From 4908a801fc52cd27f5a9c845a37e796d9010e671 Mon Sep 17 00:00:00 2001
From: benjsmith <benjamincharlessmith@gmail.com>
Date: Tue, 29 Sep 2026 21:03:03 +0000
Subject: [PATCH 1/9] docs: v0.13.0 release notes + embed architecture cutover
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bump to 0.13.0 (pyproject, __init__, frontend). CHANGELOG +
docs/releases/v0.13.0.md cover Phase 4a reverse-proxy, Embed v2
same-document mount, dual-mount Graph, core-skills auto-start,
okstratr harness Settings client, and pack/ingest drain —
feature-preserving vs v0.12.19. Refresh ADR-004/004b/005 and
CE-EMBED-HOOK for shipped CEEmbed; cite CE v1.9.0 / okstratr v0.2.0 /
CM v0.8.4. Docs + version bump only — no tag.

Signed-off-by: benjsmith <benjamincharlessmith@gmail.com>
---
 CHANGELOG.md                                  |  64 ++++++++++
 docs/ADR-004-same-origin-embed-proxy.md       |  10 +-
 docs/ADR-004b-embed-v2-same-document-mount.md |   2 +-
 ...DR-005-okstratr-harness-registry-client.md |   2 +-
 docs/CE-EMBED-HOOK.md                         |  13 ++-
 docs/enterprise.md                            |   2 +-
 docs/releases/v0.13.0.md                      | 109 ++++++++++++++++++
 frontend/package.json                         |   2 +-
 pyproject.toml                                |   2 +-
 src/switchbay/__init__.py                     |   2 +-
 10 files changed, 196 insertions(+), 12 deletions(-)
 create mode 100644 docs/releases/v0.13.0.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6dbe696..fd4fe1c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,70 @@
 Human-curated release notes. Earlier 0.9.x notes also live on the
 [GitHub releases](https://github.com/benjsmith/switchbay/releases) page.
 
+## 2026-09-29 — v0.13.0
+
+**Migration:** none (feature-preserving vs v0.12.19 architecture cutover).
+**Breaking:** none for wiki/vault format. After pull, run `make refresh BUILD=1`
+and hard-reload the PWA. No new VSIX. Do **not** tag from the docs PR alone.
+
+Architecture cutover under the skill-shell import charter: Switchbay
+**same-origin reverse-proxies** CE + okstratr (no iframes), mounts skill UIs
+same-document (Embed v2), dual-mounts CE sidebar + Graph canvas, auto-starts
+core skills, and becomes a thin client over okstratr’s harness registry.
+Built-in Graph / Agents / filebrowser remain until the parity checklist is
+green (**migrate-before-thinning**).
+
+Skill pins for this wave (tags pending docs merges):
+
+| Skill | Version | Notes |
+|---|---|---|
+| curiosity-engine | **v1.9.0** (pending) | tip `3018580`; CEEmbed dual-mount + IndexedDB cache + soft-park |
+| okstratr | **v0.2.0** (pending) | hosted proxy + registry SSOT + observer desk UX |
+| curiosity-merge | **v0.8.4** (pending) | Phase 3 installer / UI-boundary contract |
+
+See [release notes](docs/releases/v0.13.0.md), [ADR-004](docs/ADR-004-same-origin-embed-proxy.md),
+[ADR-004b](docs/ADR-004b-embed-v2-same-document-mount.md),
+[ADR-005](docs/ADR-005-okstratr-harness-registry-client.md),
+[CE-EMBED-HOOK](docs/CE-EMBED-HOOK.md), [ADR-006](docs/ADR-006-ce-pack-run-drain.md),
+[ADR-007](docs/ADR-007-ce-ingest-run-drain.md).
+
+### Added
+
+- **Phase 4a same-origin embed reverse-proxy** — `/embed/ce/*` → `:8766`,
+  `/embed/okstratr/*` → `:8767`; loopback-only upstreams; inject
+  `X-CE-Host` / `X-Okstratr-Host: switchbay`. Feature flag
+  `proxied_skill_embeds` (Settings) switches Graph → CE / Agents → okstratr;
+  daemon proxy is always on. Built-ins **not** deleted.
+- **Embed v2 same-document mount** — fetch proxied HTML when core-skills
+  healthy; rewrite assets; execute scripts in-panel; wait chrome via
+  `GET /api/core-skills/status` (`starting` / `unhealthy` / `building_wiki` /
+  `live`). Soft-reload on `sy:files-changed`.
+- **Dual-mount CE Graph** — shell-left `CeSidebarSlot` (Pages|Files persists
+  across Graph/Agents/Editor) + Graph-pane `CeAtlasEmbed` canvas; shared
+  `ceEmbedSession`; prefers `window.CEEmbed.create` when present; soft-park
+  atlas across tab switches; loads `atlas-cache.js` for cold Graph cache.
+- **Core-skills auto-start** — always start CE + okstratr with the shell;
+  rail `host_notify`; `OKSTRATR_HOSTED=switchbay` on supervised serve.
+- **Settings → okstratr harness registry** — thin client (`/api/okstratr/harness*`);
+  no second Switchbay allowlist (ADR-005).
+- **Pack / ingest drain** — drain CE `.workbench/pack-runs/` into rail LLM
+  (ADR-006); drain ingest-runs via `local_ingest` / prefer CE drop-ingest
+  endpoint (ADR-007).
+- **Sandbox roots** — allow `/workspace` (+ env roots) in home-gate (ADR-008).
+
+### Fixed / polish (embed wave)
+
+- Keep CE atlas warm across Graph tab switches; dual-mount sidebar bugs after
+  Graph mount; gzip large JSON + guard soft-remount during CE load; retarget
+  viewer on workspace switch; serve `data.json` fast / enrich off hot path;
+  vault missing-extract UX from `vault.db`.
