**Dashboard document model.** A dashboard is a declarative document with schema_version, id, title, revision, params and a grid of panels. Every edit raises the revision by 1. A 12-column grid bounds each panel. | `model.test.ts` passes.

**Table, line, bar and KPI panels.** A panel is a query plus one visualization. The browser renders table, line, bar and KPI panels from a row set. Each panel shows loading, empty, error and unavailable states. | `DashboardsView.test.tsx` passes.

**Pie, map and graph panels (remaining).** The panel kinds pie, map and graph render from a row set. The map reads latitude and longitude columns. The graph reads source and target columns. | `PanelKinds.test.tsx` passes.

**UQL panel queries through arbora.** A panel query of kind uql runs through the same governed graph query route as Understory. The browser never contacts a data source directly. Unsafe query text is refused before sending. | `query.test.ts` passes.

**Natural-language, fleet.call and EG panel queries (remaining).** Panel query kinds nl, fleet-call and eg-op run through arbora served operations. Those are eg.query.NlQuery, fleet.call and named eg.query operations. Each kind validates its arguments. | `query-kinds.test.ts` passes.

**Hand-built dashboards.** A user creates a dashboard, adds, edits, moves and removes panels, and renames the dashboard in the UI. Every control works with the keyboard alone. | `DashboardsView.test.tsx` passes.

**WebMCP dashboard tools.** The Overstory Studio page registers seven WebMCP tools. The tools are create, add_panel, update_panel, remove_panel, set_layout, list_data_sources and preview_query. Each tool validates input and output against a strict schema. Results stay under 1,500 bytes. | `tools.test.ts` passes.

**Visible and undoable agent edits.** Each agent edit appears in an activity log tagged agent. A user undoes and redoes any edit, agent or user, with the keyboard. | `history.test.ts` passes.

**Confirmed destructive agent changes.** An agent call that removes a panel waits for explicit user approval in the page. Denial, timeout or cancellation leaves the dashboard unchanged. | `tools.test.ts` passes.

**Save through arbora as catalog assets (remaining).** The browser saves, loads, lists, drops and shares dashboards through the arbora dashboard operations (ARBORA-OPS-R861). EG stores each dashboard as the catalog asset of EG-TYPED-PACKS-R108, with an owner. A stale revision yields a conflict, never an overwrite. | `store-arbora.test.ts` passes.

**Local fallback marked pending.** Until R010 lands, the browser keeps dashboards in local storage. The page states that the save is local and pending. Storage failure leaves the in-memory dashboard intact and says so. | `store.test.ts` passes.

**Ownership and sharing (remaining).** The page shows the owner and the caller's access level. An owner grants or revokes reader or editor access. A reader sees no edit controls and the edit tools refuse. | `ShareDialog.test.tsx` passes.

**Refresh, parameters and filters.** A refresh control reruns every panel query. An optional interval refreshes on a timer. Dashboard parameters substitute into queries as validated typed values, and a change reruns the affected panels. | `params.test.ts` passes.

**Accessible and themed panels.** Every panel has a text summary and a data table alternative. Series differ by more than color. Panels follow the light and dark theme tokens and respect reduced motion. | `DashboardsView.test.tsx` passes.

**Dashboards route wiring.** The route workspace.dashboards in the navigation registry mounts the view. The view mounts the WebMCP registrar, so the tools exist only on that page. | `DashboardsView.test.tsx` passes.

**Catalog browse and search page (remaining).** The Catalog page lets a user browse and search the EG metadata catalog through arbora. It lists connector assets, glossary terms, lineage, owners, ratings, comments, Agent Library entries, workflows, knowledge graphs and dashboards. Related: EG-TYPED-PACKS-R106, EG-TYPED-PACKS-R108 and the arbora catalog operations. | `CatalogPage.test.tsx` passes.

**Generated Arbora API client with typed decisions and confirmation flows.** Agent-webui generates a versioned TypeScript client and a single invoke adapter from the Arbora API schema. It migrates decisions, Markets/apps pages and WebMCP tools to call the client. The console confirmation page sends only the exact server-issued plan reference. That reference completes a previewed effect. | Contract tests against the generated client plus positive and negative effect tests on the confirmation flow verify this.

**Typed ontology, graph, Atlas and object-set operations replace host routes.** Generated Arbora operations replace the ontology, graph, Atlas and object-set route blocks in agent-webui's api_extensions.py. They also replace the corresponding src callers. The operations preserve tenant scoping, purpose context, cursor pagination and existing error semantics. | Cross-surface fixture tests and browser tests covering each migrated route family confirm parity with the prior behavior.

**Remaining domain routes migrate to generated operations with a route census (rollup).** Split into `WEBUI-API-R003.1` (route-census typed model) and `WEBUI-API-R003.2` (route-census data file and lint rule), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Route-census typed model.** A typed `RouteCensusEntry` model with a strict disposition enum records each route's owning operation. It refuses a `generated-operation` row that omits its owning operation. | Verified by `route-census.test.ts` asserting the refusal and disposition-enum behavior.

**Route-census data file and lint rule (remaining).** The remaining scope has two parts. One is a checked-in route census data file populated for every `api_extensions.py` domain route family. The other is an architecture lint rule that runs in CI and rejects any new unclassified domain route. | Route-census and contract tests plus the lint rule running in continuous integration confirm no unclassified domain route remains.

**Each request carries its own correlation id.** The host mints a fresh correlation id for each HTTP request and WebSocket connection without an inbound `x-correlation-id`. An ambient id bound on the serving thread never enters a request. | An observability test binds an ambient id and serves two requests. It confirms two distinct ids that differ from the ambient one.

**Generated TypeScript client from a pinned Arbora schema.** Agent-webui generates its TypeScript types and client from a pinned Arbora v1 API schema and digest. The client exposes one invoke adapter and a stable error envelope for all callers. | A regeneration-diff check plus contract tests confirm the generated client matches the pinned schema and envelope.

**Typed operations preserve preview-confirm-step-up for effects.** Decisions, Markets/apps pages, WebMCP tools and the console confirmation flow in agent-webui call typed Arbora operations through the generated client. They preserve the preview, confirmation and step-up sequence. That sequence is required before any side-effecting action runs. | Positive and negative effect tests exercise the preview, confirm and step-up sequence end to end.

**Ontology, graph, Atlas and object-set operations preserve tenant semantics (rollup).** Split by code root into `WEBUI-API-R008.1` (ontology), `WEBUI-API-R008.2` (graph), `WEBUI-API-R008.3` (Atlas) and `WEBUI-API-R008.4` (object-set), producer first. This row is LANDED only when all four children are LANDED. | Each child's own verification row; see below.

**Ontology reads and writes use typed Arbora operations with preserved tenant semantics.** Agent-webui's ontology callers call typed Arbora operations. The callers cover schema graph, catalogue, import/export, registry types and interfaces. They live in `agent/agent_webui/api_extensions.py` and their `src` counterparts. The operations preserve tenant scoping, purpose context, cursor pagination and existing error semantics. | Cross-surface fixtures and a browser test confirm ontology-read parity after migration.

**Graph reads and writes use typed Arbora operations with preserved tenant semantics.** Agent-webui's graph callers in `agent/agent_webui/api_extensions.py` and their `src` counterparts call typed Arbora operations that preserve tenant scoping, purpose context, cursor pagination and existing error semantics. | Cross-surface fixtures and a browser test confirm graph-read/write parity after migration.

**Atlas reads and writes use typed Arbora operations with preserved tenant semantics.** Agent-webui's Atlas callers in `agent/agent_webui/api_extensions.py` and their `src` counterparts call typed Arbora operations that preserve tenant scoping, purpose context, cursor pagination and existing error semantics. | Cross-surface fixtures and a browser test confirm Atlas parity after migration.

**Object-set reads and writes use typed Arbora operations with preserved tenant semantics.** Agent-webui's object-set callers (`ObjectExplorerView`, `ObjectView`) in `agent/agent_webui/api_extensions.py` and their `src` counterparts call typed Arbora operations that preserve tenant scoping, purpose context, cursor pagination and existing error semantics. | Cross-surface fixtures and a browser test confirm object-set parity after migration.

**Prompts, SDD, knowledge base, sessions and goals migrate to typed calls.** Agent-webui's prompts, SDD, knowledge base, sessions, goals, MCP servers/tools and model-management features call typed Arbora operations in place of host-owned routes. | A route census and contract tests confirm each family is covered by a generated operation.

**Host drops direct internal imports once replacement operations are proven.** Agent-webui removes direct internal imports and domain route handlers from its host once the replacement Arbora operations are proven. It keeps only an explicitly inventoried set of browser-local endpoints. | A static dependency check and route-census gate confirm no forbidden import or unlisted domain route remains.

**Shared auth and streaming are preserved without exposing a service bearer.** Agent-webui preserves shared authentication, credential delegation, streaming and cancel behavior, and error handling across the migration. It never exposes an Arbora service bearer token to browser JavaScript. | Host integration tests and adversarial browser tests confirm the bearer is never exposed and behavior is preserved.

**Failure logs carry a sanitized typed error code.** `_log_failure` in api_extensions.py logs the operation label, exception type and an `error_code`. The code comes from the `engine_error_code` or `code` attribute. A value that is not an upper-case token of 64 characters or fewer is logged as `none`. Message text never reaches the log. | tests/test_log_failure_error_code.py confirms `ACCESS_DENIED` is logged, malformed codes log `none`, and message text is absent.

**Host composition without an engine.** The WebUI factory holds no graph engine. A host composes its routes through `application_composer` on the real factory. Graph data comes only from Arbora served operations; a route without one answers 501 `not_available`. Injection grants no identity or session authority. | Host-seam tests prove the served-operation calls and the `not_available` answers through the real factory.

**Chat preserves explicit conversation and admitted task identities.** The browser sends its selected conversation identity from the first turn. Its cache, draft and SDK state are scoped to the observed caller and tenant. The host does not derive identity from prompt text. It rejects conflicting conversation identities and propagates only explicit Arbora task, context, run and trace references through message metadata. A trace reference is not interpreted as a graph trace ID. | Mounted chat transport and host streaming tests prove first-turn identity, conversation isolation, missing and conflicting identity, and exact returned references. This does not establish durable resume or trace retrieval.

**Conversation and admitted-identity source preservation.** Bind selected conversation identity in mounted transport source. Scope cache, draft and SDK state to the observed caller and tenant. Reject conflicting conversation identities. Preserve only explicit returned task, context, run and trace references in host message metadata. Do not derive identity from prompt text or treat a trace reference as a graph trace ID. | Source fixtures cover first-turn identity, isolation, malformed and conflicting identity, and exact returned references. These fixtures do not qualify the installed composed browser-to-Arbora path.

**Composed conversation identity qualification.** Retain every parent R011.2 obligation beyond source fixture coverage. Qualify the mounted browser transport and host streaming path against the installed Arbora provider. | Planned: Prove first-turn identity, observed caller and tenant isolation, missing and conflicting identity, and exact returned references through the composed path. Keep durable resume and trace retrieval separate.

**Adapt the shared public execution contract.** Extend `orchestrator_model.py` and the existing browser client through registered Arbora operations. Preserve explicit node, owner, root-task, run and context bindings. Project only authorized public summaries, tool activity and transcript parts. Preserve snapshot/cursor semantics and default-false control capabilities. Preserve replay-v1 decoding; negotiate new projections separately. Do not infer child targets or expose service credentials. Depends-on: ARBORA-OPS-R021.4.8, ARBORA-OPS-R021.4.9. | Planned `test_execution_projection.py::test_public_execution_adapter` and `execution-projection.test.ts::binding_and_refusal` cover schema compatibility, exact identity, ordered replay, redaction and denial. Installed-producer qualification remains required.

**Flat execution read source adapter.** Consume `runs.execution_graph` with `arbora-execution-graph-v1` through the existing canonical invoke transport. Validate exact root-task/run binding, decoded node-key tuples, bounded declared topology and unique observed evidence. Preserve aborts, unavailable results and default-false child capabilities. Never fall back to legacy endpoints or infer scheduling, lineage or child targets. | Source `execution-graph.test.ts` and mounted `WorkExecutionGraph.test.tsx` use the producer contract fixture. They cover malformed, denied and stale reads, Unicode keys and missing bindings. Nested projections, transcripts and installed-producer qualification remain under R011.3.

**Client display identity consistently reads Overstory.** Page titles, metadata, the web manifest and primary client labels present Overstory. Arbora remains the backend and ecosystem name. Retained icon assets do not require new artwork; existing screenshots retain their capture provenance until replaced by real qualified captures. | Display-name checks, rendered tests and the Pages build confirm the client identity without changing technical identifiers.

**Package, import and environment naming stay on the component identity.** Package and import names remain `agent-webui` and `agent_webui`. Npm metadata, WebMCP identifiers, skills, browser storage, consent keys and environment variable names stay unchanged. The 2026-10-25 display-name decision uses Overstory for the client and retains Arbora for its backend and ecosystem. | Build and wheel tests confirm component identifiers are unchanged while client display labels read Overstory.

**AppSurface contract declares each app's route, capability and client.** Agent-webui exposes Apps as a single section in nav-registry.ts, where each app declares its route, required capability, typed service client, WebMCP page and optional Atlas renderer through one AppSurface contract. | Contract tests and a route-census test confirm every registered app conforms to the AppSurface shape.

**Contributed app descriptors cannot escalate privilege beyond the contract.** Native apps and validated package-contributed apps resolve to the same AppSurface shape. Untrusted or malformed descriptors cannot register executable code or arbitrary URLs. They cannot grant capabilities beyond the contract. | Tests that submit invalid descriptors and denied capabilities confirm they are rejected.

**Markets consumes the AppSurface contract without shell-side duplication.** Markets is the first app to consume AppSurface. The browser shell must not duplicate its scanner, chart or gateway wiring. | A first-consumer integration test confirms Markets runs through the shared contract alone.

