diff --git a/.gitignore b/.gitignore
index 088f80a..5fe5fec 100644
--- a/.gitignore
+++ b/.gitignore
@@ -52,6 +52,13 @@ docs/product-pilot-judge-results-*.md
 docs/product-pilot-*.md
 docs/vscode-plugin.md
 
+# ── internal ADRs / embed hook (living developer docs — not public tip) ──
+docs/ADR-*.md
+docs/CE-EMBED-HOOK.md
+
+# ── local skill-shell umbrella workspace (never ship) ──
+skill-shell-rationalization/
+
 # ── machine-level admin policy drop-in (never commit a live copy) ──
 /admin.json
 /admin.baked.json
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6dbe696..0342451 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,62 @@
 Human-curated release notes. Earlier 0.9.x notes also live on the
 [GitHub releases](https://github.com/benjsmith/switchbay/releases) page.
 
+## 2026-09-29 — v0.13.0
+
+**Migration:** none. **Breaking:** none for wiki/vault format. After pull,
+run `make refresh BUILD=1` and hard-reload the PWA. No new VSIX.
+
+Switchbay **0.13.0** same-origin reverse-proxies curiosity-engine and
+okstratr (no iframes), mounts skill UIs in the same document, dual-mounts
+CE sidebar + Graph canvas, auto-starts core skills, and is a thin client
+over okstratr’s harness registry. Built-in Graph, Agents, and filebrowser
+remain; proxied embeds are opt-in in Settings.
+
+Skill versions:
+
+| Skill | Version | Notes |
+|---|---|---|
+| curiosity-engine | **1.9.0** | Dual-mount Pages + atlas; IndexedDB cache |
+| okstratr | **0.2.0** | Hosted proxy; registry SSOT; observer desk UX |
+| curiosity-merge | **0.8.4** | Installer / UI-boundary contract |
+
+See [release notes](docs/releases/v0.13.0.md) and [architecture](docs/architecture.md).
+
+### Added
+
+- **Same-origin embed reverse-proxy** — `/embed/ce/*` → `:8766`,
+  `/embed/okstratr/*` → `:8767`; loopback-only upstreams; inject
+  `X-CE-Host` / `X-Okstratr-Host: switchbay`. Feature flag
+  `proxied_skill_embeds` (Settings) switches Graph → CE / Agents → okstratr;
+  daemon proxy is always on. Built-ins **not** deleted.
+- **Same-document skill mount** — fetch proxied HTML when core-skills
+  healthy; rewrite assets; execute scripts in-panel; wait chrome via
+  `GET /api/core-skills/status` (`starting` / `unhealthy` / `building_wiki` /
+  `live`). Soft-reload on `sy:files-changed`.
+- **Dual-mount CE Graph** — shell-left `CeSidebarSlot` (Pages|Files persists
+  across Graph/Agents/Editor) + Graph-pane `CeAtlasEmbed` canvas; shared
+  `ceEmbedSession`; prefers `window.CEEmbed.create` when present; keeps
+  atlas warm across tab switches; loads `atlas-cache.js` for cold Graph cache.
+- **Core-skills auto-start** — always start CE + okstratr with the shell;
+  rail `host_notify`; `OKSTRATR_HOSTED=switchbay` on supervised serve.
+- **Settings → okstratr harness registry** — thin client (`/api/okstratr/harness*`);
+  no second Switchbay allowlist.
+- **Pack / ingest queues** — process CE `.workbench/pack-runs/` via rail LLM;
+  process ingest-runs via `local_ingest` / prefer CE drop-ingest endpoint.
+- **Sandbox roots** — allow `/workspace` (+ env roots) in home-gate.
+
+### Fixed / polish
+
+- Keep CE atlas warm across Graph tab switches; dual-mount sidebar bugs after
+  Graph mount; gzip large JSON + guard soft-remount during CE load; retarget
+  viewer on workspace switch; serve `data.json` fast / enrich off hot path;
+  vault missing-extract UX from `vault.db`.
+
+### Unchanged
+
+- v0.12.19 Curate / desks / Web / Comms / watch-folder / Zen behavior remains
+  the product baseline. Graph and Agents chrome stay; proxied mode is opt-in.
+
 ## 2026-09-20 — v0.12.19
 
 No wiki/vault format migration. Review Web, Comms, and watch-folder behavior changes below. After updating, run `make refresh BUILD=1` and hard-reload the PWA. No new VSIX.
diff --git a/README.md b/README.md
index 2b5ab46..b59367a 100644
--- a/README.md
+++ b/README.md
@@ -15,8 +15,10 @@ curate captured material into linked wiki pages, run Auto orchestration
 It runs **entirely on your machine**, against whatever models you choose,
 and nothing leaves unless you send it.
 
-- **Local & private** — two processes and your files. No cloud, no
-  accounts; your data and API keys stay on your machine.
+- **Local & private** — a Switchbay daemon on your machine (auto-starts
+  curiosity-engine + okstratr) and your files. No cloud, no accounts; your
+  data and API keys stay on your machine. See
+  [`docs/architecture.md`](docs/architecture.md).
 - **Bring your own models** — hosted APIs (Anthropic, xAI Grok, OpenAI,
   Gemini, Meta Muse Spark), subscription coding CLIs (Claude Code, Grok
   Build, Muse Code, Codex, Copilot), or fully-local models (llama.cpp /
@@ -39,7 +41,8 @@ and nothing leaves unless you send it.
 New here? Read **[`docs/concepts-and-data-flow.md`](docs/concepts-and-data-flow.md)**
 — how Switch Bay is put together in one read: the core vocabulary
 (**Workspace → Thread → Run → Turn**), the runtime shape, and the data
-flows behind the things you do most. Provider coverage (what's
+flows behind the things you do most. Hosting / embed architecture:
+**[`docs/architecture.md`](docs/architecture.md)**. Provider coverage (what's
 first-class vs preview, including Muse Code) is
 **[`docs/providers.md`](docs/providers.md)**. The default **open**
 profile is today's consumer product. An optional **enterprise** profile
@@ -99,7 +102,9 @@ make sync           # uv sync (base Python deps; add `make sync-semantic` for em
 make sync-frontend  # pnpm install in frontend/
 ```
 
-Two processes. In one terminal:
+Dev needs the daemon and Vite. The daemon **auto-starts** curiosity-engine
+(`:8766`) + okstratr (`:8767`); Vite is only for hot frontend reload. In
+one terminal:
 