+
+### Unchanged (feature-preserving)
+
+- v0.12.19 Curate / desks / Web / Comms / watch-folder / Zen behavior remains
+  the product baseline. This release is the embed/architecture cutover on top
+  of that gate — not a revert of Graph/Agents chrome.
+
 ## 2026-09-20 — v0.12.19
 
 No wiki/vault format migration. Review Web, Comms, and watch-folder behavior changes below. After updating, run `make refresh BUILD=1` and hard-reload the PWA. No new VSIX.
diff --git a/docs/ADR-004-same-origin-embed-proxy.md b/docs/ADR-004-same-origin-embed-proxy.md
index 84e5e29..9c1a4a5 100644
--- a/docs/ADR-004-same-origin-embed-proxy.md
+++ b/docs/ADR-004-same-origin-embed-proxy.md
@@ -45,11 +45,17 @@ frames**.
 ## Consequences
 
 - Dev Vite must proxy `/embed` to the daemon (`vite.config.ts`).
-- CE and okstratr should honor public-base + `X-*-Host` (okstratr
-  Phase 1a `public_base.py`; CE equivalent TBD).
+- CE and okstratr honor public-base + `X-*-Host` (okstratr ADR-004 /
+  `OKSTRATR_PUBLIC_BASE`; CE ADR-001 / `CE_PUBLIC_BASE` — both shipped).
 - Full atlas/observer chrome parity is gated by the parity checklist
   before any Switchbay duplicate deletion (Phase 4b+).
+  **Migrate-before-thinning:** built-in Graph/Agents/filebrowser stay
+  (v0.13.0 does not delete them).
 - WebSocket upgrade through the embed proxy is deferred; HTTP(S) first.
+- Status as of **v0.13.0:** Phase 4a proxy + Embed v2 mount + dual-mount
+  Graph + core-skills auto-start + Settings harness client are on `main`.
+  `proxied_skill_embeds` remains a Settings opt-in (default false) so the
+  built-in surfaces stay the safe default until operators flip the flag.
 
 ## Alternatives considered
 
diff --git a/docs/ADR-004b-embed-v2-same-document-mount.md b/docs/ADR-004b-embed-v2-same-document-mount.md
index ec018ef..9bd6572 100644
--- a/docs/ADR-004b-embed-v2-same-document-mount.md
+++ b/docs/ADR-004b-embed-v2-same-document-mount.md
@@ -1,6 +1,6 @@
 # ADR-004b: Embed v2 — same-document interactive mount
 
-- **Status:** Accepted (Embed v2)
+- **Status:** Accepted (Embed v2) — shipped in Switchbay **v0.13.0**
 - **Date:** 2026-09-19
 - **Parent:** [ADR-004](./ADR-004-same-origin-embed-proxy.md)
 - **Contract:** umbrella `CONTRACT-EMBED-V2.md`
diff --git a/docs/ADR-005-okstratr-harness-registry-client.md b/docs/ADR-005-okstratr-harness-registry-client.md
index 2b2b095..7b0a319 100644
--- a/docs/ADR-005-okstratr-harness-registry-client.md
+++ b/docs/ADR-005-okstratr-harness-registry-client.md
@@ -2,7 +2,7 @@
 
 - **Status:** Accepted
 - **Date:** 2026-09-19
-- **Parent:** [ADR-004](./ADR-004-same-origin-embed-proxy.md) (Settings TODO)
+- **Parent:** [ADR-004](./ADR-004-same-origin-embed-proxy.md) (Settings thin client — **done** in v0.13.0)
 - **Deciders:** Ben / skill-shell rationalization charter
 
 ## Context
diff --git a/docs/CE-EMBED-HOOK.md b/docs/CE-EMBED-HOOK.md
index 146ada6..9472c05 100644
--- a/docs/CE-EMBED-HOOK.md
+++ b/docs/CE-EMBED-HOOK.md
@@ -1,6 +1,6 @@
 # CE embed hook — dual mounts (shell sidebar + Graph canvas)
 
-**Date:** 2026-09-27 (updated)  
+**Date:** 2026-09-27 (updated 2026-09-29 for v0.13.0 / CE v1.9.0)  
 **Owners:** Switchbay (mount scaffolding) · CE Benchmarker (CE `embed` mode)
 
 ## Goal
@@ -34,7 +34,11 @@
 WikiPane + Files|Sources as before. Workspace remount calls
 `resetCeEmbedSession()`.
 
-## CE hook to add (CE Benchmarker)
+## CE hook (landed in curiosity-engine v1.9.0)
+
+Prefer `window.CEEmbed.create` from `/embed/ce/static/embed.js`. Switchbay
+`ceEmbedBootstrap` / `ceEmbedSession` call it when present; the local stub
+path below remains a fallback for older CE tips.
 
 ```js
 window.CEEmbed = {
@@ -72,8 +76,9 @@ Requirements:
 - Honor `CE_PUBLIC_BASE` / `opts.dataUrl`.
 - Optional: `mount({ mounts: { sidebar, canvas } })` one-shot still OK.
 
-Until `CEEmbed.create` exists, Switchbay’s stub loads CE static modules and
-calls `Sidebar.init` + `AtlasViewer`/`Graph`/`GraphSearch` itself.
+When `CEEmbed.create` is missing (older CE), Switchbay’s stub loads CE
+static modules and calls `Sidebar.init` + `AtlasViewer`/`Graph`/`GraphSearch`
+itself. With CE **v1.9.0**+, prefer the real hook (IndexedDB cache + soft-park).
 
 ## Verify
 
diff --git a/docs/enterprise.md b/docs/enterprise.md
index 22fd22f..2bf4296 100644
--- a/docs/enterprise.md
+++ b/docs/enterprise.md
@@ -205,7 +205,7 @@ normal-sensitivity thread stays pending until explicit Approve, and
 confirm Revoke stops a subsequent poll. Do not treat a green unit suite
 as tenant certification.
 
-Release notes for this cut: [`releases/v0.12.19.md`](releases/v0.12.19.md).
