# AtlasTerm/JoeSSH Codex Session Handoff

## 0. Latest continuation state (2026-06-09 controller) - ACTIVE LANE LEDGER + SAFE DISPATCH

Current controller baseline:

- Web admin static shell byte-budget guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now assigns an explicit byte budget to every audited static shell source carrier and verifies the budget inventory matches the pinned source inventory, with a fixture proving oversized static text assets fail the source-review contract, so static HTML, metadata, text, SVG, deployment header, and Service Worker assets cannot silently accumulate hidden payloads or oversized fallback content while preserving the existing exact-content and source hygiene guards.
- Verification for this Web admin static shell byte-budget slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused static-shell byte-budget probe (`static-shell-byte-budgets=pass`, `static-shell-budgeted-files=10`, `static-shell-largest-budget=4096`, `static-shell-largest-asset=2828`), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static manifest JSON duplicate-key guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now lexically scans static JSON shell sources for duplicate object keys before relying on parsed manifest metadata, with fixtures pinning both top-level and nested shortcut duplicate-key regressions, so `apps/web/public/manifest.json` cannot hide alternate launcher, shortcut, icon, scope, or integration metadata behind JSON parser last-write-wins behavior while still satisfying the parsed install-metadata baseline.
- Verification for this Web admin static manifest JSON duplicate-key slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused JSON probe (`static-json-duplicate-keys=none`, `static-json-files=1`, `static-manifest-parse=ok`), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell text-format hygiene guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now scans every collected static shell source for carriage returns, CRLF/bare-CR line endings, missing terminal newlines, duplicate terminal newlines, and trailing spaces or tabs, with fixtures pinning each failure shape, so static HTML, metadata, text, SVG, deployment header, and Service Worker carriers keep deterministic LF-only source formatting and cannot hide review-noise or packaging drift in whitespace-only changes.
- Verification for this Web admin static shell text-format hygiene slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused static-shell format probe (`static-shell-line-endings=lf`, `static-shell-format-files=10`, `static-shell-terminal-newline=single`, `static-shell-trailing-whitespace-lines=0`), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell text-encoding hygiene guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now scans every collected static shell source for disallowed C0/C1 controls, Unicode format characters, replacement characters, and common mojibake fingerprints while pinning fixtures for NUL, C1, bidirectional format controls, UTF-8 punctuation mojibake, and emoji mojibake, so static HTML, metadata, text, SVG, deployment header, and Service Worker carriers cannot silently ship hidden controls or corrupted visible copy outside the audited source-review inventory.
- Verification for this Web admin static shell text-encoding hygiene slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused static-shell encoding probe (`static-shell-encoding=clean`, `static-shell-encoding-files=10`, `static-shell-control-chars=0`, `static-shell-format-chars=0`, `static-shell-mojibake-fingerprints=0`), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static Service Worker cache-policy guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires `apps/web/public/sw.js` to keep the exact audited `install`/`activate`/`fetch` event inventory, cache name, 100-entry trim limit, five-entry precache set, install `skipWaiting`, activate old-cache cleanup plus `clients.claim`, GET and same-origin fetch boundaries, manifest/static/navigation handling, offline navigation fallback, stale-while-revalidate static asset path, and oldest-entry trim behavior, so the offline-support carrier cannot silently add or weaken cache lifecycle, request-scope, or fallback semantics while remaining inside the reviewed static shell source inventory.
- Verification for this Web admin static Service Worker cache-policy slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused Service Worker probe (`service-worker-events=install,activate,fetch`, `service-worker-cache-name=atlasterm-admin-v1`, `service-worker-static-assets=5`, `service-worker-max-cache-entries=100`, `service-worker-navigation-fallback=offline-503`, `service-worker-trim-policy=oldest-entry`), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell source inventory guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires the collected static shell sources to match the exact audited inventory for the Vite entry document, fallback documents, extensionless deployment headers, favicon, manifest, robots/humans text metadata, `.well-known/security.txt`, and the Service Worker asset, while the non-Service Worker shell subset must match the same inventory without `apps/web/public/sw.js`. The slice self-debugged an initially missing `.well-known/security.txt` path and now pins its exact security-contact metadata baseline too, so hidden public text assets cannot bypass source-review inventory, contact-policy drift, or broader shell capability scans.
- Verification for this Web admin static shell source inventory slice is green: `npm run test:web -- accessibilityContracts` (1/1 after self-debugging the missing `.well-known/security.txt` inventory entry), strict UTF-8 focused source-inventory probe (`static-shell-inventory=exact`, `static-shell-source-count=10`, `non-sw-static-shell-source-count=9`, `.well-known/security.txt-baseline=exact`, `.well-known/security.txt-lines=7`), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static text asset guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires `apps/web/public/robots.txt` and `apps/web/public/humans.txt` to match the exact audited static text asset baselines, including the root crawler directive and the AtlasTerm team/site metadata block, so public text metadata cannot silently drift into different crawl behavior, product attribution, tooling claims, or hidden markup/script carrier content outside the reviewed Web Admin shell source collection.
- Verification for this Web admin static text asset slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused text asset probe (`robots.txt-baseline=exact`, `robots.txt-lines=2`, `humans.txt-baseline=exact`, `humans.txt-lines=7`), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static deployment header asset guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires `apps/web/public/_headers` to match the exact audited deployment HTTP header asset baseline, including the root route selector, CSP `frame-ancestors 'none'`, `X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff`, strict-origin referrer policy, and disabled camera/microphone/geolocation/payment/USB/sensor capability directives, so the static deployment header carrier cannot silently drift away from the reviewed clickjacking, MIME, referrer, and browser-capability boundary while remaining covered by the broader shell source-review scan.
- Verification for this Web admin static deployment header asset slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused deployment-header probe (`deployment-headers-baseline=exact`, `deployment-headers-lines=6`, `deployment-headers-header-lines=5`), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static favicon asset guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now reads `apps/web/public/favicon.svg` through the static shell source collection and requires the exact audited JoeSSH Admin 32px rounded dark tile plus blue/white mark SVG baseline, so the browser favicon asset cannot silently drift into a different brand, geometry, or embedded markup surface outside reviewed Web Admin shell assets.
- Verification for this Web admin static favicon asset slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused favicon SVG probe (`favicon-svg-baseline=exact`, `favicon-svg-lines=5`, `favicon-svg-paths=2`), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static manifest install-metadata guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now parses `apps/web/public/manifest.json` and requires the exact audited JoeSSH Admin install metadata baseline, including launcher identity, description, root `id`/`start_url`/`scope`, standalone display, colors, orientation, three dashboard/device/audit shortcuts, productivity/utilities categories, and the single SVG maskable icon, so the static Web Admin manifest cannot silently drift into a different install surface while the advanced app-integration key guard remains in place.
- Verification for this Web admin static manifest install-metadata slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused manifest-baseline probe (`manifest-baseline=exact`, `manifest-shortcuts=3`, `manifest-icons=1`), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell style-block count guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now counts `<style>` open/close tags across every collected static shell source, requires exactly one audited fallback style block only in `apps/web/public/404.html` and `apps/web/public/offline.html`, and requires zero style blocks in the app entry document, manifest, Service Worker-adjacent shell files, deployment headers, and SVG assets, with style-block fixtures pinned so unaudited inline CSS blocks cannot appear outside the reviewed fallback recovery pages.
- Verification for this Web admin static shell style-block count slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused static-style-blocks probe (`apps/web/index.html`, `apps/web/public/manifest.json`, `apps/web/public/sw.js`, `apps/web/public/_headers`, and `apps/web/public/favicon.svg` style-blocks=0; `apps/web/public/404.html` and `apps/web/public/offline.html` style-blocks=1; fixtures matched), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static app-shell metadata guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires `apps/web/index.html` to keep exactly one audited app document shell for the Vite entry page, including `doctype`, `lang`, `head`/`body`/`html` boundaries, charset, viewport, product description, theme/color-scheme, Apple mobile-web-app metadata, CSP, Permissions-Policy, referrer, `nosniff`, Open Graph, Twitter, and title tags, so the primary Web Admin entry document cannot silently drift away from the reviewed browser/security/social metadata baseline.
- Verification for this Web admin static app-shell metadata slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused app-shell metadata probe (`apps/web/index.html` document-shell/app/security/social metadata counts all exactly 1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell root-mount guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires `apps/web/index.html` to keep exactly one audited `<div id="root"></div>` Vite mount point and requires every other collected static shell source to keep zero `id="root"` attributes, with alternate root-ID fixtures pinned so fallback pages, metadata, header assets, and Service Worker-adjacent shell files cannot collide with the React mount boundary or create ambiguous app roots.
- Verification for this Web admin static shell root-mount slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused static-root-mount probe (`apps/web/index.html` static-root-mount=exact; `apps/web/public/404.html`, `apps/web/public/offline.html`, `apps/web/public/manifest.json`, `apps/web/public/sw.js`, and `apps/web/public/_headers` static-root-mount=absent; alternate root-ID fixtures matched), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell interactive-attribute guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks `contenteditable`, `draggable`, and `popover` attributes across collected static shell sources and pins editable, drag-and-drop, and popover fixtures, so static HTML, fallback pages, metadata, header assets, and Service Worker-adjacent shell files cannot introduce manual editing, file-drag affordances, or browser popover state outside the audited React/runtime paths.
- Verification for this Web admin static shell interactive-attribute slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused static-interactive-attrs probe (`apps/web/index.html`, `apps/web/public/404.html`, `apps/web/public/offline.html`, `apps/web/public/manifest.json`, `apps/web/public/sw.js`, and `apps/web/public/_headers` static-interactive-attrs=absent; contenteditable/draggable/popover fixtures matched), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell permitted link-set guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires `apps/web/index.html` to keep exactly the audited favicon and manifest `<link>` tags while every other collected static shell source keeps zero `<link>` tags, with stylesheet and alternate-icon fixtures pinned so static HTML, fallback pages, metadata, header assets, and Service Worker-adjacent shell files cannot introduce unaudited passive resource or app-integration link entries outside the reviewed Vite shell.
- Verification for this Web admin static shell permitted link-set slice is green: `npm run test:web -- accessibilityContracts` (1/1 after self-debugging stateful global regex fixture reuse), strict UTF-8 focused static-link permitted-set probe (`apps/web/index.html` static-link-set=exact; `apps/web/public/404.html`, `apps/web/public/offline.html`, `apps/web/public/manifest.json`, `apps/web/public/sw.js`, and `apps/web/public/_headers` static-link-set=absent; stylesheet/alternate-icon fixtures matched), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell focus-attribute guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks `autofocus` and `tabindex` attributes across collected static shell sources and pins representative focus-steal/manual-tab-order fixtures, while `docs/qa-checklist.md` documents the shell source-review coverage, so static HTML, fallback pages, metadata, header assets, and Service Worker-adjacent shell files cannot steal keyboard focus or override native tab order outside the audited React focus-management paths.
- Verification for this Web admin static shell focus-attribute slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused focus-attribute probe (`apps/web/index.html`, `apps/web/public/404.html`, `apps/web/public/offline.html`, `apps/web/public/manifest.json`, `apps/web/public/sw.js`, and `apps/web/public/_headers` focus-attributes=absent; autofocus/tabindex fixtures matched), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell base-element guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks `<base>` elements across collected static shell sources and pins `href` plus `target` fixture variants, while `docs/qa-checklist.md` documents the shell source-review coverage, so static HTML, fallback pages, metadata, header assets, and Service Worker-adjacent shell files cannot rewrite relative URL resolution or default browsing targets outside the audited root recovery links and app routing paths.
- Verification for this Web admin static shell base-element slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused base-element probe (`apps/web/index.html`, `apps/web/public/404.html`, `apps/web/public/offline.html`, `apps/web/public/manifest.json`, `apps/web/public/sw.js`, and `apps/web/public/_headers` base-element=absent; href/target fixtures matched), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell script-entry guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires `apps/web/index.html` to keep exactly one `<script type="module" src="/src/main.tsx"></script>` Vite module entrypoint and requires every other collected static shell source to keep zero script open/close tags, while `docs/qa-checklist.md` documents the shell source-review coverage, so fallback pages, metadata, header assets, and Service Worker-adjacent shell files cannot introduce unreviewed static script elements outside the audited app entrypoint.
- Verification for this Web admin static shell script-entry slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused static-script-entry probe (`apps/web/index.html` static-script-entry=exact; `apps/web/public/404.html`, `apps/web/public/offline.html`, `apps/web/public/manifest.json`, `apps/web/public/sw.js`, and `apps/web/public/_headers` static-script-entry=absent), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell meta-refresh guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks `<meta http-equiv="refresh">` redirects across collected static shell sources and pins quoted plus attribute-order fixture variants, while `docs/qa-checklist.md` documents the shell source-review coverage, so static HTML, manifest, header, and Service Worker-adjacent shell assets cannot introduce document-level timed navigation outside the audited in-app routing and recovery-link paths.
- Verification for this Web admin static shell meta-refresh slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused meta-refresh probe (`apps/web/index.html`, `apps/web/public/404.html`, `apps/web/public/offline.html`, `apps/web/public/manifest.json`, `apps/web/public/sw.js`, and `apps/web/public/_headers` meta-refresh=absent; quoted/attribute-order fixtures matched), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell inline-style-attribute guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks inline `style=` attributes across collected static shell sources and pins representative HTML/SVG style-attribute fixtures, while `docs/qa-checklist.md` documents the shell source-review coverage, so static HTML, manifest, header, and Service Worker-adjacent shell assets cannot introduce unreviewed per-element inline styles outside the audited fallback `<style>` blocks and bundled CSS path.
- Verification for this Web admin static shell inline-style-attribute slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused inline-style probe (`apps/web/index.html`, `apps/web/public/404.html`, `apps/web/public/offline.html`, `apps/web/public/manifest.json`, `apps/web/public/sw.js`, and `apps/web/public/_headers` inline-style-attribute=absent; HTML/SVG style fixtures matched), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell inline-event-handler guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks inline `on*=` event-handler attributes across collected static shell sources and pins representative click/load attribute fixtures, while `docs/qa-checklist.md` documents the shell source-review coverage, so static HTML, manifest, header, and Service Worker-adjacent shell assets cannot introduce hidden inline JavaScript handlers outside the audited React/runtime paths.
- Verification for this Web admin static shell inline-event-handler slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused inline-event probe (`apps/web/index.html`, `apps/web/public/404.html`, `apps/web/public/offline.html`, `apps/web/public/manifest.json`, `apps/web/public/sw.js`, and `apps/web/public/_headers` inline-event-handler=absent; click/load fixtures matched), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback unused-button selector guard continued under the active Web admin lane: `apps/web/public/offline.html` now styles the recovery link directly through `.retry-link` instead of carrying unused `button` selectors, and `apps/web/src/accessibilityContracts.test.ts` now rejects lowercase `button` tokens across named fallback shell sources while keeping exact action selector/source wiring, so static 404/offline recovery pages cannot drift toward dead control selectors or misleading form-control affordances.
- Verification for this Web admin static fallback unused-button selector slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback unused-button probe (`apps/web/public/404.html` fallback-unused-button=ok; `apps/web/public/offline.html` fallback-unused-button=ok; `apps/web/public/offline.html` retry-link-selector-only=ok after self-debugging the probe to use line-anchored selector counts), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback action-selector wiring guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now treats each named fallback page as an exact action-source and action-selector contract, requires a single fallback `<style>` block, and counts the base, hover, focus-visible, reduced-motion, and forced-colors action selector lines exactly once, so the `404.html` root action and `offline.html` `.retry-link` action cannot silently drift away from their audited styling.
- Verification for this Web admin static fallback action-selector wiring slice is green: `npm run test:web -- accessibilityContracts` (1/1 after self-debugging comma-separated selector pseudo-class generation), strict UTF-8 focused fallback selector wiring probe (`apps/web/public/404.html` fallback-selector-wiring=ok; `apps/web/public/offline.html` fallback-selector-wiring=ok), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback recovery-action long-label wrapping guard continued under the active Web admin lane: `apps/web/public/404.html` and `apps/web/public/offline.html` now cap fallback recovery actions at `max-width: 100%` and allow `white-space: normal` wrapping while preserving the 44px touch target, padding, and focus treatments; `apps/web/src/accessibilityContracts.test.ts` now requires those action-wrap affordances across collected fallback shell sources, so future localized or longer recovery labels cannot force narrow fallback pages into horizontal overflow.
- Verification for this Web admin static fallback recovery-action long-label wrapping slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback action wrap probe (`apps/web/public/404.html` fallback-action-wrap=ok; `apps/web/public/offline.html` fallback-action-wrap=ok), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback recovery-action touch-target guard continued under the active Web admin lane: `apps/web/public/404.html` and `apps/web/public/offline.html` now give fallback recovery actions explicit `44px` minimum height and width plus stable `1.2` action line-height while preserving the existing padding, color, focus, motion, and forced-colors treatments; `apps/web/src/accessibilityContracts.test.ts` now requires those touch-target affordances across collected fallback shell sources, so mobile recovery actions cannot quietly regress below accessible tap-target sizing.
- Verification for this Web admin static fallback recovery-action touch-target slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback action touch probe (`apps/web/public/404.html` fallback-action-touch=ok; `apps/web/public/offline.html` fallback-action-touch=ok), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback long-token wrapping guard continued under the active Web admin lane: `apps/web/public/404.html` and `apps/web/public/offline.html` now apply `overflow-wrap: anywhere` to the full-width capped fallback `.card`, and `apps/web/src/accessibilityContracts.test.ts` now requires that wrapping treatment across collected fallback shell sources, so future long recovery strings, URLs, or diagnostic-safe copy cannot force narrow fallback pages into horizontal overflow.
- Verification for this Web admin static fallback long-token wrapping slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback card wrap probe (`apps/web/public/404.html` fallback-card-wrap=ok; `apps/web/public/offline.html` fallback-card-wrap=ok), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback card-width guard continued under the active Web admin lane: `apps/web/public/404.html` and `apps/web/public/offline.html` now set fallback `.card` wrappers to `width: 100%` while preserving the 400px cap, and `apps/web/src/accessibilityContracts.test.ts` now requires that full-width capped card treatment across collected fallback shell sources, so narrow recovery pages keep predictable wrapping instead of shrink-wrapping around content.
- Verification for this Web admin static fallback card-width slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback card width probe (`apps/web/public/404.html` fallback-card-width=ok; `apps/web/public/offline.html` fallback-card-width=ok), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback security-meta guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires each collected fallback shell source to keep exactly one static CSP meta tag (`default-src 'none'`, inline style only, no connections, locked base/form/object directives, and upgrade-insecure-requests), `X-Content-Type-Options: nosniff`, and the restrictive Permissions-Policy meta, so source-level 404/offline recovery pages cannot drift away from the built security-header expectations before deployment scans run.
- Verification for this Web admin static fallback security-meta slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback security meta probe (`apps/web/public/404.html` security-meta=ok; `apps/web/public/offline.html` security-meta=ok), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback document-shell metadata guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires each collected fallback shell source to keep exactly one `doctype`, `lang="en"` root, `head`/`body`/`html` shell boundary, UTF-8 charset, responsive viewport, dark theme color, `dark light` color-scheme, and strict-origin referrer meta, so static 404/offline recovery pages cannot regress into incomplete or poorly classified browser documents.
- Verification for this Web admin static fallback document-shell metadata slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback document-shell metadata probe (`apps/web/public/404.html` document-shell=ok; `apps/web/public/offline.html` document-shell=ok), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback icon and status-code style guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires both collected fallback shell sources to keep decorative icon scale and spacing at `3rem` plus `1rem`, and requires the 404 fallback status-code block to keep muted `#6e7681`, `0.875rem`/700, `0.08em` uppercase styling, and `0.5rem` spacing while offline remains status-code-free, so fallback visual hierarchy cannot regress into low-signal recovery screens.
- Verification for this Web admin static fallback icon and status-code style slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback icon/status-code style probe (`apps/web/public/404.html` icon-style=ok status-style=ok; `apps/web/public/offline.html` icon-style=ok status-style=absent), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback page-frame style guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires both collected fallback shell sources to keep centered full-viewport flex layout, dark surface and readable foreground colors, centered text, 2rem page padding, 400px card width, 1.5rem/600 heading hierarchy, and muted `#8b949e` line-height descriptions, so static `404.html` and offline fallback pages cannot regress into cramped or low-readability recovery screens.
- Verification for this Web admin static fallback page-frame style slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback page-frame style probe (`apps/web/public/404.html` page-frame-style=ok; `apps/web/public/offline.html` page-frame-style=ok), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback primary-action affordance guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires both collected fallback shell sources to keep primary recovery action styling for inline-block layout, green/default and hover backgrounds, white readable text, tappable padding, rounded corners, 1rem/500 typography, no underline, and background transition, so static fallback recovery links cannot regress into low-affordance plain text links while keeping focus/reduced-motion/forced-colors guards intact.
- Verification for this Web admin static fallback primary-action affordance slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback primary action style probe (`apps/web/public/404.html` primary-action-style=ok; `apps/web/public/offline.html` primary-action-style=ok), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback interactive CSS guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now requires both collected fallback shell sources to keep visible focus styling, the `#58a6ff` outline plus offset, reduced-motion transition removal, and forced-colors action borders, so keyboard focus, motion sensitivity, and high-contrast affordances cannot silently regress on static `404.html` or offline fallback pages.
- Verification for this Web admin static fallback interactive CSS slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback interactive CSS probe (`apps/web/public/404.html` interactive-css=ok; `apps/web/public/offline.html` interactive-css=ok), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback decorative-icon guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now extends the named fallback shell contracts with exact decorative icon text for `apps/web/public/404.html` and `apps/web/public/offline.html` and requires each fallback icon to be the single `<div class="icon" aria-hidden="true">...</div>` instance, so emoji state cues remain visual-only and cannot leak duplicate accessible names into the fallback page tree.
- Verification for this Web admin static fallback decorative-icon slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback decorative icon probe (`apps/web/public/404.html` icon=1 ariaHidden=1; `apps/web/public/offline.html` icon=1 ariaHidden=1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback detail-copy and status-code guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now extends the named fallback shell contracts with exact visible description text for both `apps/web/public/404.html` and `apps/web/public/offline.html`, requires the 404 fallback to keep exactly one visible `class="status-code"` marker with `404`, and requires the offline fallback to carry no status-code marker, so fallback pages cannot regress to terse headings or misleading status affordances.
- Verification for this Web admin static fallback detail-copy and status-code slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback description/status probe (`apps/web/public/404.html` description=1 status=1; `apps/web/public/offline.html` description=1 status=0), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback document-title and recovery-action guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now extends the named fallback shell contracts with exact `JoeSSH — Page Not Found` and `JoeSSH — Offline` document titles plus exact root `href="/"` recovery action links, so fallback pages cannot drift to ambiguous titles or non-root recovery destinations while keeping visible heading/action and native landmark checks intact.
- Verification for this Web admin static fallback document-title and recovery-action slice is green: `npm run test:web -- accessibilityContracts` (1/1), strict UTF-8 focused fallback title/action probe (`apps/web/public/404.html` title=1 rootAction=1; `apps/web/public/offline.html` title=1 rootAction=1) after self-debugging PowerShell default-decoding false negatives on the em dash, focused `rg -n '\starget\s*=|\srel\s*=' apps/web/public/404.html apps/web/public/offline.html -S` (no matches), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback visible content guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now treats `apps/web/public/404.html` and `apps/web/public/offline.html` as named fallback shell contracts and requires each collected fallback source to expose exactly one visible `<h1>` heading and exactly one visible action link text (`Page not found`/`Go to Dashboard` and `You're offline`/`Retry Connection`), in addition to the native landmark cardinality and no fallback `role` guard.
- Verification for this Web admin static fallback visible content slice is green: `npm run test:web -- accessibilityContracts` (1/1), focused fallback visible content probe (`apps/web/public/404.html` heading=1 action=1; `apps/web/public/offline.html` heading=1 action=1), focused `rg -n 'aria-label\s*=' apps/web/public/404.html apps/web/public/offline.html -S` (no matches), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback landmark cardinality guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now counts the collected `apps/web/public/404.html` and `apps/web/public/offline.html` fallback shell sources and requires exactly one opening native `<main>` plus exactly one closing `</main>` per fallback page, while also blocking any fallback source-level `role` attribute so alert/generic role regressions cannot replace semantic fallback landmarks.
- Verification for this Web admin static fallback landmark cardinality slice is green: `npm run test:web -- accessibilityContracts` (1/1), focused fallback main count probe (`apps/web/public/404.html` open=1 close=1; `apps/web/public/offline.html` open=1 close=1), focused `rg -n '\srole\s*=' apps/web/public/404.html apps/web/public/offline.html -S` (no matches), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static fallback native main landmark coverage continued under the active Web admin lane: `apps/web/public/offline.html` now uses the native `<main class="card">` fallback wrapper alongside `apps/web/public/404.html`, and `apps/web/src/accessibilityContracts.test.ts` now requires the collected static fallback shell sources to expose native opening and closing `<main>` landmarks while retaining the redundant `role="main"` source guard.
- Verification for this Web admin static fallback native main landmark slice is green: `npm run test:web -- accessibilityContracts` (1/1), focused `rg -n '<main|</main>' apps/web/public/404.html apps/web/public/offline.html -S` (both fallback pages), focused `rg -n 'role=' apps/web/public/404.html apps/web/public/offline.html -S` (no matches), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell native main landmark hardening continued under the active Web admin lane: `apps/web/public/404.html` now uses the native `<main class="card">` element instead of `role="main"`, and `apps/web/src/accessibilityContracts.test.ts` now rejects redundant source-level `role="main"` across collected static shell sources including fallback pages, metadata, SVG/text assets, and `_headers`.
- Verification for this Web admin static shell native main landmark slice is green: `npm run test:web -- accessibilityContracts` (1/1), focused `rg -n 'role="main"' apps/web/index.html apps/web/public -S` (no matches), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell no-`aria-label` source guard coverage continued under the active Web admin lane: `apps/web/public/404.html` now lets the visible `Go to Dashboard` link text provide the accessible name instead of carrying a redundant source-level `aria-label`, and `apps/web/src/accessibilityContracts.test.ts` now applies the no-`aria-label` attribute contract to all collected static shell sources including fallback pages, metadata, SVG/text assets, and `_headers`.
- Verification for this Web admin static shell no-`aria-label` guard slice is green: `npm run test:web -- accessibilityContracts` (1/1), focused `rg -n "aria-label\s*=" apps/web/index.html apps/web/public -S` (no matches), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell unsafe URL/script/HTML helper source guard coverage continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now scans `productionShellSources` for raw HTML injection helper strings, dynamic script execution helper strings, and unsafe URL protocols in addition to browser capability entrypoints, so `index.html`, static fallback pages, metadata, SVG/text assets, and `_headers` cannot carry `javascript:`/`vbscript:`/HTML-data protocol or script-eval helpers outside the audited Web Admin source-review contract. The large static source-review test now has an explicit 10 second Vitest timeout to prevent full-suite scheduling jitter from weakening the expanded guard coverage.
- Verification for this Web admin static shell unsafe URL/script/HTML helper guard slice is green after self-debugging the initial full-suite timeout: `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static deployment header asset source guard coverage continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now includes extensionless `_headers` files in collected shell sources and asserts `apps/web/public/_headers` is covered by both the static shell and non-Service Worker shell guard paths, so deployment header assets cannot bypass browser capability/source-review checks simply because they have no file extension. `docs/qa-checklist.md` documents extensionless deployment header asset coverage.
- Verification for this Web admin static deployment header asset guard slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:security-headers` (6/6 plus built scan), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static manifest app-integration key guard coverage continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now recursively scans parsed manifest objects for disallowed app-integration keys, so escaped or nested `display_override`, handler, related-app, scope-extension, URL-handler, or share-target entries inside static manifest structures cannot bypass the top-level manifest contract. `docs/qa-checklist.md` documents escaped and nested manifest key coverage.
- Verification for this Web admin static manifest app-integration key guard slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin non-Service Worker static shell browser storage/network/timer guard coverage continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now separates `nonServiceWorkerShellSources` from `productionShellSources` and blocks browser storage, network, timer, and string-timer entrypoints across static shell pages and metadata while keeping `apps/web/public/sw.js` fetch/cache behavior under its dedicated audited Service Worker contract.
- Verification for this Web admin non-Service Worker static shell guard slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin static shell browser-capability source guard coverage continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now scans `productionShellSources` for realtime communication, navigation mutation, cross-window messaging, form submission, passive resource loading, clipboard/file transfer, privileged browser APIs, Contacts Picker, protocol handlers, app integration, fingerprinting probes, device sensors, media/canvas capture, DOM expansion, native dialogs, and observer/frame scheduling while leaving Service Worker fetch/cache/timer/storage behavior under existing audited contracts. `docs/qa-checklist.md` documents the static shell source guard coverage.
- Verification for this Web admin static shell source guard slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin device sensor and immersive hardware source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks direct, optional, bracket/computed string-key, destructured, and type-cast access to sensor constructors, gamepad/vibration/XR navigator entrypoints, and screen-orientation locks, so hidden hardware aliases cannot bypass the audited admin snapshot path. `docs/qa-checklist.md` documents the device sensor and immersive hardware alias coverage.
- Verification for this Web admin device sensor and immersive hardware source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin observer/frame scheduler source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks direct, optional, bracket/computed string-key, destructured, and type-cast access to animation/idle frame callbacks, microtask scheduling, observers, and scheduler task/yield entrypoints, so hidden scheduling aliases cannot bypass the audited admin snapshot path. `docs/qa-checklist.md` documents the observer/frame scheduler alias coverage.
- Verification for this Web admin observer/frame scheduler source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin native browser dialog source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks direct, optional, bracket/computed string-key, destructured, and type-cast access to `alert`, `confirm`, `prompt`, `print`, `beforeunload`, and `onbeforeunload`, so hidden blocking-dialog or leave-interception aliases cannot bypass the audited admin snapshot path. `docs/qa-checklist.md` documents the native browser dialog alias coverage.
- Verification for this Web admin native browser dialog source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin DOM expansion and credential source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks direct, optional, bracket/computed string-key, destructured, and type-cast access to shadow DOM, editable content, DOM parsing/serialization, document command/range entrypoints, custom elements, popovers, and browser credential APIs, so hidden DOM expansion aliases cannot bypass the audited admin snapshot path. `docs/qa-checklist.md` documents the DOM expansion alias coverage.
- Verification for this Web admin DOM expansion and credential source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin media/canvas capture and local-recognition source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks direct, optional, bracket/computed string-key, destructured, and type-cast access to media capture, canvas capture/export, MIDI, canvas/audio contexts, and local-recognition constructors, so hidden capture aliases cannot bypass the audited admin snapshot path. `docs/qa-checklist.md` documents the media/canvas capture alias coverage.
- Verification for this Web admin media/canvas capture source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin passive-resource source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks passive media/frame/resource markup, preload/prefetch/srcset/poster attributes, `Image` constructor aliases, and direct, optional, bracket/computed string-key, destructured, and aliased `document.createElement(...)` calls for media/frame/resource tags, so hidden passive loads cannot bypass the audited admin snapshot path. `docs/qa-checklist.md` documents the passive-resource alias coverage.
- Verification for this Web admin passive-resource source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin form-submission source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks form markup, submit event listeners, and direct, optional, bracket/computed string-key, destructured, and type-cast `submit`/`requestSubmit` calls, so hidden form-post aliases cannot bypass the centralized live admin snapshot loader boundary. `docs/qa-checklist.md` documents the form-submission alias coverage.
- Verification for this Web admin form-submission source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin cross-window messaging source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks direct, optional, bracket/computed string-key, destructured, and type-cast access to `postMessage`, `MessageChannel`/`MessagePort`, `document.domain`, and window relationship surfaces such as `frames`, `name`, `opener`, `parent`, and `top`, so hidden frame/opener communication aliases cannot bypass the audited admin snapshot and hash-navigation boundaries. `docs/qa-checklist.md` documents the cross-window messaging alias coverage.
- Verification for this Web admin cross-window messaging source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin navigation-mutation source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks direct, optional, bracket/computed string-key, destructured, and type-cast access to `history.pushState`/`replaceState`, `location.assign`/`replace`/`href`, and `window.open`, plus `_blank`/opener markup, so hidden navigation aliases cannot bypass the audited hash-aware in-app navigation and reload boundaries. `docs/qa-checklist.md` documents the navigation-mutation alias coverage.
- Verification for this Web admin navigation-mutation source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin browser-network source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now strips the exact audited `loadAdminDashboard(window.fetch.bind(window), ...)` callsite before scanning `apps/web/src/main.tsx` and blocks direct, optional, bracket/computed string-key, destructured, and type-cast access to fetch, workers, sockets, event streams, broadcast channels, XHR, and beacon APIs, so hidden browser network aliases cannot bypass the audited admin snapshot loader boundary. `docs/qa-checklist.md` documents the browser-network alias coverage.
- Verification for this Web admin browser-network source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin browser-storage source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now strips the two exact audited language preference `window.localStorage` callsites before scanning the localization module and blocks direct, optional, bracket/computed string-key, destructured, and type-cast access to local/session storage, IndexedDB, document cookies, Cache API, and storage-manager entrypoints, so hidden storage aliases cannot bypass the audited storage boundary. `docs/qa-checklist.md` documents the browser-storage alias coverage.
- Verification for this Web admin browser-storage source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin privileged browser API source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks direct, optional, bracket/computed string-key, destructured, and type-cast access to fullscreen, geolocation, media devices, permissions, notifications, payments, Bluetooth/HID/Serial/USB, wake locks, and save-file picker entrypoints, so production Web Admin sources cannot hide privileged browser capability probes behind computed `navigator.geolocation`, `navigator.wakeLock`, `PaymentRequest`, or picker aliases. `docs/qa-checklist.md` documents the privileged browser API alias coverage.
- Verification for this Web admin privileged browser API source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin clipboard/file-transfer source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks direct, optional, bracket/computed string-key, destructured, and type-cast access for clipboard, native share, object-URL, drag/drop, download, and file-picker entrypoints, so production Web Admin sources cannot hide data ingress/egress paths behind computed `navigator.clipboard`, `navigator.share`/`canShare`, `URL.createObjectURL`, or file-picker aliases. `docs/qa-checklist.md` documents the clipboard/file-transfer/Web Share alias coverage.
- Verification for this Web admin clipboard/file-transfer source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin browser-storage audited callsite guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now counts exact production browser storage entrypoints and permits only the audited language preference `window.localStorage.setItem(LANGUAGE_STORAGE_KEY, choice)` and `window.localStorage.getItem(LANGUAGE_STORAGE_KEY)` calls in `apps/web/src/localization.ts`, so extra local/session storage, IndexedDB, cookie, Cache API, or storage-manager paths cannot hide behind the localization module's previous file-level exception. `docs/qa-checklist.md` documents the exact browser-storage callsite-count contract.
- Verification for this Web admin browser-storage audited callsite slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin browser-network audited callsite guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now counts exact production browser network entrypoints and permits only `loadAdminDashboard(window.fetch.bind(window), ...)` in `apps/web/src/main.tsx`, so extra direct `fetch`, worker, socket, event-stream, broadcast-channel, XHR, or beacon APIs cannot hide behind the Web shell's previous file-level exception. `docs/qa-checklist.md` documents the exact browser-network callsite-count contract.
- Verification for this Web admin browser-network audited callsite slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin service-worker audited callsite guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now counts exact `apps/web/src/sw-register.ts` Service Worker API entrypoints, pinning only the support probe, container capture, `/sw.js` registration, activated-controller check, and `controllerchange` listener, so the centralized offline-support module cannot quietly add readiness, lookup, or extra background registration paths under a broad file exception. `docs/qa-checklist.md` documents the exact `sw-register.ts` callsite-count contract.
- Verification for this Web admin service-worker audited callsite slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin service-worker source guard alias hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now reuses the object/property source matcher for `navigator.serviceWorker`, pinning bracket/computed string-key and destructured navigator alias access so production Web Admin modules cannot add service-worker registration, readiness, or lookup paths outside `apps/web/src/sw-register.ts` by hiding behind computed properties. `docs/qa-checklist.md` documents direct, optional, bracket/computed, destructured, and type-cast service-worker access coverage.
- Verification for this Web admin service-worker source guard alias slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin browser timer source guard precision hardening continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now counts exact production browser timer callsites and matches only the audited admin snapshot request-timeout `setTimeout`, paired `clearTimeout`, and service-worker update `setInterval`, so extra timers in those guarded files cannot hide behind a file-level exception. `docs/qa-checklist.md` documents the callsite-counted browser timer contract.
- Verification for this Web admin browser timer callsite guard slice is green: `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, `npm run qa:handoff-hygiene` (114/114 plus live scan), strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin language-choice input boundary hardening continued under the active Web admin lane: `apps/web/src/localization.ts` now rejects URL or stored language choices containing raw whitespace, C0/C1 controls, or Unicode format characters before locale resolution, so padded or hidden-character-bearing values cannot override the safe stored/fallback language path. `apps/web/src/localization.test.ts` pins padded URL values, bidirectional-control URL values, padded stored values, and zero-width stored values without increasing the 160/160 Web test count, while `docs/qa-checklist.md` documents the guarded language-choice fallback.
- Verification for this Web admin language-choice input boundary slice is green: `npm run test:web -- localization` (20/20), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin service-worker load registration hardening continued under the active Web admin lane: `apps/web/src/sw-register.ts` now attaches the service-worker registration bootstrap to the window `load` event with `{ once: true }`, so duplicate load dispatches cannot create duplicate service-worker registrations or hourly update timers. `apps/web/src/sw-register.test.ts` simulates once-only listener behavior and pins duplicate-load registration suppression without increasing the 160/160 Web test count, while `docs/qa-checklist.md` documents the once-only service-worker registration guard.
- Verification for this Web admin service-worker once-only registration slice is green: `npm run test:web -- sw-register` (4/4), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin loader URL normalization hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now normalizes the `loadAdminDashboard` snapshot URL argument immediately before fetch, so direct loader callers cannot bypass the same unsupported-protocol, malformed, raw-whitespace, backslash, userinfo, control, format-character, and fragment-stripping boundary used by `VITE_ATLASTERM_ADMIN_SNAPSHOT_URL`. `apps/web/src/adminData.test.ts` pins explicit unsafe URL fallback without increasing the 30/30 adminData test count, while `apps/web/README.md` and `docs/qa-checklist.md` document that fallback happens at the loader boundary.
- Verification for this Web admin loader URL normalization slice is green: `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin CSP/Permissions-Policy meta attribute-name boundary hardening continued under the active Web admin lane: `apps/web/src/csp.ts` now parses meta attributes by exact attribute name instead of a substring regex, so similarly named `data-http-equiv` attributes cannot shadow the real `http-equiv` CSP or Permissions-Policy tag replacement path. `apps/web/src/csp.test.ts` pins both CSP and Permissions-Policy similar-attribute regressions, while `docs/qa-checklist.md` documents attribute-name-boundary coverage.
- Verification for this Web admin CSP/Permissions-Policy meta attribute-name boundary slice is green: `npm run test:web -- csp` (13/13), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin bearer-token whitespace boundary hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now rejects configured live snapshot bearer tokens containing any internal whitespace after trimming, so ASCII spaces and Unicode line separators cannot enter the `Authorization` header. `apps/web/src/adminData.test.ts` pins env-token and fetch-header omission cases, while `apps/web/README.md` and `docs/qa-checklist.md` document the whitespace-bearing token contract.
- Verification for this Web admin bearer-token whitespace boundary slice is green: `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller Unicode format-character hygiene guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` rejects every non-BOM Unicode format character while preserving only a file-start U+FEFF BOM, so zero-width and bidirectional controls cannot hide in active handoff or QA checklist text. `scripts/check-handoff-hygiene.test.mjs` pins the U+202E handoff fixture plus the existing task-card and broad-scope hidden-character regressions, keeping the live self-test evidence at 114/114, while `docs/qa-checklist.md` documents Unicode format-character coverage.
- Verification for this controller Unicode format-character hygiene slice is green: `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing for touched files, stop-warning count, and `C:\Tools\agenttool` process scan all pass.
- Controller C1 control-character hygiene guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects U+007F through U+009F in addition to the existing C0 text controls, so hidden C1 controls such as U+009F cannot survive in active handoff or QA checklist text. `scripts/check-handoff-hygiene.test.mjs` adds a dedicated C1 handoff fixture and raises the live self-test evidence to 114/114, while `docs/qa-checklist.md` documents C0/C1 control-character coverage.
- Verification for this controller C1 control-character hygiene slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin raw-whitespace snapshot URL boundary hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` and `apps/web/src/csp.ts` now reject configured live snapshot URLs with raw internal whitespace before request normalization or optional CSP `connect-src` origin derivation can silently percent-encode ambiguous endpoint paths. `apps/web/src/adminData.test.ts` and `apps/web/src/csp.test.ts` pin absolute and root-relative raw-space cases, while `apps/web/README.md` and `docs/qa-checklist.md` document the raw whitespace URL fallback contract.
- Verification for this Web admin raw-whitespace snapshot URL boundary slice is green: `npm run test:web -- adminData csp` (43/43), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin CSP format-character snapshot-origin boundary hardening continued under the active Web admin lane: `apps/web/src/csp.ts` now rejects Unicode format characters while deriving the optional live admin snapshot `connect-src` origin, matching the configured snapshot request URL boundary so zero-width or bidirectional-control-bearing absolute URLs cannot expand the production CSP origin set. `apps/web/src/csp.test.ts` pins both zero-width and bidirectional-control URL cases, while `docs/qa-checklist.md` documents the CSP origin-boundary coverage.
