handshake without constructing a real cross-window `MessageEvent` (whose `source` is
+   * not settable in jsdom). Only a `plugin-hello` from OUR frame is honored, exactly once.
+   */
+  onWindowMessage(e: { data: unknown; source: unknown }): void {
+    if (this.session) return; // handshake already completed — ignore extras
+    if (e.source !== this.frame.contentWindow) return; // identity: must be OUR frame
+    const d = e.data as Record<string, unknown> | null;
+    if (!d || d.v !== PROTOCOL_VERSION || d.type !== 'plugin-hello') return;
+    const cw = this.frame.contentWindow;
+    if (!cw) return;
+    const channel = new MessageChannel();
+    const init: InitMsg = {
+      v: 1,
+      type: 'init',
+      apiVersion: HOST_API_VERSION,
+      // Fail CLOSED (D-2). This used to default to the full host set, so a caller that
+      // forgot to pass the manifest's negotiated grant silently handed the plugin
+      // everything — which is exactly what happened: every view-plugin ran with every
+      // host capability regardless of its manifest. An absent grant now means no grant.
+      capabilities: this.opts.capabilities ?? [],
+    };
+    // `"*"` targetOrigin is safe — the init payload is non-sensitive and the sandboxed
+    // frame's real origin is "null" (can't be named). Trust comes from holding port1.
+    cw.postMessage(init, '*', [channel.port2]);
+    this.session = new PluginSession(channel.port1, this.host, this.opts);
+    this.session.start();
+  }
+
+  get active(): PluginSession | null {
+    return this.session;
+  }
+
+  /** Full teardown: stop listening, kill the session (closes the port). No leaks. */
+  destroy(): void {
+    if (typeof window !== 'undefined') {
+      window.removeEventListener('message', this.listener as EventListener);
+    }
+    this.session?.destroy();
+    this.session = null;
+  }
+}
diff --git a/cockpit/ui/src/lib/loader.test.ts b/cockpit/ui/src/lib/loader.test.ts
new file mode 100644
index 0000000..e6ceb12
--- /dev/null
+++ b/cockpit/ui/src/lib/loader.test.ts
@@ -0,0 +1,93 @@
+import { describe, it, expect } from 'vitest';
+import {
+  validateManifest,
+  negotiateCapabilities,
+  pluginSrc,
+  discoverFrom,
+  devPluginSource,
+  packagedPluginSource,
+  type PluginManifest,
+} from './loader';
+import { HOST_API_VERSION } from './bridge';
+
+const good = {
+  id: 'reference',
+  name: 'Reference',
+  version: '0.1.0',
+  apiVersion: HOST_API_VERSION,
+  capabilities: ['log-append'],
+  entry: 'index.html',
+};
+
+describe('validateManifest', () => {
+  it('accepts a well-formed manifest', () => {
+    const r = validateManifest(good);
+    expect(r.ok).toBe(true);
+  });
+
+  it('refuses an unsupported apiVersion (host will not load it)', () => {
+    const r = validateManifest({ ...good, apiVersion: 99 });
+    expect(r).toEqual({ ok: false, reason: 'unsupported-apiVersion' });
+  });
+
+  it('rejects a bad id, missing entry, path-traversal entry, and non-object', () => {
+    expect(validateManifest({ ...good, id: 'Bad Id!' }).ok).toBe(false);
+    expect(validateManifest({ ...good, entry: '' }).ok).toBe(false);
+    expect(validateManifest({ ...good, entry: '../escape.html' })).toEqual({ ok: false, reason: 'bad-entry' });
+    expect(validateManifest(null)).toEqual({ ok: false, reason: 'not-an-object' });
+    expect(validateManifest({ ...good, capabilities: 'nope' }).ok).toBe(false);
+  });
+});
+
+describe('negotiateCapabilities', () => {
+  it('intersects the requested set with the host set (dropping unknowns)', () => {
+    const m: PluginManifest = { ...good, capabilities: ['log-append', 'mystery-power'] };
+    expect(negotiateCapabilities(m)).toEqual(['log-append']);
+  });
+});
+
+describe('pluginSrc', () => {
+  it('resolves the dev static route', () => {
+    expect(pluginSrc('dev', 'reference', 'index.html')).toBe('/plugins/reference/index.html');
+  });
+
+  // Windows/WebView2 (the primary target) serves a custom scheme at `http://<scheme>.localhost`.
+  // A literal `ccplugin://` URL is an EXTERNAL protocol there, and a sandboxed iframe refuses to
+  // navigate to one ("Navigation to external protocol blocked by sandbox") — the frame stays blank.
+  it('resolves the packaged URL to the http://ccplugin.localhost origin on Windows', () => {
+    expect(pluginSrc('packaged', 'reference', 'index.html', true)).toBe(
+      'http://ccplugin.localhost/reference/index.html',
+    );
+  });
+
+  it('resolves the packaged URL to the ccplugin:// scheme off Windows', () => {
+    expect(pluginSrc('packaged', 'reference', 'index.html', false)).toBe(
+      'ccplugin://localhost/reference/index.html',
+    );
+  });
+});
+
+describe('discoverFrom', () => {
+  it('partitions valid vs rejected and dedups ids', () => {
+    const res = discoverFrom('dev', [good, { ...good, apiVersion: 5 }, good]);
+    expect(res.plugins).toHaveLength(1);
+    expect(res.plugins[0].src).toBe('/plugins/reference/index.html');
+    expect(res.plugins[0].grantedCapabilities).toEqual(['log-append']);
+    expect(res.rejected.map((r) => r.reason)).toEqual(['unsupported-apiVersion', 'duplicate-id']);
+  });
+});
+
+describe('plugin sources (dev index | packaged scan)', () => {
+  it('devPluginSource discovers from a build-time index', async () => {
+    const src = devPluginSource({ manifests: [good] });
+    const { plugins } = await src.discover();
+    expect(plugins.map((p) => p.manifest.id)).toEqual(['reference']);
+    expect(plugins[0].src.startsWith('/plugins/')).toBe(true);
+  });
+
+  it('packagedPluginSource discovers from an injected scan and resolves scheme URLs', async () => {
+    const src = packagedPluginSource(async () => [good]);
+    const { plugins } = await src.discover();
+    expect(plugins[0].src).toBe('ccplugin://localhost/reference/index.html');
+  });
+});
diff --git a/cockpit/ui/src/lib/loader.ts b/cockpit/ui/src/lib/loader.ts
new file mode 100644
index 0000000..87c01a1
--- /dev/null
+++ b/cockpit/ui/src/lib/loader.ts
@@ -0,0 +1,163 @@
+// View-plugin loader (Lane V): discovery, manifest validation, apiVersion gate,
+// capability negotiation, and iframe-src resolution across the dev/packaged seam.
+//
+// Discovery is a single injected interface (`PluginSource`) with two impls:
+//   • dev (`vite dev`): a build-time-generated dev index of raw manifests; assets are
+//     served by a Vite static route at `/plugins/<id>/…` (no Tauri scheme exists here).
+//   • packaged: raw manifests scanned from bundled resources ∪ `~/.command-center/plugins`;
+//     assets are served by the `ccplugin://` scheme handler (shared opaque origin).
+//
+// The loader never trusts a manifest: it validates shape, refuses an unsupported
+// apiVersion, and intersects the plugin's requested capabilities with the host's.
+
+import { HOST_API_VERSION, HOST_CAPABILITIES } from './bridge';
+
+export interface PluginManifest {
+  id: string;
+  name: string;
+  version: string;
+  apiVersion: number;
+  capabilities: string[];
+  /** Entry document (relative), e.g. `index.html`. */
+  entry: string;
+}
+
+export type PluginEnv = 'dev' | 'packaged';
+
+export interface DiscoveredPlugin {
+  manifest: PluginManifest;
+  /** Capabilities the host actually granted = manifest.capabilities ∩ host capabilities. */
+  grantedCapabilities: string[];
+  /** The sandboxed-iframe `src` for this plugin's entry document. */
+  src: string;
+}
+
+export interface RejectedPlugin {
+  raw: unknown;
+  reason: string;
+}
+
+export interface DiscoveryResult {
+  plugins: DiscoveredPlugin[];
+  rejected: RejectedPlugin[];
+}
+
+export interface PluginSource {
+  discover(): Promise<DiscoveryResult>;
+}
+
+export type ManifestResult =
+  | { ok: true; manifest: PluginManifest }
+  | { ok: false; reason: string };
+
+const ID_RE = /^[a-z0-9][a-z0-9-]*$/;
+
+/**
+ * Validate a raw manifest for shape + apiVersion. A malformed manifest, or one asking
+ * for an apiVersion the host doesn't implement, is refused (the host won't load it).
+ */
+export function validateManifest(raw: unknown): ManifestResult {
+  if (typeof raw !== 'object' || raw === null) return { ok: false, reason: 'not-an-object' };
+  const m = raw as Record<string, unknown>;
+  if (typeof m.id !== 'string' || !ID_RE.test(m.id)) return { ok: false, reason: 'bad-id' };
+  if (typeof m.name !== 'string' || m.name.length === 0) return { ok: false, reason: 'bad-name' };
+  if (typeof m.version !== 'string') return { ok: false, reason: 'bad-version' };
+  if (typeof m.apiVersion !== 'number') return { ok: false, reason: 'bad-apiVersion' };
+  if (m.apiVersion !== HOST_API_VERSION) return { ok: false, reason: 'unsupported-apiVersion' };
+  if (!Array.isArray(m.capabilities) || !m.capabilities.every((c) => typeof c === 'string')) {
+    return { ok: false, reason: 'bad-capabilities' };
+  }
+  if (typeof m.entry !== 'string' || m.entry.length === 0) return { ok: false, reason: 'bad-entry' };
+  // Reject path-traversal / absolute entries — the scheme handler serves under <id>/.
+  if (m.entry.includes('..') || m.entry.startsWith('/')) return { ok: false, reason: 'bad-entry' };
+  return {
+    ok: true,
+    manifest: {
+      id: m.id,
+      name: m.name,
+      version: m.version,
+      apiVersion: m.apiVersion,
+      capabilities: m.capabilities as string[],
+      entry: m.entry,
+    },
+  };
+}
+
+/** The capabilities the host will actually grant: manifest ∩ host set (order = host's). */
+export function negotiateCapabilities(
+  manifest: PluginManifest,
+  hostCaps: readonly string[] = HOST_CAPABILITIES,
+): string[] {
+  return hostCaps.filter((c) => manifest.capabilities.includes(c));
+}
+
+/** Windows/WebView2 serves a custom scheme at `http://<scheme>.localhost` (see `pluginSrc`). */
+function runningOnWindows(): boolean {
+  return typeof navigator !== 'undefined' && navigator.userAgent.includes('Windows');
+}
+
+/**
+ * The sandboxed-iframe `src` for a plugin entry. All packaged plugins share the opaque
+ * `http://ccplugin.localhost` origin (isolation is the sandbox, not the URL); `<id>` is
+ * only a path. Under plain Vite there is no Tauri scheme, so a static route is used.
+ *
+ * The packaged URL is platform-shaped. On Windows/WebView2 — the primary target — a custom
+ * scheme is reachable only as `http://<scheme>.localhost/…`; the literal `ccplugin://…` form
+ * is an EXTERNAL protocol, and `sandbox="allow-scripts"` forbids navigating to one, so the
+ * frame silently stays blank. `view_plugins.rs` and the host `frame-src` CSP already name the
+ * `http://ccplugin.localhost` origin — this is what actually produces it.
+ */
+export function pluginSrc(
+  env: PluginEnv,
+  id: string,
+  entry: string,
+  isWindows: boolean = runningOnWindows(),
+): string {
+  if (env !== 'packaged') return `/plugins/${id}/${entry}`;
+  return isWindows
+    ? `http://ccplugin.localhost/${id}/${entry}`
+    : `ccplugin://localhost/${id}/${entry}`;
+}
+
+/** Validate + negotiate + resolve a batch of raw manifests, partitioning valid/rejected. */
+export function discoverFrom(env: PluginEnv, rawManifests: unknown[]): DiscoveryResult {
+  const plugins: DiscoveredPlugin[] = [];
+  const rejected: RejectedPlugin[] = [];
+  const seen = new Set<string>();
+  for (const raw of rawManifests) {
+    const res = validateManifest(raw);
+    if (!res.ok) {
+      rejected.push({ raw, reason: res.reason });
+      continue;
+    }
+    if (seen.has(res.manifest.id)) {
+      rejected.push({ raw, reason: 'duplicate-id' });
+      continue;
+    }
+    seen.add(res.manifest.id);
+    plugins.push({
+      manifest: res.manifest,
+      grantedCapabilities: negotiateCapabilities(res.manifest),
+      src: pluginSrc(env, res.manifest.id, res.manifest.entry),
+    });
+  }
+  return { plugins, rejected };
+}
+
+/** Dev discovery from a build-time-generated index of raw manifests. */
+export function devPluginSource(index: { manifests: unknown[] }): PluginSource {
+  return { discover: async () => discoverFrom('dev', index.manifests) };
+}
+
+/**
+ * Packaged discovery: `scan` yields raw manifests from bundled resources ∪
+ * `~/.command-center/plugins` (a Tauri command, injected so the loader stays testable).
+ */
+export function packagedPluginSource(scan: () => Promise<unknown[]>): PluginSource {
+  return {
+    discover: async () => {
+      const raw = await scan();
+      return discoverFrom('packaged', raw);
+    },
+  };
+}
diff --git a/cockpit/ui/src/lib/plugin-sdk.test.ts b/cockpit/ui/src/lib/plugin-sdk.test.ts
new file mode 100644
index 0000000..aab6d70
--- /dev/null
+++ b/cockpit/ui/src/lib/plugin-sdk.test.ts
@@ -0,0 +1,113 @@
+import { describe, it, expect } from 'vitest';
+import { connect, attach } from '../../../plugin-sdk/index.js';
+import { PluginSession, type BridgeHost } from './bridge';
+import { newUnit, type Unit } from './fleet';
+import type { CreateReq } from './api';
+
+// Lane V: the SDK is the plugin-side of the same MessagePort protocol the host bridge
+// speaks. These tests wire the real SDK client to a real `PluginSession` over a
+// MessageChannel — a protocol-level proof of both ends (NOT the Tauri/iframe e2e, which
+// Lane S owns). jsdom delivers port messages across macrotasks, so assertions poll.
+
+const wait = () => new Promise((r) => setTimeout(r, 0));
+async function waitFor(pred: () => boolean, tries = 100): Promise<boolean> {
+  for (let i = 0; i < tries; i++) {
+    if (pred()) return true;
+    await wait();
+  }
+  return pred();
+}
+
+function hostWith(units: Record<string, Unit>): { host: BridgeHost; launches: CreateReq[] } {
+  const launches: CreateReq[] = [];
+  const host: BridgeHost = {
+    order: () => Object.keys(units),
+    unit: (id) => units[id],
+    drainDirty: () => [],
+    logsSince: () => [],
+    degraded: () => false,
+    launch: async (req) => {
+      launches.push(req);
+      return 'new-unit';
+    },
+    command: async () => {},
+    requestRealLaunch: () => {},
+  };
+  return { host, launches };
+}
+
+describe('SDK attach() ↔ PluginSession over a MessageChannel', () => {
+  it('receives the full snapshot after ready and resolves a demo launch ack', async () => {
+    const units: Record<string, Unit> = { u1: newUnit('u1', 'task', 'T1') };
+    const { host, launches } = hostWith(units);
+    const ch = new MessageChannel();
+    const session = new PluginSession(ch.port1, host, { autoTick: false });
+    session.start();
+
+    const client = attach(ch.port2, { apiVersion: 1, capabilities: ['log-append'] });
+    const states: { full: boolean; changed: { id: string }[] }[] = [];
+    client.onState((s) => states.push(s));
+
+    await waitFor(() => states.length > 0);
+    expect(states[0].full).toBe(true);
+    expect(states[0].changed.map((u) => u.id)).toEqual(['u1']);
+
+    const ack = await client.launch({ task: 'go', tier: 't1', mode: 'demo' });
+    expect(ack.ok).toBe(true);
+    expect(launches).toHaveLength(1);
+
+    session.destroy();
+  });
+
+  it('surfaces a rejection ack (real launch blocked pending host confirm)', async () => {
+    const { host } = hostWith({});
+    const ch = new MessageChannel();
+    const session = new PluginSession(ch.port1, host, { autoTick: false });
+    session.start();
+    const client = attach(ch.port2, { apiVersion: 1, capabilities: [] });
+
+    const ack = await client.launch({ task: 'go', tier: 't1', mode: 'real' });
+    expect(ack.ok).toBe(false);
+    expect(ack.reasonClass).toBe('real-requires-confirm');
+    session.destroy();
+  });
+});
+
+describe('SDK connect() handshake', () => {
+  it('posts plugin-hello and resolves a client when init transfers a port', async () => {
+    const ch = new MessageChannel();
+    const units: Record<string, Unit> = { u1: newUnit('u1', 'task', 'T1') };
+    const { host } = hostWith(units);
+    const session = new PluginSession(ch.port1, host, { autoTick: false });
+    session.start();
+
+    // Fake the window/parent: the parent replies to `plugin-hello` with an `init` event
+    // that transfers port2 (exactly what the host bridge would do).
+    let handler: ((e: unknown) => void) | null = null;
+    let helloSeen = false;
+    const scope = {
+      addEventListener: (_t: string, h: (e: unknown) => void) => {
+        handler = h;
+      },
+      removeEventListener: () => {},
+    };
+    const parent = {
+      postMessage: (msg: { type: string }) => {
+        if (msg.type === 'plugin-hello') {
+          helloSeen = true;
+          handler?.({ data: { v: 1, type: 'init', apiVersion: 1, capabilities: ['log-append'] }, ports: [ch.port2] });
+        }
+      },
+    };
+
+    const client = await connect({ scope, parent });
+    expect(helloSeen).toBe(true);
+    expect(client.capabilities).toEqual(['log-append']);
+
+    const states: { full: boolean }[] = [];
+    client.onState((s) => states.push(s));
+    await waitFor(() => states.length > 0);
+    expect(states[0].full).toBe(true);
+    session.destroy();
+  });
+});
diff --git a/cockpit/ui/src/lib/reference-plugin.test.ts b/cockpit/ui/src/lib/reference-plugin.test.ts
new file mode 100644
index 0000000..660d5e3
--- /dev/null
+++ b/cockpit/ui/src/lib/reference-plugin.test.ts
@@ -0,0 +1,83 @@
+import { describe, it, expect } from 'vitest';
+import {
+  createModel,
+  applyState,
+  applyLog,
+  applyReset,
+  recordAck,
+  list,
+  awaitingApproval,
+  ticker,
+  type UnitLite,
+} from '../../../../plugins/reference/model.js';
+
+// Lane V: proves the reference plugin's model applies the FULL message surface correctly
+// (dirty `state` deltas, `log-append`, `log-reset`, `command-ack`) — "trivial" = small UI,
+// not narrow coverage. The Tauri/iframe dogfood is Lane S's integration step.
+
+function unit(id: string, phase = 'building'): UnitLite {
+  return {
+    id,
+    task: 't',
+    tier: 'T1',
+    phase,
+    history: [phase],
+    cost: 0.5,
+    usdCap: 5,
+    tokensIn: 0,
+    tokensOut: 0,
+    iters: { build: 0, check: 0, review: 0 },
+    findings: [],
+    oracleFiles: [],
+    awaitingSlot: false,
+    rateLimited: false,
+    lastSeq: 1,
+  };
+}
+
+describe('reference plugin model', () => {
+  it('a full snapshot seeds units; a delta merges only changed ones', () => {
+    const m = createModel();
+    applyState(m, { full: true, changed: [unit('u1'), unit('u2')], order: ['u1', 'u2'], degraded: false });
+    expect(list(m).map((u) => u.id)).toEqual(['u1', 'u2']);
+
+    // A delta touching only u2 must not drop u1.
+    applyState(m, { full: false, changed: [unit('u2', 'done')], order: ['u1', 'u2'], degraded: true });
+    expect(m.units['u1'].phase).toBe('building');
+    expect(m.units['u2'].phase).toBe('done');
+    expect(m.degraded).toBe(true);
+  });
+
+  it('a full snapshot resets the baseline (mirrors the host lastEmitted reset)', () => {
+    const m = createModel();
+    applyState(m, { full: true, changed: [unit('u1')], order: ['u1'], degraded: false });
+    applyState(m, { full: true, changed: [unit('u2')], order: ['u2'], degraded: false });
+    expect(Object.keys(m.units)).toEqual(['u2']);
+  });
+
+  it('log-append accumulates and the ticker is the last line; log-reset clears', () => {
+    const m = createModel();
+    applyLog(m, 'u1', [{ seq: 1, stream: 'agent', line: 'a' }]);
+    applyLog(m, 'u1', [{ seq: 2, stream: 'check', line: 'b' }]);
+    expect(m.logs['u1']).toHaveLength(2);
+    expect(ticker(m, 'u1')).toEqual({ seq: 2, stream: 'check', line: 'b' });
+
+    applyReset(m);
+    expect(m.logs['u1']).toBeUndefined();
+    expect(ticker(m, 'u1')).toBeNull();
+  });
+
+  it('detects awaiting_oracle_approval presence (non-interactive indicator source)', () => {
+    const m = createModel();
+    applyState(m, { full: true, changed: [unit('u1', 'building'), unit('u2', 'awaiting_oracle_approval')], order: ['u1', 'u2'], degraded: false });
+    expect(awaitingApproval(m)?.id).toBe('u2');
+  });
+
+  it('records command-acks including a rejection', () => {
+    const m = createModel();
+    recordAck(m, { reqId: 'p0', ok: true });
+    recordAck(m, { reqId: 'p1', ok: false, reasonClass: 'real-requires-confirm' });
+    expect(m.acks).toHaveLength(2);
+    expect(m.acks[1]).toMatchObject({ ok: false, reasonClass: 'real-requires-confirm' });
+  });
+});
diff --git a/cockpit/ui/src/lib/store.sink.svelte.test.ts b/cockpit/ui/src/lib/store.sink.svelte.test.ts
new file mode 100644
index 0000000..245f637
--- /dev/null
+++ b/cockpit/ui/src/lib/store.sink.svelte.test.ts
@@ -0,0 +1,105 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+// Lane V: the store is the SINGLE command sink. These tests exercise the paths that touch
+// the network (`launch`/`reconnect`), so `./api` is mocked — jsdom has no fleetd. The
+// load-bearing assertion is the single-sink regression: a bridge `launch` concurrent with
+// a `reconnect()` must yield exactly ONE unit and ONE socket (no duplicate-unit /
+// double-socket, which a second optimistic writer would otherwise cause).
+
+const createMission = vi.fn<(req: unknown) => Promise<string>>();
+const listUnits = vi.fn<() => Promise<unknown[]>>();
+const health = vi.fn<() => Promise<unknown>>();
+const openStream = vi.fn(() => ({ close: vi.fn() }));
+const sendCommand = vi.fn(async () => 202);
+
+vi.mock('./api', () => ({
+  createMission: (req: unknown) => createMission(req),
+  listUnits: () => listUnits(),
+  health: () => health(),
+  openStream: (...args: unknown[]) => openStream(...(args as [])),
+  sendCommand: (...args: unknown[]) => sendCommand(...(args as [])),
+}));
+
+// Imported AFTER the mock is registered.
+const { FleetStore } = await import('./store.svelte');
+import type { Envelope } from './types';
+
+const req = { task: 'do the thing', tier: 't1' as const, mode: 'demo' as const, min_review_rounds: 2 };
+
+function evt(unitId: string, seq: number, event: Envelope['event']): Envelope {
+  return { unit_id: unitId, seq, event };
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  openStream.mockImplementation(() => ({ close: vi.fn() }));
+  health.mockResolvedValue({ docker: true, anthropic_key: true, version: 'test' });
+});
+
+describe('FleetStore single command sink', () => {
+  it('a bridge launch concurrent with reconnect yields exactly one unit + one socket', async () => {
+    const s = new FleetStore();
+    createMission.mockResolvedValue('u-race');
+    // The daemon snapshot lists the very unit `launch` is optimistically inserting.
+    listUnits.mockResolvedValue([
+      { unit_id: 'u-race', phase: 'building', cost: 0, usd_cap: 5, tier: 't1', task: 'do the thing', last_seq: 0 },
+    ]);
+
+    // Fire both writers at once — the exact interleaving must not matter.
+    await Promise.all([s.launch(req), s.reconnect()]);
+
+    expect(s.order.filter((id) => id === 'u-race')).toHaveLength(1);
+    expect(Object.keys(s.units)).toEqual(['u-race']);
+    expect(openStream).toHaveBeenCalledTimes(1);
+  });
+
+  it('reconnect and a later launch of the same id still open only one socket', async () => {
+    const s = new FleetStore();
+    listUnits.mockResolvedValue([
+      { unit_id: 'u1', phase: 'queued', cost: 0, usd_cap: 5, tier: 't1', task: 't', last_seq: 0 },
+    ]);
+    await s.reconnect();
+    expect(openStream).toHaveBeenCalledTimes(1);
+
+    createMission.mockResolvedValue('u1'); // daemon hands back an already-known id
+    await s.launch(req);
+    expect(s.order.filter((id) => id === 'u1')).toHaveLength(1);
+    expect(openStream).toHaveBeenCalledTimes(1); // no second socket
+  });
+});
+
+describe('FleetStore dirty-set accumulator (bridge drain seam)', () => {
+  it('records touched ids on fold and clears them on drain', async () => {
+    const s = new FleetStore();
+    createMission.mockResolvedValue('u1');
+    await s.launch(req); // optimistic insert marks dirty
+    expect(s.drainDirty()).toEqual(['u1']);
+    expect(s.drainDirty()).toEqual([]); // drained set is now empty
+
+    s.onEvt('u1', evt('u1', 1, { type: 'phase_changed', from: 'queued', to: 'building' }));
+    s.onEvt('u1', evt('u1', 2, { type: 'metric', tokens_in: 1, tokens_out: 2, cost_usd: 0.1, elapsed_ms: 1 }));
+    expect(s.drainDirty()).toEqual(['u1']); // deduped to the single touched id
+
+    // A deduped/replayed frame (seq <= lastSeq) does not touch the unit.
+    s.onEvt('u1', evt('u1', 2, { type: 'log', stream: 'agent', line: 'x' }));
+    expect(s.drainDirty()).toEqual([]);
+  });
+});
+
+describe('FleetStore seq-tagged log tail (log-append source)', () => {
+  it('returns only lines after the cursor, with seq preserved', async () => {
+    const s = new FleetStore();
+    createMission.mockResolvedValue('u1');
+    await s.launch(req);
+    s.onEvt('u1', evt('u1', 1, { type: 'log', stream: 'agent', line: 'first' }));
+    s.onEvt('u1', evt('u1', 2, { type: 'log', stream: 'check', line: 'second' }));
+
+    expect(s.logsSince('u1', 0)).toEqual([
+      { seq: 1, stream: 'agent', line: 'first' },
+      { seq: 2, stream: 'check', line: 'second' },
+    ]);
+    expect(s.logsSince('u1', 1)).toEqual([{ seq: 2, stream: 'check', line: 'second' }]);
+    expect(s.logsSince('u1', 2)).toEqual([]);
+    expect(s.logsSince('unknown', 0)).toEqual([]);
+  });
+});
diff --git a/cockpit/ui/src/lib/store.svelte.ts b/cockpit/ui/src/lib/store.svelte.ts
index 39ee8a9..e58ac21 100644
--- a/cockpit/ui/src/lib/store.svelte.ts
+++ b/cockpit/ui/src/lib/store.svelte.ts
@@ -14,6 +14,22 @@ import type { CommandName, Envelope, FleetEvent, Health, Phase, Snapshot } from
 /** A live `phase_changed` listener — the seam the Dashboard's `onFleetPhase` prop wires to. */
 type PhaseListener = (unitId: string, to: Phase, task: string, tier: string) => void;
 
+/**
+ * One seq-tagged log line, retained by the store so the view-plugin bridge can build
+ * `log-append` deltas since a plugin's per-unit seq cursor. Kept deliberately OUTSIDE
+ * the reactive `Unit` (whose `fleet.ts` `log` is capped + untagged): the bridge needs
+ * the daemon `seq` to diff against a cursor, and this tail must not drive a component
+ * re-render, so it lives in a plain (non-`$state`) store field.
+ */
+export interface LogDelta {
+  seq: number;
+  stream: string;
+  line: string;
+}
+
+/** How many seq-tagged log lines the store retains per unit for plugin `log-append`. */
+const LOG_TAIL_CAP = 500;
+
 export class FleetStore {
   units = $state<Record<string, Unit>>({});
   order = $state<string[]>([]);
@@ -28,6 +44,20 @@ export class FleetStore {
   // Guards against double-connecting (e.g. a re-mounted Fleet view re-calling reconnect).
   private started = false;
 
+  // ── view-plugin command-sink support (Lane V) ──────────────────────────────
+  // The store is the SINGLE command sink: every daemon write (built-in ops grid AND
+  // policed plugin commands) flows through `launch`/`cmd`, which own `cmd_id`, the
+  // optimistic insert, and socket-open. Plugin-originated commands are validated by the
+  // bridge's command policy BEFORE they reach these methods; trusted built-in calls skip
+  // it. These plain (non-reactive) accumulators are what the bridge drains on its tick —
+  // Svelte-5 runes tell *components* what changed but hand a plain consumer nothing, so
+  // the fold/command path records touched ids here explicitly.
+  //
+  // `dirty` = ids touched since the bridge last drained (drives per-unit `state` deltas).
+  private dirty = new Set<string>();
+  // `logTail` = per-unit seq-tagged log lines, for `log-append` since a plugin's cursor.
+  private logTail: Record<string, LogDelta[]> = {};
+
   // A REAL-mode launch the host has staged but not yet confirmed. While set, the host
   // overlay (Lane O) shows a confirm modal; nothing is sent to the daemon until the human
   // confirms. The store stays the single source of fleet state, so the modal is driven
@@ -84,11 +114,48 @@ export class FleetStore {
       if (this.units[s.unit_id]) continue;
       this.units[s.unit_id] = fromSnapshot(s);
       this.order = [...this.order, s.unit_id];
-      this.sockets[s.unit_id] = openStream(s.unit_id, 0, (e) => this.onEvt(s.unit_id, e));
+      this.markDirty(s.unit_id);
+      this.ensureStream(s.unit_id);
     }
     if (!this.selectedId && this.order.length) this.selectedId = this.order[0];
   }
 
+  /**
+   * Open the WS stream for a unit exactly once. Both `reconnect` (snapshot repopulate)
+   * and `launch` (optimistic new unit) route through here so a bridge `launch` racing a
+   * concurrent `reconnect()` can never open a second socket for the same unit — the
+   * single-socket half of the single-sink guarantee.
+   */
+  private ensureStream(id: string): void {
+    if (this.sockets[id]) return;
+    this.sockets[id] = openStream(id, 0, (e) => this.onEvt(id, e));
+  }
+
+  /** Record that a unit changed so the plugin bridge picks it up on its next drain. */
+  private markDirty(id: string): void {
+    this.dirty.add(id);
+  }
+
+  /**
+   * Drain the set of unit ids touched since the last call (the bridge invokes this on its
+   * ~60ms tick to build per-unit `state` deltas). Returns the ids and clears the set.
+   */
+  drainDirty(): string[] {
+    const ids = [...this.dirty];
+    this.dirty.clear();
+    return ids;
+  }
+
+  /**
+   * Seq-tagged log lines for a unit with `seq > sinceSeq` — the bridge's `log-append`
+   * source, diffed against the plugin's per-unit cursor. Bounded by `LOG_TAIL_CAP`.
+   */
+  logsSince(id: string, sinceSeq: number): LogDelta[] {
+    const tail = this.logTail[id];
+    if (!tail) return [];
+    return sinceSeq <= 0 ? tail.slice() : tail.filter((l) => l.seq > sinceSeq);
+  }
+
   /** First-mount entry point: connect once, return a teardown the view can ignore. */
   start(): void {
     if (this.started) return;
@@ -104,6 +171,12 @@ export class FleetStore {
     const next = fold({ ...prev }, e.event);
     next.lastSeq = e.seq;
     this.units[id] = next;
+    this.markDirty(id);
+    if (e.event.type === 'log') {
+      const tail = (this.logTail[id] ??= []);
+      tail.push({ seq: e.seq, stream: e.event.stream, line: e.event.line });
+      if (tail.length > LOG_TAIL_CAP) tail.splice(0, tail.length - LOG_TAIL_CAP);
+    }
     if (e.event.type === 'phase_changed') this.emitPhase(id, e.event);
   }
 
@@ -122,13 +195,23 @@ export class FleetStore {
     return () => this.phaseListeners.delete(cb);
   }
 
-  /** Launch a new mission, optimistically seed its tile, open its stream, select it. */
+  /**
+   * Launch a new mission, optimistically seed its tile, open its stream, select it. The
+   * single command sink for new units: the ops grid calls it directly (trusted); the
+   * plugin bridge calls it only AFTER its command policy passes. Guards the optimistic
+   * insert against a concurrent `reconnect()` that already materialised this id from a
+   * snapshot, so a bridge `launch` racing a reconnect yields exactly one unit + one
+   * socket (`ensureStream` enforces the socket half).
+   */
   async launch(req: CreateReq): Promise<string> {
     const id = await createMission(req);
-    this.units[id] = newUnit(id, req.task, req.tier.toUpperCase());
-    this.order = [id, ...this.order];
+    if (!this.units[id]) {
+      this.units[id] = newUnit(id, req.task, req.tier.toUpperCase());
+      this.order = [id, ...this.order];
+      this.markDirty(id);
+    }
     this.selectedId = id;
-    this.sockets[id] = openStream(id, 0, (e) => this.onEvt(id, e));
+    this.ensureStream(id);
     return id;
   }
 
diff --git a/docs/STATUS.md b/docs/STATUS.md
index f71fcea..a3327d7 100644
--- a/docs/STATUS.md
+++ b/docs/STATUS.md
@@ -1,7 +1,7 @@
 ---
 stage: Build
 readiness: "control plane publication-ready; product shell on roadmap"
-updated: "2026-08-09"
+updated: "2026-08-16"
 name: "Command Center"
 base_branch: "main"
 test_cmd: "cargo test --workspace"
@@ -17,13 +17,20 @@ its own `STATUS.md`, so the Command Center appears on its own board as a `local:
 ## State summary
 
 **TL;DR.** The **control plane and workflow layer are feature-complete and tested**, the repo is
-**public**, and `main` is now **branch-protected** with `embargo guard` + `cargo test (workspace)` as
-required checks, enforced for admins. The **superseded guard digests are out of public history** — a
-targeted 9-commit `filter-repo` rewrite, not the 193-commit rewrite that was correctly ruled out for
-the embargoed name. The **product shell is no longer purely roadmap**: the plugin-runtime swarm's work
-turned out to be **complete, not stranded**, and now sits in **draft PR #49** with all three automated
-gates re-verified against current `main`, blocked only on an interactive smoke that needs a GUI
-session. A design pass and remote control remain on the roadmap.
+**public**, and `main` is **branch-protected**. **CI is now a real gate**: #60 (merged 2026-08-15)
+added rustfmt, clippy, `svelte-check + tsc`, vitest and — critically — `cargo test (cockpit)`, which
+had **never run in CI at all** because `cockpit/ui/src-tauri` is a standalone cargo workspace the
+root `--workspace` never reached. Five of seven test tiers were advisory until that landed. The
+**superseded guard digests are out of public history** (targeted 9-commit `filter-repo` rewrite).
+**The interactive smoke is FINISHED.** Run 2 (dev) and **Run 3 (packaged, 2026-08-16)** are both
+complete, and **#49 is READY FOR REVIEW with all 18 CI checks green** — it is waiting on a human
+merge decision and nothing else. Run 3 scored **9 PASS / 2 BLOCKED / 2 NOT RUN / 0 FAIL** and, with
+the fixes that followed, closed **five** defects: **D-7** (view-plugins received no state at all),
+**D-8** (**the packaged bundle shipped no plugin root — no shipped build could load a view-plugin**),
+**D-2** (every plugin was granted every capability; now fails closed), **D-4** (re-verified packaged:
+0.23 s cold exit, 5.27 s with 10 containers) and **D-5** (investigated, **did not reproduce**).
+Across both runs, **`db74a47` is CONFIRMED twice** — 1,127 samples in dev and 632 in packaged, zero
+unresponsive in either.
 
 **Vision (unchanged):** the Command Center is the operator's **one-stop shop for agentic
 engineering** — dispatch work, see every project's stage, act without alt-tabbing, host the other
@@ -38,8 +45,26 @@ launch.**
 3. **Design overhaul** (needs Claude Design output).
 4. **Remote Control** — brainstorm→spec after Phase-2 auth lands.
 
-**Open PRs.** **#49 (draft)** — cockpit plugin runtime (view-plugins + app-plugins). Merge-blocked on
-the interactive smoke only; see `spikes/SPIKE-RESULTS-app-plugins.md` and the Lane S human gate.
+**Open PRs.** **#49 — READY FOR REVIEW** (no longer draft), cockpit plugin runtime, HEAD `05c95ca`.
+`MERGEABLE`, `mergeStateStatus: CLEAN`, **18/18 CI checks pass**. Every previous merge blocker is
+resolved: D-7 fixed and confirmed live, D-8 found and fixed, D-2 fixed, and the packaged Part 2 run
+end to end (`spikes/SPIKE-RESULTS.md` → **"Smoke run 3"**). **It needs a human merge decision.**
+
+Items 1.2 / 1.4a / 1.7 remain **BLOCKED** behind **D-3**, a *pre-existing* `main` defect — fleetd
+serves no CORS headers, so every browser `fetch` from the cockpit to the daemon fails. Confirmed by
+`git diff origin/main...HEAD` being empty for `crates/fleetd/`. **Not a #49 regression; it needs its
+own issue.** It does make the FLEET ops grid non-functional today.
+
+**Testing plan.** `docs/testing/PLAN.md` (first run 2026-08-13) ranks gaps by likelihood × impact
+across seven tiers. **Reconciled by hand on 2026-08-16** (§1 "Reconciliation") because it had gone
+materially stale: it claimed CI has "exactly three jobs" (it now runs **nine** checks), and it still
+ranked `GAP-006`/`GAP-008`/`GAP-010`/`GAP-012` at the top when runs 2 and 3 had verified all four.
+Those rows are struck through pending a real scan; their `status` fields were **deliberately left
+`open`**, because status is human-owned and retirement belongs to a scan, not a hand edit.
+
+**`GAP-132` was added and is now rank 1** — the register entry for the pattern behind D-1/D-2/D-4/
+D-7/D-8. Six items still **await human ratification** (§3), including `spine_weight`, the Impact axis
+of every score in the file. **A full `testing-plan` re-run is the top-value next action.**
 
 **Known gaps / blockers.**
 - **Embargoed token remains in git history** (~193 commits) — deliberately out of scope, unchanged.
@@ -50,10 +75,40 @@ the interactive smoke only; see `spikes/SPIKE-RESULTS-app-plugins.md` and the La
   does **not** delete unreachable objects. Verified still served: commits `6016495` / `eb832bd` and
   blob `ee0ed06`. **Requires a GitHub Support ticket** asking them to garbage-collect unreachable
   objects on this repo. Until then the exposure is "attacker needs the 40-char SHA", not "gone".
-- **P3's Gate 5 (app-plugin lifecycle / no orphans) was never closed**, and
-  `docs/SWARM-HANDOFF-plugin-runtime.md` nevertheless describes P3 as "GO" when its own record says
-  **LEANING GO** with packaged gates 2/4 and Gate 5 outstanding. The swarm was dispatched on the
-  stronger claim. Those gates are now folded into #49's smoke checklist.
+- **Gate 5 is now CLOSED, and 1.9b was a real defect.** Root-caused in Smoke run 2: the
+  `ExitRequested` handler called `api.prevent_exit()` unconditionally then `app_handle.exit(0)`,
+  which re-emits `ExitRequested` — an **infinite exit loop**. Measured: no window, `Responding=True`,
+  **spinning at 93.9% of a core, 309 s of CPU burned**. **Not** a `tauri dev` artifact (`cargo` was
+  blocked *on* the app, not holding it open). Fixed by a `ShutdownGuard` (`2ab1b49`) and **verified
+  in a watched window**: exits in ~1 s, 0.19 s total CPU. Note `0d05f55` made this *worse* while
+  appearing to rule it out — idempotent teardown turned a slow loop into a hot one. This also
+  explains the standing "don't rebuild the tauri crate while the app runs" trap.
+  **Re-verified in the packaged build (run 3):** 0.23 s cold exit, and **5.27 s with 10 containers
+  up** — including full teardown, sidecar reaped and port 8787 released.
+  **Still open, but lower urgency than assumed:** `stop_all_owned(30_000)` still runs synchronously
+  inside the `RunEvent` callback, so exit is blocked for as long as teardown takes. Dev run 2 saw
+  ~2.5 min; packaged run 3 measured **5.27 s**, so the architectural concern stands but the observed
+  cost does not. **Needs a fix-or-accept decision** with that measurement attached.
+  `docs/SWARM-HANDOFF-plugin-runtime.md` still overstates P3 as "GO"; unchanged.
+- **Gate 5's success criterion used the wrong instrument.** Run 1 recorded PASS on "`docker ps`
+  empty". `docker ps` shows only *running* containers and cannot see the `Created`/`Exited` residue
+  teardown left — residue which then broke run 2's first launch with a container-name conflict.
+  Assert on **`docker ps -a`** scoped to the project. Run 2's teardown genuinely does better: 27→17
+  total, i.e. ten containers **removed**, not merely stopped.
+- **The systemic pattern, now FIVE instances and filed as `GAP-132`.** D-1, D-2, D-7, D-8 and D-4 are
+  one shape: **the dev path is exercised; the path that ships is neither wired nor asserted.**
+  `pluginSrc` was tested against the broken string; `negotiateCapabilities`' result is discarded;
+  `bridge.test.ts` drives fakes so real `$state` proxies are never exercised; and the bundle simply
+  never carried the plugin root. **Twice a test actively *defended* the defect** — `loader.test.ts:52`
+  and `bridge.test.ts:360` both asserted the broken behaviour as correct, which is worse than absent
+  coverage because it converts a gap into a false guarantee.
+  **Correction worth keeping:** it is tempting to say "CI never builds the app". **That is false** —
+  `ci.yml:311` runs `tauri build` on all three OSes and uploads artifacts. Nothing looks *inside* the
+  bundle, which is how D-8 passed a **successful** build. The cheap fix (unzip a CI artifact, assert
+  two files exist) is written up in `GAP-132`.
+- **Audience's `video` service busy-polls at ~100% of a core while idle** (last log line is just
+  `video worker started, listening on …`). Different repo, not a #49 blocker, but it skews any
+  performance observation made while the Audience stack is up. Worth filing against Audience.
 - **Optional cockpit screenshot** for the README (needs a GUI session; the architecture diagram
   stands in).
 - **Roadmap remainder:** cockpit design overhaul, Local-Tracker Phase 2 dispatch, Remote Control.
@@ -72,25 +127,212 @@ failure was a **stale local `main`**. Resolved 2026-08-09: branch protection, th
 the branch/worktree pruning below._
 
 **Next steps.** _All open work is tracked as GitHub issues (#51–#59); this list is the ordering._
-1. **#51 — Run the interactive smoke for PR #49** (dev + packaged) and record PASS/FAIL in
-   `spikes/SPIKE-RESULTS.md`. Repo is parked on `feat/plugin-runtime` with the build pre-warmed.
-   Note: free port **8080** first (a `java` process holds it) or the Audience health probe is
-   inconclusive, and Docker must be up for the managed lifecycle.
-2. **#52 — File the GitHub Support ticket** to GC unreachable objects. The last step of the digest
-   removal, and the only one that closes the residual exposure.
-3. **#54 — Retire the spike branches/worktrees**, but *only after* #49 merges — they are the sole
-   working reproduction if the smoke fails.
-4. Run `git config core.hooksPath "<abs>/.githooks"` (**absolute**) in every other clone; it is
-   per-clone config and does **not** travel with a merge.
-5. Resume the roadmap: **#55 Local-Tracker Phase 2** (keystone + auth foundation), then **#56** the
-   design pass, then **#57** Remote Control.
-
-_Also open: **#53** (`.embargo-guard.local.json` not gitignored on `feat/plugin-runtime` — the guard
-scans for plaintext, so it would not block committing its own salts+digests), **#58** (signing certs →
-first signed release), **#59** (README screenshot)._
+_For #51 specifically, work from the handoff brief:_
+[`docs/handoffs/ae18cd84-95fa-45e7-a26f-d09f64a96826.md`](handoffs/ae18cd84-95fa-45e7-a26f-d09f64a96826.md)
+_— it is self-contained and supersedes the abbreviated instructions in this list._
+1. **MERGE #49.** It is ready for review, `CLEAN`, 18/18 CI checks green, and every blocker that
+   existed on 2026-08-15 is resolved. This is a decision, not work. ~~D-7~~, ~~D-2~~ and ~~#51 the
+   packaged smoke~~ are **all done** — see the Session log entry for 2026-08-16.
+2. **File D-3 as its own issue against `main`.** fleetd serves no CORS headers, so every browser
+   `fetch` from the cockpit fails and the FLEET ops grid is empty. Pre-existing, **not** a #49
+   regression (`git diff origin/main...HEAD` is empty for `crates/fleetd/`). It blocks smoke items
+   1.2 / 1.4a / 1.7 permanently until fixed, and it is the reason the ops grid looks broken today.
+3. **Re-run `testing-plan`.** `docs/testing/PLAN.md` was hand-reconciled on 2026-08-16 but needs a
+   real scan: retire `GAP-006`/`GAP-008`/`GAP-010`/`GAP-012` with the run-2/run-3 evidence, refresh
+   the `in_ci` flags (CI now runs nine checks, not three), and rank the new **`GAP-132`** properly.
+4. **Do `GAP-132`'s cheap half.** Add a CI step that unzips a `tauri build` artifact and asserts
+   `plugins/reference/index.html` + `plugin-sdk/index.js` are present. That one assertion would have
+   caught D-8 on the commit that introduced it, and the artifacts already exist.
+5. **Decide D-4's second half** — `stop_all_owned` synchronous in the `RunEvent` callback. Now
+   measured at **5.27 s** packaged (vs ~2.5 min in dev), so: fix, or accept with the measurement.
+   Note the handoff's "prebuilt images skip the build" premise is **wrong** — `compose build` runs
+   regardless. Record under "Smoke run 2 — Part 2".
+4. **File D-3 upstream** — fleetd has no CORS layer (`OPTIONS /missions` → 405, no ACAO on any
+   response). Pre-existing on `main`, blocks 1.2 / 1.4a / 1.7 and the whole FLEET ops grid.
+2. **Decide the lingering-`app`-process anomaly** (Gate 5's second half) — dev artifact or real bug.
+3. **#52 — File the GitHub Support ticket** to GC unreachable objects. Needs no build and no GUI;
+   it is the cheapest open item and the only one closing a real exposure.
+4. **#54 — Retire the spike branches/worktrees**, but *only after* #49 merges — still the sole
+   working reproduction.
+5. **Reconcile `docs/ROADMAP.md`** (last touched 2026-07-16, `cf92aec`). It still calls P3/P4
+   unresolved spikes and the embedding swarms "blocked / dispatch-ready", which this file contradicts
+   outright, and it carries a stale "verify CI billing" note. It is now the misleading doc — the same
+   role it played in the three-week stranded-swarm misread. Not yet done; deliberately deferred until
+   #49 merges so it is written against reality.
+6. Run `git config core.hooksPath "<abs>/.githooks"` (**absolute**) in every other clone; per-clone
+   config, does **not** travel with a merge.
+7. Resume the roadmap: **#55 Local-Tracker Phase 2** (keystone + auth foundation), then **#56** the
+   design pass, then **#57** Remote Control. Sequence Phase 2 **after** #49 merges — it must touch
+   `App.svelte` and `store.svelte.ts`, the two files #49 rewrites most.
+
+_Also open: **#58** (signing certs → first signed release), **#59** (README screenshot). **#53 is
+resolved** — merging `main` into `feat/plugin-runtime` on 2026-08-10 brought the `.gitignore` entry
+across from #47; close it._
 