+Release notes: [`releases/v0.13.0.md`](releases/v0.13.0.md) (embed/architecture cutover); prior gate [`releases/v0.12.19.md`](releases/v0.12.19.md).
 
 ## SentinelOne / EDR
 
diff --git a/docs/releases/v0.13.0.md b/docs/releases/v0.13.0.md
new file mode 100644
index 0000000..4a6685f
--- /dev/null
+++ b/docs/releases/v0.13.0.md
@@ -0,0 +1,109 @@
+# v0.13.0 — 2026-09-29
+
+**Migration:** no wiki/vault format changes. **Architecture cutover** under the
+skill-shell import charter — feature-preserving vs **v0.12.19**. After pull:
+
+```sh
+git pull
+make refresh BUILD=1
+```
+
+Hard-reload the PWA. No new VSIX. Do **not** treat this docs PR as a tag.
+
+## What changed
+
+Switchbay now **hosts** curiosity-engine (Graph / filebrowser / atlas) and
+okstratr (Agents / observer) through a **same-origin reverse proxy** and
+**same-document** mount — **no iframes**. Core skills **auto-start** with the
+daemon. Settings is a **thin client** over okstratr’s harness registry.
+CE pack-runs and ingest-runs **drain** into Switchbay (rail LLM /
+`local_ingest`).
+
+**Migrate-before-thinning:** built-in GraphTab, AgentDashboardTab, and
+filebrowser stay until the umbrella parity checklist is green. Turning on
+Settings → **Proxied skill embeds** switches Graph → CE canvas and Agents →
+okstratr observer; turning it off restores built-ins.
+
+### Skill pins (tags pending)
+
+| Skill | Version | Role in this release |
+|---|---|---|
+| [curiosity-engine](https://github.com/benjsmith/curiosity-engine) | **v1.9.0** (pending; tip `3018580`) | `/embed/ce` viewer; `CEEmbed.create` dual-mount; IndexedDB atlas cache; soft-park |
+| [okstratr](https://github.com/benjsmith/okstratr) | **v0.2.0** (pending) | `/embed/okstratr` observer; registry SSOT; host_notify; `OKSTRATR_PUBLIC_BASE` |
+| [curiosity-merge](https://github.com/benjsmith/curiosity-merge) | **v0.8.4** (pending) | Headless federation; Phase 3 installer / UI-boundary contract |
+
+okbay remains deferred.
+
+### Phase 4a — reverse proxy
+
+- Daemon always proxies `/embed/ce/*` → `127.0.0.1:8766` and
+  `/embed/okstratr/*` → `127.0.0.1:8767` (loopback-only;
+  `SWITCHBAY_*_UPSTREAM` overrides).
+- Injects `X-CE-Host: switchbay` / `X-Okstratr-Host: switchbay`.
+- Vite dev proxies `/embed` to the daemon.
+- ADR: [`ADR-004-same-origin-embed-proxy.md`](../ADR-004-same-origin-embed-proxy.md).
+
+### Embed v2 — same-document mount
+
+- Poll `GET /api/core-skills/status`; wait chrome while `starting` /
+  `building_wiki`; mount only when healthy.
+- Fetch proxied HTML, rewrite asset URLs, inject markup, **execute** scripts
+  (not script-stripped Phase 4a proof).
+- Soft-reload on wiki `files_changed`; tear down scripts on unmount.
+- ADR: [`ADR-004b-embed-v2-same-document-mount.md`](../ADR-004b-embed-v2-same-document-mount.md).
+
+### Dual-mount Graph (CE sidebar + canvas)
+
+- Shell left column: CE Pages|Files (`CeSidebarSlot`) persists across
+  Graph / Agents / Editor for CE-backed workspaces when proxied embeds are on.
+- Graph pane: CE atlas canvas only (`CeAtlasEmbed`); soft-park on leave for
+  instant return; `atlas-cache.js` + workspace key for cold Graph cache.
+- Prefers `window.CEEmbed.create` (CE v1.9.0); session singleton survives
+  Graph unmount.
+- Doc: [`CE-EMBED-HOOK.md`](../CE-EMBED-HOOK.md).
+
+### Core-skills auto-start + host_notify
+
+- CE + okstratr always auto-start with the shell (Ben lock).
+- Supervised okstratr serve sets `OKSTRATR_HOSTED=switchbay`.
+- Rail receives okstratr `host_notify` envelopes.
+
+### Settings → okstratr harness registry
+
+- `/api/okstratr/harness*` thin client; no second Switchbay allowlist.
+- ADR: [`ADR-005-okstratr-harness-registry-client.md`](../ADR-005-okstratr-harness-registry-client.md).
+
+### Pack + ingest drain
+
+- CE queues pack-runs / ingest-runs under `.workbench/`; Switchbay drains
+  them (rail LLM / `local_ingest`, prefer CE drop-ingest endpoint).
+- ADRs: [`ADR-006`](../ADR-006-ce-pack-run-drain.md),
+  [`ADR-007`](../ADR-007-ce-ingest-run-drain.md).
+
+## What did **not** change
+
+- v0.12.19 Curate settlement, desk live-worker caps, Web default-off,
+  Comms metadata-first, watch folders, Zen/rail geometry — still the
+  behavior baseline ([v0.12.19 notes](v0.12.19.md),
+  [import gate](../handoff/2026-09-20-skill-shell-parity.md)).
+- Graph and Agents are **not** removed; proxied mode is opt-in via Settings.
+
+## After pull
+
+```sh
+make refresh BUILD=1
+```
+
+Enable **Proxied skill embeds** in Settings to exercise Graph→CE /
+Agents→okstratr. Confirm core-skills status goes `live`, Graph paints from
+cache on hard-reload, and Agents shows the okstratr observer (no nested
+iframe).
+
+## Validation (expected)
+
+- Unit: embed mount / URL rewrite / status banner; version sync
+  (`test_version_sync` — 0.13.0 across pyproject / `__init__` / frontend).