**No browser-state migration is required by the rebrand.** Storage and consent keys keep their component names, so existing browser state and granted permissions stay valid. Any future key change must expire or migrate them with explicit renewed consent. The 2026-10-25 display-name decision retains all technical identifiers. | Browser tests confirm existing consent and storage survive the display rebrand.

**App navigation supports accessibility and layout states across devices.** Navigation between apps in agent-webui works with keyboard, touch and reduced-motion input across mobile and desktop layouts. Each app surface presents explicit loading, unavailable and denied states. | An end-to-end accessibility test suite confirms these interaction modes and states.

**Apps information-architecture section and AppSurface contract.** Agent-webui introduces an Apps section in its navigation information architecture and a reusable AppSurface contract that binds each app's route, capability, typed client, WebMCP page and optional Atlas renderer to the existing shell. | Contract and route-census tests confirm the shared shell binds every declared app surface correctly.

**Overstory is the client display brand.** Page titles, metadata, web manifest name and short name, primary UI labels and user-facing documentation headings present Overstory. Arbora retains its backend and ecosystem meaning. Retained icon assets are unchanged; screenshot updates use real qualified captures with their own provenance. | Rendered tests and display-brand checks confirm the renamed client labels; artifact checks preserve capture provenance.

**Repository, package and runtime identifiers are not renamed.** The repository, distribution, Python import path and npm package keep the agent-webui identity. The WebMCP identifiers, skills, browser storage keys, consent version, environment variables and release image keep it too. Operator decision 2026-10-09: only front-end-facing items are renamed to Arbora; agent-webui stays the component name. | Build and packaging tests confirm the identifiers are unchanged.

**Run harness surface is read-only and honest.** The agent-webui client must show a run's current plan, context use against budget, applied harness configuration, cost and termination reason. The client reads only arbora operations. | Children WEBUI-APPS-R004.1 to WEBUI-APPS-R004.6.

**Run read goes through the arbora read operations.** The client run view must read `runs.get` and `runs.metrics` (the `ARBORA-OPS` rows for run metrics). The client must not call the engine and must not compute these values. | `tests/x::test_run_read_uses_arbora_operations`

**Applied harness configuration is shown.** The run view must show the run's `harness_config`: `context_policy`, `plan_scaffold` and `action_space`. A missing field must read "not available". | `tests/x::test_harness_config_shown`

**Context use is shown against the budget.** The run view must show `peakContextTokens` against `contextBudgetTokens` and the cost `costUsd`. An absent field must read "not available", never zero. | `tests/x::test_context_and_cost_shown`

**Current plan is shown read-only.** The selected task reads `runs.current_plan` only from its validated `metadata.arbora.runId`, never an independent trace selection. Render the typed, current snapshot in producer order with no edit controls. Distinguish available-empty, unavailable, denied and failed reads. Retire snapshots on expiry, selection or identity admission change; stale requests cannot restore them. | `src/lib/__tests__/current-plan.test.ts`, `CurrentPlanPanel.test.tsx`, `WorkWorkspace.test.tsx` and `agent/agent_webui/__tests__/test_security_boundaries.py`. These qualify presentation and host admission, not full installed-producer acceptance.

**Each termination reason has a distinct state.** The run view must map each `terminationReason` (`final_answer`, `context_overflow`, `stuck`, `step_budget`, `error`) to its own label. `context_overflow` and `stuck` must not appear as a generic failure. | `tests/x::test_termination_reasons_distinct`

**Absent operation shows an honest state.** When `runs.get` or `runs.metrics` is absent or refused, the run view must show "not available" and no fabricated value. | `tests/x::test_absent_operation_not_available`

**Navigation and dashboards follow the signed-in user's role.** Agent-webui must show each signed-in user only the navigation and dashboard content that the user's role allows, and must keep each user's own dashboard layout. Rollup: LANDED when every `WEBUI-APPS-R005.<n>` child is LANDED. | A two-principal browser test shows different navigation and separate layouts, and the children pass.

**Nav entry declares a minimum role.** Each entry in src/lib/nav-registry.ts must declare a minimum role from admin, maintainer, user or reader. Completion rolls up both child requirements. | src/lib/__tests__/nav-registry.test.ts: entries without a role fail; a reader sees no admin entry.

**Registry role contract.** Every registry entry declares a recognized minimum role. The role predicate rejects absent and unknown identities and excludes higher-role routes for readers. | src/lib/__tests__/nav-registry.test.ts

**Rendered role filtering.** The real sidebar and route shell must reject higher-role destinations for a reader. Rendered acceptance must include an allowed reader destination. | `src/components/__tests__/AppRoleVisibility.test.tsx` mounts the real sidebar and route shell with reader and admin identities. A guessed admin URL cannot mount its view for a reader. Allowed reader navigation remains visible.

**Layout saved per user.** DashboardView must save and load the dashboard layout per principal through a typed Arbora preference operation. It must report not available when the operation is absent. | src/components/views/__tests__/DashboardView.test.tsx: two principals keep separate layouts; absent operation shows not available.

**Connector tiles from the catalog.** The dashboard must offer one tile per connector in the Arbora connector catalog. It reads connection state from Arbora and holds no credential in the browser. Under R049, the tile panel lives in Operate beside the connector inspector. Optional counters remain not available when absent. | src/components/views/__tests__/DashboardConnectorTiles.test.tsx covers each returned connector through the browser adapter. It checks absent/zero counters, filter, selection, failed refresh and storage. The Operate catalog panel also maps every server returned by the supported enhanced catalog, independently of process inventory. Registration availability is explicitly distinct from provider connectivity. Connection-state and installed-provider acceptance remain open.

**One chat session list.** The default Chat & tasks entry shows the existing composer without disclosure. Other contexts retain a quiet Agent header entry. The native workspace assistant and the navigation conversation selector read the same owner-scoped session list. Preserve one mounted Chat instance and canonical transport across Work, Explore, Operate and retained private routes. Do not add a floating launcher or second composer. | src/components/__tests__/chat-session-sync.test.tsx: a session created in one appears in the other.

**Every route renders.** A render census test must mount every registered route and fail when any route shows the error boundary. Completion rolls up both child requirements. | src/__tests__/routes/route-render.hostile.test.tsx: all routes render; an injected throwing view fails the test.

**Census detects a throwing view.** The existing render harness must detect an injected throwing view through its real ErrorBoundary. | src/__tests__/routes/route-render.hostile.test.tsx

**Complete route render acceptance.** Every registered route must render without an error boundary. Known-failure baselines do not satisfy this acceptance. | `src/__tests__/routes/route-render.hostile.test.tsx` runs the complete registry matrix and rejects any known-failure exemption.

**Each view states its purpose.** Each registered view must show a one-sentence purpose from its nav registry entry. The census must fail on a missing one. Completion rolls up both child requirements. | src/lib/__tests__/nav-registry.test.ts: every entry has a purpose of at most 20 words.

**Registry purpose copy.** Every registry entry has non-placeholder purpose copy ending in sentence punctuation and containing at most 20 words. | src/lib/__tests__/nav-registry.test.ts

**Rendered purpose visibility.** Every registered view must visibly show its registry purpose. Include views that own their headings and fail on missing purpose text. | `src/components/__tests__/RoutePurpose.test.tsx` covers every registry entry through the appropriate shell, including own-heading views, object detail, chat and public content.

**One panel relates goals, sessions and fleets.** Agent-webui must offer one panel that relates goals, sessions and fleets, drawn only from identifiers that Arbora returns. Rollup: LANDED when every `WEBUI-APPS-R006.<n>` child is LANDED. | A browser test filters the panel by goal and the children pass.

**Link type.** The panel must define a typed goal-session-fleet link built from returned identifiers in src/types. | src/lib/__tests__/goal-link.test.ts: a link with an unknown identifier is rejected.

**Panel reads typed operations.** The panel must read goals, sessions and fleets through the generated Arbora client calls of `WEBUI-API-R009`. | src/components/views/__tests__/GoalPanel.test.tsx: three calls, no direct fetch.

**Absent operation is honest.** The panel must show not available for any absent or refused operation, and must invent no link. | src/components/views/__tests__/GoalPanel.test.tsx: refused fleets call shows not available.

**Graph view edits go through the engine and refusals show.** The graph view must render nodes and edges as a pan and zoom force layout with semantic filters. It must send add, edit and delete requests to arbora and show the engine verdict, never a local edit. Persona modes must change only presentation. | Children WEBUI-APPS-R030.1 to WEBUI-APPS-R030.7.

**Model.** `src/lib/graph-edit.ts` (new) must define `GraphEditRequest` (`add`, `update`, `delete`; node id; labels; properties), `GraphEditVerdict` (`applied`, `refused`, `unavailable`) and `ViewPersona` (`operator`, `analyst`, `reader`). No store type exists for these today. | `src/__tests__/graph-edit-types.test.ts::test_edit_types_closed`

**Behavior.** `src/lib/graph-edit.ts` must expose `sendGraphEdit` as a named export. Through `gatewayPost`, use the installed Arbora registry contracts `eg.graph.AddNode`, `eg.graph.ApplyMutation` and `eg.graph.RemoveNode`, with generated request schemas, at `POST /api/v1/ops/{op_id}`. Arbora binding, invocation and HTTP owners are `ARBORA-OPS-R008`, `ARBORA-OPS-R009` and `ARBORA-OPS-R013`; the served version-checked mutation owner is `EG-DURABLE-KERNEL-R084.3`. Return the engine verdict; missing or incompatible installed contracts are unavailable. `EG-TYPED-PACKS-R088` covers embedded read parity and does not establish this served write proof. | `src/__tests__/graph-edit-send.test.ts::test_send_returns_engine_verdict`

**Wiring.** `GraphView.tsx:792`, `:796` and `:801` define `handleUpdateNode`, `handleDeleteNode` and `handleAddNode`, which only change React state and call no server. The caller is `GraphCanvas.tsx:605-609` through `onUpdateNode`, `onDeleteNode` and `onAddNode`. No production caller reaches an engine write today. This row replaces the three bodies with `sendGraphEdit` and changes local state only after an `applied` verdict. | `src/__tests__/graph-edit-wiring.test.tsx::test_handlers_call_send_graph_edit`

**Refusal.** When the engine refuses an edit for lack of permission, `GraphView.tsx` must keep the node unchanged and show the refusal reason. When the operation is absent, it must show `not available`. The identity owner is `ARBORA-IDENTITY`; the client must not decide authorization. | `src/__tests__/graph-edit-refusal.test.tsx::test_unauthorized_edit_refused_and_unchanged`

**Behavior.** The view must offer semantic filters by node type and by label text through `typeFilter` (`GraphView.tsx:272`). It must offer a persona mode that selects a default filter and detail level. `GraphCanvas.tsx:379` already runs the force layout, with pan and zoom. A persona must not widen what the engine returns. | `src/__tests__/graph-persona-filter.test.tsx::test_persona_changes_presentation_only`

**Evidence.** Each edit must record the request, the verdict and the engine reason in the view's visible edit log. A refused or unavailable edit must appear there with its reason. | `src/__tests__/graph-edit-log.test.tsx::test_log_records_each_verdict`

**Served end-to-end proof.** Start the real WebUI host, authenticated Arbora operation host and a disposable durable fixture engine. From the rendered graph overlay, save and delete through `sendGraphEdit`, `gatewayPost` and the actual registered operations from R030.2. Do not mock the client, gateway, host handler or engine transport. With an unauthorized principal, assert the visible refusal. Independently read the durable graph. No node, property or edge may change. With an authorized principal, assert the accepted value and durable readback after reload. Component tests alone cannot satisfy this row. | `e2e/graph-edit-served.spec.ts::overlay_edit_reaches_durable_engine` (planned)

**Memory state shows as Markdown files that sync with the graph.** List the hosted observations, reflections, profile and active-context documents and render EG synchronization evidence. An authorized retained conflict preserves both versions without overwriting the accepted head. A refusal reveals no head metadata. | Children WEBUI-APPS-R031.1 to WEBUI-APPS-R031.7.