 ```sh
 WORKSPACE=/path/to/workspace make dev-daemon
@@ -112,7 +117,8 @@ make dev-frontend
 ```
 
 Then open the URL vite prints (default `http://localhost:5173`). Vite
-proxies `/api` and `/ws` to the daemon on `:8765`.
+proxies `/api`, `/ws`, and `/embed` to the daemon on `:8765`. Architecture:
+[`docs/architecture.md`](docs/architecture.md).
 
 ## Test
 
@@ -182,6 +188,7 @@ don’t need to quit and reopen the PWA after each restart.
 
 ## More
 
+- **[`docs/architecture.md`](docs/architecture.md)** — how Switchbay hosts CE and okstratr (embed proxy, core-skills, pack/ingest queues).
 - **[`docs/concepts-and-data-flow.md`](docs/concepts-and-data-flow.md)** — the map: concepts + data flows.
 - **[`docs/known-issues.md`](docs/known-issues.md)** — rough edges + deliberate deferrals in this release.
 - **[`docs/THIRD-PARTY-NOTICES.md`](docs/THIRD-PARTY-NOTICES.md)** — third-party attributions.
diff --git a/docs/ADR-004-same-origin-embed-proxy.md b/docs/ADR-004-same-origin-embed-proxy.md
deleted file mode 100644
index 84e5e29..0000000
--- a/docs/ADR-004-same-origin-embed-proxy.md
+++ /dev/null
@@ -1,60 +0,0 @@
-# ADR-004: Same-origin embed reverse-proxy (no iframes)
-
-- **Status:** Accepted (Phase 4a); Embed v2 mount → [ADR-004b](./ADR-004b-embed-v2-same-document-mount.md)
-- **Date:** 2026-09-18
-- **Deciders:** Ben / skill-shell rationalization charter
-
-## Context
-
-Switchbay hosts Graph (curiosity-engine atlas/wiki) and Agents (okstratr
-observer/desk) surfaces. Cross-origin iframes pointed at
-`127.0.0.1:8766` / `:8767` break hosted-mode control (okstratr HTML
-settings must hide when `host=switchbay`) and create an opaque nested
-browsing context.
-
-Charter locked decision #1: shells **same-origin reverse-proxy** skill
-daemons; in-app panels load first-party proxied routes — **not nested
-frames**.
-
-## Decision
-
-1. **Daemon reverse-proxy** (always on; independent of the UI flag):
-   - `/embed/ce/*` → `http://127.0.0.1:8766/*` (override:
-     `SWITCHBAY_CE_UPSTREAM`, must remain loopback)
-   - `/embed/okstratr/*` → `http://127.0.0.1:8767/*` (override:
-     `SWITCHBAY_OKSTRATR_UPSTREAM`, must remain loopback)
-   - Upstream allowlist is **loopback-only** (`127.0.0.1` / `::1` /
-     `localhost`). Non-loopback upstreams are rejected (502).
-   - Inject hosted-shell headers on every proxied request:
-     - `X-CE-Host: switchbay`
-     - `X-Okstratr-Host: switchbay`
-
-2. **No iframes** for Graph/Agents skill surfaces. Feature flag
-   `proxied_skill_embeds` (default **false**) switches Graph → CE panel
-   and Agents → okstratr panel that navigate `/embed/*` via same-origin
-   `fetch` + same-document rendering. Phase 4a was script-stripped HTML / JSON; Embed v2 (ADR-004b) executes skill scripts in-panel.
-   Built-in GraphTab / AgentDashboardTab / filebrowser remain the
-   default and are **not deleted**.
-
-3. **Settings → okstratr registry (done — ADR-005).** Switchbay settings
-   is a thin client over okstratr's harness/model registry
-   (`harnesses.toml` via `/api/okstratr/harness…` / embed proxy). No
-   second Switchbay allowlist. See
-   [ADR-005](./ADR-005-okstratr-harness-registry-client.md).
-
-## Consequences
-
-- Dev Vite must proxy `/embed` to the daemon (`vite.config.ts`).
-- CE and okstratr should honor public-base + `X-*-Host` (okstratr
-  Phase 1a `public_base.py`; CE equivalent TBD).
-- Full atlas/observer chrome parity is gated by the parity checklist
-  before any Switchbay duplicate deletion (Phase 4b+).
-- WebSocket upgrade through the embed proxy is deferred; HTTP(S) first.
-
-## Alternatives considered
-
-| Option | Why not |
-|--------|---------|
-| Cross-origin iframe to :8766/:8767 | Opaque origin; hosted settings leak; charter forbid |
-| Same-origin iframe to `/embed/*` | Still a nested frame; charter: no iframes |
-| Delete built-in Graph/Agents now | Violates parity checklist / dual-stack gate |
diff --git a/docs/ADR-004b-embed-v2-same-document-mount.md b/docs/ADR-004b-embed-v2-same-document-mount.md
deleted file mode 100644
index ec018ef..0000000
--- a/docs/ADR-004b-embed-v2-same-document-mount.md
+++ /dev/null
@@ -1,78 +0,0 @@
-# ADR-004b: Embed v2 — same-document interactive mount
-
-- **Status:** Accepted (Embed v2)
-- **Date:** 2026-09-19
-- **Parent:** [ADR-004](./ADR-004-same-origin-embed-proxy.md)
-- **Contract:** umbrella `CONTRACT-EMBED-V2.md`
-
-## Context
-
-Phase 4a (`ProxiedSkillPanel`) fetched `/embed/*` HTML and injected a
-**script-stripped** body. That proved the reverse-proxy path but left Graph
-and Agents inert (no pan/zoom, no desk controls). Charter + ADR-004 forbid
-`<iframe>` / nested frames for skill surfaces.
-
-CE and okstratr already honor `CE_PUBLIC_BASE` / `OKSTRATR_PUBLIC_BASE`
-(`_/embed/ce_`, `_/embed/okstratr_`) and inject `window.*_PUBLIC_BASE` so
-API helpers resolve under the proxy. Relative asset tags (`static/main.js`,
-`observer.css`) still need rewriting when the HTML is mounted into a
-Switchbay panel rather than navigated as a top-level document.
-
-## Decision
-
-**Same-document microfrontend mount** (no nested browsing context):
-
-1. **Wait chrome first.** While the panel is open, poll
-   `GET /api/core-skills/status` (~2s). Banner states: `starting` /
-   `unhealthy` / `building_wiki` / `live`. Do **not** flash a full 502
-   error while the supervisor is still `starting` or `stopped` —
-   status chrome explains the wait (`suppressFetchError`).
-2. **Fetch** proxied HTML from `/embed/ce/…` or `/embed/okstratr/…` only
-   when the skill slice is `healthy` (`allowMount`).
-3. **Rewrite** relative / root-relative / loopback asset URLs onto the
-   public base (`frontend/src/widgets/embed/embedMount.ts`).
-4. **Extract** `<script>` tags (classic + `type=module`); inject remaining
-   markup (body + head stylesheets) into a dedicated panel root via
-   `innerHTML`.
-5. **Execute** scripts by `document.createElement("script")` + append
-   (with rewritten `src`, or inline `textContent`). Browsers never run
-   scripts inserted via `innerHTML` alone.
-6. **Tear down** before soft-reload (`sy:files-changed`) or unmount:
-   remove tracked script nodes and clear the panel root so listeners /
-   duplicate roots do not accumulate.
-7. **JSON** responses keep the pretty-print path (no script mount).
-
-Built-in `GraphTab` is **not** deleted (parity checklist / Ben lock).
-
-## Consequences
-
-- Interactive CE / okstratr chrome can run under `/embed/*` without iframes.
-- Skill UIs share the Switchbay document: global ID collisions and
-  `document`-level assumptions are residual risks; skills should prefer
-  scoped queries when possible.
-- **WebSocket upgrade** through the embed proxy remains deferred (HTTP
-  first). Live features that require WS may be limited until proxyed.
-- Unit tests cover URL rewrite, script extraction, and status-banner
-  mapping (`embedMount.test.ts`).
-
-## Alternatives considered
-
-| Option | Why not |
-|--------|---------|
-| Keep script-stripping | Inert UI; fails Embed v2 acceptance |
-| Same-origin `<iframe src="/embed/…">` | Nested frame; charter / ADR-004 forbid |
-| `srcdoc` iframe | Still a nested browsing context |
-| Shadow DOM isolation | Extra complexity; CE/okstratr expect light DOM + `getElementById` |
-
-## Mount algorithm (short)
-
-```
-poll status → if !healthy: banner only
-else:
-  teardown prior mount
-  html = fetch(/embed/…/)
-  { markup, scripts } = prepareEmbedHtml(html, publicBase, pagePath)
-  root.innerHTML = markup
-  for s in scripts: createElement(script); set src|text; append; await load
-on files_changed / unmount: teardown
-```
diff --git a/docs/ADR-005-okstratr-harness-registry-client.md b/docs/ADR-005-okstratr-harness-registry-client.md
deleted file mode 100644
index 2b2b095..0000000
--- a/docs/ADR-005-okstratr-harness-registry-client.md
+++ /dev/null
@@ -1,57 +0,0 @@
-# ADR-005: Settings → okstratr harness registry (SSOT client)
-
-- **Status:** Accepted
-- **Date:** 2026-09-19
-- **Parent:** [ADR-004](./ADR-004-same-origin-embed-proxy.md) (Settings TODO)
-- **Deciders:** Ben / skill-shell rationalization charter
-
-## Context
-
-okstratr owns the harness+model registry (`~/.config/okstratr/harnesses.toml`