+- Manual: proxied on/off round-trip; dual-mount Pages persist on Agents;
+  Graph leave→return instant; pack/ingest drain smoke on a CE workspace.
+
+Live iCloud / enterprise-tenant limits from v0.12.19 still apply.
diff --git a/frontend/package.json b/frontend/package.json
index f9c86bc..03578dc 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,7 +1,7 @@
 {
   "name": "switchbay-frontend",
   "private": true,
-  "version": "0.12.19",
+  "version": "0.13.0",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/pyproject.toml b/pyproject.toml
index 3c000c3..64efa8d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "switchbay"
-version = "0.12.19"
+version = "0.13.0"
 description = "Local single-user workbench over knowledge bases — a driven second brain."
 requires-python = ">=3.11"
 authors = [{ name = "Benjamin Smith" }]
diff --git a/src/switchbay/__init__.py b/src/switchbay/__init__.py
index 998a2e4..70a9c1b 100644
--- a/src/switchbay/__init__.py
+++ b/src/switchbay/__init__.py
@@ -4,7 +4,7 @@
 # checker both read this, so drift here makes a current install look
 # stale and offers an "update" to a release it is already past.
 # tests/unit/test_version_sync.py fails the build if the two diverge.
-__version__ = "0.12.19"
+__version__ = "0.13.0"
 
 # Use the OS certificate store for HTTPS (corporate TLS proxies, custom
 # CAs). Must run before any aiohttp ClientSession creates an SSL context

From f8a16aec29b6a68847becf271b5a209e0abe7de4 Mon Sep 17 00:00:00 2001
From: benjsmith <benjamincharlessmith@gmail.com>
Date: Tue, 29 Sep 2026 21:13:21 +0000
Subject: [PATCH 2/9] docs: drop okbay asides from v0.13.0 release notes

Remove deferred/okbay callouts from the docs PR so release notes and
related charter docs do not name okbay. No CHANGELOG 0.13 change (none present).

Signed-off-by: benjsmith <benjamincharlessmith@gmail.com>
---
 docs/ADR-005-okstratr-harness-registry-client.md | 5 -----
 docs/handoff/2026-09-20-skill-shell-parity.md    | 8 ++++----
 docs/releases/v0.12.19.md                        | 4 ++--
 docs/releases/v0.13.0.md                         | 2 --
 4 files changed, 6 insertions(+), 13 deletions(-)

diff --git a/docs/ADR-005-okstratr-harness-registry-client.md b/docs/ADR-005-okstratr-harness-registry-client.md
index 7b0a319..27c4d17 100644
--- a/docs/ADR-005-okstratr-harness-registry-client.md
+++ b/docs/ADR-005-okstratr-harness-registry-client.md
@@ -35,11 +35,6 @@ Switchbay Settings must become the write path.
    LLM panels remain as **rail** surfaces and are labeled as not the
    desk/agent SSOT.
 
-4. **okbay** mirrors the same thin-client pattern (doc note; full UI
-   follow-up) — see okbay `docs/HERDR-AND-REGISTRY.md` and Switchbay
-   `/api/okstratr/host-notify` as the precedent for path-native okstratr
-   integration.
-
 ## Consequences
 
 - okstratr must be healthy (core-skill supervisor) for Settings toggles
diff --git a/docs/handoff/2026-09-20-skill-shell-parity.md b/docs/handoff/2026-09-20-skill-shell-parity.md
index ab667a1..ca363d6 100644
--- a/docs/handoff/2026-09-20-skill-shell-parity.md
+++ b/docs/handoff/2026-09-20-skill-shell-parity.md
@@ -2,10 +2,10 @@
 
 **Charter position:** Switchbay v0.12.19 is a **behavior/performance gate under
 the import charter**, not a source-parity, source-merge, or implementation
-plan. Switchbay and okbay import and invoke the CE, curiosity-merge (CM), and
-okstratr skills through their public skill contracts. They must **not vendor
+plan. Switchbay imports and invokes the CE, curiosity-merge (CM), and
+okstratr skills through their public skill contracts. It must **not vendor
 their servers, merge their source, copy their internals, or re-implement them
-for either shell**. The shell owns its adapter/UI policy; the skills remain
+for the shell**. The shell owns its adapter/UI policy; the skills remain
 the owners of their behavior and services.
 
 This document records the v0.12.19 release behavior matrix and the additional
@@ -75,6 +75,6 @@ are **additional import-boundary acceptance gates**; the v0.12.19 release
 tests above do not certify the three-skill integration.
 
 Do not use this matrix as permission to merge CE/CM/okstratr source into
-Switchbay or okbay, vendor their servers, or grow shell-specific rewrites.
+Switchbay, vendor their servers, or grow shell-specific rewrites.
 Any retirement of pre-import duplicate shell behavior is a separate decision
 after the imported-skill behavior/performance gate passes.
diff --git a/docs/releases/v0.12.19.md b/docs/releases/v0.12.19.md
index a618a2b..65a52d7 100644
--- a/docs/releases/v0.12.19.md
+++ b/docs/releases/v0.12.19.md
@@ -68,8 +68,8 @@ Then hard-reload the installed PWA. If slideshow PDF or CLI tools still miss Nod
 Installed curiosity-engine integration checks run when that optional dependency is present. Cloud-state fixtures and the native macOS API check do not replace a live iCloud or enterprise-tenant deployment test.