 ## Session log
 
+### 2026-08-16 — Built the smoke skill, then it found the defect that would have shipped
+
+Two halves. First, built and merged the **`driving-interactive-smoke-tests`** skill into `claude-kit`
+(PR #22, merged). Then used it on this repo, where it immediately paid for itself.
+
+**On building the skill — the finding that changed it.** The RED phase was run properly: 27
+no-guidance control samples across 9 scenarios drawn from the run-2 corpus. **An earlier round of 8
+controls was thrown away as invalid** — run as subagents inside this repo, they inherited a
+`CLAUDE.md` stating the `docker ps -a` rule and a `MEMORY.md` stating "never infer a result". They
+were open-book and all "passed". Re-run headless from a neutral directory, the controls **did not
+reproduce the corpus failures**: result laundering, false passes, wrong instrument, jargon, missing
+instrumentation and missing coverage analysis were all handled unaided at 3/3. So the draft's
+discipline apparatus (iron law, rationalisation table, red flags) was **deleted** — it documented
+behaviour the model already has. What shipped is the workflow shape plus the policy choices a model
+cannot derive. One operator decision was reversed by the evidence: the operator-vs-instrument rule
+became "re-read the criterion, NOT RUN only if it can't discriminate."
+
+**On the smoke itself — 9 PASS / 2 BLOCKED / 2 NOT RUN / 0 FAIL.** Details in
+`spikes/SPIKE-RESULTS.md` → "Smoke run 3". What matters here is what the *method* caught:
+
+- **D-8 was found in preflight, before the operator touched the keyboard.** `tauri.conf.json` had no
+  `bundle.resources` key, so every packaged build shipped `icon.ico` and nothing else — **no shipped
+  build could load any view-plugin.** The branch's headline feature was broken on the only path that
+  ships, and it would have shipped. Found by deriving criteria from source rather than trusting the
+  checklist. Fixed, pinned by `tests/packaged_plugin_root.rs`.
+- **The stale-artifact catch.** The packaged exe on disk was dated **2026-07-23** and predated every
+  run-2 fix. Running Part 2 against it would have measured a three-week-old build and proved nothing.
+- **A false D-5 was nearly filed.** The operator reported the pane "empty, no error, no spinner" —
+  D-5's exact signature. The instrument contradicted it: containers were 9–15 s old and the gates had
+  not passed. On re-run the app rendered. **D-5 did not reproduce**; recording the first report would
+  have filed a defect against working code.
+- **An unobserved item was scored by instrument, not impression.** For 2.5 the operator said *"I'm
+  not sure, I looked away."* That is not a pass. The 1 Hz trace — **632 samples, zero unresponsive
+  across a 0→10 container ramp** — is what scored it.
+
+**Fixes landed:** D-7 (`c16356a`), D-8 (`c16356a`), D-2 (`f275c44`), plus `05c95ca`. All test-first
+with a real red→green. **D-4 re-verified packaged** (0.23 s cold, 5.27 s with 10 containers).
+
+**Three mistakes of mine worth recording,** because each was caught by checking evidence against the
+claim rather than by being careful:
+1. The contaminated RED controls above — nearly a false GREEN on the skill's own evidence.
+2. I stated WebSocket seeding would surface units in the cockpit. **Wrong** — `store.reconnect()`
+   calls `listUnits()` (HTTP, CORS-blocked) *before* opening any per-unit stream, so D-3 blocks
+   discovery entirely.
+3. I shipped a **flaky test** — the D-7 guard waited on `setTimeout(0)` for async `MessagePort`
+   delivery (1 failure in 3 runs). Rewritten to wait on the condition; 8/8 clean. A ratchet that
+   flakes is a ratchet that gets deleted.
+
+**And one factual correction now propagated everywhere:** I wrote "nothing in CI bundles the app."
+**False** — `ci.yml:311` runs `tauri build` on three OSes. The true gap is that nothing looks *inside*
+the bundle, which is how D-8 passed a *successful* build. That correction is the substance of the new
+**`GAP-132`**, and it makes the fix cheap rather than architectural.
+
+**Docs reconciled this session:** `docs/testing/PLAN.md` (§1 Reconciliation, struck-through rows,
+`GAP-132`, `next_id` → 133), this file, and the `CLAUDE.md` pickup block. Confirmed *not* problems:
+`.embargo-guard.local.json` **is** gitignored (`.gitignore:35`), and **PR #50 is merged**.
+
+**#49 is READY FOR REVIEW, `CLEAN`, 18/18 checks green. It needs a merge decision, not more work.**
+
+### 2026-08-15 (later) — Smoke run 2: `db74a47` confirmed, four hidden defects found
+
+Ran Part 1 of the PR #49 interactive smoke, operator-driven with a checkpoint per item.
+**Branch `feat/plugin-runtime`, HEAD `44ee6ad`.** Nine of eleven items had never been executed.
+
+- **The pivotal result is a PASS, and it is measured, not judged.** `db74a47` holds: sampling
+  `Process.Responding` at 1 Hz gave **1,127 samples with zero unresponsive**, across a full
+  `compose build`, a failed `up`, and a clean 0→3→10 container ramp. The workload that froze the
+  window in run 1 no longer does.
+- **Four defects that every automated gate had passed.** **D-1**: view-plugins could not load on
+  Windows *at all* — `pluginSrc` emitted `ccplugin://localhost/…`, an external protocol a sandboxed
+  iframe refuses to navigate to; the unit test asserted the broken string as correct. Fixed
+  (`55b0a5b`), verified cold-start. **D-4**: the app never exited — an infinite `prevent_exit` /
+  `exit(0)` loop burning a full core (309 s of CPU). Fixed (`2ab1b49`), verified in a watched window
+  (exits in ~1 s, 0.19 s CPU). **D-2**: capability negotiation is dead code — every plugin gets every
+  host capability. **D-7**: view-plugins receive no state at all (`DataCloneError` on Svelte 5
+  `$state` proxies). D-2 and D-7 remain open.
+- **1.9b is answered after three carry-forwards.** A real shutdown defect, not a `tauri dev`
+  artifact: `cargo` was blocked *on* the app, and a hot spin loop is not supervision. `0d05f55`'s
+  idempotency fix had made it worse while appearing to eliminate it.
+- **Two of the handoff's premises were wrong.** Prebuilt images do **not** skip `compose build`; and
+  Gate 5's "`docker ps` empty" criterion cannot see the `Created` residue that run 1 left, which is
+  exactly what broke run 2's first launch.
+- **Three items are BLOCKED, not failed** (1.2, 1.4a, 1.7) behind **D-3**: fleetd serves no CORS
+  headers, so no browser `fetch` from the cockpit reaches the daemon. Pre-existing on `main`
+  (`git diff origin/main...HEAD` is empty for `api.ts` and `crates/fleetd/`). Confirmed directly:
+  three real units existed in the daemon and the ops grid still rendered nothing.
+- **Filed [#61](https://github.com/adbarc92/command-center/issues/61)** — the loading model shows
+  blank tabs with no loading *or* failure affordance, which is what made D-1 read as "probably still
+  loading". Also captures D-5, silent background launch failures.
+- **Part 2 (packaged) still not run.** Deliberately deferred to a fresh session.
+- Added the `driving-interactive-smoke-tests` skill capturing the method, at the operator's request.
+
+### 2026-08-15 — CI became a real gate; three days of orphaned work rescued
+
+Work-audit → executed the findings. **Branch `feat/plugin-runtime`, HEAD `42e290e`; `main` `3cc1ae6`.**
+
+- **The audit's main finding was that the resume state was two sessions stale.** Session-state and
+  `STATUS.md` both stopped at 2026-08-10, but 8/13–8/14 had produced a 260 KB testing plan, a Gate-5
+  unit suite, a main-thread ratchet test, and **PR #60 with 9/9 checks green** — and the first three
+  existed **only as uncommitted files in the working tree**. Committed as `0d05f55` (tests) and
+  `f4d7f38` (plan) after verifying green locally: 34 + 2 cockpit tests.
+- **#60 merged.** CI now gates `cargo fmt --check`, `clippy --all-targets -D warnings`,
+  `npm run check`, `npm test`, and `cargo test` on the cockpit crate — the last of which had never
+  run in CI, so the cockpit crate's 26 tests were verified only by hand. **It caught something
+  immediately**: `feat/plugin-runtime` had fmt violations in `embedding.rs`, `manager.rs` and
+  `view_plugins.rs` that would have failed the moment #60 landed. Fixed in `42e290e`.
+- **Two predictions that turned out wrong, recorded so they are not re-derived.** (1) A `merge-tree`
+  dry run predicted conflicts between #60 and #49 on `lib.rs` + `manager.rs`; the real merge was
+  **clean**. (2) `gh pr merge --delete-branch` reported failure, but only the *local* branch delete
+  failed — the merge itself succeeded. Check `gh pr view --json state` before retrying a merge.
+- **Housekeeping.** #53 closed with `git check-ignore` evidence (it had been fixed since 2026-08-10
+  and stayed open). Worktrees 5 → 3, keeping only the two deliberate spike worktrees. Pruned
+  `chore/ci-lint-gates` and `worktree-agent-ae21…`; local `main` fast-forwarded. One dead directory
+  survives under `%TEMP%\claude\…\ci-lint` — git-deregistered, undeletable via long paths, harmless.
+- **Not done:** #52 (GitHub Support GC ticket) needs the operator's account. The interactive smoke
+  (#51) is still the sole merge blocker on #49.
+- **Handoff written** for the smoke itself:
+  [`docs/handoffs/ae18cd84-95fa-45e7-a26f-d09f64a96826.md`](handoffs/ae18cd84-95fa-45e7-a26f-d09f64a96826.md)
+  — self-contained; carries the dev-seam env vars, the full 11-item checklist, the Gate-5 baseline,
+  and the 1.9b anomaly as an open question rather than a known issue.
+
+### 2026-08-10 — The smoke finally ran, and caught a real one
+
+Audit → executed the audit's own prep steps → ran the smoke → it failed on the first app-plugin
+activation → root-caused and fixed it. **Branch `feat/plugin-runtime`, HEAD `db74a47`.**
+
+- **Prep (all of it turned out to be load-bearing).** Merged `main` into `feat/plugin-runtime`
+  conflict-free (`725b630`) — #49 went `BEHIND` → **`CLEAN`**, and that merge **resolved #53 for
+  free** by bringing #47's `.gitignore` entry across. Found `cockpit/ui/node_modules` **empty**
+  (collateral from the 2026-08-09 cleanup): both JS gates were failing with `'vitest' is not
+  recognized`, a toolchain failure that would have read as a code failure mid-smoke. `npm ci` fixed
+  it. The port-8080 holder turned out to be an unrelated `purposefull` Spring Boot server in an agent
+  worktree, which **exited on its own** — never killed anything.
+- **The bug (smoke checklist 1.5).** Clicking AUDIENCE froze the entire UI. `plugin_launch` was a
+  **synchronous** `#[tauri::command]`, so it ran on the main event-loop thread — the *same* P3
+  finding that had already forced the embedding commands to be `async` — and blocked there on
+  `docker compose build` plus the health/ready probe budgets. The code had predicted this in a
+  standing comment ("may block up to the probe timeout (~180 s) … can move to a background task").
+  The Phase-6 smoke it named is exactly what came due.
+- **The fix (`db74a47`).** Dispatch the start sequence to a dedicated OS thread; return immediately.
+  A plain thread, *not* an async-runtime worker — every seam is blocking (`Command::status`, `ureq`,
+  `thread::sleep`), so the runtime would just relocate the stall. The contract change matters more
+  than the threading: **`Ok` now means "dispatched", not "healthy"**, so `App.svelte` stopped
+  fabricating `pluginState[id]='healthy'` and stopped calling `plugin_show` directly. Without that
+  half, the early return would have pointed the child webview at a URL that isn't serving yet. The
+  existing compositing `$effect` already composites on the `plugin://state` `healthy` event, so the
+  frontend fix was mostly deletion. Pinned by **`src/App.appPlugin.test.ts`**, written red first
+  (it caught `plugin_show` firing **twice** before any state event) then green.
+- **Gates after the fix:** `cargo test` 28 · `npm test` **135** (19 files, +2) · `npm run check`
+  **353 files, 0/0** · `clippy` **exit 0**. Clippy initially failed `PermissionDenied` — not a code
+  problem: `tauri-build` copies the sidecar every build and couldn't overwrite
+  `target/debug/fleetd-serve.exe` **because that file was the running sidecar**. Worth remembering:
+  **a running dev app blocks any rebuild of this crate.**
+- **Gate 5, split.** Containers: **PASS** (0 after graceful quit, against a verified 0 baseline).
+  Process exit: **ANOMALY** — the `app` process outlived its window. Recorded, not diagnosed.
+- **Found but not ours:** Audience's `video` container busy-polls at ~100% of a core while idle.
+- **Deliberately not done:** the `docs/ROADMAP.md` reconcile (next-step 5) — it is stale and
+  contradicts this file, but it should be rewritten against a merged #49, not a pending one.
+- Session artifacts (launcher + full 11-item checklist) were staged in the session scratchpad; the
+  checklist content is reproduced in `spikes/SPIKE-RESULTS.md`, so **nothing depends on the
+  scratchpad surviving**.
+
 ### 2026-08-09 — Work audit, then worked the findings
 
 Ran a full work-audit after ~10 days idle and executed the results rather than just filing them.
diff --git a/docs/SWARM-HANDOFF-plugin-runtime.md b/docs/SWARM-HANDOFF-plugin-runtime.md
index 283b766..6182b7b 100644
--- a/docs/SWARM-HANDOFF-plugin-runtime.md
+++ b/docs/SWARM-HANDOFF-plugin-runtime.md
@@ -27,6 +27,30 @@ self-contained.
 
 ---
 
+## 🔧 Reconciliation (2026-07-16, pre-dispatch) — read before dispatching Lane V
+
+A pre-dispatch audit found the repo state on `main` has moved since this doc was authored. The
+plan holds, but two facts must be carried into dispatch:
+
+1. **Spike GO verdicts live on unmerged branches, not on `main`.** `spikes/SPIKE-RESULTS.md` on
+   `main` is *stale* (old `claude -p` rate-limit spike), and `spikes/SPIKE-RESULTS-app-plugins.md`
+   does **not exist on `main`.** The real verdicts are on `spike/view-plugins-handshake` (tip:
+   *"P4 full GO — update next action to swarm dispatch"*) and `spike/app-plugins-webview-v2` (tip:
+   *"fix spike_show hang — async commands"*). The spikes **did pass**; the load-bearing findings
+   are already inlined in each lane's **Notes** below (ACAO + `ccplugin.localhost` script-src for V;
+   async-off-main-thread + park-offscreen-LRU for A), so lanes are not blocked — but treat "both GO"
+   as branch-attested, not main-verifiable.
+2. **A prior swarm (Lane A shell-store + Lane O overlay) already landed some of Lane V's files on
+   `main`.** Specifically: `cockpit/ui/src/lib/store.svelte.ts` **already exists** (the shared
+   `FleetStore` + `fleet` singleton, with `reconnect`/sockets and `pendingLaunch`/`awaitingApproval`),
+   and `cockpit/ui/src/lib/ApprovalOverlay.svelte` **already exists** (the focus-stealing
+   oracle-approval + real-launch modal, driven purely off host state). Lane V's brief below is
+   **corrected accordingly**: `store.svelte.ts` is **modify-not-create**, and the `overlay/`
+   deliverable is **already satisfied by `ApprovalOverlay.svelte`** — Lane V relies on it, does not
+   duplicate it. Lane A's `src-tauri/src/plugins/*` scaffolds exist as expected (no change).
+
+---
+
 ## ⚠️ Honest dependency analysis (why the shape is V + A + S, not 3 equal lanes)
 