-via `GET/POST /api/harness…`). Charter: shells are **config UIs** over that
-registry — no second Switchbay allowlist. Hosted mode
-(`X-Okstratr-Host: switchbay`) already disables okstratr HTML settings, so
-Switchbay Settings must become the write path.
-
-## Decision
-
-1. **Thin client module** `switchbay.okstratr_harness`:
-   - Server-side calls loopback `SWITCHBAY_OKSTRATR_UPSTREAM`
-     (default `http://127.0.0.1:8767`) with hosted-shell header.
-   - Loopback guard reused from `embed_proxy` (non-loopback → 502).
-   - `normalize_registry()` maps okstratr `list_for_api` JSON; never
-     invents an allowlist.
-   - Browser may also hit same-origin `/embed/okstratr/api/harness…`.
-
-2. **Daemon routes** (shells/UI need not know embed paths):
-   - `GET  /api/okstratr/harness`
-   - `POST /api/okstratr/harness/enable`   `{ "id": "…" }`
-   - `POST /api/okstratr/harness/disable`  `{ "id": "…" }`
-   - `POST /api/okstratr/harness/set`      `{ "key": "…", "value": "…" }`
-   - `POST /api/okstratr/harness/reload`
-
-3. **Settings UI** — section **Harness registry · okstratr**: list rows,
-   enable/disable, set `harness.<id>.default_model`. Existing Pi / local
-   LLM panels remain as **rail** surfaces and are labeled as not the
-   desk/agent SSOT.
-
-4. **okbay** mirrors the same thin-client pattern (doc note; full UI
-   follow-up) — see okbay `docs/HERDR-AND-REGISTRY.md` and Switchbay
-   `/api/okstratr/host-notify` as the precedent for path-native okstratr
-   integration.
-
-## Consequences
-
-- okstratr must be healthy (core-skill supervisor) for Settings toggles
-  to succeed; UI surfaces a clear 502 when upstream is down.
-- No `harnesses.toml` (or equivalent) under Switchbay state dirs.
-- Pi harness (`/api/llm/harness`) and local LLM panels stay Switchbay-local
-  for rail chat; they must not claim desk registry ownership.
-
-## Alternatives considered
-
-| Option | Why not |
-|--------|---------|
-| Copy allowlist into Switchbay `app_settings` | Second SSOT; charter forbid |
-| Settings UI calls `:8767` cross-origin | Breaks hosted-mode headers / CORS |
-| Only document CLI (`okstratr harness …`) | Users need in-app toggles when HTML settings are hosted-off |
diff --git a/docs/ADR-006-ce-pack-run-drain.md b/docs/ADR-006-ce-pack-run-drain.md
deleted file mode 100644
index 5ff6929..0000000
--- a/docs/ADR-006-ce-pack-run-drain.md
+++ /dev/null
@@ -1,54 +0,0 @@
-# ADR-006: CE pack-queue → Switchbay rail LLM drain
-
-- **Status:** Accepted
-- **Date:** 2026-09-19
-- **Parent:** skill-shell rationalization (CE filebrowser packs Phase 2b)
-- **Deciders:** Ben / skill-shell rationalization charter
-
-## Context
-
-Curiosity Engine's proxied filebrowser accepts
-`POST /api/packs/<pack>/action/<action>` and, after sandbox checks,
-writes only:
-
-```text
-.workbench/pack-runs/<run_id>.json   # status: "queued"
-```
-
-It does **not** seat an LLM agent. Switchbay already has
-`handle_pack_action` which seats `_dispatch_chat` with skill
-`<pack>-<action>`, but the CE path never hits that handler — so
-CE-queued runs stayed `queued` forever.
-
-Both processes share the workspace tree, so the queue files are the
-handoff surface.
-
-## Decision
-
-1. **Switchbay drains the shared JSON** (no CE `PATCH` required).
-   Module `switchbay.pack_run_drain`:
-   - `list_queued_runs` / `write_run_status` (atomic JSON rewrite)
-   - `build_pack_prompt` — same text as `handle_pack_action`
-   - `drain_once` — validate pack enabled + skill exists, mark
-     `running`, spawn `_dispatch_chat` (injectable for tests), on
-     task completion mark `done` / `failed`
-   - In-memory `app["pack_run_inflight"]` dedupes concurrent drains
-
-2. **Triggers**
-   - Background poll every ~4s while
-     `<workspace>/.workbench/pack-runs/` exists
-   - Explicit `POST /api/packs/drain` → `{drained, skipped, errors}`
-   - Opportunistic kick from `_broadcast_files_changed_soon` when
-     the pack-runs dir is present
-
-3. **Out of scope (this ADR):** reveal-in-OS, drop-ingest, rewriting
-   CE's queue writer, and refactoring `handle_pack_action` to also
-   write pack-runs JSON (nice-to-have; CE files are the required
-   consumer).
-
-## Consequences
-
-- CE remains the sandbox/accept edge; Switchbay remains the skill/LLM
-  seat. Status fields on the shared JSON are the cross-process progress
-  UI.
-- Tests mock `dispatch_fn` — no paid model seats in CI.
diff --git a/docs/ADR-007-ce-ingest-run-drain.md b/docs/ADR-007-ce-ingest-run-drain.md
deleted file mode 100644
index b08b4a3..0000000
--- a/docs/ADR-007-ce-ingest-run-drain.md
+++ /dev/null
@@ -1,60 +0,0 @@
-# ADR-007: CE ingest-queue → Switchbay local_ingest / rail drain
-
-- **Status:** Accepted
-- **Date:** 2026-09-20
-- **Parent:** skill-shell rationalization (CE drop-ingest + pack-run drain parity)
-- **Related:** ADR-006 (CE pack-queue → rail LLM drain)
-- **Deciders:** Ben / skill-shell rationalization charter
-
-## Context
-
-Curiosity Engine's drop-ingest (`POST /api/ingest/from-upload` /
-`from-path`, filebrowser + `/embed/ce/`) stages bytes under
-`vault/raw/` and writes only:
-
-```text
-.workbench/ingest-runs/<run_id>.json   # status: "queued", mode: "staged"
-```
-
-It does **not** run `local_ingest.py` or seat an LLM agent. Pack-runs
-already drain via Switchbay (`POST /api/packs/drain`, ADR-006). Without
-a sibling drain, ingest-runs sit `queued` forever after drop.
-
-Both processes share the workspace tree, so the queue files are the
-handoff surface.
-
-## Decision
-
-1. **Switchbay drains the shared JSON** (no CE `PATCH` required).
-   Module `switchbay.ingest_run_drain`:
-   - `list_queued_runs` / `write_run_status` (atomic JSON rewrite)
-   - `resolve_run_vault_path` — refuse workspace escape / null bytes
-   - Prefer **deterministic** `local_ingest` (`ce_tools._ce_ingest`)
-     for normal vault sources (`mode: staged` and peers)
-   - Escalate to `_dispatch_chat` only when metadata opts in
-     (`mode`/`drain` ∈ {llm,rail,agent,dispatch} or
-     `prefer_rail` / `use_llm` truthy)
-   - `drain_once` — mark `running`, spawn local or rail task, on
-     completion mark `done` / `failed`
-   - In-memory `app["ingest_run_inflight"]` dedupes concurrent drains
-
-2. **Triggers**
-   - Background poll every ~4s while
-     `<workspace>/.workbench/ingest-runs/` exists
-   - Explicit `POST /api/ingest/drain` → `{drained, skipped, errors}`
-   - Opportunistic kick from `_broadcast_files_changed_soon` when
-     the ingest-runs dir is present
-
-3. **Out of scope:** rewriting CE's queue writer, changing
-   Switchbay's own multipart `/api/ingest/from-upload` (still seats
-   rail immediately for non-CE uploads), multimodal CURATE waves.
-
-## Consequences
-
-- CE remains the sandbox/stage edge; Switchbay remains the ingest
-  executor. Status fields on the shared JSON are the cross-process
-  progress UI.
-- Default path stays cheap (no paid model seats). LLM only when the
-  run record asks for it.
-- Tests mock `local_ingest_fn` / `dispatch_fn` — no CE binary or paid
-  model seats in CI.
diff --git a/docs/ADR-008-workspace-sandbox-roots.md b/docs/ADR-008-workspace-sandbox-roots.md
deleted file mode 100644
index 471ac5c..0000000
--- a/docs/ADR-008-workspace-sandbox-roots.md
+++ /dev/null
@@ -1,25 +0,0 @@
-# ADR-008: Workspace sandbox roots (stage-5 home rule + box `/workspace`)
-
-**Status:** Accepted  
-**Date:** 2026-09-20  
-**Context:** Stage-5 restricted workspace paths to `$HOME` so file-ops /
-cebridge never get a cwd of `/`, `/etc`, etc. On the Grok Bot box,
-corpora live under `/workspace` (e.g. `/workspace/ce-cb-biocure`).
-`Path.resolve()` follows symlinks, so a `~/Workspaces/...` symlink still
-failed `is_within_home`; E2E had to `unshare`+bind-mount under home.
-
-**Decision:** Keep the stage-5 sandbox, but allow a small explicit set of
-roots via `allowed_workspace_roots()`:
-
-1. Always `Path.home()`.
-2. `/workspace` when that directory exists (agent-box scratch).
-3. Extra dirs from `SWITCHBAY_WORKSPACE_ROOTS` (`os.pathsep`-separated;
-   expanduser + resolve; skip missing / non-dirs).
-
-`is_within_home(path)` (name retained for call sites) returns true iff
-the resolved path is under any of those roots. Error copy uses