 
 Skill-shell rationalization is an **import-charter behavior/performance gate**,
-not source parity: Switchbay and okbay import the CE, curiosity-merge, and
-okstratr skills through public contracts. They do not vendor, merge, copy, or
+not source parity: Switchbay imports the CE, curiosity-merge, and
+okstratr skills through public contracts. It does not vendor, merge, copy, or
 re-implement those servers for a shell. The gate pins CE skill
 `5d2b967558dd052c62b23fbc03217b1ac2a18d5a` and uses BioCure wiki fixture
 `biocure-confirm-v1-query-5b9711895` at freeze tip `5b9711895`; the latter is a
diff --git a/docs/releases/v0.13.0.md b/docs/releases/v0.13.0.md
index 4a6685f..e34b1e3 100644
--- a/docs/releases/v0.13.0.md
+++ b/docs/releases/v0.13.0.md
@@ -32,8 +32,6 @@ okstratr observer; turning it off restores built-ins.
 | [okstratr](https://github.com/benjsmith/okstratr) | **v0.2.0** (pending) | `/embed/okstratr` observer; registry SSOT; host_notify; `OKSTRATR_PUBLIC_BASE` |
 | [curiosity-merge](https://github.com/benjsmith/curiosity-merge) | **v0.8.4** (pending) | Headless federation; Phase 3 installer / UI-boundary contract |
 
-okbay remains deferred.
-
 ### Phase 4a — reverse proxy
 
 - Daemon always proxies `/embed/ce/*` → `127.0.0.1:8766` and

From 9853fe91c753c6b48bf1be49b5ef7be145f0b5c2 Mon Sep 17 00:00:00 2001
From: benjsmith <benjamincharlessmith@gmail.com>
Date: Tue, 29 Sep 2026 21:16:15 +0000
Subject: [PATCH 3/9] docs: drop internal ADRs from public v0.13.0 tip

Remove ADR-004/004b/005/006/007/008 and CE-EMBED-HOOK (dev decision
records) from the public tree. Keep release notes + CHANGELOG; rewrite
links to not require ADRs. Gitignore ADR/CE-EMBED docs and the local
skill-shell-rationalization/ umbrella so they stay out of public tips.

Signed-off-by: benjsmith <benjamincharlessmith@gmail.com>
---
 .gitignore                                    |  5 ++
 CHANGELOG.md                                  | 15 ++--
 docs/ADR-004-same-origin-embed-proxy.md       | 66 --------------
 docs/ADR-004b-embed-v2-same-document-mount.md | 78 ----------------
 ...DR-005-okstratr-harness-registry-client.md | 52 -----------
 docs/ADR-006-ce-pack-run-drain.md             | 54 -----------
 docs/ADR-007-ce-ingest-run-drain.md           | 60 -------------
 docs/ADR-008-workspace-sandbox-roots.md       | 25 ------
 docs/CE-EMBED-HOOK.md                         | 89 -------------------
 docs/releases/v0.13.0.md                      |  6 --
 10 files changed, 10 insertions(+), 440 deletions(-)
 delete mode 100644 docs/ADR-004-same-origin-embed-proxy.md
 delete mode 100644 docs/ADR-004b-embed-v2-same-document-mount.md
 delete mode 100644 docs/ADR-005-okstratr-harness-registry-client.md
 delete mode 100644 docs/ADR-006-ce-pack-run-drain.md
 delete mode 100644 docs/ADR-007-ce-ingest-run-drain.md
 delete mode 100644 docs/ADR-008-workspace-sandbox-roots.md
 delete mode 100644 docs/CE-EMBED-HOOK.md

diff --git a/.gitignore b/.gitignore
index 088f80a..58f9dc2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -51,6 +51,11 @@ docs/*-design.md
 docs/product-pilot-judge-results-*.md
 docs/product-pilot-*.md
 docs/vscode-plugin.md
+docs/ADR-*.md
+docs/CE-EMBED-HOOK.md
+
+# ── local skill-shell umbrella workspace (never ship) ──
+skill-shell-rationalization/
 
 # ── machine-level admin policy drop-in (never commit a live copy) ──
 /admin.json
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fd4fe1c..6f4d695 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,11 +24,7 @@ Skill pins for this wave (tags pending docs merges):
 | okstratr | **v0.2.0** (pending) | hosted proxy + registry SSOT + observer desk UX |
 | curiosity-merge | **v0.8.4** (pending) | Phase 3 installer / UI-boundary contract |
 
-See [release notes](docs/releases/v0.13.0.md), [ADR-004](docs/ADR-004-same-origin-embed-proxy.md),
-[ADR-004b](docs/ADR-004b-embed-v2-same-document-mount.md),
-[ADR-005](docs/ADR-005-okstratr-harness-registry-client.md),
-[CE-EMBED-HOOK](docs/CE-EMBED-HOOK.md), [ADR-006](docs/ADR-006-ce-pack-run-drain.md),
-[ADR-007](docs/ADR-007-ce-ingest-run-drain.md).
+See [release notes](docs/releases/v0.13.0.md).
 
 ### Added
 
@@ -48,11 +44,10 @@ See [release notes](docs/releases/v0.13.0.md), [ADR-004](docs/ADR-004-same-origi
 - **Core-skills auto-start** — always start CE + okstratr with the shell;
   rail `host_notify`; `OKSTRATR_HOSTED=switchbay` on supervised serve.
 - **Settings → okstratr harness registry** — thin client (`/api/okstratr/harness*`);
-  no second Switchbay allowlist (ADR-005).
-- **Pack / ingest drain** — drain CE `.workbench/pack-runs/` into rail LLM
-  (ADR-006); drain ingest-runs via `local_ingest` / prefer CE drop-ingest
-  endpoint (ADR-007).
-- **Sandbox roots** — allow `/workspace` (+ env roots) in home-gate (ADR-008).
+  no second Switchbay allowlist.
+- **Pack / ingest drain** — drain CE `.workbench/pack-runs/` into rail LLM;
+  drain ingest-runs via `local_ingest` / prefer CE drop-ingest endpoint.
+- **Sandbox roots** — allow `/workspace` (+ env roots) in home-gate.