- Verification for this Web admin CSP format-character snapshot-origin slice is green: `npm run test:web -- csp` (13/13), `npm run typecheck:web`, `npm run test:web -- adminData csp` (43/43), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin root-relative snapshot URL boundary hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now rejects configured live snapshot URLs that are neither HTTP(S) absolute nor root-relative, so `admin/snapshot`, `./admin/snapshot`, `../admin/snapshot`, or query-only values cannot drift with the current document path and will fall back to `/api/admin/snapshot`. `apps/web/src/adminData.test.ts` extends the existing unsafe-endpoint fixture, while `apps/web/README.md` and `docs/qa-checklist.md` document the non-root-relative URL fallback contract.
- Verification for this Web admin root-relative snapshot URL boundary slice is green: `npm run test:web -- adminData csp` (43/43), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin canonical record-ID boundary hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now requires live snapshot record IDs to be canonical lowercase ASCII tokens using only letters, digits, `.`, `_`, `:`, or `-`, so internal whitespace, path separators, uppercase drift, hidden controls, and bidirectional ambiguity cannot reach React row keys or accessible row references. `apps/web/src/adminData.test.ts` extends the existing unsafe-ID fixture without increasing the Web test file count, while `apps/web/README.md`, `docs/sync-api.md`, and `docs/qa-checklist.md` document the canonical snapshot ID contract.
- Verification for this Web admin canonical record-ID boundary slice is green: `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:sync-api-docs` (69 checks), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin format-character snapshot boundary hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now rejects Unicode format characters in configured snapshot URLs, configured bearer tokens, live snapshot record IDs, and live snapshot display strings before fetch or render code can consume them, extending the existing C0/C1, blank, and padded-value boundaries against zero-width or bidirectional-control ambiguity. `apps/web/src/adminData.test.ts` extends the existing URL, auth-token, record-ID, and display-field fixtures without increasing the Web test file count, while `apps/web/README.md` and `docs/qa-checklist.md` document the control-or-format-character snapshot contract.
- Verification for this Web admin format-character snapshot boundary slice is green: `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Web admin padded display-field boundary hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now rejects live snapshot display strings with leading or trailing whitespace before render code can consume them, extending the existing blank/control-character boundary so audit event text, device fields, member fields, role names, scopes, live time labels, and cursor/platform strings cannot render visually ambiguous padded values. `apps/web/src/adminData.test.ts` extends the existing display-field fixture without increasing the Web test file count, while `apps/web/README.md` and `docs/qa-checklist.md` document the unpadded snapshot display-field contract.
- Verification for this Web admin padded display-field slice is green: `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller blocklist revocation/suspension alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now catches additional revoke/revocation, suspend/suspension, quarantine, and restrict/restriction-style negative list aliases as blocklist-only terminology violations, so active or historical handoff prose and protected-root terminal-safety notes cannot bypass the required blocklist wording. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded blocklist terminology coverage.
- Verification for this controller blocklist revocation/suspension alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller policy-term verification-alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats additional validated/verified/certified-style positive policy aliases as CORS-origin-only equivalents, so active or historical handoff prose and protected-root terminal-safety notes cannot bypass the exact policy-term wording contract. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded policy-term alias coverage.
- Verification for this controller policy-term verification-alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller blocklist refusal-alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now catches additional disallow/refusal/barred-style negative list-family aliases as blocklist-only terminology violations, so active or historical handoff prose and protected-root terminal-safety notes cannot bypass the required blocklist wording. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded blocklist terminology coverage.
- Verification for this controller blocklist refusal-alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller policy-term consent-family alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats additional consent/consented/consenting-style positive policy aliases as CORS-origin-only equivalents, so active or historical handoff prose and protected-root terminal-safety notes cannot bypass the exact policy-term wording contract. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded policy-term alias coverage.
- Verification for this controller policy-term consent-family alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller policy-term permission-family alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats additional permission/permitted/permitting-style positive policy aliases as CORS-origin-only equivalents, so active or historical handoff prose and protected-root terminal-safety notes cannot bypass the exact policy-term wording contract. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded policy-term alias coverage.
- Verification for this controller policy-term permission-family alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller policy-term escape-hatch alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats additional exception/exemption/bypass-style positive policy aliases as CORS-origin-only equivalents, so active or historical handoff prose and protected-root terminal-safety notes cannot bypass the exact policy-term wording contract. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded policy-term alias coverage.
- Verification for this controller policy-term escape-hatch alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller policy-term entitlement-alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats additional access/privilege/eligibility-style positive policy aliases as CORS-origin-only equivalents, so active or historical handoff prose and protected-root terminal-safety notes cannot bypass the exact policy-term wording contract. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded policy-term alias coverage.
- Verification for this controller policy-term entitlement-alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller policy-term approval-alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats additional approve/approval-family positive policy aliases as CORS-origin-only equivalents, so active or historical handoff prose and protected-root terminal-safety notes cannot bypass the exact policy-term wording contract. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded policy-term alias coverage.
- Verification for this controller policy-term approval-alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller policy-term membership-alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats additional include-family positive policy aliases as CORS-origin-only equivalents, so active or historical handoff prose and protected-root terminal-safety notes cannot bypass the exact policy-term wording contract. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded policy-term alias coverage.
- Verification for this controller policy-term membership-alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller policy-term access-alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats additional authorization/grant/clearance-style policy aliases as CORS-origin-only equivalents, so active or historical handoff prose and protected-root terminal-safety notes cannot bypass the exact policy-term wording contract. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded policy-term alias coverage.
- Verification for this controller policy-term access-alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller blocklist expanded-alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now catches additional negative list-family aliases through tense, separator, and constant-style forms, so active or historical handoff prose and protected-root terminal-safety notes cannot bypass the required blocklist wording. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded blocklist terminology coverage.
- Verification for this controller blocklist expanded-alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller blocklist negative-terminology expansion guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now catches additional ban, exclusion, and rejection family list terms as disallowed alternatives to the required blocklist wording, including constant-style and separator variants, so active or historical handoff prose and root-write safety notes cannot bypass the terminology contract. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded blocklist terminology coverage.
- Verification for this controller blocklist negative-terminology expansion guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 hygiene-input probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass after the active handoff wording cleanup.
- Controller policy-term admission/trust synonym guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats additional acceptance, admission, approval, green-coded, and trust-based list-family variants as CORS origin `allowlist` context only, preventing those aliases from appearing in active or historical handoff prose or root-write safety notes. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded policy-term alias coverage.
- Verification for this controller policy-term admission/trust synonym guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 hygiene-input probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller safe-dispatch content/resource broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now folds asset, artifact, bundle, content, doc, documentation, guide, icon, image, manual, media, resource, screenshot, style, and theme nouns into broad safe-dispatch scope matching, so dispatch text cannot widen ownership through `docs-wide`, `documentation-spanning`, `full assets`, `several resources`, `various artifacts`, `collection of images`, `throughout docs`, `between themes`, `guide pass`, `resource sweep`, `style updates`, `icon changes`, `any docs`, `all resources`, `every artifact`, `cross-asset`, `multi-theme`, or `images-crossing`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the content/resource broad-scope coverage.
- Verification for this controller safe-dispatch content/resource broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 hygiene-input probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller safe-dispatch data/config broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now folds cache, config, configuration, column, database, dataset, environment, preference, queue, record, row, schema, secret, setting, store, storage, variable, and var nouns into broad safe-dispatch scope matching, so dispatch text cannot widen ownership through `schema-wide`, `database-spanning`, `full settings`, `several environments`, `various caches`, `collection of records`, `throughout schemas`, `between datasets`, `config pass`, `schema sweep`, `cache updates`, `setting changes`, `any schema`, `all databases`, `every setting`, `cross-config`, `multi-dataset`, or `records-crossing`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the data/config broad-scope coverage.
- Verification for this controller safe-dispatch data/config broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 hygiene-input probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller safe-dispatch UI-surface broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now folds alert, button, card, control, dialog, form, list, menu, modal, navigation, panel, sidebar, table, toast, and toolbar nouns into broad safe-dispatch scope matching, so dispatch text cannot widen ownership through `dialog-wide`, `modal-spanning`, `full panels`, `several forms`, `various tables`, `collection of cards`, `throughout navigation`, `between dialogs`, `alert pass`, `menu sweep`, `toolbar changes`, `button updates`, `any modal`, `all tables`, `every form`, `cross-panel`, `multi-dialog`, or `controls-crossing`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the UI-surface broad-scope coverage.
- Verification for this controller safe-dispatch UI-surface broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 hygiene-input probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller safe-dispatch product-surface broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now folds API, endpoint, feature, page, route, screen, surface, and view nouns into broad safe-dispatch scope matching, so dispatch text cannot widen ownership through `page-wide`, `view-spanning`, `full surfaces`, `several screens`, `various features`, `collection of pages`, `throughout routes`, `between views`, `endpoint pass`, `route sweep`, `screen changes`, `feature updates`, `any endpoint`, `all routes`, `every screen`, `cross-surface`, `multi-page`, or `views-crossing`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the product-surface broad-scope coverage.
- Verification for this controller safe-dispatch product-surface broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 hygiene-input probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller safe-dispatch process-noun broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects sweep, pass, round, and baseline wording before or after broad scope nouns, so dispatch text cannot widen ownership through `baseline packages`, `sweep services`, `package sweep`, `service pass`, `module round`, `codebase baseline`, `cleanup round for services`, `QA pass of modules`, `release baseline for packages`, or `maintenance sweep of workstreams`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the process-noun broad-scope coverage.
- Verification for this controller safe-dispatch process-noun broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 hygiene-input probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller lifecycle derivation synonym guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now factors the sealed-lifecycle verb set and rejects derivation, copying, borrowing, delegation, hand-over/handover, and transfer verbs when they are paired with the existing sealed-history noun set. `scripts/check-handoff-hygiene.test.mjs` extends the existing prior-lifecycle fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded lifecycle synonym coverage.
- Verification for this controller lifecycle derivation synonym guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 hygiene-input probing, stop-warning count, and final `C:\Tools\agenttool` process scan all pass.
- Controller lifecycle continuation synonym guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects continuation, adoption, following, inheritance, pickup, and takeover verbs when they are paired with sealed history nouns, so active notes cannot imply carrying sealed controller material forward outside the exact stop-warning path. `scripts/check-handoff-hygiene.test.mjs` extends the existing prior-lifecycle fixture without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the expanded lifecycle synonym coverage.
- Verification for this controller lifecycle continuation synonym guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller blocklist-terminology synonym guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects legacy negative terminology variants in active and historical handoff prose while preserving the required protected-root `blocklist` wording. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture with plural, separator, constant-style, and CJK synonym regressions without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the blocklist terminology coverage.
- Verification for this controller blocklist-terminology synonym guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller policy-term synonym guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats additional admission-list synonym variants as CORS-origin-only terminology, preserving the exact CORS-origin policy-term carve-out while preventing lookalike policy wording from appearing in active or historical handoff prose. `scripts/check-handoff-hygiene.test.mjs` extends the existing policy-term variant fixture with concatenated, separator, and constant-style synonym regressions without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the synonym coverage.
- Verification for this controller policy-term synonym guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch setup/migration verb and noun broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects cleanup, configuration, documentation, migration, integration, instrumentation, localization, translation, and wiring phrases before or after broad scope nouns, so dispatch text cannot widen ownership through `clean up packages`, `cleanup codebase`, `configure services`, `document modules`, `migrate codebase`, `integrate packages`, `instrument services`, `wire modules`, `documentation of services`, `package migrations`, or `service integrations`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the setup/migration broad-scope coverage.
- Verification for this controller safe-dispatch setup/migration broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch QA/review verb and noun broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects audit, review, inspection, validation, verification, and testing phrases before or after broad scope nouns, so dispatch text cannot widen ownership through `audit packages`, `review services`, `inspect modules`, `validate codebase`, `verify packages`, `test services`, `audits of modules`, or `package reviews`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the QA/review broad-scope coverage.
- Verification for this controller safe-dispatch QA/review broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch hardening/optimization noun broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects nominal hardening, security-fix, optimization, repair, release, and upgrade phrases before or after broad scope nouns, so dispatch text cannot widen ownership through `hardening of packages`, `security fixes for services`, `optimization of modules`, `package upgrades`, or `service repairs`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the nominal hardening/optimization broad-scope coverage.
- Verification for this controller safe-dispatch hardening/optimization noun broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch hardening/optimization verb broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects hardening, security, optimization, repair, and modernization verbs before broad scope nouns, so dispatch text cannot widen ownership through `harden packages`, `secure services`, `optimize modules`, `upgrade codebase`, `modernize packages`, `repair services`, `stabilize modules`, or `polish codebase`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the hardening/optimization broad-scope coverage.
- Verification for this controller safe-dispatch hardening/optimization verb broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch release/maintenance verb broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects release, deployment, development, and maintenance verbs before broad scope nouns, so dispatch text cannot widen ownership through `deploy packages`, `develop services`, `deliver modules`, `ship codebase`, `improve packages`, `enhance services`, `maintain modules`, or `release codebase`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the release/maintenance broad-scope coverage.
- Verification for this controller safe-dispatch release/maintenance verb broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch write-noun broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects nominal write-intent phrases before or after broad scope nouns, so dispatch text cannot widen ownership through `implementation of packages`, `creation of services`, `removal of modules`, `patches to codebase`, `package implementations`, or `service fixes`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the write-noun broad-scope coverage.
- Verification for this controller safe-dispatch write-noun broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch execution-verb broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects additional write/execution verbs before broad scope nouns, so dispatch text cannot widen ownership through `implement packages`, `build services`, `create modules`, `remove codebase`, `fix packages`, or `patch services`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the execution-verb broad-scope coverage.
- Verification for this controller safe-dispatch execution-verb broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch assignment-noun broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects team assignment/routing noun phrases before broad scope nouns, so dispatch text cannot widen ownership through `assignment of packages`, `delegation of services`, `allocation of modules`, or `routing of codebase`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the assignment-noun broad-scope coverage.
- Verification for this controller safe-dispatch assignment-noun broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch assignment-verb broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects team assignment/routing verbs before broad scope nouns, so dispatch text cannot widen ownership through `assign packages`, `delegate services`, `allocate modules`, or `route codebase`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the assignment-verb broad-scope coverage.
- Verification for this controller safe-dispatch assignment-verb broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch responsibility-noun broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects responsibility/accountability nouns and stewardship/oversight phrases before broad scope nouns, so dispatch text cannot widen ownership through `responsibility for packages`, `accountability for services`, `oversight of modules`, or `stewardship of codebase`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the responsibility-noun broad-scope coverage.
- Verification for this controller safe-dispatch responsibility-noun broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch directive-verb broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects directive/control verbs before broad scope nouns, so dispatch text cannot widen ownership through `drive packages`, `direct services`, `steer modules`, or `govern codebase`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the directive-verb broad-scope coverage.
- Verification for this controller safe-dispatch directive-verb broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch coordination-verb broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects direct coordination verbs before broad scope nouns, so dispatch text cannot widen ownership through `lead packages`, `coordinate services`, `orchestrate modules`, or `supervise codebase`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the coordination-verb broad-scope coverage.
- Verification for this controller safe-dispatch coordination-verb broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch responsibility-phrase broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects responsibility and ownership phrases before broad scope nouns, so dispatch text cannot widen ownership through `responsible for packages`, `accountable for services`, `ownership of modules`, or `coordination of codebase`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the responsibility-phrase broad-scope coverage.
- Verification for this controller safe-dispatch responsibility-phrase broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch control-verb broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects coordination/control verbs before broad scope nouns, so dispatch text cannot widen ownership through `handle packages`, `cover services`, `manage modules`, or `own codebase`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the control-verb broad-scope coverage.
- Verification for this controller safe-dispatch control-verb broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch operation-connector broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects operation verbs with `in` and `over` connectors before broad scope nouns in addition to `on`, so dispatch text cannot widen ownership through `work in packages` or `operate over services`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the operation-connector broad-scope coverage.
- Verification for this controller safe-dispatch operation-connector broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch scope-action noun broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects broad scope nouns followed by write-intent nouns, so dispatch text cannot widen ownership through `package changes`, `service updates`, `module edits`, or `codebase modifications`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the scope-action noun broad-scope coverage.
- Verification for this controller safe-dispatch scope-action noun broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch action-target connector broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects broad action/operation target phrases that insert `for`, `in`, `on`, or `to` between write-intent wording and broad scope nouns, so dispatch text cannot widen ownership through `changes to packages`, `updates for services`, `edits in modules`, or `modifications to codebase`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the target-connector broad-scope coverage.
- Verification for this controller safe-dispatch action-target connector broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch operation-verb broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects additional broad operation/write intent phrases such as `adjust`, `revise`, `work on`, and `operate on` before broad scope nouns, so dispatch text cannot widen ownership through `adjust services`, `revise codebase`, `work on packages`, or `operate on modules`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the operation-verb broad-scope coverage.
- Verification for this controller safe-dispatch operation-verb broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch action-verb broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects broad write-scope action verbs such as `touch`, `edit`, `modify`, and `rewrite` before broad scope nouns, so dispatch text cannot widen ownership through `touch packages`, `edit services`, `modify modules`, or `rewrite codebase`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the action-verb broad-scope coverage.
- Verification for this controller safe-dispatch action-verb broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch traversal-preposition broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects traversal prepositions such as `throughout`, `through`, `between`, and `among` before broad scope nouns, so dispatch text cannot widen ownership through `throughout codebase`, `through packages`, `between services`, or `among modules`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the traversal-preposition broad-scope coverage.
- Verification for this controller safe-dispatch traversal-preposition broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch lower-bound broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects lower-bound comparative count phrases such as `at least`, `more than`, `over`, and `no fewer than` before broad scope nouns, so dispatch text cannot widen ownership through `at least two lanes`, `more than one package`, `over 3 modules`, or `no fewer than two workstreams`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the lower-bound broad-scope coverage.
- Verification for this controller safe-dispatch lower-bound broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch minimum-count broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects lower-bound count phrases such as `1+`, `1 or more`, and `one or more` before broad scope nouns, so dispatch text cannot widen ownership through `1+ services`, `1 or more packages`, or `one or more workstreams` while still allowing truly single scoped targets. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the minimum-count broad-scope coverage.
- Verification for this controller safe-dispatch minimum-count broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch article-connector broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects `of the` and connector-adjective forms before broad scope nouns for qualitative, aggregate, and counted scope phrases, so dispatch text cannot widen ownership through `both of the services`, `several of the workstreams`, `various different modules`, `collection of the services`, `two of the lanes`, or `pair of the lanes`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the article-connector broad-scope coverage.
- Verification for this controller safe-dispatch article-connector broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch aggregate-noun broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects aggregate noun scope phrases such as `collection of`, `group of`, `range of`, and `variety of` before broad scope nouns, so dispatch text cannot widen ownership through `collection of services`, `group of paths`, `range of packages`, or `a variety of modules`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the aggregate-noun broad-scope coverage.
- Verification for this controller safe-dispatch aggregate-noun broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch qualitative broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects qualitative multi-target scope adjectives such as `various`, `numerous`, `assorted`, and `mixed` before broad scope nouns, so dispatch text cannot widen ownership through `various modules`, `numerous components`, `assorted paths`, or `mixed packages`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the qualitative broad-scope coverage.
- Verification for this controller safe-dispatch qualitative broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch count-connector broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now lets counted broad-scope detection consume connector wording such as `of`, `separate`, and `different`, so dispatch text cannot widen ownership through `pair of lanes`, `a couple of workstreams`, `two separate services`, or `3 different packages`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the count-connector broad-scope coverage.
- Verification for this controller safe-dispatch count-connector broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch numeric broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects numeric and number-word broad scopes such as `two lanes`, `3 services`, `2+ workstreams`, `two or more packages`, and `couple modules`, so dispatch text cannot widen ownership through counted multi-target wording. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the numeric and number-word broad-scope coverage.
- Verification for this controller safe-dispatch numeric broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch quantitative broad-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects quantity-prefixed broad scopes such as `multiple lanes`, `several workstreams`, `many files`, and `both services`, so dispatch text cannot widen lane ownership through vague multi-target wording while keeping otherwise scoped carriers. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the quantity-prefixed broad-scope coverage.
- Verification for this controller safe-dispatch quantitative broad-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch filesystem-scope alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now centralizes file, path, directory, folder, and dir wording in `BROAD_FILESYSTEM_SCOPE_PATTERN` and folds it into the broad-scope noun checks, so lane scopes cannot be widened through `file-wide`, `directory-spanning`, `path-spanning`, `full folders`, `across paths`, `cross-file`, or `files-crossing` wording. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the filesystem-scope alias coverage.
- Verification for this controller safe-dispatch filesystem-scope alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch broad noun wide/spanning guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now reuses `BROAD_SCOPE_NOUN_PATTERN` for `*-wide` and `*-spanning` dispatch wording instead of a narrower hand-written subset, so source, test-suite, spec, and workstream expansion phrases cannot bypass scoped lane targets. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table with `source-wide`, `test-suite-wide`, `spec-spanning`, and `workstream-spanning`, while `docs/qa-checklist.md` documents the added coverage.
- Verification for this controller safe-dispatch broad noun wide/spanning guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch singular-repository alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now centralizes repository-scope matching as `repos?`, `repository`, and `repositories`, so single-repository broad wording is treated the same as repo/repositories forms. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table with `any repository`, `entire repository`, `full repository`, `across repository`, `cross-repository`, and `repository-crossing`, while `docs/qa-checklist.md` documents the added singular-repository coverage.
- Verification for this controller safe-dispatch singular-repository alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch code-scope alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats `code` as a broad safe-dispatch scope noun and rejects scope-widening forms such as `code-wide`, `full code`, `across code`, `cross-code`, and `code-crossing`. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table without changing the current 114/114 self-test count, while `docs/qa-checklist.md` documents the added code-scope alias coverage.
- Verification for this controller safe-dispatch code-scope alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller continuation audit remained green under team-mode control: the active lane ledger still keeps Web admin as the only active lane, the safe dispatch queue order remains Controller cleanup/docs, Desktop UX/a11y, Web admin, Mobile companion, Sync service/core engine, then QA infra, the five available lane entries keep the exact ownerless wording, stale self-test counts are absent, and no disallowed policy-term conflicts were found outside checker fixtures.
- Verification for this controller continuation audit is green: `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run qa:security-headers` (6/6 plus built scan), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run test:desktop -- main` (4/4), `npm run qa:sync-api-docs` (69 checks), `npm run lint`, and final active-top invariant/terminology scans all pass.
- Web/admin deployment-header hardening continued under the active Web admin lane: `apps/web/public/_headers` and `apps/desktop/public/_headers` now provide static HTTP headers for CSP `frame-ancestors 'none'`, `X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff`, Referrer-Policy, and Permissions-Policy. `scripts/check-security-headers.mjs` now verifies those files in built `apps/web/dist` and `apps/desktop/dist`, and `scripts/check-security-headers.test.mjs` pins missing `_headers` plus missing clickjacking-header regressions.
- Verification for this deployment-header slice is green: `npm run test:security-headers` (6/6), `node --check scripts/check-security-headers.mjs`, `node --check scripts/check-security-headers.test.mjs`, `npm run build:web`, `npm run build:desktop`, `Test-Path apps/web/dist/_headers`, `Test-Path apps/desktop/dist/_headers`, and `npm run qa:security-headers` (6/6 plus built scan) all pass.
- Controller handoff hygiene hardening continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects `TNN` task-card IDs with combining-mark or control-format suffixes, rejects unquoted out-of-lane safe-dispatch paths, and applies the CORS-origin `allowlist` context carve-out to historical handoff text as well as the active top section. `scripts/check-handoff-hygiene.test.mjs` adds focused regressions and raises the current handoff hygiene self-test count to 114/114; `docs/qa-checklist.md` documents the new suffix, bare-path, and historical policy-term coverage.
- Verification for this controller suffix/path/historical-terminology guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Web/admin static CSP semantics were corrected under the active Web admin lane with a companion static-shell cleanup: `apps/web/src/csp.ts` now keeps `frame-ancestors 'none'` only in the exported HTTP-header CSP policy, while generated HTML meta CSP omits that HTTP-only directive. `apps/web/index.html`, `apps/web/public/404.html`, `apps/web/public/offline.html`, `apps/desktop/index.html`, and `apps/desktop/public/offline.html` no longer advertise unenforceable `frame-ancestors` meta directives; `scripts/check-security-headers.mjs` now rejects HTTP-only CSP directives in meta tags instead of requiring them, and README/QA docs clarify that clickjacking protection must come from deployment HTTP headers such as CSP `frame-ancestors 'none'` or `X-Frame-Options: DENY`.
- Verification for this CSP meta/header semantics slice is green: `npm run test:web -- csp` (13/13), `npm run test:desktop -- main` (4/4), `npm run test:security-headers` (6/6), `node --check scripts/check-security-headers.mjs`, `node --check scripts/check-security-headers.test.mjs`, `npm run build:web`, `npm run build:desktop`, and `npm run qa:security-headers` (6/6 plus built scan) all pass.
- Controller terminology context hardening continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now narrows the only permitted policy-term carve-out to exact CORS-origin `allowlist` context, carve-out, policy-language, or legitimate wording statements, so adjacent CORS-origin words no longer mask unrelated policy terminology. `scripts/check-handoff-hygiene.test.mjs` pins the pseudo-context regression without changing the current self-test count, while `docs/qa-checklist.md` documents the narrower context/wording/policy-language coverage.
- Verification for this controller terminology context slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), and `node scripts/check-handoff-hygiene.mjs` all pass.
- Web admin hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` and `apps/web/src/csp.ts` now reject raw backslash-bearing configured snapshot URLs before fetch/CSP origin decisions, so inputs such as `\\host`, `/\host`, or `https://host\@evil.example/path` fall back to the same-origin default instead of relying on browser URL normalization. `apps/web/src/adminData.test.ts`, `apps/web/src/csp.test.ts`, `apps/web/README.md`, and `docs/qa-checklist.md` pin the boundary.
- Verification for this Web admin raw-backslash URL slice is green: `npm run test:web -- adminData csp` (43/43), `npm run typecheck:web`, and `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI) all pass.
- Controller handoff hygiene hardening continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now requires exact `package.json` handoff QA chaining through `test:handoff-hygiene` before the live scan, and rejects active task-card IDs with Unicode-letter suffixes such as Greek or CJK letters after `TNN`. `scripts/check-handoff-hygiene.test.mjs` reuses existing fixture cases so the current self-test count remains 114/114, while `docs/qa-checklist.md` documents the exact package-script chain and Unicode-letter suffix coverage.
- Verification for this controller handoff hygiene script-chain and Unicode-suffix slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Web admin hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` and `apps/web/src/csp.ts` now reject HTTP(S) scheme-without-authority snapshot URL forms such as `https:host`, `https:\host`, and `http:////host` before `new URL()` can normalize them into accepted absolute origins. `scripts/check-security-headers.mjs` now keeps the first CSP directive occurrence, rejects duplicate directives instead of allowing a later value to mask browser behavior, and rejects wildcard `connect-src` source expressions such as `https://*`, `wss://*`, and `*.example.test`; `scripts/check-security-headers.test.mjs` pins those checker regressions and `package.json` runs the self-test before built security-header scans.
- Verification for this Web admin scheme and security-header checker slice is green: `npm run test:web -- adminData csp` (43/43), `npm run test:security-headers` (6/6), `npm run typecheck:web`, `node --check scripts/check-security-headers.mjs`, `node --check scripts/check-security-headers.test.mjs`, `npm run build:web`, `npm run qa:security-headers` (6/6 plus built scan), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Web admin hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now treats C1 controls like C0 controls for snapshot URLs, bearer tokens, record IDs, and display fields, and malformed absolute snapshot URLs now fall back to `/api/admin/snapshot` instead of being treated as relative paths. `apps/web/src/csp.ts` now rewrites CSP and Permissions-Policy meta tags regardless of attribute order or single/double-quote style, while `scripts/check-security-headers.mjs` parses built CSP meta directives and rejects missing `connect-src`, `base-uri`, `form-action`, `object-src`, or `upgrade-insecure-requests`; `apps/web/public/404.html` and `apps/web/public/offline.html` now carry the static fallback-page directives needed by that gate.
- Verification for this Web admin URL/control, CSP meta, and security-header slice is green: `npm run test:web -- adminData` (30/30), `npm run test:web -- csp` (13/13), `npm run test:web -- adminData csp` (43/43), `npm run typecheck:web`, `node --check scripts/check-security-headers.mjs`, `npm run build:web`, `npm run qa:security-headers`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Web admin boundary hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` rejects control-character record IDs and display fields, `apps/web/src/csp.ts` only adds exact HTTP(S) admin snapshot origins to CSP `connect-src` while rejecting protocol-relative/userinfo/control-character inputs, `docs/sync-api.md` plus `scripts/verify-sync-api-docs.mjs` pin dedicated `ATLASTERM_SYNC_ADMIN_TOKEN` semantics, and `scripts/check-handoff-hygiene.mjs` pins exact CORS-origin `allowlist` context, suffixed task-card, prefix-like out-of-lane code-span, and sealed lifecycle wording regressions.
- Verification for this Web admin boundary and hygiene slice is green: `npm run test:web -- adminData csp` (43/43), `npm run typecheck:web`, `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --check scripts/verify-sync-api-docs.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:sync-api-docs` (69 checks), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller matcher precision hardening continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects task-card trailing suffixes, plural/slash/dot disallowed policy-term variants, handoff-wide disallowed policy terms, out-of-lane safe-dispatch code spans, normalized broad-scope queue text, active-ledger non-active lane/code-span mentions, and sealed lifecycle prose in English and CJK. `scripts/check-handoff-hygiene.test.mjs` now defaults regex `expectedFailure` cases to one failure unless `expectedFailureCount` is explicit, adds focused regressions for the sidecar漏检面, and raises the current handoff hygiene self-test count to 114/114; `docs/qa-checklist.md` documents Web admin active-lane, out-of-lane code-span, policy-term variant, and lifecycle-status coverage.
- Verification for this controller matcher precision slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller active-lane broad ownership guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects broad ownership phrasing inside the active lane ledger detail, reusing the safe-dispatch broad-scope alias set so a ledger entry cannot expand current-controller ownership outside the active Web admin lane while still naming the current controller. `scripts/check-handoff-hygiene.test.mjs` extends the existing sealed-context ledger regression without increasing the current 114/114 self-test count, and `docs/qa-checklist.md` documents broad active ownership scope coverage.
- Verification for this controller active-lane broad ownership guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 hygiene-input probing, and final `C:\Tools\agenttool` process scan all pass.
- Controller handoff count and assertion precision hardening continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now requires explicit `npm run qa:handoff-hygiene` live-scan count evidence, rejects lagging loose handoff-count prose without misclassifying unrelated QA counts on mixed verification lines, and expands sealed-context lifecycle wording detection. `scripts/check-handoff-hygiene.test.mjs` now carries live-scan evidence in the clean fixture and tightens high-value regex-only expectations to exact failure inventories without increasing the current 114/114 self-test count; `docs/qa-checklist.md` documents exact English CORS-origin `allowlist` context, disallowed policy-term variants, exact available-lane ownerless wording, required live-scan count evidence, loose count drift, and localized lifecycle-prose coverage.
- Verification for this controller count/assertion precision slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node scripts/check-handoff-hygiene.mjs`, and `node --test scripts/check-handoff-hygiene.test.mjs` (114/114) all pass.
- Controller active-lane ledger indentation and mixed-count self-test guard hardening continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects indented lane-like bullets inside the active lane ledger instead of treating them as harmless prose, and the loose handoff self-test count scan now skips lines that already contain exact handoff command-count evidence so unrelated QA command counts on mixed verification lines are not misclassified as handoff self-test drift. `scripts/check-handoff-hygiene.test.mjs` extends existing fixtures without increasing the current 114/114 self-test count, and `docs/qa-checklist.md` documents the indented active-lane ledger coverage.
- Verification for this controller active-lane ledger indentation and mixed-count self-test guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 hygiene-input probing, and final `C:\Tools\agenttool` process scan all pass.
- Controller CJK localized lifecycle-prose guard evidence was recorded as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` rejects localized CJK lifecycle context wording in the live handoff without relying on English-only patterns or raw UUID matches, while the exact standalone stop warning remains the only permitted restart boundary. `scripts/check-handoff-hygiene.test.mjs` pins that localized context path in the existing active-prose regression without increasing the current 114/114 self-test count; `docs/qa-checklist.md` documents the live-handoff CJK context coverage.
- Verification for this controller CJK localized lifecycle-prose guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, strict UTF-8 hygiene-input probing, and final `C:\Tools\agenttool` process scan all pass.
- Controller handoff hygiene guard hardening continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects decoded text control characters across hygiene inputs, blocks indented safe-dispatch lane-like bullets from masquerading as continuations, requires the active ledger to reach the single do-not-resurrect stop warning before the restart footer, widens stop-warning variant detection across token order and adjacent lines, normalizes UUID text before closed-ID checks, and removes broad top-section safe-dispatch lane presence scans that could be satisfied by later ledger entries. `scripts/check-handoff-hygiene.test.mjs` extends existing fixtures without increasing the current 114/114 self-test count, and `docs/qa-checklist.md` documents control-character coverage.
- Verification for this controller hygiene guard hardening slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, and `node --test scripts/check-handoff-hygiene.test.mjs` (114/114) all pass.
- Controller CJK stop-warning variant guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats localized CJK near-duplicate stop warnings that combine do-not wording, restart/resume verbs, archival qualifiers, and session/thread/id nouns as unsafe active text, so non-English warning-shaped directives cannot reopen prior work streams outside the exact English stop warning. `scripts/check-handoff-hygiene.test.mjs` reuses the existing modified-warning regression to pin both suffixed English warning text and localized CJK warning-shaped prose without increasing the current handoff hygiene self-test count; `docs/qa-checklist.md` documents the CJK warning-shape coverage.
- Verification for this controller CJK stop-warning variant guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller exact stop-warning line guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now counts only the exact standalone stop-warning line instead of substring matches, so warning text with appended suffix/prose is treated as missing the stop warning and as unexpected ledger-gap text rather than preserving a false stop boundary. `scripts/check-handoff-hygiene.test.mjs` reuses the existing warning-shape regression to pin missing-warning, near-duplicate, and ledger-gap failures for a suffixed warning without increasing the current handoff hygiene self-test count; `docs/qa-checklist.md` documents exact-line stop-warning counting.
- Verification for this controller exact stop-warning line guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller active-lane ledger current-workspace footer requirement continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now requires exactly one `Start from the current workspace state and this top section.` footer after the stop warning and still rejects any other nonblank footer prose before the active separator, so the live handoff cannot silently lose the current-state restart anchor or hide lane/owner changes in footer text. `scripts/check-handoff-hygiene.test.mjs` updates the clean fixture and extends the existing ledger-gap/footer regression to pin missing-footer plus unexpected-footer failures without changing the current handoff hygiene self-test count; `docs/qa-checklist.md` documents the exact footer requirement.
- Verification for this controller active-lane ledger current-workspace footer requirement slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller stop-warning and dispatch-scope precision continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects near-duplicate do-not-resurrect warning variants, and the Controller cleanup/docs safe-dispatch lane now names concrete `README.md` and `CHANGELOG.md` targets instead of generic release/readiness prose. `scripts/check-handoff-hygiene.test.mjs` adds a focused near-duplicate warning regression, raising the current handoff hygiene self-test count to 114/114; `docs/qa-checklist.md` also documents the root `npm run qa` handoff/security-header coverage and the active-lane ledger gap guard.
- Verification for this controller stop-warning/scope precision slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, and `node --test scripts/check-handoff-hygiene.test.mjs` (114/114) all pass.
- Controller active-lane ledger footer guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now keeps scanning after the stop warning and allows only blank lines plus the exact current-workspace handoff footer before the active separator, rejecting any other nonblank footer prose as `Unexpected active lane ledger footer line`, so post-warning text cannot hide owner or lane changes outside the ledger. `scripts/check-handoff-hygiene.test.mjs` extends the existing ledger-gap regression to pin both pre-warning gap prose and post-warning footer prose without changing the current handoff hygiene self-test count, and also syncs the clean fixture with the controller cleanup/docs lane's current `README.md`/`CHANGELOG.md` scope.
- Verification for this controller active-lane ledger footer guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller active-lane ledger gap guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now keeps scanning after the active lane ledger until the stop warning, allowing only blank gap lines and rejecting nonblank prose as `Unexpected active lane ledger gap line`, so post-ledger text cannot imply owner or lane changes outside a ledger entry. `scripts/check-handoff-hygiene.test.mjs` adds a focused regression, raising the current handoff hygiene self-test count to 114/114.
- Verification for this controller active-lane ledger gap guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, and `node --test scripts/check-handoff-hygiene.test.mjs` (114/114) all pass.
- Controller safe-dispatch queue-gap guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now keeps scanning the safe dispatch queue until the `Active lane ledger (current controller occupancy):` heading, allowing only blank gap lines after the lane block and rejecting any nonblank prose in that gap as `Unexpected safe dispatch queue gap line`, so post-queue text cannot widen dispatch ownership outside a lane entry. `scripts/check-handoff-hygiene.test.mjs` reuses the existing broad-scope lane fixture to pin simultaneous broad-scope and queue-gap failures without increasing the current handoff hygiene self-test count, and `docs/qa-checklist.md` documents the post-queue gap rejection path.
- Verification for this controller safe-dispatch queue-gap guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch unexpected-line guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects nonblank safe-dispatch queue lines that are neither lane bullets nor indented lane continuations, including prose before the first lane, so unscoped queue text cannot silently widen scoped dispatch lanes. `scripts/check-handoff-hygiene.test.mjs` reuses the existing broad-scope lane fixture to pin simultaneous broad-scope and unexpected-line failures without increasing the current handoff hygiene self-test count, and `docs/qa-checklist.md` documents the unexpected queue-line rejection path.
- Verification for this controller safe-dispatch unexpected-line guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller dynamic-template self-test counting continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now excludes dynamic template test names from standalone counts and counts those table-driven cases through the case inventory, so `test(`${name}`)`-style loops cannot undercount hygiene tests. `scripts/check-handoff-hygiene.test.mjs` adds the focused regression and raises the current handoff hygiene self-test count to 114/114.
- Verification for this controller dynamic-template self-test counting slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, and `node --test scripts/check-handoff-hygiene.test.mjs` (114/114) all pass.