**Model.** Planned `src/lib/memory-files.ts` consumes generated snapshot and tagged outcome schemas from `EG-DURABLE-KERNEL-R085.1` through `ARBORA-OPS-R024.4.1`. `MemoryFileKind` is observations, reflections, profile or active_context. `MemoryFile` maps the authorized document identity, logical path, revision, digest and sync state without a second permissive wire schema. `MemorySyncState` includes in_sync, graph_ahead, file_ahead, conflict and unavailable. Refused is a separate head-free variant. No file-sync client exists on current main. | `src/__tests__/memory-files-types.test.ts::test_memory_file_types_closed` (planned)

**Behavior.** Planned named exports `listMemoryFiles`, `readMemoryFile` and `saveMemoryFile` reuse `src/lib/arbora-api/invoke.ts` and generated schemas under `WEBUI-API-R001`. Bind proposed `memory.files.list`, `memory.files.read` and `memory.files.save` exactly to `ARBORA-OPS-R024.4.1–.3` and `.6`, backed by `EG-DURABLE-KERNEL-R085.1–.4`. Preserve exact revision/digest, bytes, explicit absent-head creation and submit/resolve tags. Fetch content only through authorized read; restart refused/expired pagination explicitly. Saves bind idempotency identity to the exact request. Browser callers cannot submit observe_file or acknowledge_materialization. Generic memory.read/write and Memory-node CRUD are not versioned synchronization. | `src/__tests__/memory-files-ops.test.ts::test_generated_operations_preserve_preconditions` plus `e2e/memory-files-served.spec.ts::authorized_snapshots_and_cursor_refusal` (planned)

**Wiring.** `MemoryView.tsx:439` currently lists Memory nodes at `:461` and writes legacy `/api/enhanced/graph/memory` routes. Navigation mounts the view from `nav-registry.ts:664`. Add the Files tab beside browse (`MemoryView.tsx:610`) using the named exports and canonical invoke adapter, whose endpoint is `POST /api/v1/ops/{op_id}`. Prove the real same-origin host reaches registered Arbora operations under `ARBORA-OPS-R024.4.2/.6`. Reuse the operation transport. Do not assume gatewayPost, which prefixes the graph facade, serves this endpoint. Cancel or discard obsolete responses after document, tenant, graph or principal changes; clear protected content on access loss. Missing registration/schema/host transport renders not available. | `src/__tests__/memory-files-wiring.test.tsx::test_files_tab_uses_canonical_invoke` plus `e2e/memory-files-served.spec.ts::navigation_reaches_registered_memory_operations` (planned)

**Refusal.** Render both immutable contents and digests only for an authorized conflict_retained outcome and authorized subsequent reads under `EG-DURABLE-KERNEL-R085.3/.5/.7` and `ARBORA-OPS-R024.4.3/.5`. Retention must survive restart without changing the accepted head; resolve requires current-head and retained-conflict references. Refused exposes only registered error code and request-local correlation. It withholds existence, revision, digest, conflict reference and stored receipt from errors, activity entries and stale UI state. Denied existing, absent and creation responses have equal disclosure. Retention failure must not claim conflict preservation. Recheck authorization on replay and conflict reads; clear protected versions on revocation. | `src/__tests__/memory-files-conflict.test.tsx::test_authorized_conflict_and_head_free_refusal` plus `e2e/memory-files-served.spec.ts::denied_reads_creates_and_replays_are_redacted` (planned)

**Behavior.** The Files tab must show each file's `MemorySyncState` with a distinct label per state. A file with a missing state must read `not available`, never `in_sync`. | `src/__tests__/memory-files-state.test.tsx::test_each_sync_state_has_label`

**Evidence.** Authorized save results show the returned digest, verdict and time; authorized conflict views show both retained digests. Refused entries show only registered error code and request-local correlation. Never reconstruct missing metadata from an earlier authorized result. Client save success or local timestamps do not establish synchronization. | `src/__tests__/memory-files-evidence.test.tsx::test_save_evidence_respects_outcome_authority` (planned)

**Served end-to-end proof.** Navigate the rendered Files tab through the actual WebUI host, Arbora registered operations and authenticated durable fixture engine. Prove authorized snapshot reads, cursor rejection, competing saves, retained conflicts across restart and exact-head resolution. Independently read accepted content and retained artifacts. Exercise denied existing/absent/create and replay after revocation with head-free UI/errors. Under `EG-DURABLE-KERNEL-R085.6/.8` and `ARBORA-OPS-R024.4.4–.6`, delay a host acknowledgment. Observe a newer edit while the accepted head stays unchanged. Then deliver the old acknowledgment; it must not establish in_sync. Only an authenticated host acknowledgment matching current head, digest, observation generation and attempt establishes served in_sync. Pending edits/conflicts prevent it; missing evidence is unavailable. Browser acknowledgment attempts refuse. No mocked client, host handler, authorization, engine transport or persistence can satisfy this row. | `e2e/memory-files-served.spec.ts::file_conflict_preserves_both_versions` and `::stale_materialization_ack_never_shows_in_sync` (planned)

**Evolution evidence.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R004.7.1` through `WEBUI-APPS-R004.7.6` must pass their planned acceptance.

**Model.** Use generated proposal identity, prompt revision, agent identity, progress state and source RunTrace references. Keep measured run metrics separate from decision calibration and coverage. | Planned `e2e/evolution-evidence-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Show each optimization proposal beside its exact source runs and recorded progress. Preserve pending review and propose-only state. Never promote a prompt from this view. | Planned `e2e/evolution-evidence-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend src/components/views/ObservabilityView.tsx beside the existing trace waterfall. Resolve proposal and trace references through typed Arbora reads. The existing runs.get and runs.metrics operations alone do not return the missing join. | Planned `e2e/evolution-evidence-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Missing proposal provenance, hidden traces or incompatible producer revisions show unavailable. Never infer progress from trace count or substitute WEBUI-DECIDE-R001 coverage. | Planned `e2e/evolution-evidence-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind the shown proposal revision, run IDs, trace digests, metric window and producer schema revision. Label incomplete source sets. | Planned `e2e/evolution-evidence-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** A real served proposal must lead from the dashboard to its authorized stored traces and measured outcomes. Denied traces must reveal no metrics or proposal progress. | Planned `e2e/evolution-evidence-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Unified harness sessions.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R006.4.1` through `WEBUI-APPS-R006.4.6` must pass their planned acceptance.

**Model.** Consume the versioned host supported-harness manifest and discovery status for every manifest entry. Session identity includes source harness, source session ID, tenant and authoritative indexed revision. | Planned `e2e/unified-harness-sessions-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** On first use, show discovery and synchronization for every declared supported harness. Browse and search the unified authorized index with cross-session cost summaries. | Planned `e2e/unified-harness-sessions-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend src/components/views/SessionsView.tsx and the R006 panel through the generated client. SDK discovers and syncs sources; EG owns indexes; Arbora serves bounded search and discovery progress. | Planned `e2e/unified-harness-sessions-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Unsupported harnesses, denied sources and partial synchronization remain individually visible. Never claim complete discovery from one source or replace missing costs with zero. | Planned `e2e/unified-harness-sessions-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Keep source coverage, sync cursor, index revision, query window, cost units and partial-result flags with every result page. Do not create a browser metric or session index. | Planned `e2e/unified-harness-sessions-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** From a fresh browser, exercise every supported harness in the versioned owner manifest and search sessions without duplicate identities. Include at least two harnesses when the manifest contains two or more. Two examples alone do not prove manifest-wide coverage. Deny one source and prove visible partial coverage and no hidden-session disclosure. | Planned `e2e/unified-harness-sessions-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Indexed usage analysis.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R004.8.1` through `WEBUI-APPS-R004.8.6` must pass their planned acceptance.

**Model.** Consume generated model, project and agent identities, input/output token counts and total usage cost. Preserve owner-defined cached/reasoning categories, accounting units and missing-value semantics. | Planned `e2e/indexed-usage-analysis-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Filter indexed history by model, project, agent and time window. Show producer aggregates and pagination. Label cost per solved task separately from total usage and context peak/budget. | Planned `e2e/indexed-usage-analysis-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend src/components/views/ObservabilityView.tsx using the canonical operation adapter. EG returns indexed accounting and groups; Arbora serves the generated projection. Reuse existing model/task-class metrics. | Planned `e2e/indexed-usage-analysis-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Unknown project/agent attribution, incomplete token accounting and zero-solved abstention remain explicit. Missing, nonpositive or nonfinite owner latency limits make bounded analysis unavailable. Never total overlapping token categories or manufacture project costs in JavaScript. | Planned `e2e/indexed-usage-analysis-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Retain aggregate definition, currency, accounting version, observation interval, source coverage and index watermark. Bind measured latency to an owner-published positive finite limit, units, measurement boundary, dataset size and contract revision. | Planned `e2e/indexed-usage-analysis-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Serve indexed model/project/agent queries over the owner-declared dataset and check independent stored accounting totals. Compare measured latency with the revision-bound positive finite owner limit. Test incomplete attribution, denied scope and absent, invalid or exceeded limits. | Planned `e2e/indexed-usage-analysis-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Live graph convergence.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R030.8.1` through `WEBUI-APPS-R030.8.6` must pass their planned acceptance.

**Model.** Consume authorized snapshot identity and ordered change events with graph incarnation, revision, cursor and event identity. A tombstone remains distinct from an inaccessible entity. | Planned `e2e/live-graph-convergence-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Apply committed changes to other connected clients without page refresh. Preserve selected nodes, camera and stable layout anchors during concurrent edits. | Planned `e2e/live-graph-convergence-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Attach the host subscription to src/components/views/GraphView.tsx and GraphCanvas. Use the existing host event transport with its generated contract; snapshot reads remain typed Arbora operations. | Planned `e2e/live-graph-convergence-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Deduplicate events and reject revision regressions. A gap or expired cursor requires an authorized fresh snapshot. Missing, nonpositive or nonfinite latency/layout bounds make bounded live mode unavailable. Revocation clears protected graph state and stops the subscription. | Planned `e2e/live-graph-convergence-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Retain snapshot and event revisions and measure commit-to-visible latency. Bind latency and layout measurements to owner-published positive finite limits, metric definitions, units, workload and contract revision. Layout metrics must cover readability and frame timing; retain selection continuity evidence. | Planned `e2e/live-graph-convergence-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Two real browsers edit concurrently and converge before refresh within the owner latency limit. Compare layout measurements against owner limits under the declared workload. Test missing, invalid and exceeded bounds. Exercise duplicated, delayed and reordered events, reconnect and revocation; compare both views with independent durable readback. | Planned `e2e/live-graph-convergence-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Retrieval quality comparison.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.1.1` through `WEBUI-APPS-R001.1.6` must pass their planned acceptance.

**Model.** Consume EG evaluation identity, corpus revision, relevance-label revision, algorithm version, k, hits-at-k and context-span offsets. Keep result ranking separate from relevance labels. | Planned `e2e/retrieval-quality-comparison-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Compare algorithms side by side for the same evaluation input. Show hits-at-k, safe n-gram highlights and context search with source references. | Planned `e2e/retrieval-quality-comparison-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend src/components/table-explorer/TryItPanel.tsx through typed Arbora evaluation reads. Its current SQL search legs and local rrfFuse do not establish authoritative evaluation metrics. | Planned `e2e/retrieval-quality-comparison-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Missing labels, incompatible corpus revisions, invalid offsets and denied context show unavailable. Never compute quality from rank alone or treat local fusion as an EG retrieval decision. | Planned `e2e/retrieval-quality-comparison-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Show numerator, denominator, k, corpus/label revisions, algorithm settings and query identity. Escape source text before highlighting and bound returned context spans. | Planned `e2e/retrieval-quality-comparison-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** A real served fixed corpus and labels must produce independently checked hits-at-k for two algorithms. Test unlabeled data, cross-revision comparison and hostile highlight text without fake metrics. | Planned `e2e/retrieval-quality-comparison-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Bounded large-data charts.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.2.1` through `WEBUI-APPS-R001.2.6` must pass their planned acceptance.

**Model.** Consume EG viewport bounds, pixel dimensions, bin revision, source cardinality, count/extrema and selection references. Scatter bins and line continuity have distinct generated result variants. | Planned `e2e/bounded-large-data-charts-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Pan, zoom and select scatter and line data with at least one billion source points. Render screen-bounded results, preserving gaps and producer-defined selection semantics. | Planned `e2e/bounded-large-data-charts-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend the existing shared Atlas chart renderer used by finance. Send viewport queries through typed Arbora reads; EG performs binning and selection against its indexed source. | Planned `e2e/bounded-large-data-charts-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Reject stale viewport replies and invalid selection tokens. Refuse rendering when owner bin/byte limits or viewport dimensions are absent, nonpositive, nonfinite or schema-invalid. Never download the complete source, interpolate across declared gaps or report exact point selection from a bin summary. | Planned `e2e/bounded-large-data-charts-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Enforce owner-published positive finite bin-count and response-byte limits before rendering. Their versioned formulas must bind viewport dimensions and chart variant, independently of total source cardinality. Count limits use integers. Record formula revision, viewport dimensions, source cardinality, bins and bytes. | Planned `e2e/bounded-large-data-charts-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Serve a real indexed source of at least one billion points. Pan, zoom and select both chart variants. Measure bins and bytes against the owner viewport formulas and limits. Test absent, zero, negative, nonfinite and exceeded limits, stale responses and denied selections. | Planned `e2e/bounded-large-data-charts-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Column vector controls.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.3.1` through `WEBUI-APPS-R001.3.6` must pass their planned acceptance.

**Model.** Consume stable table/column IDs, schema revision, ColumnVectorBinding, embedder identity/dimension and versioned index statistics. Advice and binding state remain distinct. | Planned `e2e/column-vector-controls-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Offer explicit per-column bind/unbind controls and show index readiness, indexed-row count and owner-reported size/freshness. Read the authoritative binding after each accepted mutation. | Planned `e2e/column-vector-controls-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend src/components/views/TableExplorerView.tsx and src/components/table-explorer/SchemaTree.tsx. Use generated Arbora list, stats and mutation bindings to existing EG column operations. | Planned `e2e/column-vector-controls-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Deny unauthorized mutations before effects. Stale schema, unsupported type or unavailable embedder leaves the binding unchanged. Advice must never activate a toggle automatically. | Planned `e2e/column-vector-controls-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind mutation verdict and readback to column ID, schema revision, embedder and index generation. Missing statistics remain unavailable, never fabricated zeros. | Planned `e2e/column-vector-controls-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Use an authenticated browser to bind a text column and read actual index statistics through Arbora and EG. Deny a writer and submit a stale schema; prove unchanged bindings and no embedding effects. | Planned `e2e/column-vector-controls-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Remote editor compatibility.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.4.1` through `WEBUI-APPS-R001.4.6` must pass their planned acceptance.

**Model.** Consume a versioned host compatibility manifest naming editor protocol, extension IDs/versions, supported capabilities and keybinding profiles. Keep remote workspace identity scoped to the session. | Planned `e2e/remote-editor-compatibility-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Expose supported extension installation/use and keyboard shortcuts within the existing embedded workbench. Resolve shortcut focus between shell and editor without silently swallowing commands. | Planned `e2e/remote-editor-compatibility-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Reuse src/components/views/WorkspaceIDEView.tsx at /ide and its editor-context bridge. Arbora owns workbench hosting and extension admission; the browser must not install a second editor. | Planned `e2e/remote-editor-compatibility-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Unsupported extensions, incompatible versions and denied workspace access show explicit refusals. Untrusted workspaces cannot gain host privileges or access another workspace through the bridge. | Planned `e2e/remote-editor-compatibility-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Record workbench and manifest versions, extension verdicts, keybinding profile and workspace revision. Keep service credentials out of frame messages and browser state. | Planned `e2e/remote-editor-compatibility-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Open an authenticated remote workspace and exercise one declared extension and shortcut in a real browser. Test incompatible extensions, reserved shortcut focus and cross-workspace access denial. | Planned `e2e/remote-editor-compatibility-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Meeting transcripts and summaries.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.5.1` through `WEBUI-APPS-R001.5.6` must pass their planned acceptance.