 The two features are **not cleanly independent**, and each is **internally serial**:
@@ -85,18 +109,29 @@ Svelte glue, config-key deltas) so Lane S can paste-and-reconcile in one write.
 - **Goal:** the sandboxed-iframe view-plugin runtime — store extraction (single command sink),
   MessagePort bridge + command policy, host overlay (oracle approval), plugin SDK, loader, and a
   reference plugin that exercises the full message surface.
-- **Owns (exclusive write):** `cockpit/ui/src/lib/store.svelte.ts` (new), `cockpit/ui/src/lib/bridge.ts`
-  (new), `cockpit/ui/src/lib/loader.ts` (new), `cockpit/ui/src/lib/overlay/**` (new),
-  `cockpit/plugin-sdk/**`, `plugins/reference/**`, plus their tests.
-- **Reads (no write):** `cockpit/ui/src/lib/{api.ts,fleet.ts,types.ts}`, `cockpit/ui/src/App.svelte`,
-  `spikes/SPIKE-RESULTS.md` (P4 findings).
+- **Owns (exclusive write):** `cockpit/ui/src/lib/store.svelte.ts` (**MODIFY — already exists**; add
+  the single policed command-sink; do NOT recreate), `cockpit/ui/src/lib/bridge.ts` (new),
+  `cockpit/ui/src/lib/loader.ts` (new), `cockpit/plugin-sdk/**`, `plugins/reference/**`, plus their
+  tests. **The `overlay/` deliverable is already satisfied by the existing
+  `cockpit/ui/src/lib/ApprovalOverlay.svelte`** (from the prior Lane O swarm) — rely on it, do NOT
+  build a parallel `overlay/`. If you touch `ApprovalOverlay.svelte` at all it is a **read**, not a
+  rewrite.
+- **Reads (no write):** `cockpit/ui/src/lib/{api.ts,fleet.ts,types.ts}`,
+  `cockpit/ui/src/lib/ApprovalOverlay.svelte` (existing host overlay — the oracle-approval modal),
+  `cockpit/ui/src/App.svelte`. **P4 spike findings** are inlined in Notes below (the on-`main`
+  `SPIKE-RESULTS.md` is stale; the GO verdict is on branch `spike/view-plugins-handshake`).
 - **Shared contract:** files requests to **Lane S** for the App.svelte / lib.rs / tauri.conf.json
   entries in the table above. Does **not** write those files.
-- **Internal order (one agent, serial):** `store.svelte.ts` (+ regression: a bridge `launch`
+- **Internal order (one agent, serial):** `store.svelte.ts` **command-sink extraction** (MODIFY the
+  existing `FleetStore` — route plugin-originated commands through one policed sink; preserve the
+  live `reconnect`/socket path and its double-connect guards. + regression: a bridge `launch`
   concurrent with `reconnect()` yields **exactly one unit + one socket**) → `bridge.ts`
   (plugin-hello→init→ready 100× no-drop; dirty-delta `state`; `log-append`/`log-reset`;
-  **command policy** — shape/authority/cost/rate + inbound-flood-kill; `command-ack`) → `overlay/`
-  (oracle-approval modal, focus-stealing) → `plugin-sdk` + `loader` + **reference plugin**.
+  **command policy** — shape/authority/cost/rate + inbound-flood-kill; `command-ack`) → **overlay
+  is already done** (the existing `ApprovalOverlay.svelte` + the store's `awaitingApproval` derived
+  give the focus-stealing oracle-approval modal, driven purely off host state — a plugin cannot
+  satisfy/suppress it; wire the bridge's `awaiting_oracle_approval` presence to *read* this, never to
+  drive a new modal) → `plugin-sdk` + `loader` + **reference plugin**.
 - **Done when:** unit tests green for store (fold/single-sink), bridge (handshake/policy/ack),
   policy (reject unknown-type/unknown-id/over-bound `task`/`approve_oracle`; flood→kill);
   reference plugin exercises the full surface (dirty-`state`, `log-append`, a policed `launch`, a
diff --git a/docs/handoffs/4503b448-49ac-4b8c-9cd8-495937693183.md b/docs/handoffs/4503b448-49ac-4b8c-9cd8-495937693183.md
new file mode 100644
index 0000000..f70017b
--- /dev/null
+++ b/docs/handoffs/4503b448-49ac-4b8c-9cd8-495937693183.md
@@ -0,0 +1,142 @@
+# Handoff — fix D-7, then run the packaged Part 2 smoke for PR #49
+
+**Written:** 2026-08-15  ·  **Branch:** `feat/plugin-runtime` @ `e6decdc`  ·  **Session:** `4503b448-49ac-4b8c-9cd8-495937693183`
+
+## ⏳ Background operation in flight
+
+**None.** Everything from this session completed. The app was quit gracefully, `docker ps` is
+**0 running**, no `app.exe` / `fleetd-serve.exe` / `cargo` processes remain. The remaining work is
+**blocked on a human GUI session**, not on a machine.
+
+CI has **not** been re-run against this session's three code/doc commits — nothing is pushed yet.
+Check with `gh pr checks 49` after pushing.
+
+## Goal
+
+Land PR #49. Smoke run 2 completed **Part 1** and confirmed the pivotal fix, but surfaced four
+defects. Two are fixed; **D-7 is the agreed next action**, then the **packaged Part 2** — which has
+never been executed and is required before #49 can be marked ready.
+
+## State
+
+- **Canonical results:** [`spikes/SPIKE-RESULTS.md`](../../spikes/SPIKE-RESULTS.md) → **"Smoke run 2"**
+  (findings D-1…D-6; D-7 is written up in this brief and in `docs/STATUS.md`)
+- **Status doc:** [`docs/STATUS.md`](../STATUS.md) — State summary current as of 2026-08-15
+- **Done this session** (4 commits, **not pushed**):
+  - `55b0a5b` — **D-1 fixed**: `pluginSrc` now emits the Windows `http://ccplugin.localhost/…` form.
+    Verified cold-start.
+  - `2ab1b49` — **D-4 fixed**: `ShutdownGuard` ends the infinite `prevent_exit`/`exit(0)` loop.
+    Verified in a watched window (exits ~1 s, 0.19 s CPU; was 309 s and never exiting).
+  - `44ee6ad` — Smoke run 2 results table + findings
+  - `e6decdc` — STATUS.md + CLAUDE.md pickup block
+  - Filed [#61](https://github.com/adbarc92/command-center/issues/61) — loading-model UX (blank tabs,
+    silent launch failures)
+- **In flight (uncommitted):** nothing. Working tree clean.
+- **Gates after the fixes:** `cargo test` 37 · `cargo fmt` clean · `clippy -D warnings` clean ·
+  `npm test` 137 (19 files) · `npm run check` 353 files, 0/0.
+
+## Successor autonomy
+
+**`checkpoint-each`, operator-driven — settled with the operator this session and explicitly
+endorsed by them.** Use the **`driving-interactive-smoke-tests`** skill
+(`~/.claude/skills/driving-interactive-smoke-tests/`), written at their request from this session's
+method. In short: one item at a time; state the literal action, the exact PASS string, and the FAIL
+signatures *before* they click; ask with structured options; and **never record a result the
+operator did not explicitly report**. Recording results and committing is autonomous once a result
+is reported.
+
+## Successor's next action
+
+### 1. Fix D-7 — view-plugins receive no state (agreed with the operator)
+
+`PluginSession.sendFullState()` throws `DataCloneError` posting Svelte 5 `$state` proxies through
+`postMessage`:
+
+```
+bridge.ts:512 Uncaught DataCloneError: Failed to execute 'postMessage' on 'MessagePort'
+    at PluginSession.sendFullState (bridge.ts:405)
+    at PluginSession.onReady (bridge.ts:389)
+```
+
+`store.svelte.ts:34` declares `units = $state<Record<string, Unit>>({})`, so `toUnitLite`'s nested
+fields (`history`, `findings`, `oracleFiles`) stay proxy-backed and are not structured-cloneable.
+The throw lands **inside `onReady` before the tick timer starts**, so the plugin gets **no state and
+no ticks** — the whole state channel is dead. This is why the reference plugin shows `no units`.
+
+Fix with `$state.snapshot()` or a structural clone before `post()`. **Test-first, and drive the test
+with real proxies** — `bridge.test.ts` uses plain fake objects, which is exactly why 137 tests
+missed it. A fake-based test will pass against the broken code.
+
+### 2. Decide D-2 — capability negotiation is inert *(unresolved, see Open questions)*
+
+`grantedCapabilities` is computed at `loader.ts:140` and read **only by a test**
+(`loader.test.ts:75`). `App.svelte:237` constructs `PluginBridge` without `capabilities`, so
+`bridge.ts:594` falls back to `[...HOST_CAPABILITIES]` and ships the full host set. Observed live: a
+plugin whose manifest requests only `log-append` was granted `real-launch-confirm` too.
+
+### 3. Run Part 2 — the packaged smoke (never executed)
+
+```powershell
+$repo = 'D:\MajorProjects\CURRENT\command-center'
+Set-Location "$repo\cockpit\ui"; npm run bundle          # long: budget 20+ min
+# then run the packaged exe from target/release/
+```
+
+Repeat items 1.1–1.9 against the packaged build. **Part 2 needs no `CC_*` env vars** — that is the
+point of it: it confirms `ccplugin://` and the child webview work with **no dev server**. Part 2 is
+also the only way to confirm D-1's fix in the packaged path, since `pluginSrc`'s packaged branch is
+what ships.
+
+## Live decisions (settled)
+
+- **`db74a47` is CONFIRMED and needs no further verification.** Measured: 1,127 samples at 1 Hz,
+  **zero unresponsive**, across a real `compose build` and a 0→3→10 container ramp.
+- **1.9b was a real shutdown defect, not a `tauri dev` artifact.** Settled with evidence; do not
+  reopen it as an open question. Fixed and verified.
+- **D-3 (fleetd has no CORS) is out of scope for #49.** Pre-existing on `main`;
+  `git diff origin/main...HEAD` is empty for `api.ts` and `crates/fleetd/`. It BLOCKS smoke items
+  1.2, 1.4a and 1.7 — record those as **BLOCKED**, never as FAIL, and do not chase them as #49 bugs.
+- **Real-mode fleetd missions are authorised** by the operator (they approved spend this session).
+  Note `mode:'real'` currently fails at provisioning anyway — the sandbox container cannot clone the
+  private agent repo (`could not read Username for 'https://github.com'`). Use **tier `t2`** to reach
+  `awaiting_oracle_approval`; **t1 auto-freezes the oracle** (`driver.rs:934`) and never parks.
+
+## ⚠️ Open questions (unresolved — do NOT settle implicitly)
+
+1. **Push and update PR #49?** The operator chose "commit" over "commit and push", but said "we need
+   to focus on PR'ing the work already in-flight". **Four commits are sitting unpushed.** Confirm
+   before pushing — do not assume either way.
+2. **D-2 — fix, or ship #49 with capability negotiation inert?** Not decided. It is security-relevant
+   (every plugin gets every host capability), so it should not be defaulted quietly.
+3. **Does the remaining half of D-4 block the merge?** `stop_all_owned(30_000)` still runs
+   synchronously inside the `RunEvent` callback, so exit is blocked for as long as teardown takes
+   (~2.5 min with 10 containers up). Deliberately not bundled into `2ab1b49` (one change at a time).
+   The process now *exits*; it does not exit *promptly*.
+4. **Should the `docs/testing/PLAN.md` risk model be re-weighted?** Three of the four new defects
+   share one shape — **a unit test passing on a function whose output is never wired to anything**.
+   The gap is integration-boundary coverage, not unit coverage. The plan's §3 items (including
+   `spine_weight`) still await human ratification, unchanged from the last handoff.
+5. **Issue #52 (GitHub Support ticket to GC unreachable objects)** still needs the operator's
+   account; an agent cannot file it. Unchanged.
+6. **Issue #54 — retire the spike branches/worktrees** — still gated on #49 merging.
+
+## Traps (updated — two of the previous handoff's premises were wrong)
+
+1. **`docker ps` is the wrong instrument for Gate 5.** It shows only *running* containers. Run 1
+   left `audience-{minio,postgres,redis}-1` in **`Created`** state, invisible to `docker ps`, and
+   that residue broke run 2's first launch with a name conflict. **Assert on `docker ps -a`.**
+2. **"Images are prebuilt, so no 20-minute build" is FALSE.** `compose build` runs regardless; it
+   rebuilt two images this session.
+3. **A stale pre-warm is not a warm build.** After `main` merged up, the `app` crate rebuilt cold at
+   **16m22s**. Budget that for Part 2.
+4. **Quit the cockpit gracefully, never `Stop-Process`,** during Gate 5 — a force-kill skips
+   `stop_all_owned` and fabricates a teardown failure.
+5. The old "a running dev app blocks any tauri rebuild" trap was a *symptom* of D-4 and should be
+   largely gone since `2ab1b49`.
+
+## On completion
+
+1. Append **"Smoke run 2 — Part 2"** to `spikes/SPIKE-RESULTS.md`, verbatim on any FAIL or ANOMALY.
+2. Rewrite the State summary in [`docs/STATUS.md`](../STATUS.md) and append a session-log entry.
+3. If all green **and** D-7/D-2 are resolved: `gh pr ready 49`, then merge. Otherwise record exactly
+   what failed and stop — a partial pass does not unblock #49.
diff --git a/docs/handoffs/ae18cd84-95fa-45e7-a26f-d09f64a96826.md b/docs/handoffs/ae18cd84-95fa-45e7-a26f-d09f64a96826.md
new file mode 100644
index 0000000..0e0f703
--- /dev/null
+++ b/docs/handoffs/ae18cd84-95fa-45e7-a26f-d09f64a96826.md
@@ -0,0 +1,133 @@
+# Handoff — run Smoke run 2 and unblock PR #49
+
+**Written:** 2026-08-15  ·  **Branch:** `feat/plugin-runtime` @ `0466450`  ·  **Session:** `ae18cd84-95fa-45e7-a26f-d09f64a96826`
+
+## ⏳ Background operation in flight
+
+**None.** All background work from this session has completed. This handoff exists because the
+remaining work is **blocked on a human GUI session**, not on a machine.
+
+Last background op: PR #49 CI. **Settled, 9/9 pass** — `fmt + clippy`, `cargo test (cockpit)`,
+`cargo test (workspace)`, `svelte-check + tsc`, `vitest (cockpit/ui)`, `embargo guard`, and
+`tauri build` on all three OSes. Re-verify cheaply with `gh pr checks 49`.
+
+## Goal
+
+Run **Smoke run 2** — the interactive dev + packaged smoke — to completion, record results in
+[`spikes/SPIKE-RESULTS.md`](../../spikes/SPIKE-RESULTS.md), and mark **PR #49 ready**. The smoke is
+the **sole remaining merge blocker** on #49; every automated gate now passes.
+
+## State
+
+- **Checklist source:** [`spikes/SPIKE-RESULTS.md`](../../spikes/SPIKE-RESULTS.md) → "REMAINING HUMAN GATE" (§148) and "Smoke run 1" (§172)
+- **Status doc:** [`docs/STATUS.md`](../STATUS.md) — State summary is current as of 2026-08-15
+- **Done this session:**
+  - PR #60 merged → `main` @ `3cc1ae6`. CI now gates fmt, clippy, type-check, vitest, **and the
+    cockpit crate's tests, which had never run in CI at all.**
+  - Gate-5 teardown tests + main-thread ratchet test → `0d05f55`
+  - Risk-ranked testing plan → `f4d7f38` ([`docs/testing/PLAN.md`](../testing/PLAN.md), 131 gaps)
+  - `main` merged up (clean) → `458b952`; fmt violations it exposed fixed → `42e290e`
+  - STATUS.md rewritten → `0466450`
+  - Issue #53 closed; worktrees 5→3; branches pruned
+- **In flight (uncommitted):** nothing. Working tree is clean and pushed.
+
+## Successor autonomy
+
+**`checkpoint-each`, operator-driven — settled with the operator this session.**
+
+The successor **drives the checklist**: state each item, say exactly what to click and what a PASS
+looks like, then **wait for the operator to report what they saw**. The successor does **not** infer
+results, and does **not** mark an item PASS that the operator did not explicitly confirm. Recording
+results into `SPIKE-RESULTS.md` and pushing is autonomous once a result is reported.
+
+**A "not run" item must stay "not run".** Smoke run 1's whole lesson is that unmeasured items get
+laundered into passes. Nine of eleven items have never been executed.
+
+## Successor's next action
+
+1. Confirm the Gate-5 baseline is still valid — it is judged against this number:
+   ```powershell
+   docker ps --format '{{.Names}}'          # must be EMPTY (baseline was 0 containers)
+   Get-Process app,fleetd-serve -ErrorAction SilentlyContinue   # must be empty
+   ```
+2. Launch with the dev-seam env vars set. **`npm run desktop` does NOT set them**; without them
+   `ccplugin://` and app discovery won't resolve and you get a false failure:
+   ```powershell
+   $repo = 'D:\MajorProjects\CURRENT\command-center'
+   $env:CC_VIEW_PLUGINS_DEV = "$repo\plugins"
+   $env:CC_PLUGIN_SDK       = "$repo\cockpit\plugin-sdk\index.js"
+   $env:CC_APP_PLUGINS_DEV  = "$repo\cockpit\ui\src-tauri\app-plugins"
+   Set-Location "$repo\cockpit\ui"; npm run desktop
+   ```
+   (A preflighting launcher was written to this session's scratchpad at `smoke-dev.ps1`; it is
+   temp-dir scoped and may be gone. The five lines above are the whole of it that matters.)
+3. Drive the checklist below **in this order**. 1.5 is deliberately held until after 1.3/1.4 so a
+   repeat freeze doesn't block the cheap items the way it did in run 1.
+
+### Checklist — Part 1 (dev)
+
+| # | Item | PASS looks like |
+|---|---|---|
+| 1.1 | switcher renders | Four entries: FLEET (default) + PROJECTS + REFERENCE + AUDIENCE |
+| 1.2 | fleet regression canary | FLEET ops grid unchanged — tiles, colours, rails all as before |
+| 1.3 | REFERENCE view-plugin | Sandboxed iframe renders; `plugin-hello` → `ready` completes; **no network** from the plugin |
+| 1.4 | command policy round-trip | A policed `launch` round-trips; the `command-ack` **rejection** path also fires |
+| **1.5** | **AUDIENCE activation — PIVOTAL** | Chip walks `starting → health-probing → healthy` **with the window responsive throughout**. A frozen window means `db74a47` did not take. Images are prebuilt, so no 20-min build. |
+| 1.6 | rect glue on resize | Native webview stays glued to its rect while resizing |
+| 1.7 | park-on-overlay | Stage a REAL launch → webview parks off-screen, restores on close |
+| 1.8 | no leak on switch | AUDIENCE→FLEET→AUDIENCE: no orphaned webview, Fleet state preserved |
+| 1.9a | Gate 5 — container teardown | After **graceful** quit: `docker ps` empty, ports 8787/5173/8080 released |
+| 1.9b | Gate 5 — process exit | `app` process actually exits. **Known ANOMALY — see below** |
+| 1.10 | HMR under host CSP | Vite HMR still works with the new host CSP |
+
+### Checklist — Part 2 (packaged)
+
+`npm run bundle` → run `target/release/*app*.exe` → repeat 1.1–1.9. Confirms `ccplugin://` and the
+child webview work with **no dev server**. Never executed; budget real time for it.
+
+## Live decisions (settled)
+
+- **#60 merges before #49** — done. #49 is rebased on it and green.
+- **Results go in `spikes/SPIKE-RESULTS.md` under a new "Smoke run 2" section**, same table shape as
+  run 1. That file is the canonical manual-QA record.
+- **Item order is 1.1→1.4, then 1.5, then 1.6→1.10**, then Part 2.
+- **#49 gets marked ready only when Part 1 and Part 2 are both complete.** A partial pass does not
+  unblock it.
+
+## ⚠️ Traps that have already cost time twice
+
+1. **Quit gracefully — window close only. NEVER `Stop-Process`.** A force-kill skips
+   `stop_all_owned` and fabricates a Gate-5 teardown failure.
+2. **Do not rebuild the tauri crate while the app is running.** `tauri-build` cannot overwrite
+   `target/debug/fleetd-serve.exe` while it is the running sidecar and fails `PermissionDenied`.
+   Quit the app first.
+3. **Check `cockpit/ui/node_modules` is populated** before trusting any JS gate. It was empty at the
+   start of run 1 and both JS gates failed with `'vitest' is not recognized` — a toolchain failure
+   that reads as a code failure. Verified present as of this handoff.
+
+## ⚠️ Open questions (unresolved — do NOT settle implicitly)
+
+1. **The 1.9b process-exit anomaly is undiagnosed and must be decided this run.** In run 1 the `app`
+   process survived the window close (no window, 23 threads, still responding 15 s later) *after*
+   teardown had demonstrably succeeded. It is `GAP-010` in the testing plan, scored 25/25, and has
+   been carried forward three times. **Decide: `tauri dev` supervision artifact, or a real shutdown
+   defect?** The new `stop_all_owned_is_idempotent` test (`0d05f55`) rules out a second teardown
+   pass re-spending the 30 s `ExitRequested` budget, so that hypothesis is already eliminated.
+   If it reproduces in the **packaged** build too, it is not a dev artifact.
+2. **Does 1.9b block the merge?** Not yet decided. If it turns out to be a real shutdown defect,
+   does #49 wait for a fix, or merge with a tracked follow-up issue? Ask the operator; do not assume.
+3. **`docs/testing/PLAN.md` §3 has six items awaiting human ratification**, including
+   `spine_weight` — the Impact axis of all 131 gap scores, currently a first-run *proposal*. Not
+   smoke-blocking. Do not treat those scores as ratified until the operator confirms.
+4. **Issue #52 (GitHub Support ticket to GC unreachable objects) needs the operator's account.** An
+   agent cannot file it. Still open; it is the only item closing a real exposure.
+5. **Issue #54 — retire the spike branches/worktrees** (`spike/app-plugins-webview`,
+   `spike/app-plugins-webview-v2`, `spike/view-plugins-handshake`) — **only after #49 merges**. They
+   remain the sole working reproduction if the smoke fails.
+
+## On completion
+
+1. Write the "Smoke run 2" results table into `spikes/SPIKE-RESULTS.md`, including any FAIL or
+   ANOMALY verbatim — do not soften.
+2. Update the State summary in [`docs/STATUS.md`](../STATUS.md) and append a session-log entry.
+3. If all green: `gh pr ready 49`, then merge. If not: record precisely what failed and stop.
diff --git a/docs/handoffs/grill-and-build-smoke-testing-skill.md b/docs/handoffs/grill-and-build-smoke-testing-skill.md
new file mode 100644
index 0000000..6f28174
--- /dev/null
+++ b/docs/handoffs/grill-and-build-smoke-testing-skill.md
@@ -0,0 +1,165 @@
+# Handoff — grill the operator, then build the interactive-smoke-testing skill properly
+
+**Written:** 2026-08-15  ·  **Branch:** `feat/plugin-runtime` @ `7a05cae`  ·  **Session:** `4503b448-49ac-4b8c-9cd8-495937693183`
+
+## ⏳ Background operation in flight
+
+**None.** Nothing is running: 0 `app`/`fleetd-serve`/`cargo` processes, 0 containers, clean tree.
+This handoff exists because the work needs a **fresh agent with full budget**, not because anything
+is pending.
+
+## Goal
+
+Produce a **robust, empirically-tested** skill for driving operator-in-the-loop smoke tests.
+The operator's words: *"I want it to be robust — it's about to see a lot of usage."*
+
+Two phases, in order:
+
+1. **Grill the operator** (`grill-me`) to settle the design questions listed below. Do this
+   **first** — do not start authoring from the existing draft.
+2. **Author it** under `writing-skills` discipline, with a real RED phase.
+
+## State
+
+- **Existing draft:** `~/.claude/skills/driving-interactive-smoke-tests/SKILL.md` — written at the
+  end of a long session, **never subagent-tested**. Treat it as *input*, not a baseline; expect to
+  rewrite it. Its captured failure modes are worth mining; its structure is not sacred.
+- **Where the evidence came from:** a full operator-driven smoke of PR #49
+  ([`spikes/SPIKE-RESULTS.md`](../../spikes/SPIKE-RESULTS.md) → "Smoke run 2"). That run found four
+  defects every automated gate had passed, using the method this skill is meant to encode.
+- **Prior art to read:** `tests/tauri_command_threading.rs` in this repo is a good example of the
+  operator's taste — a *ratchet* that makes a class of defect mechanical rather than a doc asking
+  people to be careful.
+
+## Successor autonomy
+
+**Phase 1 (grilling): `discuss-first`.** The whole point is extracting the operator's real
+requirements. Do not propose a design and seek assent — interrogate branch by branch.
+
+**Phase 2 (authoring/testing): `autonomous`, and subagents are explicitly authorised.** The operator
+confirmed: *"Yes — dispatch freely for testing."* This lifts the earlier session's restriction. Use
+subagents for baseline scenarios, wording micro-tests, and post-skill compliance runs. **Without a
+real RED phase this deliverable is not robust, it is merely confident** — the existing draft is
+already the "merely confident" version.
+
+**Scope: personal, all projects** (`~/.claude/skills/`). It must generalise well beyond this repo —
+web apps, CLIs, mobile, hardware — not just Tauri desktop. Do not let cockpit specifics leak in.
+
+## Successor's next action
+
+1. Read the existing draft and the "Smoke run 2" section of `spikes/SPIKE-RESULTS.md`.
+2. Invoke **`grill-me`** on the design questions below. Resolve them with the operator.
+3. Then invoke **`writing-skills`** and follow RED-GREEN-REFACTOR:
+   - **RED:** run pressure scenarios against subagents *without* the skill. Capture rationalisations
+     verbatim. **A no-guidance control is mandatory** — if the control doesn't exhibit the failure,
+     don't write guidance for it.
+   - **GREEN:** write only what addresses observed failures.
+   - **REFACTOR:** close the loopholes the tests surface; re-run until stable.
+
+## The empirical corpus (real observed failures — use these, don't invent scenarios)
+
+This is the most valuable part of this brief. Every item below actually happened.
+
+**Result laundering — the core failure the skill must prevent.**
+- Smoke run 1 recorded 9 of 11 items as untested, but the surrounding narrative read as "mostly
+  fine", and #49 sat for weeks as though only one item remained. **Unmeasured items decay into
+  assumed passes.**
+
+**The agent nearly recorded a false pass (this is the sharpest scenario available).**
+- Item "prove the plugin cannot reach the network": the operator ran the probe and reported it
+  blocked. The report *looked* like a pass. But the error text named origin `http://localhost:5173`
+  — the **host** frame, not the sandboxed plugin frame — and it was a **CORS** error, not the
+  **CSP** error the test was designed to elicit. Correct scoring: **not run**, re-run in the right
+  frame. A skill must make an agent check that the evidence matches the claim, not just the verdict.
+
+**Wrong instrument produces a confident wrong answer.**
+- Gate 5's criterion was "`docker ps` empty". `docker ps` shows only *running* containers; three
+  containers sat in `Created` state, invisible to it, and that residue broke the *next* run's launch.
+  The passing criterion was measuring the wrong thing.
+
+**Operator impressions are unreliable in BOTH directions — and that's not a criticism, it's the design constraint.**
+- A hard defect (a frame that never navigated) was read as *"It's blank, but I assume it's mostly
+  taking a while to load."*
+- Conversely their *"PASS — stayed responsive"* was **correct**, and corroborated by 1,127 background
+  samples at 1 Hz showing zero unresponsive. Objective instrumentation is what let both be scored
+  honestly. **Sampling in the background costs the operator nothing and should probably be a default,
+  not an option** — test that claim in the grill.
+
+**Badly phrased items waste the operator's time — the agent failed at this live.**
+- One item was phrased in internal jargon ("what is the cockpit doing?", "did the webview park?").
+  The operator replied: ***"I'm not sure what you're asking me to check, be more specific."*** Only
+  after the agent read the component source and re-phrased concretely — *"a modal titled `ORACLE
+  APPROVAL REQUIRED` with `✕ REJECT` and `✓ APPROVE`; does the content behind it disappear?"* — was
+  it answerable. **This is a prime RED scenario: give a subagent an internal-jargon checklist item
+  and see whether it translates to observable terms before asking.**
+
+**Free-text answers carried the decisive evidence.**
+- The operator's own additions — a devtools 405 preflight, a pasted `DataCloneError` stack — led
+  directly to two root causes that the structured options alone would have missed entirely.
+  **Options must never crowd out free-text.** Note this cuts against over-structuring.
+
+**BLOCKED is not FAIL.**
+- Three items were unreachable because of an unrelated pre-existing defect. Scoring them FAIL would
+  have falsely indicted the feature under test; scoring them PASS would have been a lie. They need
+  their own bucket, and the skill must stop agents collapsing four outcomes into two.
+
+**Deriving criteria from source converted judgement calls into observations.**
+- Reading the code first yielded exact expected strings (`connected · caps: …` vs
+  `failed to connect: …` after 3 s) instead of "check it connects". Cheap, and it is what made most
+  items scorable at all.
+
+## Design questions the grill must resolve (do NOT pre-answer these)
+
+1. **Batching vs strict one-at-a-time.** The skill draft says one item per question. In practice the
+   agent asked **2–3 related items per round** and the operator explicitly praised the flow. Strict
+   serialisation may be too slow for an 11-item checklist. Where is the real line — and is it about
+   item count, or about whether the items share a setup?
+2. **How much source-reading is warranted per item?** It clearly paid off, but it costs latency
+   before the operator can act. Should it be mandatory, conditional, or judgement?
+3. **Should background instrumentation be mandatory?** It was decisive here. But it is only possible
+   when the agent can observe the system. What is the rule when it can't?
+4. **What happens when the operator's report contradicts the instrument?** This didn't occur —
+   they agreed every time — so there is no observed precedent. Needs a decided policy.
+5. **Continue or halt after a failure?** This run continued past failures and banked 8 further
+   results, which the operator seemed to want. But the prior handoff's standing instruction was
+   "record precisely what failed and stop." Which is right, and does it depend on failure severity?
+6. **Authority to mutate the environment.** The agent asked before removing containers and before
+   spending real money, and stated blast radius each time. Should the skill mandate that pattern,
+   and does it differ for reversible vs irreversible actions?
+7. **Does the skill own the record format**, or only the interrogation method? Writing results to a
+   durable artifact was load-bearing here, but it may be out of scope.
+8. **Operator expertise assumptions.** This operator reads stack traces and devtools fluently.
+   Should the skill adapt phrasing to expertise, and if so how does the agent detect it?
+9. **Relationship to `verify` / `qa-runner`.** Both exist in the operator's skill set and drive
+   browser automation. Where is the boundary, so the right one gets picked?
+
+## Live decisions (settled)
+
+- **Subagent dispatch is authorised** for testing this skill (operator, this session).
+- **The existing draft is input, not a baseline.** Expect a rewrite.
+- **Personal scope**, `~/.claude/skills/`, must generalise across project types.
+- **The method itself is validated** — it found four real defects in one session, two of which are
+  now fixed and verified. The question is how to *encode* it, not whether it works.
+
+## ⚠️ Open questions (unresolved — do NOT settle implicitly)
+
+1. **All nine design questions above.** They are the grill's agenda. None are pre-answered; several
+   (batching, halt-vs-continue) have evidence pointing *against* what the current draft says.
+2. **Does the skill keep its current name?** `driving-interactive-smoke-tests` was chosen without
+   consultation. Naming affects discovery, which the operator cares about.
+3. **Should the skill's RED corpus be committed somewhere reusable?** The scenarios above are
+   valuable and were expensive to obtain; there may be no good home for them.
+4. **PR #49's six commits are still unpushed** — carried over, still unanswered. The operator chose
+   "commit" over "commit and push" but said to focus on PR'ing the in-flight work. Confirm before
+   pushing; do not assume. See
+   [`docs/handoffs/4503b448-49ac-4b8c-9cd8-495937693183.md`](4503b448-49ac-4b8c-9cd8-495937693183.md)
+   for the rest of the #49 state, including the agreed-next **D-7** fix.
+
+## On completion
+
+1. Skill lives at `~/.claude/skills/<name>/SKILL.md`, replacing the draft.
+2. Record what the RED phase actually found — the rationalisation table should come from observed
+   subagent behaviour, not from imagination.
+3. If a memory note is warranted, update
+   `~/.claude/projects/d--MajorProjects-CURRENT-command-center/memory/smoke-testing-via-structured-dialog.md`
+   and its `MEMORY.md` index line, which currently point at the draft's name.
diff --git a/docs/testing/PLAN.md b/docs/testing/PLAN.md
new file mode 100644
index 0000000..47ea83c
--- /dev/null
+++ b/docs/testing/PLAN.md
@@ -0,0 +1,4485 @@
+---
+plan-format: 1
+next_id: 133
+
+# RATIFICATION PENDING (proposed 2026-08-13, first run) — the Impact axis, 1-5 per module.
+# Nothing here was derived from call-graph fan-in; these are judgments about blast radius.
+spine_weight:
+  tauri_host: 5           # the desktop shell: a defect here freezes or kills the whole product
+  ui_shell: 5             # App.svelte is the only surface the operator touches
+  fleetd_driver: 5        # the autonomous execution spine; defects burn real money and real agent time
+  build_ci_gate: 5        # the gate itself: if it does not run, no other module's coverage is real
+  app_plugin_runtime: 5   # CARVE-OUT, see Trust verdicts
+  fleetd_server: 4        # the control plane every UI surface reads from
+  fleetd_store: 4         # persistence; loss or corruption is unrecoverable
+  fleetd_forge: 4         # container + GitHub lifecycle; orphaned resources and lost work
+  ui_plugin_bridge: 4     # the trust boundary for untrusted plugin code
+  fleet_core: 3           # small pure state machine, the best-covered thing in the repo
+  ui_dashboard: 3         # a read-only viewer today; a wrong card misleads, it does not destroy
+  dev_scripts: 3          # build/demo scripts; failure is loud and local
+  session_state: 2        # developer-experience plugin; failure loses a session note
+  py_tools: 2             # operator hooks; failure degrades a Claude session, not the product
+
+core_entry_points:        # ratified traversal roots for reachability
+  - cockpit/ui/src/main.ts
+  - cockpit/ui/src-tauri/src/main.rs
+  - crates/fleetd/src/bin/serve.rs
+  - crates/fleetd/src/bin/run_once.rs
+
+tier_map:
+  rust-workspace:
+    runners: ["cargo test --workspace"]
+    globs:   [crates/fleet-core/**, crates/fleetd/**]
+    trust:   reports-dne
+    in_ci:   true
+    parse_spec:
+      ok: '^test (?<test>\S+) \.\.\. ok$'
+      summary: '^test result: (ok|FAILED)\. (\d+) passed; (\d+) failed; (\d+) ignored; (\d+) measured; (\d+) filtered out'
+  tauri-host:
+    runners: ["cargo test --manifest-path cockpit/ui/src-tauri/Cargo.toml"]
+    globs:   [cockpit/ui/src-tauri/**]
+    trust:   reports-dne
+    in_ci:   false          # standalone [workspace]; see GAP for the CI hole
+    parse_spec:
+      ok: '^test (?<test>\S+) \.\.\. ok$'
+      summary: '^test result: (ok|FAILED)\. (\d+) passed; (\d+) failed; (\d+) ignored; (\d+) measured; (\d+) filtered out'
+  vitest:
+    runners: ["npm test (cwd cockpit/ui)"]
+    globs:   [cockpit/ui/src/**]
+    trust:   reports-dne
+    in_ci:   false
+    parse_spec:
+      ok: '^ . (?<file>src/\S+) \((?<n>\d+) tests?\)'
+      summary: '^\s*Tests\s+(\d+) passed \((\d+)\)$'
+  node-embargo:
+    runners: ["node --test scripts/embargo-guard.test.mjs"]
+    globs:   [scripts/**]
+    trust:   reports-dne
+    in_ci:   true
+    parse_spec:
+      ok: '^ok (?<n>\d+) - (?<test>.+)$'
+      summary: '^# pass (\d+)$'
+  node-session-state:
+    runners: ['node --test "plugins/session-state/test/*.test.mjs"']
+    globs:   [plugins/session-state/**]
+    trust:   reports-dne
+    in_ci:   false
+    parse_spec:
+      ok: '^ok (?<n>\d+) - (?<test>.+)$'
+      summary: '^# pass (\d+)$'
+  pytest:
+    runners: ["uv run pytest (cwd tools/budget-checkpoint)", "uv run pytest (cwd tools/cache-countdown)"]
+    globs:   [tools/**]
+    trust:   reports-dne
+    in_ci:   false
+    parse_spec:
+      ok: '^\.+\s+\[\s*\d+%\]$'
+      summary: '^(\d+) passed(?:, (\d+) skipped)?(?:, (\d+) failed)? in [\d.]+s$'
+  manual:
+    runners: ["a watched GUI session on the target machine"]
+    globs:   [spikes/SPIKE-RESULTS.md]
+    trust:   unverified
+    in_ci:   false
+    parse_spec:
+      ok: 'PASS'
+      summary: 'n/a - a human writes the result row by hand'
+---
+
+# Testing Plan — Command Center
+
+> Risk-ranked map of testing gaps, automated and human-QA in one ranking. Produced by the
+> `testing-plan` skill. **This file is the register; it writes no tests and changes no code.**
+> Entries are append-only and IDs are never reused. `decision` / `rationale` / `owner` are
+> human-owned fields — a scan may propose, never overwrite.
+
+## 1. Run stamp
+
+| | |
+|---|---|
+| **Run** | 2026-08-13 (first run — bootstrap) |
+| **Commit** | `a3edc78` on `feat/plugin-runtime` |
+| **Working tree at scan time** | `M cockpit/ui/src-tauri/src/plugins/manager.rs`, `?? cockpit/ui/src-tauri/tests/` — **concurrent work by another agent**, see the carve-out in §2 |
+| **Repo age** | 223 commits, first commit 2026-06-04 (70 days) |
+
+### Reconciliation — 2026-08-16 (not a rescan; a correction of known-stale facts)
+
+The 2026-08-13 stamp above is **materially out of date**. Three smoke sessions and two CI changes
+have landed since. This block corrects the facts a reader would otherwise be misled by; it does
+**not** re-derive risk or rescan the tree. **A full `testing-plan` re-run is the right next step**
+and is recorded as the top item in `docs/STATUS.md`.
+
+**1. CI no longer has "exactly three jobs."** §1's coverage-hole #1 below is stale. `#60` added
+rustfmt, clippy, type-check and both test tiers. CI now runs **nine** distinct checks:
+`embargo guard`, `fmt + clippy`, `svelte-check + tsc`, `vitest (cockpit/ui)`,
+`cargo test (workspace)`, `cargo test (cockpit)`, and `tauri build` ×3 OS. The claim that five of
+seven tiers never run in CI no longer holds — `vitest` and `tauri-host` both run now.
+
+**2. The manual row is no longer "1 of 12 PASS."** Smoke run 2 (dev, 2026-08-15) and Smoke run 3
+(**packaged**, 2026-08-15/16) executed the checklist end to end. See `spikes/SPIKE-RESULTS.md`.
+Current manual state: **most rows PASS**, three are BLOCKED behind **D-3** (fleetd serves no CORS
+headers — pre-existing on `main`), and two are genuinely unverified (`GAP-011`, and the packaged
+no-network check which needs devtools a release build does not have).
+
+**3. Five defects were found by those sessions that every automated gate had passed** — D-1, D-2,
+D-4, D-7 and D-8. All are now fixed. The pattern they share is recorded as **`GAP-132`**, which is
+the single highest-value addition to this register.
+
+**4. A correction worth keeping.** A first draft of the run-3 analysis claimed *"nothing in CI
+bundles the app."* **That is false** — `tauri build` runs on all three OSes and uploads artifacts.
+The true gap is that **nothing asserts what is inside the bundle**, which is why D-8 passed a
+*successful* build. `GAP-132` records this precisely.
+
+### Per-tier results this run
+
+| Tier | Runner | Runs in CI? | This run |
+|---|---|---|---|
+| `rust-workspace` | `cargo test --workspace` | **yes** | **not run** — the cargo build was held by a concurrent agent; stamped `(static-only)` |
+| `tauri-host` | `cargo test` in `cockpit/ui/src-tauri` | **NO** | **not run** — same reason; stamped `(static-only)` |
+| `vitest` | `npm test` in `cockpit/ui` | **NO** | **GREEN** — 19 files, 135 tests, 135 passed, 0 failed, 0 skipped, 0 todo (209 s) |
+| `node-embargo` | `node --test scripts/embargo-guard.test.mjs` | **yes** | **GREEN** — 13 tests, 13 pass, 0 fail, 0 skipped, 0 todo |
+| `node-session-state` | `node --test "plugins/session-state/test/*.test.mjs"` | **NO** | **GREEN** — 52 tests, 52 pass, 0 fail, 0 skipped, 0 todo |
+| `pytest` (budget-checkpoint) | `uv run pytest` | **NO** | **GREEN** — 24 passed |
+| `pytest` (cache-countdown) | `uv run pytest` | **NO** | **GREEN** — 29 passed |
+| `manual` | watched GUI session | n/a | **1 of 12 rows PASS**; 1 FAIL-then-fixed-but-never-re-watched; 1 undiagnosed ANOMALY; 9 never run |
+
+### Coverage holes — read these before trusting any number above
+
+1. **Five of the seven automated tiers never run in CI.** `.github/workflows/ci.yml` has exactly
+   three jobs: `embargo`, `test` (`cargo test --workspace`), and `build` (`tauri build` ×3 OS).
+   Only `rust-workspace` and `node-embargo` gate a pull request. 135 vitest tests, 28 Tauri-host
+   Rust tests, 52 session-state tests and 53 pytest tests are **advisory**, not gating.
+2. **`cargo test --workspace` does not reach the Tauri host crate.** `cockpit/ui/src-tauri/Cargo.toml`
+   declares a bare `[workspace]`, so the root workspace (`crates/fleet-core`, `crates/fleetd`) excludes
+   it. CI compiles that crate via `tauri build` and never executes one of its tests.
+3. **CI has no Docker daemon.** `crates/fleetd/tests/{local_docker_it,preflight_it,swarm_smoke_it}.rs`
+   are `#[ignore]`d (`swarm_smoke_it` for git network access, the other two for Docker) and run
+   nowhere automatically. Everything whose only coverage is one of those files is **human-QA-only
+   today**; entries say so individually.
+4. **No lint, format, or static-analysis gate exists.** `clippy`, `rustfmt`, `cargo fmt`, eslint and
+   prettier appear in zero workflow files.
+5. **`release.yml` runs no tests at all** before signing and publishing. `releaseDraft: true` — a
+   human clicking publish — is the only thing between an untested build and users.
+6. **`npm run check`** (svelte-check + tsc, 353 files) is not in CI either.
+7. **`churn_90d` is lifetime churn on this repo.** The first commit is 70 days old, so the 90-day
+   window covers all 223 commits. Churn points therefore skew high across the board; treat them as a
+   relative ordering signal, not an absolute rate.
+8. **No captured per-test inventory exists for the two Rust tiers this run.** Every Rust claim below
+   is static-analysis only. No `open → covered` transition would be licensed for those tiers.
+
+## 2. Trust verdicts
+
+| Tier · runner | Trust | Basis |
+|---|---|---|
+| `rust-workspace` · `cargo test --workspace` | `reports-dne` | libtest's summary carries a real `ignored` count and `#[ignore]` is a first-class primitive this repo actually uses. **But not run this session** — `(static-only)`. |
+| `tauri-host` · `cargo test` | `reports-dne` | same runner grammar. **Not run this session**, and never run by CI at all. |
+| `vitest` · `npm test` | `reports-dne` | vitest's summary distinguishes `passed` / `skipped` / `todo`; this run reported 0 of the latter two. Verified against a real captured run. |
+| `node-embargo` · `node --test` | `reports-dne` | TAP emits `# skipped` and `# todo` separately from `# pass`. Captured: both 0. |
+| `node-session-state` · `node --test` | `reports-dne` | same. Captured: both 0. |
+| `pytest` · `uv run pytest` | `reports-dne` | pytest's summary line reports `skipped` separately. Captured: neither suite skipped. |
+| `manual` · watched GUI | `unverified` | A human writes PASS/FAIL prose into `spikes/SPIKE-RESULTS.md` by hand. Nothing distinguishes "ran and passed" from "was not reached" except the author's discipline. |
+
+**`manual-baseline: partial.`** One of the twelve manual rows (Gate 5 container teardown) carries a
+recorded pass at `2026-08-10 @ 725b630`. Ten have never carried a result. One carries a FAIL that was
+fixed in `db74a47` and has never been re-run in a watched window.
+
+### Scope carve-out — the app-plugin runtime
+
+`cockpit/ui/src-tauri/src/plugins/**` (`manager.rs`, `state.rs`, `manifest.rs`, `discovery.rs`,
+`seams.rs`, `seams_impl.rs`, `mod.rs`) was **deliberately not scanned** on this run. Targeted tests for
+the `plugin_launch` main-thread-blocking defect and the `stop_all_owned` / container-teardown
+lifecycle (Gate 5) were being written by another agent while this plan was produced — the working tree
+showed `M .../plugins/manager.rs` and a new `cockpit/ui/src-tauri/tests/tauri_command_threading.rs`.
+Those two areas are **in progress, covered separately** and are recorded here only as context, never
+as gaps to act on: entries `GAP-005` (1.5 AUDIENCE activation) and `GAP-009`/`GAP-010` (Gate 5) carry
+`ratification_pending` for that reason and are excluded from the ranked index's call to action.
+
+Neighbouring code that is *not* carved out was scanned normally — `embedding.rs`, `view_plugins.rs`,
+`sidecar.rs`, `dashboard.rs`, `local_projects.rs`, `lib.rs` and the whole UI side all appear below.
+Note that the new `tests/tauri_command_threading.rs` guard is a **signature-level** ratchet: it
+inspects whether a `#[tauri::command]` is declared `async`, so blocking work one level down inside a
+callee is invisible to it (see `GAP` entries for `WebviewPool::touch_and_evict` and `run_halyard`).
+
+## 3. Needs ratification
+
+Durable — carried across runs until a human answers. Nothing below has been applied.
+
+| # | Awaiting | Detail |
+|---|---|---|
+| R1 | `spine_weight` | The whole table in the front matter is a first-run **proposal**. It is the Impact axis of every score in this file. Confirm or amend before the next run treats it as ratified. |
+| R2 | `core_entry_points` | Four roots proposed. `plugins/session-state/**` and `tools/**` are reachable from **none** of them — their real entry points are the Claude Code hook contract (`hooks.json`, the `.ps1` wrappers) and the `/save-state` skill. Ratify whether those count as additional roots. |
+| R3 | Phase-3 dispatch shape | On this bootstrap run the scanners returned ~200 candidates. Risk-tiered solo refutation of every one was not affordable, so refuters were dispatched **grouped by module** over the highest-risk and live-defect-asserting claims; the remainder are written `(unverified)`. Ratify this as the standing policy for large bootstrap runs, or require a second pass. |
+| R4 | Manual checklist home | `spikes/SPIKE-RESULTS.md` was seeded as the single manual-QA source. `docs/handoff/2026-06-24-human-gated-spikes-runbook.md` and `2026-06-25-spikes-handoff.md` also contain human-gated procedures but are marked SUPERSEDED. Confirm SPIKE-RESULTS is canonical, or name a real checklist file. |
+| R5 | Carve-out release | `GAP-005`, `GAP-009`, `GAP-010` are parked as "covered separately". Release them back into the ranking once the concurrent app-plugin-runtime test work lands, or mark them `covered` with the covering test. |
+| R6 | Tier `in_ci` key | `tier_map` here carries a non-standard `in_ci` boolean per tier. It is the single most load-bearing fact this plan discovered and there was nowhere else in the schema to put it. Ratify the key or move it. |
+
+## 4. Index
+
+Machine-owned and fully regenerated each run. Ranks are re-densified `1..N` every time;
+tie-break is `(impact desc, likelihood desc, GAP id asc)`.
+
+### 4.1 Ranked open gaps
+
+| rank | id | risk | title |
+|---:|---|---:|---|
+| **1** | **`GAP-132`** | **25** (L5×I5) | **CI bundles the app on three OSes and never looks inside the bundle** — the register entry for the pattern behind D-1/D-2/D-4/D-7/D-8 (added 2026-08-16) |
+| ~~1~~ | `GAP-006` | ~~25~~ | ~~Smoke 1.6: rect glue on resize~~ — **VERIFIED** run 2 (dev) + run 3 (packaged, item 2.6). Retire on next scan |
+| ~~2~~ | `GAP-008` | ~~25~~ | ~~Smoke 1.8: no leak on switch~~ — **VERIFIED AND MEASURED** run 3 (item 2.8): 3 switch cycles, webview2 procs 31→31, mem +0.19%. Retire on next scan |
+| ~~3~~ | `GAP-010` | ~~25~~ | ~~Smoke 1.9b: app process survives window close~~ — **ROOT-CAUSED AND FIXED** (D-4, `2ab1b49`); re-verified packaged: exit in **0.23 s** cold / **5.27 s** with 10 containers. No longer "undiagnosed". Retire on next scan |
+| 4 | `GAP-013` | **25** (L5×I5) | Overlay input-block over a LIVE view-plugin iframe is unverified (new manual row) |
+| 5 | `GAP-014` | **25** (L5×I5) | Rect glue under DPI, monitor, and window-move changes (new manual row) |
+| 6 | `GAP-015` | **25** (L5×I5) | Cockpit behaviour after fleetd restarts or the socket drops (new manual row) |
+| 7 | `GAP-017` | **25** (L5×I5) | `agent_exec` awaits the agent with no timeout and no cancellation |
+| 8 | `GAP-033` | **25** (L5×I5) | Driver-plus-real-Docker resume has never been verified by machine or human |
+| 9 | `GAP-002` | **20** (L4×I5) | Smoke 1.2: Fleet ops-grid regression canary (manual) |
+| 10 | `GAP-007` | **20** (L4×I5) | Smoke 1.7: native webview parks off-screen while a host overlay is open (manual) |
+| 11 | `GAP-011` | **20** (L4×I5) | Smoke 1.10: Vite HMR still works under the host CSP (manual) |
+| ~~12~~ | `GAP-012` | ~~20~~ | ~~Smoke Part 2: the packaged build has never been launched~~ — **LAUNCHED AND RUN END TO END**, run 3 (2026-08-16). 9 PASS / 2 BLOCKED / 2 NOT RUN / 0 FAIL. Retire on next scan; the two NOT RUN rows (packaged no-network, policed-launch ack) need their own entries |
+| 13 | `GAP-018` | **20** (L4×I5) | `Runner::health` is implemented twice and called from nowhere, so `Trigger::Stall` is unreachable |
+| 14 | `GAP-019` | **20** (L4×I5) | Resumed T2/T3: rejecting the oracle is a silent no-op |
+| 15 | `GAP-021` | **20** (L4×I5) | A successful T3 ship orphans the unit's named volume |
+| 16 | `GAP-022` | **20** (L4×I5) | `poll_mergeability` fires ten `gh` calls back to back with no delay |
+| 17 | `GAP-023` | **20** (L4×I5) | The whole host-side git/GitHub failure surface is unexecuted because `FakeForge` cannot fail |
+| 18 | `GAP-024` | **20** (L4×I5) | Every command-validity decision is written out four times |
+| 19 | `GAP-057` | **20** (L4×I5) | The Tauri host crate is a standalone workspace, so CI never runs one of its tests |
+| 20 | `GAP-058` | **20** (L4×I5) | The sidecar supervisor's restart loop has no test, no attempt cap, and no deadline |
+| 21 | `GAP-059` | **20** (L4×I5) | `health_gate` does not restart on timeout, contradicting its own doc, and wedges the app in Starting |
+| 22 | `GAP-062` | **20** (L4×I5) | `view_plugins::respond` is the only guard between plugin URLs and `fs::read`, with 14 untested branches |
+| 23 | `GAP-063` | **20** (L4×I5) | Dev/packaged plugin-root precedence is the seam every remaining smoke row stands on, untested |
+| 24 | `GAP-064` | **20** (L4×I5) | `WebviewPool::touch_and_evict` is the whole "no leak on switch" guarantee and is pure arithmetic nobody tests |
+| 25 | `GAP-065` | **20** (L4×I5) | The `app::<id>` webview-label scheme is encoded in three places with a "MUST" nobody enforces |
+| 26 | `GAP-066` | **20** (L4×I5) | The `ccplugin://` origin is written three ways, and the CSP form is Windows-only |
+| 27 | `GAP-067` | **20** (L4×I5) | `127.0.0.1:8787` is hand-mirrored in four places and only one of them honours `CC_ADDR` |
+| 28 | `GAP-068` | **20** (L4×I5) | The updater is registered against an empty pubkey and a `.example` endpoint |
+| 29 | `GAP-069` | **20** (L4×I5) | `lib.rs:run`'s ExitRequested ordering is load-bearing and enforced only by statement order |
+| 30 | `GAP-078` | **20** (L4×I5) | `api.ts` has no test file at all, and `openStream` wires no close or error handler |
+| 31 | `GAP-081` | **20** (L4×I5) | `phaseClass` and `progress` drive every tile's colour and rail and have no direct assertion |
+| 32 | `GAP-111` | **20** (L4×I5) | `npm run check` (353 files) is not in CI, and two source files are typechecked by nothing |
+| 33 | `GAP-113` | **20** (L4×I5) | No lint, format, or static-analysis gate exists anywhere |
+| 34 | `GAP-122` | **20** (L4×I5) | The embargo guard's `--all` mode, its skip paths, and its only write path are untested |
+| 35 | `GAP-123` | **20** (L4×I5) | The git hooks and CI's inline commit-message range are shell nothing executes |
+| 36 | `GAP-016` | **20** (L5×I4) | Starting a real mission with Docker stopped or the agent image absent (new manual row) |
+| 37 | `GAP-043` | **20** (L5×I4) | No `busy_timeout` anywhere: a second writer loses events silently |
+| 38 | `GAP-044` | **20** (L5×I4) | Every driver event does two synchronous SQLite writes inside a global mutex on a tokio worker |
+| 39 | `GAP-045` | **20** (L5×I4) | `events_since` replays from 0 with no retention, pagination, or bound |
+| 40 | `GAP-049` | **20** (L5×I4) | `router()` mounts nine routes with no auth, no origin check, and no CORS layer |
+| 41 | `GAP-092` | **20** (L5×I4) | The hostile-plugin kill-and-revert path is covered by neither a test nor a checklist row |