-`home_label()` → e.g. `must live inside /home/box or /workspace`.
-
-**Consequences:** Box corpora register without bind-mount workarounds.
-`/etc`, `/tmp`, `/`, and `..` escapes remain refused unless an operator
-deliberately adds a root via the env var.
diff --git a/docs/CE-EMBED-HOOK.md b/docs/CE-EMBED-HOOK.md
deleted file mode 100644
index 146ada6..0000000
--- a/docs/CE-EMBED-HOOK.md
+++ /dev/null
@@ -1,84 +0,0 @@
-# CE embed hook — dual mounts (shell sidebar + Graph canvas)
-
-**Date:** 2026-09-27 (updated)  
-**Owners:** Switchbay (mount scaffolding) · CE Benchmarker (CE `embed` mode)
-
-## Goal
-
-- **Shell left column** hosts the **CE sidebar** (Pages | Files + search that
-  highlights both list and canvas) — **persistent** across Graph / Agents /
-  Editor for CE-backed workspaces.
-- **Graph pane** hosts **only the CE atlas canvas** (+ in-canvas graph-search).
-- **One CE embed session**, **two mount points**, shared `data.json` /
-  module state — same-origin, no iframe, no full-document HTML remount.
-- Switchbay keeps tabs, rail, Agents, theme/mode footer. Non-CE / proxied-off
-  workspaces keep native WikiPane + Files|Sources.
-
-## Do not
-
-- Keep Pages only inside the Graph tab (must persist across tabs).
-- Rebuild Switchbay’s sidebar to imitate CE Pages (search-highlight debt).
-- Run two page lists at once.
-
-## Switchbay scaffolding (landed)
-
-| Piece | Role |
-|-------|------|
-| `ceEmbedSession.ts` | Singleton session: `ensure()` → load `/embed/ce` modules + `data.json`; `attachSidebar` / `attachCanvas` / detach; survives Graph unmount |
-| `CeSidebarSlot.tsx` | Shell-left mount (`#ce-sidebar-root`) when `proxied_skill_embeds` |
-| `CeAtlasEmbed.tsx` | Graph tab canvas (`#graph-root`); soft-parks atlas on tab leave (instant return) |
-| `ceEmbedBootstrap.ts` | `prepareSession()`, script order, fetch shim, `window.CEEmbed` prefer |
-| `ceSidebarShell.html` / `ceEmbedShell.html` | DOM fragments (aside vs graph-pane+modal) |
-
-`Sidebar.tsx`: proxied on → `CeSidebarSlot` (full-height); proxied off →
-WikiPane + Files|Sources as before. Workspace remount calls
-`resetCeEmbedSession()`.
-
-## CE hook to add (CE Benchmarker)
-
-```js
-window.CEEmbed = {
-  /**
-   * Preferred: create a session, then attach external mounts.
-   * @param {{
-   *   embed: true,
-   *   dataUrl: string,       // "/embed/ce/data.json"
-   *   publicBase: string,    // "/embed/ce"
-   *   chrome?: boolean,      // shell owns theme/rail; CE chrome minimal
-   * }} opts
-   */
-  async create(opts) {
-    return {
-      /** Mount CE Pages|Files sidebar into Switchbay's left column. */
-      mountSidebar(el) { /* Sidebar.init + FileBrowser; search↔canvas */ },
-      /** Mount atlas canvas (+ graph-search) into #graph-root. */
-      mountCanvas(el) { /* AtlasViewer / Graph; share session data */ },
-      destroy() { /* tear both; leave Switchbay fetch/body clean */ },
-    };
-  },
-};
-```
-
-Requirements:
-
-- Single shared state / `data.json` for both mounts.
-- Sidebar search highlights **list + canvas** (existing GraphSearch wiring).
-- `mountCanvas` may be called after `mountSidebar`. Leaving Graph should
-  **soft-park** the canvas (`unmountCanvas()` default) — keep atlas/simulation
-  + loaded data alive off-DOM; return calls `mountCanvas` again for **instant
-  reattach** (no N>10k layout). Pass `unmountCanvas({ destroy: true })` only
-  for hard teardown. Optional `revalidate()` refreshes `data.json` in the
-  background after reattach.
-- Honor `CE_PUBLIC_BASE` / `opts.dataUrl`.
-- Optional: `mount({ mounts: { sidebar, canvas } })` one-shot still OK.
-
-Until `CEEmbed.create` exists, Switchbay’s stub loads CE static modules and
-calls `Sidebar.init` + `AtlasViewer`/`Graph`/`GraphSearch` itself.
-
-## Verify
-
-- Pages list visible on Agents and Editor (not only Graph).
-- One page list (CE), not WikiPane + CE.
-- Graph = atlas canvas; rail right-docked; Agents not stuck Loading.
-- Leave Graph → Agents → back Graph is **instant** (no "Loading Curiosity Engine atlas…" / no 20s layout).
-- `/embed/ce/data.json` and `/api/graph/data` still serve BioCure nodes+edges.
diff --git a/docs/architecture.md b/docs/architecture.md
new file mode 100644
index 0000000..c7688f7
--- /dev/null
+++ b/docs/architecture.md
@@ -0,0 +1,75 @@
+# Architecture (v0.13)
+
+How Switchbay **hosts** first-party skills today. Product vocabulary and
+data flows stay in [`concepts-and-data-flow.md`](concepts-and-data-flow.md).
+Release detail: [`releases/v0.13.0.md`](releases/v0.13.0.md).
+
+> If a detail here disagrees with the code, the code wins.
+
+## Shape
+
+```
+Browser PWA  ──WS/HTTP──▶  Switchbay daemon :8765
+                              │
+                              ├── /embed/ce/*       → 127.0.0.1:8766  (curiosity-engine)
+                              ├── /embed/okstratr/* → 127.0.0.1:8767  (okstratr)
+                              ├── /api/core-skills/*   (auto-start + status)
+                              ├── /api/okstratr/harness*  (Settings thin client)
+                              └── pack / ingest queues  (.workbench)
+```
+
+Same-origin reverse proxy + **same-document** mounts — **no iframes** for
+Graph / Agents skill surfaces.
+
+## Same-origin reverse proxy
+
+- Daemon always proxies `/embed/ce/*` and `/embed/okstratr/*` to loopback
+  upstreams (`SWITCHBAY_CE_UPSTREAM` / `SWITCHBAY_OKSTRATR_UPSTREAM`;
+  non-loopback rejected).
+- Injects `X-CE-Host: switchbay` / `X-Okstratr-Host: switchbay`.
+- Vite dev proxies `/embed` to the daemon.
+- Settings → **Proxied skill embeds** switches Graph → CE and Agents →
+  okstratr observer; turning it off restores built-ins. The proxy itself
+  stays on either way.
+
+## Same-document skill mount
+
+- Poll `GET /api/core-skills/status`; wait chrome while `starting` /
+  `building_wiki` / `unhealthy`; mount only when healthy.
+- `fetch` proxied HTML, rewrite asset URLs onto `/embed/…`, inject markup,
+  **execute** scripts via `createElement` + append.
+- Soft-reload on wiki `files_changed`; tear down scripts on unmount.
+- Implementation: `frontend/src/widgets/embed/` (`ProxiedSkillPanel`,
+  `embedMount.ts`).
+
+## Dual-mount Graph
+
+- Shell left column: CE Pages|Files (`CeSidebarSlot`) persists across
+  Graph / Agents / Editor when proxied embeds are on for a CE workspace.
+- Graph pane: atlas canvas only (`CeAtlasEmbed`); keeps the atlas warm
+  when you leave the tab; `atlas-cache.js` + workspace key for cold Graph cache.
+- Prefers `window.CEEmbed.create` / `mount` when CE provides it; one
+  session survives Graph unmount.
+
+## Core-skills auto-start
+
+- curiosity-engine and okstratr **always** auto-start with the shell.
+- Supervised okstratr serve sets `OKSTRATR_HOSTED=switchbay`.
+- Rail receives okstratr `host_notify` envelopes.
+
+## Settings → okstratr harness registry
+
+- `/api/okstratr/harness*` is a thin client over okstratr’s harness /
+  model registry. No second Switchbay allowlist.
+
+## Pack + ingest queues
+
+- CE queues pack-runs and ingest-runs under `.workbench/`.
+- Switchbay processes pack-runs via the rail LLM and ingest-runs via
+  `local_ingest` (prefer CE drop-ingest endpoint; rail LLM only when
+  run metadata opts in).
+
+## Built-in Graph and Agents
+
+Built-in GraphTab, AgentDashboardTab, and filebrowser stay available.
+Proxied skill embeds are opt-in in Settings.
diff --git a/docs/concepts-and-data-flow.md b/docs/concepts-and-data-flow.md
index 56e8a6a..1de05c3 100644
--- a/docs/concepts-and-data-flow.md
+++ b/docs/concepts-and-data-flow.md
@@ -13,6 +13,8 @@ running tools, and turning raw material into a knowledge graph.
 > If a detail here disagrees with the code, the code wins — this doc is
 > the map, not the territory.
 
+Skill hosting (same-origin embed proxy, dual-mount Graph, core-skills auto-start, pack/ingest queues, Settings → okstratr registry): **[`architecture.md`](architecture.md)**.
+
 ---
 
 ## The core loop
@@ -41,21 +43,26 @@ local. Nothing leaves unless you send it.
 
 ## Runtime shape
 
-Two processes and your files. No cloud, no accounts.
+Your browser, the Switchbay daemon, auto-started core skills, and your
+files. No cloud, no accounts. Hosting / embed detail:
+**[`architecture.md`](architecture.md)**.
 