**Model.** Consume meeting ID, segment ID, sequence, correction revision, timestamps and finalization state. Summary requests bind final transcript revision, admitted provider identity and local/hosted execution class. | Planned `e2e/meeting-transcripts-and-summaries-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Show live partial/final segments and ordered corrections. After meeting finalization, let the user select an available local or hosted summary provider and request a summary. | Planned `e2e/meeting-transcripts-and-summaries-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Add the meeting consumer through existing AppSurface and host transport. SDK owns live transcription/provider transport; EG owns context and summary admission; Arbora serves their generated contracts. | Planned `e2e/meeting-transcripts-and-summaries-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Keep src/hooks/useVoiceDictation.ts single-shot behavior honest. Denied capture, missing streams, sequence gaps or absent providers remain distinct. Never silently move a local-provider request to a hosted service. | Planned `e2e/meeting-transcripts-and-summaries-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind summary content and citations to final transcript revision, provider/model revision and admitted execution receipt. Corrections invalidate stale summaries visibly. | Planned `e2e/meeting-transcripts-and-summaries-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** In a real browser, receive segments and corrections, finalize, then select local and hosted providers separately. Check actual provider routing and summary provenance. Denied egress and stale transcript requests produce no summary effects. | Planned `e2e/meeting-transcripts-and-summaries-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Bookmark knowledge views.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.6.1` through `WEBUI-APPS-R001.6.6` must pass their planned acceptance.

**Model.** Consume bookmark/source IDs, ingestion provenance, semantic-index revision, authorized relationships and bounded export schema. Reuse the existing SDK bookmark envelopes and extraction vocabulary. | Planned `e2e/bookmark-knowledge-views-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Search and filter bookmarks by meaning; render their authorized relationships as an interactive mindmap. Offer CSV and JSON export for the selected authorized query snapshot. | Planned `e2e/bookmark-knowledge-views-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Use existing AppSurface, GraphView/GraphCanvas and generated Arbora reads/export delivery. EG owns semantic indexing and relationship decisions. Do not duplicate SDK offline ingestion in the browser. | Planned `e2e/bookmark-knowledge-views-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Denied nodes, stale cursors and unavailable semantic indexes reveal no hidden counts or relationships. Never fetch embedded URLs or run imported instructions. Exports must not widen the selected scope. | Planned `e2e/bookmark-knowledge-views-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind search, mindmap and exports to one query/snapshot revision, source provenance, format version and content digest. Preserve unknown metadata and escape CSV formula-like cells safely. | Planned `e2e/bookmark-knowledge-views-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Import bookmarks through SDK R005.7–.12, then use real browser semantic filtering, mindmap and CSV/JSON export. Independently compare stored records and downloaded bytes; deny one bookmark and prove exclusion everywhere. | Planned `e2e/bookmark-knowledge-views-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Sandboxed design artifacts.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.7.1` through `WEBUI-APPS-R001.7.6` must pass their planned acceptance.

**Model.** Consume host-discovered executable identities and capabilities, EG-admitted skill sequence and immutable generated artifact references. Bind artifacts to execution, skill and source revisions. | Planned `e2e/sandboxed-design-artifacts-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Let the user select available coding-agent capabilities for a design flow and inspect skill-transformation progress. Render the resulting artifact only through the existing sandboxed frame. | Planned `e2e/sandboxed-design-artifacts-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Reuse src/components/mcp/McpAppFrame.tsx and McpAppHost.tsx. Arbora discovers PATH executables and hosts effects; EG selects composition; AU runs admitted skills. The browser never probes PATH or chooses policy. | Planned `e2e/sandboxed-design-artifacts-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Unavailable executables or refused transformations produce no success preview. Validate artifact digest, origin and message schema. Block parent DOM, credential access, popups and unauthorized network/navigation. | Planned `e2e/sandboxed-design-artifacts-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Show execution and transformation references with the rendered digest. Preserve producer refusal and cancellation; frame rendering alone is not proof of a completed transformation. | Planned `e2e/sandboxed-design-artifacts-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** Serve an admitted design flow through actual host discovery and execution to the sandbox frame. Compare the artifact digest with durable provenance; test substituted artifacts and hostile scripts without parent or network escape. | Planned `e2e/sandboxed-design-artifacts-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evolution projection dashboard.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R004.9.1` through `WEBUI-APPS-R004.9.6` must pass their planned acceptance.

**Model.** Consume EG-owned proposal identity and progress state. Measured run metrics remain separate from calibration/coverage. | Planned `e2e/evolution-projection-dashboard-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Show optimization progress linked to runs and their source proposals. Show unavailable and refused states distinctly. | Planned `e2e/evolution-projection-dashboard-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend ObservabilityView with EG projection read and Arbora operation transport. | Planned `e2e/evolution-projection-dashboard-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Missing or incompatible progress revisions show unavailable. Never substitute decision calibration. | Planned `e2e/evolution-projection-dashboard-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind shown runs to exact proposal revision and progress generation. | Planned `e2e/evolution-projection-dashboard-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Hot-path proof.** Dashboard test links measured runs to proposals. Test unavailable/refused states in real served environment. | Planned `e2e/evolution-projection-dashboard-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Graph changes stream to connected clients.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R030.9.1` through `WEBUI-APPS-R030.9.6` must pass their planned acceptance.

**Model.** Consume ordered change events with graph incarnation, revision and cursor. Stream identity remains distinct from snapshot. | Planned `e2e/graph-changes-stream-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Apply committed changes immediately to other authenticated clients without refresh. Preserve selection and layout under concurrent edits. | Planned `e2e/graph-changes-stream-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Define versioned graph-change subscription contract under EG/Arbora. Attach to existing GraphView and GraphCanvas consumers. | Planned `e2e/graph-changes-stream-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Dropped events, expired cursors and revocation produce distinct unavailable states. Reject stale revisions. | Planned `e2e/graph-changes-stream-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Retain event/snapshot revisions and measure commit-to-visible latency bounds. | Planned `e2e/graph-changes-stream-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Hot-path proof.** Two real browsers edit concurrently and see changes without refresh. Test reconnect, ordering and durable readback in served environment. | Planned `e2e/graph-changes-stream-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evolution projection dashboard.** Relate runs and measured metrics to prompt optimization progress and proposal source traces. | Children `WEBUI-APPS-R032.1` through `WEBUI-APPS-R032.6` must pass.

**Model.** EG proposal/progress identity separate from calibration/coverage. | Planned `e2e/evolution-dashboard-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Dashboard shows exact proposal beside measured runs and progress. | Planned `e2e/evolution-dashboard-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend ObservabilityView with generated read contract. Arbora serves operation. | Planned `e2e/evolution-dashboard-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Missing proposal/progress or incompatible revisions show unavailable. | Planned `e2e/evolution-dashboard-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind shown runs to proposal revision and progress state. | Planned `e2e/evolution-dashboard-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Hot-path proof.** Real served test links runs to exact proposal and unavailable/refused states. | Planned `e2e/evolution-dashboard-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Large-data chart binning and selection.** Billion-point scatter plus line selection with viewport bounds and payload limits. | Children `WEBUI-APPS-R033.1` through `WEBUI-APPS-R033.6` must pass.

**Model.** EG viewport-bin request/response and bounded payload semantics. Selection distinct from counts. | Planned `e2e/large-chart-binning-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Extend renderer with scatter/line interaction. Pan, zoom, select billion-point source. | Planned `e2e/large-chart-binning-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Extend shared Atlas renderer. Arbora serves EG bin/select operations. | Planned `e2e/large-chart-binning-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Invalid selection or exceeded payload limits remain unavailable. | Planned `e2e/large-chart-binning-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Record viewport bounds, source cardinality, bin/byte counts against limits. | Planned `e2e/large-chart-binning-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Hot-path proof.** Real billion-point source, pan/zoom/select checks against owner limits. | Planned `e2e/large-chart-binning-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Remote editor extension compatibility.** Product-neutral versioned extension/keyboard-shortcut support. | Children `WEBUI-APPS-R034.1` through `WEBUI-APPS-R034.6` must pass.

**Model.** Versioned host compatibility manifest with extension IDs/versions and keybinding profiles. | Planned `e2e/editor-compatibility-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Support extension installation/use and shortcuts in existing workbench. | Planned `e2e/editor-compatibility-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Reuse WorkspaceIDEView and editor-context bridge. Arbora hosts workbench. | Planned `e2e/editor-compatibility-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Unsupported/incompatible extensions show explicit refusal. | Planned `e2e/editor-compatibility-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind extension/shortcut verdicts to manifest and workspace revision. | Planned `e2e/editor-compatibility-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Hot-path proof.** Real browser extension/shortcut test in authenticated workspace. | Planned `e2e/editor-compatibility-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Live meeting transcript and summary.** Transcript production and provider-selected summary. | Children `WEBUI-APPS-R035.1` through `WEBUI-APPS-R035.6` must pass.

**Model.** Meeting/segment/sequence and correction revision. Provider selection class distinct. | Planned `e2e/meeting-transcript-summary-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Show live segments and ordered corrections. Let user select local/hosted provider. | Planned `e2e/meeting-transcript-summary-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** SDK owns live transport/provider. EG owns summary decision. Arbora serves operations. | Planned `e2e/meeting-transcript-summary-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Keep single-shot behavior honest. Denied/missing remain distinct. | Planned `e2e/meeting-transcript-summary-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind summary to final transcript and provider revision. | Planned `e2e/meeting-transcript-summary-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Hot-path proof.** Real served segments, finalization, local/hosted selection. | Planned `e2e/meeting-transcript-summary-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Bookmark semantic search and export.** Knowledge-base semantic search and mindmap/CSV/JSON export. | Children `WEBUI-APPS-R036.1` through `WEBUI-APPS-R036.6` must pass.

**Model.** EG bookmark semantics and meaning-based index. Authorized relationships separate. | Planned `e2e/bookmark-search-export-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Search/filter bookmarks by meaning. Render mindmap and export CSV/JSON. | Planned `e2e/bookmark-search-export-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Use SDK R005.7-.12 producer definitions. EG owns semantic index. Arbora bounded reads/export. | Planned `e2e/bookmark-search-export-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Denied/unavailable semantic index shows unavailable. Export scope not widened. | Planned `e2e/bookmark-search-export-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind search/mindmap/export to query revision and semantic index generation. | Planned `e2e/bookmark-search-export-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Hot-path proof.** Real served semantic filtering, mindmap, CSV/JSON from ingested bookmarks. | Planned `e2e/bookmark-search-export-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Design flow agent discovery and sandbox.** Discover coding agents and apply skill transformations. | Children `WEBUI-APPS-R037.1` through `WEBUI-APPS-R037.6` must pass.

**Model.** Host discovered executor identity. EG-admitted skill sequence and artifact reference. | Planned `e2e/design-agent-discovery-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Select available coding agent. Inspect skill transformation progress. Render artifact. | Planned `e2e/design-agent-discovery-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Reuse McpAppFrame/McpAppHost. Arbora discovers PATH. EG selects skills. AU runs. | Planned `e2e/design-agent-discovery-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Unavailable/refused transformations show unavailable. Validate digest and schema. | Planned `e2e/design-agent-discovery-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Show execution and transformation reference with rendered digest. | Planned `e2e/design-agent-discovery-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Hot-path proof.** Real served discovery, execution, sandbox isolation. | Planned `e2e/design-agent-discovery-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Interactive code explanations.** Extend the existing presentation rollup with the six clauses below. | Children `WEBUI-APPS-R001.8.1` through `WEBUI-APPS-R001.8.6` must pass their planned acceptance.

**Model.** Consume query/repository revision, ordered walkthrough steps, source spans, self-contained artifact manifest/digest and execution-note sequence references. Keep explanation notes distinct from private model reasoning. | Planned `e2e/interactive-code-explanations-served.spec.ts::test_model`; the owning contract in plan.md and test-spec.md defines the served proof.

**Behavior.** Show a linear source-linked walkthrough and interactive explanation artifact for the same query output. Show ordered graph-persisted execution notes with provenance links. | Planned `e2e/interactive-code-explanations-served.spec.ts::test_behavior`; the owning contract in plan.md and test-spec.md defines the served proof.

**Wiring.** Reuse existing code navigation and the R001.7 frame boundary. Arbora serves generated explanation output and note subscriptions; EG owns source and provenance identity; AU emits admitted execution notes. | Planned `e2e/interactive-code-explanations-served.spec.ts::test_wiring`; the owning contract in plan.md and test-spec.md defines the served proof.

**Refusal.** Missing source revisions, invalid manifests, stale notes and denied source spans show unavailable. Reject unmanifested external artifact dependencies; never synthesize a successful explanation from a generic span tree. | Planned `e2e/interactive-code-explanations-served.spec.ts::test_refusal`; the owning contract in plan.md and test-spec.md defines the served proof.

**Evidence.** Bind walkthrough, artifact bytes and note stream to one query and repository revision. Label disconnected streams and retain sequence/correction identities without exposing hidden source content. | Planned `e2e/interactive-code-explanations-served.spec.ts::test_evidence`; the owning contract in plan.md and test-spec.md defines the served proof.

**Served acceptance.** From a real served code query, inspect source-linked steps and load the artifact with external network blocked. Independently read graph notes and compare artifact bytes; reject wrong-revision outputs and unauthorized source links. | Planned `e2e/interactive-code-explanations-served.spec.ts::test_served_acceptance`; the owning contract in plan.md and test-spec.md defines the served proof.