- Controller safe-dispatch continuation-scope guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now folds indented continuation lines into the owning safe-dispatch lane scope before scoped-target, code-span, and broad-scope checks run, so a lane cannot keep a clean first line while hiding `across services` or similar expansion wording on a continuation line. `scripts/check-handoff-hygiene.test.mjs` reuses the existing broad-alias table with a multiline `scoped continuation` fixture and normalizes expected multiline scope text without increasing the current handoff hygiene self-test count, and `docs/qa-checklist.md` documents continuation-line scope folding.
- Verification for this controller safe-dispatch continuation-scope guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller self-test counting and assertion precision continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now counts external named case arrays, quoted `name` keys, and `forEach` table-driven cases, while `scripts/check-handoff-hygiene.test.mjs` tightens key hygiene regressions to exact failure inventories and raises the current handoff hygiene self-test count to 114/114.
- Verification for this controller self-test precision slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, and `node --test scripts/check-handoff-hygiene.test.mjs` (114/114) all pass.

- Controller safe-dispatch across-scope alias guard widened as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now centralizes broad safe-dispatch scope nouns in `BROAD_SCOPE_NOUN_PATTERN` and treats `across <scope>` plus `across the <scope>` as unsafe for repo/repository/workspace/codebase/project/app/package/module/component/service/source/tree/test/spec/suite scopes, so lane scopes cannot be widened by dropping `the` or moving beyond repository/project nouns. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table with `across repositories`, `across apps`, and `across test suites` without changing the current handoff hygiene self-test count, and `docs/qa-checklist.md` documents the added across-scope dispatch coverage.
- Verification for this controller safe-dispatch across-scope alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch cross-scope alias guard widened as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now applies `cross-*`, `multi-*`, and `*-crossing` broad-scope detection to app/package/module/component/service/source/test-scope wording in addition to repo/workspace/codebase/project/tree wording. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table with `cross-package`, `multi-service`, `module-crossing`, and `cross-test-suite`, and also tightens separator-gap assertions so hidden gap content plus hidden resume directives remain pinned as simultaneous hygiene failures instead of being masked by single-failure expectations. `docs/qa-checklist.md` documents the expanded cross-scope dispatch coverage.
- Verification for this controller safe-dispatch expanded cross-scope alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch cross-scope alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects `cross-*`/`multi-*` safe dispatch scope aliases and `*-crossing` wording for repo/repository/workspace/codebase/project/tree scopes, so scoped lane text cannot be widened through cross-scope follow-up prose. `scripts/check-handoff-hygiene.test.mjs` extends the existing broad-alias table with `cross-repo`, `multi-project`, and `workspace-crossing` without changing the current handoff hygiene self-test count, and `docs/qa-checklist.md` documents the cross-scope broad-alias coverage.
- Verification for this controller safe-dispatch cross-scope alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller self-test and audit-line precision hardening continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now ignores `test(...)`/table-loop lookalikes inside string fixtures while counting refactored table-driven self-tests, rejects content inserted between the active separator and prior-continuation heading, and rejects active task-card IDs appended to the historical audit statement instead of treating valid-looking `TNN` suffixes as part of the audit carve-out. `scripts/check-handoff-hygiene.test.mjs` adds focused regressions for refactored table counts, gapped historical boundaries, and audit-line task-card masking, keeping the current handoff hygiene self-test count at 114/114.
- Verification for this controller self-test/audit-line precision slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, and `node --test scripts/check-handoff-hygiene.test.mjs` (114/114) all pass.
- Controller prior-continuation boundary guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now requires exactly one `## Prior continuation state` heading in addition to the single active separator, so lower handoff content cannot lose the explicit boundary label while still passing reference checks. `scripts/check-handoff-hygiene.test.mjs` extends the existing active-separator regression to pin the missing-heading path without adding a separate test case, and `docs/qa-checklist.md` documents missing prior-continuation heading coverage.
- Verification for this controller prior-continuation boundary guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, and `node --test scripts/check-handoff-hygiene.test.mjs` (114/114) all pass.
- Controller safe-dispatch plural broad-scope alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats plural repository/project/codebase/tree expansion phrases such as `any repositories`, `all projects`, `whole codebases`, `full trees`, and `across the repositories` as unsafe broad write scopes, so scoped lane text cannot be widened through plural repo/project wording. `scripts/check-handoff-hygiene.test.mjs` reuses the existing broad-alias table to pin those variants without changing the current self-test count, and `docs/qa-checklist.md` documents the plural broad-scope alias coverage.
- Verification for this controller safe-dispatch plural broad-scope alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, and `node --test scripts/check-handoff-hygiene.test.mjs` (114/114) all pass.
- Web Admin source-guard final-audit hardening continued under team-mode control: `apps/web/src/accessibilityContracts.test.ts` now folds simple computed string keys, template-literal keys, object/key alias combinations, `self`/`window`/`globalThis` navigator aliases, destructured `window.navigator` aliases, and decoded manifest keys before guarding Contacts Picker, protocol handler, browser app-integration, and fingerprinting/environment-probe surfaces. The manifest guard now parses JSON before checking advanced integration keys, so escaped protocol-handler entries cannot bypass text matching; standard launcher metadata already present in `apps/web/public/manifest.json` remains outside that advanced-key block.
- Controller checker separator/task-card hardening continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now accepts active handoff separator lines with trailing spaces, requires exactly one active separator before the prior continuation section, counts latest-continuation headings only in the active top section so archived lower headings do not false-positive, and rejects separated task-card IDs that use superscript/subscript digit lookalikes. `scripts/check-handoff-hygiene.test.mjs` adds four focused regressions for those sidecar-reported gaps, raising the current handoff hygiene self-test count to 114/114.
- Verification for this Web/checker final-audit slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), and `npm run lint` all pass.
- Controller safe-dispatch QA infra code-span guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now requires the QA infra lane to publish concrete code-spanned write targets for `tests/e2e/playwright*.config.ts`, `tests/e2e/scripts/*`, `scripts/*`, and `.github/workflows/*`, matching the live dispatch queue instead of accepting generic Playwright/scripts/CI prose. `scripts/check-handoff-hygiene.test.mjs` reuses the existing scoped-target fixture to pin both Desktop UX/a11y and QA infra missing-code-span regressions without changing the current self-test count, and `docs/qa-checklist.md` documents QA infra path code-span coverage.
- Verification for this controller safe-dispatch QA infra code-span guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Controller valid UTF-8 hygiene-input guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now decodes hygiene inputs through a strict UTF-8 helper for `HANDOFF.md`, `scripts/check-handoff-hygiene.test.mjs`, `package.json`, `docs/qa-checklist.md`, `.github/workflows/ci.yml`, and `tests/e2e/test-results/.last-run.json`, so invalid bytes in any hygiene carrier fail before content-specific checks proceed. `scripts/check-handoff-hygiene.test.mjs` now writes raw-byte fixture overrides through the same directory-creating fixture path, keeping invalid-byte docs regressions focused on checker output instead of fixture setup.
- Verification for this controller valid UTF-8 hygiene-input guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Controller checker final-audit hardening continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now compares normalized task-card IDs against raw ASCII IDs as a multiset, broadens safe-dispatch scope aliases for `everywhere`, `workspace-spanning`, `all app code`, and `all source code`, normalizes markdown/link/arrow active-lane prose before ledger checks, expands CJK policy-term synonym detection for the CORS-origin carve-out, and broadens lifecycle collision wording detection without changing the active Web admin lane. `scripts/check-handoff-hygiene.test.mjs` adds five focused regressions for those sidecar-reported gaps, raising the current handoff hygiene self-test count to 114/114.
- Verification for this controller checker final-audit slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), and `npm run lint` all pass.
- Controller handoff UTF-8 guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now decodes `HANDOFF.md` with a strict UTF-8 decoder before running live hygiene checks, so byte-level corruption cannot silently pass through replacement-character decoding. `scripts/check-handoff-hygiene.test.mjs` reuses the active mojibake fixture with raw invalid bytes without changing the current self-test count, and `docs/qa-checklist.md` documents valid UTF-8 coverage alongside active handoff mojibake regressions.
- `HANDOFF.md` byte cleanup replaced five invalid byte triplets in prior lower notes with valid UTF-8 dash punctuation, restoring the file to strict UTF-8 so normal patch tooling can edit it again.
- Verification for this controller handoff UTF-8 guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Controller active-lane ledger sealed-context guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects active ledger ownership details that point at sealed-controller lifecycle wording while still allowing product-facing lagged-live Web Admin coverage wording in the active Web lane. `scripts/check-handoff-hygiene.test.mjs` reuses the existing active-ledger negative fixture to pin the sealed-owner context path without changing the current self-test count, and the same fixture command-count line now escapes backticks so syntax checks cover it.
- Active-top handoff wording cleanup restored live hygiene after the stricter stop-warning guard: older evidence lines now use neutral sealed-controller phrasing instead of wording that resembles resumable sealed-controller context, preserving the single stop-warning path.
- Verification for this controller active-lane ledger sealed-context guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Controller safe-dispatch test-scope broad alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats broad test/spec/suite scope wording such as `all tests`, `test-wide`, `any specs`, and `full test suite` as unsafe safe-dispatch expansion aliases, so a lane cannot preserve scoped carriers while appending test-suite-wide write permission. `scripts/check-handoff-hygiene.test.mjs` reuses the existing broad-scope fixture to pin all-tests and test-wide coverage without changing the current self-test count, and `docs/qa-checklist.md` documents all-tests/test-wide broad-scope alias coverage.
- Verification for this controller safe-dispatch test-scope broad alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Controller safe-dispatch any-code broad-scope alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats `any code` in safe dispatch scope text as an unsafe broad write alias, so a lane cannot preserve its scoped carrier list while appending code-wide follow-up wording. `scripts/check-handoff-hygiene.test.mjs` reuses the existing broad-scope fixture to pin the alias without changing the current self-test count, and `docs/qa-checklist.md` documents any-code broad-scope alias coverage.
- Verification for this controller safe-dispatch any-code broad-scope alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Controller Chinese terminology separator guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats ASCII and Unicode dash separators inside disallowed Chinese policy-term variants the same as whitespace, so active handoff prose cannot bypass the terminology guard with CJK separator variants. `scripts/check-handoff-hygiene.test.mjs` reuses the existing Chinese terminology fixtures to pin non-breaking-hyphen and en-dash variants without changing the current self-test count, and `docs/qa-checklist.md` documents CJK separator terminology regression coverage alongside the existing CORS-origin `allowlist` carve-out.
- Verification for this controller Chinese terminology separator guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller/Web guard hardening continued under team-mode control: `scripts/check-handoff-hygiene.mjs` now rejects additional non-ledger lane wording with hyphenated subject forms and lane-name-before-subject forms, Unicode separator task-card lookalikes, broader safe-dispatch scope aliases (`root-wide`, `full workspace`, `global`, `unrestricted`, `all repo`), tighter CORS-origin policy-term context, and qualified/plural/reverse collision-note prose. `apps/web/src/accessibilityContracts.test.ts` now scans Web Admin `src`, `index.html`, and `public` production carriers for Contacts Picker, protocol handler, app-integration, and fingerprinting/environment-probe entrypoints across direct, optional, bracket/computed, destructured, and type-cast access.
- Verification for this controller/Web guard-hardening slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), and `npm run lint` all pass.
- Controller task-card Unicode-digit lookalike guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now scans task-card IDs with any Unicode decimal digit after an ASCII/fullwidth/Greek/Cyrillic `T`-like prefix and rejects non-ASCII forms, so Arabic-Indic, Devanagari, fullwidth, and related digit lookalikes cannot bypass the ASCII compact `TNN` requirement. `scripts/check-handoff-hygiene.test.mjs` reuses the existing padded-ID fixture to pin Arabic-Indic and Devanagari digit coverage without changing the current self-test count, and `docs/qa-checklist.md` documents the fullwidth/Greek/Cyrillic-prefix-or-Unicode-digit lookalike regression path.
- Verification for this controller task-card Unicode-digit lookalike guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Controller task-card Greek/Cyrillic-prefix lookalike guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects active task-card IDs whose `TNN` prefix uses Greek Tau or Cyrillic Te lookalikes in addition to fullwidth `T` and fullwidth digits, so visually compact cards such as Greek/Cyrillic `T07` cannot bypass the ASCII compact `TNN` requirement. `scripts/check-handoff-hygiene.test.mjs` reuses the existing padded-ID fixture to pin Greek/Cyrillic prefix coverage without changing the current self-test count, and `docs/qa-checklist.md` documents the fullwidth/Greek/Cyrillic-prefix-or-digit lookalike regression path.
- Verification for this controller task-card Greek/Cyrillic-prefix lookalike guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Controller safe-dispatch Unicode-dash broad-scope alias guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now treats Unicode dash separators the same as ASCII separators in unsafe safe-dispatch scope aliases, so `repo-wide`, `any-files`, `all-source`, `entire-project`, `whole-tree`, and related wording cannot bypass broad-write-scope rejection by swapping in non-ASCII dash characters. `scripts/check-handoff-hygiene.test.mjs` reuses the existing broad-scope fixture to pin Unicode non-breaking-hyphen/en-dash variants without changing the current self-test count, and `docs/qa-checklist.md` documents Unicode-dash broad-scope alias coverage.
- Verification for this controller safe-dispatch Unicode-dash broad-scope alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin service-worker registration source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now keeps Service Worker API entrypoints centralized in `apps/web/src/sw-register.ts` by blocking production Web Admin sources elsewhere from probing `serviceWorker` support, touching `navigator.serviceWorker`, referencing Service Worker container/registration types, or calling registration/readiness/lookup surfaces. `docs/qa-checklist.md` documents the service-worker registration source guard alongside the browser app-integration contract and existing service-worker update failure coverage.
- Verification for this Web Admin service-worker registration source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin browser app-integration source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing browser app-integration entrypoints such as `IdleDetector`, `PresentationRequest`, `launchQueue`, App Badging calls, installed-related-app discovery, Web Locks, Presentation API access, window-controls overlay access, or directory-picker surfaces, keeping the audited admin shell out of browser-installed/PWA-style integration paths unless explicitly reviewed. `docs/qa-checklist.md` documents the browser app-integration source guard alongside the existing privileged browser API, Contacts Picker, hardware, and fingerprinting contracts.
- Verification for this Web Admin browser app-integration source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin realtime browser communication source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing peer-to-peer or low-latency browser transport primitives such as `RTCPeerConnection`, `RTCDataChannel`, `RTCIceCandidate`, `RTCSessionDescription`, RTP sender/receiver/transceiver classes, or `WebTransport` stream/datagram surfaces, keeping the audited admin shell on the centralized snapshot fetch path instead of adding unreviewed realtime browser channels. `docs/qa-checklist.md` documents the realtime browser communication source guard alongside browser-network centralization and cross-window messaging contracts.
- Verification for this Web Admin realtime browser communication source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin media/canvas capture and local-recognition source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing media capture, canvas extraction, audio fingerprinting, local recognition, Web MIDI, or Web NFC surfaces such as `getUserMedia`, `getDisplayMedia`, `MediaRecorder`, `MediaStream`, `captureStream`, `toDataURL`, `toBlob`, `AudioContext`, `OffscreenCanvas`, `BarcodeDetector`, `FaceDetector`, `TextDetector`, `EyeDropper`, `navigator.requestMIDIAccess`, or `NDEFReader`, keeping the audited admin shell out of browser-side capture and recognition flows unless explicitly reviewed. `docs/qa-checklist.md` documents the media/canvas capture and local-recognition source guard alongside the hardware, fingerprinting, and privileged browser API contracts.
- Verification for this Web Admin media/canvas capture and local-recognition source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin browser fingerprinting and environment-probe source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing client fingerprinting or environment-probe APIs such as `navigator.userAgent`, `navigator.userAgentData`, `navigator.hardwareConcurrency`, `navigator.deviceMemory`, `navigator.connection`, `navigator.getBattery`, `navigator.mediaCapabilities`, `performance.memory`, `screen.colorDepth`, or `visualViewport`, preserving the admin shell's audited snapshot/localization boundaries instead of adding ad hoc browser capability detection. `docs/qa-checklist.md` documents the browser fingerprinting/environment-probe source guard alongside the hardware and privileged browser API contracts.
- Verification for this Web Admin browser fingerprinting and environment-probe source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin device sensor and immersive hardware source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing device-motion/orientation sensors, generic sensor constructors, gamepad/vibration surfaces, orientation-lock calls, or WebXR primitives such as `navigator.xr` and XR session/frame classes, keeping the audited admin shell away from hardware/immersive browser APIs unless explicitly reviewed. `docs/qa-checklist.md` documents the device sensor and immersive hardware source guard alongside the privileged browser API contract.
- Verification for this Web Admin device sensor and immersive hardware source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin Contacts Picker source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing contact-book access through `navigator.contacts`, optional-chained contacts access, or `ContactsManager`, keeping personal contact data surfaces out of the audited admin shell unless explicitly reviewed. `docs/qa-checklist.md` documents the Contacts Picker source guard alongside the privileged browser API and device sensor contracts.
- Verification for this Web Admin Contacts Picker source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin protocol handler source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from registering or unregistering browser URL protocol handlers through `navigator.registerProtocolHandler`, `navigator.unregisterProtocolHandler`, or optional-chained equivalents, keeping external protocol routing out of the audited admin shell unless explicitly reviewed. `docs/qa-checklist.md` documents the protocol handler source guard alongside the privileged browser API, Contacts Picker, and environment-probe contracts.
- Verification for this Web Admin protocol handler source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Controller task-card fullwidth-lookalike guard continued as a serialized cleanup/docs carve-out with ledger ownership unchanged: `scripts/check-handoff-hygiene.mjs` now rejects active task-card IDs containing non-ASCII digit or prefix lookalikes, so visually compact IDs cannot bypass the ASCII compact `TNN` requirement. `scripts/check-handoff-hygiene.test.mjs` pins the padded-ID fixture with fullwidth digit and prefix coverage, and `docs/qa-checklist.md` documents the fullwidth-lookalike task-card ID regression path.
- Verification for this controller task-card fullwidth-lookalike guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch directory/tree/module broad-scope alias guard continued as a serialized cleanup/docs carve-out while the active Web admin lane remains unchanged: `scripts/check-handoff-hygiene.mjs` now rejects additional safe-dispatch queue broad-scope aliases that preserve otherwise scoped lane text but append directory, tree, project, app, package, module, or component expansion phrases such as `any directories`, `any dirs`, `any folders`, `any modules`, `all components`, `project-wide`, `app-wide`, `whole tree`, or `entire project`. `scripts/check-handoff-hygiene.test.mjs` reuses the existing broad-scope fixture to pin a scoped-looking QA infra lane that still adds directory/tree/module/project expansion wording without changing the current self-test count, and `docs/qa-checklist.md` documents the expanded any-directories/whole-tree/any-modules/project-wide alias coverage.
- Verification for this controller safe-dispatch directory/tree/module broad-scope alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller non-ledger active-lane and collision-note prose guard continued as a serialized cleanup/docs carve-out while the active Web admin lane remains unchanged: `scripts/check-handoff-hygiene.mjs` now rejects reverse-order non-ledger active-lane phrasing such as lane names followed by `is active`, `remains active`, or `stays active`, plus generic prose that says `active lane is/remains/stays <lane>` or uses punctuation-shaped active-lane subject wording, in addition to the existing forward active-lane wording; it also reserves collision-note and reverse lifecycle-status prose for the single stop-warning path instead of allowing active-top collision hints to imply resumable prior context. `scripts/check-handoff-hygiene.test.mjs` reuses existing fixtures for the reverse active-lane, punctuation-shaped subject, and collision-note prose regressions without changing the current self-test count, and `docs/qa-checklist.md` documents both guard paths.
- Verification for this controller non-ledger active-lane and collision-note prose guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller terminology dash-variant guard continued as a serialized cleanup/docs carve-out while the active Web admin lane remains unchanged: `scripts/check-handoff-hygiene.mjs` now treats Unicode dash separators in the CORS-origin terminology carve-out and deprecated policy wording the same as ASCII separators, so active handoff text cannot bypass terminology enforcement with non-ASCII separators. `scripts/check-handoff-hygiene.test.mjs` reuses the existing hyphenated terminology fixtures to pin Unicode en-dash/non-breaking-hyphen variants without changing the current self-test count, and `docs/qa-checklist.md` documents the Unicode-dash terminology regression coverage.
- Verification for this controller terminology dash-variant guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.
- Controller safe-dispatch broad-scope alias guard continued as a serialized cleanup/docs carve-out while the active Web admin lane remains unchanged: `scripts/check-handoff-hygiene.mjs` now rejects additional safe-dispatch queue broad-scope aliases that keep the required lane wording but append plural or alternate expansion phrases such as `any files`, `any paths`, `any packages`, `any workspaces`, `any source`, `all code`, or `every file/path/package/workspace/source`. `scripts/check-handoff-hygiene.test.mjs` reuses the existing broad-scope fixture to pin a scoped-looking QA infra lane that still adds `any files touched by QA`, and `docs/qa-checklist.md` documents the expanded any-files/every-file alias coverage.
- Verification for this controller safe-dispatch broad-scope alias guard slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.