 ```
  ┌─────────────────────────┐         ┌──────────────────────────────┐
- │  Browser frontend (PWA)  │  WS +   │   Python daemon (aiohttp)    │
- │  installed from          │◀──HTTP─▶│   always-on launchd agent    │
- │  http://127.0.0.1:8765   │  :8765  │   :8765                      │
+ │  Browser frontend (PWA)  │  WS +   │  Switchbay daemon            │
+ │  installed from          │◀──HTTP─▶│  always-on launchd agent     │
+ │  http://127.0.0.1:8765   │  :8765  │  :8765                       │
  │  Power mode · Zen mode   │         │                              │
- └─────────────────────────┘         │  ┌────────────────────────┐  │
-                                      │  │ LLM gateway (providers) │  │
-   Your knowledge base                │  │  APIs: Anthropic · xAI  │  │
-   (a "workspace"):                   │  │    · OpenAI · Gemini ·  │  │
-     <ws>/wiki/     docs + graph      │  │    Meta                 │  │
-     <ws>/vault/    raw sources       │  │  CLIs: Claude Code ·    │  │
-     <ws>/.workbench/  config+state ◀─┼──┤    Grok Build · Muse ·  │  │
+ └─────────────────────────┘         │  reverse-proxy /embed/…       │
+                                      │    /embed/ce/*       → :8766 │
+                                      │    /embed/okstratr/* → :8767 │
+                                      │  ┌────────────────────────┐  │
+   Your knowledge base                │  │ LLM gateway (providers) │  │
+   (a "workspace"):                   │  │  APIs: Anthropic · xAI  │  │
+     <ws>/wiki/     docs + graph      │  │    · OpenAI · Gemini ·  │  │
+     <ws>/vault/    raw sources       │  │    Meta                 │  │
+     <ws>/.workbench/  config+state ◀─┼──┤  CLIs: Claude Code ·    │  │
+                                      │  │    Grok Build · Muse ·  │  │
                                       │  │    Codex · Copilot      │  │
                                       │  │  local: llama.cpp/Ollama│  │
                                       │  │ tools · MCP bridge      │  │
@@ -67,11 +74,15 @@ Two processes and your files. No cloud, no accounts.
 - **Frontend**: a pure-browser PWA (no Electron/Tauri). Talks to the
   daemon over a WebSocket (live events) plus REST (`/api/*`). Installed
   from `http://127.0.0.1:8765` so it gets a dock icon + standalone
-  window. In dev, vite serves `:5173` and proxies `/api` + `/ws`.
-- **Daemon**: one aiohttp process, always on (launchd agent, restart on
-  crash). Owns everything: the LLM providers, the tool registry, the
-  rail history, the managed local model server, PTY sessions. Closing
-  the window does **not** stop work — runs live in the daemon.
+  window. In dev, vite serves `:5173` and proxies `/api` + `/ws` +
+  `/embed`.
+- **Daemon**: one always-on process (launchd agent, restart on crash).
+  Owns the LLM providers, tool registry, rail history, managed local
+  model server, PTY sessions, and same-origin `/embed` reverse proxy.
+  **Auto-starts** curiosity-engine (`:8766`) and okstratr (`:8767`).
+  Closing the window does **not** stop work — runs live in the daemon.
+  Skill UI mounts (dual-mount Graph, pack/ingest queues, Settings →
+  okstratr harness): see [`architecture.md`](architecture.md).
 - **Knowledge base**: a **curiosity-engine**-shaped folder (curiosity-
   engine is bundled as a first-party skill). Durable, user-facing files
   (`wiki/`, `vault/`, figures,
@@ -495,6 +506,7 @@ all. Two interop layers sit on top:
 