 
 ### Fixed / polish (embed wave)
 
diff --git a/docs/ADR-004-same-origin-embed-proxy.md b/docs/ADR-004-same-origin-embed-proxy.md
deleted file mode 100644
index 9c1a4a5..0000000
--- a/docs/ADR-004-same-origin-embed-proxy.md
+++ /dev/null
@@ -1,66 +0,0 @@
-# ADR-004: Same-origin embed reverse-proxy (no iframes)
-
-- **Status:** Accepted (Phase 4a); Embed v2 mount → [ADR-004b](./ADR-004b-embed-v2-same-document-mount.md)
-- **Date:** 2026-09-18
-- **Deciders:** Ben / skill-shell rationalization charter
-
-## Context
-
-Switchbay hosts Graph (curiosity-engine atlas/wiki) and Agents (okstratr
-observer/desk) surfaces. Cross-origin iframes pointed at
-`127.0.0.1:8766` / `:8767` break hosted-mode control (okstratr HTML
-settings must hide when `host=switchbay`) and create an opaque nested
-browsing context.
-
-Charter locked decision #1: shells **same-origin reverse-proxy** skill
-daemons; in-app panels load first-party proxied routes — **not nested
-frames**.
-
-## Decision
-
-1. **Daemon reverse-proxy** (always on; independent of the UI flag):
-   - `/embed/ce/*` → `http://127.0.0.1:8766/*` (override:
-     `SWITCHBAY_CE_UPSTREAM`, must remain loopback)
-   - `/embed/okstratr/*` → `http://127.0.0.1:8767/*` (override:
-     `SWITCHBAY_OKSTRATR_UPSTREAM`, must remain loopback)
-   - Upstream allowlist is **loopback-only** (`127.0.0.1` / `::1` /
-     `localhost`). Non-loopback upstreams are rejected (502).
-   - Inject hosted-shell headers on every proxied request:
-     - `X-CE-Host: switchbay`
-     - `X-Okstratr-Host: switchbay`
-
-2. **No iframes** for Graph/Agents skill surfaces. Feature flag
-   `proxied_skill_embeds` (default **false**) switches Graph → CE panel
-   and Agents → okstratr panel that navigate `/embed/*` via same-origin
-   `fetch` + same-document rendering. Phase 4a was script-stripped HTML / JSON; Embed v2 (ADR-004b) executes skill scripts in-panel.
-   Built-in GraphTab / AgentDashboardTab / filebrowser remain the
-   default and are **not deleted**.
-
-3. **Settings → okstratr registry (done — ADR-005).** Switchbay settings
-   is a thin client over okstratr's harness/model registry
-   (`harnesses.toml` via `/api/okstratr/harness…` / embed proxy). No
-   second Switchbay allowlist. See
-   [ADR-005](./ADR-005-okstratr-harness-registry-client.md).
-
-## Consequences
-
-- Dev Vite must proxy `/embed` to the daemon (`vite.config.ts`).
-- CE and okstratr honor public-base + `X-*-Host` (okstratr ADR-004 /
-  `OKSTRATR_PUBLIC_BASE`; CE ADR-001 / `CE_PUBLIC_BASE` — both shipped).
-- Full atlas/observer chrome parity is gated by the parity checklist
-  before any Switchbay duplicate deletion (Phase 4b+).
-  **Migrate-before-thinning:** built-in Graph/Agents/filebrowser stay
-  (v0.13.0 does not delete them).
-- WebSocket upgrade through the embed proxy is deferred; HTTP(S) first.
-- Status as of **v0.13.0:** Phase 4a proxy + Embed v2 mount + dual-mount
-  Graph + core-skills auto-start + Settings harness client are on `main`.
-  `proxied_skill_embeds` remains a Settings opt-in (default false) so the
-  built-in surfaces stay the safe default until operators flip the flag.
-
-## Alternatives considered
-
-| Option | Why not |
-|--------|---------|
-| Cross-origin iframe to :8766/:8767 | Opaque origin; hosted settings leak; charter forbid |
-| Same-origin iframe to `/embed/*` | Still a nested frame; charter: no iframes |
-| Delete built-in Graph/Agents now | Violates parity checklist / dual-stack gate |
diff --git a/docs/ADR-004b-embed-v2-same-document-mount.md b/docs/ADR-004b-embed-v2-same-document-mount.md
deleted file mode 100644
index 9bd6572..0000000
--- a/docs/ADR-004b-embed-v2-same-document-mount.md
+++ /dev/null
@@ -1,78 +0,0 @@
-# ADR-004b: Embed v2 — same-document interactive mount
-
-- **Status:** Accepted (Embed v2) — shipped in Switchbay **v0.13.0**
-- **Date:** 2026-09-19
-- **Parent:** [ADR-004](./ADR-004-same-origin-embed-proxy.md)
-- **Contract:** umbrella `CONTRACT-EMBED-V2.md`
-
-## Context
-
-Phase 4a (`ProxiedSkillPanel`) fetched `/embed/*` HTML and injected a
-**script-stripped** body. That proved the reverse-proxy path but left Graph
-and Agents inert (no pan/zoom, no desk controls). Charter + ADR-004 forbid
-`<iframe>` / nested frames for skill surfaces.
-
-CE and okstratr already honor `CE_PUBLIC_BASE` / `OKSTRATR_PUBLIC_BASE`
-(`_/embed/ce_`, `_/embed/okstratr_`) and inject `window.*_PUBLIC_BASE` so
-API helpers resolve under the proxy. Relative asset tags (`static/main.js`,
-`observer.css`) still need rewriting when the HTML is mounted into a
-Switchbay panel rather than navigated as a top-level document.
-
-## Decision
-
-**Same-document microfrontend mount** (no nested browsing context):
-
-1. **Wait chrome first.** While the panel is open, poll
-   `GET /api/core-skills/status` (~2s). Banner states: `starting` /
-   `unhealthy` / `building_wiki` / `live`. Do **not** flash a full 502
-   error while the supervisor is still `starting` or `stopped` —
-   status chrome explains the wait (`suppressFetchError`).
-2. **Fetch** proxied HTML from `/embed/ce/…` or `/embed/okstratr/…` only
-   when the skill slice is `healthy` (`allowMount`).