+| 42 | `GAP-119` | **20** (L5×I4) | Failed and halted units keep their volumes forever, and nothing has ever looked |
+| 43 | `GAP-047` | **16** (L4×I4) | `env_f64` accepts a zero cap, bricking every mission with a 429 |
+| 44 | `GAP-048` | **16** (L4×I4) | `stream_to_socket` drops events permanently on broadcast lag and never notices a dead peer |
+| 45 | `GAP-050` | **16** (L4×I4) | `post_command` is the entire inbound control surface and no test drives it over HTTP |
+| 46 | `GAP-053` | **16** (L4×I4) | `spawn_driver_for` and `rehydrate` duplicate the real-mode construction and both dispatch on `_` |
+| 47 | `GAP-055` | **16** (L4×I4) | `bin/serve.rs:main` has no tests, no graceful shutdown, and panics on a held port |
+| 48 | `GAP-056` | **16** (L4×I4) | `get_swarm` computes the swarm "done" verdict at read time with no test and no consumer |
+| 49 | `GAP-087` | **16** (L4×I4) | `policeCommand`'s only numeric bound, `min_review_rounds`, is untested |
+| 50 | `GAP-088` | **16** (L4×I4) | `loader.ts`'s traversal guard has one test case and disagrees with the Rust guard |
+| 51 | `GAP-089` | **16** (L4×I4) | The shipped SDK has no lifetime story: unsubscribes untested, no `close()`, and a killed session hangs every pending promise |
+| 52 | `GAP-090` | **16** (L4×I4) | The reference plugin's `esc`/`render` are structurally untestable, and `esc` guards `innerHTML` |
+| 53 | `GAP-116` | **16** (L4×I4) | `FakeRunner` cannot fail, so the Docker error arms are unreachable from CI |
+| 54 | `GAP-117` | **16** (L4×I4) | `trial_merge`'s Conflict half and cleanup are testable with git alone and are tested nowhere |
+| 55 | `GAP-118` | **16** (L4×I4) | `local_docker`'s pure validators and exit-code mappings are untested, and two write paths swallow failure |
+| 56 | `GAP-001` | **15** (L3×I5) | Smoke 1.1: switcher shows all four destinations (manual) |
+| 57 | `GAP-005` | **15** (L3×I5) | Smoke 1.5: AUDIENCE app-plugin activation stays responsive (manual) — PARKED, covered separately |
+| 58 | `GAP-009` | **15** (L3×I5) | Smoke 1.9a: Gate 5 container teardown on quit (manual) — PARKED, covered separately |
+| 59 | `GAP-020` | **15** (L3×I5) | A `Ship` delivered to a `Halted` unit destroys it |
+| 60 | `GAP-025` | **15** (L3×I5) | The red-checks feedback loop has no test and no iteration ceiling |
+| 61 | `GAP-026` | **15** (L3×I5) | The wall-clock cap's driver-side use is dead code in the entire suite |
+| 62 | `GAP-027` | **15** (L3×I5) | `fail_closed` bypasses the state machine and is never executed |
+| 63 | `GAP-028` | **15** (L3×I5) | `ClaudePlanner::plan` spawns a real `claude` process with no timeout and no test |
+| 64 | `GAP-029` | **15** (L3×I5) | The USD-cap check is copy-pasted at five call sites, three of them unexercised |
+| 65 | `GAP-030` | **15** (L3×I5) | `steps::build` and `steps::review` are untested, and `review`'s prompt is half a contract |
+| 66 | `GAP-032` | **15** (L3×I5) | `retry.rs:env_secs` and its three wrappers are untested |
+| 67 | `GAP-060` | **15** (L3×I5) | `fleetd://status` is emitted to nobody |
+| 68 | `GAP-061` | **15** (L3×I5) | The `ccplugin://` response headers are three load-bearing security invariants with no assertion |
+| 69 | `GAP-070` | **15** (L3×I5) | `run_halyard` shells out with no timeout from a synchronous Tauri command |
+| 70 | `GAP-071` | **15** (L3×I5) | The Audience HTTP commands have no client timeout and an unasserted error-policy asymmetry |
+| 71 | `GAP-073` | **15** (L3×I5) | `App.svelte`'s app-plugin compositing effect never exercises the overlay park/restore pair |
+| 72 | `GAP-074` | **15** (L3×I5) | The ResizeObserver rect-glue effect is asserted nowhere, teardown included |
+| 73 | `GAP-075` | **15** (L3×I5) | No test in the repo ever mounts a view-plugin iframe from `App.svelte` |
+| 74 | `GAP-076` | **15** (L3×I5) | `onKill` — the plugin-misbehaviour escape hatch — has no App-level test |
+| 75 | `GAP-077` | **15** (L3×I5) | `selectApp` has no in-flight guard, so a double-click starts two docker builds |
+| 76 | `GAP-079` | **15** (L3×I5) | `FleetStore.dispose` leaves the store un-restartable |
+| 77 | `GAP-080` | **15** (L3×I5) | `fleet.ts:fold` matches Rust-side reason strings by exact equality, with no test on either side |
+| 78 | `GAP-082` | **15** (L3×I5) | Phase-eligibility policy for the action buttons lives in three places with no assertion on any |
+| 79 | `GAP-110` | **15** (L3×I5) | `npm test` — 135 tests over the whole cockpit UI — is not in CI |
+| 80 | `GAP-112` | **15** (L3×I5) | Three whole test suites outside the Rust workspace are invoked by no gate |
+| 81 | `GAP-114` | **15** (L3×I5) | `release.yml` signs and publishes without running a single test |
+| 82 | `GAP-115` | **15** (L3×I5) | The Docker integration tests run nowhere, on any schedule |
+| 83 | `GAP-121` | **15** (L3×I5) | The load-bearing sidecar-before-bundle order is written four times and CI does not reuse it |
+| 84 | `GAP-093` | **15** (L5×I3) | The dashboard's local scan root is a hardcoded developer drive letter |
+| 85 | `GAP-041` | **12** (L3×I4) | `Store::open` is the only constructor any real process uses and no test calls it |
+| 86 | `GAP-042` | **12** (L3×I4) | `Store::init`'s migration ALTERs swallow every error, so a failed upgrade reads as an empty fleet |
+| 87 | `GAP-046` | **12** (L3×I4) | `docker_ok` has no timeout and no single-flight guard, and `create_swarm` awaits it in-handler |
+| 88 | `GAP-051` | **12** (L3×I4) | The `/units`, `/health` and `/units/:id` JSON shapes are a hand-mirrored contract nothing gates |
+| 89 | `GAP-052` | **12** (L3×I4) | `create_mission` and `create_swarm`'s real-mode money guards are unexecuted |
+| 90 | `GAP-054` | **12** (L3×I4) | `spawn_forwarder` discards store write errors, then broadcasts the event as if durable |
+| 91 | `GAP-083` | **12** (L3×I4) | Capabilities are negotiated, thrown away, and never enforced |
+| 92 | `GAP-084` | **12** (L3×I4) | The bridge's rate/flood buckets are never driven end to end |
+| 93 | `GAP-085` | **12** (L3×I4) | The shipped `autoTick: true` default path executes in zero tests |
+| 94 | `GAP-086` | **12** (L3×I4) | Hostile-input handling on the port is exercised only through pure-function tests |
+| 95 | `GAP-091` | **12** (L3×I4) | The host duplicates the reference manifest inline, so the loader's tested code paths are unreachable in the app |
+| 96 | `GAP-120` | **12** (L3×I4) | The fake and the real runner disagree on what a valid `UnitSpec` is |
+| 97 | `GAP-039` | **12** (L4×I3) | `Provisioning` is excluded from `is_agent_active`, so nothing bounds a hung provision |
+| 98 | `GAP-097` | **12** (L4×I3) | Both dashboard adapters map an unrecognised upstream state to a confident "Idle" |
+| 99 | `GAP-101` | **12** (L4×I3) | `model.ts:isOffPipeline` is exported, unreferenced, untested — and `sortedCards` re-derives it inline |
+| 100 | `GAP-124` | **12** (L4×I3) | `demo-restart-recovery.mjs` is the only end-to-end durability check and nothing runs it |
+| 101 | `GAP-125` | **12** (L4×I3) | `index.html` loads Google Fonts against a CSP that has no `font-src` and no such origin |
+| 102 | `GAP-031` | **10** (L2×I5) | `reconcile` and `reconcile_live` re-derive the same decision independently |
+| 103 | `GAP-072` | **10** (L2×I5) | `local_projects`' exclusion list and depth bound are the only brakes on a whole-disk walk, and neither is tested |
+| 104 | `GAP-040` | **9** (L3×I3) | `Phase::is_interruptible` is exported, uncalled, untested, and duplicated inline |
+| 105 | `GAP-094` | **9** (L3×I3) | `Dashboard.svelte`'s entire live-wiring path is unexecuted while looking well tested |
+| 106 | `GAP-095` | **9** (L3×I3) | Every dashboard adapter's degradation contract is unenforced at its edges |
+| 107 | `GAP-096` | **9** (L3×I3) | App-scoped Halyard proposals are written into the map under a key nothing reads |
+| 108 | `GAP-098` | **9** (L3×I3) | `dashboard/api.ts` has no test file and is the only place the four IPC command names appear |
+| 109 | `GAP-099` | **9** (L3×I3) | The dashboard's user-facing affordances — deep links, chips, footers, empty state — are asserted nowhere |
+| 110 | `GAP-100` | **9** (L3×I3) | App-plugin cards can never reach the dashboard board because the prop is never passed |
+| 111 | `GAP-102` | **9** (L3×I3) | The dashboard's "source unreachable" card is hand-copied three times with divergent fields |
+| 112 | `GAP-003` | **8** (L2×I4) | Smoke 1.3: REFERENCE view-plugin renders, handshakes, and cannot reach the network (manual) |
+| 113 | `GAP-004` | **8** (L2×I4) | Smoke 1.4: command policy round-trip and command-ack rejection (manual) |
+| 114 | `GAP-103` | **8** (L4×I2) | The session-state SessionEnd hook has never been observed firing |
+| 115 | `GAP-104` | **8** (L4×I2) | The Stop hook spawns eight sequential git subprocesses against a 5-second budget |
+| 116 | `GAP-106` | **8** (L4×I2) | `withLock` steals a lock from a demonstrably live holder, and `sleep` busy-spins |
+| 117 | `GAP-126` | **8** (L4×I2) | The PowerShell hooks Claude Code actually executes are tested by nothing, in any repo language |
+| 118 | `GAP-127` | **8** (L4×I2) | `deploy_globals.py` mutates the user's real `settings.json` and `CLAUDE.md` with no tests at all |
+| 119 | `GAP-128` | **8** (L4×I2) | `context-offload` has no test infrastructure, and its update path corrupts on any Windows path |
+| 120 | `GAP-129` | **8** (L4×I2) | cache-countdown's headline feature is inert, and its self-test cannot fail |
+| 121 | `GAP-131` | **8** (L4×I2) | Both `install.ps1` scripts are the same 85 lines twice, with an untested `Copy-Item` nesting hazard |
+| 122 | `GAP-034` | **6** (L2×I3) | `gate_met`'s anti-oscillation conjunct is unreachable dead logic |
+| 123 | `GAP-035` | **6** (L2×I3) | `Event`'s wire shape is the cockpit's contract and seven of ten variants are unasserted |
+| 124 | `GAP-036` | **6** (L2×I3) | The snake_case phase vocabulary is hand-duplicated across Rust, SQL and TypeScript |
+| 125 | `GAP-037` | **6** (L2×I3) | `Command::to_trigger` has no production caller while the driver re-implements it twice |
+| 126 | `GAP-038` | **6** (L2×I3) | `OracleTampering`'s transition arm is the trust gate and has no direct test |
+| 127 | `GAP-105` | **6** (L3×I2) | `capture_end` drops a timeline record and deletes the only backup in the same breath |
+| 128 | `GAP-107` | **6** (L3×I2) | Two `repoRoot` spawns per hook, and a torn `git status` renders as a real branch called `null` |
+| 129 | `GAP-108` | **6** (L3×I2) | The session-state hook contract is validated only for file existence |
+| 130 | `GAP-109` | **6** (L3×I2) | `capture_rich`'s four failure arms are the plugin's only user-visible errors and none is tested |
+| 131 | `GAP-130` | **6** (L3×I2) | Both Python tools' console-script entry points are the untested side of the process boundary |
+
+### 4.2 By status
+
+| status | count | ids |
+|---|---:|---|
+| `open` | 132 | all entries |
+
+_As of the **2026-08-16 reconciliation** (§1), four ranked rows are verified-but-not-yet-retired —
+`GAP-006`, `GAP-008`, `GAP-010`, `GAP-012` — and are struck through in §4.1. Their `status` fields
+are deliberately left `open` because status is human-owned and retirement belongs to a real scan,
+not a hand edit. The next `testing-plan` run should retire all four with the run-2/run-3 evidence._
+
+_Three entries are parked as **covered separately** pending the concurrent app-plugin-runtime
+test work and are excluded from the call to action even though they appear in the ranking above:
+`GAP-005`, `GAP-009`, `GAP-010` (see §2 and R5)._
+
+## 5. Entries
+
+One flat list, `GAP-###` ascending, append-only. **Status is a field, not a section.** Ordering and
+grouping live in the Index (§4), never here.
+
+### GAP-001 — Smoke 1.1: switcher shows all four destinations (manual)
+
+| field | value |
+|---|---|
+| **status** | `open` <!-- human --> |
+| **claim_type** | `manual-unverified` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `spikes/SPIKE-RESULTS.md#smoke-run-1--2026-08-10`, `1.1` |
+| **governs** | `cockpit/ui/src/App.svelte`, `cockpit/ui/src/lib/Switcher.svelte` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L3 × I5 = **15** |
+| **observations** | manual_coverage_pts=3, churn_90d=8 (churn_pts=4), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-10 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The row asks a human to eyeball that FLEET + PROJECTS + REFERENCE + AUDIENCE all
+appear. `Switcher.test.ts` tests the presentational component against hand-written props; App's
+*composition* of host views + discovered view-plugins + `plugins_list` app-plugins into that prop is
+asserted nowhere, and neither is `activeSwitcherId`'s nested-ternary precedence. Scored 3 rather than
+5 because the leaf component is genuinely covered.
+
+**Concrete test.** **Automatable.** A jsdom render of `App` asserting the four
+`data-testid` tabs in order with their labels, plus the aria-pressed precedence, replaces everything
+this row asks a human to look at except "the segmented control looks right".
+
+### GAP-002 — Smoke 1.2: Fleet ops-grid regression canary (manual)
+
+| field | value |
+|---|---|
+| **status** | `open` <!-- human --> |
+| **claim_type** | `manual-unverified` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `spikes/SPIKE-RESULTS.md#smoke-run-1--2026-08-10`, `1.2` |
+| **governs** | `cockpit/ui/src/App.svelte`, `cockpit/ui/src/lib/fleet.ts`, `cockpit/ui/src/lib/store.svelte.ts` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L4 × I5 = **20** |
+| **observations** | manual_coverage_pts=4, churn_90d=8 (churn_pts=4), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-10 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** This is the "did bolting the plugin runtime on break the thing the product is
+for" canary, and it is the largest unasserted surface in the UI: not one test in `src/` renders or
+inspects the ops grid. `App.overlay.test.ts` seeds a unit only to pop a modal and asserts nothing
+about tiles; the grid markup carries no `data-testid` at all.
+
+**Concrete test.** **Automatable.** Seed three units with distinct phases, assert one
+tile each plus the ACTIVE/UNITS/BURN stat values, then switch away and back and assert the same tiles
+return with selection intact — which also covers the automatable core of row 1.8.
+
+### GAP-003 — Smoke 1.3: REFERENCE view-plugin renders, handshakes, and cannot reach the network (manual)
+
+| field | value |
+|---|---|
+| **status** | `open` <!-- human --> |
+| **claim_type** | `manual-unverified` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `spikes/SPIKE-RESULTS.md#smoke-run-1--2026-08-10`, `1.3` |
+| **governs** | `cockpit/ui/src/lib/bridge.ts`, `cockpit/ui/src/lib/loader.ts`, `cockpit/plugin-sdk/**`, `plugins/reference/**`, `cockpit/ui/src-tauri/src/view_plugins.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L2 × I4 = **8** |
+| **observations** | manual_coverage_pts=2, churn_90d=1 (churn_pts=2), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-10 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Scores low *because it is the best-defended manual row*: `bridge.test.ts` drives
+the `plugin-hello`→`ready`→full-snapshot handshake 100× over a real `MessageChannel` with zero drops.
+What stays genuinely human is the part jsdom cannot model — that a `sandbox="allow-scripts"` iframe
+yields an opaque origin, that `connect-src 'none'` really blocks network, and that the CORS/module
+fetch of `sdk.js` succeeds under the real `ccplugin://` handler.
+
+**Concrete test.** **Partially automatable — see `GAP-075` and `GAP-086`.** The iframe-mount,
+`sandbox` attribute, bridge construction and destroy-on-switch are jsdom-assertable; the opaque-origin
+and CSP halves are not and must stay in this row.
+
+### GAP-004 — Smoke 1.4: command policy round-trip and command-ack rejection (manual)
+
+| field | value |
+|---|---|
+| **status** | `open` <!-- human --> |
+| **claim_type** | `manual-unverified` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `spikes/SPIKE-RESULTS.md#smoke-run-1--2026-08-10`, `1.4` |
+| **governs** | `cockpit/ui/src/lib/bridge.ts`, `cockpit/plugin-sdk/index.js` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L2 × I4 = **8** |
+| **observations** | manual_coverage_pts=2, churn_90d=1 (churn_pts=2), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-10 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `policeCommand` has eight direct tests, so the happy round-trip and the
+`real-requires-confirm` rejection are already pinned. The residual holes are the ones no human step
+would find either: the rate/flood buckets are never driven end to end, the `sink-error` ack arms are
+dead in the suite, and a version-skewed message is dropped silently with no ack.
+
+**Concrete test.** **Fully automatable — see `GAP-084`, `GAP-086`, `GAP-087`, `GAP-089`.** Everything
+this row checks happens over a `MessageChannel`, which jsdom provides natively. This row can be
+retired from the human gate once those land.
+
+### GAP-005 — Smoke 1.5: AUDIENCE app-plugin activation stays responsive (manual) — PARKED, covered separately
+
+| field | value |
+|---|---|
+| **status** | `open` <!-- human --> |
+| **claim_type** | `manual-unverified` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `spikes/SPIKE-RESULTS.md#smoke-run-1--2026-08-10`, `1.5` |
+| **governs** | `cockpit/ui/src-tauri/src/plugins/**`, `cockpit/ui/src/App.svelte` |
+| **last_manual_pass** | — (FAIL 2026-08-10 @ `725b630`; fixed in `db74a47`, never re-run) |
+| **risk** | L3 × I5 = **15** |
+| **observations** | manual_coverage_pts=2, churn_90d=8 (churn_pts=4), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-10 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **ratification_pending** | `accepted` — in progress, covered separately (see §2 carve-out and R5) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The row that earned the whole smoke its keep: clicking AUDIENCE froze the UI
+because `plugin_launch` was a synchronous `#[tauri::command]` running `docker compose build` on the
+main event-loop thread. Root-caused and fixed in `db74a47`, pinned by two tests in
+`src/App.appPlugin.test.ts` — but **verified only by automated gates, never in a watched window**.
+Excluded from this plan's call to action: another agent is writing targeted tests for exactly this
+defect concurrently.
+
+**Concrete test.** Owned elsewhere. The residual human step after that work is narrow: watch the chip
+walk `starting → health-probing → healthy` with the window responsive throughout.
+
+### GAP-006 — Smoke 1.6: native webview stays glued to its rect on resize (manual)
+
+| field | value |
+|---|---|
+| **status** | `open` <!-- human --> |
+| **claim_type** | `manual-unverified` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `spikes/SPIKE-RESULTS.md#smoke-run-1--2026-08-10`, `1.6` |
+| **governs** | `cockpit/ui/src/App.svelte`, `cockpit/ui/src-tauri/src/embedding.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I5 = **25** |
+| **observations** | manual_coverage_pts=5, churn_90d=8 (churn_pts=4), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-10 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Nothing in the suite asserts one byte of the rect-glue effect —
+`App.appPlugin.test.ts` explicitly stubs `ResizeObserver` to a no-op and its own comment defers this
+to "smoke checklist 1.6". `embedding.rs` has zero tests. So the highest-churn interactive surface in
+the app is defended by a checklist row that has never been run.
+
+**Concrete test.** **Two thirds automatable — see `GAP-074`.** That an observer is attached to the
+reserved rect, that the callback marshals a well-formed four-key rect through `toRect`, and that the
+observer is disconnected on switch-away are all jsdom-assertable. Only the geometric truth needs a
+real window — and see `GAP-014` for the DPI/multi-monitor case this row does *not* cover.
+
+### GAP-007 — Smoke 1.7: native webview parks off-screen while a host overlay is open (manual)
+
+| field | value |
+|---|---|
+| **status** | `open` <!-- human --> |
+| **claim_type** | `manual-unverified` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `spikes/SPIKE-RESULTS.md#smoke-run-1--2026-08-10`, `1.7` |
+| **governs** | `cockpit/ui/src/App.svelte`, `cockpit/ui/src-tauri/src/embedding.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L4 × I5 = **20** |
+| **observations** | manual_coverage_pts=4, churn_90d=8 (churn_pts=4), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-10 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `z-index` and `inert` cannot cross the native-webview boundary, so parking is the
+*only* mechanism keeping an app-plugin from painting over a REAL-launch confirm dialog. The two
+existing app-plugin tests cover only the healthy/not-healthy compositing gate; neither ever opens an
+overlay, so the entire park/restore branch pair is dead in the suite.
+
+**Concrete test.** **Signal half automatable — see `GAP-073`.** Assert `plugin_hide` fires exactly
+once on overlay open and `plugin_show` on close, with no re-issue on an unrelated state write. The
+residual human step shrinks to confirming the pixels once. See also `GAP-013`, an input-block case
+over a *view*-plugin that this row does not cover at all.
+
+### GAP-008 — Smoke 1.8: no leak or orphaned webview when switching away and back (manual)
+
+| field | value |
+|---|---|
+| **status** | `open` <!-- human --> |
+| **claim_type** | `manual-unverified` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `spikes/SPIKE-RESULTS.md#smoke-run-1--2026-08-10`, `1.8` |
+| **governs** | `cockpit/ui/src/App.svelte`, `cockpit/ui/src/lib/bridge.ts`, `cockpit/ui/src-tauri/src/embedding.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I5 = **25** |
+| **observations** | manual_coverage_pts=5, churn_90d=8 (churn_pts=4), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-10 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** A leak is the one defect class a human watching a window *cannot* see. Every test
+calls `bridge.destroy()`/`session.destroy()` as cleanup and none asserts anything about it; the
+window `message` listener, the `setInterval` tick, the transferred port, the `ResizeObserver`, and
+the `WebviewPool` LRU entry are all released only by teardown paths nothing checks.
+
+**Concrete test.** **Largely automatable — see `GAP-074`, `GAP-075`, `GAP-064`, `GAP-085`.** Construct
+and destroy fifty times and assert the live window-listener count, timer count, and LRU length are
+unchanged. Only "Task Manager shows no orphaned webview process" stays human.
+
+### GAP-009 — Smoke 1.9a: Gate 5 container teardown on quit (manual) — PARKED, covered separately
+
+| field | value |
+|---|---|
+| **status** | `open` <!-- human --> |
+| **claim_type** | `manual-unverified` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `spikes/SPIKE-RESULTS.md#smoke-run-1--2026-08-10`, `1.9a` |
+| **governs** | `cockpit/ui/src-tauri/src/plugins/manager.rs`, `crates/fleetd/src/local_docker.rs` |
+| **last_manual_pass** | 2026-08-10 @ `725b630` (PASS — `docker ps` empty against a verified 0-container baseline) |
+| **risk** | L3 × I5 = **15** |
+| **observations** | manual_coverage_pts=2, churn_90d=9 (churn_pts=4), never_verified=false |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-10 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **ratification_pending** | `accepted` — in progress, covered separately (see §2 carve-out and R5) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The only manual row in the register carrying a real PASS. Excluded from this
+plan's call to action — `stop_all_owned` / container teardown is being covered by targeted tests
+concurrently. Recorded here so the ranking is honest about what is and is not already defended.
+
+**Concrete test.** Owned elsewhere. One gap this row does *not* close, filed separately as `GAP-119`:
+it checks `docker ps` only, never `docker volume ls`, and volumes are deliberately kept on teardown.
+
+### GAP-010 — Smoke 1.9b: the app process survives window close (manual) — PARKED, undiagnosed
+
+| field | value |
+|---|---|
+| **status** | `open` <!-- human --> |
+| **claim_type** | `manual-unverified` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `spikes/SPIKE-RESULTS.md#smoke-run-1--2026-08-10`, `1.9b` |
+| **governs** | `cockpit/ui/src-tauri/src/lib.rs`, `cockpit/ui/src-tauri/src/sidecar.rs` |
+| **last_manual_pass** | — (ANOMALY 2026-08-10 @ `725b630`) |
+| **risk** | L5 × I5 = **25** |
+| **observations** | manual_coverage_pts=5, churn_90d=10 (churn_pts=4), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-10 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **ratification_pending** | `accepted` — adjacent to the carve-out (see §2 and R5) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Teardown demonstrably ran — the containers came down — but the `app` process
+survived the window close (pid 13396, no window, 23 threads, still responding 15 s later, 41 MB).
+Undiagnosed: dev-only artifact of `tauri dev` supervision, or a real shutdown defect. `lib.rs` has
+zero tests and its `ExitRequested` handler's ordering (reap the sidecar *before* `stop_all_owned`, so
+the supervisor cannot respawn it mid-teardown) is enforced by nothing but statement order.
+
+**Concrete test.** **The ordering half is automatable — see `GAP-069`.** A source-structure guard
+asserting `SidecarSupervisor::shutdown` precedes `stop_all_owned`, which precedes `app_handle.exit(0)`.
+Whether the process actually exits stays human until someone diagnoses the anomaly.
+
+### GAP-011 — Smoke 1.10: Vite HMR still works under the host CSP (manual)
+
+| field | value |
+|---|---|
+| **status** | `open` <!-- human --> |
+| **claim_type** | `manual-unverified` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `spikes/SPIKE-RESULTS.md#smoke-run-1--2026-08-10`, `1.10` |
+| **governs** | `cockpit/ui/src-tauri/tauri.conf.json`, `cockpit/ui/vite.config.ts` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L4 × I5 = **20** |
+| **observations** | manual_coverage_pts=5, churn_90d=3 (churn_pts=3), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-10 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Nothing in the repo reads `tauri.conf.json`'s CSP and checks it against what the
+app actually loads — not the 19-file vitest suite, not either workflow. Two concrete drifts are
+already visible and unguarded (`GAP-066` frame-src origin form, `GAP-125` index.html loading Google
+Fonts against a `style-src 'self'` policy). HMR is only the most visible symptom of that class.
+
+**Concrete test.** **The static half is automatable — see `GAP-066`.** Parse `tauri.conf.json` and
+assert every origin any code path can request is admitted by the directive that governs it. Whether
+the WebView2 HMR socket actually connects stays human.
+
+### GAP-012 — Smoke Part 2: the packaged build has never been launched (manual)
+
+| field | value |
+|---|---|
+| **status** | `open` <!-- human --> |
+| **claim_type** | `manual-unverified` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `spikes/SPIKE-RESULTS.md#remaining-human-gate--interactive-dev--packaged-smoke-not-run-headlessly`, `Part 2` |
+| **governs** | `cockpit/ui/src-tauri/tauri.conf.json`, `.github/workflows/ci.yml`, `.github/workflows/release.yml`, `cockpit/ui/scripts/build-sidecar.mjs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L4 × I5 = **20** |
+| **observations** | manual_coverage_pts=5, churn_90d=4 (churn_pts=3), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-07-17 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** CI produces `.msi`/`.exe`/`.dmg`/`.app`/`.deb`/`.AppImage` on three OSes with
+`if-no-files-found: warn` — so a bundle producing zero files does not even fail the job — and never
+launches one. `release.yml` signs and publishes without launching one either. **No packaged build of
+this app has ever been confirmed to start.** Every packaged-only concern is unexercised by every
+automated gate: the `ccplugin://` scheme without a dev server, `externalBin` resolution, the updater.
+
+**Concrete test.** **Partially automatable — see `GAP-121`.** A CI step that unpacks the produced
+bundle and asserts `binaries/fleetd-serve*` is inside it and answers `--version` would catch the
+build-order class cheaply. Launching the GUI stays human, but it should become a per-release row that
+must be PASS before a draft release is published.
+
+### GAP-013 — Overlay input-block over a LIVE view-plugin iframe is unverified (new manual row)
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `cockpit/ui/src/App.svelte:overlayOpen` |
+| **governs** | `cockpit/ui/src/App.svelte`, `cockpit/ui/src/lib/ApprovalOverlay.svelte` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I5 = **25** |
+| **observations** | manual_coverage_pts=5, churn_90d=8 (churn_pts=4), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `App.svelte`'s own comment asserts that `inert` on the content subtree is
+"honored by WebView2/Chromium" and is "the real input block, not the backdrop" — a claim about a
+native runtime that nobody has verified. jsdom implements no `inert` semantics at all: it reports the
+property as `true` while delivering every event, so `App.overlay.test.ts`'s assertion is a spelling
+check on an attribute, not evidence of a block. No existing row covers it — 1.7 is about parking a
+*native* webview, an entirely different mechanism.
+
+**Concrete test.** Not automatable in this harness. With REFERENCE live and focused, stage a REAL
+launch and confirm keystrokes and clicks no longer reach the iframe, Tab cannot move focus into it,
+the plugin cannot `.focus()` its way back, and Enter/Escape still hit the modal. Repeat packaged.
+
+### GAP-014 — Rect glue under DPI, monitor, and window-move changes (new manual row)
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `cockpit/ui/src/App.svelte:$effect#rect-glue-resizeobserver` |
+| **governs** | `cockpit/ui/src/App.svelte`, `cockpit/ui/src-tauri/src/embedding.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I5 = **25** |
+| **observations** | manual_coverage_pts=5, churn_90d=8 (churn_pts=4), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The glue is driven solely by a `ResizeObserver` on the reserved div, which fires
+on element *size* changes. A window **move** produces no size change, and `plugin_show`/
+`plugin_set_rect` take `LogicalPosition` — so a scale-factor change is the most likely break. Row 1.6
+says only "resize the window" on a single display; mixed-DPI multi-monitor is the ordinary case on
+the target machine and the failure is a plugin rendered halfway off the window with no error.
+
+**Concrete test.** Not automatable — jsdom has no layout engine and `getBoundingClientRect` returns
+zeros. Drag the window between monitors with different scale factors, change display scaling while
+running, move without resizing, minimise/restore, maximise/unmaximise; after each confirm the child
+webview is still exactly over the reserved rect.
+
+### GAP-015 — Cockpit behaviour after fleetd restarts or the socket drops (new manual row)
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `cockpit/ui/src/lib/store.svelte.ts:start`, `crates/fleetd/src/server.rs:stream_to_socket` |
+| **governs** | `cockpit/ui/src/lib/api.ts`, `cockpit/ui/src/lib/store.svelte.ts`, `crates/fleetd/src/server.rs`, `cockpit/ui/src-tauri/src/sidecar.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I5 = **25** |
+| **observations** | manual_coverage_pts=5, churn_90d=26 (churn_pts=5), never_verified=true |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Nothing — automated or manual — observes what the cockpit does after the daemon
+goes away, and the sidecar supervisor restarts fleetd on every crash, so this is a normal path, not an
+exotic one. `openStream` wires no `onclose`/`onerror`, `start()` latches `started = true`, and daemon
+health is fetched only inside that single `reconnect()`. The result is a cockpit that looks completely
+healthy and is completely dead: frozen phases, a **green** DOCKER badge from minutes ago, launch
+buttons that 404. The stale-green header is the dangerous part — an affirmative false signal, not
+merely a missing one. All twelve existing rows assume a live daemon for the whole run.
+
+**Concrete test.** Launch a DEMO unit, confirm tiles are streaming, then kill and restart the fleetd
+sidecar. Record whether tiles keep updating, whether the header badge goes stale-but-green, whether
+there is any user-visible indication, and whether anything recovers without an app restart. The
+jsdom-testable half is filed as `GAP-078`.
+
+### GAP-016 — Starting a real mission with Docker stopped or the agent image absent (new manual row)
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `crates/fleetd/src/local_docker.rs:provision`, `crates/fleetd/src/server.rs:docker_ok` |
+| **governs** | `crates/fleetd/src/local_docker.rs`, `crates/fleetd/src/server.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I4 = **20** |
+| **observations** | manual_coverage_pts=5, churn_90d=26 (churn_pts=5), never_verified=true |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The most common first-run user error has never been performed by anyone. Both
+`#[ignore]`d Docker ITs assume a healthy daemon *and* a prebuilt `cc-agent:dev` image, CI has no
+daemon at all, and no smoke row starts a mission. Worse, `docker_ok` has no timeout and no
+single-flight guard, so a wedged Docker Desktop makes every `/health` poll spawn its own `docker
+version` — a subprocess pileup under exactly the condition the probe exists to detect — while
+`create_swarm` awaits it *inside* the request handler.
+
+**Concrete test.** With Docker stopped, and separately with the image absent, dispatch a real mission
+from the cockpit and record what the operator sees and how long it takes. Much of this is
+reclassifiable to CI — see `GAP-116`, `GAP-046` and `GAP-118`.
+
+### GAP-017 — `agent_exec` awaits the agent with no timeout and no cancellation
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `crates/fleetd/src/driver.rs:Run::agent_exec`, `crates/fleetd/src/steps.rs:check` |
+| **governs** | `crates/fleetd/src/driver.rs`, `crates/fleetd/src/steps.rs`, `crates/fleetd/src/local_docker.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I5 = **25** |
+| **observations** | manual_coverage_pts=5, churn_90d=19 (churn_pts=5), never_verified=true |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `agent_exec` awaits `runner.exec(...)` with no timeout; `local_docker.rs:exec` is a
+bare `docker exec` with no bound either. The only wall-clock guard runs at the **top of the `drive`
+loop**, i.e. between phases, so it can never interrupt an exec already in flight. `steps::check` — the
+project's own test command — gets no in-container `timeout` prefix at all. A hung agent or a test
+suite that never returns pins the driver task forever while holding an `OwnedSemaphorePermit`,
+silently consuming a fleet concurrency slot. `Runner::health` exists and would notice, but nothing
+calls it (`GAP-018`). No checklist row covers a stalled exec.
+
+**Concrete test.** `crates/fleetd/tests/exec_watchdog_it.rs`, fakes only so it runs in CI: a
+`HangingRunner` whose `exec` sleeps 86 400 s, driven under `#[tokio::test(start_paused = true)]` with
+`wall_clock_secs: 60`; assert `Blocked{cap: Some("wall_clock")}`, `NeedsHuman`, and that the semaphore
+returns to full `available_permits()`.
+
+### GAP-018 — `Runner::health` is implemented twice and called from nowhere, so `Trigger::Stall` is unreachable
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/runner.rs:Runner::health`, `crates/fleetd/src/local_docker.rs:health`, `crates/fleetd/src/fake.rs:health` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5 (no test and no caller), branches=0 (branch_pts=1), churn_90d=9 (churn_pts=4) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** An exhaustive workspace search for `.health(` returns one
+hit and it is unrelated TypeScript. `Liveness::Stalled` is constructed only inside
+`LocalDockerRunner::health` and consumed nowhere; `Trigger::Stall` appears only at its declaration, in
+the universal-interrupt match pattern, and in one `fleet-core` unit test — the daemon never constructs
+it. So container liveness detection is **built but not wired**: a container that dies, OOMs, or is
+`docker kill`ed mid-run is never noticed, and the `Stall → NeedsHuman` path is dead. The dead wiring
+is itself the defect; the missing test is secondary.
+
+**Concrete test.** Add `FakeRunner::stalled()` (the `health` field exists but has no builder, so
+`Liveness::Stalled` is currently unconstructible from the fake), then a `driver.rs` test asserting a
+unit whose container reports `Stalled` is routed off the agent-active phases. It will fail to observe
+anything today, which is the point.
+
+### GAP-019 — Resumed T2/T3: rejecting the oracle is a silent no-op
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/driver.rs:Run::drive#awaiting-oracle-reject-on-resume`, `crates/fleetd/src/driver.rs:Run::drive#spec-oracle-frozen-guard` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=4, branches=5 (branch_pts=2), churn_90d=19 (churn_pts=5) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** `Phase::Spec` is guarded by `if self.resume &&
+self.spec.oracle_frozen { goto(OracleFrozen); continue; }`, and neither flag is ever cleared — `resume`
+appears once outside construction, and `oracle_frozen` is only ever latched *on* (the store even has a
+test asserting `None` must not un-freeze it). `server.rs:rehydrate` sets `resume: true` for every
+restart-recovered unit. So a human clicking REJECT on a resumed T2/T3 unit drives
+`Spec → OracleFrozen → AwaitingOracleApproval` with no oracle re-run and is asked the identical
+question forever. A human-in-the-loop gate that silently does nothing, catchable only by a person
+clicking the button, and no checklist row covers it.
+
+**Concrete test.** In `driver.rs`'s inline `mod tests`, a `RunCtx{resume: true}` T2 unit with
+`oracle_frozen: true`: send `RejectOracle` and assert a **second** oracle exec runs and a second
+`OracleProposed` with a different hash is emitted. Red today.
+
+### GAP-020 — A `Ship` delivered to a `Halted` unit destroys it
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleet-core/src/transition.rs:transition#ship-from-halted`, `crates/fleetd/src/driver.rs:Run::goto#none-arm`, `crates/fleetd/src/server.rs:post_command` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=2, branches=2 (branch_pts=1), churn_90d=26 (churn_pts=5) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed, every link.** `(NeedsHuman, Ship)` is defined;
+`(Halted, Ship)` falls to `_ => None`. `Run::goto`'s `None` arm does not ignore the trigger — it
+emits an `Event::Error` and then unconditionally sets `Phase::Failed` with reason
+`invalid transition`. The driver's `Phase::NeedsHuman | Phase::Halted` arm routes `Command::Ship` for
+**both** phases with no discrimination. And it is reachable from real input: `post_command` forwards
+any deserialized `Command` with zero phase validation (returning 202), and `bridge.ts` exposes `ship`
+to plugins with only a shape/`hasUnit` check. Only the host's own button gates on
+`phase === 'needs_human'` — precisely the guard the HTTP and plugin paths lack. A Ship that lands one
+tick after a Halt permanently `Failed`s a unit that had already produced a clean trial merge.
+
+**Concrete test.** `driver.rs` test `ship_while_halted_must_not_destroy_the_unit`: pre-queue `Halt`,
+let it park, send `Ship`, assert the unit stays `Halted` with a rejection `Event::Error` rather than
+`Failed`. Write it as the desired behaviour so it fails until `goto`'s `None` arm stops force-failing
+on human-supplied triggers.
+
+### GAP-021 — A successful T3 ship orphans the unit's named volume
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/driver.rs:Run::drive#pause-cleanup-takes-handle`, `crates/fleetd/src/driver.rs:Run::drive#done-arm-discard` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=4, branches=3 (branch_pts=2), churn_90d=19 (churn_pts=5) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** Entering `NeedsHuman`/`Halted` runs a pause cleanup that
+does `self.handle.take()`. T3 lands at `NeedsHuman` by design, so by the time a human Ships it to
+`Done` the terminal arm's `if let Some(h) = self.handle.clone()` sees `None` and **skips `discard`** —
+and `discard` is the only thing that runs `docker volume rm`. `handle_id` survives but is consumed
+only by the `Abandon` arm. No sweeper exists: `reap_unit` and reconcile only remove containers. So
+every successful T3 ship, and any Resume→…→Done that passed through a pause, permanently orphans a
+`ccvol_<unit>` volume holding a full repo clone. Gate 5 (`GAP-009`) checks `docker ps`, never
+`docker volume ls`, so no human would see it either.
+
+**Concrete test.** `driver.rs` test `t3_human_ships_from_needs_human_to_done`: drive a `Tier::T3` spec
+(no test in the crate constructs T3) to `NeedsHuman`, send `Command::Ship`, assert `Done` **and**
+`runner.discards == 1`. It is 0 today while `teardowns == 1`.
+
+### GAP-022 — `poll_mergeability` fires ten `gh` calls back to back with no delay
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/driver.rs:Run::poll_mergeability#pending-dirty-and-error-arms`, `crates/fleetd/src/gh_forge.rs:poll_mergeable` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=4, branches=4 (branch_pts=2), churn_90d=19 (churn_pts=5) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `Ok(Mergeability::Pending) => continue` loops `for _ in 0..MAX_MERGEABLE_POLLS`
+with **no sleep**, and `gh_forge` maps GitHub's `"UNKNOWN"` to `Pending`. GitHub returns UNKNOWN for
+several seconds after every fresh PR, so on a real run the happy path plausibly *always* declares
+"mergeability poll timed out" within milliseconds and routes to `NeedsHuman` — and a `gh` rate limit
+is amplified tenfold. Tellingly, `preflight_it.rs` compensates with its own 15-iteration loop and a 2 s
+sleep: the IT proves the daemon's loop is wrong and hides it at the same time, and it is `#[ignore]`d
+so CI never sees any of it. Every driver test uses `FakeForge::default()` (`Mergeable`), so the
+Pending, Dirty and Err arms are unexecuted.
+
+**Concrete test.** With `FakeForge { mergeable: Pending }` under `tokio::time::pause()`, assert exactly
+`MAX_MERGEABLE_POLLS` polls, that **virtual elapsed time is greater than zero** (i.e. a backoff
+exists), and that it ends in `Blocked` + `PrDirty`.
+
+### GAP-023 — The whole host-side git/GitHub failure surface is unexecuted because `FakeForge` cannot fail
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/fake.rs:FakeForge#no-failure-knobs`, `crates/fleetd/src/driver.rs:Run::drive#forge-and-export-failure-arms` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=4, branches=5 (branch_pts=2), churn_90d=19 (churn_pts=5) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `FakeForge` is only ever built via `::default()` (Clean + Mergeable) — grep finds
+no struct-literal construction anywhere — and its three methods return `Ok(..)` unconditionally. So
+five driver arms can never fire in an automated test: `export_bundle` Err, `MergeResult::Conflict`,
+`trial_merge` Err, `open_pr` Err, and the poll Err arm. These are the routine real-world failures — a
+base that moved, an expired `gh` token, a full temp dir, a secondary rate limit. Two contract
+mismatches are visible and unasserted: `trial_merge` Err is emitted `retryable: true` but routed to a
+non-retryable `Failed`, and "a PR already exists for this branch" (the normal outcome of any resume) is
+treated as fatal. **This is the single cheapest reclassification in the repo** — the struct's fields
+are already `pub` and already model Conflict/Dirty/Pending.
+
+**Concrete test.** Add `trial_merge_fails`/`open_pr_fails`/`poll_fails` builders plus struct-literal
+construction in driver tests, and assert each arm's scope, retryability, terminal phase, and whether
+the container was torn down versus discarded.
+
+### GAP-024 — Every command-validity decision is written out four times
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/driver.rs:Run::poll_halt`, `crates/fleetd/src/driver.rs:Run::drive#awaiting-oracle-recv`, `crates/fleetd/src/driver.rs:Run::drive#paused-recv`, `crates/fleetd/src/driver.rs:Run::agent_exec#backoff-select` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=3, branches=21 (branch_pts=5), churn_90d=19 (churn_pts=5) |
+| **anchor_sites** | 4 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Four hand-written copies of "which commands are valid here", each with its own
+reject message. Adding a `Command` variant means editing four places and nothing enforces it. The
+drift is already load-bearing: during a rate-limit backoff only `Halt` is honoured, so a user hitting
+ABANDON on a throttled unit gets "not valid" and the unit keeps waiting — up to the full
+`CC_RL_MAX_WAIT_SECS` (3600 s default) — holding its permit and its container.
+`non_halt_command_during_backoff_errors_and_keeps_retrying` actually *pins* that behaviour with
+`Resume`, and nothing flags that `Abandon` falls in the same bucket.
+
+**Concrete test.** `crates/fleetd/tests/command_dispatch_matrix_it.rs`, fakes only: a table over every
+`Command` × every waiting state, asserting each cell is either accepted-and-transitions or
+rejected-with-an-Error-and-stays-parked — never silently dropped, never a hard `Failed`.
+
+### GAP-025 — The red-checks feedback loop has no test and no iteration ceiling
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/driver.rs:Run::drive#checking-red-checks`, `crates/fleetd/src/driver.rs:Run::drive#has-diff-error` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=2 (branch_pts=1), churn_90d=19 (churn_pts=5) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `if out.exit_code != 0 { goto(ChecksFailed) }` is the entire red-test feedback
+loop and no test anywhere supplies a non-zero check exit — `demo_script` in both `server.rs` and the
+mirrored `demo_mode_it.rs` always scripts passing checks. The `Checking → Building → Checking` loop has
+no iteration ceiling of its own; its only bounds are the USD cap and the between-phase wall-clock
+check, itself untested (`GAP-026`). An agent that can never go green burns the full budget in a loop
+nothing asserts. Separately, the `has_diff` Err arm fails **open** (proceeds to `ChecksPassed`),
+opening a PR for a possibly-empty branch — a real decision no test pins.
+
+**Concrete test.** Script oracle → build → check with `exit_code: 1` → build/check/review passing;
+assert the phase sequence contains `Checking → Building`, that two `Iteration{Build}` events fired,
+and that a tiny USD cap bounds the loop at `NeedsHuman`.
+
+### GAP-026 — The wall-clock cap's driver-side use is dead code in the entire suite
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/driver.rs:Run::drive#wall-clock-backstop`, `crates/fleetd/src/driver.rs:Run::over_wall_clock` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=2 (branch_pts=1), churn_90d=19 (churn_pts=5) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Every driver test — and both `demo_mode_it.rs` scenarios, which set
+`wall_clock_secs: 1800` — finishes long before `over_wall_clock()` can return true, so the
+`is_agent_active() && over_wall_clock()` guard never executes. `retry.rs:wall_clock_exceeded` is
+tested as a pure function, but the driver's *use* of it — the `Blocked` event the cockpit renders, the
+`CapBreach` routing, and the rate-limit exemption fed by `self.rl_elapsed` — is not. This is the
+daemon's only defence against an agent that loops without tripping the per-step USD check, so a
+regression is a silent budget hole.
+
+**Concrete test.** `#[tokio::test(start_paused = true)]` with `wall_clock_secs: 5` and a `FakeRunner`
+whose exec sleeps 10 virtual seconds: assert `Blocked{cap: Some("wall_clock")}`, `NeedsHuman`, and
+permit release. Companion: a rate-limited run whose `elapsed - rl_elapsed` stays under the cap must
+**not** trip it.
+
+### GAP-027 — `fail_closed` bypasses the state machine and is never executed
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/driver.rs:Run::fail_closed` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=0 (branch_pts=1), churn_90d=19 (churn_pts=5) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The only path in the driver that sets `self.phase` directly, bypassing
+`fleet_core::transition` — so it can move a unit to `Failed` from a state the machine might not allow.
+It fires whenever the last `cmd_tx` is dropped while a unit is parked, and
+`crates/fleetd/src/bin/run_once.rs` (a ratified entry point) drops `cmd_tx` immediately. So in a live
+`run_once`, **any** cap breach, oracle-tamper detection, retries-exhausted park, merge conflict, or
+PR-dirty verdict converts instantly to a hard `Failed` where the design intends a recoverable human
+gate. No test closes the channel while a unit is parked.
+
+**Concrete test.** `closed_command_channel_at_needs_human_fails_closed`: park via a cap breach with the
+sender already dropped; assert the error + `Failed{reason: "control channel closed"}`, that the
+container was torn down but the volume kept, and that the permit is released.
+
+### GAP-028 — `ClaudePlanner::plan` spawns a real `claude` process with no timeout and no test
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/planner.rs:ClaudePlanner::plan` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=0 (branch_pts=1), churn_90d=2 (churn_pts=2) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Reached from `serve.rs → run_swarm(ClaudePlanner::new())` for any non-demo swarm,
+it awaits `Command::output()` with no timeout, no cancellation and no kill-on-drop. If the CLI hangs
+or waits on stdin the swarm sits in status `planning` forever; `reconcile_on_startup` only rescues that
+state on a *daemon restart*, so nothing recovers it while the process lives. Two further unpinned
+contracts: `--max-budget-usd 1.0` is hardcoded rather than derived from the swarm's `usd_budget`, and
+`parse_usage(..).unwrap_or(0.0)` means a format change silently bills planning at $0. Every test uses
+`FakePlanner`, so not one line executes in CI.
+
+**Concrete test.** Split out a pure `parse_plan_output(stdout, lane_cap)` and table-test it against
+captured `stream-json` fixtures (mixed narration, a `result` record, malformed JSON, no array, an
+over-cap array). Then assert `plan()` is wrapped in a bounded `tokio::time::timeout`.
+
+### GAP-029 — The USD-cap check is copy-pasted at five call sites, three of them unexercised
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/driver.rs:Run::account`, `crates/fleetd/src/driver.rs:Run::remaining` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=2, branches=6 (branch_pts=3), churn_90d=19 (churn_pts=5) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `if self.account(&out) { goto(CapBreach, "usd cap") ; continue; }` is hand-copied
+at `Spec`, `Building`, `Checking`, `Reviewing`, and inside `agent_exec`'s rate-limit arm. There is no
+choke point, so a new billable step added without the copy spends money with no ceiling and emits no
+`Metric` for the cockpit's cost chip. Enforcement is *post-hoc* (`cost_usd > usd_cap` after the spend),
+so the only pre-hoc bound is the `--max-budget-usd` value `remaining()` feeds to `claude_argv` —
+making the correctness of the copies the difference between a bounded and an unbounded overrun. Two of
+the five copies have direct assertions; the Spec, Checking and Reviewing breach sub-paths do not.
+
+**Concrete test.** A table over the four billable phases scripting a cheap run to the target phase then
+one exec that blows the cap; assert each lands at `NeedsHuman{reason: "usd cap"}` and that no further