**Complete capability and leaf census.** Record the user job, actual operation, role and source/fixture/served/unavailable evidence class in the existing coverage inventory. One registry lists every registered route, entity/detail destination, actionable form/control and backend capability. Derive it from existing owners. Each entry binds stable ID, parent relationships, component, role/tenant scope, manual interaction and semantic WebMCP action. It also binds an operation or local/unavailable disposition, existing spec ID and acceptance evidence. Unclassified or orphaned leaves fail CI. Missing upstream capability remains visible and unavailable, never a fabricated success. | Planned: Registry completeness, orphan/duplicate IDs, dynamic detail fixtures and new-route/action omission tests.

**One semantic workspace navigation state.** The tree/map, accessible list, breadcrumbs and direct search share stable destination/entity IDs and revisioned state. Route, selection, inspector and focus use that same state. Every permitted branch tip resolves to a native interactive surface at arbitrary depth without obligatory ancestor traversal. Existing deep links remain valid. Canonical entities can have multiple relationship paths without duplication. Browser Back/Forward restores semantic selection and focus; transient camera frames do not pollute history. | Planned: All-leaf reachability through keyboard, touch, direct URL, search and WebMCP; repeated Back/Forward and shared-entity path tests.

**Native WebMCP action equivalence.** Manual buttons, keyboard commands, typed form edits and semantic WebMCP tools use the same validated action dispatcher and visible state. Expose bounded authorized leaf discovery, navigation, state read, selection, focus, inspector expansion, form editing, supported undo/redo and effect requests. No arbitrary selector click, JavaScript evaluation, unconstrained URL or automatic backend-tool mirroring. Form editing is distinct from submission. All published actions are inventoried, with explicit human-only security exceptions instead of hidden automation gaps. | Planned: Parameterized manual/keyboard/tool equivalence for every inventoried action; same state, validation, permission, confirmation and outcome, including denial/cancellation.

**WebMCP lifecycle and authority preservation.** Keep existing schema/catalog digests, bounded results, secure-context capability detection, permission policy, route/generation scope, attended control and identity retirement. Unsupported browsers retain complete manual features with honest unavailable tooling. Sensitive actions use the same Arbora preview/confirm/step-up receipt as manual use; navigation or form editing cannot grant authority. Reject stale identity, context revision, replay, cross-origin, wrong object and mismatched confirmation. Propagate cancellation and report committed/unknown outcomes honestly. | Planned: Native supported-browser registration/execution plus unsupported fallback; stale generation, hidden-page retirement, replay, revocation, cross-origin and cancellation adversarial tests. Partial source repair: `navigation-lifecycle.test.tsx` checks retained registration callbacks; this structural document fixture does not qualify native-browser support or close the row. Additional source coverage in `provider.test.tsx` checks hidden-document registration retirement and recovery. `execution-lifetime.test.tsx` covers cooperative caller and registration cancellation through the mounted provider. Native-browser and served authority acceptance remain open.

**Preserve every feature through the Arbora redesign.** Reorganize existing surfaces into one persistent workspace with contextual panes rather than replacing them with a landing catalogue. Preserve capabilities and compatible deep links, not standalone feature pages. Replace page-per-feature layouts with three persistent contexts: Work, Explore and Operate. Keep required public/legal/contact content. Keep identity, chat, graph/Atlas, workflow, admin, Markets and dashboards. Retain empty/error/denied states. User-facing branding is Arbora. Technical identifiers retain the component identity under R039/R043. These include package, import, image, storage, consent, environment and WebMCP identifiers. No mobile feature subset is allowed. | Planned: Children R049.1 and R049.2 retain capability parity and prove consolidated design acceptance.

**Composed deployment and shared-backend acceptance.** Qualify the installed WebUI with real Arbora served operations and the intended EG/AU/SDK providers. Local fixtures or simulated model output are explicitly labelled and cannot count as real provider acceptance. Validate explicit no-auth, built-in EG and external OIDC modes independently under WEBUI-IDENTITY-R003.1–R003.3 and common R010 lifecycle. Never fall back from broken auth or relax network policy implicitly. Record exact component revisions, operation availability, browser versions and evidence. Shared execution, history, approval, model, host and metric semantics stay upstream and match TUI consumers. | Planned: Installed-host browser journeys against real Arbora. Include unavailable-provider cases, authenticated tenant isolation, permitted no-auth tests and shared contract parity receipts.

**Registered navigation source slice.** Reuse the route registry for role-filtered branch and list controls. Share existing same-origin, registered-route and role validation with WebMCP navigation. Preserve native links and modified clicks. Subscribe to URL changes without discarding query state. Restore focus after closing a branch disclosure. This slice does not qualify camera zoom or dynamic entity leaves. | Source tests in `src/lib/__tests__/workspace-navigation.test.tsx` and `src/components/__tests__/WorkspaceNavigation.test.tsx` cover dispatcher refusals, URL subscription and registered controls. Synthetic popstate is not real browser history acceptance.

**Complete semantic navigation acceptance.** Retain all parent R046 obligations beyond the registered source slice. Qualify dynamic deepest leaves, shared-entity paths, semantic zoom, real browser Back/Forward, selection and focus restoration. Test keyboard, touch and mobile layouts against the actual rendered workspace. | Planned: Run the parent browser and all-leaf matrix on the installed candidate. Source fixtures alone do not satisfy this child.

**Three-context migration without feature loss.** Replace standalone app pages with Work, Explore and Operate workspace contexts. Each legacy destination maps to context, entity/task, relationship path, lens and optional inspector state. Old URLs remain typed compatibility adapters, not separate page layouts. Preserve permissions, capabilities, actions and required legal content. Retire redundant navigation groups and duplicate shells. Keep every feature available on mobile. | Planned: Cover every baseline destination and dynamic leaf in the migration matrix. Reject orphan aliases, lost actions and extra standalone app layouts.

**Measured ground-up redesign acceptance.** Present Chat, Knowledge and Tools as the primary jobs, with Chat & tasks, Knowledge and Tools & connections page labels. Explain giving agents work and reviewing outcomes in plain language. The default composer requires zero disclosure activations. Demo record titles are not product features. Compare actual old and redesigned task journeys using identical fixtures. Show three primary contexts, not feature-page tabs disguised as branches. Direct search reaches every permitted leaf. Users reach a task surface within three navigation activations from its context root. Exclude typing, policy confirmations and the task itself from this count. Visible context, selected entity and primary actions remain anchored during content scrolling. Record scrolling distance and viewport changes for representative tasks. Demonstrate reduced navigation effort without clipping content or hiding features. | Planned: Publish before/after navigation counts, scroll distances, layout captures and task results. Test keyboard, touch, arbitrary aspect ratios and native WebMCP against the real workspace. Existing navigation or object-link slices alone cannot close this row.

**Retained Explore source slice.** Provide one read-only collection/entity composition at the opt-in workspace destination. Retain the query and results while selecting entities and relationship/history tools. Share typed destination validation between manual navigation and mounted WebMCP. Reject malformed state and insufficient roles before navigation. Defer protected reads while identity resolves. Keep bounded published evidence context separate from the complete user query. Show missing data and retryable errors honestly. | Mounted and pure source tests in `ExploreWorkspace.test.tsx` in the workspace component tests. These cover retained state, typed tools, bounded context, role/loading refusals and error states. Synthetic history events do not prove browser Back/Forward.

**Complete contextual migration acceptance.** Retain every R049.1 obligation beyond the opt-in read-only Explore source slice. Migrate all baseline capabilities and compatible addresses into the three-context workspace. Retire standalone legacy layouts only after capability and authority acceptance. Qualify actual browser history, focus, keyboard, touch, mobile resizing and native WebMCP. Include producer-bound nested execution navigation and separate hierarchy/dependency edges under the execution-explorer contract in plan.md. Check real served providers separately from browser fixtures. | Planned: Complete the 58-destination matrix and dynamic leaves. Publish installed-workspace evidence and capability parity. The isolated Explore proof cannot close this child.

**Retained Work source slice.** Foreground the single existing conversation and composer on the default Work route. Keep task, trace and saved-conversation inspection secondary and reachable, including direct links. Distinguish this presentation from the standalone /chat route so task content is not hidden. Compose a conversation selector and one existing Chat instance with independent served task and trace reads. Use task list/get and trace/node adapters. Let the caller refresh a selected task and request cancellation through the existing Arbora operation. While a selected-task read is pending, withdraw cached status, output, references and cancellation eligibility, including retained review callbacks. Keep the refresh control mounted and preserve keyboard focus while retiring reviews. Prove focus with native-browser deferred reads, not only DOM identity. Refuse repeated keyboard and script activation while refresh or cancellation is pending. Restore them only from the renewed matching response; refusal or navigation must not revive stale evidence. Bind visible cancellation review to the selected task and admission. Refuse duplicate submissions and stale reviews. Report request acceptance without inventing a terminal task state. Distinguish authorization refusal from an unknown outcome after a lost response. Share typed URL and tool navigation with manual controls. Anchor the shared context rail while retaining selected conversation and investigation state. Keep the primary conversation visible in native flow on the ordinary Chat & tasks landing. Task/editor deep links retain their intended primary content. Other contexts expose a quiet Agent header entry. Use a bounded expandable dock and reachable composer, not an overlay or equal-width default split. Narrow layouts retain a compact composer and current status, with explicit transcript and message-option expansion. Navigation updates existing page context without retargeting the conversation or authorizing actions. Do not infer conversation-to-task, task-to-trace or trace-to-subagent/evidence associations. Trace spans are not subagents. R049.1.2 retains the missing producer-bound association and nested-navigation acceptance. | Source tests in `WorkWorkspace.test.tsx`, `WorkTaskControls.test.tsx`, `WorkWorkspaceAdmission.test.tsx` and the shared shell/context-rail suites. These cover composition, navigation, task requests and admission changes. Real provider associations and full browser acceptance remain open.

**Retained Operate discovery source slice.** Keep caller-visible fleet children beside capability details in one composition. Use only canonical fleet status and unfiltered catalog listing. Do not prime named-server probes, load tools or perform operations. Share strict server/item/filter state between native links, manual controls and WebMCP. Preserve filter focus. Bound and label partial pagination. Scope cached results and tool handles to observed identity admission changes. Keep gateway discovery authorization authoritative. | Source tests in `OperateWorkspace.test.tsx` and `operate-workspace.test.ts` cover mounted selection, refusal, focus, observed-session isolation, pagination and validated gateway decoding. No installed-provider, anonymous-mode or native-browser acceptance is claimed.

**Inspect the current response task.** Show a task link only for the latest non-streaming assistant response with explicit matching conversation metadata. Use one typed destination for native links, manual controls and WebMCP. Reject malformed identifiers, stale handles and insufficient roles. Do not decode trace references or grant task authority. | Source tests in `CurrentResponseTaskLink.test.tsx` and `Chat.conversation-identity.test.tsx` cover bounded navigation and response retirement. Live task retrieval and native-provider acceptance remain open under R049.1.2.

**Bounded workspace command search.** Search the three migrated context roots and loaded caller-visible Explore results. Use native links and the same typed dispatcher for manual and semantic tool selection. Retire catalog handles on owner, role, availability and location changes. Keep executable operations and legacy page routes outside this catalog. | Source tests in `WorkspaceCommands.test.tsx` cover search, permission filtering, lifecycle refusal and keyboard access. Full destination migration and native browser acceptance remain open under R049.1.2.

**Consent prompt lifecycle source repair.** Keep the authenticated workspace prompt in normal flow below navigation. Hide it after a choice or explicit dismissal without a permanent floating control. Dismissal never grants optional consent. Manage choices through the public Privacy page and workspace menu. Preserve dismissal and explicit denial across route remounts when browser storage fails. Ignore unrelated storage events when retaining a failed-denial fallback. Focus Home after a workspace prompt choice or dismissal. Focus the surviving Disable optional control after revocation. | Source tests cover prompt dismissal, explicit choices, management access and storage failure. Check that dismissal grants nothing and unrelated session-storage events cannot restore an old grant. Repeat rendered mobile clearance, focus and remount checks on the exact candidate. This repair does not qualify the complete navigation matrix.

**Remaining complete navigation qualification.** Retain every R046.2 obligation beyond the consent placement source repair. Qualify dynamic deepest leaves, shared-entity paths, semantic zoom and actual browser history. Preserve selection and focus through keyboard, touch and mobile journeys. | Partial delivery: loaded context, fleet/capability and trace/node branches share the command catalog and typed dispatcher. Rendered tests cover retirement and focus; Chromium fixtures cover branch/search selection and real Back/Forward. Complete deepest-leaf, shared-entity and installed-browser qualification remains open. Synthetic responses do not prove served authority.

**Retained query and validation lenses.** Integrate existing query and validation controls into Explore without a legacy page shell. Preserve evidence selection and collection search across typed lens navigation. Keep drafts outside URLs. Require maintainer access for query and validation. Retire controller state on owner or evidence-context changes. Lens navigation must not submit requests. | Source tests in `ExploreQueryWorkspace.test.tsx` and `explore-lens-state.test.ts` cover composition, drafts, permissions and typed navigation. Provider and browser acceptance remain separate under R049.1.2.

**Attended query editor tools.** Expose bounded local draft edits and a request for visible submission review. Neither tool may call a provider. Bind review to the exact draft, source type and workspace context. Refuse stale reviews and script-dispatched confirmation. This tool-requested path submits only through the visible confirmation control. Existing manual submit controls keep their behavior. Keep backend permissions authoritative. | Source tests in `QueryEditorTools.test.tsx` and `ExploreQueryWorkspace.test.tsx` cover local effects, byte limits, retirement and the trusted-event default. Accepted-path unit tests use an explicit test gesture. Real browser pointer and keyboard checks remain required. Direct governed execution and full tool parity remain open under R049.1.2.