- Web Admin observer/frame scheduler source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing direct observer or frame-scheduling primitives such as `MutationObserver`, `ResizeObserver`, `IntersectionObserver`, `PerformanceObserver`, `requestAnimationFrame`, `cancelAnimationFrame`, `requestIdleCallback`, `cancelIdleCallback`, `queueMicrotask`, `scheduler.postTask`, or `scheduler.yield`, including optional-chained scheduler calls, keeping render timing and DOM observation paths out of the audited admin shell unless explicitly reviewed.
- Verification for this Web Admin observer/frame scheduler source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin Web Share API source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing native share-sheet data egress through `navigator.share` or `navigator.canShare`, keeping clipboard, file-transfer, and sharing surfaces out of the audited admin shell unless explicitly reviewed. `docs/qa-checklist.md` documents the Web Share API source guard alongside the existing clipboard/file-transfer contract.
- Verification for this Web Admin Web Share API source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin browser timer source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now allows direct production `setTimeout`/`clearTimeout`/`setInterval`/`clearInterval` usage only in the audited admin snapshot timeout path (`apps/web/src/adminData.ts`) and the service-worker update scheduler (`apps/web/src/sw-register.ts`), while blocking ad hoc browser timers elsewhere in production Web Admin sources and continuing to reject string-based timers everywhere. `docs/qa-checklist.md` documents the browser timer source guard alongside browser-network centralization and service-worker update failure coverage.
- Verification for this Web Admin browser timer source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin cross-window messaging source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing cross-window messaging or window-relationship surfaces such as `postMessage`, `MessageChannel`, `MessagePort`, `document.domain`, `window.frames`, `window.name`, `window.opener`, `window.parent`, or `window.top`, keeping the admin shell out of unreviewed frame/opener communication paths. `docs/qa-checklist.md` documents the cross-window messaging source guard alongside the existing browser-network, navigation-mutation, and form-submission contracts.
- Verification for this Web Admin cross-window messaging source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin DOM expansion and credential source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing DOM parser/serializer expansion, Shadow DOM/custom-elements surfaces, editable/popover markup, legacy range/execCommand flows, or credential-management APIs such as `navigator.credentials`, `PasswordCredential`, `PublicKeyCredential`, and `FederatedCredential`. `docs/qa-checklist.md` documents this source guard alongside the existing browser-network, passive-resource, clipboard/file-transfer, privileged browser API, and native-dialog contracts.
- Verification for this Web Admin DOM expansion and credential source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin privileged browser API source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing privileged browser capabilities such as fullscreen requests, geolocation, media devices, permissions, notifications, payment requests, Bluetooth/HID/Serial/USB, wake locks, or save-file picker APIs, keeping the Web Admin shell within the audited live snapshot and localized UI boundaries. `docs/qa-checklist.md` documents the privileged browser API source guard alongside the existing source-level browser-network, passive-resource, clipboard/file-transfer, and native-dialog contracts.
- Verification for this Web Admin privileged browser API source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin native browser dialog source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing native blocking browser dialog surfaces such as `alert(`, `confirm(`, `prompt(`, `print(`, `beforeunload`, or `onbeforeunload`, preserving the localized non-ready/error UI and audited reload/focus flows instead of allowing ad hoc modal browser prompts. `docs/qa-checklist.md` documents the native browser dialog source guard alongside the existing browser-network, navigation-mutation, form-submission, passive-resource, and clipboard/file-transfer contracts.
- Verification for this Web Admin native browser dialog source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin clipboard/file-transfer source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing clipboard, drag/drop, download, file-picker, `FileReader`, `DataTransfer`, or object-URL transfer surfaces, so the admin shell cannot add ad hoc browser data ingress/egress paths outside the audited snapshot boundary. `docs/qa-checklist.md` documents the clipboard/file-transfer source guard alongside browser-network, passive-resource, navigation-mutation, and form-submission contracts.
- Verification for this Web Admin clipboard/file-transfer source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Controller count-noise cleanup continued as a serialized cleanup/docs carve-out while the active Web admin lane remains unchanged: `HANDOFF.md` now describes stale handoff-hygiene self-test regressions as older lower handoff-hygiene results instead of naming obsolete numeric counts in the active top section, reducing false-positive grep noise while preserving the current 114/114 evidence and the checker fixtures that intentionally exercise stale-count failures.
- Verification for this controller count-noise cleanup slice is green: `npm run qa:handoff-hygiene` (114/114 plus live scan) and `npm run lint` pass.
- Web Admin passive-resource source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing passive resource-loading surfaces such as `<img`, `<iframe`, `<object`, `<embed`, audio/video/source tags, preload/prefetch links, `poster=`, or `srcSet=`, so static markup cannot bypass the centralized live snapshot network path. `docs/qa-checklist.md` documents the passive-resource source guard alongside browser-network, navigation-mutation, and form-submission contracts.
- Verification for this Web Admin passive-resource source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin admin snapshot non-JSON static-error coverage continued under the active Web admin lane: `apps/web/src/adminData.test.ts` now asserts successful live snapshot responses served with non-JSON media types reject with the static `Admin snapshot response was not JSON.` message before reading body payloads, keeping raw HTML/text details out of the loader error path without increasing the 30-test count. `docs/qa-checklist.md` documents non-JSON media-type failures alongside the existing network/JSON/HTTP/malformed-shape redaction coverage.
- Verification for this Web Admin non-JSON static-error test slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin form-submission source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from introducing raw form submission surfaces such as `<form`, `action=`, GET/POST form methods, `onSubmit`, `.submit(`, or `requestSubmit`, preserving the centralized live snapshot loader as the only browser network path. `docs/qa-checklist.md` documents the form-submission source guard alongside the existing browser-network and navigation-mutation contracts.
- Verification for this Web Admin form-submission source guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin admin snapshot URL control-character hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now rejects configured live snapshot URLs containing control characters before absolute/relative URL normalization, so CR/LF, NUL, or DEL-shaped endpoint values cannot be passed to `fetch` or fragment stripping. `apps/web/src/adminData.test.ts` pins CR/LF and DEL endpoint fallbacks without increasing the 30-test count, while `docs/qa-checklist.md` documents control-character-bearing configured URLs falling back to the same-origin default.
- Verification for this Web Admin URL control-character slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin malformed snapshot raw-detail redaction coverage continued under the active Web admin lane: `apps/web/src/adminData.test.ts` now injects token-bearing payload fields into malformed live snapshot shape responses and asserts the loader keeps the static `Admin snapshot response did not match the expected shape.` message instead of preserving raw payload details. `docs/qa-checklist.md` documents malformed shape failures alongside the existing network/JSON/HTTP redaction coverage.
- Verification for this Web Admin malformed-shape redaction test slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin admin snapshot auth-token control-character hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now drops configured live snapshot bearer tokens containing control characters such as CR/LF or NUL after trimming, so invalid or header-injection-shaped env values cannot enter the `Authorization` header. `apps/web/src/adminData.test.ts` pins env-token rejection and request-header omission for unsafe tokens without increasing the 30-test count; `docs/qa-checklist.md` and `apps/web/README.md` document the token sanitization boundary.
- Verification for this Web Admin auth-token control-character slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin admin snapshot URL credential/fragment hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now rejects configured HTTP(S) live snapshot URLs that include embedded userinfo credentials, strips URL fragments from accepted absolute and relative snapshot URLs before fetch, and keeps unsupported/protocol-relative endpoints on the same-origin default. `apps/web/src/adminData.test.ts` pins credential fallback plus absolute and relative fragment stripping without increasing the 30-test count; `docs/qa-checklist.md` and `apps/web/README.md` document the URL credential and fragment boundary.
- Verification for this Web Admin URL credential/fragment slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin live admin snapshot no-keepalive hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now sends live admin snapshot fetches with explicit `keepalive: false` alongside `method: 'GET'`, `cache: 'no-store'`, `credentials: 'same-origin'`, `mode: 'cors'`, `referrerPolicy: 'no-referrer'`, `redirect: 'error'`, guarded JSON headers, bearer-token support, and the abort signal, so the dashboard snapshot request stays abortable and is not queued past the page lifecycle. `apps/web/src/adminData.test.ts` pins no-keepalive initialization for populated, bearer-token, and blank-token snapshot loads, while `docs/qa-checklist.md` documents the no-keepalive request boundary.
- Verification for this Web Admin live admin snapshot no-keepalive slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin admin snapshot non-OK body/read redaction coverage continued under the active Web admin lane: `apps/web/src/adminData.test.ts` now pins that 401, 403, and 500 live snapshot responses are classified without reading raw JSON bodies, rejected fetch and JSON parsing failures normalize to safe `AdminDataError.message` values instead of preserving raw rejection text or token-bearing payloads, and `+json` media types remain accepted by the JSON response boundary. `docs/qa-checklist.md` and `apps/web/README.md` document the body-read and safe-error-message boundary.
- Verification for this Web Admin non-OK body/read redaction test slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin live admin snapshot read-only method hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now sends live admin snapshot fetches with explicit `method: 'GET'` alongside `cache: 'no-store'`, `credentials: 'same-origin'`, `mode: 'cors'`, `referrerPolicy: 'no-referrer'`, `redirect: 'error'`, guarded JSON headers, bearer-token support, and the abort signal, so the dashboard snapshot boundary remains an explicit read-only request. `apps/web/src/adminData.test.ts` pins the method for populated, bearer-token, and blank-token snapshot loads, while `docs/qa-checklist.md` documents the read-only method contract.
- Verification for this Web Admin live admin snapshot read-only method slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin live admin snapshot JSON media-type hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now rejects successful live snapshot responses before body parsing unless the response `Content-Type` is `application/json` or a `+json` media type, so HTML/text fallback bodies cannot enter the trusted snapshot validation path. `apps/web/src/adminData.test.ts` keeps the existing 30-test count while pinning JSON media-type request fixtures, non-JSON body-read skipping, and the previous hung/body-abort semantics. `docs/qa-checklist.md` and `apps/web/README.md` document the JSON media-type response contract.
- Verification for this Web Admin JSON media-type slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin live admin snapshot explicit CORS mode continued under the active Web admin lane: `apps/web/src/adminData.ts` now sends live admin snapshot fetches with `mode: 'cors'` alongside `cache: 'no-store'`, `credentials: 'same-origin'`, `referrerPolicy: 'no-referrer'`, `redirect: 'error'`, guarded JSON headers, bearer-token support, and the abort signal, so relative and configured HTTP(S) snapshot endpoints stay on normal CORS response checks instead of an opaque request mode. `apps/web/src/adminData.test.ts` pins the explicit CORS mode for populated, bearer-token, and blank-token snapshot loads, while `docs/qa-checklist.md` documents the CORS-mode request boundary.
- Verification for this Web Admin live admin snapshot CORS-mode slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin live admin snapshot redirect containment continued under the active Web admin lane: `apps/web/src/adminData.ts` now sends live admin snapshot fetches with `redirect: 'error'` alongside `cache: 'no-store'`, `credentials: 'same-origin'`, `referrerPolicy: 'no-referrer'`, guarded JSON headers, bearer-token support, and the abort signal, so configured snapshot endpoints cannot silently redirect privileged dashboard requests to an unexpected target. `apps/web/src/adminData.test.ts` pins redirect containment for populated, bearer-token, and blank-token snapshot loads, while `docs/qa-checklist.md` documents the redirect rejection boundary.
- Verification for this Web Admin live admin snapshot redirect-containment slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin admin snapshot bearer-token redaction coverage continued under the active Web admin lane: `tests/e2e/specs/web-admin.spec.ts` now seeds the configured admin snapshot auth token into mocked 401, 403, 503, malformed JSON, and malformed-shape responses while the shared non-ready helper asserts that the token stays out of state-panel text, alert text, and page text. `docs/qa-checklist.md` and `apps/web/README.md` document that unavailable/error copy must not expose raw response details or configured bearer tokens.
- Verification for this Web Admin bearer-token redaction E2E helper slice is green: `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "has no critical|surfaces auth"` (4/4), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin live admin snapshot referrer privacy hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now sends live admin snapshot fetches with `referrerPolicy: 'no-referrer'` alongside `cache: 'no-store'`, `credentials: 'same-origin'`, guarded JSON headers, bearer-token support, and the abort signal, so configured snapshot endpoints do not receive the admin console URL as a referrer. `apps/web/src/adminData.test.ts` pins the referrer policy for populated, bearer-token, and blank-token snapshot loads, while `docs/qa-checklist.md` documents the referrer-suppression boundary.
- Verification for this Web Admin live admin snapshot referrer-policy slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin live admin snapshot credentials isolation continued under the active Web admin lane: `apps/web/src/adminData.ts` now sends live admin snapshot fetches with `credentials: 'same-origin'` alongside `cache: 'no-store'`, guarded JSON headers, bearer-token support, and the abort signal, so configured cross-origin snapshot endpoints do not receive ambient browser cookies while same-origin deployments keep ordinary credential behavior. `apps/web/src/adminData.test.ts` pins credentials isolation for populated, bearer-token, and blank-token snapshot loads, while `docs/qa-checklist.md` documents the same-origin credential boundary.
- Verification for this Web Admin live admin snapshot credentials slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin CSP/Permissions missing-meta hardening continued under the active Web admin lane: `apps/web/src/csp.ts` now injects Content-Security-Policy and Permissions-Policy meta tags into `<head>` when the Vite HTML template is missing them, and prepends them as a last-resort fallback when no head element exists, while preserving existing meta replacement and CSP-origin injection behavior. `apps/web/src/csp.test.ts` pins missing-head and missing-meta cases for both policies, and `docs/qa-checklist.md` documents the CSP/Permissions-Policy missing-meta injection unit guard.
- Verification for this Web Admin CSP/Permissions missing-meta slice is green: targeted `npm run test:web -- csp` (13/13), `npm run typecheck:web`, full `npm run test:web` (160/160), and `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI) all pass.
- Web Admin live admin snapshot no-store request hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now sends live admin snapshot fetches with `cache: 'no-store'` alongside the existing guarded `Accept`/bearer headers and abort signal, so privileged sync snapshots do not rely on browser or HTTP cache state. `apps/web/src/adminData.test.ts` pins no-store request initialization for populated, bearer-token, and blank-token snapshot loads, while `docs/qa-checklist.md` documents the cache-bypass requirement.
- Verification for this Web Admin live admin snapshot no-store slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin admin snapshot URL protocol hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now keeps configured live admin snapshot URLs to trimmed relative or HTTP(S) targets, while unsupported protocols and protocol-relative values fall back to `/api/admin/snapshot` so the data fetch boundary matches the CSP connect-origin policy. `apps/web/src/adminData.test.ts` pins trimmed HTTP(S), blank default, unsupported protocol, and protocol-relative fallback behavior; `docs/qa-checklist.md` documents the endpoint protocol fallback requirement.
- Verification for this Web Admin admin snapshot URL protocol slice is green: targeted `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, full `npm run test:web` (160/160), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin service-worker update failure hardening continued under the active Web admin lane: `apps/web/src/sw-register.ts` now exports a testable offline-support registration helper, keeps browser import side effects intact, catches failed scheduled `registration.update()` calls, and keeps registration failure/controller-change/update-available handling explicit without relaxing the production-source network guard. `apps/web/src/sw-register.test.ts` pins unavailable service-worker skips, load-time registration, rejected scheduled updates, update-available dispatch, and single controller-change reload behavior. `docs/qa-checklist.md` documents the service-worker update failure unit guard.
- Verification for this Web Admin service-worker update failure slice is green: targeted `npm run test:web -- sw-register` (4/4), `npm run typecheck:web`, full `npm run test:web` (160/160), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin navigation-mutation source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from untested navigation mutations such as `window.open`, `location.href`, `location.assign`, `location.replace`, history push/replace state, `_blank` targets, and opener relationships while preserving the existing hash-aware navigation and explicit reload paths. `docs/qa-checklist.md` documents the navigation-mutation unit guard alongside the existing source-level Web Admin safety contracts.
- Verification for this Web Admin navigation-mutation source guard slice is green: `npm run typecheck:web`, targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin browser-network centralization source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources outside `apps/web/src/main.tsx` from direct browser network primitives such as `fetch(`, `window.fetch`, `XMLHttpRequest`, `WebSocket`, `EventSource`, workers, broadcast channels, and beacon APIs, while pinning the Web shell's single network entrypoint through `loadAdminDashboard(window.fetch.bind(window)`. `docs/qa-checklist.md` documents the browser-network centralization unit guard and ties live snapshot requests to the guarded auth, abort, timeout, validation, and safe-error pipeline.
- Verification for this Web Admin browser-network centralization source guard slice is green: `npm run typecheck:web`, targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin lazy locale chunk failure hardening continued under the active Web admin lane: `apps/web/src/localization.ts` now catches eager `loadLocale` failures, keeps async translator creation resolved, and falls back to English shared messages while preserving locale-specific local Web copy when a dynamic language bundle is unavailable. `apps/web/src/localization.test.ts` pins both eager-load and async failure paths, while `docs/qa-checklist.md` documents the lazy locale chunk fallback unit guard.
- Verification for this Web Admin lazy locale chunk failure slice is green: `npm run typecheck:web`, targeted `npm run test:web -- localization` (20/20), full `npm run test:web` (160/160), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "language storage|strict core localization"` (4/4), `npm run lint`, `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `node scripts/check-handoff-hygiene.mjs`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin browser-storage centralization source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources outside `apps/web/src/localization.ts` from direct browser storage APIs such as `localStorage`, `sessionStorage`, `indexedDB`, `document.cookie`, `navigator.storage`, and `caches.open`, while pinning the localization helper as the single guarded storage integration point. `docs/qa-checklist.md` documents the storage-centralization unit guard alongside blocked-storage language resilience.
- Verification for this Web Admin browser-storage centralization source guard slice is green: `npm run typecheck:web`, targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin unsafe URL and dynamic script source guards continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now blocks production Web Admin sources from `javascript:`, `vbscript:`, `data:text/html`, dynamic script execution APIs, string timers, `srcDoc=`, and contextual-fragment/raw HTML sinks, extending the existing source-level no-`aria-label`, safe-error-copy, and raw HTML-injection contracts. `docs/qa-checklist.md` documents the unsafe URL protocol and dynamic script execution unit guards.
- Verification for this Web Admin unsafe URL and dynamic script source guard slice is green: `npm run typecheck:web`, targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin raw HTML-injection source guard continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now scans production Web Admin sources for raw HTML injection APIs including `dangerouslySetInnerHTML`, `.innerHTML`, `.outerHTML`, `insertAdjacentHTML`, and `document.write(` while preserving the existing no-`aria-label` and raw-error-detail contracts. `docs/qa-checklist.md` documents the raw HTML-injection unit guard alongside the production-source accessibility and safe-error-copy guards.
- Verification for this Web Admin raw HTML-injection source guard slice is green: `npm run typecheck:web`, targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin raw-error-detail state guard continued under the active Web admin lane: `apps/web/src/main.tsx` now keeps non-ready dashboard state to phase-only values instead of retaining raw `AdminDataError.message` strings after live snapshot failures, while `apps/web/src/accessibilityContracts.test.ts` pins the source-level contract that render state uses localized safe error copy without `adminError.message`. `docs/qa-checklist.md` documents the raw-error-detail unit guard alongside the existing production-source no-`aria-label` guard.
- Verification for this Web Admin raw-error-detail state guard slice is green: `npm run typecheck:web`, targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin raw-error source contract and sealed-controller exclusion guard continued under team-mode control: `apps/web/src/accessibilityContracts.test.ts` now also pins the unavailable/error state-panel source contract so rendered panel copy keeps `web.state.error.message` and cannot read `state.message` raw details. The controller cleanup guard now rejects the blocked controller fingerprint anywhere in live `HANDOFF.md`, including archival-only sections, while `scripts/check-handoff-hygiene.test.mjs` keeps the real blocked ID only in negative fixtures. `docs/qa-checklist.md` documents blocked controller-ID regressions and the raw-error-detail unit guard.
- Verification for this Web Admin source contract plus sealed-controller guard slice is green: targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.

- Web Admin unavailable/error raw-detail redaction continued under the active Web admin lane: `apps/web/src/main.tsx` now renders only the localized recovery message for unavailable/error admin snapshot panels instead of retaining or appending raw `AdminDataError` details. `tests/e2e/specs/web-admin.spec.ts` pins network failure, 503, invalid JSON, malformed snapshot shape, invalid counters, duplicate/padded IDs, and blank required fields to the same exact safe described alert copy with raw technical details absent from the panel, and adds a Simplified Chinese unavailable path so localized error copy cannot fall back to English. `docs/qa-checklist.md` documents the raw admin snapshot detail redaction coverage.
- Verification for this Web Admin unavailable/error redaction slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "surfaces auth, empty"` (2/2), focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "surfaces auth, empty|keeps admin state chrome localized"` (4/4), `npm run test:web -- main localization` (57/57), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), full `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.

- Web Admin production-source no-`aria-label` guard broadened under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now scans every production `apps/web/src` TypeScript/TSX source through `import.meta.glob` while excluding tests and generated Vite env declarations, so the no-`aria-label=` contract no longer depends on `main.tsx` alone and the guard no longer self-matches during simple source scans. `docs/qa-checklist.md` now documents the production-source no-`aria-label` unit guard.
- Verification for this Web Admin production-source no-`aria-label` guard slice is green: `npm run typecheck:web`, targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.

- Web Admin source-level no-`aria-label` guard and Web QA count-drift follow-up continued under the active Web admin lane: `apps/web/src/accessibilityContracts.test.ts` now imports `apps/web/src/main.tsx` as raw source and fails fast if Web Admin reintroduces source-level `aria-label=` attributes while preserving the `aria-labelledby` naming contract. `scripts/check-handoff-hygiene.mjs` and `scripts/check-handoff-hygiene.test.mjs` now require current `qa:web` evidence at 160/160 after the new Web test, and this active handoff top was normalized to the new Web test count. `docs/qa-checklist.md` documents the source-level no-`aria-label` unit guard.
- Verification for this Web Admin source no-`aria-label` guard and count-drift slice is green: `npm run typecheck:web`, targeted `npm run test:web -- accessibilityContracts` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.

- Controller sealed-controller collision guard continued under team-mode control: `scripts/check-handoff-hygiene.test.mjs` now makes the active-top fixture fail on a raw blocked-controller UUID before the safe dispatch queue, while the clean archival fixture uses a synthetic UUID so the real blocked controller ID only appears in negative fixtures. `docs/qa-checklist.md` documents the active raw blocked-controller UUID regression coverage and current Web-only 35/35 evidence.
- Verification for this controller sealed-controller collision guard slice is green: `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.

- Web Admin rendered no-`aria-label` contract guard continued under the active Web admin lane: `tests/e2e/specs/web-admin.spec.ts` now asserts the populated fixture dashboard and mobile navigation path render with zero `[aria-label]` attributes, preserving the visible text, hidden heading, and `aria-labelledby` naming direction now used across the Web Admin shell. `docs/qa-checklist.md` documents the populated-shell no-`aria-label` contract.
- Verification for this Web Admin rendered no-`aria-label` contract guard slice is green: `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|keeps navigation usable"` (4/4), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.

- Web Admin Storage navigation target semantics hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now includes a hidden Storage heading in the managed-device table name so the `#storage` navigation target announces both the nav destination and managed-device table context. `tests/e2e/specs/web-admin.spec.ts` pins the Storage heading, combined `aria-labelledby` table name, and Storage link `aria-current="location"` path; `docs/qa-checklist.md` documents Storage navigation target naming.
- Verification for this Web Admin Storage navigation target slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "shows role, audit|keeps navigation usable"` (4/4), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.

- Web Admin data-row visible-cell naming continued under the active Web admin lane: `apps/web/src/main.tsx` now composes member and managed-device data row names from visible cell IDs via `aria-labelledby` instead of constructed row `aria-label` strings, and removes redundant role/status cell labels where visible text already names the control. `tests/e2e/specs/web-admin.spec.ts` pins the member/device row names, `aria-labelledby` relationships, and no-`aria-label` regressions, while `docs/qa-checklist.md` documents visible-cell row naming.
- Verification for this Web Admin data-row visible-cell naming slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|shows role, audit"` (4/4), `npm run lint`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.

- Web Admin fatal/navigation/language semantics hardening continued under the active Web admin lane: `apps/web/src/WebErrorBoundary.tsx` now renders a safe localized recovery description instead of exposing raw exception messages while still reporting the raw error to the monitor; `apps/web/src/main.tsx` now uses visible-label-derived language selector naming and `aria-current="location"` for page-section navigation. `apps/web/src/localization.ts` adds localized fatal recovery copy for all supported Web locales, `tests/e2e/specs/web-admin.spec.ts` pins fatal raw-exception redaction, language-selector visible-label naming, and hash-aware location-current semantics, and `docs/qa-checklist.md` documents the updated Web Admin coverage.
- Controller lane guard follow-up continued as a serialized cleanup/docs carve-out while the Web admin lane remains active: `scripts/check-handoff-hygiene.mjs` now requires the active lane ledger to keep Web admin active and tightens QA-checklist coverage to CORS-origin `allowlist` context; `scripts/check-handoff-hygiene.test.mjs` updates the clean fixture to Web admin active and pins non-Web active-owner rejection.
- Verification for this Web Admin fatal/navigation/language plus controller guard follow-up is green: `npm run test:web -- WebErrorBoundary localization` (23/23), `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "keeps navigation usable|language storage|strict core localization"` (6/6), focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "fatal render errors|runtime language"` (4/4), full `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.

- Web Admin navigation landmark hidden-heading naming continued under the active Web admin lane: `apps/web/src/main.tsx` now names the admin navigation landmark from a screen-reader navigable hidden heading via `aria-labelledby` instead of an anonymous `aria-label`, while preserving hash-aware `aria-current="location"` navigation links. `tests/e2e/specs/web-admin.spec.ts` pins the hidden-heading relationship, no-`aria-label` regression, and mobile navigation path, and `docs/qa-checklist.md` documents the navigation landmark hidden-heading naming requirement.
- Verification for this Web Admin navigation landmark hidden-heading naming slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|keeps navigation usable"` (4/4), `npm run lint`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.

- Web Admin dashboard collection hidden-heading naming continued under the active Web admin lane: `apps/web/src/main.tsx` now labels the metrics list, team-member table, role-permissions list, managed-device table, and recent-audit-events list/table collections from screen-reader-visible hidden headings via `aria-labelledby` instead of anonymous `aria-label` strings. `tests/e2e/specs/web-admin.spec.ts` pins the heading-derived collection names, no-`aria-label` regressions, and exact main-heading lookups so hidden collection headings cannot collide with top-level title assertions, and `docs/qa-checklist.md` documents the hidden-heading collection naming requirement.
- Verification for this Web Admin dashboard collection hidden-heading naming slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|shows role, audit"` (4/4), `npm run lint`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.

- Web Admin refresh-control hidden-text naming continued under the active Web admin lane: `apps/web/src/main.tsx` now names the icon-only refresh button from persistent visually hidden button text instead of an `aria-label`, while the transient loading announcement moved to a sibling `aria-describedby` target so loading progress remains descriptive instead of joining the button name. `tests/e2e/specs/web-admin.spec.ts` pins the no-`aria-label` regression in fixture and live-refresh loading paths, and `docs/qa-checklist.md` documents the hidden-text refresh-control naming requirement.
- Verification for this Web Admin refresh-control hidden-text naming slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|aborts stale live admin snapshot refreshes"` (4/4), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.

- Web Admin navigation visible-label hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now lets navigation links derive their accessible names from their visible localized text instead of duplicating the same copy through `aria-label`, while preserving hidden icons and hash-aware `aria-current`. `tests/e2e/specs/web-admin.spec.ts` pins visible-text link names and rejects redundant link `aria-label` attributes across desktop and mobile Web Admin navigation, and `docs/qa-checklist.md` documents the visible-text navigation-name requirement.
- Verification for this Web Admin navigation visible-label slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "keeps navigation usable"` (2/2), `npm run lint`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass. The active handoff wording was also cleaned so the stop-warning line remains the only collision warning allowed by the live guard, and `tests/e2e/test-results/.last-run.json` is `passed`.
- Controller hygiene guard follow-up continued as a serialized cleanup/docs carve-out while the Web admin lane remains active: `scripts/check-handoff-hygiene.mjs` now rejects any non-35/35 Web Admin Web-only command/prose evidence instead of enumerating stale counts, reserves collision-note wording for the single stop warning, and renames the terminology guard around disallowed policy terms while preserving CORS origin `allowlist` context. `scripts/check-handoff-hygiene.test.mjs` pins appended non-current Web-only evidence and generic sealed-controller prose, while `docs/qa-checklist.md` documents the explicit disallowed-terminology variants.
- Verification for this controller hygiene guard follow-up is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass.

- Web Admin team-overview heading semantics hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now names the Team management overview region from a screen-reader navigable `h2` via `aria-labelledby`, replacing the anonymous `aria-label` while preserving the existing dashboard layout and visible panel headings. `tests/e2e/specs/web-admin.spec.ts` pins the heading-derived region name in the fixture dashboard path, and `docs/qa-checklist.md` documents dashboard overview heading-derived region naming.
- Verification for this Web Admin team-overview heading semantics slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard"` (2/2), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass. Cleanup scan found no workspace processes in `C:\Tools\agenttool`, and `tests/e2e/test-results/.last-run.json` is `passed`.
- Controller count-drift guard follow-up continued as a serialized cleanup/docs carve-out while the Web admin lane remains active: `scripts/check-handoff-hygiene.mjs` now rejects stale pre-35 Web Admin Web-only command evidence and prose after the runtime language fatal-boundary E2E raised the durable Web-only count to 35/35. `scripts/check-handoff-hygiene.test.mjs` pins the new stale-count rejection, and this active handoff top now carries only the current Web-only fresh 35/35 evidence.
- Verification for this controller count-drift guard slice is green: `npm run qa:handoff-hygiene` (114/114 plus live scan) and `npm run lint` both pass.

- Web Admin device/audit panel description hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now associates the Device status and Audit log regions with their visible scope summaries via `aria-describedby`, preserving the existing visible headings, managed-device table semantics, and recent audit-event list semantics while exposing the panel scope to assistive technology. `tests/e2e/specs/web-admin.spec.ts` pins the described-by relationship for both panels in the role/audit/device dashboard path, and `docs/qa-checklist.md` documents device and audit panel scope descriptions.
- Verification for this Web Admin device/audit panel description slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "shows role, audit"` (2/2), `npm run lint`, `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass. Cleanup scan found no workspace processes in `C:\Tools\agenttool`, and `tests/e2e/test-results/.last-run.json` is `passed`.
- Web Admin runtime language fatal-boundary hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now lifts the Web language choice into `AppWithBoundary`, shares the same locale/translator with the dashboard shell, and keeps a synchronous locale fallback translator so render crashes during a language switch use the newly selected fatal alert/reload copy instead of the initial page language. `tests/e2e/specs/web-admin.spec.ts` now starts in English, forces a render crash during a runtime switch to Simplified Chinese, and verifies the localized fatal alert, described crash detail, focused localized reload action, and absence of leaked English fallback copy. `docs/qa-checklist.md` documents runtime language-switch fatal fallback coverage.
- Verification for this Web Admin runtime language fatal-boundary slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "fatal render errors|runtime language"` (4/4), full `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass. Cleanup removed 0 `%TEMP%\joessh-e2e-mobile-web-*` dirs and found no workspace Playwright/Vite/Expo/static-server processes in `C:\Tools\agenttool`.

- Web Admin roles access-model description hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now associates the Roles region with its visible access-model summary via `aria-describedby`, preserving the existing region heading and role-permission list semantics while exposing the panel's summary to assistive technology. `tests/e2e/specs/web-admin.spec.ts` pins the Roles panel described-by relationship in the role/audit/device dashboard path, and `docs/qa-checklist.md` documents roles access-model descriptions.
- Verification for this Web Admin roles access-model description slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "shows role, audit"` (2/2), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass. Cleanup scan found no workspace processes in `C:\Tools\agenttool`, and `tests/e2e/test-results/.last-run.json` is `passed`.

- Web Admin members data-source description hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now associates the Members region with the visible fixture/live source badge via `aria-describedby`, so the panel's accessible description reflects the current data boundary without changing its visible heading or table semantics. `tests/e2e/specs/web-admin.spec.ts` pins the described-by relationship for both fixture fallback and live snapshot paths, and `docs/qa-checklist.md` documents members data-source descriptions.
- Verification for this Web Admin members data-source description slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|loads a live admin snapshot"` (4/4), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass. Cleanup scan found no workspace processes in `C:\Tools\agenttool`, and `tests/e2e/test-results/.last-run.json` is `passed`.

- Web Admin table rowheader semantics hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now exposes member names/emails and managed-device names as first-column `rowheader` cells while preserving row-level composed names, row/column indexes, and visible mobile field labels. `apps/web/src/styles.css` now applies mobile field-label pseudo content to both `cell` and `rowheader` table cells; `tests/e2e/specs/web-admin.spec.ts` pins fixture/live member and device rowheaders plus English LTR and Arabic RTL mobile field labels; `docs/qa-checklist.md` documents rowheader coverage.
- Verification for this Web Admin table-rowheader slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|shows role, audit|loads a live admin snapshot|keeps navigation usable"` (8/8), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass. Cleanup scan found no workspace processes in `C:\Tools\agenttool`.

- Web Admin navigation axe regression follow-up continued under the active Web admin lane: the current axe regression is green after removing nav `aria-controls` target-control metadata from admin navigation links while preserving hash-aware `aria-current`. `tests/e2e/specs/web-admin.spec.ts` keeps desktop/mobile navigation usability coverage; `docs/qa-checklist.md` no longer lists nav target-control relationships as an active requirement.
- Verification for this Web Admin navigation axe regression slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, `npm run test:web -- WebErrorBoundary` (5/5), focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "has no critical|surfaces auth, empty|fatal render errors|keeps admin state chrome localized|keeps navigation usable"` (10/10), full `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass. Cleanup removed 0 `%TEMP%\joessh-e2e-mobile-web-*` dirs and found no workspace Playwright/Vite/Expo/static-server processes in `C:\Tools\agenttool`.

- Web Admin fatal/localized description a11y hardening continued under the active Web admin lane: `apps/web/src/WebErrorBoundary.tsx` now gives the fatal alert a localized accessible name via `aria-labelledby` and associates the crash detail through `aria-describedby`, while preserving assertive atomic alert semantics and reload dispatch coverage. `tests/e2e/specs/web-admin.spec.ts` now queries English and Simplified Chinese fatal alerts by localized names, verifies their described crash detail, and pins the Simplified Chinese empty snapshot panel's message-description association. `docs/qa-checklist.md` documents named/described fatal alerts and localized non-ready message-description coverage.
- Verification for this Web Admin fatal/localized description slice is green: `npm run test:web -- WebErrorBoundary` (5/5), `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "fatal render errors"` (2/2), focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "keeps admin state chrome localized"` (2/2), and full `npm run test:web:fresh -w @atlasterm/e2e` (35/35) all pass.

- Web Admin sidebar landmark semantics hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now keeps the sidebar wrapper as a neutral `div` so the named navigation landmark is not duplicated by a redundant complementary landmark. `tests/e2e/specs/web-admin.spec.ts` pins the absence of extra complementary landmarks alongside the existing named navigation check across desktop and mobile Web Admin projects; `docs/qa-checklist.md` documents redundant sidebar-landmark prevention.
- Verification for this Web Admin sidebar-landmark slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|keeps navigation usable"` (4/4), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass. Cleanup scan found no workspace processes in `C:\Tools\agenttool`.