 ## See also
 
+- [`architecture.md`](architecture.md) — how Switchbay hosts CE and okstratr (v0.13).
 - `README.md` — what Switch Bay is and how to run it.
 - `CLAUDE.md` — orientation for AI coding sessions.
 - `src/switchbay/` — the daemon; each module's docstring carries its rationale.
diff --git a/docs/enterprise.md b/docs/enterprise.md
index 22fd22f..8184059 100644
--- a/docs/enterprise.md
+++ b/docs/enterprise.md
@@ -205,7 +205,7 @@ normal-sensitivity thread stays pending until explicit Approve, and
 confirm Revoke stops a subsequent poll. Do not treat a green unit suite
 as tenant certification.
 
-Release notes for this cut: [`releases/v0.12.19.md`](releases/v0.12.19.md).
+Release notes: [`releases/v0.13.0.md`](releases/v0.13.0.md); prior [`releases/v0.12.19.md`](releases/v0.12.19.md).
 
 ## SentinelOne / EDR
 
diff --git a/docs/handoff/2026-09-20-skill-shell-parity.md b/docs/handoff/2026-09-20-skill-shell-parity.md
index ab667a1..ca363d6 100644
--- a/docs/handoff/2026-09-20-skill-shell-parity.md
+++ b/docs/handoff/2026-09-20-skill-shell-parity.md
@@ -2,10 +2,10 @@
 
 **Charter position:** Switchbay v0.12.19 is a **behavior/performance gate under
 the import charter**, not a source-parity, source-merge, or implementation
-plan. Switchbay and okbay import and invoke the CE, curiosity-merge (CM), and
-okstratr skills through their public skill contracts. They must **not vendor
+plan. Switchbay imports and invokes the CE, curiosity-merge (CM), and
+okstratr skills through their public skill contracts. It must **not vendor
 their servers, merge their source, copy their internals, or re-implement them
-for either shell**. The shell owns its adapter/UI policy; the skills remain
+for the shell**. The shell owns its adapter/UI policy; the skills remain
 the owners of their behavior and services.
 