-3. **Rewrite** relative / root-relative / loopback asset URLs onto the
-   public base (`frontend/src/widgets/embed/embedMount.ts`).
-4. **Extract** `<script>` tags (classic + `type=module`); inject remaining
-   markup (body + head stylesheets) into a dedicated panel root via
-   `innerHTML`.
-5. **Execute** scripts by `document.createElement("script")` + append
-   (with rewritten `src`, or inline `textContent`). Browsers never run
-   scripts inserted via `innerHTML` alone.
-6. **Tear down** before soft-reload (`sy:files-changed`) or unmount:
-   remove tracked script nodes and clear the panel root so listeners /
-   duplicate roots do not accumulate.
-7. **JSON** responses keep the pretty-print path (no script mount).
-
-Built-in `GraphTab` is **not** deleted (parity checklist / Ben lock).
-
-## Consequences
-
-- Interactive CE / okstratr chrome can run under `/embed/*` without iframes.
-- Skill UIs share the Switchbay document: global ID collisions and
-  `document`-level assumptions are residual risks; skills should prefer
-  scoped queries when possible.
-- **WebSocket upgrade** through the embed proxy remains deferred (HTTP
-  first). Live features that require WS may be limited until proxyed.
-- Unit tests cover URL rewrite, script extraction, and status-banner
-  mapping (`embedMount.test.ts`).
-
-## Alternatives considered
-
-| Option | Why not |
-|--------|---------|
-| Keep script-stripping | Inert UI; fails Embed v2 acceptance |
-| Same-origin `<iframe src="/embed/…">` | Nested frame; charter / ADR-004 forbid |
-| `srcdoc` iframe | Still a nested browsing context |
-| Shadow DOM isolation | Extra complexity; CE/okstratr expect light DOM + `getElementById` |
-
-## Mount algorithm (short)
-
-```
-poll status → if !healthy: banner only
-else:
-  teardown prior mount
-  html = fetch(/embed/…/)
-  { markup, scripts } = prepareEmbedHtml(html, publicBase, pagePath)
-  root.innerHTML = markup
-  for s in scripts: createElement(script); set src|text; append; await load
-on files_changed / unmount: teardown
-```
diff --git a/docs/ADR-005-okstratr-harness-registry-client.md b/docs/ADR-005-okstratr-harness-registry-client.md
deleted file mode 100644
index 27c4d17..0000000
--- a/docs/ADR-005-okstratr-harness-registry-client.md
+++ /dev/null
@@ -1,52 +0,0 @@
-# ADR-005: Settings → okstratr harness registry (SSOT client)
-
-- **Status:** Accepted
-- **Date:** 2026-09-19
-- **Parent:** [ADR-004](./ADR-004-same-origin-embed-proxy.md) (Settings thin client — **done** in v0.13.0)
-- **Deciders:** Ben / skill-shell rationalization charter
-
-## Context
-
-okstratr owns the harness+model registry (`~/.config/okstratr/harnesses.toml`
-via `GET/POST /api/harness…`). Charter: shells are **config UIs** over that
-registry — no second Switchbay allowlist. Hosted mode
-(`X-Okstratr-Host: switchbay`) already disables okstratr HTML settings, so
-Switchbay Settings must become the write path.
-
-## Decision
-
-1. **Thin client module** `switchbay.okstratr_harness`:
-   - Server-side calls loopback `SWITCHBAY_OKSTRATR_UPSTREAM`
-     (default `http://127.0.0.1:8767`) with hosted-shell header.
-   - Loopback guard reused from `embed_proxy` (non-loopback → 502).
-   - `normalize_registry()` maps okstratr `list_for_api` JSON; never
-     invents an allowlist.
-   - Browser may also hit same-origin `/embed/okstratr/api/harness…`.
-
-2. **Daemon routes** (shells/UI need not know embed paths):
-   - `GET  /api/okstratr/harness`
-   - `POST /api/okstratr/harness/enable`   `{ "id": "…" }`
-   - `POST /api/okstratr/harness/disable`  `{ "id": "…" }`
-   - `POST /api/okstratr/harness/set`      `{ "key": "…", "value": "…" }`
-   - `POST /api/okstratr/harness/reload`
-
-3. **Settings UI** — section **Harness registry · okstratr**: list rows,
-   enable/disable, set `harness.<id>.default_model`. Existing Pi / local
-   LLM panels remain as **rail** surfaces and are labeled as not the
-   desk/agent SSOT.
-
-## Consequences
-
-- okstratr must be healthy (core-skill supervisor) for Settings toggles
-  to succeed; UI surfaces a clear 502 when upstream is down.
-- No `harnesses.toml` (or equivalent) under Switchbay state dirs.
-- Pi harness (`/api/llm/harness`) and local LLM panels stay Switchbay-local
-  for rail chat; they must not claim desk registry ownership.
-
-## Alternatives considered
-
-| Option | Why not |
-|--------|---------|
-| Copy allowlist into Switchbay `app_settings` | Second SSOT; charter forbid |
-| Settings UI calls `:8767` cross-origin | Breaks hosted-mode headers / CORS |
-| Only document CLI (`okstratr harness …`) | Users need in-app toggles when HTML settings are hosted-off |
diff --git a/docs/ADR-006-ce-pack-run-drain.md b/docs/ADR-006-ce-pack-run-drain.md
deleted file mode 100644
index 5ff6929..0000000
--- a/docs/ADR-006-ce-pack-run-drain.md
+++ /dev/null
@@ -1,54 +0,0 @@
-# ADR-006: CE pack-queue → Switchbay rail LLM drain
-
-- **Status:** Accepted
-- **Date:** 2026-09-19
-- **Parent:** skill-shell rationalization (CE filebrowser packs Phase 2b)
-- **Deciders:** Ben / skill-shell rationalization charter
-
-## Context
-
-Curiosity Engine's proxied filebrowser accepts
-`POST /api/packs/<pack>/action/<action>` and, after sandbox checks,
-writes only:
-
-```text
-.workbench/pack-runs/<run_id>.json   # status: "queued"
-```
-
-It does **not** seat an LLM agent. Switchbay already has
-`handle_pack_action` which seats `_dispatch_chat` with skill
-`<pack>-<action>`, but the CE path never hits that handler — so
-CE-queued runs stayed `queued` forever.