- Web Admin main landmark semantics hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now uses the shell wrapper as a neutral `div` and makes `#main-content` the unique named `main` landmark, so the sidebar navigation is no longer nested inside the page's main content. `tests/e2e/specs/web-admin.spec.ts` pins the unique `Team operations` main landmark and skip-link focus transfer across desktop and mobile Web Admin projects; `docs/qa-checklist.md` documents unique main landmark coverage.
- Verification for this Web Admin main-landmark slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|moves keyboard focus"` (4/4), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass. Cleanup scan found no workspace processes in `C:\Tools\agenttool`.

- Web Admin non-ready state panel naming hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now composes loading, authentication-required, empty, and unavailable panel accessible names from the visible state badge plus title via `aria-labelledby`, while keeping visible message copy associated through `aria-describedby`. `tests/e2e/specs/web-admin.spec.ts` pins the composed English panel names across status, alert, authentication recovery, and loading-refresh paths; `docs/qa-checklist.md` documents badge/title panel-name coverage.
- Verification for this Web Admin non-ready panel-name slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "has no critical|surfaces auth, empty|recovers a live admin snapshot|aborts stale live admin snapshot refreshes"` (8/8), `npm run lint`, and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass. Cleanup scan found no workspace processes in `C:\Tools\agenttool`.

- Web Admin non-ready description/navigation recovery QA continued under the active Web admin lane: `apps/web/src/main.tsx` now links non-ready state panels to their visible message copy with `aria-describedby`, while `tests/e2e/specs/web-admin.spec.ts` pins message descriptions for authentication-required, empty, unavailable, and loading states. The same E2E pass now verifies direct `#devices` hash loads set the initial navigation `aria-current`, and that a later `403 admin_forbidden` refresh clears previously rendered live audit events along with live tables. `docs/qa-checklist.md` documents non-ready message descriptions, direct-hash navigation current state, and audit-event clearing after forbidden responses.
- Verification for this Web Admin non-ready description/navigation recovery slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "surfaces auth, empty|aborts stale live admin snapshot refreshes"` (4/4), focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "surfaces auth, empty|aborts stale live admin snapshot refreshes|recovers a live admin snapshot|keeps navigation usable"` (8/8), full `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.

- Web Admin table row-name a11y hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now gives member and managed-device data rows accessible names composed from their visible cell values, while preserving existing row/column metadata and localized status/relative-time formatting. `tests/e2e/specs/web-admin.spec.ts` pins representative member and device rows by composed accessible names across desktop and mobile Web Admin projects; `docs/qa-checklist.md` documents member/device row-name coverage.
- Verification for this Web Admin table row-name slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|shows role, audit"` (4/4), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Final process scan found no workspace processes in `C:\Tools\agenttool`.

- Web Admin live audit/reload QA follow-up continued under the active Web admin lane: `tests/e2e/specs/web-admin.spec.ts` now pins the live audit-event `listitem` accessible name from malformed-time, actor, action, and target fields, and extends live member/device table checks to include column counts plus representative live cell column indexes. `apps/web/src/WebErrorBoundary.tsx` now accepts an optional reload handler so `apps/web/src/WebErrorBoundary.test.tsx` can verify the localized reload button dispatches without triggering a real page reload. `docs/qa-checklist.md` documents audit-event item-name coverage and Web error-boundary reload action dispatch.
- Verification for this Web Admin live audit/reload follow-up is green: `npm run test:web -- WebErrorBoundary` (5/5), `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "loads a live admin snapshot|surfaces fatal render errors"` (4/4), focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "shows role, audit|loads a live admin snapshot"` (4/4), full `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.

- Web Admin audit-event a11y hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now renders each audit event through a focused `AuditEventItem` component whose `listitem` accessible name is composed from the visible time, actor, action, and target via `aria-labelledby`. `tests/e2e/specs/web-admin.spec.ts` pins fixture audit events by their composed accessible names across desktop and mobile Web Admin projects; `docs/qa-checklist.md` documents audit-event item-name coverage.
- Verification for this Web Admin audit-event item-name slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "shows role, audit"` (2/2), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Final process scan found no workspace processes in `C:\Tools\agenttool` after a transient `tsc` child exited.

- Web Admin table/navigation/403 axe hardening continued under the active Web admin lane: `apps/web/src/main.tsx` keeps member/device custom table row/column metadata current for fixture and live snapshots, preserves collapsed mobile table header semantics via `apps/web/src/styles.css`, and updates navigation `aria-current` from the URL hash instead of leaving Sync permanently current. `tests/e2e/specs/web-admin.spec.ts` pins fixture/live table metadata, hash-aware navigation current state, and the `403 admin_forbidden` authentication-required axe gate; `docs/qa-checklist.md` documents the expanded table, navigation, and 401/403 axe coverage.
- Verification for this Web Admin table/navigation/403 axe slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|shows role, audit|loads a live admin snapshot|surfaces auth, empty|keeps navigation usable"` (10/10), full `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.

- Web Admin role-permission a11y hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now gives each role-permission `listitem` an accessible name composed from the visible role name, localized scope, member count, and risk badge via `aria-labelledby`. `tests/e2e/specs/web-admin.spec.ts` pins Workspace Admin and Operator role items by their composed accessible names across desktop and mobile Web Admin projects; `docs/qa-checklist.md` documents role-permission item-name coverage.
- Verification for this Web Admin role-permission item-name slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, and focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "shows role, audit"` (2/2) pass.

- Web Admin table semantics hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now exposes member and managed-device ARIA table row/column counts plus row/column indexes, and `apps/web/src/styles.css` keeps mobile table headers visually collapsed without removing their `columnheader` semantics from the accessibility tree. `tests/e2e/specs/web-admin.spec.ts` pins the table dimension metadata and header/cell indexes across desktop and mobile Web Admin projects; `docs/qa-checklist.md` documents the table metadata and mobile-header a11y coverage.
- Verification for this Web Admin table-metadata/mobile-header slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, and focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|shows role, audit"` (4/4) pass. Cleanup stopped stale Playwright/Vite/esbuild children left by the fresh-port run and a final process scan found no workspace processes in `C:\Tools\agenttool`.

- Web Admin metric semantics hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now exposes the dashboard metric strip as a named `list`, and each metric card as a `listitem` while preserving the label-plus-value accessible name. `tests/e2e/specs/web-admin.spec.ts` pins the named metric list, four metric listitems, and the existing metric accessible names across desktop and mobile Web Admin projects; `docs/qa-checklist.md` documents metric list/listitem semantics.
- Verification for this Web Admin metric-list semantics slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, and focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard"` (2/2) pass.

- Web Admin live audit/non-ready axe QA continued under the active Web admin lane: `tests/e2e/specs/web-admin.spec.ts` now verifies live snapshot audit events through the named `Recent audit events` list and a live `listitem` count, and runs the existing critical/serious axe gate against both empty and unavailable live snapshot states in addition to the populated dashboard and authentication-required state. `docs/qa-checklist.md` now documents live audit-event list semantics and non-ready axe coverage.
- Verification for this Web Admin live audit/non-ready axe slice is green: `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "loads a live admin snapshot|surfaces auth, empty"` (4/4), and full `npm run test:web:fresh -w @atlasterm/e2e` (35/35) all pass.

- Current controller safe-dispatch guard continued: `scripts/check-handoff-hygiene.mjs` now rejects additional broad write-scope aliases in the safe dispatch queue, including `repository-wide`, `workspace-wide`, `monorepo-wide`, `codebase-wide`, `all source`, `all packages`, and unbounded/any-workspace wording. `scripts/check-handoff-hygiene.test.mjs` pins repository-wide and all-source regressions, and `docs/qa-checklist.md` documents the expanded safe-dispatch alias coverage.
- Verification for this safe-dispatch guard is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, and `node --test scripts/check-handoff-hygiene.test.mjs` (114/114) pass.
- Team-mode Web Admin QA pass continued with parallel read-only reviews while the active lane remains Web admin: `apps/web/src/WebErrorBoundary.test.tsx` now covers the real React render-error capture path from a throwing child through the fatal fallback and monitor reporter calls; `tests/e2e/specs/web-admin.spec.ts` now drives the fatal crash path through English and Simplified Chinese, pins localized reload focus, and rejects leaked English fallback copy in the localized fatal path. The controller cleanup/docs carve-out also synchronizes current Web-only fresh E2E evidence to 35/35, root E2E evidence to 73/73 in `scripts/check-handoff-hygiene.mjs`, `scripts/check-handoff-hygiene.test.mjs`, `docs/qa-checklist.md`, and this handoff.
- Verification for this team-mode Web Admin/count-sync pass is green: `npm run typecheck:e2e`, `npm run typecheck:web`, `npm run test:web -- WebErrorBoundary` (4/4), focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "fatal render errors"` (2/2), full `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `npm run qa:e2e:fresh` (73/73), `npm run qa:e2e` (73/73), `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup removed 2 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.