 This document records the v0.12.19 release behavior matrix and the additional
@@ -75,6 +75,6 @@ are **additional import-boundary acceptance gates**; the v0.12.19 release
 tests above do not certify the three-skill integration.
 
 Do not use this matrix as permission to merge CE/CM/okstratr source into
-Switchbay or okbay, vendor their servers, or grow shell-specific rewrites.
+Switchbay, vendor their servers, or grow shell-specific rewrites.
 Any retirement of pre-import duplicate shell behavior is a separate decision
 after the imported-skill behavior/performance gate passes.
diff --git a/docs/releases/v0.12.19.md b/docs/releases/v0.12.19.md
index a618a2b..65a52d7 100644
--- a/docs/releases/v0.12.19.md
+++ b/docs/releases/v0.12.19.md
@@ -68,8 +68,8 @@ Then hard-reload the installed PWA. If slideshow PDF or CLI tools still miss Nod
 Installed curiosity-engine integration checks run when that optional dependency is present. Cloud-state fixtures and the native macOS API check do not replace a live iCloud or enterprise-tenant deployment test.
 
 Skill-shell rationalization is an **import-charter behavior/performance gate**,
-not source parity: Switchbay and okbay import the CE, curiosity-merge, and
-okstratr skills through public contracts. They do not vendor, merge, copy, or
+not source parity: Switchbay imports the CE, curiosity-merge, and
+okstratr skills through public contracts. It does not vendor, merge, copy, or
 re-implement those servers for a shell. The gate pins CE skill
 `5d2b967558dd052c62b23fbc03217b1ac2a18d5a` and uses BioCure wiki fixture
 `biocure-confirm-v1-query-5b9711895` at freeze tip `5b9711895`; the latter is a
diff --git a/docs/releases/v0.13.0.md b/docs/releases/v0.13.0.md
new file mode 100644
index 0000000..499249d
--- /dev/null
+++ b/docs/releases/v0.13.0.md
@@ -0,0 +1,100 @@
+# v0.13.0 — 2026-09-29
+
+**Migration:** none (wiki and vault formats unchanged). After pull:
+
+```sh
+git pull
+make refresh BUILD=1
+```
+
+Hard-reload the PWA. No new VSIX.
+
+## What changed
+
+Switchbay **0.13.0** hosts curiosity-engine (Graph, filebrowser, atlas) and
+okstratr (Agents / observer) through a **same-origin reverse proxy** and
+**same-document** mount — no iframes. Core skills start with the daemon.
+Settings is a thin client over okstratr’s harness registry. Pack-runs and
+ingest-runs from CE workspaces are handled by Switchbay (rail LLM /
+`local_ingest`).
+
+Built-in Graph and Agents remain available. Settings → **Proxied skill
+embeds** switches Graph to the CE canvas and Agents to the okstratr
+observer; turning it off restores the built-ins.
+
+Canonical architecture: [`architecture.md`](../architecture.md).
+
+### Skill versions
+
+| Skill | Version | Role |
+|---|---|---|
+| [curiosity-engine](https://github.com/benjsmith/curiosity-engine) | **1.9.0** | `/embed/ce` viewer; dual-mount Pages + atlas; IndexedDB atlas cache |
+| [okstratr](https://github.com/benjsmith/okstratr) | **0.2.0** | `/embed/okstratr` observer; harness registry; `OKSTRATR_PUBLIC_BASE` |
+| [curiosity-merge](https://github.com/benjsmith/curiosity-merge) | **0.8.4** | Headless federation; installer / UI-boundary contract |
+
+### Same-origin reverse proxy
+
+- Daemon proxies `/embed/ce/*` → `127.0.0.1:8766` and
+  `/embed/okstratr/*` → `127.0.0.1:8767` (loopback-only;
+  `SWITCHBAY_*_UPSTREAM` overrides).
+- Injects `X-CE-Host: switchbay` / `X-Okstratr-Host: switchbay`.
+- Vite dev proxies `/embed` to the daemon.
+
+### Same-document skill mount
+
+- Poll `GET /api/core-skills/status`; wait chrome while `starting` /
+  `building_wiki`; mount only when healthy.
+- Fetch proxied HTML, rewrite asset URLs, inject markup, and run scripts
+  in-panel.
+- Soft-reload on wiki `files_changed`; tear down scripts on unmount.
+
+### Dual-mount Graph (CE sidebar + canvas)
+
+- Shell left column: CE Pages|Files (`CeSidebarSlot`) persists across
+  Graph / Agents / Editor for CE-backed workspaces when proxied embeds are on.
+- Graph pane: CE atlas canvas only (`CeAtlasEmbed`); keeps the atlas warm
+  when you leave the tab; `atlas-cache.js` + workspace key for cold Graph cache.
+- Prefers `window.CEEmbed.create` when CE provides it; one session
+  survives Graph unmount.
+
+### Core-skills auto-start + host_notify
+
+- CE and okstratr always start with the shell.
+- Supervised okstratr serve sets `OKSTRATR_HOSTED=switchbay`.
+- Rail receives okstratr `host_notify` envelopes.
+
+### Settings → okstratr harness registry
+
+- `/api/okstratr/harness*` thin client; no second Switchbay allowlist.
+
+### Pack + ingest queues
+
+- CE queues pack-runs / ingest-runs under `.workbench/`; Switchbay
+  processes them (rail LLM / `local_ingest`, prefer CE drop-ingest endpoint).
+
+## What did **not** change
+
+- v0.12.19 Curate settlement, desk live-worker caps, Web default-off,
+  Comms metadata-first, watch folders, Zen/rail geometry — still the
+  behavior baseline ([v0.12.19 notes](v0.12.19.md)).
+- Graph and Agents are **not** removed; proxied mode is opt-in via Settings.
+
+## After pull
+
+```sh
+make refresh BUILD=1
+```
+
+Enable **Proxied skill embeds** in Settings to use Graph→CE /
+Agents→okstratr. Confirm core-skills status goes `live`, Graph paints from
+cache on hard-reload, and Agents shows the okstratr observer (no nested
+iframe).
+
+## Validation (expected)
+
+- Unit: embed mount / URL rewrite / status banner; version sync
+  (`test_version_sync` — 0.13.0 across pyproject / `__init__` / frontend).
+- Manual: proxied on/off round-trip; dual-mount Pages persist on Agents;
+  Graph leave→return stays warm; pack/ingest queue smoke on a CE workspace.
+
+Live iCloud / enterprise-tenant limits from v0.12.19 still apply.
diff --git a/frontend/package.json b/frontend/package.json
index f9c86bc..03578dc 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,7 +1,7 @@
 {
   "name": "switchbay-frontend",
   "private": true,
-  "version": "0.12.19",
+  "version": "0.13.0",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/frontend/src/widgets/embed/CeAtlasEmbed.tsx b/frontend/src/widgets/embed/CeAtlasEmbed.tsx
index 595b1c9..797c2b5 100644
--- a/frontend/src/widgets/embed/CeAtlasEmbed.tsx
+++ b/frontend/src/widgets/embed/CeAtlasEmbed.tsx
@@ -113,7 +113,7 @@ export default function CeAtlasEmbed() {
           <pre>{state.message}</pre>
           <p className="sy-ce-atlas-embed-hint">
             Dual-mount session: shell hosts CE Pages|Files; this pane is
-            canvas-only. See docs/CE-EMBED-HOOK.md.
+            canvas-only. See docs/architecture.md.
           </p>
         </div>
       )}
diff --git a/frontend/src/widgets/embed/ProxiedSkillPanel.tsx b/frontend/src/widgets/embed/ProxiedSkillPanel.tsx
index deb5679..b0bbbd6 100644
--- a/frontend/src/widgets/embed/ProxiedSkillPanel.tsx
+++ b/frontend/src/widgets/embed/ProxiedSkillPanel.tsx
@@ -21,7 +21,7 @@ import {
  * 5. Tear down (clear root + remove injected scripts) before soft-reload
  *    or unmount to avoid duplicate roots/listeners.
  *
- * JSON responses keep the pretty-print path. No nested frames (ADR-004 / 004b).
+ * JSON responses keep the pretty-print path. No nested frames (see docs/architecture.md).
  */
 