+exec is issued. Plus `remaining_never_goes_negative_and_is_passed_to_claude`.
+
+### GAP-030 — `steps::build` and `steps::review` are untested, and `review`'s prompt is half a contract
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/steps.rs:build`, `crates/fleetd/src/steps.rs:review`, `crates/fleetd/src/driver.rs:parse_blockers` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=0 (branch_pts=1), churn_90d=4 (churn_pts=3) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `steps.rs` has three tests and they only call `oracle` and `check`. `review`
+matters disproportionately: its prompt asks the agent to emit `BLOCKERS=N`, and `parse_blockers`
+**defaults to 0 when the marker is absent**. So any drift in the prompt wording — or a model that
+stops complying — silently produces zero blockers, `gate_met` opens on the round floor, and a unit with
+unresolved must-fix findings sails into an auto-opened PR. `parse_blockers` is tested against a literal
+string, which is exactly the kind of test that cannot catch producer/consumer drift.
+
+**Concrete test.** `review_prompt_demands_the_blockers_marker`: assert the prompt contains
+`BLOCKERS=N` and round-trip it through `parse_blockers` in the same assertion, so producer and consumer
+are pinned together. Plus `build_prompt_carries_task_and_findings`.
+
+### GAP-031 — `reconcile` and `reconcile_live` re-derive the same decision independently
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/reconcile.rs:reconcile`, `crates/fleetd/src/reconcile.rs:reconcile_live` |
+| **risk** | L2 × I5 = **10** |
+| **observations** | coverage_pts=2, branches=9 (branch_pts=3), churn_90d=2 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `reconcile_live` is `reconcile` plus a `live` filter; both independently re-derive
+`HaltWithContainer` vs `HaltNoContainer` and both re-derive stray detection from a second pass. They
+run in different lifecycles (startup vs a 30 s timer) and both drive destructive `reap_unit` calls plus
+store writes that force units to `Halted`. Divergence means the timer pass could start halting healthy
+in-flight work, or stop reaping genuine orphans. Both functions are individually well tested — the only
+untested sub-path is their **agreement**, which is the whole risk of the duplication.
+
+**Concrete test.** `startup_is_steady_state_with_no_live_drivers`: assert
+`reconcile(&p, &r) == reconcile_live(&p, &[], &r)` over an exhaustive enumeration on a 3-id universe.
+
+### GAP-032 — `retry.rs:env_secs` and its three wrappers are untested
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/retry.rs:env_secs`, `crates/fleetd/src/retry.rs:rl_max_wait_secs` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=0 (branch_pts=1), churn_90d=3 (churn_pts=3) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** These govern the rate-limit retry budget, including the ~1 h envelope after which
+`agent_exec` gives up and parks. `.parse().ok().unwrap_or(default)` swallows every malformed value
+silently, so `CC_RL_MAX_WAIT_SECS=1h` yields 3600 by luck of the default and a typo'd variable name is
+equally silent. During that envelope the unit holds its container and its concurrency permit, so this
+is a real fleet-throughput knob. `Backoff::next_delay` is well tested but always with hand-passed
+literals; the env plumbing that supplies them in production has no test.
+
+**Concrete test.** One serialized test asserting the three documented defaults (2 / 300 / 3600) with the
+vars unset, that a valid value is honoured, and that a malformed value falls back to the default rather
+than to 0.
+
+### GAP-033 — Driver-plus-real-Docker resume has never been verified by machine or human
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `crates/fleetd/src/driver.rs:run#resume-contract`, `crates/fleetd/src/local_docker.rs:provision#reused-volume-resume-path` |
+| **governs** | `crates/fleetd/src/driver.rs`, `crates/fleetd/src/local_docker.rs`, `crates/fleetd/src/server.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I5 = **25** |
+| **observations** | manual_coverage_pts=5, churn_90d=19 (churn_pts=5), never_verified=true |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **No automated test anywhere runs `driver::run` against `LocalDockerRunner`** —
+`demo_mode_it.rs` is fakes-only by design, and `preflight_it.rs`/`local_docker_it.rs` are `#[ignore]`d
+and drive `Runner` methods by hand, deliberately bypassing the driver. So the crash-restart recovery
+contract (reuse the persisted volume, skip the frozen oracle, re-checkout the agent branch over a
+possibly dirty tree, re-arm the tamper gate from the reloaded hash) is only ever verified against
+`FakeRunner`, whose `provision` returns a constant handle. The riskiest half lives in
+`provision`'s `reused` branch (`rm -f .git/index.lock`, `git checkout -B`), which the fake cannot model
+at all — and `reused` is inferred from an `exec` that can fail for unrelated reasons, in which case a
+genuinely resumable volume is silently re-cloned over, losing all agent work. No checklist row covers
+daemon-restart resume.
+
+**Concrete test.** CI-runnable half: a `ResumingFakeRunner` recording the ordered `Runner` call
+sequence, asserting a `RunCtx{resume: true, start_phase: Halted}` run issues `provision` → *no oracle
+exec* → `read_files` → build/check, and never `discard`. Real half `#[ignore]`d: provision, commit,
+teardown, re-provision the same id, assert no re-clone and that a planted `.git/index.lock` is removed.
+
+### GAP-034 — `gate_met`'s anti-oscillation conjunct is unreachable dead logic
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleet-core/src/gate.rs:gate_met#non-increasing-conjunct` |
+| **risk** | L2 × I3 = **6** |
+| **observations** | coverage_pts=2, branches=3 (branch_pts=2), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** `unresolved_blockers` and `prev_unresolved_blockers` are
+both `u32`, and the verdict already requires `unresolved_blockers == 0`, so `0 <= prev` holds for every
+possible prev — `non_increasing` can never change the answer. The documented intent ("no oscillation
+in this round", restated in `transition.rs`) is unenforced: a unit that oscillates 0 → 3 → 0 across
+rounds auto-advances identically to one that converged. This is the gate that lets the driver fire
+`ReviewFinished{gate_met: true}` and push toward MergeCheck without a human. Low risk score only
+because `fleet_core` is a spine-weight-3 module; the finding is structural, not cosmetic.
+
+**Concrete test.** `non_increasing_is_subsumed_by_zero_blockers` documenting the unreachability, then a
+decision: either delete the conjunct or move the anti-oscillation check somewhere it can bind (e.g. on
+`round`-over-`round` blocker history rather than the current count).
+
+### GAP-035 — `Event`'s wire shape is the cockpit's contract and seven of ten variants are unasserted
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleet-core/src/event.rs:Event`, `cockpit/ui/src/lib/types.ts:FleetEvent` |
+| **risk** | L2 × I3 = **6** |
+| **observations** | coverage_pts=2, branches=0 (branch_pts=1), churn_90d=2 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `Event` is the outbound `/stream` contract consumed across a process boundary by a
+**hand-maintained** TypeScript mirror with nothing enforcing agreement. Only 3 of 10 variants have any
+serialization assertion. The untested ones are the ones the operator acts on: `Blocked` (drives the
+"why is this stuck" surface and the rate-limit notice), `Finding` (severity/round feed the review gate
+display), `Error`, `Done`. The `skip_serializing_if` behaviour on `Finding.file` and `Blocked.cap` —
+which `types.ts` encodes as optional properties — is asserted for zero of them, so a dropped attribute
+compiles, passes `cargo test --workspace`, and shows up as a blank cell in a running cockpit.
+
+**Concrete test.** `every_event_variant_wire_shape`: serialize one instance of each variant, assert the
+`type` tag and every field key including the `None`-omission and `Some`-presence cases, then round-trip
+each back through `from_str`.
+
+### GAP-036 — The snake_case phase vocabulary is hand-duplicated across Rust, SQL and TypeScript
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleet-core/src/phase.rs:Phase`, `crates/fleet-core/src/phase.rs:TERMINAL_PHASE_STRS`, `crates/fleetd/src/store.rs:swarm_rollup`, `cockpit/ui/src/lib/types.ts:Phase` |
+| **risk** | L2 × I3 = **6** |
+| **observations** | coverage_pts=2, branches=0 (branch_pts=1), churn_90d=14 (churn_pts=5) |
+| **anchor_sites** | 4 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Four independent copies, only the terminal subset pinned: the serde derive, the
+`TERMINAL_PHASE_STRS` const (one test), raw SQL literals in `swarm_rollup` (`phase IN
+('needs_human','halted')`) plus the interpolated queries in `committed_spend` and the server's
+admission filters, and the TS union consumed by `store.svelte.ts`, `App.svelte` (`canShip`/`canResume`/
+`PHASE_LABEL`) and `adapters/fleet.ts`. Phase is persisted as a bare `String` column, so nothing
+type-checks the SQL against the enum and nothing at all type-checks TS against Rust. Renaming or adding
+a phase silently breaks the parked-unit rollup, the spend partition, and the cockpit's attention
+highlighting — all across boundaries `cargo test --workspace` cannot see. Widest drift surface in the
+repo. See also `GAP-081` and `GAP-082` (the UI-side half).
+
+**Concrete test.** Extend `terminal_strs_match_is_terminal` into
+`phase_wire_strings_are_exhaustive_and_stable`: serialize all 14 variants and assert the set equals a
+literal list, so adding or renaming one fails CI and forces the mirrors to be updated.
+
+### GAP-037 — `Command::to_trigger` has no production caller while the driver re-implements it twice
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleet-core/src/event.rs:Command::to_trigger`, `crates/fleetd/src/driver.rs:Run::drive#awaiting-oracle-recv`, `crates/fleetd/src/driver.rs:Run::drive#paused-recv` |
+| **risk** | L2 × I3 = **6** |
+| **observations** | coverage_pts=2, branches=6 (branch_pts=3), churn_90d=19 (churn_pts=5) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Three copies of one mapping, and **only the unused copy is under test** — and only
+2 of its 6 arms at that. A new command verb ships correct in `fleet-core` and wrong in the daemon; the
+`_ => other` catch-alls in both driver arms mean a mismatch degrades to a silent "not valid"
+`Event::Error` rather than a compile failure. Overlaps `GAP-024`, which covers the four-way duplication
+of the *validity* decision; this entry is specifically the command→trigger mapping.
+
+**Concrete test.** `every_command_maps_to_its_trigger` covering all six arms, then replace the two
+inline mappings with `cmd.to_trigger()` (or assert the inline copies agree with it for every variant).
+
+### GAP-038 — `OracleTampering`'s transition arm is the trust gate and has no direct test
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleet-core/src/transition.rs:transition#oracle-tampering-arm` |
+| **risk** | L2 × I3 = **6** |
+| **observations** | coverage_pts=3, branches=2 (branch_pts=1), churn_90d=3 (churn_pts=3) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `OracleTampering if phase.is_agent_active() => NeedsHuman` is its own arm and the
+trust gate the whole T1-autonomy story rests on; the driver fires it from three sites (unreadable
+frozen files, an empty frozen set, a hash mismatch). If the guard or target ever changes, tamper
+detection degrades to `None`, which `goto` turns into a hard `Failed` rather than the intended human
+review — a silent downgrade of a security-shaped gate into a crash. Exercised only indirectly by two
+fleetd driver tests; the guard-false side is never exercised for this trigger at all.
+
+**Concrete test.** `oracle_tampering_parks_agent_phases_at_needs_human` mirroring the existing
+`retries_exhausted_*` test over `[Spec, Building, Checking, Reviewing]`, plus `MergeCheck` and
+`AwaitingOracleApproval` asserting `None`.
+
+### GAP-039 — `Provisioning` is excluded from `is_agent_active`, so nothing bounds a hung provision
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `crates/fleet-core/src/phase.rs:Phase::is_agent_active` |
+| **governs** | `crates/fleet-core/src/phase.rs`, `crates/fleetd/src/driver.rs`, `crates/fleetd/src/local_docker.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L4 × I3 = **12** |
+| **observations** | manual_coverage_pts=4, churn_90d=3 (churn_pts=3), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `is_agent_active` returns true only for Spec/Building/Checking/Reviewing, and the
+driver's only stall backstop gates on exactly that predicate. But `Provisioning` is where the long
+blocking work happens: an unbounded `acquire_owned().await` on the concurrency semaphore, then
+`local_docker.rs:provision`, which shells out to docker with no timeout. So a hung image build or a
+never-freed slot leaves a unit pinned in `Provisioning` with no cap, no stall trigger, and no escape
+hatch — the cockpit just shows PROVISIONING and a human is the only detector. Same failure shape as the
+1.5 freeze.
+
+**Concrete test.** A driver-level test with a fake `provision()` that sleeps past `wall_clock_secs`,
+asserting the unit leaves `Provisioning`; plus a `fleet-core` unit test pinning the exclusion as a
+deliberate decision rather than an accident.
+
+### GAP-040 — `Phase::is_interruptible` is exported, uncalled, untested, and duplicated inline
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleet-core/src/phase.rs:Phase::is_interruptible` |
+| **risk** | L3 × I3 = **9** |
+| **observations** | coverage_pts=4, branches=0 (branch_pts=1), churn_90d=3 (churn_pts=3) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Zero callers repo-wide and zero tests, while `transition` open-codes the identical
+condition twice as `!phase.is_terminal()` on the `FatalError` and `Halt` arms. The crate ships a named
+concept the state machine does not use, and an edit to one will not track the other. Drift/dead-API
+rather than a live defect — ranked accordingly.
+
+**Concrete test.** Either delete it, or add `interruptible_is_the_complement_of_terminal` over all 14
+variants and wire it into the two arms that currently open-code it.
+
+### GAP-041 — `Store::open` is the only constructor any real process uses and no test calls it
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/store.rs:Store::open` |
+| **risk** | L3 × I4 = **12** |
+| **observations** | coverage_pts=4, branches=0 (branch_pts=1), churn_90d=14 (churn_pts=5) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** All 13 inline store tests and every `server.rs` test call `Store::open_memory()`,
+which dies with the process and cannot exercise WAL, the `-wal`/`-shm` sidecars, or reopen.
+`Store::open` is what `bin/serve.rs` actually uses. The whole reason the schema carries set-once
+columns is resume-after-restart, and the cockpit sidecar auto-restarts fleetd on every exit — so
+restart is the normal path, not the exceptional one. A durability regression (rows not committed, the
+seq allocator re-seeding to 0 and re-minting a live unit id) would be invisible to CI and would surface
+only as a human noticing their fleet history vanished.
+
+**Concrete test.** Open a `Store` on a real file in a temp dir, write a unit + swarm + lanes + events,
+drop it, reopen with `Store::open`, and assert every row and that `max_unit_seq`/`max_swarm_seq`
+re-seed to the persisted maxima rather than 0.
+
+### GAP-042 — `Store::init`'s migration ALTERs swallow every error, so a failed upgrade reads as an empty fleet
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/store.rs:Store::init#alter-migration-on-preexisting-db` |
+| **risk** | L3 × I4 = **12** |
+| **observations** | coverage_pts=4, branches=1 (branch_pts=1), churn_90d=14 (churn_pts=5) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The migration loop is `let _ = conn.execute(stmt, [])` and the comment concedes it
+relies on the ALTERs being "a no-op failure we ignore". On `open_memory` the CREATE TABLE always wins,
+so the ALTER path never supplies the columns in any test — the sole migration test proves only the
+fresh-db case. The fresh CREATE for `units` does **not** declare `swarm_id`, so even a new db depends
+on an ALTER that cannot fail loudly. If any ALTER fails for a real reason on a user's existing
+`fleet.db`, `init` still returns `Ok`, and every downstream query dies on "no such column" — which
+`server.rs` converts to silence via `unwrap_or_default()`/`.ok()`. Silent total history loss on
+upgrade, caught by no gate and no checklist row.
+
+**Concrete test.** Hand-build a temp db with an OLD `units` table plus one legacy row, then
+`Store::open` it and assert the row is readable with the new columns defaulted. Add a negative case
+where an ALTER genuinely fails and assert `open()` reports it rather than returning `Ok`.
+
+### GAP-043 — No `busy_timeout` anywhere: a second writer loses events silently
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `crates/fleetd/src/store.rs:Store::init#pragma-set` |
+| **governs** | `crates/fleetd/src/store.rs`, `crates/fleetd/src/bin/serve.rs`, `cockpit/ui/src-tauri/src/sidecar.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I4 = **20** |
+| **observations** | manual_coverage_pts=5, churn_90d=14 (churn_pts=5), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `init` sets `journal_mode=WAL` and `synchronous=NORMAL` but no `busy_timeout` —
+grep finds no `busy_timeout`/`busy_handler` call in the whole repo — so a second writer gets
+`SQLITE_BUSY` immediately with no retry. Two writers are reachable in normal use: the cockpit
+supervisor respawns `fleetd-serve` the instant the old one exits, with no wait for the WAL lock; and a
+developer running `cargo run --bin serve` alongside the packaged app opens the same default
+`./fleet.db`. Every store write on the event hot path is `let _ = ...`, so a BUSY loses the event
+silently; and if `Store::open` itself fails, `serve.rs` panics and the supervisor restart-loops. No
+db/persistence/restart row exists in the manual checklist either.
+
+**Concrete test.** Hold a write transaction from a second connection, then drive a unit through the
+serve binary against the same `CC_DB`: assert writes either block-and-succeed or surface a visible
+error, never silently drop. Pair with a supervisor check that a `Store::open` failure does not produce
+an unbounded respawn loop.
+
+### GAP-044 — Every driver event does two synchronous SQLite writes inside a global mutex on a tokio worker
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `crates/fleetd/src/server.rs:spawn_forwarder`, `crates/fleetd/src/store.rs:Store::append_event`, `crates/fleetd/src/store.rs:Store::update_unit` |
+| **governs** | `crates/fleetd/src/server.rs`, `crates/fleetd/src/store.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I4 = **20** |
+| **observations** | manual_coverage_pts=5, churn_90d=26 (churn_pts=5), never_verified=true |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Two blocking `rusqlite` writes per event, inside a `std::sync::Mutex` critical
+section, on a tokio worker thread — against a WAL file on disk in production but only against
+`:memory:` in every existing test, so the tests **structurally cannot observe the real IO cost**. This
+is the exact defect class the repo has already been burned by: the 1.5 FAIL was blocking work on the
+wrong thread, passed every automated gate, and was caught only by a human watching a frozen window.
+Here the cost scales with event volume and fleet size (one global lock shared by all drivers and every
+HTTP handler) and the failure is a laggy cockpit rather than a red test. `evt_rx` is also an unbounded
+mpsc, so a chatty driver grows memory with no backpressure.
+
+**Concrete test.** Drive a few thousand events through `spawn_forwarder` against a **file-backed**
+store and assert per-event forwarder latency stays under a budget, that a concurrent `/health` is
+served within a budget while the burst is in flight, and that no events are dropped.
+
+### GAP-045 — `events_since` replays from 0 with no retention, pagination, or bound
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `crates/fleetd/src/store.rs:Store::events_since`, `crates/fleetd/src/server.rs:get_unit` |
+| **governs** | `crates/fleetd/src/store.rs`, `crates/fleetd/src/server.rs`, `cockpit/ui/src/lib/store.svelte.ts` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I4 = **20** |
+| **observations** | manual_coverage_pts=5, churn_90d=26 (churn_pts=5), never_verified=true |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** No `DELETE`, no `VACUUM`, no retention policy and no `LIMIT` anywhere in
+`crates/fleetd/src` — units, swarms, lanes and events grow forever in the long-lived `./fleet.db` the
+sidecar keeps reopening. `events_since` collects the entire matching set into a `Vec<String>` in
+memory, and both the snapshot and WS-attach replay paths call it with `since = 0`, on the same global
+store mutex. `FleetStore.ensureStream` also always passes `sinceSeq = 0`, so a cockpit reload makes the
+daemon re-serialize every unit's entire log — a startup thundering herd. Unbounded growth plus full
+replay is a slow-motion UI hang no unit test will ever see (existing tests replay one or two events).
+
+**Concrete test.** Append 100 k events for one unit and assert the `/events` and WS-attach replay paths
+stay under latency and memory budgets; assert some retention or pagination bound exists; assert
+repeated daemon restarts do not monotonically grow the db.
+
+### GAP-046 — `docker_ok` has no timeout and no single-flight guard, and `create_swarm` awaits it in-handler
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/server.rs:docker_ok`, `crates/fleetd/src/server.rs:create_swarm#docker-preflight` |
+| **risk** | L3 × I4 = **12** |
+| **observations** | coverage_pts=4, branches=1 (branch_pts=1), churn_90d=26 (churn_pts=5) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `Command::new("docker").args(["version",...]).output().await` with no timeout, and
+the 5 s TTL cache is written only *after* the await returns — so a Docker Desktop that is starting or
+wedged makes every unserved `/health` poll spawn its own docker process. The Tauri supervisor polls
+every 300 ms for 20 s and `App.svelte` polls on an interval, so this is a subprocess pileup under
+exactly the condition the probe exists to detect. Worse, `create_swarm` awaits `docker_ok` **inside**
+the request handler for `mode: "real"`, so `POST /swarms` hangs unboundedly with the human staring at a
+spinner — the same "slow work on the interactive path" shape as the 1.5 freeze. CI has no Docker, so
+the false branch is all a CI machine could ever see; the true and hung branches are human-QA-only.
+
+**Concrete test.** Behind a probe seam: assert the 5 s TTL is honoured (two calls inside the window
+spawn one subprocess), that an injected 60 s probe returns `false` within a stated deadline, and that
+`/health` answers within that deadline while the probe is stuck.
+
+### GAP-047 — `env_f64` accepts a zero cap, bricking every mission with a 429
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/server.rs:env_f64`, `crates/fleetd/src/server.rs:env_usize` |
+| **risk** | L4 × I4 = **16** |
+| **observations** | coverage_pts=5, branches=0 (branch_pts=1), churn_90d=26 (churn_pts=5) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** `env_usize` guards with `.filter(|&n| n > 0)`; `env_f64`
+does not. So `CC_GLOBAL_USD_CAP=0` (or a negative) is accepted, and the admission check
+`committed_spend(...).unwrap_or(0.0) >= st.global_cap` evaluates `0.0 >= 0.0` — every `POST /missions`
+**and** `POST /swarms` is refused forever on a fresh daemon with no spend. `api.ts:createMission`
+surfaces that as "global daily cost cap reached", so the human sees a cap error on an empty fleet with
+no way to tell it is a config typo. The asymmetry between the two helpers is the tell that the missing
+filter is an oversight. `.env.example` and `docs/quickstart.md` document the knob as user-settable.
+(Refuter notes `NaN` produces the opposite failure — the cap never binds.)
+
+**Concrete test.** Assert `env_f64` rejects `"0"`, `"-5"` and `NaN` the way `env_usize` rejects `"0"`,
+plus a companion asserting an `AppState` built with `CC_GLOBAL_USD_CAP=0` does not turn
+`create_mission` into a permanent 429.
+
+### GAP-048 — `stream_to_socket` drops events permanently on broadcast lag and never notices a dead peer
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/server.rs:stream_to_socket#lagged-recv-arm`, `crates/fleetd/src/server.rs:stream_to_socket#no-recv-loop` |
+| **risk** | L4 × I4 = **16** |
+| **observations** | coverage_pts=4, branches=11 (branch_pts=4), churn_90d=26 (churn_pts=5) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `broadcast::channel(1024)` plus `Err(Lagged(_)) => continue` is silent, permanent
+event loss on the seam the cockpit renders from — and the UI dedups on `seq` but never re-fetches, so a
+burst of log lines leaves a tile stuck on a stale phase with no error anywhere. Separately the function
+is write-only: it never calls `socket.recv()`, so it never processes Close frames and never learns the
+peer is gone while the unit is live-but-quiet — the task and its receiver leak for the daemon's
+lifetime (nothing ever removes a `UnitHandle`). The one existing WS test connects *after* the unit is
+terminal, so it exercises only the replay half.
+
+**Concrete test.** Flood a unit's sender past 1024 envelopes faster than the socket drains and assert
+the client's received `seq` set has **no gap** — i.e. after a lag the server backfills from
+`events_since(last_seq)` instead of `continue`-ing. Plus a peer-disappears test asserting the task
+terminates.
+
+### GAP-049 — `router()` mounts nine routes with no auth, no origin check, and no CORS layer
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `crates/fleetd/src/server.rs:router` |
+| **governs** | `crates/fleetd/src/server.rs`, `crates/fleetd/src/bin/serve.rs`, `cockpit/ui/src-tauri/tauri.conf.json` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I4 = **20** |
+| **observations** | manual_coverage_pts=5, churn_90d=26 (churn_pts=5), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** No auth layer, no origin check, no CORS layer — `tower-http` is not even a
+dependency. Two unverified consequences pull in opposite directions and **neither is gated**.
+*Security:* `POST /missions` and `POST /swarms` spend real money and start containers; any local
+process can drive them, and `CC_ADDR` accepts any bind address with no loopback assertion, so one env
+var exposes the fleet to the LAN. *Function:* the Tauri webview origin is `tauri://localhost`, not
+`127.0.0.1:8787`; `tauri.conf.json` grants `connect-src` (CSP), but **CSP is not CORS**, and `api.ts`
+uses plain `fetch`. Whether the read succeeds depends entirely on WebView2/WKWebView behaviour for the
+custom scheme — unverified. Every vitest suite stubs `fetch`, so no test at any layer crosses the real
+origin boundary. The only evidence this works is a human having watched a window.
+
+**Concrete test.** A `crates/fleetd/tests/http_contract_it.rs` case that issues requests carrying
+`Origin: http://tauri.localhost` and `Origin: https://evil.example` and asserts the response's
+`Access-Control-Allow-Origin` against a **decided** policy, plus a preflight `OPTIONS`. Whichever policy
+is chosen, the test freezes it. Add the corresponding human row.
+
+### GAP-050 — `post_command` is the entire inbound control surface and no test drives it over HTTP
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/server.rs:post_command` |
+| **risk** | L4 × I4 = **16** |
+| **observations** | coverage_pts=4, branches=5 (branch_pts=2), churn_90d=26 (churn_pts=5) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Halt/Resume/Abandon/Ship/ApproveOracle all arrive here, and every existing test
+pokes `h.cmd_tx` directly — bypassing the handler, the `Json<Command>` deserializer, and the
+rehydrate-then-dispatch ordering. All three status outcomes (202/404/410) are unasserted, and axum's
+422 on a deserialize failure never appears in the handler at all. The failure is invisible by
+construction: `api.ts:sendCommand` returns the status but `FleetStore.cmd` discards it, so a
+404/410/422 renders as a button click that does nothing. This handler also carries the `rehydrate` side
+effect, so an untested path can **start a Docker container as a side effect of an HTTP POST**. See
+`GAP-020` for the destructive case this lack of validation enables.
+
+**Concrete test.** `crates/fleetd/tests/http_contract_it.rs` (demo mode, no Docker): POST to a ghost id
+→ 404; to a unit whose driver exited → 410; a valid Halt → 202 **and** a `phase_changed` carrying the
+same `cmd_id` on that unit's stream.
+
+### GAP-051 — The `/units`, `/health` and `/units/:id` JSON shapes are a hand-mirrored contract nothing gates
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/server.rs:list_units`, `crates/fleetd/src/server.rs:health`, `crates/fleetd/src/server.rs:get_unit`, `cockpit/ui/src/lib/types.ts:Snapshot` |
+| **risk** | L3 × I4 = **12** |
+| **observations** | coverage_pts=4, branches=0 (branch_pts=1), churn_90d=26 (churn_pts=5) |
+| **anchor_sites** | 4 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** These produce the only JSON the fleet view is built from, and no test anywhere
+serializes them. `types.ts` is hand-maintained with no generator, so renaming `usd_cap` or dropping
+`task` compiles clean, passes `cargo test --workspace`, passes `npm run check` (TS sees only its own
+stale interface), passes `tauri build` — and the cockpit renders `undefined`, or throws outright in
+`fromSnapshot`, which dereferences `s.tier.toUpperCase()`. **Drift is already present and
+unverified:** the Rust `Snapshot` returned by `GET /units/:id` has no `tier` or `task`, while the TS
+interface of the same name requires both. Discovered today only by a human seeing a blank tile.
+
+**Concrete test.** `crates/fleetd/tests/ui_contract_it.rs`: assert the exact top-level key set of each
+payload against a literal list, failing on missing **and** extra keys, and that `phase` is one of the
+14 strings in `types.ts`. Emit the same payloads as golden fixtures under
+`cockpit/ui/src/lib/__fixtures__/` and type-assert them in vitest so both sides fail together.
+
+### GAP-052 — `create_mission` and `create_swarm`'s real-mode money guards are unexecuted
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/server.rs:create_mission#real-mode-preflight`, `crates/fleetd/src/server.rs:create_swarm#real-mode-preflight` |
+| **risk** | L3 × I4 = **12** |
+| **observations** | coverage_pts=2, branches=9 (branch_pts=3), churn_90d=26 (churn_pts=5) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** All existing tests pass `mode: "demo"`. The `ANTHROPIC_API_KEY` check is the only
+thing between a cockpit click and a real Docker + GitHub + paid-Anthropic run, and no test proves it
+fires — nor that it fires **before** the row insert and driver spawn, an ordering the code comment
+claims is load-bearing precisely so a bad request "never leaves a driverless unit in the map or a junk
+row in the store". The 409 path from `spawn_driver_for` returning `AlreadyRegistered` is likewise never
+executed. For swarms the blast radius multiplies by `CC_MAX_LANES`. The 503 docker path cannot run in
+CI at all, but the 400-before-any-side-effect assertion needs no Docker.
+
+**Concrete test.** With `ANTHROPIC_API_KEY` removed, call with `mode: "real"` and assert 400 **and**
+that `list_units()` is still empty and no handle was registered. Repeat for `create_swarm`, and assert
+a rejected request does not burn a swarm id.
+
+### GAP-053 — `spawn_driver_for` and `rehydrate` duplicate the real-mode construction and both dispatch on `_`
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/server.rs:spawn_driver_for#real-arm`, `crates/fleetd/src/server.rs:rehydrate#real-arm`, `crates/fleetd/src/server.rs:resume_fan_out` |
+| **risk** | L4 × I4 = **16** |
+| **observations** | coverage_pts=4, branches=8 (branch_pts=3), churn_90d=26 (churn_pts=5) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The runner/forge construction is copy-pasted verbatim in two `_` arms, each
+independently building the temp host-clone path, the `GhForge` title, and a **hardcoded**
+`cc-agent:dev` image — note `bin/serve.rs` honours `CC_IMAGE` for reconciliation but these two sites do
+not, so the drift already exists. Neither copy is executed by any test. The dangerous shared property:
+both dispatch on `_`, not on `"real"`. `create_mission` validates the mode string, but `rehydrate`
+(`row.mode`) and `resume_fan_out` (`sw.mode`) feed **persisted** values straight through — so any
+unexpected mode value in SQLite becomes a real, billable Docker run at daemon startup.
+
+**Concrete test.** Extract one `real_driver(spec, unit_id)` and assert mode dispatch is a whitelist, not
+a fallthrough: persist a unit row with `mode: ""` or `"legacy"`, call `rehydrate`, and assert no driver
+is spawned rather than a silent promotion to a real run.
+
+### GAP-054 — `spawn_forwarder` discards store write errors, then broadcasts the event as if durable
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/server.rs:spawn_forwarder#ignored-store-write-error` |
+| **risk** | L3 × I4 = **12** |
+| **observations** | coverage_pts=2, branches=6 (branch_pts=3), churn_90d=26 (churn_pts=5) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `let _ = s.append_event(...)` and `let _ = s.update_unit(...)`, then
+`bcast.send(env)` regardless. The result is a live UI that has folded events which do not exist in the
+store: refresh the cockpit or restart the daemon and they vanish, `last_seq` regresses, and the WS
+replay disagrees with what the human just watched — with no log line, no error event, and no health
+signal. The existing test covers only the happy-path projection fold, so the enclosing symbol looks
+covered while the durability guarantee it exists to provide is unasserted.
+
+**Concrete test.** Drive `spawn_forwarder` with a store whose `append_event` fails and assert the
+failure is **observable** — the event is not broadcast as durable, or an `Event::Error{scope: System}`
+is emitted.
+
+### GAP-055 — `bin/serve.rs:main` has no tests, no graceful shutdown, and panics on a held port
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/bin/serve.rs:main` |
+| **risk** | L4 × I4 = **16** |
+| **observations** | coverage_pts=5, branches=1 (branch_pts=1), churn_90d=5 (churn_pts=3) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** No inline tests, no integration file, and `cargo test --workspace` never links its
+`main`. Two behaviours bite in the packaged product. **Port-in-use:** `TcpListener::bind(...).unwrap_or_else(|e| panic!(...))`
+aborts, and `sidecar.rs:supervise` respawns every 2 s forever — while `health_gate` polls
+`127.0.0.1:8787/health`, which the *other* already-running fleetd cheerfully answers, so the supervisor
+emits `Ready` and the cockpit believes it is talking to its own sidecar while that sidecar crash-loops
+against a different `CC_DB`. **Shutdown:** there is no `with_graceful_shutdown` and no signal handler
+at all; the process is torn down by `CommandChild::kill()`, severing in-flight WS clients mid-write —
+and Gate 5 already recorded an undiagnosed "process did not exit" anomaly (`GAP-010`). Also
+unasserted: `reconcile_on_startup` runs against a real `LocalDockerRunner` **before** the bind, so a
+hung `docker ps` delays listening past the supervisor's 20 s health gate.
+
+**Concrete test.** `crates/fleetd/tests/serve_bootstrap_it.rs`: hold the port, start `serve`, assert a
+non-zero exit with a diagnosable message rather than a bare panic; and assert a terminate signal
+mid-mission leaves a coherent `last_seq` when a second process reads the same db.
+
+### GAP-056 — `get_swarm` computes the swarm "done" verdict at read time with no test and no consumer
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/server.rs:get_swarm` |
+| **risk** | L4 × I4 = **16** |
+| **observations** | coverage_pts=4, branches=6 (branch_pts=3), churn_90d=26 (churn_pts=5) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The only place the swarm "done" verdict exists, computed rather than persisted, as
+a three-way conjunction with zero direct coverage — the `run_swarm` tests assert the *stored* status and
+call `swarm_rollup` directly, never this handler. A wrong verdict is how a human ends up believing a
+swarm finished while lanes are still burning budget, or the reverse. `spent_so_far` — the number a
+human would use to decide whether to keep going — is likewise computed only here, by iterating
+`get_unit` per lane inside the held store lock, and asserted nowhere. And `grep -rn 'swarm'
+cockpit/ui/src` returns nothing: the entire `/swarms` surface is a fully-implemented,
+contract-unpinned API with no client to notice drift.
+
+**Concrete test.** Build a swarm with two child units; assert `running` while one child is
+non-terminal, `done` only when both are terminal, never `done` when `total == 0`, and
+`spent_so_far == planner_cost + sum(child.cost)`. Pin the exact `SwarmDetail`/`LaneView` key sets.
+
+### GAP-057 — The Tauri host crate is a standalone workspace, so CI never runs one of its tests
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | build_ci_gate |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/Cargo.toml:[workspace]`, `Cargo.toml:workspace.members`, `.github/workflows/ci.yml:jobs.test` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=0 (branch_pts=1), churn_90d=10 (churn_pts=4) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Verified from source: line 2 of `cockpit/ui/src-tauri/Cargo.toml` is a bare
+`[workspace]` with the comment "Standalone workspace so the parent Cargo workspace doesn't claim this
+crate", and the root members are only `crates/fleet-core` and `crates/fleetd`. So `cargo test
+--workspace` in CI's `test` job never reaches the crate that contains the sidecar supervisor, the
+`ccplugin://` handler, the webview embedding layer, the dashboard commands and the app-plugin runtime.
+CI's only contact with it is compilation inside `tauri build`. **This entry is the multiplier on every
+other `tauri_host` and `app_plugin_runtime` finding in this plan** — including the tests the concurrent
+carve-out work is writing right now, which will not gate a PR either.
+
+**Concrete test.** Add `cargo test --manifest-path cockpit/ui/src-tauri/Cargo.toml` to the `test` job.
+Pair it with a repo-root guard that walks every `Cargo.toml`, collects those declaring their own
+`[workspace]`, and asserts each is named in an allowlist CI is known to invoke — so the next standalone
+crate cannot silently drop out.
+
+### GAP-058 — The sidecar supervisor's restart loop has no test, no attempt cap, and no deadline
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `cockpit/ui/src-tauri/src/sidecar.rs:supervise` |
+| **governs** | `cockpit/ui/src-tauri/src/sidecar.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L4 × I5 = **20** |
+| **observations** | manual_coverage_pts=5, churn_90d=1 (churn_pts=2), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `sidecar.rs` contains no `#[cfg(test)]` module at all, and no smoke row exercises a
+mid-session sidecar crash — the twelve rows cover teardown at quit and nothing else. The restart loop
+has no attempt cap and no cumulative deadline: on a hard-crashing or unspawnable binary it cycles
+`emit_status(Down)` → 2 s backoff → respawn forever, and the two `Err` arms (sidecar resolve failure,
+spawn failure) each `continue` into that same uncapped loop. Combined with `GAP-055`, a port already
+held by a stale fleetd produces a permanent crash-loop the operator cannot see.
+
+**Concrete test.** Extract the decision as a pure `should_restart(shutting_down, exit_code, attempt) ->
+Restart` and unit-test crash→restart, shutdown→stop, and attempt-cap behaviour with no real process.
+Manual row: kill `fleetd-serve` from outside the app and confirm exactly one listener on 8787 afterwards.
+
+### GAP-059 — `health_gate` does not restart on timeout, contradicting its own doc, and wedges the app in Starting
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/src/sidecar.rs:health_gate`, `cockpit/ui/src-tauri/src/sidecar.rs:pump_events#gate-spawn` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=5 (branch_pts=2), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** `HEALTH_GATE_TIMEOUT`'s doc says the gate waits "before
+giving up on this attempt and restarting". The code does not restart: the gate runs on a detached
+`spawn` whose failure arm is a lone `log::warn!` and whose result is never joined. `supervise` advances
+only when the child's event stream closes, so a fleetd that starts but never binds — port 8787 already
+held by a stale sidecar, a real scenario — leaves the app in `Starting` indefinitely with no `Down`
+event and no restart. The success arm, the `_` fallthrough and the deadline arm are all unexercised.
+
+**Concrete test.** Thread the timeout, poll interval and base URL through as parameters, then run
+`health_gate` against a stub that never binds: assert it returns false at the deadline rather than
+hanging, and assert the supervisor reacts with a Down/restart transition — which is what the constant's
+doc promises.
+
+### GAP-060 — `fleetd://status` is emitted to nobody
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/src/sidecar.rs:emit_status`, `cockpit/ui/src-tauri/src/sidecar.rs:STATUS_EVENT` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=5, branches=0 (branch_pts=1), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** Grepping the whole `cockpit/` tree for `fleetd://` returns
+exactly two hits, both inside `sidecar.rs` itself. The only `listen(` subscriber in the frontend is
+`plugin://state`. So the supervisor emits Starting/Ready/Down on a channel with zero subscribers, and
+the only live liveness path is `api.ts:health` polling `/health`. In fairness the module docstring
+hedges ("the event is an optimisation, not a hard dependency") — but nothing would notice if the event
+name, the `rename_all = "lowercase"` serialisation, or the `skip_serializing_if` on `code` changed.
+
+**Concrete test.** A serde round-trip on `StatusPayload`, plus a source-level contract test asserting
+the `"fleetd://status"` literal appears in at least one frontend listener — which fails today and
+documents the dead channel rather than leaving it to be rediscovered.
+
+### GAP-061 — The `ccplugin://` response headers are three load-bearing security invariants with no assertion
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/src/view_plugins.rs:built`, `cockpit/ui/src-tauri/src/view_plugins.rs:PLUGIN_CSP` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=5, branches=0 (branch_pts=1), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `view_plugins.rs` has zero tests. Its module header names three findings that each
+"cost a dropped handshake run to discover": the concrete-origin `script-src` (a
+`sandbox="allow-scripts"` iframe has an opaque origin, so `'self'` matches nothing), the
+`Access-Control-Allow-Origin: *` (opaque-origin module scripts are always fetched CORS-mode, so without
+it `sdk.js` never runs and every handshake times out), and CSP as a **response header** rather than a
+`<meta>`. All three live in two string literals with no assertion anywhere, and the failure mode is a
+silent handshake timeout only a human in a watched window sees. **Cheapest high-value test in the
+module** — `built` takes no `AppHandle`, so it is a plain `#[test]`.
+
+**Concrete test.** Assert `built(200, "text/javascript", vec![])` and `not_found()` both carry
+`Content-Security-Policy == PLUGIN_CSP`, that it contains `script-src 'self' http://ccplugin.localhost`
+(not bare `'self'`) and `connect-src 'none'`, and that ACAO is `*` on **both** the 200 and 404 paths.
+
+### GAP-062 — `view_plugins::respond` is the only guard between plugin URLs and `fs::read`, with 14 untested branches
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/src/view_plugins.rs:respond#path-traversal-and-id-validation` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=14 (branch_pts=4), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Fourteen branches of hand-rolled string validation guard `root.join(id).join(sub)`
+before a filesystem read, and none is tested. Whether `request.uri().path()` arrives percent-decoded
+(making `%2e%2e` a bypass) is **unverified** — precisely why a test should pin it. A Windows `id` such
+as a drive prefix or a device name also reaches `Path::join` unchecked. And this Rust guard **disagrees
+with the JavaScript one** (`GAP-088`): the JS side rejects any `..` substring while Rust rejects only
+`..` *components*, and the JS side accepts a bare backslash the Rust side 404s. A manifest is
+attacker-supplied in the `~/.command-center/plugins` drop-in case.
+
+**Concrete test.** Extract `resolve(path) -> Option<(String, String)>` and table-drive it over `/`,
+`/../etc/passwd`, `/id/../../secret`, `/id/a//b`, `/id/.`, `/id/a\b`, and percent-encoded `%2e%2e`;
+assert `/id` defaults to `index.html` and `/id/sdk.js` takes the SDK branch.
+
+### GAP-063 — Dev/packaged plugin-root precedence is the seam every remaining smoke row stands on, untested
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/src/view_plugins.rs:plugin_roots#dev-env-precedence`, `cockpit/ui/src-tauri/src/view_plugins.rs:sdk_bytes` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=3 (branch_pts=2), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `SPIKE-RESULTS.md` step 1 instructs the operator to set `CC_VIEW_PLUGINS_DEV` and
+`CC_PLUGIN_SDK` before running the smoke, and rows 1.3, 1.4 and 1.10 are **unmeasurable** if resolution
+silently falls through to the wrong root. First-hit-wins ordering across three optional sources is
+exactly the logic that rots when a fourth root is added, and a wrong-root hit fails as "the plugin
+rendered stale content", not as an error. Zero tests; the `USERPROFILE`/`HOME` fallback in particular is
+only ever exercised on one OS at a time.
+
+**Concrete test.** Refactor to `roots_from(dev, resource, home) -> Vec<PathBuf>` and assert the exact
+ordering dev → `<resource>/plugins` → `<home>/.command-center/plugins`, that an absent env var drops
+only its own entry, and that `USERPROFILE` wins over `HOME`. Same shape for `sdk_bytes`.
+
+### GAP-064 — `WebviewPool::touch_and_evict` is the whole "no leak on switch" guarantee and is pure arithmetic nobody tests
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/src/embedding.rs:WebviewPool::touch_and_evict` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=3 (branch_pts=2), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `embedding.rs` has zero tests. This function is the only thing bounding
+native-webview memory and it is list arithmetic that unit-tests trivially — yet today the only way to
+learn it is wrong is Task Manager. Two specific unasserted behaviours: `plugin_hide` parks a webview
+**without touching the LRU**, so a parked-but-still-MRU plugin can be destroyed by three subsequent
+shows and the user's next switch-back gets a cold reload instead of the promised warm render tree; and
+nothing removes a label from `lru`/`last_rect` when a plugin is stopped, so stale labels occupy
+warm-cap slots and evict live webviews.
+*(A related claim — that the `lru` mutex is held across a blocking main-thread `close()` — was **Phase-3
+refuted**: `close()` compiles to a non-blocking `send_event`, so the critical section is two channel
+sends. Recorded so it is not re-flagged.)*
+
+**Concrete test.** Split bookkeeping from destruction — `touch(label, rect) -> Vec<String>` returning
+evicted labels — then assert with no Tauri runtime: A,B,C,D evicts [A]; re-showing A before D evicts
+[B]; re-showing the MRU evicts nothing and does not duplicate; `last_rect` has no entry for an evicted
+label; `lru.len()` never exceeds `WARM_CAP`.
+
+### GAP-065 — The `app::<id>` webview-label scheme is encoded in three places with a "MUST" nobody enforces
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/src/embedding.rs:app_label`, `cockpit/ui/src-tauri/capabilities/default.json:app-plugins`, `cockpit/ui/src-tauri/src/embedding.rs:HOST_WINDOW_LABEL` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=0 (branch_pts=1), churn_90d=4 (churn_pts=3) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `format!("app::{id}")`, the `"app::*"` glob in `capabilities/default.json`, and the
+module header's contract are three independent copies, and the capability comment literally says the
+glob "MUST match the webview-label scheme" — a MUST with no enforcement. Renaming the prefix compiles,
+bundles, and passes every gate; it surfaces only as an app-plugin webview silently losing permissions
+at runtime. `HOST_WINDOW_LABEL = "main"` has the same shape: a guess about a label `tauri.conf.json`
+never states, degrading to a user-visible error string when `get_window` returns `None`.
+*(A related claim — that the `app-plugins` capability over-grants webview-mutating permissions to
+third-party app content — was **Phase-3 refuted**: the capability omits `remote`, and the child webview
+loads an external URL, so Tauri classifies it `Origin::Remote` and the Local-only grants never resolve.
+The capability is inert rather than dangerous. Recorded so it is not re-flagged.)*
+
+**Concrete test.** `include_str!` the capability file and assert every `webviews` glob, with its
+trailing `*` stripped, is a prefix of `app_label("x")`; assert `HOST_WINDOW_LABEL` appears in the
+`default` capability's `windows` array and that `tauri.conf.json` declares exactly one window.
+
+### GAP-066 — The `ccplugin://` origin is written three ways, and the CSP form is Windows-only
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/tauri.conf.json:app.security.csp`, `cockpit/ui/src-tauri/src/view_plugins.rs:PLUGIN_CSP`, `cockpit/ui/src/lib/loader.ts:pluginSrc` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=0 (branch_pts=1), churn_90d=3 (churn_pts=3) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed against the vendored Tauri source.** `pluginSrc` emits
+`ccplugin://localhost/${id}/${entry}` and `App.svelte` uses that literal as the iframe `src` in both
+dev and packaged; the host CSP is a single static string ending `frame-src http://ccplugin.localhost`
+with no platform variants and no rewrite anywhere; and Tauri's own docs state the URL form is
+`http://<scheme>.localhost` on **Windows/Android** but `<scheme>://localhost` on **macOS/iOS/Linux**.
+Tauri's runtime CSP augmentation only injects nonces into `script-src`/`style-src`, never adds custom
+schemes to `frame-src`. `release.yml` builds all three OSes. So view-plugins would be CSP-blocked on
+macOS and Linux, discovered by a user. CI's three-OS matrix only runs `tauri build` and never launches
+the app; smoke rows 1.3/1.10 were Windows-only and are recorded "not run".
+
+**Concrete test.** Parse `tauri.conf.json` and assert its `frame-src` admits **every** origin form
+`pluginSrc` can emit — including the raw `ccplugin://localhost` form — and that the origin token in
+`PLUGIN_CSP`'s `script-src` is byte-identical to the one in `frame-src`. Mirror it in `loader.test.ts`.
+
+### GAP-067 — `127.0.0.1:8787` is hand-mirrored in four places and only one of them honours `CC_ADDR`
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/src/sidecar.rs:FLEETD_ADDR`, `cockpit/ui/src-tauri/tauri.conf.json:app.security.csp`, `cockpit/ui/src/lib/api.ts:BASE`, `crates/fleetd/src/bin/serve.rs:main#cc-addr` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=0 (branch_pts=1), churn_90d=5 (churn_pts=3) |