- Current controller count-drift guard continued: `scripts/check-handoff-hygiene.mjs` now checks every active-section handoff-hygiene command count for both direct `node --test scripts/check-handoff-hygiene.test.mjs` evidence and `npm run qa:handoff-hygiene` live-scan evidence, rather than only the first direct self-test count. `scripts/check-handoff-hygiene.test.mjs` adds coverage for stale live-scan command counts so future top-section evidence cannot mix older lower handoff-hygiene results with current controller output.
- Verification for this count-drift guard is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, and `node --test scripts/check-handoff-hygiene.test.mjs` (114/114) pass.
- Current controller QA carve-out continued without changing Web admin lane ownership: `scripts/check-handoff-hygiene.mjs` now centralizes disallowed terminology detection and rejects Simplified/Traditional Chinese variants with optional CJK spacing in both active handoff text and protected-root terminal-safety lines. `scripts/check-handoff-hygiene.test.mjs` pins active and protected-root CJK variants, and `docs/qa-checklist.md` documents the expanded coverage.
- Verification for this controller QA carve-out is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Process scan found no workspace Playwright/Vite/Expo/static-server processes in `C:\Tools\agenttool`; unrelated QA remains isolated under `C:\code`.
- Web Admin refresh-control a11y hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now keeps the refresh button accessible name stable while exposing `aria-busy`, a hidden loading description, and the existing main-content busy state during live snapshot loading; `apps/web/src/styles.css` adds a reusable visually-hidden utility and reduced-motion-safe refresh spinner; `tests/e2e/specs/web-admin.spec.ts` pins the loading status panel, refresh-control busy/description attributes, and cleanup after the newer live snapshot renders.
- Web Admin navigation a11y hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now exposes the current Sync navigation item with `aria-current="page"` instead of relying only on visual `.active` styling, while `tests/e2e/specs/web-admin.spec.ts` pins the current-state semantics across desktop, mobile, and strict zh-CN localization paths. `docs/qa-checklist.md` documents active navigation current-state coverage.
- Verification for this Web Admin navigation-current slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|keeps navigation usable|strict core localization"` (6/6), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Web Admin language and role-permission a11y hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now associates the language selector with its current-language hint via `aria-describedby`, and the role permissions panel exposes its role cards as a named list/listitem set instead of a visually grouped `div` only. `tests/e2e/specs/web-admin.spec.ts` pins the described-by relationship across the blocked-storage language-switch flow and the role-permission list semantics in both Web Admin projects; `docs/qa-checklist.md` documents both coverage points.
- Verification for this Web Admin language/role semantics slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "shows role, audit|language storage|strict core localization"` (6/6), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Web Admin metric a11y hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now labels each dashboard metric card from its visible label and formatted value via `aria-labelledby`, so assistive technology gets both the metric name and current number without duplicating hidden copy. `tests/e2e/specs/web-admin.spec.ts` pins the accessible names for fixture metrics across desktop and mobile Web Admin projects, and `docs/qa-checklist.md` documents metric-name coverage.
- Verification for this Web Admin metric accessible-name slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard"` (2/2), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Web Admin navigation landmark hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now labels the navigation landmark with the existing localized `web.adminNavigation` copy instead of relying only on the surrounding sidebar label, and `tests/e2e/specs/web-admin.spec.ts` pins the `JoeSSH admin navigation` landmark in both the fixture dashboard and mobile navigation coverage. `docs/qa-checklist.md` documents navigation-landmark naming coverage.
- Verification for this Web Admin navigation-landmark slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|keeps navigation usable"` (4/4), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Web Admin non-ready state a11y hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now announces unavailable/error snapshot panels as `role="alert"` with `aria-live="assertive"` while authentication-required, empty, and loading panels remain `role="status"` with `aria-live="polite"`. `tests/e2e/specs/web-admin.spec.ts` pins the unavailable alert role, assertive live mode, and focus handoff while preserving the polite status assertions for auth, empty, and loading panels; `docs/qa-checklist.md` documents the split semantics.
- Verification for this Web Admin non-ready state semantics slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "surfaces auth, empty, malformed"` (2/2), focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "aborts stale live admin snapshot refreshes"` (2/2), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Web Admin authentication-state semantics hardening continued under the active Web admin lane: `tests/e2e/specs/web-admin.spec.ts` now pins both `401` login-required and `403 admin_forbidden` live snapshot responses to the same authentication-required status panel semantics, including `role="status"`, `aria-live="polite"`, and focus handoff before any sync data is shown. `docs/qa-checklist.md` documents the 401/403 authentication status semantics coverage.
- Verification for this Web Admin authentication-state semantics slice is green: `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "surfaces auth, empty, malformed"` (2/2), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Web Admin authentication recovery semantics hardening continued under the active Web admin lane: `tests/e2e/specs/web-admin.spec.ts` now also pins the live recovery path so the initial `401` panel and the later refresh-triggered `403 admin_forbidden` panel both retain `role="status"`, `aria-live="polite"`, and focus handoff while the post-403 assertions continue to prove previously rendered live sync data is cleared. `docs/qa-checklist.md` documents the recovery-path status semantics and clear-data coverage together.
- Verification for this Web Admin authentication recovery semantics slice is green: `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "recovers a live admin snapshot"` (2/2), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Web Admin localized non-ready semantics hardening continued under the active Web admin lane: `tests/e2e/specs/web-admin.spec.ts` now pins the Simplified Chinese empty snapshot status panel to the same `role="status"`, `aria-live="polite"`, and focus handoff semantics as the English empty path while still rejecting leaked English empty-state copy. `docs/qa-checklist.md` documents localized non-ready status semantics coverage.
- Verification for this Web Admin localized non-ready semantics slice is green: `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "keeps admin state chrome localized"` (2/2), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Web Admin fatal error-boundary hardening continued under the active Web admin lane: the root Web fatal fallback is now `apps/web/src/WebErrorBoundary.tsx`, requires localized title/reload labels instead of carrying hardcoded English fallback copy in `main.tsx`, keeps the existing error-monitor breadcrumb/report path, and renders fatal crashes as an atomic `role="alert"` / `aria-live="assertive"` panel with a localized reload action. `apps/web/src/WebErrorBoundary.test.tsx` pins healthy children rendering, localized fatal alert anatomy, `aria-atomic="true"`, absence of English fallback copy, and monitor reporting.
- Verification for this Web Admin fatal error-boundary slice is green: `npm run test:web -- WebErrorBoundary` (4/4), `npm run typecheck:web`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "fatal render errors"` (2/2), `npm run typecheck:e2e`, `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Web Admin localized fatal error-boundary QA continued under the active Web admin lane: `apps/web/src/WebErrorBoundary.test.tsx` now covers the real React render-error capture path from a throwing child through the boundary fallback and monitor reporter calls, while `tests/e2e/specs/web-admin.spec.ts` drives the same forced fatal render crash through both English and Simplified Chinese routes, preserving `alert` / `assertive` / atomic semantics while pinning localized zh-CN fatal title and reload focus and rejecting leaked English fallback copy in the localized fatal path.
- Web Admin region semantics hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now names the skip-link target workspace from the visible `Team operations` heading and names the Members, Roles, Device status, and Audit log panels from their visible headings. The recent audit events collection remains a named list and `tests/e2e/specs/web-admin.spec.ts` now pins the workspace region focus target, panel region lookup, and audit list/listitem semantics; `docs/qa-checklist.md` documents the main content, panel region, and audit-event list coverage.
- Verification for this Web Admin region/list semantics slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "renders team operations dashboard|shows role, audit|moves keyboard focus"` (6/6), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Full fresh E2E stabilization also closed a desktop shortcut timing race found during final verification: `tests/e2e/specs/desktop-workbench.spec.ts` now retries the synthetic `Ctrl+Shift+T` theme shortcut until the expected `data-theme` state is observed, matching the existing quick-connect shortcut helper and preserving fresh-port listener-mount resilience.
- Controller cleanup/docs guard hardening continued as a serialized carve-out while the Web admin lane remains active: `scripts/check-handoff-hygiene.mjs` now anchors safe-dispatch and active-lane headings, rejects broader write-scope aliases such as repo-wide/all paths/full tree, catches lowercase and punctuation-separated task-card IDs without hiding bad cards on historical audit lines, expands protected-root terminology detection, and rejects non-current root E2E, Web Admin `qa:web`, `adminData`, Web-only prose, and stale `TerminalPane.browser.test.tsx` count evidence. `scripts/check-handoff-hygiene.test.mjs` adds fixture coverage for those guard gaps, and `HANDOFF.md` updates the current TerminalPane browser evidence to 61/61.
- Controller guard follow-up closed the remaining low-risk audit gaps: the required safe-dispatch heading is line-anchored, the non-ledger active-lane helper ignores prose ledger phrases, task-card separator detection rejects colon and parenthesized variants, stale TerminalPane focused counts reject any non-61/61 active evidence, and stale count evidence is allowed only in historical sections below the first separator.
- Verification for this controller guard follow-up is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Verification for this team-mode pass is green: `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "stale live admin snapshot refreshes"` (2/2), focused `npm run test:fresh -w @atlasterm/e2e -- --project=desktop-workbench --grep "toggles theme with keyboard shortcut"` (1/1), `npm run test -w @atlasterm/desktop -- TerminalPane.browser.test.tsx` (61/61), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), full `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, `npm run qa:e2e:fresh` (73/73), and `npm run qa:e2e` (73/73) all pass. Latest cleanup removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Web Admin a11y/storage hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now makes the skip-link target focusable and hides stable English fallback text from the accessibility tree, while `apps/web/src/localization.ts` tolerates blocked `localStorage` reads/writes so the admin console still loads and in-memory language changes still apply. `apps/web/src/localization.test.ts` pins storage read/write failures, and `tests/e2e/specs/web-admin.spec.ts` verifies skip-link focus transfer, blocked-storage language switching without page errors, and localized stable text without English fallback names in the accessibility tree.
- Verification for this Web Admin a11y/storage slice is green: `npm run test:web -- localization main` (57/57), `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "skip link|language storage|strict core localization"` (6/6), full `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), and `npm run qa:e2e` (73/73) all pass. Latest cleanup removed 2 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Web Admin stale-refresh abort hardening continued under the active Web admin lane: `apps/web/src/main.tsx` now aborts any in-flight live admin snapshot refresh before starting a newer one and aborts the outstanding request on unmount, while `apps/web/src/adminData.ts` accepts a caller `AbortSignal`, short-circuits pre-aborted caller signals before fetch, keeps caller abort ahead of already resolved non-OK responses, bridges abort into the existing bounded request/body-read timeout, checks abort again before queued `response.json()` work begins, and cancels pending response bodies where the runtime exposes a cancellable body. `apps/web/src/adminData.test.ts` pins caller-signal cancellation during request wait, pre-aborted calls, resolved-response races, queued JSON-start aborts, and JSON body-read wait; `tests/e2e/specs/web-admin.spec.ts` verifies stale live refreshes and stale live body reads are aborted before newer data renders in both desktop and mobile Web Admin projects.
- Verification for this Web Admin stale-refresh abort slice is green: `npm run test:web -- adminData` (30/30), `npm run test:web -- adminData csp` (38/38), `npm run typecheck:web`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "stale live admin snapshot"` (4/4), full `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run qa:e2e` (73/73), and `npm run qa:e2e:fresh` (73/73) all pass.
- Current E2E stabilization pass kept root QA reliable after the new Web Admin body-read coverage exposed a desktop shortcut timing race: `tests/e2e/specs/desktop-workbench.spec.ts` now dispatches app-level quick-connect shortcuts through a helper that retries across transient navigation-context replacement and waits until the command palette input is actually visible, covering listener-mount delay on fresh ports without changing the product code; the theme-toggle and right-panel shortcut assertions now share the same synthetic shortcut helper with explicit key code and `metaKey: false`.
- Current team-mode doc-sync pass kept the active lane on Web admin while closing the stale-refresh abort/body-read evidence into `HANDOFF.md`, `apps/web/README.md`, and `docs/qa-checklist.md`; the safe dispatch queue and active lane ledger remain unchanged except for Web admin ownership of stale live refresh abort coverage.
- Verification for this controller pass is green: `npm run test:web -- adminData` (30/30), `npm run test:web -- adminData csp` (38/38), `npm run typecheck:web`, `npm run typecheck:e2e`, focused stale Web Admin E2E (4/4), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), full Web-only fresh E2E (35/35), focused desktop shortcut fresh E2E (3/3), `npm run qa:e2e` (73/73), `npm run qa:e2e:fresh` (73/73), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, and root `npm run test` (error-monitor 85/85, i18n 50/50, UI 13/13, desktop 517/517, web 160/160, mobile 41/41 with coverage) all pass. Latest cleanup removed 2 `%TEMP%\joessh-e2e-mobile-web-*` directories, left 0 remaining, and found no workspace Playwright/Vite/Expo/static-server processes.
- Web Admin a11y QA continued under the active Web admin lane: `tests/e2e/specs/web-admin.spec.ts` now runs `@axe-core/playwright` against both the fixture dashboard and live authentication-required state, on the desktop and mobile Web Admin projects, and fails on critical or serious WCAG 2/2.1 A/AA violations. `apps/web/src/styles.css` darkens the light-theme accent to keep the `Admin Console` eyebrow above the AA contrast threshold, and `scripts/check-handoff-hygiene.mjs` plus `scripts/check-handoff-hygiene.test.mjs` now require the current 73/73 full-root E2E evidence and reject stale lower-count E2E evidence.
- Verification for this Web Admin a11y slice is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run typecheck:e2e`, `npm run lint`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --project=web-admin-mobile --grep "critical or serious a11y"` (2/2), full `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), and `npm run qa:e2e` (73/73) all pass.
- Web Admin configured snapshot URL normalization continued under the active Web admin lane: `apps/web/src/adminData.ts` now trims `VITE_ATLASTERM_ADMIN_SNAPSHOT_URL` and falls back to `/api/admin/snapshot` when the variable is unset or blank, matching the existing bearer-token normalization and preventing an empty endpoint configuration from fetching the current page before failing at JSON/shape validation. `apps/web/src/adminData.test.ts` pins the blank-env fallback in the existing default URL test.
- Verification for this Web Admin endpoint-config slice is green: `npm run test:web -- adminData csp` (38/38), `npm run typecheck:web`, and `npm run lint` all pass.
- Current controller terminology pass continued under team-mode control: the active handoff hygiene guard now rejects disallowed English and Chinese terminology variants, plus hyphenated forms outside CORS/origin context, while preserving legitimate Sync CORS origin `allowlist` wording. The active-section mojibake guard's fingerprint regex and the Chinese terminology fixture now use source-level ASCII Unicode escapes so the guard itself cannot be corrupted by console/codepage drift. `scripts/check-handoff-hygiene.test.mjs` adds the new terminology variants in the live-section fixture path.
- Verification for this terminology/guard-normalization pass is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories and found no workspace Playwright/Vite/Expo/static-server processes.
- Current controller hygiene pass continued in team mode: a read-only subagent audited the active handoff for display-encoding drift, and the controller verified the cited Chinese runtime strings are valid UTF-8 in the file. To prevent future active-section corruption, `scripts/check-handoff-hygiene.mjs` now scans only the active top section for high-confidence mojibake/replacement-character fingerprints, and `scripts/check-handoff-hygiene.test.mjs` adds live-section and QA-checklist omission regressions.
- Verification for this active-section mojibake guard pass is green: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories and found no workspace Playwright/Vite/Expo/static-server processes.
- Current team-mode controller pass continued without reviving archived work: two read-only subagent audits confirmed the active handoff invariants and Web Admin record-ID coverage, while the controller kept edits local to the handoff guard/docs. `scripts/check-handoff-hygiene.mjs` now also rejects spaced task-card IDs, requires active handoff evidence for leading/trailing-whitespace Web Admin record-ID rejection, and rejects stale active adminData test-count evidence in favor of the current 29/29 count. `scripts/check-handoff-hygiene.test.mjs`, `HANDOFF.md`, and `docs/qa-checklist.md` were updated in lockstep.
- Verification for this team-mode controller pass is green: `npm run test:web -- adminData` (30/30), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), and `npm run lint` all pass. Cleanup scan removed 0 `%TEMP%\joessh-e2e-mobile-web-*` directories and found no workspace Playwright/Vite/Expo/static-server processes.
- Current controller takeover continued without reviving old work: multi-agent explorer dispatch for handoff hygiene, Web QA, and QA-risk lanes hit tool-side authorization failures before producing usable reports, so the controller kept the work local. The leftover `%TEMP%\joessh-e2e-mobile-web-*` static export directories were safely filtered and removed (8 removed, 0 remaining).
- Web Admin auth-state coverage continued under the active Web admin lane: `apps/web/src/adminData.test.ts` now pins a `403` `{ code: "admin_forbidden" }` snapshot response to the existing `auth_required` data error, and `tests/e2e/specs/web-admin.spec.ts` now exercises the same `403 admin_forbidden` response in the live snapshot state-flow before the empty, malformed, and unavailable branches. This extends the existing state-flow E2E without changing the durable Web Admin E2E test count.
- Verification for this Web Admin 403 slice is green: `npm run typecheck:web`, `npm run test:web -- adminData` (30/30), `npm run typecheck:e2e`, `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `npm run qa:handoff-hygiene` (114/114 plus live scan), `npm run lint`, and `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI) all pass. Final cleanup checks found no listeners on the default or fresh E2E ports, no remaining `%TEMP%\joessh-e2e-mobile-web-*` directories, and no leftover Playwright/Vite/Expo/static-server processes beyond the scanner command itself.
- Web Admin hung-response hardening continued under the active Web admin lane: `apps/web/src/adminData.ts` now keeps the same 8 second admin snapshot request budget active through `response.json()` parsing, so a server that sends headers but stalls the JSON body cannot leave the admin console in the loading state indefinitely. `apps/web/src/adminData.test.ts` replaced a duplicated fetch-timeout case with a body-stall timeout regression test and keeps malformed JSON classified separately from aborted body reads.
- Verification for this Web Admin hung-response slice is green: `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run typecheck:e2e`, `npm run lint`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --grep "live admin snapshot|auth, empty, malformed|recovers a live admin snapshot"` (3/3), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), and full `npm run test:web:fresh -w @atlasterm/e2e` (35/35) all pass.
- Web Admin live time rendering hardening continued under the active Web admin lane: `apps/web/src/helpers.ts` now formats only valid `HH:MM` clock strings and ISO/RFC3339-shaped timestamps for audit/event and device last-seen surfaces, returns invalid clock strings without JavaScript date rollover, and preserves malformed dynamic timestamp strings instead of throwing through the React ErrorBoundary. The audit log now uses `getClockDateTime(...)` so malformed audit `time` values stay visible as raw text but do not populate an invalid `<time datetime>` machine-readable attribute. `apps/web/src/helpers.test.ts`, `apps/web/src/main.test.ts`, and `tests/e2e/specs/web-admin.spec.ts` cover malformed live `lastSeen` and audit `time` values rendering as visible raw data while the live dashboard stays usable.
- Verification for this Web Admin live time-rendering slice is green: focused `npm run test:web -- helpers main` (87/87), `npm run typecheck:web`, `npm run lint`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --grep "loads a live admin snapshot"` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), and full `npm run test:web:fresh -w @atlasterm/e2e` (35/35) all pass.
- Web Admin snapshot counter validation continued under the active Web admin lane: `apps/web/src/adminData.ts` now accepts only non-negative safe integers for metrics, member device counts, and role member counts, matching the Sync service's `usize` admin snapshot fields instead of trusting arbitrary finite numbers. `apps/web/src/adminData.test.ts` rejects negative and fractional counters before render code can consume them, and `tests/e2e/specs/web-admin.spec.ts` verifies a negative live `activeMembers` value routes to the `Snapshot unavailable` state instead of rendering trusted dashboard metrics.
- Verification for this Web Admin snapshot counter-validation slice is green: `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run lint`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --grep "surfaces auth, empty, malformed"` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run test:web:fresh -w @atlasterm/e2e` (35/35), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin snapshot list identity validation continued under the active Web admin lane: `apps/web/src/adminData.ts` now rejects blank/whitespace-only `id` values, record IDs with leading or trailing whitespace, and duplicate trim-equivalent `id` values within each admin snapshot list (`auditEvents`, `devices`, `members`, and `roles`) before React render code can use those IDs as list keys. `apps/web/src/adminData.test.ts` covers duplicate IDs, whitespace-equivalent duplicates, blank IDs, and padded IDs across the four lists, and `tests/e2e/specs/web-admin.spec.ts` verifies a live duplicate device ID routes to the `Snapshot unavailable` state instead of rendering a keyed device table with ambiguous row identity.
- Verification for this Web Admin snapshot identity-validation slice is green: `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run lint`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --grep "surfaces auth, empty, malformed"` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run test:web:fresh -w @atlasterm/e2e` (35/35), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin snapshot display-field validation continued under the active Web admin lane: `apps/web/src/adminData.ts` now requires all required UI display strings to be nonblank after trimming, including device cursor/lastSeen/name/owner/platform, audit action/actor/target/time, member email/name/role, and role name/scope. This preserves long cursor compatibility while preventing blank trusted values from rendering in dashboard tables and audit rows. `apps/web/src/adminData.test.ts` covers blank fields across the four snapshot surfaces, and `tests/e2e/specs/web-admin.spec.ts` verifies a blank live device cursor routes to `Snapshot unavailable` instead of rendering a managed-device table with empty trusted data.
- Verification for this Web Admin snapshot display-field validation slice is green: `npm run test:web -- adminData` (30/30), `npm run typecheck:web`, `npm run lint`, `npm run typecheck:e2e`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-chromium --grep "surfaces auth, empty, malformed"` (1/1), `npm run qa:web` (Web typecheck, 160/160 Web tests, production build + SRI), `npm run test:web:fresh -w @atlasterm/e2e` (35/35), and `npm run qa:handoff-hygiene` (114/114 plus live scan) all pass.
- Web Admin long-value readability continued under the active Web admin lane: `apps/web/src/styles.css` now keeps table grid tracks shrinkable with `minmax(0, ...)` and lets cells wrap long unbroken values with `overflow-wrap: anywhere`, so live device names and sync cursors cannot force document-level horizontal overflow. `tests/e2e/specs/web-admin.spec.ts` now injects a long real-shaped device name plus cursor into the live snapshot flow and reuses the shared `expectNoDocumentOverflow` guard, covering both desktop and mobile Web Admin projects without increasing the durable E2E test count.
- Verification for this Web Admin long-value slice is green: `npm run typecheck:e2e`, `npm run lint`, and `npm run test:web:fresh -w @atlasterm/e2e` (35/35) all pass.
- Web Admin authorization-expiry isolation continued under the active Web admin lane: the live snapshot recovery E2E now covers `401` missing auth, successful live recovery, and then a `403 admin_forbidden` refresh in the same browser flow. After the forbidden refresh, the test asserts the auth-required state is visible and the prior `Live snapshot`, long cursor, and managed-device table are gone, pinning that expired authorization cannot leave previously fetched sync data on screen.
- Verification for this Web Admin authorization-expiry slice is green: `npm run typecheck:e2e`, `npm run lint`, and `npm run test:web:fresh -w @atlasterm/e2e` (35/35) all pass.
- Web Admin mobile table readability continued under the active Web admin lane: `apps/web/src/main.tsx` now attaches localized `data-label` field names to member/device table cells, and `apps/web/src/styles.css` renders those labels as compact uppercase prefixes only in the narrow single-column table layout. `tests/e2e/specs/web-admin.spec.ts` verifies the mobile Web Admin project renders the English `Member`/`Cursor` pseudo-labels and the Arabic RTL member/cursor pseudo-labels through computed `::before` content, so hidden headers no longer leave stacked values without localized field context.
- Verification for this Web Admin mobile table-label slice is green: `npm run typecheck:web`, `npm run typecheck:e2e`, `npm run lint`, focused `npm run test:web:fresh -w @atlasterm/e2e -- --project=web-admin-mobile --grep "keeps navigation usable"` (1/1), and `npm run test:web:fresh -w @atlasterm/e2e` (35/35) all pass.
- Web Admin scripted visual baselines were refreshed after the mobile field-label layout change: the actual mobile zh-CN screenshot was inspected for readable collapsed table labels and no overflow, `npm run test:visual:fresh -w @atlasterm/e2e -- --project=web-admin-visual-mobile --grep "web admin visual" --update-snapshots` regenerated the Web Admin mobile zh-CN/en baselines at `390x5044`, and `npm run qa:e2e:visual:fresh` passes (5 passed, 10 expected project skips).
- Cleanup after the Web Admin visual refresh is current: three `%TEMP%\joessh-e2e-mobile-web-*` directories were safely filtered and removed, leaving 0 remaining; process scan found no Playwright/Vite/Expo/static-server command lines tied to `C:\Tools\agenttool`. Ports `5173` and `5174` are already occupied by external local Vite pages titled `Concord Agents`, which is not present in this workspace, so they were left untouched rather than mistaken for JoeSSH E2E leftovers.
- Product-facing desktop polish from the prior Desktop UX/a11y lane: SFTP file-size fallbacks no longer render a bare `-` for live directory entries or static fallback rows. `apps/desktop/src/panels.tsx` now uses the existing localized `desktop.notAvailable` copy for unknown/null SFTP sizes, and `apps/desktop/src/panels.test.tsx` pins both static and live-directory fallback branches so they do not regress to raw punctuation.
- Product-facing brand cleanup continued: the user-visible settings export download now writes `joessh-connections.json` instead of the old `atlasterm-connections.json`, while preserving internal package names and `atlasterm.*` persistence keys as compatibility state. `apps/desktop/src/panels.test.tsx` captures the generated anchor filename during export to keep this product-facing surface on the JoeSSH brand.
- QA infra hardening from an earlier controller pass: `package.json` now aligns the `size-limit` aggregate desktop budget with `scripts/check-bundle-size.mjs` by excluding the lazy `apps/desktop/dist/assets/xterm-*.js` vendor chunk from the startup-path aggregate while still keeping the explicit 250KB per-chunk checker and its on-demand skip annotation. This fixes the previous root QA contradiction where the custom chunk gate passed but `size-limit` failed by counting the lazy xterm vendor chunk in the desktop startup total.
- Verification for this SFTP fallback/export-brand slice is green: `npm run test -w @atlasterm/desktop -- panels.test.tsx` (30/30), `npm run typecheck:desktop`, `npm run test:i18n` (50/50), `npm run lint`, `npm run qa:i18n-release` (1/1), `npm run qa:desktop` (i18n/ui/desktop typechecks, i18n 50/50, UI 13/13, desktop 517/517, desktop production build + SRI), `npm run qa:sync-api-docs` (69 checks), a focused scan for `atlasterm-connections` across app/package/test/docs scopes returned no matches, and `npm run qa:handoff-hygiene` passed with `node:test` self-tests (114/114) plus the live handoff scan.
- Verification for the bundle-size QA alignment is green: `npm run qa:subresource-integrity`, `npm run qa:security-headers`, and `npm run qa:bundle-size` all pass. The final `size-limit` desktop aggregate now reports `190.87 kB` gzipped against the `250 kB` budget after excluding the lazy xterm chunk, while `scripts/check-bundle-size.mjs` still prints the explicit `SKIP ... xterm-*.js ... lazy vendor chunk, exempt from startup budget` line.
- Wider controller verification is green after this pass: root `npm run typecheck`, root `npm run test` (error-monitor 85/85, i18n 50/50, UI 13/13, desktop 517/517, web 160/160, mobile 41/41 with coverage), `npm run qa:web`, `npm run qa:mobile`, root `npm run build`, final-production `npm run qa:subresource-integrity`, final-production `npm run qa:security-headers`, final-production `npm run qa:bundle-size`, and `npm run lint` all pass on the current workspace state.
- Desktop E2E stabilization continued: `tests/e2e/specs/desktop-workbench.spec.ts` now scopes the Team Access summary assertion to the `.team-summary` region instead of the status-bar button with the same accessible label, and scopes the blocked-command assertion to `#terminal-command-feedback` instead of all alert roles, because the polished toast layer also exposes an error alert. Focused rerun for the two formerly failing tests passed (2/2), and full desktop E2E on a temporary Vite server passed `36/36` across `desktop-workbench` and `desktop-accessibility`; `tests/e2e/test-results/.last-run.json` is back to `passed`.
- QA infra hardening from an earlier controller lane: full E2E no longer depends on two long-running Expo/Metro dev servers for mobile companion smoke coverage. `tests/e2e/scripts/mobile-static-web-server.mjs` now exports the offline and live `apps/mobile` Expo Web bundles into temporary directories and serves them from one local Node static server on the configured mobile ports, keeping the live bundle wired to the mock mobile Sync API. `tests/e2e/playwright.config.ts` and `tests/e2e/playwright.visual.config.ts` now point mobile projects at `127.0.0.1` static mobile web server URLs instead of `localhost` Expo dev-server readiness, avoiding the Windows IPv4/IPv6 and Metro `Waiting on http://localhost:<port>` dead-end found during diagnosis.
- Web E2E lane isolation continued: `tests/e2e/playwright.web.config.ts` starts only the admin snapshot mock plus the two Web Admin Vite servers, and `tests/e2e/package.json` now exposes `test:web` / `test:web:fresh` through that config so Web Admin QA is independent from desktop and mobile startup. `tests/e2e/specs/desktop-workbench.spec.ts` also scopes command-palette assertions to the accessible dialog/combobox instead of the English placeholder, preserving localized UI compatibility while keeping the Enter-to-activate flow covered.
- Verification for the E2E QA infra slice is green: `node --check tests/e2e/scripts/mobile-static-web-server.mjs`, `npm run typecheck:e2e`, `npm run lint`, `npm run test:fresh -w @atlasterm/e2e -- --project=mobile-companion-web --project=mobile-companion-live-web` (4/4), `npm run test:web:fresh -w @atlasterm/e2e` (35/35), `npm run qa:e2e:fresh` (73/73), `npm run qa:e2e` (73/73), and `npm run qa:e2e:visual:fresh` (5 passed, 10 expected project skips) all pass. The scripted visual snapshots under `tests/e2e/specs/visual-qa.spec.ts-snapshots/` were regenerated through Playwright after actual screenshots were inspected for correct desktop/web/mobile pages, localized copy, and no overflow regressions.
- Controller handoff hygiene guardrails were updated to current evidence: `scripts/check-handoff-hygiene.mjs` now requires the active handoff to state that full root `npm run qa:e2e` passes 73/73 and records the static mobile web server path, and rejects reintroducing the old active Windows full-root E2E timeout caveat. `scripts/check-handoff-hygiene.test.mjs` adds fixture coverage for that stale caveat rejection; `tests/e2e/README.md` and `docs/qa-checklist.md` document the static mobile web server model plus the isolated Web Admin config.
- Product-facing desktop metadata polish continued: the desktop PWA/install manifest and HTML/social description surface now have localized coverage instead of only static English copy. `apps/desktop/public/manifest.json` keeps English fallback values but now declares `lang`/`dir`, localized `description_localized`, and localized `name_localized` / `short_name_localized` maps for the five install shortcuts across all 15 advertised locales, including RTL metadata for Arabic. `apps/desktop/src/desktopManifest.ts` centralizes the runtime manifest/meta copy shape, and `apps/desktop/src/main.tsx` applies the active locale's `desktop.manifestDescription` to the document, Open Graph, and Twitter description meta tags after locale load while leaving the static `/manifest.json` link intact for CSP-safe PWA discovery.
- Verification for the desktop manifest/meta localization slice is green: `node -e "const fs=require('fs'); const m=JSON.parse(fs.readFileSync('apps/desktop/public/manifest.json','utf8')); console.log(m.shortcuts.length, Object.keys(m.description_localized).length)"` returned `5 15`, `npm run test -w @atlasterm/desktop -- desktopManifest.test.ts main.test.tsx` (7/7), `npm run test:i18n` (50/50), `npm run typecheck:desktop`, `npm run typecheck:i18n`, `npm run qa:i18n-release` (1/1), `rg -n "\?" packages\i18n\src\locales -g "*.ts"` returned no matches, `npm run test:desktop` (517/517), `npm run lint`, `npm run build:desktop`, and a dist manifest check confirmed 5 shortcuts, 15 localized description entries, and Arabic `dir: "rtl"`.