**Loaded Work and Operate commands.** Extend command search with loaded conversations, tasks, independent traces and selected-trace nodes. Include confirmed fleet children and their loaded capabilities. Keep the existing typed navigation dispatchers. Bound each group and omit invalid destinations. Withdraw failed discoveries and retire stale command handles. Do not add execution or infer associations. | Source tests in `LoadedWorkspaceCommands.test.tsx` cover mounted adapters, native links, keyboard opening, semantic selection, refusal and bounded groups. Full migration, live providers and native browser coverage remain open under R049.1.2.

**Message an active child explicitly.** Extend `WorkWorkspace.tsx` and the existing Chat composer through the shared adapter. Graph inspection must not retarget Chat. Activate `Message active child` only for a valid owner-issued target and `can_message_active`. Preserve the root draft. Report accepted, rejected and unknown outcomes without automatic resend. Depends-on: ARBORA-RELEASE-R003.4.12, WEBUI-API-R011.3. | Planned `WorkExecutionControls.test.tsx::active_child_target` proves explicit target selection, exact delivery binding, stale-capability refusal and duplicate protection.

**Continue a completed child separately.** Use the existing composer with the producer's continuation binding and `can_continue_completed`. Show `Continue completed child` as a separate action. Preserve completed history and adopt only the returned continuation identity. Never create an unbound agent or silently use root chat. Depends-on: ARBORA-RELEASE-R003.4.13, WEBUI-API-R011.3. | Planned `WorkExecutionControls.test.tsx::completed_child_continuation` checks lifecycle races, returned identity, unsupported capability and preserved root draft.

**Prove served targeted interaction.** Enter the real Work route and Chat composer against the released producer. Qualify active-child delivery, completed-child continuation and authorized cancellation with two principals. Keep R049.1.2 full navigation acceptance separate. | Planned `e2e/execution-explorer-served.spec.ts::targeted_controls` proves nested child isolation, reconnect reconciliation, revocation and cancellation acknowledgement. Synthetic browser fixtures cannot close this row.

**Flat dependency view source slice.** Extend the existing selected Work task with a read-only flat dependency diagram and equivalent keyboard-accessible list. Use only its explicit Arbora run binding and root task ID. Render producer-declared edges and observed evidence, with incomplete lifecycle and unobserved labels. Withdraw stale data on refresh, selection, identity change or denied access. Keep node labels plain text and never retarget Chat. | Source fixtures in `WorkExecutionGraph.test.tsx` and `execution-graph.test.ts` cover bound reads, fan-out/fan-in, hostile labels, cancellation and refusal. This source-only row excludes actual browser rendering, installed producers and nested execution, which remain under R049.1.2.

**Shared shell and Explore presentation slice.** Privacy management belongs inside Settings, including retained private routes. No route mounts an automatic privacy prompt. Keep the public policy page reachable. Existing consent values, explicit opt-in, refusal and revocation remain unchanged. First-use examples only fill the existing composer and never submit. Apply the accepted materials to real context content without restarting the theme. Keep navigation browsing and expert query/schema tools secondary. Knowledge search failures remain unavailable, not empty or fabricated results. Apply Liquid Glass through the existing shared workspace and retained Explore collection/detail journey. Keep one thin full-width floating header, a quieter resizable map, dominant evidence center and optional real selected-evidence detail. Keep a contextual Agent entry with in-place expansion, no dedicated bottom bar, floating bubble or empty default third column. Preserve native links, existing routes, identity admission, retained chat/query state and validated manual/WebMCP dispatch. Do not add a second router, fabricated evidence or backend authority. | Planned: rendered shell/Explore tests for query, selection, detail tools, return, errors, cancellation focus and responsive continuity. Native history/tool checks remain distinct from mounted fixtures. This bounded slice does not close R049.2, complete migration under R049.1.2, or served acceptance under R050.

**Remaining measured redesign acceptance.** Complete every original R049.2 obligation beyond the bounded shell/Explore source slice. Include complete Work/Operate composition and identical-fixture before/after tasks. Record navigation counts, scrolling distances, all-leaf search and actual layout evidence. Preserve keyboard, touch and native WebMCP qualification. Do not clip content or hide features to improve measurements. | Planned: publish baseline/redesigned task results and complete native interaction evidence under the original R049.2 acceptance criteria. Scoped presentation tests cannot close this row.

**Native read-only graph lens source slice.** Compose GraphCanvas and existing validated read facades within Explore. Do not mount the legacy Graph page shell. Retain independent graph selection/type and evidence collection/entity/tool state. Preserve query drafts and results across adjacent selection and browser history. Provide keyboard-accessible sampled adjacency and a plain-text inspector. Keep existing route admission. Infer no schema/manage capability. Expose no edit controls or requests. Withdraw data on denied refresh, obsolete requests and identity changes. Preserve sample limits, partial results and unavailable/error provenance. | Mounted graph-lens, state and reader fixtures pair with the existing canvas regression suite. This source-only child extends R030, R046.2.2, R047, R048 and API R008.2. Original owners retain browser/provider acceptance, engine edits, Cypher/MAGMA migration and old-route adaptation. R049.1.2 retains complete feature parity.

**Retained contextual workflow plan source.** Absorb the existing workflow serializer, palette, inspector and nodes into an administrator-only Work lens without nested legacy page chrome. Keep selected workflow identity, local draft, capability availability and validation through task inspection and return without retargeting conversation or task. Retire admission-owned state and fence stale read responses. Provide keyboard add/select/connect controls and narrow/short layout source for the palette and inspector. Label the in-memory preview and unavailable Save/Run authority honestly. | Mounted `WorkWorkflowLens.test.tsx`, `WorkflowEditorView.test.tsx` and typed Work-state fixtures cover retention, identity withdrawal, malformed/denied reads and keyboard alternatives. This bounded source row excludes served save/run, complete tool parity, real-browser accessibility and full migration; those remain under R049.1.2, R047, R048, WEBUI-DESIGN-R004.1.2/R004.2.2 and WEBUI-API-R009.

**Absorb existing usage analysis into Operate.** Extract the current usage controller and shell-free KPI, breakdown, tool, activity, session, timeline, search and trace panels. Preserve explicit tenant, supported filters, selected session and return context across Health, Services and Usage. Retire protected data on owner, scope, request or selection changes. Denied and malformed responses must not become measured zero or stale success. Reuse existing API bindings. Do not infer analytics from tenant totals or activate effects. | Source tests cover typed history, mounted panels, reader refusal and admin tenant isolation. Include unavailable producers, hostile numeric data and reordered responses. A separate browser scenario retains keyboard, touch, 320px, short viewport and Back/Forward qualification. This bounded source row does not close R004.8, R006.4, R047, R049.1.2, WEBUI-API-R009/R011 or WEBUI-DESIGN-R004.1.2/R004.2.2; all broad criteria and installed-producer acceptance remain.

**Requests without interaction modes.** The existing composer accepts ordinary requests without Ask, Plan or Code selection, persisted request-mode state or a mode payload. Handling belongs to the existing served agent path, not browser classification. Delete local /mode switching and its help entry. Preserve model choice, developer workspace routing, identity admission and explicit action approvals. | Mounted tests cover stale stored selections, normal submission without mode, absent selector/help and unchanged developer workspace controls.

**Design guidance distilled into component system and skills.** agent-webui distills license-reviewed accessibility, responsive, interaction and visual guidance from outside sources into the `src/components/ui/` primitives, the `src/index.css` tokens, and the public universal design and accessibility skills, ranking keyboard and screen-reader failures highest in its review rubric. The assimilation never installs duplicate skill names or copies unlicensed skill text. It adds no remote critique service or new telemetry. | Source diff and dependency audit confirm no duplicate skill names, unlicensed text, or new telemetry were introduced.

**Design tokens documented with contrast targets.** The component system documents semantic color, typography, spacing, focus, density and state tokens from `src/index.css`. Each token includes light and dark contrast targets. | Token audit and snapshot tests confirm documented tokens match `src/index.css` and meet the stated contrast targets.

**Controls have accessible names and visible focus.** Every interactive control exposes an accessible name and a visible focus indicator, repeated filter rows label each individual clause distinctly, and dialogs trap keyboard focus while open and restore it to the triggering element on close. | Keyboard end-to-end tests cover the chat, Atlas and an operational form flow.

**Responsive layout covers 320px mobile through desktop.** Layout patterns render correctly from 320px mobile width through desktop without horizontal overflow. All required actions remain reachable. | Viewport matrix tests with screenshot diffing across the mobile-to-desktop range.

**Gesture actions have alternatives and respect reduced motion.** Every gesture-driven action also has a click or keyboard alternative, and when `prefers-reduced-motion` is set, nonessential animation is disabled while status feedback remains visible. | Touch-alternative and reduced-motion end-to-end tests.

**Status states are distinguishable by text, not only color.** A failed knowledge/task read is not an empty result; unreported execution or connection state stays unknown. Loading, empty, stale, denied, error, success and pending states each render with distinct text in addition to color, and a long-running operation can be interrupted where doing so is safe. | Rendered tests against fixtures for each named state.

**No duplicate primitives or unsolicited telemetry introduced.** No new component duplicates an existing UI primitive, no unsolicited telemetry is added, and any idea drawn from a third-party source is paraphrased in original wording only after its license has been reviewed and cleared. | Source diff and dependency audit confirm no duplicate primitives, no new telemetry, and license clearance for paraphrased content.

**Fonts load from the same origin.** The interface ships its Inter font files inside the build and declares them with `@font-face` and a system fallback stack. The stylesheet imports no remote font or stylesheet. | A browser probe under the served policy records no `font-src` or `style-src-elem` violation for a remote URL.

**Runtime style elements satisfy the strict policy.** The server issues a fresh nonce for each HTML document and adds it to `style-src` and `style-src-elem`. Each library that inserts a `<style>` element at runtime carries that nonce or ships its rules as a bundled stylesheet. The policy never gains `'unsafe-inline'` for style elements. | Server tests prove a fresh nonce per document. A browser probe under the served policy records no inline `style-src-elem` violation.

**Purposeful density and Arbora visual hierarchy.** Use shared semantic spacing/type/color/state tokens and space-efficient, visibly labelled context navigation. Provide a primary working surface and optional related inspector/run tray. Wide views add useful panes rather than stretched prose; narrow views reflow to focused panes with persistent context. Tree/branch styling conveys relationship or navigation, not decoration. Never shrink text to fit or clip content to minimize scrolling. | Partial delivery: container-width pane composition in Work, Explore and Operate; native context disclosures retain mounted state. `e2e/workspace-density.spec.ts` exercises keyboard disclosure, draft retention and the viewport matrix. Screenshot/task-completion and full acceptance review remain open.

**Full mobile and arbitrary-aspect feature parity.** Every route and action, including the currently mobile-unsupported cohort, remains available at all supported viewport sizes. Reflow tables, editors, charts, workflows and administration into usable focused views instead of hiding controls or forcing a desktop-only gate. No viewport/device category reduces authorization or feature coverage. Wide data may use an explicitly labelled scrollable region with keyboard access, not whole-page horizontal overflow. | Planned: All-route/action coverage at 320 CSS px, narrow/tall, low-height landscape, 4:3,16:9,32:9 and generated intermediate dimensions; no unsupported/mobile-only omission.

**Resize, fold and visual viewport continuity.** Preserve selection, navigation history, unsent input, safe drafts, task progress and focus context. Cover resize, orientation, fold/unfold and on-screen keyboard changes. Respect safe areas and visual viewport; do not assume named device resolutions or fixed aspect ratios. Browser zoom to 200 percent preserves readable content and reachable actions. | Partial delivery: retained workspace viewport sizing and deferred focus reveal. Query journeys cover editing, pending responses and result inspection across native resize and simulated keyboard occlusion. A native 200-percent Chromium query journey checks keyboard access and retained edits. Full fold, native keyboard, browser zoom, stream and graph acceptance remain open.

**Bounded workspace viewport continuity.** Retain the shared visual-viewport sizing, safe-area padding and deferred focus reveal. Preserve query editing, pending responses, result inspection and one native assistant across workspace navigation and resize. Keep drafts, selection, conversation identity, execution-mode controls and approval review. Compact chat uses its intrinsic height and ordinary outer scrolling; expanded transcripts retain their own scrollport. | Source and synthetic browser tests cover the current Work, Explore, Operate and retained-chat slice. Native Chromium query zoom is separate evidence. This child does not accept the remaining device and all-surface obligations in R004.2.2.

**Complete resize and device continuity acceptance.** Prove every remaining R004.2 obligation across applicable surfaces, not only the bounded workspace fixtures. Cover resize, orientation, fold/unfold, native on-screen keyboards, safe areas and visual-viewport changes. Preserve selection, navigation history, unsent input, safe drafts, task progress and focus during stream and graph journeys. Prove readable content and reachable actions at 200-percent browser zoom without relying on named device resolutions or fixed aspect ratios. | Planned: exact-candidate browser and native-device evidence for the complete matrix, including all outstanding stream, graph, fold and keyboard cases. Existing synthetic fixtures and the bounded child cannot close this row.

**Accessible interruptible semantic zoom.** Semantic zoom reveals readable native DOM surfaces, not merely scaled screenshots or tiny text. Map/list, breadcrumbs, search and explicit controls offer equivalent non-gesture access to every leaf. Transitions are interruptible and preserve focus; reduced motion removes camera travel while retaining state feedback. Touch/coarse targets are at least 44 CSS px unless an existing stricter requirement applies. | Partial delivery: loaded workspace branch browsing uses native DOM, explicit controls and breadcrumbs without camera travel. Rendered and Chromium journeys cover branch/search equivalence, focus, immediate ancestor return and resized layouts. Full deepest-leaf, touch and manual screen-reader acceptance remain open.