+| **anchor_sites** | 4 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The `sidecar.rs` comment says it "mirrors serve.rs" — a mirror maintained by hand.
+`serve.rs` honours `CC_ADDR`; the host does not. So setting `CC_ADDR` produces a running daemon the
+supervisor health-gates against forever on the old port (never `Ready`, and per `GAP-059` never
+restarted) while the CSP simultaneously blocks the frontend from the new one. Silent, three-symptom,
+asserted nowhere.
+
+**Concrete test.** Read `tauri.conf.json` and assert its `connect-src` contains both
+`http://{FLEETD_ADDR}` and `ws://{FLEETD_ADDR}` built from the sidecar constant. Better: make
+`FLEETD_ADDR` read `CC_ADDR` with the same default as `serve.rs` and test that override end to end.
+
+### GAP-068 — The updater is registered against an empty pubkey and a `.example` endpoint
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/tauri.conf.json:plugins.updater`, `cockpit/ui/src-tauri/src/lib.rs:run#updater-registration` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=2 (branch_pts=1), churn_90d=10 (churn_pts=4) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** `pubkey` is the empty string and the single endpoint host is
+a reserved `.example` name; `lib.rs` registers the plugin unconditionally with no `Builder::pubkey`
+override, and no build step patches the config. Meanwhile `release.yml` injects
+`TAURI_SIGNING_PRIVATE_KEY` for all three OSes — so a tagged build produces **signed artifacts whose
+signature can never verify**, pointed at a nonexistent host. `tauri build` validates bundling, not
+updater semantics, and no smoke row mentions the updater. `lib.rs` has zero tests.
+
+**Concrete test.** A config-coherence test asserting `plugins.updater.pubkey` is non-empty, that no
+endpoint host ends in `.example`/`.invalid`, and that every endpoint retains its
+`{{target}}/{{arch}}/{{current_version}}` placeholders. Pair with a `release.yml` assertion that signing
+key and verifying pubkey cannot be configured one-sidedly.
+
+### GAP-069 — `lib.rs:run`'s ExitRequested ordering is load-bearing and enforced only by statement order
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/src/lib.rs:run#exit-requested`, `cockpit/ui/src-tauri/src/lib.rs:run#generate-handler` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=2 (branch_pts=1), churn_90d=10 (churn_pts=4) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `lib.rs` has zero tests and is a ratified core entry point. The handler's comment
+states the sidecar must be reaped first "so the supervisor doesn't respawn it as we tear down" — an
+ordering nothing enforces. Smoke row 1.9b (`GAP-010`) recorded a live, undiagnosed anomaly here, which
+is precisely the signal this contract deserves a mechanical guard. The registration block is the other
+silent-drift surface: adding a command and forgetting the `generate_handler!` line compiles clean and
+fails only as a runtime "command not found" in the webview.
+
+**Concrete test.** A source-structure guard (same technique the concurrent
+`tests/tauri_command_threading.rs` uses): assert `SidecarSupervisor::shutdown` appears at an earlier
+byte offset than `stop_all_owned`, which precedes `app_handle.exit(0)`; and assert every name in
+`generate_handler!` resolves to a real `#[tauri::command]` in the tree.
+
+### GAP-070 — `run_halyard` shells out with no timeout from a synchronous Tauri command
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/src/dashboard.rs:run_halyard`, `cockpit/ui/src-tauri/src/dashboard.rs:halyard_status`, `cockpit/ui/src-tauri/src/local_projects.rs:scan_local_projects` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=1 (branch_pts=1), churn_90d=2 (churn_pts=2) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **This is the same defect class as the 1.5 freeze, in commands nobody has looked
+at.** `halyard_status`/`halyard_queue` are synchronous `#[tauri::command] pub fn` calling
+`Command::output()` with no timeout; `scan_local_projects` is synchronous and does a bounded-recursive
+`walkdir` over whole scan roots plus a full read of every STATUS.md/ROADMAP.md. Sync Tauri commands run
+on the main event-loop thread. `Dashboard.svelte` fires all three on mount **and again every 15 s**, so
+the freeze recurs. The concurrent `tests/tauri_command_threading.rs` guard already names this as
+tolerated debt — it asserts signatures, so it can never go red when the hang happens. Nothing else
+gates it: this crate's tests do not run in CI (`GAP-057`).
+
+**Concrete test.** Point `HALYARD_BIN` at a stub and assert the three failure shapes (binary absent,
+non-zero exit with stderr, non-JSON stdout); then the one that matters — a `sleep 30` stub must return
+within a bounded time, which fails today and forces a timeout to exist.
+
+### GAP-071 — The Audience HTTP commands have no client timeout and an unasserted error-policy asymmetry
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/src/dashboard.rs:audience_health`, `cockpit/ui/src-tauri/src/dashboard.rs:audience_posts` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=3 (branch_pts=2), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `reqwest::Client::new()` with no `.timeout()`, so a backend that accepts the socket
+and stalls leaves the invoke promise pending forever — and `Dashboard.svelte:refresh()` awaits
+sequentially, so `pulling` never clears, REFRESH stays disabled, and the unrelated LOCAL lane never
+polls. Only `unwrap_posts` is tested; neither transport is. The two commands also take **opposite**
+error policies (`audience_health` swallows every transport error into `Ok(false)`, `audience_posts`
+propagates) and nothing pins that as deliberate, so a refactor could flip a down backend into a hard
+failure the adapter is not written to handle.
+
+**Concrete test.** Stand a `tokio` test HTTP server and assert: `/health` 200 → `Ok(true)`; 500 →
+`Ok(false)`; connection refused → `Ok(false)` not `Err`; `/posts` 503 → `Err` with the status; HTML body
+→ `Err` "not JSON"; `{"posts":[…]}` → the unwrapped array.
+
+### GAP-072 — `local_projects`' exclusion list and depth bound are the only brakes on a whole-disk walk, and neither is tested
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | tauri-host |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src-tauri/src/local_projects.rs:discover#excludes-and-max-depth`, `cockpit/ui/src-tauri/src/local_projects.rs:scan_local_projects#pin-dedup` |
+| **risk** | L2 × I5 = **10** |
+| **observations** | coverage_pts=2, branches=5 (branch_pts=2), churn_90d=2 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** All four tests pass `max_depth: 5, excludes: vec![]`, so `is_excluded` is never
+exercised with a non-empty list and the depth bound is never observed truncating anything — while
+`scan_local_projects` is itself flagged unbounded main-thread debt whose cost scales with the
+operator's disk. Separately the pin dedup arm (`if discovered.contains(&norm) { continue }`) is never
+taken, and its correctness rests on a case-**sensitive** comparison on Windows, where `D:/proj` and
+`d:/proj` are the same directory — so the same project can appear twice on the board, and a pinned
+directory that is also discovered silently keeps `is_pinned: false`.
+
+**Concrete test.** Build `root/deep/a/b/c/d/docs/STATUS.md` and assert it is found at depth 8 and absent
+at 3; build `root/vendor/thing/docs/STATUS.md` and assert `excludes: ["vendor"]` drops it; pass a pin
+with backslashes against forward-slash discovery and assert dedup still holds.
+
+### GAP-073 — `App.svelte`'s app-plugin compositing effect never exercises the overlay park/restore pair
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/App.svelte:$effect#app-plugin-compositing` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=4 (branch_pts=2), churn_90d=8 (churn_pts=4) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The jsdom half of smoke row 1.7 (`GAP-007`) and it is fully automatable: the
+overlay-open branch (`if (overlayOpen) void invoke('plugin_hide')`) and the restore branch are pure
+signal emission across the Tauri boundary, observable through the invoke mock this test file already
+installs. The two existing tests cover only the healthy/not-healthy gate; neither ever opens an
+overlay. Same class as the defect that froze the UI — a native-boundary contract the UI half must
+honour. Note the pin would still be **local-only** until `npm test` reaches CI (`GAP-110`).
+
+**Concrete test.** Activate audience, emit `healthy`, assert one `plugin_show`; call
+`fleet.requestRealLaunch(...)`, assert one `plugin_hide` and no `plugin_show` while open; cancel and
+assert `plugin_show` count is 2. Plus: no re-issue of `plugin_hide` on an unrelated `pluginState` write.
+
+### GAP-074 — The ResizeObserver rect-glue effect is asserted nowhere, teardown included
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/App.svelte:$effect#rect-glue-resizeobserver` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=2 (branch_pts=1), churn_90d=8 (churn_pts=4) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Two thirds of smoke row 1.6 and the leak half of 1.8. `App.appPlugin.test.ts`
+explicitly stubs `ResizeObserver` to a no-op and defers this to the checklist, so nothing asserts that
+an observer is attached, that the callback marshals a well-formed rect, or — the high-value one — that
+the effect's teardown **disconnects** when `activeApp` goes null. An undisconnected observer holding a
+detached rect element is exactly the leak 1.8 is looking for, and a human eyeballing a window will
+never see it.
+
+**Concrete test.** Stub `ResizeObserver` with a class capturing the callback and recording
+`observe`/`disconnect`; assert `observe` on the rect element, that firing the callback emits
+`plugin_set_rect` with all four keys, and that switching to FLEET calls `disconnect` exactly once and
+stops further emissions.
+
+### GAP-075 — No test in the repo ever mounts a view-plugin iframe from `App.svelte`
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/App.svelte:$effect#view-plugin-bridge`, `cockpit/ui/src/App.svelte:onSwitch#view-prefix-arm` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=2 (branch_pts=1), churn_90d=8 (churn_pts=4) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `bridge.test.ts` unit-tests `PluginBridge` in isolation and no App-level test ever
+activates a view-plugin — no test in `src/` references `view-plugin-frame` or `switch-view:` at all. So
+the `view:` arm of `onSwitch`, the entry point to the entire sandboxed-plugin runtime, is unexecuted.
+The bridge registers a window `message` listener and a 60 ms interval released only via `destroy()`, so
+if the effect teardown ever stops firing, every FLEET↔REFERENCE round trip leaks a listener plus a
+timer draining a store for an unmounted frame. The `sandbox="allow-scripts"` assertion is cheap
+insurance on a security-shaped invariant with zero automated protection today.
+
+**Concrete test.** `vi.mock('./lib/bridge')` so `PluginBridge` records constructor args and a `destroy`
+spy; assert the iframe mounts with `sandbox === 'allow-scripts'` (and **not** `allow-same-origin`) and a
+`ccplugin://` src, that exactly one bridge is constructed, and that switching away calls `destroy` once
+and unmounts. Re-enter and assert no accumulation.
+
+### GAP-076 — `onKill` — the plugin-misbehaviour escape hatch — has no App-level test
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/App.svelte:$effect#view-plugin-bridge#onkill-fallback` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=2 (branch_pts=1), churn_90d=8 (churn_pts=4) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** An inbound message flood must dump the untrusted iframe and fall back to the
+trusted ops grid. `onKill` sets two pieces of state from inside an effect keyed on the first of them —
+a self-invalidating write whose correctness depends on Svelte 5 effect re-entrancy doing the teardown
+before the re-run. `bridge.test.ts` can only prove the callback fires, not what the shell does with it,
+and the hostile-plugin kill path falls between every manual row (1.3/1.4 are the happy path, 1.7 is
+app-plugin parking, 1.8 is leak-on-switch). A human smoke run would essentially never trigger it.
+
+**Concrete test.** Capture the options passed to the mocked `PluginBridge`, invoke `options.onKill()`,
+`await tick()`, then assert the iframe is gone, the Fleet ops grid is rendered, and
+`switch-fleet` has `aria-pressed === "true"`.
+
+### GAP-077 — `selectApp` has no in-flight guard, so a double-click starts two docker builds
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/App.svelte:selectApp#no-in-flight-guard` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=3 (branch_pts=2), churn_90d=8 (churn_pts=4) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed on both sides.** UI: `activeApp` is set synchronously, then
+`await tick()`, then a `pluginState[id] === 'healthy'` check — and `pluginState` is only ever written by
+the async `plugin://state` listener, so a second click during `starting`/`building` fails the check and
+dispatches again. The tab is a plain `<button>` with no `disabled` and no same-id short-circuit. Rust:
+`plugin_launch` looks the id up and immediately `thread::spawn`s the start sequence; the `running` map
+is consulted nowhere on the launch path and is only inserted into *after* `Healthy`. So both threads
+run `docker compose build` against the same project. Direct descendant of the 1.5 freeze, and exactly
+what a careful human smoke tester (one deliberate click) will never reproduce. *(The Rust half was read
+while another agent had `manager.rs` modified in the working tree.)*
+
+**Concrete test.** Fire two clicks on the app tab back to back without awaiting between them, then
+`waitFor` and assert `calls('plugin_launch').length === 1`. Also add the app→app hand-off case (two app
+tabs: assert `plugin_hide` on the outgoing before any `plugin_launch` on the incoming) and the
+already-healthy re-entry short-circuit.
+
+### GAP-078 — `api.ts` has no test file at all, and `openStream` wires no close or error handler
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/api.ts:openStream`, `cockpit/ui/src/lib/api.ts:createMission`, `cockpit/ui/src/lib/api.ts:sendCommand` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=3 (branch_pts=2), churn_90d=2 (churn_pts=2) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** `api.ts` is mocked away wholesale by every test, so its real
+code is executed by nothing. `openStream` sets only `onmessage` — a repo-wide grep for
+`onclose|onerror` returns nothing — and `FleetStore.start()` latches `started = true` with `reconnect()`
+called exactly once, while `ensureStream` refuses to reopen a socket already in its map (a closed
+socket is still truthy). Daemon health is fetched only inside that one `reconnect`, so the ◉ DOCKER / ◉
+KEY badges keep their last green value. This is a **missing feature**, not just a missing test: the
+cockpit becomes silently, confidently dead when the sidecar restarts. Also unpinned: `sendCommand`
+returns the raw status while `FleetStore.cmd` discards it, so a daemon-rejected halt looks identical to
+a successful one.
+
+**Concrete test.** New `cockpit/ui/src/lib/api.test.ts` with a stubbed `WebSocket`/`fetch`: assert the
+`http→ws` URL rewrite and `since` param, that a malformed frame is swallowed, that the three `!res.ok`
+guards throw with status and body, that `sendCommand` does **not** throw on 409 — and then pin the
+socket-lifecycle contract, which is where the intended behaviour gets decided.
+
+### GAP-079 — `FleetStore.dispose` leaves the store un-restartable
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/store.svelte.ts:dispose`, `cockpit/ui/src/lib/store.svelte.ts:start#started-latch` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=0 (branch_pts=1), churn_90d=3 (churn_pts=3) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** `dispose()` closes the sockets but does not clear
+`this.sockets` and does not reset `this.started`; it is `App.svelte`'s `onMount` teardown, and `fleet`
+is a module-level singleton whose `units`/`order` survive the unmount. So a remount — Vite HMR of
+`App.svelte`, or any second mount — takes the `if (this.started) return` early-out and `ensureStream`'s
+truthy-dead-socket guard: the cockpit comes back fully populated and permanently frozen, no error, no
+reconnect. Only a human doing an HMR reload would see it, and smoke row 1.10 only checks that HMR loads
+at all.
+
+**Concrete test.** `reconnect()` with two units, `dispose()`, assert both socket `close` spies fired;
+then `start()` again and assert `openStream` was called twice more. Red today — pin the intended
+contract.
+
+### GAP-080 — `fleet.ts:fold` matches Rust-side reason strings by exact equality, with no test on either side
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/fleet.ts:fold#blocked-reason-literals`, `crates/fleetd/src/retry.rs:RL_REASON`, `crates/fleetd/src/driver.rs:drive#awaiting-slot-reason` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=3 (branch_pts=2), churn_90d=19 (churn_pts=5) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `fleet.ts` has no test file and the `blocked` arm is never folded by any test. Its
+two flags are set by **exact string equality** against literals produced on the Rust side —
+`RL_REASON = "rate limited"` and an inline `"awaiting concurrency slot"`. Nothing on either side
+enforces the match: `cargo test --workspace`, the one logic gate CI actually has, can rename the reason
+and stay green while the ◷ SLOT / ⏳ RATE-LIMIT chips silently stop appearing and a unit looks hung with
+no explanation. Cross-language stringly-typed coupling with a green build on both sides is the worst
+shape a gap can have here.
+
+**Concrete test.** Fold a `Blocked` with each exact literal and assert the corresponding flag; fold an
+unrecognised reason and assert both stay false while `blocked` is still set; fold any `phase_changed`
+and assert both clear. Add a comment naming the two Rust producers, and ideally a Rust-side assertion
+that those literals are the ones emitted.
+
+### GAP-081 — `phaseClass` and `progress` drive every tile's colour and rail and have no direct assertion
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/fleet.ts:phaseClass`, `cockpit/ui/src/lib/fleet.ts:progress` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=4, branches=6 (branch_pts=3), churn_90d=3 (churn_pts=3) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Both run on every tile render; neither has a direct assertion anywhere, executing
+only incidentally when a test seeds a unit and renders. `progress()` returns `i/(order.length-1)` from
+an `indexOf` over a hand-maintained array that **omits** `needs_human`/`halted`/`no_change` entirely —
+those fall to the `i < 0 ? 0` arm and render a zero-width rail, which may or may not be intended and is
+currently undocumented and unpinned. Adding a phase to `types.ts` or the Rust enum silently lands it in
+the idle bucket. Cheap, high-fanout end of the row-1.2 canary.
+
+**Concrete test.** Table-drive every member of the `Phase` union through `phaseClass` asserting the
+expected bucket; assert `progress` is monotonic non-decreasing along the happy path, that
+`progress('failed') === 1`, and that an unknown phase yields 0 rather than a negative width.
+
+### GAP-082 — Phase-eligibility policy for the action buttons lives in three places with no assertion on any
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/App.svelte:canHalt`, `cockpit/ui/src/App.svelte:canResume`, `cockpit/ui/src/lib/fleet.ts:ATTENTION` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=3 (branch_pts=2), churn_90d=8 (churn_pts=4) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `canHalt` inlines `['needs_human','halted','awaiting_oracle_approval']` —
+byte-for-byte the `ATTENTION` array in `fleet.ts` — and `canResume` re-derives two thirds of it with an
+`||`. The same knowledge exists a third time in the daemon, which is the actual authority, and
+`sendCommand`'s status is discarded (`GAP-078`), so a daemon rule change leaves the UI offering a verb
+that is silently rejected. Zero assertions on any copy. `GAP-020` is the destructive case this enables.
+
+**Concrete test.** Drive one selected unit through every `Phase` and assert the enabled/disabled state
+of RESUME/SHIP/HALT/ABANDON as a table; then assert the set `canHalt` excludes equals `fleet.ts`'s
+`ATTENTION` set, so changing one without the other goes red.
+
+### GAP-083 — Capabilities are negotiated, thrown away, and never enforced
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/loader.ts:negotiateCapabilities`, `cockpit/ui/src/lib/bridge.ts:PluginBridge.onWindowMessage#capabilities-fallback`, `cockpit/ui/src/App.svelte:$effect#view-plugin-bridge` |
+| **risk** | L3 × I4 = **12** |
+| **observations** | coverage_pts=4, branches=1 (branch_pts=1), churn_90d=8 (churn_pts=4) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** `negotiateCapabilities` intersects manifest ∩ host into
+`DiscoveredPlugin.grantedCapabilities`, and a repo-wide grep shows that field has **no production
+consumer**. `App.svelte` builds the bridge with only `{ onKill }`, so
+`this.opts.capabilities ?? [...HOST_CAPABILITIES]` advertises the **full** host set: the reference
+plugin requests only `log-append` and is told it also holds `real-launch-confirm`. And
+`PluginSession` never consults capabilities for anything except the `advertisedCapabilities` getter —
+they are advisory strings with no enforcement point anywhere. `loader.test.ts`'s green negotiation
+tests actively create false confidence that negotiation is in effect.
+
+**Concrete test.** Run the reference manifest through `discoverFrom` and construct the bridge the way
+`App.svelte` does (no `capabilities`), then assert the captured `init.capabilities` equals the
+negotiated `['log-append']`. Red today, and that is the point.
+
+### GAP-084 — The bridge's rate/flood buckets are never driven end to end
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/bridge.ts:PluginSession.onCommand#rate-limited`, `cockpit/ui/src/lib/bridge.ts:PluginSession.onCommand#sink-error` |
+| **risk** | L3 × I4 = **12** |
+| **observations** | coverage_pts=4, branches=7 (branch_pts=3), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `TokenBucket` is unit-tested in isolation but no test drives a session past a
+bucket, so the **wiring** is unproven: which bucket is charged for which verb, the capacities, and the
+`!launchBucket.take() || !bucket.take()` short-circuit that burns a launch token when the general
+bucket is dry. Swap the operands and a plugin's launch verb is silently un-rate-limited with no test
+failing. Both `sink-error` catch arms are equally dead — and that is the *realistic* path, since the
+sinks hit a live HTTP daemon: if the ack were dropped instead of sent, the SDK's `pending` map never
+resolves and the plugin's `await fleet.launch(...)` hangs forever with no visible failure. Manual row
+1.4 (`GAP-004`) is marked "not run", so rate limiting is verified by neither machine nor human.
+
+**Concrete test.** Construct a session with tiny bucket capacities and `autoTick: false`, post three
+launches, assert acks 1–2 `{ok:true}` and ack 3 `{ok:false, reasonClass:'rate-limited'}`. Separately
+give the host a rejecting `launch`/`command` and assert both acks are `sink-error` with no unhandled
+rejection escaping the `void this.onCommand(m)` call site.
+
+### GAP-085 — The shipped `autoTick: true` default path executes in zero tests
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/bridge.ts:PluginSession.onReady#autotick-timer`, `cockpit/ui/src/lib/bridge.ts:PluginSession.onReady#duplicate-ready` |
+| **risk** | L3 × I4 = **12** |
+| **observations** | coverage_pts=4, branches=2 (branch_pts=1), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Every existing session test passes `{ autoTick: false }`, so the default
+`App.svelte` actually uses is unexecuted. Two things are unproven: that the 60 ms tick timer starts at
+all (if it silently didn't, the plugin would render only the initial snapshot and look frozen —
+precisely what a human would have to catch in row 1.3), and that `clearInterval` in `kill()` releases
+it. Worse, `if (this.ready) return` is the only thing stopping a hostile plugin from starting **one
+interval per `ready`** — an unbounded timer leak that survives `kill()` because only the last timer is
+cleared, and 50 readys/sec sits under the 200 flood ceiling.
+
+**Concrete test.** With fake timers and defaults: drive `ready`, mark a unit dirty, advance 35 ms and
+assert 3+ delta pushes; `destroy()`, advance, and assert no further `state` and
+`vi.getTimerCount()` back to baseline. Then post `ready` 50 more times and assert zero additional
+`state` messages and no timer growth.
+
+### GAP-086 — Hostile-input handling on the port is exercised only through pure-function tests
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/bridge.ts:PluginSession.handleMessage#version-skew-drop`, `cockpit/ui/src/lib/bridge.ts:PluginBridge.onWindowMessage#hostile-hello` |
+| **risk** | L3 × I4 = **12** |
+| **observations** | coverage_pts=4, branches=7 (branch_pts=3), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `if (!m || m.v !== PROTOCOL_VERSION) return` is exercised only through
+`policeCommand`'s pure test, never over the port — and the difference matters: over the port a
+v-mismatched message is dropped **silently** with no ack, so a v2 plugin's every command hangs its
+promise forever with no diagnostic. Nobody has chosen that behaviour deliberately. On the bridge side,
+the `window.addEventListener` wiring in the constructor is executed by no assertion at all: if the
+constructor stopped registering the listener, every existing test still passes and the handshake dies
+only in the real app — a row-1.3 failure. The `e.source === frame.contentWindow` check is the *only*
+auth available, since a sandboxed iframe's origin is `"null"`.
+
+**Concrete test.** Dispatch a real `MessageEvent` on `window` (source is null in jsdom) and assert no
+session is created and nothing was posted — proving the constructor's listener is wired **and** that a
+non-frame sender is rejected. Then table-drive `{v:2,...}`, `{v:1,type:'wat'}`, `null`, a string, `{}`
+over the port and assert no ack, no sink call, `isAlive` still true, and no exception.
+
+### GAP-087 — `policeCommand`'s only numeric bound, `min_review_rounds`, is untested
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/bridge.ts:policeCommand#min-review-rounds-bounds`, `cockpit/ui/src/lib/bridge.ts:policeCommand#reqid-validation` |
+| **risk** | L4 × I4 = **16** |
+| **observations** | coverage_pts=4, branches=27 (branch_pts=5), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `policeCommand` is the trust boundary and the best-covered thing in the module —
+which is exactly why the residual holes are the dangerous ones. `min_review_rounds` is the only numeric
+bound in the whole policy and **no test touches it**, so the four-way guard
+(`typeof`/`isInteger`/`<1`/`>6`) is unexecuted: a plugin passing `1e9` or `0` reaches `store.launch`
+and then the daemon with an out-of-range review budget — a cost lever an untrusted frame should not
+hold. `reqId` validation, which is what makes ack correlation forgery-resistant, is likewise untested.
+Both are pure-function assertions and both are sub-assertions of manual row 1.4 that can be retired
+from the human gate.
+
+**Concrete test.** Table-drive `min_review_rounds` over `0, -1, 7, 1.5, NaN, Infinity, '3', null, 6, 1`
+expecting `over-bound` for the first eight; assert `undefined` still defaults to 2. Separately assert
+`reqId: ''`, a number, absent, and a 100 KB string all reject `malformed`, and that a malformed command
+with a non-string `reqId` still produces an ack with `reqId: ''` rather than throwing.
+
+### GAP-088 — `loader.ts`'s traversal guard has one test case and disagrees with the Rust guard
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/loader.ts:validateManifest#entry-traversal-variants`, `cockpit/ui/src-tauri/src/view_plugins.rs:respond#component-check` |
+| **risk** | L4 × I4 = **16** |
+| **observations** | coverage_pts=4, branches=15 (branch_pts=4), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The guard is a single line (`entry.includes('..') || entry.startsWith('/')`) with
+exactly one test case. The untested variants matter because **the JS and Rust gates accept different
+strings**: JS rejects any `..` substring while Rust rejects only `..` *components*; JS accepts a bare
+backslash entry that Rust 404s. Nothing tests that they agree, and the Rust half has no tests at all
+(`GAP-062`). A manifest is attacker-supplied in the `~/.command-center/plugins` drop-in case.
+
+**Concrete test.** Table-drive `entry` over `'..\\escape.html'`, `'a/../../etc/passwd'`, `'%2e%2e/x'`,
+`'.'`, `'sub\\index.html'`, `'http://evil/x'`, `'//evil/x'`, `'javascript:alert(1)'`,
+`'index.html?../../x'`; for anything accepted, feed it through `pluginSrc` and assert the URL still has
+a literal `ccplugin://localhost/<id>/` prefix with no `..` segment. Mirror the corpus in the Rust test.
+
+### GAP-089 — The shipped SDK has no lifetime story: unsubscribes untested, no `close()`, and a killed session hangs every pending promise
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/plugin-sdk/index.js:attach`, `cockpit/plugin-sdk/index.js:connect#handshake-timeout` |
+| **risk** | L4 × I4 = **16** |
+| **observations** | coverage_pts=4, branches=18 (branch_pts=4), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `plugin-sdk.test.ts` does import the shipped artifact (good, and worth recording)
+but walks only three happy paths. Everything about lifetime is untested: the four unsubscribe closures
+are never invoked and there is no `close()`/dispose at all, so the client can never release
+`port.onmessage` or the `pending` map. The consequence chains with the host: when
+`PluginSession.kill('flood')` fires, `post()` short-circuits on `!this.alive`, so the flood-triggering
+command is **never acked**, its `pending` entry is never deleted, and the plugin's
+`await fleet.launch(...)` hangs forever. `connect`'s `if (opts.timeoutMs)` also means the documented
+default `connect()` never times out and never removes its window listener. And `attach` accepts
+`init.apiVersion` blindly while `validateManifest` enforces it strictly on the host side —
+asymmetric and untested. Note `cockpit/plugin-sdk/**` is outside vitest's `src/**` include pattern, so
+this one importing test file is the only reachable coverage.
+
+**Concrete test.** Over a real `MessageChannel`: register two `onState` callbacks, dispose the first,
+push state, assert only the second fired; fire an in-flight `launch()` then `kill('flood')` and assert
+(with a race-vs-timeout) that the promise never settles — documenting the hang. With fake timers,
+assert `connect({timeoutMs:3000})` rejects at the deadline **and** removes its listener, and that
+`connect()` with no `timeoutMs` stays pending forever (pinning today's behaviour).
+
+### GAP-090 — The reference plugin's `esc`/`render` are structurally untestable, and `esc` guards `innerHTML`
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `plugins/reference/app.js:esc`, `plugins/reference/app.js:render` |
+| **risk** | L4 × I4 = **16** |
+| **observations** | coverage_pts=5, branches=6 (branch_pts=3), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `plugins/reference/app.js` has zero tests and **cannot get any in its current
+shape**: it is outside vitest's include pattern, and at module scope it calls `document.getElementById`,
+`connect(...)`, and imports `./sdk.js` — a file that does not exist on disk and is synthesized at
+runtime by the Rust scheme handler's `sub == "sdk.js"` special case. So the one importable piece
+(`model.js`) is well tested while the piece that touches untrusted data — a hand-rolled `esc` feeding
+`innerHTML` — is untestable by construction. The sandbox contains the blast radius but does not make
+injected script harmless inside the plugin's own document, and defence-in-depth is the file's own
+stated intent.
+
+**Concrete test.** Extract `esc` and make `render(model, doc)` take its root so a test under
+`cockpit/ui/src/lib/` can import the shipped file the way `reference-plugin.test.ts` already imports
+`model.js`. Then assert a unit id of `<img src=x onerror=...>` and a log line containing `</li><script>`
+produce zero `script`/`img` nodes while the raw text survives as `textContent`, and that the
+awaiting-approval banner renders with no clickable control.
+
+### GAP-091 — The host duplicates the reference manifest inline, so the loader's tested code paths are unreachable in the app
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/App.svelte:VIEW_PLUGIN_INDEX`, `cockpit/ui/src/lib/loader.ts:devPluginSource`, `plugins/reference/manifest.json` |
+| **risk** | L3 × I4 = **12** |
+| **observations** | coverage_pts=4, branches=3 (branch_pts=2), churn_90d=8 (churn_pts=4) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `App.svelte` inlines a copy of the manifest and calls `discoverFrom('packaged', …)`
+directly, so `devPluginSource`, `packagedPluginSource` and the whole `dev` arm of `pluginSrc` are
+unreachable from `main.ts` — `loader.test.ts`'s four green tests certify code the app never runs, which
+is **worse than no coverage** because it reads as coverage. Meanwhile the copy that *is* shipped is
+unpinned against `plugins/reference/manifest.json`: change the manifest's `entry`, `id` or
+`capabilities` and the host keeps loading the stale copy, silently producing a 404 iframe (a row-1.3
+failure) or the wrong grant (`GAP-083`). Separately **unverified**: `tauri.conf.json` declares no
+`bundle.resources`, so a packaged build may ship neither `plugins/` nor `plugin-sdk/index.js` — which
+would 404 both `index.html` and `sdk.js` in Part 2.
+
+**Concrete test.** Static-import `plugins/reference/manifest.json` and assert it deep-equals the entry
+the host actually loads; run it through `discoverFrom('packaged', …)` asserting one plugin, zero
+rejections, the exact `src`, and `grantedCapabilities === ['log-append']`. Add a `tauri.conf.json`
+assertion that the plugin and SDK paths are declared as bundle resources.
+
+### GAP-092 — The hostile-plugin kill-and-revert path is covered by neither a test nor a checklist row
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `cockpit/ui/src/App.svelte:selectViewPlugin`, `cockpit/ui/src/lib/bridge.ts:PluginSession.kill` |
+| **governs** | `cockpit/ui/src/App.svelte`, `cockpit/ui/src/lib/bridge.ts` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I4 = **20** |
+| **observations** | manual_coverage_pts=5, churn_90d=8 (churn_pts=4), never_verified=true |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The flood/teardown response is the only plugin behaviour with a **host-visible**
+consequence, and it is verified by nobody. `bridge.test.ts` asserts only that a `vi.fn()` `onKill`
+receives `'flood'` against a fake host; no test renders `App`, so revert-to-the-trusted-ops-grid is
+unproven. It is absent from the manual gate too: 1.3/1.4 are the happy path, 1.7 is app-plugin parking,
+1.8 is leak-on-switch. If the revert misfires the user stares at a dead iframe with a live-looking
+switcher, or a second bridge is built over a destroyed frame and leaks. Both smoke runs leave 1.3 and
+1.4 "not run", so **the module with the repo's largest untrusted-input surface has never been executed
+against a real plugin by a human or by CI.**
+
+**Concrete test.** Dev build with a temporarily hostile reference plugin: flood the port and verify the
+port closes, the iframe unmounts, the switcher reverts within one frame, five activate/flood cycles
+leave the window-listener and detached-frame counts unchanged, and re-activating performs a fresh
+handshake. Pre-automate the shell half (`GAP-076`).
+
+### GAP-093 — The dashboard's local scan root is a hardcoded developer drive letter
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `cockpit/ui/src/App.svelte:localReader`, `cockpit/ui/src/lib/dashboard/adapters/local.ts:localCards#zero-docs` |
+| **governs** | `cockpit/ui/src/App.svelte`, `cockpit/ui/src/lib/dashboard/adapters/local.ts`, `cockpit/ui/src-tauri/src/local_projects.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I3 = **15** |
+| **observations** | manual_coverage_pts=5, churn_90d=8 (churn_pts=4), never_verified=true |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** `App.svelte` hardcodes
+`scanRoots: ['D:/MajorProjects'], maxDepth: 5, pins: [], excludes: []` as a literal — not from
+`import.meta.env`, a settings file, or a command — and the Rust side has no default/env/home fallback
+either. On any other machine `walkdir` swallows the io error, `scan_local_projects` returns `Ok([])`,
+and `localCards` returns `[]` with health `ok`: the LOCAL lane renders as **absence indistinguishable
+from "nothing to show"**. `localCards`' tests all inject docs, so the zero-docs path is never asserted,
+and the checklist has no PROJECTS-content row at all. The codebase already has an env-seam pattern
+(`VITE_FLEET_URL`); this reader simply doesn't use one.
+
+**Concrete test.** Automated: `localCards(reader([]))` returns `[]` and the board renders an explicit
+empty affordance rather than silence. Manual: on a machine with no `D:` drive, open PROJECTS and
+confirm the LOCAL lane says something.
+
+### GAP-094 — `Dashboard.svelte`'s entire live-wiring path is unexecuted while looking well tested
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/views/Dashboard.svelte:onMount#initialboard-absent`, `cockpit/ui/src/views/Dashboard.svelte:refresh#overlapping-polls` |
+| **risk** | L3 × I3 = **9** |
+| **observations** | coverage_pts=4, branches=4 (branch_pts=2), churn_90d=2 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** All five existing tests pass `initialBoard`, and `onMount` returns at its first line
+when that prop is set — so the seed, the first refresh, both intervals, both subscriptions and the
+teardown closure have **zero executed coverage** while the file reads as covered. That is the only path
+that runs in the real app. PROJECTS is mounted and unmounted on every tab switch, so a broken cleanup
+leaks two intervals and two listeners per visit. `refresh()` also has `try/finally` with **no catch**,
+so any adapter rejection becomes an unhandled promise rejection on every tick, silently, with `pulling`
+reset so the UI looks idle; and the 15 s interval has no in-flight guard, so slow sources stack up and
+cards can flicker backwards.
+
+**Concrete test.** Render without `initialBoard` using fake readers, fake timers, and stub subscribe
+functions: assert seeded cards, the first refresh, that a captured fleet callback advances a card, that
+timers re-poll, and that after `cleanup()` both unsubscribes ran and `vi.getTimerCount()` is 0. Then
+hold a reader's promise across three intervals and assert `status()` was called **once**.
+
+### GAP-095 — Every dashboard adapter's degradation contract is unenforced at its edges
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/dashboard/adapters/halyard.ts:halyardCards#non-array-payload`, `cockpit/ui/src/lib/dashboard/adapters/local.ts:localCards#parse-throw-escapes-try` |
+| **risk** | L3 × I3 = **9** |
+| **observations** | coverage_pts=4, branches=2 (branch_pts=1), churn_90d=2 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Both adapters promise to "degrade to `health: unknown`, never a fake stage", and
+both promises hold only for the call inside the `try`. In `halyardCards` the `statuses.map(...)` sits
+**outside** it, and the Rust side gives no shape guarantee — `run_halyard` returns whatever
+`from_str::<Value>` yields from arbitrary CLI stdout, while `api.ts` asserts
+`invoke<HalyardReleaseStatus[]>` as a compile-time lie. In `localCards`, `parseStatusFrontmatter` and
+`parseRoadmapItems` run outside the `try`, and the latter runs `marked`'s lexer on unvalidated
+third-party markdown read verbatim off disk — so **one malformed ROADMAP.md anywhere in a scanned tree
+takes down the whole board's refresh loop**, including the healthy lanes, as an unhandled rejection
+(`refresh` has no catch). Note the asymmetry: the Audience command normalizes via a tested
+`unwrap_posts`; Halyard has no equivalent.
+
+**Concrete test.** `halyardCards` with `status()` resolving to an object, `null`, and a JSON string —
+assert `health: 'unknown'` rather than a throw. `localCards` with pathological `roadmapText`/`statusText`
+— assert it resolves to cards. Plus a `store.test.ts` case asserting `pollLocal` never rejects.
+
+### GAP-096 — App-scoped Halyard proposals are written into the map under a key nothing reads
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/dashboard/adapters/halyard.ts:halyardCards#app-scoped-proposal-key` |
+| **risk** | L3 × I3 = **9** |
+| **observations** | coverage_pts=4, branches=4 (branch_pts=2), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** The map is keyed `p.release_id ?? \`app:${p.app}\`` and the
+only external read is `openByRelease.get(s.release_id)` — no `app:`-prefixed lookup exists anywhere. So
+every release-less proposal (the `release_id?` field is explicitly optional and `social_post` is the
+documented example) can never set a card Blocked and never contributes to the NEEDS YOU count. The
+board's single most valuable number under-reports: a real human gate exists in Halyard's queue and the
+operator is never told. The existing test only covers a proposal *with* a `release_id`.
+
+**Concrete test.** One status and one OPEN proposal for the same app with `release_id` undefined;
+assert the card is Blocked with gate `approval`. It is `Live` with no blocked affordance today.
+
+### GAP-097 — Both dashboard adapters map an unrecognised upstream state to a confident "Idle"
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/dashboard/adapters/audience.ts:pipelineFor#default-arm`, `cockpit/ui/src/lib/dashboard/adapters/halyard.ts:pipelineFor#default-arm` |
+| **risk** | L4 × I3 = **12** |
+| **observations** | coverage_pts=4, branches=18 (branch_pts=4), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Both `default:` arms map an unknown native state to `{ stage: null }` → `Idle` with
+`health: 'ok'` — indistinguishable from a genuinely idle project. So contract drift in either upstream
+(an Audience backend adding `scheduled`, a Halyard release-state rename) silently mis-stages real work
+as idle rather than surfacing it: the exact class of defect the whole declared-vs-inferred machinery
+exists to prevent. The tests enumerate only states that already map, so the drift arm is the one arm
+with no coverage, and nothing checks either mapping against its producer.
+
+**Concrete test.** Table-drive both adapters with absent states — audience: `scheduled`, `queued`, `''`,
+`APPROVAL-PENDING` (case drift); halyard: `canary`, `staged`, `shipped`, `null` — asserting either an
+explicit "unrecognized state: X" in `detail` with `health: 'degraded'`, or at minimum pinning today's
+behaviour so a future mapping change is visible.
+
+### GAP-098 — `dashboard/api.ts` has no test file and is the only place the four IPC command names appear
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/dashboard/api.ts:tauriHalyardReader`, `cockpit/ui/src/lib/dashboard/api.ts:tauriAudienceReader` |
+| **risk** | L3 × I3 = **9** |
+| **observations** | coverage_pts=5, branches=0 (branch_pts=1), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The one dashboard file with literally zero test execution, and the only place the
+four IPC name strings exist on the TS side. A rename on the Rust side produces no compile error, no
+type error and no test failure — it produces a runtime invoke rejection the adapters' catch blocks turn
+into a permanently greyed lane that looks exactly like "Halyard isn't installed". The generic
+parameters are erased at runtime and assert nothing. Both sides are ungated: vitest is not in CI and
+the src-tauri crate is a standalone workspace (`GAP-057`). This is also the module's only live-I/O seam
+with no injectable boundary beneath it.
+
+**Concrete test.** `api.test.ts` with `vi.mock('@tauri-apps/api/core')`: assert each method invokes the
+exact command name and returns its payload untransformed, and cross-check those four literals against
+the `generate_handler![]` list in `src-tauri/src/lib.rs` (read as a fixture, or share a generated
+constant).
+
+### GAP-099 — The dashboard's user-facing affordances — deep links, chips, footers, empty state — are asserted nowhere
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/views/Dashboard.svelte:openLink`, `cockpit/ui/src/views/Dashboard.svelte:template#health-footer-precedence`, `cockpit/ui/src/views/Dashboard.svelte:template#declared-and-conflict-chips`, `cockpit/ui/src/views/Dashboard.svelte:template#empty-state-vs-first-poll` |
+| **risk** | L3 × I3 = **9** |
+| **observations** | coverage_pts=4, branches=5 (branch_pts=2), churn_90d=2 (churn_pts=2) |
+| **anchor_sites** | 4 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Four separate holes in one template, all user-visible. `openLink` — the entire
+realisation of "every act-here affordance deep-links OUT" — is invoked by no test; both fallback layers
+are pure error-path code that has never executed, and a wrong command name or unhandleable scheme
+produces a click that silently does nothing. The four-arm health footer has no assertion, and the tests
+are **structurally incapable** of reaching three arms: fixtures use a frozen 2026-06-09 clock while the
+component reads `Date.now()`, so every card in every test is stale and greyed — the "renders the
+canonical stage" test passes on `data-stage` while the card is visually inert. The DECLARED and DRIFT
+chips — the visible half of the whole override/conflict mechanism — have never rendered. And there is
+**no loading state at all**: between mount and the first (unbounded) Halyard poll the user is told, in
+display type, "NO PROJECTS · every source is idle or unreachable", which is simply false.
+
+**Concrete test.** Use `vi.setSystemTime` so `updatedIso` is relative to a frozen clock, then assert all
+four footer arms and their precedence; render a board with an override and a conflict and assert both
+chips with their tooltips; click `act` with a mocked `invoke` and assert the command and both fallbacks;
+render with unresolved readers and assert the pre-first-poll state is not the empty state.
+
+### GAP-100 — App-plugin cards can never reach the dashboard board because the prop is never passed
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/views/Dashboard.svelte:onMount#onpluginstate-guard`, `cockpit/ui/src/App.svelte:dashboard-mount` |
+| **risk** | L3 × I3 = **9** |
+| **observations** | coverage_pts=4, branches=1 (branch_pts=1), churn_90d=8 (churn_pts=4) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** `App.svelte` mounts `<Dashboard>` with five props and
+`onPluginState` is not among them, so the guard is false in production and
+`store.ts:applyPluginState` plus the whole `appPlugin.ts` adapter — six passing unit tests across two
+files — never place a card on the real board. **This is the failure mode unit tests are worst at:
+every piece passes and the composition is unwired.** Only a wiring assertion at the App level or a
+human looking at the tab would reveal it, and neither exists (the app-plugin smoke rows are all about
+the native webview, not the board).
+
+**Concrete test.** An App-level assertion that the `<Dashboard>` instance receives an `onPluginState`
+prop, plus a live-render Dashboard case invoking the captured callback and asserting an
+`app-plugin:<id>` card appears with the mapped stage.
+
+### GAP-101 — `model.ts:isOffPipeline` is exported, unreferenced, untested — and `sortedCards` re-derives it inline
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/dashboard/model.ts:isOffPipeline`, `cockpit/ui/src/lib/dashboard/store.ts:sortedCards` |
+| **risk** | L4 × I3 = **12** |
+| **observations** | coverage_pts=5, branches=0 (branch_pts=1), churn_90d=3 (churn_pts=3) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Zero references of any kind, and `model.ts` has no test file at all. Low individual
+severity, but it points at a real hole: `sortedCards` hardcodes `if (s === 'Failed')` /
+`if (s === 'Blocked')` / `else 99` instead of using the exported predicate, so the two representations
+of "which stages are off-pipeline" can drift silently. Add a fourth off-pipeline state and
+`sortedCards` buckets it at 99 alongside Idle with no type error and no failing test.
+
+**Concrete test.** Either delete it, or add `model.test.ts` asserting `isOffPipeline` and
+`isPipelineStage` exhaustively partition the `Stage` union — then make `sortedCards` use it.
+
+### GAP-102 — The dashboard's "source unreachable" card is hand-copied three times with divergent fields
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | vitest |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/src/lib/dashboard/adapters/halyard.ts:halyardCards#catch-card`, `cockpit/ui/src/lib/dashboard/adapters/audience.ts:unknownCard`, `cockpit/ui/src/lib/dashboard/adapters/local.ts:localCards#catch-card` |
+| **risk** | L3 × I3 = **9** |
+| **observations** | coverage_pts=3, branches=3 (branch_pts=2), churn_90d=2 (churn_pts=2) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Three copies of the degraded `ProjectCard` literal with real divergences: local and
+halyard omit `family` while audience sets it; the `projectId` conventions differ; the `detail` prefixes
+differ. `ProjectCard`'s stated purpose is being the **one** render contract, so adding a required field
+means finding all three by hand — and the `downSources` banner keys off `health === 'unknown'` in all
+of them. Only two are asserted in any depth. A fourth adapter would copy it a fourth time. Related:
+every adapter also repeats a five-line options preamble that calls the injected `now()` **twice**, so a
+card's `updatedIso` and the instant used to evaluate its override TTL are different — invisible to
+tests because they all inject a frozen clock where the two coincide.
+
+**Concrete test.** Extract `sourceDownCard(source, name, detail, nowIso, staleAfterSec)` and
+`resolveAdapterOpts(opts, defaultStaleSec)` (one `now()` call), then one table-driven test across all
+sources asserting the invariant degraded-card contract and that `Date.parse(nowIso) === nowMs` exactly.
+
+### GAP-103 — The session-state SessionEnd hook has never been observed firing
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `plugins/session-state/hooks/hooks.json:SessionEnd`, `plugins/session-state/src/capture_end.mjs:module` |
+| **governs** | `plugins/session-state/hooks/hooks.json`, `plugins/session-state/src/capture_end.mjs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L4 × I2 = **8** |
+| **observations** | manual_coverage_pts=5, churn_90d=1 (churn_pts=2), never_verified=true |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The module's own spike record verified exactly two events ("Both hooks fired —
+SessionStart and Stop") and `claude plugin details` reported "Hooks (2)". `hooks.json` declares three.
+So SessionEnd — the **only** path that writes a durable timeline record from a hook, the only path that
+unlinks a finished session's scratch file, and the only caller of `prune` outside the CLI — has never
+been observed firing in a real session on any OS. `entries.test.mjs` invokes the script directly but
+asserts only the `reason === 'clear'` skip. The whole body is wrapped in a bare `try {} catch {}`