 export type SkillEmbedKind = "ce" | "okstratr";
diff --git a/frontend/src/widgets/embed/ceEmbedBootstrap.ts b/frontend/src/widgets/embed/ceEmbedBootstrap.ts
index 79898f8..d91dc23 100644
--- a/frontend/src/widgets/embed/ceEmbedBootstrap.ts
+++ b/frontend/src/widgets/embed/ceEmbedBootstrap.ts
@@ -5,7 +5,7 @@
  * CE static modules from `/embed/ce/static/…` and run a Switchbay stub that
  * mirrors `main.js` without Sidebar / filebrowser chrome.
  *
- * CE hook (for CE Benchmarker) — see docs/CE-EMBED-HOOK.md:
+ * CE hook (for CE Benchmarker) — see docs/architecture.md:
  *   window.CEEmbed.mount(container, {
  *     embed: true,
  *     dataUrl: "/embed/ce/data.json",
diff --git a/frontend/src/widgets/embed/ceEmbedSession.ts b/frontend/src/widgets/embed/ceEmbedSession.ts
index 47525ed..aa31a6d 100644
--- a/frontend/src/widgets/embed/ceEmbedSession.ts
+++ b/frontend/src/widgets/embed/ceEmbedSession.ts
@@ -9,7 +9,7 @@
  * Prefer window.CEEmbed.create/mount when CE ships dual-mount embed mode;
  * stub path below coordinates Sidebar + AtlasViewer until then.
  *
- * See docs/CE-EMBED-HOOK.md.
+ * See docs/architecture.md.
  */
 
 import {
diff --git a/frontend/src/widgets/embed/embedMount.ts b/frontend/src/widgets/embed/embedMount.ts
index b56a5cd..f65d21b 100644
--- a/frontend/src/widgets/embed/embedMount.ts
+++ b/frontend/src/widgets/embed/embedMount.ts
@@ -1,7 +1,7 @@
 /**
  * Embed v2 same-document mount helpers (no iframe).
  *
- * Mount algorithm (see docs/ADR-004b-embed-v2-same-document-mount.md):
+ * Mount algorithm (see docs/architecture.md):
  * 1. Tear down prior mount (clear panel root + remove injected <script> nodes).
  * 2. fetch(`/embed/{ce|okstratr}/…`) for proxied HTML.
  * 3. rewriteHtmlUrls → absolute `/embed/…` asset paths.
diff --git a/pyproject.toml b/pyproject.toml
index 3c000c3..64efa8d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "switchbay"
-version = "0.12.19"
+version = "0.13.0"
 description = "Local single-user workbench over knowledge bases — a driven second brain."
 requires-python = ">=3.11"
 authors = [{ name = "Benjamin Smith" }]
diff --git a/src/switchbay/__init__.py b/src/switchbay/__init__.py
index 998a2e4..70a9c1b 100644
--- a/src/switchbay/__init__.py
+++ b/src/switchbay/__init__.py
@@ -4,7 +4,7 @@
 # checker both read this, so drift here makes a current install look
 # stale and offers an "update" to a release it is already past.
 # tests/unit/test_version_sync.py fails the build if the two diverge.
-__version__ = "0.12.19"
+__version__ = "0.13.0"
 
 # Use the OS certificate store for HTTPS (corporate TLS proxies, custom
 # CAs). Must run before any aiohttp ClientSession creates an SSL context
diff --git a/src/switchbay/daemon.py b/src/switchbay/daemon.py
index a277b1b..b928aeb 100644
--- a/src/switchbay/daemon.py
+++ b/src/switchbay/daemon.py
@@ -4381,7 +4381,7 @@ async def handle_ingest_drain(request: web.Request) -> web.Response:
     """Drain CE-queued ``.workbench/ingest-runs/*.json``.
 
     Prefer deterministic ``local_ingest``; escalate to rail LLM only when
-    run metadata opts in (see ADR-007). Returns
+    run metadata opts in (see ``docs/architecture.md``). Returns
     ``{drained, skipped, errors, …}``.
     """
     summary = await ingest_run_drain.drain_once(request.app)
diff --git a/src/switchbay/ingest_run_drain.py b/src/switchbay/ingest_run_drain.py
index de89dcc..683f423 100644
--- a/src/switchbay/ingest_run_drain.py
+++ b/src/switchbay/ingest_run_drain.py
@@ -5,7 +5,7 @@
 ``vault/raw/`` and writes ``.workbench/ingest-runs/<run_id>.json`` with
 ``status: "queued"`` — it does not run ``local_ingest`` or seat an LLM.
 Switchbay owns deterministic CE ingest + skill/LLM execution (same
-pattern as ``pack_run_drain`` / ADR-006).
+pattern as ``pack_run_drain``; see ``docs/architecture.md``).
 
 Default path: deterministic ``local_ingest`` (via ``ce_tools._ce_ingest``)
 for normal vault sources. Escalate to ``_dispatch_chat`` only when the
diff --git a/uv.lock b/uv.lock
index a3705a0..bfbf92d 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2515,7 +2515,7 @@ wheels = [
 
 [[package]]
 name = "switchbay"
-version = "0.12.19"
+version = "0.13.0"
 source = { virtual = "." }
 dependencies = [
     { name = "aiohttp" },