**Measured performance under representative load.** Declare reference device/browser, network, fixture cardinality, capture method and budgets before acceptance. Representative journeys target p75 INP at most 200 ms, LCP at most 2.5 s and CLS at most 0.1. Target p95 local feedback at most 100 ms. Target p95 animation frames at most 16.7 ms on the declared 60 Hz reference. Virtualize/cull large data, retain worker/LOD seams, cancel obsolete work and bound streams/caches. No idle continuous animation or unsolicited telemetry. Report unsupported measurement cases and failures rather than claim zero lag. | Planned: Reproducible load/interaction traces, memory/idle checks and budget assertions plus reduced-motion tests on the exact release candidate.

**Repeatable documentation screenshots.** Capture the real Work, Explore and Operate interfaces with deterministic synthetic responses at narrow and wide sizes. Block live services and private sessions. Provide refresh, artifact import and integrity checks with stable documentation paths and source/viewport/theme/fixture provenance. Persist actual PNG files for local use and read-only CI artifacts. Documentation may store a lossless WebP derivative with identical decoded RGBA pixels, dimensions and color semantics. Retain the original PNG filename and digest, delivered filename and digest, and pinned optimizer provenance. Validate the complete set and the one-million-byte per-file budget before import. Missing tools, unsupported metadata or mismatched pixels must leave published files unchanged. Require complete successful captures and pixel review before committing the images. Capture output must not claim provider, accessibility or broader design acceptance. | Source: `scripts/documentation-screenshots.test.mjs` and `e2e/documentation-screenshots.browser.ts`. Acceptance: successful hosted captures, reviewed pixels, current README/docs assets, matching manifest and green CI. The dated evidence in `tasks.md` records the hosted capture, pixel review and asset qualification.

**Liquid Glass material and density.** Extend existing tokens with a continuous atmospheric sage/blue/ivory field and a deep-green dark alternative. Use visibly frosted framing and higher-opacity white-glass reading surfaces. Use black light-theme labels and visibly translucent tinted controls. Controls are slightly more opaque than their supporting glass. Use lighter frosting than the provided rough draft. Fill available space with returned evidence and relevant detail, never filler. Keep text opaque and prove composited contrast over the darkest and lightest authored background regions. Preserve the existing Arbora artwork and same-origin typography. Use useful alignment and compact/comfortable density, never tiny required text, decorative panels or fabricated data. Selected controls use a simple pale translucent fill, not asymmetric dark inset edges. Offer green (the exact accepted default), blue, red, purple, pink, orange and yellow palettes through Settings. Reuse existing colorizer and persistence. Derive neutral/primary, hover/pressed and focus tokens centrally; preserve legacy preferences, light/dark, opaque, reduced-transparency and forced-colors behavior. Keep semantic danger/warning colors and non-color status cues independent. Ordinary buttons share subtly translucent green fills with no resting outline; primary actions remain stronger and destructive states remain semantic. Align shared control text and icons with a consistent type scale; retain full-perimeter keyboard focus and semantic action contrast. Coarse-pointer sizing overrides compact spacing. Offer an opaque appearance fallback without losing information. | Planned: token/composited-contrast checks, rendered shell and Explore fixtures in every theme/density, coarse-pointer checks and pixel review. Scoped source tests do not accept the full theme or parent R002.1.

**Fully expanded responsive shell.** Use a thin inset floating bar across the available width. Retain identity, labelled Work/Explore/Operate navigation, current context, command/search entry and main actions. Reflow the same header into useful rows at narrow widths. Never use a centered capsule or hide main navigation/search behind a compact disclosure. Retain the resizable map and a dominant working center; show detail only for selected evidence. Preserve selection, drafts, mounted work, focus and compatible links through resize. | Planned: actual shell geometry and keyboard journeys from 320 CSS px through ultrawide, generated sizes and short landscape. Include resized editing, native zoom and optional-pane focus. This does not accept all-route parity under R004.1/R004.2.

**Meaningful interruptible motion.** Animate real selection, branch, pane and data changes with short interruptible transitions, never idle decoration, fabricated progress or queued navigation. State commits independently of animation completion. System reduced motion applies from first paint and overrides an expressive preference; provide an in-app reduction control. Motion, opacity and forced-color fallbacks preserve text, status and controls. | Planned: initial reduced-motion, rapid navigation, interruption, stale completion, focus return, appearance preference and idle-animation checks. Full semantic-zoom, live-update and measured performance acceptance remain with R005.1/R010.

**Remaining density and hierarchy acceptance.** Complete the original R002.1 obligations beyond the bounded material slice. Qualify Work/Operate composition and remaining graph, editor, run, administration and authentication surfaces. Preserve useful wide/narrow panes, readable text, native controls and purposeful hierarchy. Retain the parent R002 token documentation and light/dark contrast obligations. Independent accessibility and performance owners remain unchanged. | Planned: complete remaining token/layout snapshots, identical-task completion review and actual viewport pixels. The bounded shell/Explore evidence cannot close this row.

**Remaining full-route responsive parity acceptance.** Complete every original R004.1 route/action obligation beyond the responsive shell slice. Include registered routes, permitted dynamic leaves and formerly unsupported mobile surfaces across required and generated dimensions. Never hide required controls or reduce feature coverage. Retain the separate R004.2 continuity obligations. | Planned: complete route/action census and keyboard-accessible viewport matrix with reviewed screenshots. Shell and selected graph fixtures cannot establish full parity.

**Contextual scenes preserve product meaning.** Extend `WorkspaceFrame.tsx` and `WorkspaceAppearance.tsx` through the existing appearance provider. Roots represent source-system connectors; the trunk represents the harness; branches/leaves represent knowledge; light represents workspace attention. Follow context emphasizes the selected product context; manual selection overrides appearance only. Fluid remains a neutral alternative. Activity and knowledge relationships require matching, current Arbora evidence. Missing evidence leaves static scenery or selection feedback, never invented work or topology. Preserve Chat/Knowledge/Tools labels, navigation, drafts, identity and native textual status. | Planned: extend `WorkspaceFrame.test.tsx` and `canopy-glass.browser.ts` with context/manual selection and evidence-bound scene journeys. Reject unknown, stale, duplicate, unrelated and out-of-order activity. Review exact-candidate screenshots and motion recordings.

**Route-derived scene selection and manual overrides.** Resolve Follow workspace from canonical page routes: Chat uses the harness tree, Knowledge canopy, Tools roots, and entry or unknown context neutral fluid/light. Named scenes override context. Preserve the Canopy scene default and saved manual choices, navigation, drafts, identity and textual status. Page selection does not imply activity or graph relationships. | Extend wallpaper unit tests and `canopy-glass.browser.ts` with route mapping, manual override, static Off, cleanup and retained drafts. Review exact-head default and selected-scene pixels.

**Evidence-bound activity and topology.** Render activity or knowledge relationships only from matching current Arbora evidence. Missing evidence leaves static scenery or selection feedback. Never invent work, topology or native status. | Planned: supply real event and relationship seams, then reject missing, unknown, stale, duplicate, unrelated and out-of-order evidence. Preserve the actual task graph and review activity recordings. No implementation or test binding yet.

**Wallpaper effects remain bounded and optional.** Extend `theme-provider.tsx` and the shared frame with Off/Subtle/Expressive wallpaper motion. Default to bounded Subtle motion when no valid saved choice exists. Preserve explicit saved Off and manual scenes. Settings provides an immediate Off opt-out. Off disables wallpaper animation, not the selected static scene. System and in-app reductions override Expressive from first paint. Hidden documents, constrained resources and unavailable rendering use a static fallback. Use one shared renderer, not one renderer per panel. Preserve material tokens, readable black light-theme text and opaque/forced-color alternatives. Motion never delays input, changes status, plays audio or introduces sharp flashes. | Planned: extend `ThemeProvider.test.tsx`, `WorkspaceFrame.test.tsx` and `canopy-glass.browser.ts` with preference, interruption, lifecycle, contrast and fallback cases. R010 requires measured frame/input/memory evidence before acceptance.

**Weather ambience uses explicit consent and truthful conditions.** Extend existing appearance controls with optional weather following and clearly labelled manual previews. Offer Clear, Rain, Snow, Thunderstorm, Fog, Heat and Cloudy. Weather following requires an explicitly chosen location and authorized provider. Prefer existing Arbora/MCP sources; never assume an API, infer location or request GPS automatically. Represent unknown, stale, offline and unsupported conditions without inventing current weather. Rain on glass preserves text and controls; heat distorts background only. Opt-in ambient playback has separate safety/performance acceptance; audio remains off by default. | Planned: extend `ThemeProvider.test.tsx`, `WorkspaceFrame.test.tsx` and `canopy-glass.browser.ts`. Prove opt-in, disable, provider/location scope, freshness, manual-preview labels, every weather variant and content-safe effects. Assert no weather requests before consent or after disabling.

**Evaluation dashboard shows calibration and coverage.** A dashboard presents decision evaluation calibration and coverage metrics — cohort, sample count, source class, evaluation window, target versus observed coverage, risk, and receipt version — as independently labeled fields, and shows no numeric coverage, calibration or deployment claim when the evaluation is synthetic-only, missing or underpowered. | Independent-label fixture tests plus negative fixtures for the synthetic-only, missing, and underpowered cases.

**Decision explorer cites premises, derivations and certificate.** A typed decision explorer renders the chosen and excluded options for a decision. It cites the premise and derivation identifiers, the certificate and any violations that applied. | Contract fixture and rendered route tests.

**Why-not explanations run on demand within a bounded budget.** A why-not explanation is computed on demand within a bounded solve budget. The reader sees any timeout or refusal. It never alters the original decision record. | Timeout and refusal integration fixture tests.

**Dashboard labels each evaluation field independently.** The evaluation dashboard labels cohort, sample count, source class, evaluation window, target and observed coverage, risk, and receipt version as separate, independently sourced fields rather than a single combined claim. | Independent-label fixture and rendered dashboard tests.

**No coverage claim shown for inadequate evaluation data.** The dashboard shows no numeric coverage, calibration or deployment claim when the underlying evaluation is synthetic-only, missing, or underpowered. | Negative fixture tests for each of the synthetic-only, missing, and underpowered cases.

**Tenant or purpose change invalidates cached decision queries.** Changing tenant or purpose invalidates any cached decision or evaluation query. A stale response never overwrites a result from a newer selection. | Two-tenant browser test exercising cache invalidation and stale-response ordering.

**Explanation views work without color, hover or pointer.** Every part of the decision explanation structure is usable without relying on color alone, hover-only reveal, or pointer-only controls. | Keyboard and accessibility tests covering the full explanation structure.

**Decision explorer surfaces premises, derivations and violations.** The decision explorer presents a selected decision's premise classes, derivations, certificate, why-not explanation and violations through the WebUI. Typed calls to the Arbora read API back it. | Component tests cover the explorer's rendering logic, plus a browser integration test against an authenticated Keycloak-backed Arbora session.

**Mobile-first Markets app with five-destination navigation (rollup).** Split into `FIN-UI-R001.1` (detail-tab support) and `FIN-UI-R001.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Detail-tab support model.** A typed detail-tab support model decides which of the six detail tabs an instrument supports. The tabs are Chart, Rates, News, Notes, Dividends and Analysis. The instrument's series capabilities set the result. | Verified by `detail-support.test.ts` asserting each capability combination yields the correct supported/unsupported tab set.

**Live Markets app wiring (remaining).** The remaining scope is wiring these parts into the live Markets app. The parts are the five-destination navigation, instrument groups and sparkline rows. They also include the detail view's six tabs gated by `FIN-UI-R001.1`. The range selector and the performance-versus-benchmark card complete the list. The wiring includes PWA install, theming and accessibility. | Verified by a responsive browser test across phone and desktop viewports confirming the navigation, group and detail views, and accessibility behavior.

**Shared ChartRenderer for line, candle, and overlay data (rollup).** Split into `FIN-UI-R002.1` (ChartRenderer contract) and `FIN-UI-R002.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Shared ChartRenderer input contract.** A typed shared ChartRenderer input contract validates line series and complete OHLC candle series. It defines decimation that never alters finalized trail, flip or state output. It also defines a versioned, simulation-flagged overlay marker type. | Verified by `chart-contract.test.ts` asserting decimated and full-resolution views of the same fixture produce identical finalized trend and overlay output.

**Live ChartRenderer wiring (remaining).** The remaining scope is wiring the shared ChartRenderer contract into the live ChartRenderer and ChartPage components. The components render line, area and candle series with a volume pane. They draw overlays. The overlays cover trend lines, flips, DCA buys, cost basis, and margin and liquidation levels. They support touch crosshair and pinch-zoom interaction. | Verified by a chart-rendering test comparing full-resolution and decimated views of the same fixture and asserting identical finalized trend and overlay output.

**Responsive five-destination navigation.** The application presents five top-level destinations. On narrow viewports they appear as a bottom navigation bar. On desktop they appear as a side rail. The selected route and keyboard focus stay coherent across layouts. | Verified by a responsive browser test at phone and desktop widths confirming the correct navigation chrome and consistent selection and focus.

**Instrument groups with distinct data states.** User-defined instrument groups and their Basic/Holdings mode preserve the selected group and mode. The UI shows each of these results as a separate state: loading, genuinely empty, stale, partial, permission-denied and unavailable. It never collapses them into one state. | Verified by a component test driving each data state from a fixture and asserting a distinct, correctly labeled rendering for each.

**Search resolves by stable identity, not ticker text.** Instrument search and selection key off stable instrument and listing IDs, together with venue and quote currency. A ticker symbol alone never identifies an instrument. | Verified by a test using two identically ticked instruments on different venues and asserting search and detail views keep them distinct by ID.

**Instrument rows show price, provenance, after-hours value.** Instrument rows and detail views show the current price with session and source provenance. They also show the previous close, the price change and a sparkline. They show a licensed logo or text fallback. When the owner supplies an after-hours value, they label it separately. | Verified by a fixture-driven test covering regular, pre-market, post-market, delayed, and missing quotes, asserting each field renders correctly and a missing price is never shown as zero.