+ending in `process.exit(0)`, so if the event never arrives with the expected payload, every session's
+state is silently lost, scratch files accumulate forever, and the store never prunes — with no error
+surface anywhere.
+
+**Concrete test.** Extend the spike protocol with a SessionEnd leg: install into a throwaway
+`CLAUDE_CONFIG_DIR`, run a session, exit normally, and assert `claude plugin details` lists three hooks,
+that `timeline.jsonl` gained a `SessionEnd:<reason>` record, that the scratch file was unlinked, and
+that prune ran. Then repeat with `reason=clear` and assert nothing is appended.
+
+### GAP-104 — The Stop hook spawns eight sequential git subprocesses against a 5-second budget
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `plugins/session-state/hooks/hooks.json:Stop`, `plugins/session-state/src/capture_scratch.mjs:module`, `plugins/session-state/src/keying.mjs:repoRoot` |
+| **governs** | `plugins/session-state/src/capture_scratch.mjs`, `plugins/session-state/src/keying.mjs`, `plugins/session-state/src/gitfacts.mjs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L4 × I2 = **8** |
+| **observations** | manual_coverage_pts=5, churn_90d=3 (churn_pts=3), never_verified=true |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed, count exact.** Eight `execFileSync` git spawns on the Stop
+path, each carrying its own 5000 ms timeout, against a `"timeout": 5` (seconds) hook budget — an
+internal worst case of ~40 s. Two of the eight are pure waste: `repoRoot(cwd)` is called, then
+`stateDir(cwd)` re-enters `repoKey → repoRoot` with no memoization (`GAP-107`). This is the
+highest-frequency path in the plugin — it runs at the end of **every** assistant turn — and nothing
+anywhere bounds its latency; the spec even asserts the opposite as settled fact. The 30 s throttle is
+also confirmed to sit **after** `collectGitFacts`, because the skip condition compares the
+already-collected facts, so it saves one `writeFileSync` and no subprocess at all.
+
+**Concrete test.** Time `capture_scratch.mjs` against a large synthetic repo with a dirty worktree and
+assert wall time stays well inside 2 s. Then reorder so the throttle short-circuits before
+`collectGitFacts`, and add the missing throttle unit tests (second run does not rewrite; a real git
+change does rewrite inside the window; a corrupt scratch recovers).
+
+### GAP-105 — `capture_end` drops a timeline record and deletes the only backup in the same breath
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | node-session-state |
+| **verified_by** | automated |
+| **anchors** | `plugins/session-state/src/store.mjs:appendRecord#locktimeout-false`, `plugins/session-state/src/capture_end.mjs:module#ignores-return` |
+| **risk** | L3 × I2 = **6** |
+| **observations** | coverage_pts=4, branches=3 (branch_pts=2), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** `appendRecord` returns `false` specifically on
+`LockTimeout` — a checked-return contract — and `capture_end.mjs` calls it as a bare expression
+statement, then unconditionally unlinks its own scratch file and prunes, all inside a bare
+`try {} catch {}` with `exit(0)` and no output. So under contention the record is dropped **and** the
+scratch copy, the only other place that session's git facts survive, is deleted. `capture_rich.mjs`
+handles the identical return correctly (preserves the temp file, prints a retry), which proves the
+contract was understood and then not honoured on the auto path. `lock.test.mjs` shows `LockTimeout` is
+reachable in ~1 s of contention, and two Claude sessions in one repo is a routine setup.
+
+**Concrete test.** Pre-create `timeline.lock` holding a live-pid fresh token, run `capture_end.mjs`,
+and assert `timeline.jsonl` is unchanged **and** `scratch/<sid>.json` still exists.
+
+### GAP-106 — `withLock` steals a lock from a demonstrably live holder, and `sleep` busy-spins
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | node-session-state |
+| **verified_by** | automated |
+| **anchors** | `plugins/session-state/src/lock.mjs:withLock#age-steal-with-live-pid`, `plugins/session-state/src/lock.mjs:sleep` |
+| **risk** | L4 × I2 = **8** |
+| **observations** | coverage_pts=4, branches=11 (branch_pts=4), churn_90d=2 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Every lock test is single-process and hand-fabricates lockfiles; no test ever has
+two real processes contend. Two hazards follow from the source. The age backstop is **unconditional**:
+it steals whenever mtime exceeds `maxAgeMs` even when the recorded pid is alive — so a holder that
+stalls past 60 s (a paused debugger, a suspended laptop, a network-mounted `~/.claude`) has its lock
+taken while still inside `fn()`, producing two concurrent writers doing `appendFileSync` plus a full
+`latest.md` rewrite. The ownership-checked release stops the loser deleting the winner's lock but does
+nothing about the two bodies running at once — that is the actual data-loss window. Second, `sleep` is
+a hard busy-spin, so contention burns a core for up to `tries * backoffMs` inside a hook that fires
+every turn; no test has ever paid that cost.
+
+**Concrete test.** Spawn eight child processes each calling `appendRecord` against one shared temp dir;
+assert `readTimeline(dir).length === 8`, that the raw line count matches (`readTimeline` swallows torn
+lines), and that `latest.md` is complete rather than a truncated interleave. Add a holder-stalls-past-
+`maxAgeMs` case asserting the two appends do not interleave.
+
+### GAP-107 — Two `repoRoot` spawns per hook, and a torn `git status` renders as a real branch called `null`
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | node-session-state |
+| **verified_by** | automated |
+| **anchors** | `plugins/session-state/src/keying.mjs:stateDir`, `plugins/session-state/src/keying.mjs:repoKey`, `plugins/session-state/src/gitfacts.mjs:collectGitFacts#status-failure` |
+| **risk** | L3 × I2 = **6** |
+| **observations** | coverage_pts=4, branches=9 (branch_pts=3), churn_90d=3 (churn_pts=3) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** All three capture entries do `repoRoot(cwd)` then `stateDir(cwd)`, and `stateDir`
+re-enters `repoRoot` internally — the same subprocess twice, on the timeout-constrained path
+(`GAP-104`). It is also a correctness hazard: `repoRoot` is evaluated at two different instants, so a
+transient failure yields `repo` and `dir` derived from different roots, which `checkMeta` then reports
+as a spurious COLLISION. Separately, `collectGitFacts`' status IIFE does `catch { return "" }`, and
+`parsePorcelainV2("")` returns `{branch: null, detached: false, dirty: []}` — indistinguishable from a
+clean attached repo. `head` is still populated from the separate `git log`, so `fmtGit` renders the
+literal ``branch `null` @ abc1234``, and that garbage record becomes the freshest entry the next
+session's resume block reads.
+
+**Concrete test.** A spawn-counting test (PATH-shadow `git` with a counter) asserting at most one
+`rev-parse --show-toplevel` per capture. Plus a PATH-shadowed git that fails only on `status`, asserting
+the result is rejected or clearly marked degraded rather than reporting `branch: null`.
+
+### GAP-108 — The session-state hook contract is validated only for file existence
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | node-session-state |
+| **verified_by** | automated |
+| **anchors** | `plugins/session-state/hooks/hooks.json:SessionStart`, `plugins/session-state/src/resume.mjs:module#source-gate`, `plugins/session-state/test/manifest.test.mjs:manifest-validity` |
+| **risk** | L3 × I2 = **6** |
+| **observations** | coverage_pts=4, branches=4 (branch_pts=2), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The source gate is written twice — declaratively as `"matcher": "startup|resume"`
+and imperatively as `["startup","resume"].includes(data.source)` — and the spec calls the alignment
+deliberate. Nothing checks it. `manifest.test.mjs` asserts exactly one thing per hook: that the script
+file exists. It never looks at the matcher, at `type`/`command`, or at the Stop entry's `timeout: 5` —
+so widening the matcher produces hooks that fire and silently no-op, narrowing it kills resume with no
+failing test, and dropping the timeout field (the only thing bounding the every-turn hook) passes
+everything. The hook contract **is** this module's real entry point.
+
+**Concrete test.** Read `hooks.json`, split the SessionStart matcher on `|`, and assert the set equals
+the array `resume.mjs` gates on (export it and import it in both). Same for `capture_end.mjs`'s SKIP
+set. Assert every entry has `type: 'command'`, `command: 'node'`, an `args[0]` under
+`${CLAUDE_PLUGIN_ROOT}/`, and that Stop still carries a numeric timeout.
+
+### GAP-109 — `capture_rich`'s four failure arms are the plugin's only user-visible errors and none is tested
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | node-session-state |
+| **verified_by** | automated |
+| **anchors** | `plugins/session-state/src/capture_rich.mjs:module#failure-arms`, `plugins/session-state/src/store.mjs:prune#locktimeout-skip` |
+| **risk** | L3 × I2 = **6** |
+| **observations** | coverage_pts=4, branches=7 (branch_pts=3), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `entries.test.mjs` exercises only the success path, and the `/save-state` skill
+tells the model to read and relay these arms. Two concrete defects sit in that dead text: the retry
+command it prints is `node capture_rich.mjs --input ${input}` — a bare relative script name that cannot
+run from the user's cwd, handed to a user the skill instructs not to blind-retry — and `${input}` is
+interpolated **unquoted**, so any temp path containing a space (routine on Windows) produces a broken
+command anyway. The spec mandated "a fixture path containing a space" and no test in the suite uses
+one. Bundled here: `prune`'s `LockTimeout` arm silently abandons truncation with no retry and no
+signal, and its only automatic caller is the SessionEnd hook that may never fire (`GAP-103`).
+
+**Concrete test.** Table-drive the four arms (no input; malformed JSON; repo-key collision; lock held)
+asserting exit code, the message, and that the temp file is preserved — with a fixture dir whose name
+contains a space, and asserting the printed retry command is absolute and shell-quoted. Plus a held-lock
+`prune` asserting the file is untouched and a later uncontended prune truncates.
+
+### GAP-110 — `npm test` — 135 tests over the whole cockpit UI — is not in CI
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | build_ci_gate |
+| **verified_by** | automated |
+| **anchors** | `.github/workflows/ci.yml:jobs`, `cockpit/ui/package.json:scripts.test` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=2 (branch_pts=1), churn_90d=4 (churn_pts=3) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Verified: the only npm invocations anywhere in `.github/workflows` are `npm ci`,
+`npm run sidecar`, `npm run tauri build`, and `npm run sidecar:release`. The 19 vitest files gate
+nothing on push or PR; the only thing CI proves about the UI is that `vite build` compiled it.
+**Every UI entry in this plan inherits this** — including every test the automatable smoke items below
+would add. Orchestrator captured a real run this session: 135/135 green, so the suite is real and
+healthy and simply ungated.
+
+**Concrete test.** `scripts/ci-shape.test.mjs` (node:test, added to the `embargo` job which already runs
+`node --test`): parse `ci.yml` with js-yaml and assert some step's `run` matches `/npm (run )?test|vitest/`.
+Fails today; passes once the step is added.
+
+### GAP-111 — `npm run check` (353 files) is not in CI, and two source files are typechecked by nothing
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | build_ci_gate |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/package.json:scripts.check`, `cockpit/ui/tsconfig.node.json:include` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=0 (branch_pts=1), churn_90d=4 (churn_pts=3) |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `check` = `svelte-check --tsconfig ./tsconfig.app.json && tsc -p tsconfig.node.json`,
+invoked by no workflow step. `vite build` (the `beforeBuildCommand`) strips types without checking them,
+so a type error in a `.svelte`/`.ts` file is invisible to CI end to end. `SPIKE-RESULTS.md` records that
+`npm run check` was not even *runnable* at session start (empty `node_modules`) — exactly how a
+never-CI'd gate rots. Compounding it: `tsconfig.node.json:include` is `["vite.config.ts"]` only and
+`tsconfig.app.json` is `src/**`, so `vitest.config.ts` and `cockpit/ui/scripts/build-sidecar.mjs` are
+typechecked by nothing even if `check` were wired in — and `tsconfig.node.json` is the only project
+enabling `noUnusedLocals`/`noFallthroughCasesInSwitch`, applied to exactly one 9-line file.
+
+**Concrete test.** Assert a `ci.yml` step runs `npm run check`; separately assert every tracked
+`.ts`/`.mjs` under `cockpit/ui` (excluding `node_modules`/`dist`) is matched by exactly one project's
+`include`.
+
+### GAP-112 — Three whole test suites outside the Rust workspace are invoked by no gate
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | build_ci_gate |
+| **verified_by** | automated |
+| **anchors** | `.github/workflows/ci.yml:jobs.test`, `plugins/session-state/test`, `tools/budget-checkpoint/pyproject.toml:[tool.pytest.ini_options]`, `tools/cache-countdown/pyproject.toml:[tool.pytest.ini_options]` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=0 (branch_pts=1), churn_90d=4 (churn_pts=3) |
+| **anchor_sites** | 4 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Verified and captured green this session: `node --test
+"plugins/session-state/test/*.test.mjs"` → 52/52, `uv run pytest` in `budget-checkpoint` → 24, in
+`cache-countdown` → 29. **None of the three is invoked by any workflow step.** There is no
+`package.json` under `plugins/session-state` and the strings `python`, `pytest` and `uv` appear nowhere
+in `.github/workflows`. All three back things that run on the maintainer's machine on every session —
+Stop hooks, SessionStart hooks, the session timeline — so a regression merged to `main` silently
+degrades every future Claude Code session, and 105 passing tests would never notice.
+
+**Concrete test.** Add the two steps (`node --test` needs no `package.json`; both pyprojects already set
+`testpaths` and a pytest dev group, so `uv run pytest` is one line each) and assert their presence in
+`scripts/ci-shape.test.mjs` so they cannot be quietly dropped again.
+
+### GAP-113 — No lint, format, or static-analysis gate exists anywhere
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | build_ci_gate |
+| **verified_by** | automated |
+| **anchors** | `.github/workflows/ci.yml:jobs` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=0 (branch_pts=1), churn_90d=4 (churn_pts=3) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Exhaustive grep: `clippy`, `rustfmt` and `cargo fmt` appear in zero files under
+`.github/`, `.githooks/`, and every `Cargo.toml`; there is no eslint or prettier either. Clippy catches
+several correctness-adjacent classes this codebase is actively exposed to for free — `await` while
+holding a lock, blocking calls in async contexts, needless clones in the supervisor's threads — and it
+has no automated reader. Given the repo's history (`GAP-005`), a lint that flags blocking-in-async is
+disproportionately valuable here.
+
+**Concrete test.** Add a `lint` job running `cargo clippy -- -D warnings` and `cargo fmt --check` over
+the root workspace **and** over `cockpit/ui/src-tauri` (which needs its own `--manifest-path`, per
+`GAP-057`), then assert both in `scripts/ci-shape.test.mjs`.
+
+### GAP-114 — `release.yml` signs and publishes without running a single test
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | build_ci_gate |
+| **verified_by** | automated |
+| **anchors** | `.github/workflows/release.yml:jobs.release` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=5, branches=2 (branch_pts=1), churn_90d=2 (churn_pts=2) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed.** One job, no `needs:`, no test command: checkout → toolchain
+→ cache → node → apt → `npm ci` → `npm run sidecar:release` → `tauri-action` with `releaseDraft: true`.
+And the refuter found the sharper point: `ci.yml` triggers on `push: branches: ["**"]` and
+`pull_request` — **a tag ref is not a branch**, so `cargo test --workspace` does not even run on a `v*`
+tag push. A tag from a red branch produces a signed, notarized, published release; a human clicking
+publish is a review step, not a gate. `ci.yml`'s own `build` job has `needs: test`, so the pattern
+exists and was omitted here.
+
+**Concrete test.** Assert the `release` job either contains a test step or a `needs:` on a job that
+does, before the `tauri-action` step. Cheapest real fix: `uses: ./.github/workflows/ci.yml`.
+
+### GAP-115 — The Docker integration tests run nowhere, on any schedule
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | build_ci_gate |
+| **verified_by** | automated |
+| **anchors** | `.github/workflows/ci.yml:jobs.test#ignored-its`, `crates/fleetd/tests/local_docker_it.rs`, `crates/fleetd/tests/preflight_it.rs` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=0 (branch_pts=1), churn_90d=4 (churn_pts=3) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Documented as deliberate at `ci.yml` lines 9–14 and 93–94, and the documentation is
+honest — but "documented" is not "covered". The real container lifecycle, the thing the product does, is
+verified only when a human remembers to run it locally, and nothing records whether anyone ever has.
+One correction to the header's framing: `swarm_smoke_it.rs` is ignored for **git network access**, not
+Docker, and `demo_mode_it.rs` is not ignored and does run. Note also that many behaviours currently
+guarded only by these files are reclassifiable to plain `cargo test` via fake seams — see `GAP-023`,
+`GAP-116`, `GAP-117`.
+
+**Concrete test.** A scheduled `.github/workflows/nightly-it.yml` on a self-hosted/dind runner running
+`cargo test --workspace -- --ignored`, plus an assertion in `scripts/ci-shape.test.mjs` that such a
+workflow exists so the gap cannot be quietly forgotten.
+
+### GAP-116 — `FakeRunner` cannot fail, so the Docker error arms are unreachable from CI
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/fake.rs:provision#no-failure-knob`, `crates/fleetd/src/fake.rs:list_unit_containers#no-failure-knob`, `crates/fleetd/src/driver.rs:drive#provisioning-err-arm` |
+| **risk** | L4 × I4 = **16** |
+| **observations** | coverage_pts=4, branches=0 (branch_pts=1), churn_90d=10 (churn_pts=4) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `FakeRunner::provision` returns `Ok(Handle)` unconditionally with no failure knob,
+so the driver's `Provisioning` Err arm (`ErrorScope::Docker` → `FatalError`) is structurally
+unreachable from any non-ignored test — error scope, permit release, terminal phase and whether the
+cockpit sees `Done(failed)` are all unverified. The fake already models one failure
+(`oracle_read_fails`), so the pattern exists. Worse, `list_unit_containers` on the real runner returns
+`Ok(vec![])` when `docker ps` exits non-zero — "no containers running", a lie that propagates straight
+into reconciliation, so a stopped daemon makes every non-terminal unit `HaltNoContainer` (halted while
+its container may be alive and spending) and every genuine orphan invisible. `reconcile.rs`'s decision
+function is densely tested, which makes this **look** covered; the input-corruption step is what is
+untested. **Both are fully reclassifiable from human-QA to plain `cargo test`.**
+
+**Concrete test.** Add `FakeRunner::provision_fails()` and `list_fails()`. Assert the Provisioning Err
+arm's full contract, and assert `reconcile_on_startup`/`reconcile_tick` emit no `ReapStray`/
+`HaltNoContainer` for units whose container state is merely *unknown*.
+
+### GAP-117 — `trial_merge`'s Conflict half and cleanup are testable with git alone and are tested nowhere
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/gh_forge.rs:trial_merge`, `crates/fleetd/src/gh_forge.rs:ensure_clone`, `crates/fleetd/src/gh_forge.rs:open_pr` |
+| **risk** | L4 × I4 = **16** |
+| **observations** | coverage_pts=4, branches=1 (branch_pts=1), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `trial_merge` is the gate that decides whether a paid agent run becomes a PR, and
+its Conflict half has zero coverage anywhere. Its cleanup is unverified too: `git merge --abort` is
+fired with `let _ =` after both outcomes, but abort **errors** when the merge was a fast-forward or
+already up to date — which would leave the shared host clone in a detached mid-merge state poisoning
+the next unit that reuses the path. `ensure_clone` full-clones into `temp_dir()` per unit with no
+timeout and no size bound, and **nothing ever deletes it** (only the ignored ITs clean up after
+themselves), so every real mission permanently leaks a repo clone — as does `export_bundle`'s
+`.bundle` file. `open_pr` collapses every outcome into `ForgeError::Failed(stderr)`: no rate-limit
+handling at all, in stark contrast to `retry.rs` on the Anthropic side, and "a PR already exists for
+this branch" (the normal outcome of any resume) is fatal rather than idempotent.
+
+**Concrete test.** **Needs only `git` and a `file://` fixture — no Docker, no GitHub, so it runs in
+CI.** Build a bare origin plus a `git bundle`; assert Clean and Conflict outcomes, and that after
+*either* the host clone is clean (`git status --porcelain` empty, no `MERGE_HEAD`). Make the `git`/`gh`
+program names injectable and drive `open_pr` against stub scripts emitting canned stderr and exit codes.
+
+### GAP-118 — `local_docker`'s pure validators and exit-code mappings are untested, and two write paths swallow failure
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/local_docker.rs:valid_repo_url`, `crates/fleetd/src/local_docker.rs:has_diff#exit-code-polarity`, `crates/fleetd/src/local_docker.rs:commit_all#nothing-to-commit`, `crates/fleetd/src/local_docker.rs:discard#swallowed-result` |
+| **risk** | L4 × I4 = **16** |
+| **observations** | coverage_pts=4, branches=5 (branch_pts=2), churn_90d=9 (churn_pts=4) |
+| **anchor_sites** | 4 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `valid_git_branch` has a dedicated injection test; its sibling `valid_repo_url` —
+which guards the value handed to `git clone` inside the container, fed from an API-supplied
+`UnitSpec.repo_url` and from `CC_REPO_URL` — has none at all: five boolean terms, zero assertions, and
+nothing pins that `file://`, `ext::` and `http://` stay rejected. `has_diff` maps **any** non-zero exit
+to "there is a diff", including git's 128 for a bad ref, routing a broken unit into bundle export and a
+real PR instead of NO_CHANGE; only the `true` side is ever observed. `commit_all` collapses "clean
+tree" together with every genuine git failure into `Ok(false)`. And `discard`/`teardown` swallow both
+docker calls with `let _ =` and return `Ok(())`, so a container that refuses to die or a volume that is
+not removed is indistinguishable from success.
+*(A related claim — that `discard`'s `replacen("cc_", "ccvol_", 1)` mis-targets — was Phase-3 downgraded
+to **uncertain**: every reachable `Handle.id` today starts with `cc_`, so the rewrite is correct. The
+unenforced prefix coupling and the swallowed result remain real and are what this entry covers.)*
+
+**Concrete test.** Table-test `valid_repo_url` mirroring the existing branch-validator test; extract and
+table-test the two exit-code mappings over `0`, `1`, `128`; and assert `derived_volume(handle) ==
+volume_name(unit_id)` over hostile ids including ones containing `cc_` internally.
+
+### GAP-119 — Failed and halted units keep their volumes forever, and nothing has ever looked
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `crates/fleetd/src/local_docker.rs:teardown`, `crates/fleetd/src/local_docker.rs:reap_unit` |
+| **governs** | `crates/fleetd/src/local_docker.rs`, `crates/fleetd/src/reconcile.rs` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L5 × I4 = **20** |
+| **observations** | manual_coverage_pts=5, churn_90d=9 (churn_pts=4), never_verified=true |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** By design `teardown` and `reap_unit` remove the container and **keep** the
+`ccvol_<unit>` volume; `discard` — the only thing that removes one — runs solely on Done/NoChange/
+Abandon, and `GAP-021` shows even the Done path can skip it. So every failed unit, every
+halted-then-forgotten unit, and every unit whose driver died leaves a permanent named volume holding a
+full repo clone, reachable directly from `serve.rs → reconcile_*  → reap_unit`. Automated coverage is
+zero in the sense that matters (the fake models no volumes; the ignored ITs never inspect
+`docker volume ls`). **Manual coverage is also zero**: Gate 5's recorded PASS is `docker ps` — containers
+only. Unbounded disk growth verified by neither machine nor human. Add the abnormal-exit case too:
+nothing reaps a container at process exit, so a `kill -9` leaves the agent running with the API key
+until someone restarts the daemon.
+
+**Concrete test.** Add `docker volume ls --filter name=ccvol_ -q` to the Gate 5 row and an abnormal-exit
+row. Automate the decision half now: assert a unit terminating in `Failed` bumps `teardowns` and not
+`discards`, then add a tested, bounded reaping policy with a pure "which volumes are eligible" function.
+
+### GAP-120 — The fake and the real runner disagree on what a valid `UnitSpec` is
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | rust-workspace |
+| **verified_by** | automated |
+| **anchors** | `crates/fleetd/src/fake.rs:provision#skips-spec-validation`, `crates/fleetd/src/local_docker.rs:provision#spec-validation`, `crates/fleetd/src/gh_forge.rs:guard_branch` |
+| **risk** | L3 × I4 = **12** |
+| **observations** | coverage_pts=2, branches=4 (branch_pts=2), churn_90d=10 (churn_pts=4) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `FakeRunner::provision` accepts any spec; `LocalDockerRunner::provision` rejects it
+on `valid_repo_url`/`valid_git_branch`. Demo mode is the advertised "try it cold" path and
+`demo_mode_it.rs` runs entirely on the fake — so a mission that passes cleanly in demo can fail at
+provision in real mode with "unsafe branch name", **after** the user has committed to a paid run. The
+exposure is real: swarm branches are built from planner-generated text
+(`agent/{swarm_id}/{idx}-{slug}`) and only the slug half is sanitized. Compounding it, the identical
+four-clause branch allowlist is implemented twice — `valid_git_branch` (bool) and `guard_branch`
+(Result) — each with its own test corpus, and nothing asserts they agree; loosen one and a name accepted
+at provision is rejected at PR time, killing a unit after it has paid for the whole run.
+
+**Concrete test.** Move the checks into a shared `validate_spec(&UnitSpec)` called by **both** runners,
+then assert a demo swarm whose planner-chosen title yields a hostile branch fails identically to real.
+Separately assert `valid_git_branch(s) == guard_branch(s).is_ok()` over one shared corpus.
+
+### GAP-121 — The load-bearing sidecar-before-bundle order is written four times and CI does not reuse it
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | build_ci_gate |
+| **verified_by** | automated |
+| **anchors** | `cockpit/ui/package.json:scripts.bundle`, `.github/workflows/ci.yml:jobs.build`, `cockpit/ui/scripts/build-sidecar.mjs:dest` |
+| **risk** | L3 × I5 = **15** |
+| **observations** | coverage_pts=4, branches=2 (branch_pts=1), churn_90d=7 (churn_pts=4) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The ordering `ci.yml` calls "LOAD-BEARING" is spelled out in four places
+(`scripts.desktop`, `scripts.bundle`, `ci.yml`, `release.yml`) and asserted only by prose. CI does
+**not** reuse `npm run bundle`; it re-implements the order with the **debug** sidecar, so the CI bundle
+is not the bundle `release.yml` produces — which matters because Part 2 (`GAP-012`) has never launched
+either. `build-sidecar.mjs` itself has no test at all: not the triple regex `/host:\s*(\S+)/` (silently
+throws on a rustc output change), not the win32 `.exe` suffix, not the release/debug fork, not the
+`../..` relative cwd. A silent rename here surfaces as an opaque Tauri `externalBin` compile failure on
+three OSes at once. Also worth fixing: `build-sidecar.mjs`'s header claims `tauri build` wires the
+release sidecar via `beforeBuildCommand`, but `tauri.conf.json` sets that to `npm run build` (vite
+only) — the comment is wrong and no test would notice.
+
+**Concrete test.** Assert any job invoking `tauri build` is immediately preceded by a
+`sidecar`/`sidecar:release` step, and that CI uses the same composite script `package.json` defines.
+Plus `build-sidecar.test.mjs` stubbing `rustc`/`cargo` on PATH and asserting the copied filename is
+exactly what `externalBin` resolves.
+
+### GAP-122 — The embargo guard's `--all` mode, its skip paths, and its only write path are untested
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | node-embargo |
+| **verified_by** | automated |
+| **anchors** | `scripts/embargo-guard.mjs:modeAll`, `scripts/embargo-guard.mjs:runOverFiles#skip-paths`, `scripts/embargo-guard.mjs:modeAddEntry` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=4, branches=6 (branch_pts=3), churn_90d=3 (churn_pts=3) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The guard is the repo's one real security gate and one of only two things CI runs —
+yet `embargo-guard.test.mjs` exercises only `--staged` and `--message`. **`--all` is the mode CI
+actually invokes** and has zero direct coverage, and it differs materially: it reads the working tree
+while `--staged` reads the staged blob. The header states "we report every skip rather than passing
+silently — a guard that quietly declines to look at something reads as clean when it never checked" —
+and nothing tests that: `MAX_BYTES`, the unreadable catch, and especially `isBinary` (a NUL in the first
+8000 bytes) are all exit-0 paths, and `isBinary` skips with **no warning at all**, so a token in a
+UTF-16 doc passes as clean. Worst of all, `modeAddEntry` — the only write path and the only way a
+denylist is ever created — is invoked by no test; every test hand-rolls its denylist via a helper that
+duplicates the salt+digest derivation. If the two ever disagree, every test still passes and every real
+denylist silently matches nothing.
+
+**Concrete test.** Add `--all` cases (clean and leaking, plus an `ls-files` entry missing on disk); a
+>8 MiB file, a NUL-containing file, and an unreadable file each asserting a **reported** skip; and a
+`--add-entry` case asserting the written digest/salt, that the plaintext token appears nowhere in the
+file, that re-adding exits 1, and that a second add preserves the first entry.
+
+### GAP-123 — The git hooks and CI's inline commit-message range are shell nothing executes
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | build_ci_gate |
+| **verified_by** | automated |
+| **anchors** | `.githooks/pre-commit:GUARD_ROOT`, `.githooks/commit-msg:GUARD_ROOT`, `.github/workflows/ci.yml:jobs.embargo#base-ref-fallback` |
+| **risk** | L4 × I5 = **20** |
+| **observations** | coverage_pts=5, branches=2 (branch_pts=1), churn_90d=4 (churn_pts=3) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The guard-side half is tested; the **hook** side is not tested at all.
+`GUARD_ROOT="$(cd "$(dirname "$0")/.." && pwd)"` and the node-missing fail-closed branch are shell no
+test executes — and the pre-commit comment records the exact incident it prevents (a relative
+`core.hooksPath` makes git find no hook in a worktree and silently commit), which is precisely the
+condition nothing verifies. Bundled here: `ci.yml`'s embargo job contains bespoke inline shell that
+exists only in the YAML and runs only on GitHub, with two untested branches — the base-ref fallback and
+the `git rev-parse --verify` guard that degrades to `git log -50`. If the range resolves wrong the guard
+scans the wrong commits and reports clean; the fallback also silently caps at 50, so on a long branch
+older commits are never scanned and the failure mode is a **pass**.
+
+**Concrete test.** `scripts/githooks.test.mjs`: a scratch repo with an absolute `core.hooksPath`,
+asserting a leaking commit is rejected and no commit object created; a `git worktree` case asserting
+`GUARD_ROOT` resolves back to the guard-bearing checkout; and a no-node PATH case asserting exit 1.
+Extract the CI shell into `scripts/collect-commit-messages.sh` and cover both branches.
+
+### GAP-124 — `demo-restart-recovery.mjs` is the only end-to-end durability check and nothing runs it
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | dev_scripts |
+| **verified_by** | automated |
+| **anchors** | `scripts/demo-restart-recovery.mjs:main` |
+| **risk** | L4 × I3 = **12** |
+| **observations** | coverage_pts=5, branches=8 (branch_pts=3), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Nothing references it: no workflow step, no test, no other script. It is the only
+artifact that exercises the headline "recovers durably across restarts" claim end to end — SIGKILL, cold
+process, same SQLite file — and it runs only when a human types it, against a `target/debug/serve`
+binary that must already exist (it exits 2 otherwise, so a stale build makes it a silent no-op). Its
+PASS condition is real; it is simply never evaluated. Closely related to `GAP-041`, which is the same
+durability claim at the unit level.
+
+**Concrete test.** Port the invariant into `crates/fleetd/tests/restart_recovery_it.rs` (or extend the
+non-ignored `demo_mode_it.rs`): dispatch a demo unit against a temp SQLite path, abort the server task,
+reopen the store, and assert the reconstructed event log length equals the pre-kill length and is > 0 —
+the same check the script prints, but as an assertion inside `cargo test --workspace`.
+
+### GAP-125 — `index.html` loads Google Fonts against a CSP that has no `font-src` and no such origin
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `cockpit/ui/index.html:head` |
+| **governs** | `cockpit/ui/index.html`, `cockpit/ui/src-tauri/tauri.conf.json` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L4 × I3 = **12** |
+| **observations** | manual_coverage_pts=5, churn_90d=1 (churn_pts=2), never_verified=true |
+| **anchor_sites** | 1 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** `index.html` loads Oxanium and IBM Plex Mono from `fonts.googleapis.com` /
+`fonts.gstatic.com` while `tauri.conf.json` sets `default-src 'self'; style-src 'self' 'unsafe-inline'`
+with **no `font-src`** and no googleapis origin — so the packaged webview should refuse the stylesheet
+and silently fall back to system fonts. Whether this already manifests in dev or only packaged is
+**unverified** (the app could not be launched during this run). Either way the app depends on network
+reachability at startup for its typography, unverified offline. Nothing in the 19-file vitest suite or
+in either workflow reads `index.html` at all.
+
+**Concrete test.** A vitest case reading `index.html` and `tauri.conf.json` and asserting every external
+origin referenced by a `<link>`/`<script>` is permitted by the directive that governs it — which fails
+today. Pair with a human check: launch the packaged app offline and confirm the typography is
+intentional rather than accidental fallback.
+
+### GAP-126 — The PowerShell hooks Claude Code actually executes are tested by nothing, in any repo language
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | pytest |
+| **verified_by** | automated |
+| **anchors** | `tools/budget-checkpoint/hooks/budget-checkpoint.ps1:script`, `tools/cache-countdown/hooks/cache-timer-write.ps1:script`, `tools/cache-countdown/hooks/cache-timer-resume.ps1:script` |
+| **risk** | L4 × I2 = **8** |
+| **observations** | coverage_pts=5, branches=9 (branch_pts=3), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** These are the processes Claude Code spawns on **every Stop event on the user's
+machine**, and nothing tests PowerShell anywhere in this repo. Concrete hazards visible in 31 lines:
+the shim pipes `uv run`'s stdout straight through to Claude Code, whose hook-output contract is strict
+JSON — so any uv resolution notice on a cold `--project` dir yields malformed hook output; the
+`try{}catch{}` is dead cover, because with `$ErrorActionPreference='Continue'` a native non-zero exit
+does not raise a terminating error; and `uv run` cold start can exceed the 10 s hook timeout
+`install.ps1` writes into settings.json, stalling the end of every turn. On the cache-countdown side,
+`cache-timer-write.ps1` is the **sole producer** of the state file the feature consumes and its format
+is only ever approximated in tests by a hand-written timestamp literal; it does an unlocked
+read-modify-write of a file the resume hook also writes, and `$sid` is interpolated straight into a
+path with no sanitization. The two hooks are also ~40 identical lines differing only in one boolean.
+
+**Concrete test.** A pwsh harness with a stub `uv` on PATH: assert stdout is byte-exact (a stub printing
+chatter before the JSON must FAIL), exit code 0 on stub exits 1/2/127 and when `uv` is absent, and
+completion inside 10 s cold. For the timer hooks, pipe a realistic Stop payload with `$env:USERPROFILE`
+at a temp dir and feed the result straight into `core.read_timer_file`, then repeat for empty stdin,
+non-JSON, a missing `session_id`, a `session_id` containing path separators, a corrupt existing file,
+and a drive-root `cwd`. Extract the shared body into one `Write-CacheTimer -Stopped <bool>` first.
+
+### GAP-127 — `deploy_globals.py` mutates the user's real `settings.json` and `CLAUDE.md` with no tests at all
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | pytest |
+| **verified_by** | automated |
+| **anchors** | `tools/lane-z-integration/deploy_globals.py:merge_settings`, `tools/lane-z-integration/deploy_globals.py:append_claude_md`, `tools/lane-z-integration/deploy_globals.py:deploy_tools`, `tools/lane-z-integration/deploy_globals.py:recall_command` |
+| **risk** | L4 × I2 = **8** |
+| **observations** | coverage_pts=5, branches=13 (branch_pts=4), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 4 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The only code in the module that mutates files the README itself flags as having
+"no git rollback", and `tools/lane-z-integration/` has no pyproject and no tests directory. Four
+distinct defects are visible: the idempotency guard is an exact string compare against a freshly
+rendered absolute path, so any separator or quoting difference **appends a duplicate SessionStart hook
+on every run**; `json.loads` on the existing settings is unguarded and raises *after* `backup()` and
+`deploy_tools()` have already run, leaving a partially-applied deploy with no unwind;
+`append_claude_md` warns "would create it" and then, under `--apply`, actually writes — the one case
+with no backup, since `backup()` returns early for a nonexistent file; and `recall_command` hardcodes
+the bare interpreter name `python`, which on a stock Windows box is frequently the Store
+app-execution alias, silently making the recall hook dead at every session start (indistinguishable
+from "no memory yet", because `recall.py` prints nothing in that case).
+
+**Concrete test.** pytest against a temp `--config-dir`: run `--apply` twice and assert exactly one
+recall entry, including when the same hook is spelled with different separators; a malformed existing
+settings.json asserting a clear failure with CLAUDE.md untouched; the create path asserting the message
+matches what actually happens; and an execution test that the emitted `recall_command` runs, with a
+config dir containing a space.
+
+### GAP-128 — `context-offload` has no test infrastructure, and its update path corrupts on any Windows path
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-branch` |
+| **layer** | pytest |
+| **verified_by** | automated |
+| **anchors** | `tools/context-offload/offload.py:upsert_index#regex-replacement-escape`, `tools/context-offload/offload.py:resolve_memory_dir#unsanitized-slug`, `tools/context-offload/recall.py:main` |
+| **risk** | L4 × I2 = **8** |
+| **observations** | coverage_pts=5, branches=7 (branch_pts=3), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** No pyproject, no tests directory — not one line executes under any harness — and
+`recall.py` is a **live SessionStart hook** with a 5 s timeout whose stdout is injected verbatim into
+the model's context. Three concrete defects: `upsert_index` passes the caller-supplied entry as a regex
+**replacement template**, so a summary containing `D:\proj\...` raises `re.error: bad escape \p` — and
+only on the *second* offload of the same slug, exactly the idempotent re-run the docstring advertises
+as safe; an explicit `--slug` bypasses `slugify` entirely, so a traversal writes outside the memory
+store, and the caller composing that argument is an LLM; and `render_hook` does no escaping of note
+titles or summaries, making the memory store an unescaped prompt-injection surface into every future
+session, with `--max-notes` defaulting to unbounded so the tool built to reduce token cost injects the
+whole index. Exit code is hardcoded 0, so every failure is silent.
+
+**Concrete test.** Stand up a pyproject and tests dir, then: `upsert_index` with a backslash path, `\1`,
+and `\g<0>` in the summary asserting literal insertion; `--slug '../../evil'` and `'a/b'` asserting
+rejection; and `main()` against a temp `CLAUDE_CONFIG_DIR` asserting `--format hook` prints **nothing**
+for a zero-entry index, that a summary containing `</session-memory>` cannot break the envelope, and
+that a 500-entry index stays inside the 5 s budget.
+
+### GAP-129 — cache-countdown's headline feature is inert, and its self-test cannot fail
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `manual-uncovered` |
+| **layer** | manual |
+| **verified_by** | manual |
+| **anchors** | `tools/cache-countdown/src/cache_countdown/core.py:cost_at_stake`, `tools/cache-countdown/src/cache_countdown/ticker.py:_self_test` |
+| **governs** | `tools/cache-countdown/**` |
+| **last_manual_pass** | — (never_verified) |
+| **risk** | L4 × I2 = **8** |
+| **observations** | manual_coverage_pts=5, churn_90d=1 (churn_pts=2), never_verified=true |
+| **anchor_sites** | 2 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** **Phase-3 confirmed on both halves.** cost-at-stake leads the pyproject description
+and the README, but no writer in the repo ever populates `cached_tokens` — the two PowerShell hooks set
+only `session_id`, `stopped`, `timestamp`, `project`, `cwd`, and merely copy pre-existing keys forward.
+So `cost_at_stake` returns `None` on every real tick and the dollar figure never renders. Every test
+that exercises it hand-injects the value, and `_self_test` injects the same constant — so **the one
+human-facing check actively conceals the gap** by always displaying a cost the production path cannot
+produce. And `_self_test` asserts nothing at all: it prints "N bells rung (expected … 6)" and
+unconditionally `return 0`, so an operator seeing "4 bells rung" still gets a zero exit. (In fairness,
+`core.py` and the README do disclose the missing writer in prose.)
+*(A related claim — that `ticker.state_dir` and the hooks resolve `~/.claude` to different directories
+under `CLAUDE_CONFIG_DIR` — was **Phase-3 refuted**: on Windows `Path.home()` resolves via `USERPROFILE`,
+the same directory the hooks write to, and `recall.py` shares no file with the ticker. A latent
+inconsistency, not a live defect. Recorded so it is not re-flagged.)*
+
+**Concrete test.** Make `_self_test` compare against the expected bell count and stage sequence and
+return non-zero on mismatch, then add a pytest that monkeypatches `bells_crossed` to 0 and asserts it
+fails. Separately drive the real producer end to end: run `cache-timer-write.ps1`, then
+`cache-countdown --file <that file> --once`, and assert explicitly whether a cost figure is present —
+either wire a `cached_tokens` writer or document the feature as inert.
+
+### GAP-130 — Both Python tools' console-script entry points are the untested side of the process boundary
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `untested-symbol` |
+| **layer** | pytest |
+| **verified_by** | automated |
+| **anchors** | `tools/budget-checkpoint/src/budget_checkpoint/hook.py:main`, `tools/cache-countdown/src/cache_countdown/ticker.py:main`, `tools/budget-checkpoint/src/budget_checkpoint/core.py:count_turns` |
+| **risk** | L3 × I2 = **6** |
+| **observations** | coverage_pts=4, branches=5 (branch_pts=2), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** The tests cover `build_output`/`run` and the injected-dependency `run()` loop, but
+never `main` — so everything unique to the real entry point is unexecuted: `sys.stdin.read()` (which
+blocks until EOF; if Claude Code ever spawns the hook without closing stdin the process hangs to the
+10 s timeout on every Stop), the stdout write+flush, the blanket `except Exception: return 0`, and the
+module-level UTF-8 `reconfigure` that exists only because Windows consoles default to cp1252. On the
+ticker side, argument parsing, the `--file`/`--session`/`--self-test` dispatch and the `load()` closure
+are all untested, and `--interval` is unvalidated — `--interval 0` busy-spins at 100 % of a core, a
+negative raises mid-loop. The unreachable `return 2` after `parser.error(...)` is a tell that this path
+has never been run. Related and cheap: `count_turns` json-parses **every line of the full transcript**
+on every Stop, and the tests feed it 2–60 line files, so the cost characteristic that matters is
+asserted nowhere.
+
+**Concrete test.** Subprocess-level tests invoking the installed console scripts: assert exit 0 and
+empty stdout for garbage input, byte-exact JSON on a threshold crossing, UTF-8-decodable output with
+non-ASCII content, and that the process **exits** rather than hanging on an open-but-idle stdin. For the
+ticker, assert each `--file`/`--session` dispatch, the corrupt-file swallow, and `--interval 0`. Add a
+scaled perf assertion on `count_turns` against a 40 k-line transcript.
+
+### GAP-131 — Both `install.ps1` scripts are the same 85 lines twice, with an untested `Copy-Item` nesting hazard
+
+| field | value |
+|---|---|
+| **status** | `open` |
+| **claim_type** | `duplicated-logic` |
+| **layer** | pytest |
+| **verified_by** | automated |
+| **anchors** | `tools/budget-checkpoint/install.ps1:script`, `tools/cache-countdown/install.ps1:script`, `tools/cache-countdown/install.ps1:Get-HookEntries` |
+| **risk** | L4 × I2 = **8** |
+| **observations** | coverage_pts=5, branches=3 (branch_pts=2), churn_90d=1 (churn_pts=2) |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-13 |
+| **last_verified** | 2026-08-13 @ `a3edc78` (static-only) |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** Identical param blocks, encoding line, four `Copy-Item` calls, uv block and trailing
+`ConvertTo-Json`, differing only in names, a timeout value, and a comment. Every defect in one is a
+defect in the other, and with zero PowerShell tests, fixing one and forgetting the other is the likely
+outcome. Two shared hazards: `Copy-Item -Path <src>\src -Destination $InstallDir -Recurse -Force`
+creates `<InstallDir>\src` on a first run but copies **into** it on a re-run (classic footgun,
+unverified for this exact invocation), leaving a stale package at the path `uv run` actually imports —
+so the user "reinstalls", sees success, and keeps running old code. And `Get-HookEntries`' output **is**
+the install contract, pasted into a real settings.json, with nothing validating its shape: neither
+script declares `#requires -Version 7.0`, and under Windows PowerShell 5.1 `ConvertTo-Json` unwraps a
+single-element array into a bare object, producing an entry Claude Code silently ignores — the hook
+simply never fires, with no error anywhere.
+
+**Concrete test.** Run each installer twice into the same temp `-InstallDir` and assert the tree is
+identical after the second run — specifically no `<InstallDir>\src\src` — and that `uv run --project`
+still resolves. Run `-PrintHooksOnly` under **both** pwsh 7 and `powershell.exe` and assert the parsed
+JSON has an array of matcher objects. Then factor the shared body into one parameterised script.
+
+### GAP-132 — CI bundles the app on three OSes and never looks inside the bundle
+
+| field | value |
+|---|---|
+| **status** | `open` <!-- human --> |
+| **claim_type** | `absent-coverage` |
+| **layer** | build/packaging |
+| **verified_by** | manual |
+| **anchors** | `.github/workflows/ci.yml:311`, `cockpit/ui/src-tauri/tauri.conf.json`, `spikes/SPIKE-RESULTS.md#smoke-run-3` |
+| **governs** | `cockpit/ui/src-tauri/tauri.conf.json`, `cockpit/ui/src-tauri/src/view_plugins.rs`, `.github/workflows/ci.yml` |
+| **last_manual_pass** | 2026-08-16 (found by inspection during Smoke run 3 preflight) |
+| **risk** | L5 × I5 = **25** |
+| **observations** | produced_a_real_defect=true (D-8), instances_of_pattern=5 |
+| **anchor_sites** | 3 |
+| **first_seen** | 2026-08-16 |
+| **last_verified** | 2026-08-16 @ `05c95ca` |
+| **decision** | — |
+| **rationale** | — |
+
+**Risk rationale.** This is the register entry for the pattern behind **five** defects on
+`feat/plugin-runtime`, every one of which passed every automated gate:
+
+- **D-1** — `pluginSrc` emitted a URL unusable on the primary target; `loader.test.ts:52` **asserted
+  the broken string as expected**.
+- **D-2** — `grantedCapabilities` was computed and discarded; every plugin got every capability.
+  `bridge.test.ts:360` **asserted the full host set as correct**.
+- **D-7** — `sendFullState` was tested against plain objects; production passes Svelte `$state`
+  proxies, which are not structured-cloneable. The fake could not fail the way production did.
+- **D-8** — `bundle.resources` did not exist, so **no packaged build could load any view-plugin**.
+- **D-4** — a third instance of the main-event-loop family already guarded by
+  `tests/tauri_command_threading.rs`.
+
+The shape is one thing: **the dev path is exercised; the path that ships is neither wired nor
+asserted.** Twice a test actively *defended* the defect, which is worse than absent coverage — it
+converts a gap into a false guarantee.
+
+**The important correction.** It is tempting to write "CI never builds the app". **That is false.**
+`ci.yml:311` runs `npm run tauri build` on `windows-latest`, `macos-latest` and `ubuntu-latest` and
+uploads the bundles as artifacts, on every run. D-8 did not slip past a missing build — it slipped
+past a **successful** one. A green `tauri build` means "it compiled and packaged", never "it packaged
+the right files".
+
+**Concrete test.** Cheap, because the artifacts already exist. Add a CI step after `tauri build` that
+unzips the produced bundle and asserts `plugins/reference/index.html` and `plugin-sdk/index.js` are
+present at the paths `resource_dir()` resolves. That single assertion would have caught D-8 on the
+commit that introduced it. `cockpit/ui/src-tauri/tests/packaged_plugin_root.rs` already closes the
+*config* half (the mapping exists and its sources exist on disk); this entry covers the *artifact*
+half, which no gate touches.
+
+Second, structural: a smoke-test lane that **launches the built artifact headlessly** and asserts the
+handshake completes would have caught D-1, D-7 and D-8 together. That is the general fix; the unzip