- Product-facing desktop polish continued: the right-panel SFTP tab and the SFTP panel header badge no longer render raw hardcoded `"SFTP"` labels in React UI. `apps/desktop/src/main.tsx` now feeds the segment label through `t("desktop.sftp")`, `apps/desktop/src/panels.tsx` renders the badge through the same key, and all 15 locale packs under `packages/i18n/src/locales/*` include `desktop.sftp` with the protocol acronym preserved as `SFTP`. `apps/desktop/src/main.test.tsx` guards against regressing to `label: "SFTP"`, and `apps/desktop/src/panels.test.tsx` pins the SFTP panel badge to translator output.
- Verification for the SFTP short-label localization slice is green: `npm run test -w @atlasterm/desktop -- panels.test.tsx main.test.tsx` (34/34), `npm run typecheck:desktop`, `npm run test:i18n` (50/50), `npm run typecheck:i18n`, `npm run qa:i18n-release` (1/1), `rg -n "\?" packages\i18n\src\locales -g "*.ts"` returned no matches, `npm run test:desktop` (514/514), `npm run lint`, and focused static scans for `label: "SFTP"` / `>SFTP</Badge>` in `apps/desktop/src` returned no matches. The static PWA manifest shortcut still contains `SFTP` as a protocol acronym in JSON and is a separate manifest-localization surface rather than a React translator boundary.
- Product-facing desktop E2E coverage continued: the Team Access review flow now has a dedicated Simplified Chinese path in `tests/e2e/specs/desktop-workbench.spec.ts`, covering `/?lang=zh-CN`, exact Chinese tab/button/region/status labels, keyboard activation of review/approve, approved status text, localized team summary, localized audit event, and the `maya.rao / prod-edge-01` request row. The adjacent English review E2E now expects the shipped localized `Approved` status label and scopes the summary assertion to the `.team-summary` panel region, avoiding the status-bar action with the same accessible label.
- Verification for the Team Access zh-CN E2E slice is green: `npm run typecheck:e2e` and `npm run qa:e2e:fresh -- --project=desktop-workbench --grep "team access request"` (2/2). The first attempted `playwright.desktop.config.ts` run was discarded because that desktop-only config does not start a webServer on this host; the standard Playwright config with fresh ports starts the desktop server and passes the focused review flow.
- Product-facing desktop polish continued: the locked/MFA connection latency slot no longer uses raw `latencyLabel: "MFA"` from the built-in demo connection data. `apps/desktop/src/main.tsx` now stores `latencyLabelKey: "desktop.mfaRequiredShort"` for `db-replica-03`, while `apps/desktop/src/Sidebar.tsx` and `apps/desktop/src/StatusBar.tsx` render `latencyMs -> latencyLabelKey -> latencyLabel -> desktop.notAvailable` so numeric latency remains first, built-in MFA copy is localized, and imported/custom plain-text latency labels remain supported. All 15 locale packs include `desktop.mfaRequiredShort`, and the existing terminal-session MFA sentence remains on `desktop.terminalSessionMfaRequired` rather than reusing the short status label.
- Verification for the MFA short-label dataization slice is green: `npm run test -w @atlasterm/desktop -- Sidebar.test.tsx StatusBar.test.tsx main.test.tsx` (37/37), `npm run typecheck:desktop`, `npm run test:i18n` (50/50), `npm run typecheck:i18n`, `npm run qa:i18n-release` (1/1), `npm run test:desktop` (513/513), `npm run lint`, and `rg -n "\?" packages\i18n\src\locales -g "*.ts"` returned no matches. Tests now pin translated `latencyLabelKey` display, legacy/custom `latencyLabel` fallback, and `latencyMs` priority over labels.
- Product-facing desktop polish continued: terminal safety-block reasons no longer flow to the UI as hardcoded English strings from `apps/desktop/src/safety.ts`. Dangerous command rules now emit `reasonKey: TranslationKey`, `apps/desktop/src/terminalExecutor.ts` passes the key through blocked events, and `apps/desktop/src/main.tsx` translates `t(result.event.reasonKey)` before formatting `desktop.commandBlockedDetail`; `apps/desktop/src/TerminalPane.tsx` still receives fully formatted localized feedback and keeps the existing alert/status semantics. All 15 locale packs include the 17 new `desktop.safetyReason*` keys, covering rm-root, mkfs, fork bomb, raw disk copy, chmod root, block-device writes, root delete/wipe, firewall flush, remote shell pipes, root download overwrite, shutdown, Windows/PowerShell destructive commands, database drops, and command substitution.
- Verification for the safety-reason localization slice is green: `npm run test -w @atlasterm/desktop -- safety.test.ts terminalExecutor.test.ts` (35/35), `npm run typecheck:desktop`, `npm run test:i18n` (50/50), `npm run typecheck:i18n`, `npm run qa:i18n-release` (1/1), `npm run test:desktop` (508/508), `npm run lint`, and `rg -n "\?" packages\i18n\src\locales -g "*.ts"` returned no matches. `apps/desktop/src/safety.test.ts` now table-pins every dangerous pattern to a `reasonKey`, and `packages/i18n/src/index.test.ts` asserts every advertised locale resolves all safety reason labels without leaking raw keys.
- Product-facing desktop polish continued: sidebar command snippet display names no longer ship as hardcoded English strings in `apps/desktop/src/main.tsx`. The built-in snippets now carry `nameKey` values (`desktop.snippetPodStatus`, `desktop.snippetTailLogs`, `desktop.snippetDiskUsage`, `desktop.snippetActiveConnections`, `desktop.snippetMemoryTop`) while preserving the actual shell commands as technical/dynamic command text. `apps/desktop/src/Sidebar.tsx` renders `t(snippet.nameKey)`, and `apps/desktop/src/Sidebar.test.tsx` pins that selecting the localized label still injects the original command.
- Verification for the command-snippet display localization slice is green: `npm run test -w @atlasterm/desktop -- Sidebar.test.tsx main.test.tsx` (20/20), `npm run typecheck:desktop`, `npm run test:i18n` (49/49), `npm run typecheck:i18n`, `npm run qa:i18n-release` (1/1), `npm run test:desktop` (507/507), `npm run lint`, and `rg -n "\?" packages\i18n\src\locales -g "*.ts"` returned no matches. All 15 locale packs include the five new `desktop.snippet*` display keys.
- Product-facing desktop polish continued: built-in desktop group names now use one shared display helper instead of per-component English literals. `apps/desktop/src/desktopGroups.ts` centralizes the canonical internal group ids (`Production`, `Staging`, `CI runners`, `Data`) and maps them to existing `desktop.groupProduction`, `desktop.groupStaging`, `desktop.groupCI`, and `desktop.groupData` keys. `apps/desktop/src/Sidebar.tsx`, `apps/desktop/src/ContextMenu.tsx`, `apps/desktop/src/GroupManagerModal.tsx`, and `apps/desktop/src/panels.tsx` render localized labels for built-in groups while preserving custom/user-provided group names verbatim and keeping callbacks/storage on the original canonical ids.
- Product-facing desktop polish continued: group names embedded in terminal bootstrap and move-to-group toast copy now receive localized built-in labels at the display boundary. `apps/desktop/src/desktopTerminalSession.ts` formats `desktop.terminalSessionConnected` with `desktopGroupLabel(...)`, and `apps/desktop/src/main.tsx` passes localized built-in group labels to `connectionMovedToast(...)` without changing `useGroupManager` persistence or dynamic connection group ids.
- Verification for the built-in group display localization slice is green: `npm run test -w @atlasterm/desktop -- Sidebar.test.tsx desktopTerminalSession.test.ts desktopGroups.test.ts ContextMenu.test.tsx GroupManagerModal.test.tsx panels.test.tsx panels.browser.test.tsx main.test.tsx` (104/104), `npm run typecheck:desktop`, `npm run test:desktop` (507/507), `npm run lint`, `npm run test:i18n` (49/49), `npm run typecheck:i18n`, `npm run qa:i18n-release` (1/1), and `rg -n "\?" packages\i18n\src\locales -g "*.ts"` returned no matches. The remaining raw group strings in `apps/desktop/src/main.tsx` / `apps/desktop/src/useGroupManager.ts` are canonical data/storage ids or region-code lookup keys, not localized display copy.
- Product-facing desktop polish continued: Team Access prototype data no longer renders static English strings directly from `apps/desktop/src/teamAccess.ts`. Shared vault names/scopes/owners, member role/access labels, audit actions/targets, production-elevation request copy, and generated approve/reject audit events now flow through translation keys rendered by `apps/desktop/src/panels.tsx`; `apps/desktop/src/teamAccess.test.ts`, `apps/desktop/src/panels.test.tsx`, and `apps/desktop/src/panels.browser.test.tsx` pin the key-backed state and rendered localized output. All 15 locale packs include the new Team Access display keys.
- Verification for the Team Access static-copy localization slice is green: `npm run test -w @atlasterm/desktop -- teamAccess.test.ts panels.test.tsx panels.browser.test.tsx StatusBar.test.tsx` (56/56), `npm run test:i18n` (49/49), `rg -n "\?" packages\i18n\src\locales -g "*.ts"` (no matches), a non-test source scan for the old Team Access strings (`Incident commander`, `JIT role issued`, `Vault share approved`, `Command recorded`, `Production elevation`, `Access request approved`, `Access request rejected`, `Database break-glass`, `CI deploy keys`) plus the old raw aria/fallback strings returned no matches, `npm run test:desktop` (504/504), `npm run typecheck:desktop`, `npm run typecheck:i18n`, `npm run qa:i18n-release`, and `npm run lint`.
- Product-facing desktop polish continued: `DesktopErrorBoundary` no longer carries hardcoded English fallback strings for crash title/reload copy. `apps/desktop/src/DesktopErrorBoundary.tsx` now requires callers to provide localized `titleLabel` and `reloadLabel`, preserving the existing `apps/desktop/src/main.tsx` wiring through `desktop.error.boundary.title` and `desktop.error.boundary.reload`; `apps/desktop/src/DesktopErrorBoundary.test.tsx` now exercises the component with explicit localized labels.
- Verification for the error-boundary fallback cleanup is green: `npm run test -w @atlasterm/desktop -- DesktopErrorBoundary.test.tsx main.test.tsx` (6/6), `npm run test:desktop` (504/504), `npm run typecheck:desktop`, `npm run test:i18n` (49/49), `npm run typecheck:i18n`, `npm run qa:i18n-release`, `npm run lint`, and a non-test source scan for `"Something went wrong"`, `"Reload"`, `aria-label="terminal"`, `aria-label={connection.color}`, and `aria-label={vault.status}` returned no matches.
- Product-facing desktop polish continued: the interactive xterm host no longer exposes a hardcoded `aria-label="terminal"`; `apps/desktop/src/XtermTerminal.tsx` now receives a localized `desktop.xtermTerminalLabel` from `apps/desktop/src/main.tsx`, with `apps/desktop/src/XtermTerminal.test.tsx` pinning the rendered label. Sidebar connection status dots and Inspector connection badges now announce localized connection status labels (`desktop.connectionStatusOnline`, `desktop.connectionBusy`, `desktop.locked`) instead of raw color/status tokens such as `good` or `online`.
- Product-facing desktop polish continued: Team Access review and shared-vault status surfaces now render localized status labels for approved/rejected/recording/pending states, and vault status dots use the same localized labels for assistive tech instead of raw `approved` / `recording` tokens. All 15 locale packs include `desktop.xtermTerminalLabel`, `desktop.connectionStatusOnline`, `team.statusApproved`, `team.statusRejected`, and `team.statusRecording`.
- Verification for this xterm/status localization slice is green: `npm run test -w @atlasterm/desktop -- XtermTerminal.test.tsx Sidebar.test.tsx panels.test.tsx panels.browser.test.tsx` (55/55), `npm run test:i18n` (49/49), `rg -n "\?" packages\i18n\src\locales -g "*.ts"` (no matches), a focused raw-token scan for `aria-label={connection.color}`, `aria-label={vault.status}`, `aria-label="terminal"`, and raw `online`/`approved`/`rejected`/`recording` render tokens outside tests, `npm run test:desktop` (504/504), `npm run typecheck:desktop`, `npm run typecheck:i18n`, `npm run qa:i18n-release`, and `npm run lint`.
- Product-facing desktop polish continued: status-bar actions now expose localized action labels for session context, SFTP, latency history, and team access summary instead of relying on terse status-value button names. Missing latency data in the desktop status bar and sidebar connection cards now uses the localized `desktop.notAvailable` fallback across all 15 locale packs instead of hardcoded `N/A`; focused connection cards now omit `aria-current` on non-current rows instead of rendering a false current state.
- Product-facing desktop polish continued: the command palette's recent-item badges now render through `desktop.paletteRecentBadge` in all 15 locale packs instead of hardcoded `recent`. The latency chart SVG now advertises `role="img"` alongside its localized label, and the inspector skeleton state is now an announced `role="status"` / `aria-busy="true"` loading region labeled with `desktop.panelLoading` while keeping skeleton cards hidden from assistive tech.
- Verification for this desktop a11y/localization slice is green: `npm run test -w @atlasterm/desktop -- CommandPalette.test.tsx panels.test.tsx StatusBar.test.tsx Sidebar.test.tsx` (75/75), `npm run test:i18n` (49/49), `rg -n "\?" packages\i18n\src\locales -g "*.ts"` (no matches), `npm run test:desktop` (502/502), `npm run typecheck:desktop`, `npm run typecheck:i18n`, `npm run qa:i18n-release`, and `npm run lint`.
- Product-facing desktop polish continued: the desktop topbar connection scope summary no longer ships hardcoded English copy. `apps/desktop/src/main.tsx` now renders the scope label through `desktop.connectionScopeSummary`, all 15 locale packs under `packages/i18n/src/locales/*` include exactly one localized value for that key, and `apps/desktop/src/main.test.tsx` pins the source-level regression against the old inline English production/gateway-fleet label. This slice also repaired the newly introduced literal-question-mark corruption in the non-ASCII locale rows before release gates.
- Verification for the topbar scope-label localization slice is green: `npm run test -w @atlasterm/desktop -- main.test.tsx` (3/3), `npm run typecheck:desktop`, `npm run test:i18n` (49/49), `npm run typecheck:i18n`, `npm run qa:i18n-release`, and `npm run lint`. Static scans confirmed `rg -n "\?" packages\i18n\src\locales -g "*.ts"` returns no matches, every locale file has exactly one `desktop.connectionScopeSummary` key, and the old English scope literal remains only in the English locale plus the regression assertion.
- Product-facing desktop polish continued: terminal autocomplete guidance no longer ships hardcoded English hint fragments. `apps/desktop/src/TerminalPane.tsx` now renders the command-suggestion hint through `desktop.terminalAutocompleteComplete` and `desktop.terminalAutocompleteNavigate`, and all 15 locale packs under `packages/i18n/src/locales/*` include localized strings for those keys. `apps/desktop/src/TerminalPane.browser.test.tsx` pins the hint to translator output and guards against the old inline `to complete` / `to navigate` copy returning.
- Verification for the terminal autocomplete hint localization slice is green on the that desktop slice: `npm run test -w @atlasterm/desktop -- TerminalPane.browser.test.tsx` (61/61), `npm run typecheck:desktop`, `npm run test:i18n` (49/49), `npm run typecheck:i18n`, `npm run qa:i18n-release`, and `npm run lint`. Static scan now finds `to complete` / `to navigate` only in the English locale and regression assertions, while runtime UI code uses translation keys.
- Product-facing desktop polish continued: synthetic terminal bootstrap lines for non-primary saved connections no longer rely on hardcoded English copy. `apps/desktop/src/desktopTerminalSession.ts` centralizes `PRIMARY_TERMINAL_PROMPT`, SSH command formatting, and translated bootstrap session creation; `apps/desktop/src/main.tsx` now creates/regenerates synthetic sessions through that helper while preserving sessions that already have command history; `apps/desktop/src/TerminalPane.tsx` imports the shared prompt constant. All 15 locale packs under `packages/i18n/src/locales/*` include `desktop.terminalSessionConnected`, `desktop.terminalSessionReady`, and `desktop.terminalSessionMfaRequired`, and `apps/desktop/src/desktopTerminalSession.test.ts` pins SSH formatting, translated placeholder payloads, the locked-MFA branch, and primary demo-session identity.
- Verification for the terminal bootstrap localization slice is green: `npm run test -w @atlasterm/desktop -- desktopTerminalSession.test.ts` (4/4), `npm run typecheck:desktop`, `npm run test:i18n` (49/49), `npm run qa:i18n-release`, `npm run typecheck:i18n`, and `npm run lint`. Static scan confirmed no lingering inline `Connected to ${...}`, `MFA verification required before command execution`, or hardcoded `Session ready.` remains outside the English locale/test fixtures. Fresh browser QA on `http://127.0.0.1:5174/?lang=en` activated `staging-api` and observed the expected English terminal bootstrap text with no leaked `desktop.terminalSession*` key, no `.error-boundary-shell`, no alert roles, and no console errors. Fresh browser QA on `http://127.0.0.1:5174/?lang=zh-CN` observed localized terminal bootstrap text with the same no-leak/no-error result; raw non-English text is omitted from the active handoff to avoid display-encoding drift. The temporary 5174 Vite/npm server was stopped afterward, `PORT_5174_CLEAR` was confirmed, and temporary `desktop-vite-5174*.log` files were removed.
- Product-facing desktop polish continued: creating a saved connection no longer reports the misleading generic `Connected` toast, and the connection context menu's `Copy SSH command` action now performs the copy instead of only showing a label. `apps/desktop/src/main.tsx` adds a small SSH-command formatter plus clipboard-backed copy handler, routes the `copySsh` context action through that handler, and uses `connectionCreatedToast(t, connection.name)` for new saved connections. `apps/desktop/src/desktopToastMessages.ts` centralizes the new `desktop.connectionCreated`, `desktop.sshCommandCopied`, and `desktop.sshCommandCopyFailed` templates, `apps/desktop/src/desktopToastMessages.test.ts` pins their keys and placeholders, and all 15 locale packs under `packages/i18n/src/locales/*` include the new strings.
- Verification for the create/copy-SSH feedback slice is green: `npm run test -w @atlasterm/desktop -- desktopToastMessages.test.ts` (3/3), `npm run typecheck:desktop`, `npm run test:i18n` (49/49), `npm run qa:i18n-release`, `npm run typecheck:i18n`, and `npm run lint`. Fresh browser QA on `http://127.0.0.1:5174/?lang=en` loaded `JoeSSH Workbench`, opened the `prod-edge-01` context menu, selected `Copy SSH command`, observed clipboard text `ssh 10.48.12.11`, observed toast text `SSH command for prod-edge-01 copied`, saw no `Could not copy SSH command` fallback, leaked no `desktop.sshCommand*` key, had no `.error-boundary-shell`, no alert roles, and no fresh console errors. The temporary 5174 Vite/npm server was stopped afterward and the port check returned `PORT_5174_CLEAR`.
- Product-facing desktop polish continued: desktop action toasts no longer rely on hardcoded English message fragments for connection switching/moving/importing/testing, built-in connection guards, duplicate/edit/delete actions, group create/delete/rename, and SFTP upload completion. `apps/desktop/src/desktopToastMessages.ts` centralizes the toast templates behind the `Translator` API, `apps/desktop/src/main.tsx` routes those action paths through the helper, and `apps/desktop/src/desktopToastMessages.test.ts` pins the translation keys plus placeholder payloads. All 15 locale packs under `packages/i18n/src/locales/*` now include the new `desktop.connectionSwitched`, `desktop.connectionMoved`, `desktop.connectionsImported`, `desktop.connectionConnectToast`, `desktop.connectionTestResult`, `desktop.builtinConnectionEditUnavailable`, `desktop.builtinConnectionDeleteUnavailable`, `desktop.connectionCopyName`, `desktop.connectionCopyNameNumbered`, `desktop.connectionDuplicated`, `desktop.connectionDeleted`, `desktop.connectionEdited`, `desktop.groupCreatedToast`, `desktop.groupDeletedToast`, `desktop.groupRenamedToast`, and `desktop.sftpUploadComplete` keys.
- Verification for the desktop toast localization slice is green: `npm run test -w @atlasterm/desktop -- desktopToastMessages.test.ts` (3/3), `npm run typecheck:desktop`, `npm run test:i18n` (49/49), `npm run qa:i18n-release`, `npm run typecheck:i18n`, and `npm run lint`. A scripted locale completeness check confirmed every new toast key exists in all 15 locale packs, and the focused copy audit confirmed the new action toast paths route through the helper/translator while remaining `addToast` calls are either existing translated keys or dynamic command/probe values. Fresh browser QA on `http://127.0.0.1:5174/?lang=en` loaded `JoeSSH Workbench` without console errors, triggered `Alt+2`, and observed exactly one `class="toast toast--success"` / `role=status` toast with text `Switched to prod-edge-02`, no leaked `desktop.connectionSwitched` key, no `.error-boundary-shell`, and no alert roles. The temporary 5174 Vite/npm server was stopped afterward and the port check returned no connection rows.
- Product-facing desktop polish continued: the keyboard shortcuts overlay no longer ships hardcoded English labels for connection switching, theme toggling, or command history. `apps/desktop/src/ShortcutsOverlay.tsx` now treats every shortcut label as a `TranslationKey`, all 15 locale packs under `packages/i18n/src/locales/*` include `desktop.shortcutSwitchConnection`, `desktop.shortcutToggleTheme`, and `desktop.shortcutCommandHistory`, and `apps/desktop/src/ShortcutsOverlay.test.tsx` pins translator usage plus absence of the old hardcoded `Toggle theme` label. Browser QA also found the documented `Ctrl+Shift+?` handler was too literal for the common shifted-slash event shape; `apps/desktop/src/keyboardShortcuts.ts` now centralizes the predicate and `apps/desktop/src/main.tsx` accepts literal `?`, `/`, and `code="Slash"` while preserving the documented shortcut.
- Verification for the shortcut localization/runtime slice is green: `npm run test -w @atlasterm/desktop -- ShortcutsOverlay.test.tsx keyboardShortcuts.test.ts` (10/10), `npm run typecheck:desktop`, `npm run test:i18n` (49/49), `npm run qa:i18n-release`, `npm run typecheck:i18n`, and `npm run lint`. Fresh browser QA on `http://127.0.0.1:5174/?lang=en` after reload confirmed `.workbench` rendered with title `JoeSSH Workbench`, `Ctrl+Shift+/` opened one `role="dialog"` with `aria-label="Keyboard shortcuts"`, the overlay text included `Keyboard shortcuts`, `Switch connection`, `Toggle theme`, and `Command history`, leaked no `desktop.shortcut*` keys, had no `.error-boundary-shell`, no `.panel-loading`, no alert roles, and no console errors. The temporary 5174 Vite/npm server chain was stopped afterward and the port check returned no connection rows.
- Product-facing desktop polish continued: the root desktop crash fallback is now a dedicated `DesktopErrorBoundary` instead of inline markup in `apps/desktop/src/main.tsx`. `apps/desktop/src/DesktopErrorBoundary.tsx` preserves the existing error-monitor breadcrumb/report path, renders the fatal state through shared `InlineAlert` copy with `aria-atomic="true"`, and keeps a localized reload action. `apps/desktop/src/styles.css` adds a compact full-page fatal shell/card/reload treatment with stable wrapping; `apps/desktop/src/DesktopErrorBoundary.test.tsx` pins healthy children rendering, localized fatal alert anatomy, monitor reporting, and reload dispatch.
- Verification for the desktop crash-boundary slice is green: `npm run test -w @atlasterm/desktop -- DesktopErrorBoundary.test.tsx main.test.tsx` (5/5), `npm run typecheck:desktop`, and `npm run lint`. Fresh browser QA on `http://127.0.0.1:5174/?lang=en` confirmed the normal boot path still renders `.workbench`, has no `.error-boundary-shell`, no alert roles, zero `.panel-loading` leftovers after settle, title `JoeSSH Workbench`, and no console errors from port 5174.
- Product-facing desktop polish continued: live forwarding runtime errors now reuse the shared structured inline-alert treatment instead of a plain red paragraph. `apps/desktop/src/panels.tsx` imports `InlineAlert` for `ForwardingPanel` runtime failures, preserving `role="alert"` / `aria-atomic="true"` plus the lucide error icon and wrapping-safe copy; `apps/desktop/src/styles.css` now treats `.forward-error` as spacing on top of the shared `.inline-alert` shell rather than stale paragraph typography; `apps/desktop/src/panels.test.tsx` pins `.inline-alert.forward-error`, alert semantics, icon, title-only message, and no detail branch.
- Verification for the forwarding runtime alert slice is green: `npm run test -w @atlasterm/desktop -- panels.test.tsx` (30/30), `npm run typecheck:desktop`, and `npm run lint`. This branch is covered by focused render/unit evidence because the forwarding runtime error state depends on injected backend/runtime state rather than an ordinary click-only browser path.
- Product-facing desktop polish continued: modal inline errors now use the same structured alert treatment as the rest of the polished desktop states instead of plain red paragraphs. `apps/desktop/src/InlineAlert.tsx` renders a reusable `role="alert"` / `aria-atomic="true"` inline card with lucide alert icon, title, optional detail, and wrapping-safe copy; `apps/desktop/src/ConnectModal.tsx` uses it for connection failures with the backend detail separated from the localized title; `apps/desktop/src/NewConnectionModal.tsx` uses it for duplicate-name validation. `apps/desktop/src/styles.css` adds the `.inline-alert` icon/copy grid, soft error surface, circular icon well, and wrapping detail text; `apps/desktop/src/ConnectModal.test.tsx` and `apps/desktop/src/NewConnectionModal.test.tsx` pin the alert role, atomic announcement, icon, title, and optional detail/no-detail branches.
- Verification for the modal inline-alert slice is green: `npm run test -w @atlasterm/desktop -- ConnectModal.test.tsx NewConnectionModal.test.tsx` (12/12), `npm run typecheck:desktop`, and `npm run lint`. Fresh browser QA opened the New Connection dialog on `http://127.0.0.1:5174/?lang=en` and confirmed the dialog/control surface was reachable, but typing the duplicate built-in name through the browser automation path hit the local virtual-clipboard bridge before text entry; the rendered alert anatomy is unit-pinned rather than claimed as live-typed browser evidence.
- Product-facing desktop polish continued: toast notifications now use tone-correct lucide icons and roles instead of reusing the old success-looking error icon and status-only semantics. `apps/desktop/src/ToastContainer.tsx` maps success to `CircleCheck` with `role="status"`, warning to `TriangleAlert` with `role="status"`, and error to `CircleAlert` with `role="alert"`; `apps/desktop/src/styles.css` gives toasts a stable icon/message grid, tone-specific borders, circular icon wells, and safe wrapping; `apps/desktop/src/ToastContainer.test.tsx` pins the success/warning status roles, error alert role, icon wrapper, and mixed-toast role counts.
- Verification for the toast notification slice is green: `npm run test -w @atlasterm/desktop -- ToastContainer.test.tsx` (7/7), `npm run typecheck:desktop`, and `npm run lint`. Fresh browser QA on `http://127.0.0.1:5174/?lang=en` triggered a real success toast through the connection context menu; the rendered toast had `class="toast toast--success"`, `role=status`, a `.toast-icon svg`, a `.toast-message`, 28px/icon-column grid layout, 240px minimum width, text `Connect: prod-edge-01`, and no fresh console errors from port 5174. Error-toast assertive semantics are unit-pinned because browser text entry hit the local virtual-clipboard bridge rather than the app.
- Product-facing desktop polish continued: lazy terminal and right-panel chunk fallbacks now use a shared loading-card treatment instead of a single status line. `apps/desktop/src/PanelLoadingState.tsx` renders a `role="status"` / `aria-busy="true"` card with lucide spinner, localized title and hint, and non-announced skeleton rows; `apps/desktop/src/main.tsx` uses it for both Suspense fallbacks; `apps/desktop/src/styles.css` gives `.panel-loading` stable 132px height, elevation, icon, copy, and skeleton structure. Added `desktop.panelLoadingHint` to all 15 locale packs under `packages/i18n/src/locales/*`; `apps/desktop/src/PanelLoadingState.test.tsx` covers the a11y/status and skeleton structure.
- Verification for the panel-loading slice is green: `npm run test -w @atlasterm/desktop -- PanelLoadingState.test.tsx` (1/1), `npm run typecheck:desktop`, `npm run test:i18n` (49/49), `npm run qa:i18n-release`, `npm run lint`, and fresh browser QA on `http://127.0.0.1:5174/`. Fresh browser QA observed one initial localized `.panel-loading` card with `role=status`, `aria-busy=true`, icon, copy, non-announced skeleton, 132px height, then zero loading cards after settle, no error boundary, and no fresh console errors from port 5174; raw non-English text is omitted from the active handoff to avoid display-encoding drift.
- Product-facing desktop polish continued: the Command Palette empty-results state now uses the shared emotional empty-state treatment instead of a single placeholder line. `apps/desktop/src/CommandPalette.tsx` renders an icon-in-circle, localized title, and localized hint; `apps/desktop/src/styles.css` gives the palette empty state stable height and accent icon styling; `apps/desktop/src/CommandPalette.test.tsx` covers the new empty-state copy. Added `desktop.paletteEmptyTitle` and `desktop.paletteEmptyHint` to all 15 locale packs under `packages/i18n/src/locales/*`.
- Browser QA also found and fixed a Command Palette trigger crash: the sidebar `IconButton` had been forwarding its click event into `openPalette`, which could turn `paletteState.input` into a non-string and crash at `.startsWith`. `apps/desktop/src/Sidebar.tsx` now calls `onOpenPalette()` explicitly, and `apps/desktop/src/useCommandPalette.ts` ignores non-string initial input defensively; regression coverage is in `apps/desktop/src/Sidebar.test.tsx` and `apps/desktop/src/useCommandPalette.test.ts`.
- Product-facing localization polish continued: fixed literal `?` replacement corruption in shipped locale copy for panel loading, latency labels, connection import/export, host/group/tag labels, and team access review/status strings across Arabic, German, Spanish, French, Hindi, Japanese, Korean, Portuguese (Brazil), Russian, Thai, Vietnamese, Simplified Chinese, and Traditional Chinese. The i18n mojibake regression test in `packages/i18n/src/index.test.ts` now rejects literal question-mark replacement marks when the English source is not itself a question, while keeping the existing fingerprint scan. Focused verification is green: `npm run test:i18n` (49/49), `npm run qa:i18n-release`, `npm run typecheck:i18n`, and `rg -n "\?" packages\i18n\src\locales -g "*.ts"` (no matches).
- Product-facing desktop polish continued: live SFTP directories with zero entries now render the shared emotional empty-state treatment (folder icon, localized title, localized hint) instead of an empty list. Live SFTP loading, directory-error, transfer-in-progress, and transfer-error states now render compact `sftp-state` cards with lucide icons, clear hierarchy, status/alert roles, and preserved error details instead of plain status paragraphs. Tests cover the live empty-directory and status-card branches in `apps/desktop/src/panels.test.tsx`; implementation is in `apps/desktop/src/panels.tsx` and `apps/desktop/src/styles.css`.
- Controller QA hardening continued: `scripts/check-handoff-hygiene.mjs` now enforces active task-card hygiene, safe dispatch queue shape, active lane occupancy, available lane ownerless wording, duplicate active coordination block rejection, archival reference labeling, git metadata caveat retention, CORS origin terminology context, a single do-not-resurrect stop warning, and handoff self-test count freshness instead of only documenting them. The live top handoff section may keep the required historical audit statement, but any active task-card IDs must use compact two-digit TNN form (rejecting spaced, padded, or overlong forms) and be non-duplicated. The safe dispatch queue is parsed as six exact lanes in fixed order with scoped write targets, required code-span formatting for path/glob targets, duplicate-lane rejection, duplicate-heading rejection, and broad-scope wording rejection; the Desktop UX/a11y lane explicitly includes shared `packages/i18n/src/*` translation packs for localized desktop polish. The active lane ledger must list the same six lanes in order, exactly one active lane, current-controller ownership for that active lane, available lanes must say `no active owner in this thread.`, no duplicate active ledger heading, and no outdated owner references. Archival IDs and rollout files are allowed only below the first handoff separator and only when the same line is explicitly labeled archival-only. The top handoff's `node --test scripts/check-handoff-hygiene.test.mjs` count must match the current fixture count. The checker rejects disallowed terminology variants in active handoff text, preserves the CORS origin terminology carve-out, and requires blocklist terminology for terminal command contexts such as `wget -O /`, `--output-document=/`, and `curl -o /`.
- Desktop a11y/UX hardening continued: focused connection cards now support keyboard reordering within the visible group via `Alt+ArrowUp` / `Alt+ArrowDown`, with `aria-keyshortcuts` exposed and mouse drag semantics preserved. Implementation is in `apps/desktop/src/Sidebar.tsx`, `apps/desktop/src/useDragReorder.ts`, and `apps/desktop/src/main.tsx`; tests cover the hook, sidebar dispatch paths, and browser persistence flow.
- Verification for this desktop slice is green: `npm run test -w @atlasterm/desktop -- panels.test.tsx` (30/30), `npm run typecheck:desktop`, `npm run test:desktop` (482/482), `npm run qa:i18n-release`, and `npm run lint`.
- Verification for the Command Palette empty-state slice is green: `npm run test -w @atlasterm/desktop -- CommandPalette.test.tsx Sidebar.test.tsx useCommandPalette.test.ts` (46/46), `npm run test:i18n` (49/49), `npm run typecheck:desktop`, `npm run typecheck:i18n`, `npm run qa:i18n-release`, `npm run lint`, and fresh browser QA on `http://127.0.0.1:5174/`.
- Fresh browser QA result: on the current desktop Vite server, clicking the localized command-palette trigger opened one dialog and one combobox without an error boundary; entering `zzzz-no-palette-match-901` rendered one localized `.palette-empty.empty-state`, one icon circle, zero options, and no fresh console errors from port 5174. Raw non-English text is omitted from the active handoff to avoid display-encoding drift.
- Fresh controller verification after this cleanup: `npm run test -w @atlasterm/desktop -- panels.test.tsx` (30/30), `npm run test -w @atlasterm/desktop -- useDragReorder.test.ts Sidebar.test.tsx` (29/29), `npm run qa:i18n-release`, `npm run typecheck:desktop`, `npm run typecheck:e2e`, `npm run lint`, `npm run test:desktop` (482/482), `npm run test -w @atlasterm/e2e -- --config=playwright.desktop.config.ts --project=desktop-workbench --project=desktop-accessibility` (35/35), focused drag-order E2E (1/1), focused keyboard-reorder E2E (1/1), and desktop accessibility E2E (6/6) all pass.
- Additional controller verifier checks pass: `node --check scripts/check-handoff-hygiene.mjs`, `node --check scripts/check-handoff-hygiene.test.mjs`, `node --test scripts/check-handoff-hygiene.test.mjs` (114/114), `npm run qa:handoff-hygiene` (114/114 plus live scan), CI workflow YAML parse, CI handoff-step assertion, `npm run qa:sync-api-docs` (69 checks), package JSON parse, `npx eslint scripts --ext .mjs,.cjs`, `npm run lint`, `node scripts/check-i18n.cjs`, and `npm run qa:i18n-release`.
- Handoff hygiene is now current: only one active `Latest continuation state`, obsolete resume references are quarantined, Section 3 is archival-only context, and the prior broad parallelism wording is replaced with scoped lane dispatch.
- Handoff hygiene is now executable, self-tested, and enforced in durable QA: `npm run qa:handoff-hygiene` first runs isolated `node:test` fixtures in `scripts/check-handoff-hygiene.test.mjs`, then runs the live `scripts/check-handoff-hygiene.mjs` scan. Root `npm run qa` includes it after Sync API docs, and `.github/workflows/ci.yml` runs it in the lint job. The gate checks controller invariants including duplicate latest sections, obsolete resume directives, active task-card numbering/duplicates, protected-root blocklist wording, CORS origin terminology context, broad dispatch wording, exact safe lane order/scope and code-span formatting, active lane ledger ownership, available lane ownerless wording, duplicate active coordination blocks, archival reference labeling, `.git` caveat retention, single do-not-resurrect stop-warning shape, self-test count drift, package/docs/CI wiring, and last E2E status when present. `docs/qa-checklist.md` documents the gate.
- Root lint now covers QA scripts too: `npm run lint` runs ESLint over `apps/`, `packages/`, and `scripts/` with `.ts/.tsx/.mjs/.cjs` extensions. Fixed script-lint findings in `scripts/check-i18n.cjs` (dead locale export-name metadata), `scripts/lighthouse-audit.mjs` (unused loop key), and `eslint.config.mjs` (Node/CommonJS globals/rules for `.cjs`).
- Controller audit: historical task-card references are limited to T04/T05/T12/T15; there is no active duplicate card queue.
- CORS origin `allowlist` wording is legitimate policy language.
- Terminal-safety `wget -O /` is documented as a protected-root blocklist.
- Workspace caveat remains: `.git/` is partial on this host and `git status` fails. Treat files on disk plus verification output as truth here.
- Full root `npm run qa:e2e` now passes 73/73 on this Windows host with the static mobile web server path, so the active handoff must not carry the old Windows webServer timeout caveat.