**Detail tabs and range controls expose only supported data (rollup).** Split into `FIN-UI-R008.1` (supportedChartMode) and `FIN-UI-R008.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Pure supportedChartMode gating function.** A pure `supportedChartMode` function gates interval, data-type and volume combinations for the detail view. It returns an explanatory reason when a combination is unsupported. | Verified by `chart-contract.test.ts` and `detail-support.test.ts` driving valid and unsupported timeframe/data-type combinations and asserting the correct supported state and reason.

**Live detail-tab/range-control wiring (remaining).** The remaining scope is wiring `supportedChartMode` into the live detail view's tabs, range controls and line, candle and volume toggle. The running UI then hides or explains unsupported options. Fixtures alone do not meet this need. | Verified by a test driving valid and unsupported timeframe and data-type combinations and asserting unsupported options are hidden or explained rather than silently rendered.

**Shared ChartRenderer preserves gaps and revisions.** One typed ChartRenderer, shared with the Atlas renderer, draws scalar line and area series and complete OHLC candles. It preserves data gaps. It preserves bar revisions by ID. It does not smooth over them. It performs no authoritative indicator computation of its own. | Verified by a unit and browser test asserting candle mode only accepts valid OHLC bars, gaps persist, a revised bar replaces the prior one by ID, and no indicator values originate client-side.

**Chart overlays show strategy version and simulation state (rollup).** Split into `FIN-UI-R010.1` (overlay marker type) and `FIN-UI-R010.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Overlay marker version/simulation-flag type.** Chart overlay markers carry a strategy version. They also carry a simulation flag. `overlayLabel` tags simulated results apart from finalized ones. | Verified by the batch-2 contract tests asserting overlay markers carry the correct version and simulation label for a finalized trend flip, DCA buy, cost basis, and simulated margin level.

**Live chart overlay wiring (remaining).** The remaining scope is wiring the versioned overlay marker type into the live chart overlay rendering. The marker type carries a simulation flag. The overlays cover trend lines, flips, DCA buys, cost basis, and margin and liquidation levels. | Verified by a test comparing full-resolution and decimated chart views on a fixture with a finalized trend flip, DCA buy, cost basis, and simulated margin level, asserting markers align to the correct bars and versions.

**Performance cards render owner-calculated values verbatim (rollup).** Split into `FIN-UI-R011.1` (verbatim-value contract) and `FIN-UI-R011.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Performance/benchmark card verbatim-value contract.** Performance and benchmark cards reproduce the owning service's decimal string verbatim. They have explicit unavailable and stale states. They never recompute values on the client. | Verified by the batch-2 contract-fixture tests with multi-currency cash flows, dividends, splits, fees, and a stale valuation, asserting no client-side recomputation.

**Live performance/benchmark card wiring (remaining).** The remaining scope is wiring the verbatim-value contract into the live performance and benchmark card components. The cards show the return method and currency. They also show the source, as-of time and session. | Verified by a contract-fixture test with multi-currency cash flows, dividends, splits, fees, and a stale valuation, asserting the UI reproduces the owner's decimal-string output with no client-side recomputation.

**Strategy views cite evidence and never submit orders (rollup).** Split into `FIN-UI-R012.1` (evidence/abstain contract) and `FIN-UI-R012.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Strategy view evidence/abstain contract type.** Strategy recommendation view types cite versioned evidence or an explicit abstain reason, and contain no order-submission field by construction. | Verified by the batch-2 fixture tests covering a calibrated proposal, thin history, warmup, drift, and a missing scorecard.

**Live strategy/recommendation view wiring (remaining).** The remaining scope is wiring the evidence and abstain contract type into the live views. These are the strategy and recommendation views. No order-submission path exists in the rendered UI. | Verified by a fixture test covering a calibrated proposal, thin history, warmup, drift, and a missing scorecard, asserting the shown evidence and abstention reason and confirming no order request originates from the panel.

**DCA and alert views distinguish delivery states (rollup).** Split into `FIN-UI-R013.1` (delivery-receipt dedupe) and `FIN-UI-R013.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**DCA/alert delivery-receipt dedupe contract.** DCA and alert delivery receipts dedupe a duplicated event ID. They also dedupe a channel retry. The UI never reports a paper fill as a live fill. | Verified by the batch-2 fixture tests exercising due, missed, failed, replayed, paper-filled, and delivered states including a duplicated event ID and channel retry.

**Live DCA/alert delivery-state wiring (remaining).** The remaining scope is wiring the delivery-receipt dedupe contract into the live DCA and alert views. Each state renders as a distinct outcome. | Verified by a fixture test exercising each state, including a duplicated event ID and a channel retry, asserting the states and receipts remain distinct and a paper fill is never shown as a live fill.

**CSV import preview with idempotent receipt (rollup).** Split into `FIN-UI-R014.1` (CSV import contract) and `FIN-UI-R014.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**CSV import preview contract mirroring the SDK.** CSV import preview types mirror `agent_connector_sdk.finance.csv_import`, modeling column-mapping errors and idempotent re-import keyed by file digest. | Verified by the batch-3 CSV fixture tests with mapped and unmapped columns, a malformed row, and a duplicate digest.

**Live CSV import preview wiring (remaining).** The remaining scope is wiring the CSV import preview contract into the live import flow. After import, the flow shows holdings from the owning service's response. | Verified by a CSV fixture test with mapped and unmapped columns, a malformed row, and a duplicate digest, asserting preview counts, idempotent receipts, and owner-sourced holdings.

**Offline PWA shell marks cached data stale (rollup).** Split into `FIN-UI-R015.1` (offline cache contract) and `FIN-UI-R015.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Offline cache staleness contract.** An offline cache view type marks data stale and disables current-state actions while offline or expired. | Verified by the batch-3 offline-cache fixture tests.

**Live offline PWA shell wiring (remaining).** The remaining scope is wiring the offline cache staleness contract into the live installed PWA shell. Offline, the shell shows previously cached financial facts. It marks them stale. Current-data actions are disabled. | Verified by an offline test loading a previously valid finance view without network access and asserting cached values are labeled stale and current-data actions are unavailable.

**Charts and controls meet accessibility requirements (rollup).** Split into `FIN-UI-R016.1` (accessibility contract) and `FIN-UI-R016.2` (live wiring), producer first. This row is LANDED only when both children are LANDED. | Each child's own verification row; see below.

**Chart accessibility text-summary contract.** A chart accessibility contract defines a screen-reader text summary and non-color direction words for chart state. | Verified by the batch-3 accessibility contract tests.

**Live chart/control accessibility wiring (remaining).** The remaining scope is wiring the accessibility text-summary contract into the live charts and controls. This covers keyboard operation and 200% zoom. It also covers reduced motion and non-color state indicators. | Verified by an accessibility review combining keyboard-only operation, screen-reader inspection, 200% zoom, reduced-motion, and high-contrast checks against each chart and control.

**Arbora Markets app with scanner, search, and layered chart.** An Arbora-hosted Markets application offers a market overview and a scanner with filters. It also offers symbol search and a layered chart view. It reuses the shared Atlas OHLC ChartRenderer and the epistemic-graph engine's large-dataset decimation. It also exposes its market actions as WebMCP tools. | Verified by an integration test driving the scanner, search, and chart views against fixture market data and confirming the WebMCP tool calls return the expected results.

**Identity mode wizard shows the active auth mode with no hidden bypass.** The identity wizard shows the operator-selected mode: explicit no-auth, built-in EG authentication or external OIDC (including Keycloak/Okta). Loopback bootstrap is a separate setup state, not an implicit authentication mode. It also shows a diagnostic check result. An explicitly configured no-auth mode is visible and policy-bounded. Missing credentials, broken verifiers and provider outages cannot select it implicitly. | Mode-specific rendered and server tests confirm each mode displays correctly and no bypass is possible.

**Local account flows use server sessions with no stored credentials.** Agent-webui's local registration, login, logout, forgot-password, reset-password and change-password flows use server-managed sessions with anti-CSRF protection. No credential or bearer token is stored in browser persistence. | End-to-end session-fixation and CSRF probe tests confirm no credential leaks into browser storage.

**MFA enrollment and recovery cover TOTP and WebAuthn.** Agent-webui supports MFA enrollment, challenge and recovery for both TOTP and WebAuthn, including recovery codes that can each be used only once. | Positive, replay and lost-device tests confirm enrollment, challenge and one-time recovery behavior.

**Identity admin tabs cover users, roles, groups and mapping dry run.** Agent-webui's administration interface provides tabs for users, roles, groups, authentication modes and a mapping-rule dry run, each calling a typed identity Arbora operation. | Authorized and denied generated-client tests confirm each admin tab enforces the correct access.

**Elevation requests display scope, expiry and a bound receipt.** Agent-webui's elevation request, approval and revocation views display the requested scope, reason, expiry and resulting receipt. The confirmation and step-up for an elevation action are bound to the caller and action that requested it. | Parity tests across chat and UI surfaces plus adversarial tests confirm the binding holds.

**Identity or tenant change invalidates cached protected data.** Changing the identity mode, tenant or session in agent-webui invalidates any cached protected data. It closes active privileged interactions. It does not leave them reachable under the prior context. | A two-principal browser test confirms cached data and privileged interactions are closed on change.

**Identity forms and confirmations are accessible on desktop and mobile.** Agent-webui's identity forms, error messages, admin tab panels and modal confirmations are usable by keyboard and screen reader, with equivalent behavior on mobile. | An accessibility end-to-end test suite confirms keyboard, screen-reader and mobile parity.

**Release-qualification identity test client supports a live sign-in probe.** Agent-webui's release qualification maintains a dedicated OIDC test client and test-realm user. A real browser sign-in probe against the identity provider can then run end to end. | A browser sign-in probe against the provisioned test client and user confirms the authentication path works.

**Admin UI surfaces identity operations for users, roles and navigation.** UserManagementView.tsx, AdminView.tsx and nav-registry.ts present identity administration through the Arbora identity API. | Authorized and denied generated-client tests against the live identity API confirm the admin UI enforces correct access.

**Explicit no-auth mode with bounded anonymous policy.** The operator can intentionally select no-auth for WebUI and its Arbora/EG composition. The UI clearly displays anonymous operation, its configured policy scope and the lack of confirmed human identity. Normal navigation and operations permitted by that policy work through the same UI/WebMCP dispatch. No synthetic logged-in principal, service bearer or no-op admission callback may masquerade as authentication. Network exposure obeys explicit host/origin policy; default qualification is isolated loopback. Anonymous provenance is distinguished from authenticated receipts. Operations requiring real identity, MFA, named approval or attended authenticated control must return a typed requirement/refusal, never fabricated proof. | Planned: The installed no-auth stack completes declared anonymous-policy journeys. It rejects out-of-scope/identity-required operations, cross-origin requests and accidental public exposure. UI/tool results identify the same anonymous scope.

**Built-in EG authentication through Arbora.** Provide built-in EG account/session authentication via Arbora-owned served identity operations and the existing WebUI session boundary. Login, session descriptors, authority and logout are composed from the real producer; WebUI stores no graph credentials or policy database. Browser HTTP and WebSocket requests carry the same validated context. | Planned: Test real composed EG login/session/use/logout with valid, invalid, expired, revoked and wrong-tenant sessions. Check HTTP/WebSocket parity and token protection.

**External OIDC provider interoperability.** Support configured Keycloak and Okta through the shared OIDC/session contract, validating issuer, audience, callback/state/nonce, verifier and tenant/role mapping. Provider secrets remain server-side. Partial configuration and unavailable or invalid providers fail closed without falling back to EG or no-auth. Treat provider selection/configuration changes as operator-controlled changes, not an unauthenticated browser toggle. | Planned: Test OIDC protocol fixtures and each claimed live provider. Reject wrong issuer/audience/state, replay, unavailable discovery/JWKS and incomplete configuration. Unavailable live-provider evidence remains explicit.

**Long-session renewal and mode-transition coherence.** Auth modes share one server-authoritative lifecycle for expiry, bounded renewal, logout, revocation, tenant change and cancellation. In-flight UI and WebMCP calls use current admitted context, never old privileged state after transition. Renewal does not extend a revoked or logged-out session; concurrent requests coordinate renewal rather than multiplying credentials. Expired sessions require reauthentication without losing safe unsent drafts. No-auth has no invented auth renewal; changing into or out of it retires prior caches, streams, tools and receipts. | Planned: Test long-running HTTP/stream/WebSocket and manual/WebMCP flows across renewal, expiry, revocation/logout, multiple tabs and mode changes. Reject privilege carryover, duplicate effects and hidden downgrade.

**Explicit anonymous source refusal boundary.** Explicit no-auth binds no authenticated identity or grant. Default-empty exact read policy cannot admit direct enhanced effects. Presented credentials, unsafe exposure and cross-origin actions refuse. | Source mode tests cover anonymous provenance, policy refusal and ambient-authority cleanup. This does not deliver full no-auth journeys.

**Complete installed anonymous journeys.** Complete the parent no-auth navigation, visible policy and governed operations through shared UI/WebMCP dispatch. Preserve containment, confirmation and truthful anonymous receipts. | Installed positive and adversarial anonymous-policy journeys and native effect qualification remain required.

**EG boundary configuration source refusal.** EG mode requires a typed host-owned EG session boundary. An arbitrary callback or absent owner refuses. No configuration failure changes the mode. | Source factory tests reject missing and untyped EG callbacks without provisioning credentials.

**Installed EG identity journeys.** Complete the parent real EG account, login, session, logout and HTTP/WebSocket context contract through Arbora. | Installed real producer/browser qualification remains required; source configuration refusal is not login support.

**OIDC configuration source refusal.** OIDC mode requires complete verifier and browser SSO configuration. It rejects an EG boundary and never silently changes provider mode. | Source factory tests reject incompatible owners and incomplete browser OIDC configuration.

**External provider interoperability qualification.** Complete the parent OIDC contract for configured Keycloak and Okta. Validate real provider journeys and all protocol refusal cases. | Protocol fixtures and each claimed live provider remain required; configuration tests do not qualify provider interoperability.