+assertion is the cheap one to do first.
+
+## 6. Change log
+
+Append-only, newest first. One dated, commit-stamped block per run.
+
+### 2026-08-13 @ `a3edc78` — first run (bootstrap)
+
+**Freshness.** Scanned at `a3edc78` on `feat/plugin-runtime`. Per-tier: `vitest` GREEN
+(19 files / 135 tests / 0 skipped), `node-embargo` GREEN (13/13), `node-session-state` GREEN (52/52),
+`pytest` GREEN (24 + 29). `rust-workspace` and `tauri-host` **not run** — the cargo build was held by
+a concurrent agent, so every Rust claim is stamped `(static-only)` and no `open → covered` transition
+would have been licensed for those tiers. `manual`: `manual-baseline: partial` (1 of 12 rows has a
+recorded pass).
+
+**Bootstrap seeding (Phase 0b).** Twelve entries (`GAP-001`…`GAP-012`) seeded from
+`spikes/SPIKE-RESULTS.md` — the "REMAINING HUMAN GATE" procedure and the "Smoke run 1 — 2026-08-10"
+results table — one per checklist row, each marked `&lt;!-- human --&gt;` (escaped here on purpose: the
+parser treats a bare marker outside a table row as a fatal error) and carrying its recorded result
+(`1.9a` PASS, `1.5` FAIL-then-fixed, `1.9b` ANOMALY, the rest never run). Two superseded human-gate
+docs (`docs/handoff/2026-06-24-human-gated-spikes-runbook.md`,
+`docs/handoff/2026-06-25-spikes-handoff.md`) were **not** seeded from; see R4.
+
+**Scan (Phase 2).** Twelve read-only Lane-A scanners over a `check-globs`-validated disjoint partition
+of all 274 tracked files (14 modules + an anchorless bucket; 0 overlaps, 0 unmapped). No Lane B — there
+were no existing entries to re-verify. Scanners returned **≈215 candidates**.
+
+**Dedup (Phase 2b).** `churn_90d` swept once, whole-repo, over every flagged anchor. Consolidation by
+any-anchor overlap reduced ≈215 candidates to **131 entries** (`GAP-001`…`GAP-131`, `next_id` now 132).
+The material merges, recorded so the next run does not re-mint them:
+- The five separate "tier X is not in CI" candidates plus their per-module restatements collapsed to
+  `GAP-057`, `GAP-110`, `GAP-111`, `GAP-112`, `GAP-113`, `GAP-115`.
+- `Runner::health` was raised independently by `fleetd_driver` and `fleetd_forge` → `GAP-018`.
+- The `poll_mergeable` no-delay loop was raised by both → `GAP-022`.
+- `FakeForge`'s three missing failure knobs (three candidates) → `GAP-023`; `FakeRunner`'s two →
+  `GAP-116`.
+- The blocking synchronous dashboard commands were raised by both `tauri_host` and `ui_dashboard` →
+  `GAP-070` and `GAP-071`.
+- The Phase-vocabulary duplication was raised by `fleet_core`, `fleetd_server` and `ui_shell` →
+  `GAP-036` (Rust/SQL side) and `GAP-081`/`GAP-082` (UI side).
+- `local_docker`'s pure-validator and exit-code-mapping candidates (four) → `GAP-118`;
+  `gh_forge`'s three → `GAP-117`.
+- Roughly thirty low-severity single-symbol candidates in `ui_dashboard`, `session_state` and
+  `py_tools` were folded into thematically-anchored entries (`GAP-095`, `GAP-099`, `GAP-102`,
+  `GAP-109`, `GAP-126`…`GAP-131`) rather than minted separately.
+
+**Adversarial verification (Phase 3).** Four refuters over **26 targeted claims** — every claim
+asserting a *live defect* or a *dead contract* rather than merely absent coverage. Verdicts:
+**21 confirmed, 4 refuted, 1 uncertain.** False-positive rate **4/26 ≈ 15 %**, which is the number to
+watch on the next run.
+
+*Refuted and dropped (recorded so they are never re-flagged):*
+- "The `app-plugins` capability over-grants webview-mutating permissions to third-party app content."
+  The capability omits `remote`; the child webview loads an external URL, so Tauri classifies it
+  `Origin::Remote` and the Local-only grants never resolve. **Inert, not dangerous.** Noted in `GAP-065`.
+- "`WebviewPool::touch_and_evict` holds the LRU mutex across a blocking main-thread `close()`."
+  `close()` compiles to a non-blocking `send_event`; the critical section is two channel sends. Also
+  `plugin_set_rect` never touches `lru`, so the named contention pair is wrong. Noted in `GAP-064`.
+- "`ticker.state_dir` and the PowerShell hooks resolve `~/.claude` to different directories under
+  `CLAUDE_CONFIG_DIR`." On Windows `Path.home()` resolves via `USERPROFILE` — the same directory the
+  hooks write to — and `recall.py` shares no file with the ticker. A latent inconsistency, not a live
+  defect. Noted in `GAP-129`.
+- "`resolve.mjs` and `SKILL.md` implement different plugin-resolution algorithms." SKILL.md step 3 does
+  contain the existence check plus the same cache-scan fallback. The dead-code half (zero production
+  importers) is real and is retained inside `GAP-109`'s neighbourhood, but the claimed failure mode is
+  wrong.
+
+*Uncertain, written `(unverified)`:*
+- "`discard`'s `replacen("cc_", "ccvol_", 1)` mis-targets the volume." Every reachable `Handle.id`
+  today starts with `cc_`, so the rewrite is currently correct. The unenforced prefix coupling and the
+  swallowed `let _ =` result remain real; both are covered by `GAP-118`.
+
+*Not refuted this run.* The remaining ≈105 entries assert absent coverage rather than a live defect and
+were **not** put through a refuter — risk-tiered solo dispatch over 215 candidates was not affordable
+on a bootstrap run. They are honest static findings, not adversarially verified ones. See **R3**.
+
+**Transitions.** None — every entry is new. No `covered`, `accepted`, or `intentionally-red` entries
+exist yet, so no promotion or demotion was possible.
+
+**Needs ratification.** Six items open (R1–R6), the load-bearing ones being the whole `spine_weight`
+table (R1) and the Phase-3 dispatch policy (R3).
+
+**Concurrent work observed.** The working tree carried `M cockpit/ui/src-tauri/src/plugins/manager.rs`
+and an untracked `cockpit/ui/src-tauri/tests/tauri_command_threading.rs` throughout the run — another
+agent writing targeted tests for the `plugin_launch` main-thread defect and the `stop_all_owned`
+teardown lifecycle. `cockpit/ui/src-tauri/src/plugins/**` was deliberately not scanned; `GAP-005`,
+`GAP-009` and `GAP-010` are parked accordingly. Note the new guard test is a **signature-level**
+ratchet, which is why `GAP-064` and `GAP-070` — blocking work one call below a correctly-`async`
+command — are still open findings.
diff --git a/plugins/reference/app.js b/plugins/reference/app.js
new file mode 100644
index 0000000..0207654
--- /dev/null
+++ b/plugins/reference/app.js
@@ -0,0 +1,105 @@
+// @ts-nocheck
+// Reference view-plugin — the small UI shell that dogfoods the FULL message surface:
+//   • dirty `state` deltas       → renders the unit list + coarse `degraded` badge
+//   • `log-append`               → per-unit operation ticker (last line)
+//   • `log-reset`                → clears tickers on a daemon-stream reconnect
+//   • a policed demo `launch`    → button; ack shown
+//   • a `command-ack` REJECTION  → a REAL launch (blocked pending host confirm) + a halt
+//                                  on a non-existent id both surface their rejection ack
+//   • presence during `awaiting_oracle_approval` → a NON-INTERACTIVE indicator only
+//     (approval is a host-authority action rendered by the host overlay — never a plugin
+//     verb; this plugin has no approve/reject button and cannot dismiss the modal).
+//
+// The SDK is served alongside this plugin as ./sdk.js (the loader/packaging step copies
+// cockpit/plugin-sdk there — see Lane S integration note). "Trivial" here means a small
+// UI, NOT narrow coverage: the contract is exercised end-to-end, not merely compiled.
+
+import { connect } from './sdk.js';
+import {
+  createModel,
+  applyState,
+  applyLog,
+  applyReset,
+  recordAck,
+  list,
+  awaitingApproval,
+  ticker,
+} from './model.js';
+
+const model = createModel();
+const el = (id) => document.getElementById(id);
+
+// Log/unit fields are untrusted daemon text relayed by the host — escape before it ever
+// touches innerHTML (defense-in-depth even inside the sandboxed, network-less frame).
+function esc(s) {
+  return String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+}
+
+function render() {
+  const banner = el('banner');
+  const await_ = awaitingApproval(model);
+  if (await_) {
+    // NON-INTERACTIVE: no verb. The host overlay owns approval.
+    banner.textContent = `◆ AWAITING ORACLE APPROVAL · ${await_.id} · respond in host overlay`;
+    banner.hidden = false;
+  } else {
+    banner.hidden = true;
+  }
+
+  el('degraded').textContent = model.degraded ? 'DAEMON: DEGRADED' : 'DAEMON: OK';
+
+  const rows = list(model)
+    .map((u) => {
+      const t = ticker(model, u.id);
+      const line = t ? esc(`${t.stream}: ${t.line}`) : '—';
+      return `<li data-id="${esc(u.id)}"><b>${esc(u.id)}</b> <span>${esc(u.phase)}</span> · $${u.cost.toFixed(3)} · <i>${line}</i></li>`;
+    })
+    .join('');
+  el('units').innerHTML = rows || '<li class="empty">no units</li>';
+
+  const last = model.acks[model.acks.length - 1];
+  el('acks').textContent = last
+    ? `ack ${last.reqId}: ${last.ok ? 'OK' : `REJECTED (${last.reasonClass})`}`
+    : 'no commands yet';
+}
+
+connect({ timeoutMs: 3000 })
+  .then((fleet) => {
+    el('status').textContent = `connected · caps: ${fleet.capabilities.join(', ') || 'none'}`;
+
+    fleet.onState((s) => {
+      applyState(model, s);
+      render();
+    });
+    fleet.onLog((unitId, lines) => {
+      applyLog(model, unitId, lines);
+      render();
+    });
+    fleet.onReset(() => {
+      applyReset(model);
+      render();
+    });
+    fleet.onAck((ack) => {
+      recordAck(model, ack);
+      render();
+    });
+
+    // Policed DEMO launch.
+    el('launch-demo').onclick = async () => {
+      await fleet.launch({ task: 'reference demo launch', tier: 't1', mode: 'demo' });
+    };
+    // REAL launch → blocked pending host confirm → REJECTION ack surfaces here.
+    el('launch-real').onclick = async () => {
+      await fleet.launch({ task: 'reference real launch', tier: 't1', mode: 'real' });
+    };
+    // Halt the first unit (or a bogus id, to exercise the unknown-id rejection ack).
+    el('halt').onclick = async () => {
+      const first = list(model)[0];
+      await fleet.command(first ? first.id : 'no-such-unit', 'halt');
+    };
+
+    render();
+  })
+  .catch((err) => {
+    el('status').textContent = `failed to connect: ${err.message}`;
+  });
diff --git a/plugins/reference/index.html b/plugins/reference/index.html
new file mode 100644
index 0000000..34de9e0
--- /dev/null
+++ b/plugins/reference/index.html
@@ -0,0 +1,45 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Cockpit Reference Plugin</title>
+    <!--
+      NOTE: the plugin-document CSP is delivered as a RESPONSE HEADER by the ccplugin://
+      scheme handler (lib.rs) / the dev static route — NOT a <meta> the plugin controls.
+      This document only loads its own same-origin module scripts (app.js → sdk.js/model.js).
+    -->
+    <style>
+      :root { color-scheme: dark; }
+      body { margin: 0; font: 13px/1.5 ui-monospace, monospace; background: #05121a; color: #cfe8f0; padding: 14px; }
+      h1 { font-size: 14px; letter-spacing: 2px; margin: 0 0 10px; color: #7fe3e3; }
+      .bar { display: flex; gap: 12px; align-items: center; flex-wrap: wrap; margin-bottom: 10px; }
+      button { background: #0c2a34; color: #cfe8f0; border: 1px solid #1c4a58; border-radius: 3px; padding: 6px 10px; cursor: pointer; font: inherit; }
+      button:hover { border-color: #2f7f92; }
+      #banner { background: rgba(120, 220, 220, 0.12); border: 1px solid #2f7f92; color: #7fe3e3; padding: 8px 10px; border-radius: 3px; margin-bottom: 10px; }
+      ul { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 4px; }
+      li { background: #0a1f27; border: 1px solid #16323c; border-radius: 3px; padding: 6px 9px; }
+      li b { color: #eaf6fa; }
+      li span { color: #7fe3e3; }
+      li i { color: #86a2ad; }
+      li.empty { color: #567; }
+      .muted { color: #6f8a94; }
+    </style>
+  </head>
+  <body>
+    <h1>REFERENCE VIEW-PLUGIN</h1>
+    <div class="bar">
+      <span id="status" class="muted">connecting…</span>
+      <span id="degraded" class="muted">DAEMON: ?</span>
+    </div>
+    <div class="bar">
+      <button id="launch-demo">▸ demo launch</button>
+      <button id="launch-real">▸ real launch (→ rejected, host confirms)</button>
+      <button id="halt">◼ halt first unit</button>
+      <span id="acks" class="muted">no commands yet</span>
+    </div>
+    <div id="banner" hidden></div>
+    <ul id="units"><li class="empty">no units</li></ul>
+    <script type="module" src="./app.js"></script>
+  </body>
+</html>
diff --git a/plugins/reference/manifest.json b/plugins/reference/manifest.json
new file mode 100644
index 0000000..0ff6aec
--- /dev/null
+++ b/plugins/reference/manifest.json
@@ -0,0 +1,8 @@
+{
+  "id": "reference",
+  "name": "Reference",
+  "version": "0.1.0",
+  "apiVersion": 1,
+  "capabilities": ["log-append"],
+  "entry": "index.html"
+}
diff --git a/plugins/reference/model.d.ts b/plugins/reference/model.d.ts
new file mode 100644
index 0000000..9b89663
--- /dev/null
+++ b/plugins/reference/model.d.ts
@@ -0,0 +1,61 @@
+// Types for the reference plugin's pure model (runtime is model.js).
+
+export interface UnitLite {
+  id: string;
+  task: string;
+  tier: string;
+  phase: string;
+  history: string[];
+  cost: number;
+  usdCap: number;
+  tokensIn: number;
+  tokensOut: number;
+  iters: { build: number; check: number; review: number };
+  findings: { round: number; title: string; severity: string; resolved: boolean }[];
+  oracleFiles: string[];
+  branch?: string;
+  pr?: string;
+  blocked?: string;
+  awaitingSlot: boolean;
+  rateLimited: boolean;
+  error?: string;
+  result?: string;
+  lastSeq: number;
+}
+
+export interface LogLine {
+  seq: number;
+  stream: string;
+  line: string;
+}
+
+export interface StateMessage {
+  full: boolean;
+  changed: UnitLite[];
+  removed?: string[];
+  order?: string[];
+  degraded?: boolean;
+}
+
+export interface CommandAck {
+  reqId: string;
+  ok: boolean;
+  reasonClass?: string;
+}
+
+export interface RefModel {
+  units: Record<string, UnitLite>;
+  order: string[];
+  degraded: boolean;
+  logs: Record<string, LogLine[]>;
+  acks: CommandAck[];
+}
+
+export function createModel(): RefModel;
+export function applyState(model: RefModel, msg: StateMessage): RefModel;
+export function applyLog(model: RefModel, unitId: string, lines: LogLine[]): RefModel;
+export function applyReset(model: RefModel): RefModel;
+export function recordAck(model: RefModel, ack: CommandAck): RefModel;
+export function list(model: RefModel): UnitLite[];
+export function awaitingApproval(model: RefModel): UnitLite | null;
+export function ticker(model: RefModel, unitId: string): LogLine | null;
diff --git a/plugins/reference/model.js b/plugins/reference/model.js
new file mode 100644
index 0000000..4be8f9a
--- /dev/null
+++ b/plugins/reference/model.js
@@ -0,0 +1,73 @@
+// @ts-nocheck
+// Reference view-plugin — pure state model (no DOM). Factored out of app.js so the full
+// message surface it consumes (dirty `state` deltas, `log-append`, `log-reset`, and
+// `command-ack`) is unit-testable without a browser. app.js renders off this model.
+
+/** A fresh, empty model. */
+export function createModel() {
+  return {
+    /** unitId → UnitLite (latest). */
+    units: {},
+    /** fleet order (from the host). */
+    order: [],
+    /** coarse daemon health. */
+    degraded: false,
+    /** unitId → accumulated log lines [{seq,stream,line}]. */
+    logs: {},
+    /** every command-ack seen (newest last). */
+    acks: [],
+  };
+}
+
+/**
+ * Apply a `state` message. A FULL snapshot resets the unit baseline (matching the host's
+ * `lastEmitted` reset); a delta merges only its changed units. `removed` is reserved-empty
+ * this cycle but honored if present.
+ */
+export function applyState(model, msg) {
+  if (msg.full) model.units = {};
+  for (const u of msg.changed) model.units[u.id] = u;
+  for (const id of msg.removed ?? []) delete model.units[id];
+  model.order = msg.order ?? model.order;
+  model.degraded = !!msg.degraded;
+  return model;
+}
+
+/** Append `log-append` lines to a unit's buffer (append-only, seq-ordered). */
+export function applyLog(model, unitId, lines) {
+  const buf = (model.logs[unitId] ??= []);
+  for (const l of lines) buf.push(l);
+  return model;
+}
+
+/** On `log-reset` (daemon-stream reconnect): discard all accumulated log lines. */
+export function applyReset(model) {
+  model.logs = {};
+  return model;
+}
+
+/** Record a `command-ack` (correlated by reqId at the SDK layer). */
+export function recordAck(model, ack) {
+  model.acks.push(ack);
+  return model;
+}
+
+/** Units in fleet order (skips any id in `order` without a materialized unit). */
+export function list(model) {
+  return model.order.map((id) => model.units[id]).filter(Boolean);
+}
+
+/**
+ * The first unit parked in `awaiting_oracle_approval`, or null. The plugin renders only a
+ * NON-INTERACTIVE indicator from this — approval is a host-authority action (the overlay),
+ * never a plugin verb.
+ */
+export function awaitingApproval(model) {
+  return list(model).find((u) => u.phase === 'awaiting_oracle_approval') ?? null;
+}
+
+/** The operation-ticker for a unit = its last log line, or null. */
+export function ticker(model, unitId) {
+  const buf = model.logs[unitId];
+  return buf && buf.length ? buf[buf.length - 1] : null;
+}
diff --git a/spikes/SPIKE-RESULTS-app-plugins.md b/spikes/SPIKE-RESULTS-app-plugins.md
new file mode 100644
index 0000000..f0ad5d3
--- /dev/null
+++ b/spikes/SPIKE-RESULTS-app-plugins.md
@@ -0,0 +1,66 @@
+# SPIKE #1 — App-plugin child-webview embedding
+
+Branch: `spike/app-plugins-webview-v2` (supersedes stale v1 `spike/app-plugins-webview`).
+Tauri `=2.11.2` + `unstable`. Harness: `spike_webview.rs` (3 async commands) + `App.svelte`
+(AUDIENCE tab in the top switcher hosts the child webview).
+Decision: **LEANING GO (overlay "B")** on dev evidence — **final pending packaged build + Gate 5.**
+
+> Phase 0 throwaway go/no-go for embedding whole web apps as child webviews. Phase 1+ must not
+> start until this records an explicit go/no-go. Spec gates: `app-plugins-design.md` §4/§6.
+
+## Gate results
+
+- [x] **1. `unstable` feature builds — PASS (dev).** `cargo build` exit 0 (sidecar must be built
+  first — see v1 gotcha). Packaged (`tauri build`) still pending.
+- [x] **Hang fixed — PASS.** The original `spike_show` deadlock (sync `#[tauri::command]` blocking
+  the main event-loop thread on `add_child`) is fixed by making the three commands `async fn`
+  (commit `a41a573`). Trace confirms `[SPIKE] add_child RETURNED ok` + `set_focus done` (it never
+  printed pre-fix). Watched run 2026-06-26.
+- [x] **2. Renders (dev) — PASS.** A Rust-positioned child webview rendered the whole Audience web
+  app (`http://localhost:3000/compose`) full-area under a Svelte rect, in the AUDIENCE tab.
+  ⚠️ **Audience is a poor proving app:** with only the web dev server + `fake` providers up (no
+  `api` backend), its frontend throws `TypeError: Failed to fetch` (lib/api-client.ts) and can
+  degrade to a blank render. That is Audience's missing backend, **not** an embedding failure
+  (the webview faithfully executes real JS + network). For a clean re-confirm, point the harness
+  at a stable page (a healthy app, or bring up the Audience `api` service).
+- [x] **4a. Resize tracking (dev) — PASS.** On host-window resize the child webview tracks the
+  reserved rect correctly (ResizeObserver + window-resize → `spike_set_rect`, rAF-coalesced).
+- [~] **4b. Hide-on-switch — WORKS but inefficient.** Switching tabs hides/reveals the webview
+  cleanly (no orphan paint), BUT `Webview::hide()`→`show()` forces a **repaint/reload** each
+  switch (loses scroll/form/session state, re-runs app startup). The spec's §4 "hide, not destroy"
+  keep-alive is therefore **not free**. → Roadmap: park off-screen instead of `hide()` + warm-pool
+  LRU cap. Recorded in `app-plugins-design.md` §5 ("Webview keep-warm without reload").
+- [~] **3. Real-origin behaviors — PARTIAL.** Confirmed the webview is a true origin (executes
+  real JS, makes real network calls). Cookies-persist / `window.open` popup / full-page redirect
+  NOT exercised this run because Audience's backend was down — revisit with a healthy app.
+- [ ] **2/4 PACKAGED — pending.** Gates 2 & 4 must also hold in a real `npm run bundle` artifact,
+  not just `tauri dev`.
+- [ ] **5. Lifecycle / no orphans — pending.** Launch → health → ready → show → quit → `docker ps`
+  clean. This exercises the app-plugin **backend** lifecycle, which the webview harness does not
+  drive; needs a separate launch path (see the 2026-06-15 resume doc's Gate-5 plan).
+
+## Exact webview API that worked (Phase 6 copies verbatim)
+
+Tauri 2.11.2 `unstable`, called from Rust commands (not gated by the JS webview capability allowlist):
+- `tauri::webview::WebviewBuilder::new(label, WebviewUrl::External(url))`
+- `Window::add_child(builder, LogicalPosition, LogicalSize) -> Webview`  ← the `unstable` call
+- `Webview::set_position(LogicalPosition)` · `Webview::set_size(LogicalSize)`
+- `Webview::set_focus()` · `Webview::hide()` / `Webview::show()` · `Webview::close()`
+- `Manager::get_webview(label) -> Option<Webview>` (reuse-or-create)
+
+## Harness gotchas (carry into the embedding build)
+
+- **`.taurignore` required.** `fleetd` writes `fleet.db` + WAL sidecars (`-shm`/`-wal`) into
+  `src-tauri/`; the `tauri dev` file-watcher rebuilds on every WAL write → endless "Rebuilding
+  application" loop (window opens-and-dies). Fix: `src-tauri/.taurignore` listing `fleet.db*`.
+  (The repo `.gitignore` entries are root-anchored `/fleet.db` and do NOT cover `src-tauri/`.)
+- **Teardown:** kill the `tauri dev` watcher ROOT (not `app.exe` — the watcher respawns it). Also
+  kill the standalone Vite (`:5173`) and the detached `fleetd-serve` sidecar (`:8787`); both can
+  survive an `app.exe` kill and a stale Vite forces the next run onto `:5174` (wrong `devUrl`).
+
+## Decision + rationale
+
+Dev-side evidence supports **overlay "B"** (renders full web app under a Svelte rect, resize
+tracks, deadlock fixed). Two gates remain before a final GO: **packaged build** (2 & 4) and
+**Gate 5** (lifecycle orphans). Known refinement before relying on cheap tab-switching:
+off-screen-park keep-warm (spec §5), not `hide()`.
diff --git a/spikes/SPIKE-RESULTS.md b/spikes/SPIKE-RESULTS.md
index 79b3e80..115e3f9 100644
--- a/spikes/SPIKE-RESULTS.md
+++ b/spikes/SPIKE-RESULTS.md
@@ -98,3 +98,433 @@ These patterns cover the known Anthropic HTTP status codes (429 = too many reque
 rate-limit and overload conditions. The classifier is built and tested against synthetic
 fixtures; this spike only would have refined the patterns — the absence of a confirmed
 signal does not block implementation.
+
+---
+
+## Plugin Runtime — Swarm Integration (Lane S)  → **CODE-COMPLETE; interactive smoke pending** ⏳
+
+> Run 2026-07-17 on the target machine (Windows 11, Tauri 2.11.2 `unstable`). Integrates the
+> view-plugin runtime (Lane V) + app-plugin embedding (Lane A) into the shared shell.
+> Dispatch doc: [docs/SWARM-HANDOFF-plugin-runtime.md](../docs/SWARM-HANDOFF-plugin-runtime.md).
+
+**What landed (branch `feat/plugin-runtime`):**
+- **Lane V** (view-plugin core): `store.svelte.ts` command-sink extraction, `bridge.ts`
+  (MessagePort `PluginBridge`/`PluginSession` + command policy + flood/rate kill), `loader.ts`,
+  `cockpit/plugin-sdk/`, `plugins/reference/`. Merged conflict-free.
+- **Lane A** (app-plugin core): `src-tauri/src/plugins/*` (manifest/discovery/lifecycle already
+  on main, extended), Tauri `unstable` pinned `=2.11.2`, `capabilities/default.json` `app::*`
+  capability, Audience proving manifest + dev-list discovery. Merged conflict-free.
+- **Lane S** (this integration, single writer of the three shared files):
+  - `tauri.conf.json`: host CSP — `frame-src http://ccplugin.localhost` + `connect-src` for
+    fleetd (`127.0.0.1:8787` http/ws).
+  - `src-tauri/src/view_plugins.rs` (new): production `ccplugin://` asset handler serving from
+    dev roots (`CC_VIEW_PLUGINS_DEV`) ∪ packaged resources ∪ `~/.command-center/plugins`, with
+    the **P4 findings** baked in — `script-src … http://ccplugin.localhost` (opaque origin ⇒
+    `'self'` matches nothing), `Access-Control-Allow-Origin: *` (opaque-origin module fetch is
+    CORS-mode), CSP as a **response header**, `connect-src 'none'`.
+  - `src-tauri/src/embedding.rs` (new): `plugin_show`/`plugin_hide`/`plugin_set_rect` — **async**
+    (P3: sync deadlocks webview creation), `plugin_hide` **parks off-screen** (never `hide()`,
+    which forces a repaint/reload), warm-pool LRU (cap 3), label scheme `app::<id>`.
+  - `lib.rs`: registers the `ccplugin://` scheme + the three embedding commands + `WebviewPool`.
+  - `App.svelte`: ONE topbar switcher across Fleet (in-DOM, default) + Projects + view-plugins
+    (sandboxed iframe) + app-plugins (native webview); `PluginBridge` handshake wiring;
+    hide-on-overlay compositing (native webview parked when a host overlay opens); ResizeObserver
+    rect tracking. Fleet ops grid behaviour unchanged (regression canary).
+
+**Automated gates — all GREEN (real output):**
+- `cd cockpit/ui/src-tauri && cargo test` → **28 passed; 0 failed** (clean compile against 2.11.2
+  `unstable`; the `add_child`/`get_webview`/`get_window`/`register_uri_scheme_protocol` surface).
+- `cd cockpit/ui && npm run check` → **0 errors / 0 warnings** across 352 files.
+- `cd cockpit/ui && npm test` → **133 passed** (18 files), incl. bridge handshake 100×-zero-drop,
+  command policy/flood-kill, store single-sink, and the `App.overlay`/`Switcher`/`ApprovalOverlay`
+  ops-grid regression canaries.
+- `cd cockpit/ui && npm run build` → clean (one benign `INEFFECTIVE_DYNAMIC_IMPORT` warning).
+
+**Provenance note:** the P3/P4 GO verdicts + throwaway spike harnesses live on unmerged branches
+`spike/app-plugins-webview-v2` (P3: `spike_show` async fix) and `spike/view-plugins-handshake`
+(P4 full GO). Their load-bearing *findings* are carried into `embedding.rs` / `view_plugins.rs`
+above; the spike files themselves were **not** merged (throwaway, per the handoff).
+
+### REMAINING HUMAN GATE — interactive dev + packaged smoke (not run headlessly)
+
+This is the spec's "spike-and-smoke" step: it needs a watched window and cannot be asserted from
+an automated run. Steps:
+
+1. **Dev seam env** (so `ccplugin://` + app discovery resolve to the repo in dev):
+   - `CC_VIEW_PLUGINS_DEV=<repo>/plugins`
+   - `CC_PLUGIN_SDK=<repo>/cockpit/plugin-sdk/index.js`  (served as `<id>/sdk.js`)
+   - `CC_APP_PLUGINS_DEV=<repo>/cockpit/ui/src-tauri/app-plugins`  (for the Audience app tab)
+2. **Dev:** `cd cockpit/ui && npm run desktop` (or `tauri dev`). Verify:
+   - Switcher shows FLEET (default, ops grid unchanged) + PROJECTS + REFERENCE (view-plugin) +
+     AUDIENCE (app-plugin).
+   - REFERENCE → sandboxed iframe renders, `plugin-hello`→`ready` completes, a policed `launch`
+     round-trips, `command-ack` rejection path fires; **no network** from the plugin.
+   - AUDIENCE → native webview appears over the reserved rect; resize the window and confirm the
+     webview stays glued; trigger a host overlay (stage a REAL launch) and confirm the webview
+     **parks off-screen** (hide-on-overlay across the native boundary), then restores on close.
+   - Switch AUDIENCE→FLEET→AUDIENCE with no leak / no orphaned webview; Fleet state preserved.
+   - Verify Vite HMR still works under the new host CSP (P4 spike gate d).
+3. **Packaged:** `npm run bundle` → run `target/release/*app*.exe`; repeat the above. Confirm the
+   `ccplugin://` scheme + child webview both work in the packaged build (no dev server).
+
+Record PASS/FAIL here once run on the target machine.
+
+### Smoke run 1 — 2026-08-10 (dev, partial) → **1.5 FAIL, fixed; rest not yet run**
+
+Run on the target machine against `feat/plugin-runtime` merged up to `main` (`725b630`). Ended
+early: the first app-plugin activation exposed a blocking defect that made the rest of the
+app-plugin checklist unmeasurable until fixed.
+
+**Environment note.** `cockpit/ui/node_modules` was empty at session start (collateral from the
+2026-08-09 cleanup), so `npm run check` / `npm test` failed with `'vitest' is not recognized` —
+a toolchain failure, not a code failure. `npm ci` restored it. Port 8080 was held by an unrelated
+`purposefull` Spring Boot process which exited on its own before launch.
+
+| Item | Result |
+|---|---|
+| 1.1 switcher renders | not run |
+| 1.2 fleet regression canary | not run |
+| 1.3 REFERENCE view-plugin | not run |
+| 1.4 command policy round-trip | not run |
+| **1.5 AUDIENCE activation** | **FAIL — UI froze on tab click (root-caused + fixed, see below)** |
+| 1.6 rect glue on resize | not run |
+| 1.7 park-on-overlay | not run |
+| 1.8 no leak on switch | not run |
+| **1.9 Gate 5 — container teardown** | **PASS — `docker ps` empty after quit (baseline was 0)** |
+| 1.9 Gate 5 — process exit | **ANOMALY — see below** |
+| 1.10 HMR under host CSP | not run |
+| Part 2 packaged | not run |
+
+**1.5 FAIL — root cause.** `plugin_launch` was a *synchronous* `#[tauri::command]`, so it ran on
+the main event-loop thread (the same P3 finding that forced the embedding commands to be `async`)
+and blocked there on `docker compose build` plus the health/ready probe budgets. The whole UI was
+frozen from the tab click until the stack came up. The code carried a standing note predicting
+exactly this ("may block up to the probe timeout (~180 s) … can move to a background task") — the
+smoke is what came due.
+
+**Fix (this session).** `plugin_launch` now dispatches `run_start_sequence` to a dedicated OS
+thread and returns immediately; a plain thread rather than an async-runtime worker because every
+seam in the sequence is blocking (`Command::status`, `ureq`, `thread::sleep`), so a runtime worker
+would only relocate the stall. `Ok` now means *dispatched*, not *healthy* — so `App.svelte`
+stopped fabricating `pluginState[id]='healthy'` and stopped calling `plugin_show` directly; the
+existing compositing `$effect` composites on the `plugin://state` `healthy` event instead. That
+second half is load-bearing: with launch returning early, the old code would have pointed the
+child webview at a URL that is not serving yet. Pinned by `src/App.appPlugin.test.ts` (2 tests,
+verified red→green).
+
+**Gate 5 — split result.** Container teardown **PASS**: `docker ps` empty after a graceful quit,
+against a verified 0-container baseline; `fleetd-serve` exited and 8787/5173/8080 all released.
+**Process exit ANOMALY**: the `app` process survived the window close (pid 13396, no window, 23
+threads, still responding 15 s later, 41 MB). Teardown clearly ran — the containers came down —
+but the process did not exit after it. Not diagnosed; **carry into the next smoke** and decide
+whether it is a dev-only artifact of `tauri dev` supervision or a real shutdown defect.
+
+**Automated gates re-verified after the fix:** `cargo test` 28 passed · `npm test` **135 passed**
+(19 files, +2 new) · `npm run check` **353 files, 0 errors / 0 warnings**.
+
+**Still merge-blocking:** everything marked "not run" above, plus the whole packaged pass. The fix
+is verified only at the automated level — it has **not** been confirmed in a watched window.
+
+### Smoke run 2 — 2026-08-15 (dev) → **db74a47 CONFIRMED; 5 new defects, 2 fixed**
+
+Run on the target machine against `feat/plugin-runtime` @ `26cbd24`, operator-driven with
+checkpoint-per-item. Nine of eleven items had never been executed before this run.
+
+**Environment notes — two of these invalidate assumptions the handoff was written on.**
+
+- `docker ps` was empty at preflight, but `docker ps -a` was **not**: `audience-minio-1`,
+  `audience-postgres-1` and `audience-redis-1` sat in **`Created`** state, left behind by Smoke
+  run 1. They broke the first AUDIENCE launch outright:
+  `Conflict. The container name "/audience-redis-1" is already in use`.
+- **The handoff's "images are prebuilt, so no 20-min build" is wrong.** `compose build` runs
+  regardless; it rebuilt `audience-video` and `audience-ai_content` before `up`.
+- The pre-warmed Tauri build was stale after `main` merged up — the `app` crate rebuilt cold
+  (16m22s). Budget that for the packaged pass too.
+
+| Item | Result |
+|---|---|
+| 1.1 switcher renders | **PASS** (limited — see note) |
+| 1.2 fleet regression canary | **BLOCKED** by **D-3** — ops grid renders nothing; says nothing about the canary |
+| 1.3a REFERENCE iframe renders | **FAIL → fixed → PASS** (**D-1**) |
+| 1.3b `plugin-hello`→`ready` | **PASS** — `connected · caps: log-append, real-launch-confirm` |
+| 1.3c no network from plugin | **PASS** — `connect-src 'none'` delivered on the plugin document |
+| 1.4a policed `launch` round-trip | **PARTIAL** — bridge round-trip works; terminal ack is `REJECTED (sink-error)` from **D-3** |
+| 1.4b `command-ack` rejection path | **PASS** — `REJECTED (real-requires-confirm)`, correct reasonClass |
+| **1.5 AUDIENCE activation** | **PASS — 1,127 samples, 0 unresponsive** |
+| 1.6 rect glue on resize | **PASS** |
+| 1.7 park-on-overlay | **BLOCKED** by **D-3** — overlay unreachable, mechanism untested |
+| 1.8 no leak on switch | **PASS** |
+| 1.9a Gate 5 — container teardown | **PASS** — 11→1 running, 27→17 total (10 fully removed) |
+| 1.9b Gate 5 — process exit | **FAIL → root-caused → fixed → re-verified PASS** (**D-4**) |
+| 1.10 HMR under host CSP | **NOT RIGOROUSLY VERIFIED** — worked incidentally, operator did not observe |
+| Part 2 packaged | **NOT RUN** |
+
+**1.1 covers less than it appears to.** `VIEW_PLUGIN_INDEX` (`App.svelte:45`) is a hard-coded
+build-time constant, not runtime discovery. A REFERENCE tab appears whether or not the plugin
+runtime works at all — as D-1 proved. Do not read 1.1 as evidence about the runtime.
+
+**1.5 — `db74a47` is CONFIRMED.** The pivotal item. Responsiveness was *measured*, not judged:
+`Process.Responding` sampled at 1 Hz across three traces totalling **1,127 samples with zero
+unresponsive**, spanning a full `compose build`, a failed `up`, and a clean 0→3→10 container ramp.
+The window stayed interactive through exactly the workload that froze it in run 1.
+
+#### D-1 — view-plugins could not load on Windows at all *(FIXED this session)*
+
+`pluginSrc()` emitted the literal `ccplugin://localhost/<id>/<entry>`. On Windows/WebView2 — which
+`view_plugins.rs:5` itself calls the primary target — a custom scheme is reachable only as
+`http://<scheme>.localhost/…`; the literal form is an *external protocol*, and
+`sandbox="allow-scripts"` forbids navigating to one. The frame never navigated and stayed blank:
+
+> `Navigation to external protocol blocked by sandbox, because it doesn't contain any of:
+> 'allow-top-navigation-to-custom-protocols', …`
+
+The codebase already contradicted itself here: the host CSP (`frame-src http://ccplugin.localhost`)
+and `pluginSrc`'s own docstring both name the Windows origin the code never produced.
+
+**Why every gate missed it:** `loader.test.ts:52` asserted the broken string as correct. CI has been
+green on a view-plugin runtime that cannot load on the primary target platform. `tauri build` only
+compiles; nothing in CI ever navigates the iframe.
+
+Fixed test-first: `pluginSrc` takes an injected `isWindows` (defaulting to a UA check) and returns
+the `http://ccplugin.localhost` form there. Verified live — REFERENCE rendered and completed its
+handshake without an app restart.
+
+#### D-2 — capability negotiation is dead code at runtime *(NOT fixed — needs a decision)*
+
+The operator's status line read `caps: log-append, real-launch-confirm` for a plugin whose manifest
+requests **only** `log-append`. Cause: `grantedCapabilities` is computed at `loader.ts:140` and read
+in exactly one place in the whole codebase — a test (`loader.test.ts:75`). `App.svelte:237`
+constructs `PluginBridge` without passing `capabilities`, so `bridge.ts:594` falls back to
+`this.opts.capabilities ?? [...HOST_CAPABILITIES]` and ships the **full host set** in `init`.
+
+Every view-plugin is granted every host capability regardless of its manifest. The manifest's
+capability declaration is decorative. This is security-relevant in a sandbox/capability system.
+
+#### D-3 — fleetd serves no CORS headers *(PRE-EXISTING on `main`, not a #49 regression)*
+
+`OPTIONS /missions` → **405**; `GET /health` with an `Origin` returns **no**
+`Access-Control-Allow-Origin`; and `crates/fleetd/src/*.rs` contains no CORS handling anywhere. So
+every browser `fetch` from the cockpit to the daemon fails. One cause, three blocked items:
+
+- **1.2** — `listUnits` is CORS-blocked, so the ops grid stays empty. Confirmed directly: three real
+  units (`u1` failed, `u2` done, `u3` awaiting_oracle_approval) existed in the daemon and the grid
+  still showed nothing.
+- **1.4a** — the plugin's policed launch reaches the sink correctly, then `createMission`
+  (`api.ts:16`) fails preflight → `REJECTED (sink-error)`.
+- **1.7** — the overlay is `$derived` from a unit in `awaiting_oracle_approval`. `u3` was parked
+  there on the daemon, but the cockpit cannot discover units, so the overlay never opened.
+
+`git diff origin/main...HEAD` is **empty** for `cockpit/ui/src/lib/api.ts` and `crates/fleetd/`, so
+the failing code is untouched by this branch. Whether this seam ever worked end-to-end is unverified
+— note that WebSocket state streaming is CORS-exempt, so only the HTTP verbs are affected.
+
+#### D-4 — the app never exits: an infinite exit loop *(FIXED and re-verified in a watched window)*
+
+Run 1's undiagnosed anomaly, reproduced and root-caused. `lib.rs` called `api.prevent_exit()`
+unconditionally, ran teardown, then `app_handle.exit(0)` — which **re-emits `ExitRequested`**, so the
+handler prevented it again, forever.
+
+Measured: after a graceful close the process held **20 threads, no window, `Responding=True`,
+spinning at 93.9% of one core**, having burned **309 s of CPU** by the time it was killed.
+
+This **answers the handoff's open question 1 definitively: a real shutdown defect, not a `tauri dev`
+supervision artifact.** The process tree showed `cargo` *blocked on* the app, not holding it open,
+and a hot spin loop is not what supervision looks like.
+
+**`0d05f55` made this worse while appearing to rule it out.** The handoff states its
+`stop_all_owned_is_idempotent` test "already eliminated" the second-teardown-pass hypothesis. Making
+teardown idempotent removed the 30 s cost per iteration and converted a slow loop into a hot one.
+
+It also explains the project's own **trap #2** (`tauri-build` cannot overwrite `fleetd-serve.exe`
+while the app runs) — that trap exists *because* the app never exits.
+
+Fixed test-first with a `ShutdownGuard` (`lib.rs`): the first `ExitRequested` is prevented so
+teardown runs; every later one is allowed through. Pinned by
+`shutdown_guard_tests::only_the_first_exit_request_is_prevented`, verified red→green.
+
+**Re-verified in a watched window (same session):** the process now exits in **~1 s** having burned
+**0.19 s of CPU**, against 309 s and never exiting before the fix. 1.9b is closed.
+
+**Not fixed, deliberately (one change at a time):** `stop_all_owned(30_000)` still runs
+*synchronously inside the `RunEvent` callback*, i.e. on the main event-loop thread — the same
+architectural mistake `db74a47` fixed for `plugin_launch`. The trace shows the loop blocked ~2.5 min
+(window closed ~13:15:30, containers reaped 13:18:00). The guard makes the process exit; it does not
+make it exit *promptly*.
+
+#### D-5 — a failed app-plugin launch is invisible in the UI *(NOT fixed)*
+
+The first AUDIENCE launch failed on the container-name conflict and the UI showed **nothing** — no
+chip, no error state. `plugin_launch` returns "dispatched", so there is no rejected promise, and the
+background failure never reached the shell. Operator comment: *"It's empty, and I see no UX to
+indicate anything is loading, which is a problem in itself."*
+
+#### D-6 — Gate 5's success criterion uses the wrong instrument
+
+Run 1 recorded teardown as PASS on "`docker ps` empty". `docker ps` lists only *running* containers
+and cannot see the `Created`/`Exited` residue that teardown actually left — residue which then broke
+the next run's launch. Gate 5 must assert on `docker ps -a` scoped to the project. Run 2's teardown
+genuinely does better: total containers went 27→17, i.e. ten were **removed**, not merely stopped.
+
+#### D-7 — view-plugins receive no state at all *(NOT fixed — agreed as the next action)*
+
+Not a checklist item; observed alongside 1.3b/1.4a once D-1's fix let the REFERENCE plugin actually
+render. The handshake completes and then the plugin sits on `no units` forever.
+`PluginSession.sendFullState()` throws posting Svelte 5 `$state` proxies through `postMessage`:
+
+> `bridge.ts:512 Uncaught DataCloneError: Failed to execute 'postMessage' on 'MessagePort'`
+> `    at PluginSession.sendFullState (bridge.ts:405)`
+> `    at PluginSession.onReady (bridge.ts:389)`
+
+`store.svelte.ts:34` declares `units = $state<Record<string, Unit>>({})`, so `toUnitLite`'s nested
+fields (`history`, `findings`, `oracleFiles`) stay proxy-backed and are not structured-cloneable. The
+throw lands **inside `onReady` before the tick timer starts**, so the plugin gets **no state *and* no
+ticks** — the entire state channel is dead, not merely stale.
+
+Fix with `$state.snapshot()` or a structural clone before `post()`. **Drive the test with real
+proxies:** `bridge.test.ts` uses plain fake objects, which is exactly why 137 tests missed it — a
+fake-based test passes against the broken code.
+
+#### The systemic pattern
+
+D-1, D-2 and D-7 are the same shape: **a unit test passes on a function whose output is never wired
+to anything — or is wired to a fake that cannot fail the way production does.** `pluginSrc` was
+tested against the broken string; `negotiateCapabilities` is tested in isolation while its result is
+discarded; `sendFullState` is tested against plain objects it never sees at runtime. D-4 is the third
+instance of the main-event-loop-blocking family already documented in
+`tests/tauri_command_threading.rs`. All of them passed every automated gate. Feed this into
+`docs/testing/PLAN.md`: the gap is integration-boundary coverage, not unit coverage.
+
+**Automated gates after this session's fixes:** `cargo test` **37 passed** · `cargo fmt` clean ·
+`cargo clippy --all-targets -D warnings` clean · `npm test` **137 passed** (19 files) ·
+`npm run check` **353 files, 0 errors / 0 warnings**.
+
+**Still merge-blocking #49:** **D-7** is unfixed (agreed as the next action); **D-2** needs a
+decision; 1.2/1.4a/1.7 are blocked behind **D-3**; 1.10 is unverified; and the **entire packaged pass
+(Part 2) has still never been run**. D-4 is closed — fixed *and* re-verified — but its second half
+(`stop_all_owned` still running synchronously in the `RunEvent` callback) is open and undecided.
+
+### Smoke run 3 — 2026-08-15 (**PACKAGED, Part 2**) → **D-7 fixed & confirmed; D-8 found & fixed; Part 2 substantially GREEN**
+
+The packaged pass, run for the **first time ever**. Operator-driven against `feat/plugin-runtime`
+with `bridge.ts`, `tauri.conf.json` and both new test files uncommitted at run time. Artifact:
+`target/release/app.exe` rebuilt this session (the artifact previously on disk was dated
+**2026-07-23** and predated every Smoke-run-2 fix — running Part 2 against it would have measured a
+three-week-old build).
+
+**Objective instrumentation:** `Process.Responding` sampled at 1 Hz throughout, 935 samples total.
+
+| Item | Result |
+|---|---|
+| 2.1 switcher renders | **PASS** — FLEET · PROJECTS · REFERENCE. AUDIENCE correctly absent (see note) |
+| 2.1b AUDIENCE with dev discovery root | **PASS** |
+| 2.2 fleet regression canary | **BLOCKED** by **D-3** |
+| **2.3a REFERENCE iframe renders (packaged)** | **PASS — first time the view-plugin runtime has ever worked packaged** |
+| 2.3b `plugin-hello`→`ready` | **PASS** — `connected · caps: log-append, real-launch-confirm` |
+| 2.3c no network from plugin | **NOT RUN** — release build has no devtools (F12 confirmed dead); criterion unreachable |
+| **2.4 view-plugin receives state (D-7)** | **PASS** — badge read `DAEMON: DEGRADED`, i.e. off its static `DAEMON: ?` default |
+| 2.4a policed `launch` round-trip | **NOT RUN** — the demo-launch button was never exercised this run (gap in the run, not a defect) |
+| **2.5 AUDIENCE activation responsiveness** | **PASS — 632 samples, 0 unresponsive**, across compose-up and a 0→10 container ramp |
+| 2.5b Audience web app renders | **PASS** — real content in the embedded child webview |
+| 2.6 rect glue on resize | **PASS** (see verbatim note) |
+| 2.7 park-on-overlay | **BLOCKED** by **D-3** |
+| **2.8 no leak on switch** | **PASS — measured**, 3 switch cycles: webview2 procs 31→31, mem +0.19% (noise), app threads 29→28 |
+| **2.9 Gate 5 — teardown + exit** | **PASS** — 10 containers → **0**, process exit **5.27 s**, `fleetd-serve` reaped, port 8787 released |
+
+**2.1's AUDIENCE note — not a defect.** `PluginManager::roots()` (`manager.rs:35`) has only two
+roots: `CC_APP_PLUGINS_DEV` and `~/.command-center/app-plugins`. Unlike view-plugins there is
+deliberately **no packaged resource root**, and the audience manifest is a dev fixture (it hard-codes
+`"cwd": "D:/MajorProjects/CURRENT/audience"`). A clean packaged build correctly shows no app-plugin.
+Items 2.5/2.6/2.8 were then run with `CC_APP_PLUGINS_DEV` set — recorded honestly as **packaged
+binary, dev discovery seam**; discovery is not what those items test, embedding is.
+
+**2.6 verbatim:** *"It lags a bit — there's a slight gap that exists for a moment before it catches
+up."* Scored PASS against the written criterion: rect updates are rAF-coalesced by design, and it
+caught up. Recorded rather than smoothed over — if the gap is ever considered a defect, this is the
+observation to start from.
+
+**2.5 was scored by instrument, not impression.** The operator's answer was *"I'm not sure, I looked
+away."* That is **not** a pass; it is an unobserved item. The 1 Hz trace is what scored it. This is
+the case Smoke run 2 never produced and the reason the sampler runs by default.
+
+**A premature D-5 was avoided.** The operator first reported the AUDIENCE pane as *"empty pane, no
+error, no spinner"* — the exact D-5 signature. The instrument contradicted it: containers had been up
+for only 9–15 s and the health/ready gates had not yet passed. On re-run with
+`http://localhost:8080/health` → **200** and `http://localhost:3000` → **307** (both inside
+`okStatus`), the app rendered. **D-5 did not reproduce.** Scoring the first report would have filed a
+false defect.
+
+**D-4 re-verified in the packaged build, twice.** A graceful close with no containers up exited in
+**0.23 s**; with 10 containers up, **5.27 s** including full teardown. Pre-fix this process never
+exited and burned 309 s of CPU. D-4's open second half (`stop_all_owned` synchronous in the
+`RunEvent` callback) did **not** manifest as a hang here — 5.27 s total, against ~2.5 min observed in
+dev run 2.
+
+#### D-8 — the view-plugin runtime could not work in ANY packaged build *(FOUND AND FIXED this session)*
+
+Found by preflight inspection **before** the operator touched the keyboard.
+`view_plugins::plugin_roots` falls back to `resource_dir()/plugins`, and `sdk_bytes` to
+`resource_dir()/plugin-sdk/index.js` — but `tauri.conf.json` had **no `bundle.resources` key at
+all**. The bundle shipped exactly one resource: `icon.ico`.
+
+So every packaged build would have served `ccplugin://localhost/reference/index.html` → 404 (blank
+frame) and found no SDK, so `plugin-hello` never posts and every handshake times out. The branch's
+headline feature did not function on the path that ships.
+
+Fixed by adding a two-entry `bundle.resources` map (view-plugin root + SDK). Verified: the six
+required files now land beside `app.exe`, and 2.3a/2.3b/2.4 all passed immediately afterwards.
+
+**Pinned by `cockpit/ui/src-tauri/tests/packaged_plugin_root.rs`** — a ratchet, not a note: delete
+either mapping and it goes red. Verified red→green.
+
+#### D-2 — confirmed on the shipping path *(FIXED after the run)*
+
+`caps: log-append, real-launch-confirm` for a plugin whose manifest requests **only** `log-append`.
+Previously observed in dev; this run confirmed it reproduces in the packaged build — a capability
+defect in the build that would ship, which is why it was fixed rather than deferred.
+
+Two changes, test-first. `App.svelte` now passes the discovered plugin's `grantedCapabilities` into
+`PluginBridge`, and `bridge.ts` **fails closed**: an absent grant is now `[]`, not the full host set,
+so forgetting to pass it can never again silently widen a plugin's authority.
+
+**`bridge.test.ts:360` asserted the full host set as correct** — the same mistake `loader.test.ts:52`
+made for D-1. That is now the **fifth** instance of the pattern and the second time a test actively
+defended the defect. The assertion was corrected and three new tests pin the grant, the fail-closed
+default, and an explicitly empty grant. Verified red→green
+(`expected [ 'log-append', 'real-launch-confirm' ] to deeply equal []`).
+
+**A flake was also fixed in this session's own work.** `bridge.proxy.svelte.test.ts` waited on
+`setTimeout(0)` for an inherently async `MessagePort` delivery and was intermittently red (1 failure
+in 3 isolation runs). Rewritten to wait on the condition with a 5 s ceiling; 8/8 clean since. A
+ratchet that flakes is a ratchet that gets deleted.
+
+#### The systemic pattern, now four instances
+
+D-1, D-2, D-7 and **D-8** are one shape: **something is exercised only on the dev path, and the path
+that ships was never wired or never asserted.** `pluginSrc` was tested against the broken string;
+`negotiateCapabilities` is computed and discarded; `sendFullState` was tested against plain objects
+it never sees at runtime; and the packaged bundle simply never carried the plugin root. Every one
+passed every automated gate.
+
+**Correction, made after CI ran on this work.** An earlier draft of this section (and commit
+`c16356a`'s message) claimed *"nothing in CI bundles the app"*. **That is false.** `.github/workflows/ci.yml:311`
+runs `npm run tauri build` on windows-latest, macos-latest and ubuntu-latest and uploads the bundles
+as artifacts. CI bundles the app on every platform, every run.
+
+The real gap is narrower, and better news: **nothing asserts what is INSIDE the bundle, and nothing
+ever runs the artifact.** D-8 did not slip past a missing build — it slipped past a *successful* one.
+`tauri build` packaged an app with no plugin root and exited 0, because a green build means "it
+compiled and packaged", never "it packaged the right files".
+
+That makes the fix cheap rather than architectural: the bundles already exist as CI artifacts, so a
+job that unzips one and asserts `plugins/reference/index.html` and `plugin-sdk/index.js` are present
+would have caught D-8 on the commit that introduced it. `tests/packaged_plugin_root.rs` closes the
+config half of this today; the artifact half is still open and is the single highest-value addition
+to `docs/testing/PLAN.md`.
+
+The gap is integration-boundary and **bundle-content** coverage, not unit coverage.
+
+**Automated gates after this session:** `cargo test --workspace` **120 passed** · tauri host **40
+passed** (+3, the new ratchet) · `npm test` **139 passed** (+2, the D-7 proxy lane) ·
+`npm run check` **354 files, 0 errors / 0 warnings**.
+
+**Residue after the run:** 0 `audience` containers, 0 `app`/`fleetd-serve` processes, port 8787 free.