Safe next dispatch queue (choose non-overlapping write scopes):

- Controller cleanup/docs: `HANDOFF.md`, `docs/qa-checklist.md`, `README.md`, `CHANGELOG.md`.
- Desktop UX/a11y: `apps/desktop/src/*`, `packages/i18n/src/*`, `tests/e2e/specs/desktop-*`.
- Web admin: `apps/web/src/*`, `tests/e2e/specs/web-*`, `docs/sync-api.md`.
- Mobile companion: `apps/mobile/*`, mobile service/model tests.
- Sync service/core engine: `services/sync/*`, `crates/*` (requires Cargo-capable host for final verification).
- QA infra: `tests/e2e/playwright*.config.ts`, `tests/e2e/scripts/*`, `scripts/*`, `.github/workflows/*`.

Active lane ledger (current controller occupancy):

- Controller cleanup/docs: available - no active owner in this thread.
- Desktop UX/a11y: available - no active owner in this thread.
- Web admin: active - current controller owns stale live admin snapshot refresh/body-read abort coverage, refresh-control busy/loading announcements, 403 admin_forbidden auth-state coverage and live audit-event clearing, 401/403 authentication status semantics, authentication recovery status/focus semantics, localized non-ready status semantics and message descriptions, non-ready badge/title accessible names and message descriptions, named/described fatal error-boundary alert semantics, runtime language-switch fatal fallback semantics, and reload action dispatch, hung admin snapshot response/body timeout coverage, malformed live time rendering resilience, non-negative integer snapshot counter validation, per-list nonblank/unique/canonical snapshot ID validation, nonblank snapshot display-field validation, authorization-expiry data clearing, long device/cursor readability, LTR/RTL mobile table field labels, fixture/live member/device table dimension and index metadata plus row names and rowheaders, mobile table-header accessibility, Web Admin axe accessibility checks across populated, 401/403 authentication-required, and non-ready states, skip-link focus transfer, hash-aware active navigation current-state semantics for direct loads and clicks, navigation landmark naming without redundant sidebar complementary landmarks, unique main content landmark naming, dashboard panel region naming, language-selector current-language descriptions, role-permission list semantics and item names, fixture and live audit-event list semantics and item names, metric list/listitem semantics and accessible names, error-state alert/assertive semantics, blocked-storage language resilience, hidden stable fallback a11y hygiene, Web Admin E2E isolation checks, and Web QA documentation.
- Mobile companion: available - no active owner in this thread.
- Sync service/core engine: available - no active owner in this thread.
- QA infra: available - no active owner in this thread.

Do not resurrect archived session ids from historical notes below.
Start from the current workspace state and this top section.

---
## Prior continuation state (2026-06-01 00:05 local) - EMOTIONAL EMPTY-STATE DESIGN (sidebar no-match)

Screenshot loop revealed the sidebar no-match state was **cheap/bare**: just a small search icon + "0 娑擃亜灏敓? count. Premium apps give empty states a clear hierarchy. Upgraded it to an **emotional empty state**:

- **Markup** (`apps/desktop/src/Sidebar.tsx`): icon now wrapped in `.empty-state-icon` (soft circle), plus `.empty-state-title` (`desktop.searchEmptyTitle`) + `.empty-state-hint` (`desktop.searchEmptyHint`). `searchMatches` key retained ? still used by TerminalPane match counter.
- **i18n**: added `desktop.searchEmptyTitle` + `desktop.searchEmptyHint` to **all 15 locales** (real translations, not placeholders; release gate green).
- **CSS** (`apps/desktop/src/styles.css` `.empty-state`): icon in a 44px soft-bg bordered circle, bold 14px title in full text color, 1.5-line muted hint capped at 30ch.
- Re-screenshotted: now shows icon-in-circle ? "濞屸剝婀侀崠褰掑帳閻ㄥ嫯绻涢敓? ? "鐠囨洝鐦崗鏈电铂閸忔娊鏁拠宥忕礉閹存牗绔婚梽銈嗙垼缁涘墽鐡柅澶涙嫹? ? clear, friendly, professional.

**VERIFICATION:** typecheck 0, lint 0, coverage gate green, i18n release green, build OK, **desktop a11y E2E 6/6**.

**Remaining for true "world-class":** systematic typography scale; emotional design for other empty/loading/error states (SFTP empty dir, forward no-rules, panel-loading skeletons already exist ? could get the same icon+title+hint treatment). Continue the screenshot loop.