-
-Both processes share the workspace tree, so the queue files are the
-handoff surface.
-
-## Decision
-
-1. **Switchbay drains the shared JSON** (no CE `PATCH` required).
-   Module `switchbay.pack_run_drain`:
-   - `list_queued_runs` / `write_run_status` (atomic JSON rewrite)
-   - `build_pack_prompt` — same text as `handle_pack_action`
-   - `drain_once` — validate pack enabled + skill exists, mark
-     `running`, spawn `_dispatch_chat` (injectable for tests), on
-     task completion mark `done` / `failed`
-   - In-memory `app["pack_run_inflight"]` dedupes concurrent drains
-
-2. **Triggers**
-   - Background poll every ~4s while
-     `<workspace>/.workbench/pack-runs/` exists
-   - Explicit `POST /api/packs/drain` → `{drained, skipped, errors}`
-   - Opportunistic kick from `_broadcast_files_changed_soon` when
-     the pack-runs dir is present
-
-3. **Out of scope (this ADR):** reveal-in-OS, drop-ingest, rewriting
-   CE's queue writer, and refactoring `handle_pack_action` to also
-   write pack-runs JSON (nice-to-have; CE files are the required
-   consumer).
-
-## Consequences
-
-- CE remains the sandbox/accept edge; Switchbay remains the skill/LLM
-  seat. Status fields on the shared JSON are the cross-process progress
-  UI.
-- Tests mock `dispatch_fn` — no paid model seats in CI.
diff --git a/docs/ADR-007-ce-ingest-run-drain.md b/docs/ADR-007-ce-ingest-run-drain.md
deleted file mode 100644
index b08b4a3..0000000
--- a/docs/ADR-007-ce-ingest-run-drain.md
+++ /dev/null
@@ -1,60 +0,0 @@
-# ADR-007: CE ingest-queue → Switchbay local_ingest / rail drain
-
-- **Status:** Accepted
-- **Date:** 2026-09-20
-- **Parent:** skill-shell rationalization (CE drop-ingest + pack-run drain parity)
-- **Related:** ADR-006 (CE pack-queue → rail LLM drain)
-- **Deciders:** Ben / skill-shell rationalization charter
-
-## Context
-
-Curiosity Engine's drop-ingest (`POST /api/ingest/from-upload` /
-`from-path`, filebrowser + `/embed/ce/`) stages bytes under
-`vault/raw/` and writes only:
-
-```text
-.workbench/ingest-runs/<run_id>.json   # status: "queued", mode: "staged"
-```
-
-It does **not** run `local_ingest.py` or seat an LLM agent. Pack-runs
-already drain via Switchbay (`POST /api/packs/drain`, ADR-006). Without
-a sibling drain, ingest-runs sit `queued` forever after drop.
-
-Both processes share the workspace tree, so the queue files are the
-handoff surface.
-
-## Decision
-
-1. **Switchbay drains the shared JSON** (no CE `PATCH` required).
-   Module `switchbay.ingest_run_drain`:
-   - `list_queued_runs` / `write_run_status` (atomic JSON rewrite)
-   - `resolve_run_vault_path` — refuse workspace escape / null bytes
-   - Prefer **deterministic** `local_ingest` (`ce_tools._ce_ingest`)
-     for normal vault sources (`mode: staged` and peers)
-   - Escalate to `_dispatch_chat` only when metadata opts in
-     (`mode`/`drain` ∈ {llm,rail,agent,dispatch} or
-     `prefer_rail` / `use_llm` truthy)
-   - `drain_once` — mark `running`, spawn local or rail task, on
-     completion mark `done` / `failed`
-   - In-memory `app["ingest_run_inflight"]` dedupes concurrent drains
-
-2. **Triggers**
-   - Background poll every ~4s while
-     `<workspace>/.workbench/ingest-runs/` exists
-   - Explicit `POST /api/ingest/drain` → `{drained, skipped, errors}`
-   - Opportunistic kick from `_broadcast_files_changed_soon` when
-     the ingest-runs dir is present
-
-3. **Out of scope:** rewriting CE's queue writer, changing
-   Switchbay's own multipart `/api/ingest/from-upload` (still seats
-   rail immediately for non-CE uploads), multimodal CURATE waves.
-
-## Consequences
-
-- CE remains the sandbox/stage edge; Switchbay remains the ingest
-  executor. Status fields on the shared JSON are the cross-process
-  progress UI.
-- Default path stays cheap (no paid model seats). LLM only when the
-  run record asks for it.
-- Tests mock `local_ingest_fn` / `dispatch_fn` — no CE binary or paid
-  model seats in CI.
diff --git a/docs/ADR-008-workspace-sandbox-roots.md b/docs/ADR-008-workspace-sandbox-roots.md
deleted file mode 100644
index 471ac5c..0000000
--- a/docs/ADR-008-workspace-sandbox-roots.md
+++ /dev/null
@@ -1,25 +0,0 @@
-# ADR-008: Workspace sandbox roots (stage-5 home rule + box `/workspace`)
-
-**Status:** Accepted  
-**Date:** 2026-09-20  
-**Context:** Stage-5 restricted workspace paths to `$HOME` so file-ops /
-cebridge never get a cwd of `/`, `/etc`, etc. On the Grok Bot box,
-corpora live under `/workspace` (e.g. `/workspace/ce-cb-biocure`).
-`Path.resolve()` follows symlinks, so a `~/Workspaces/...` symlink still
-failed `is_within_home`; E2E had to `unshare`+bind-mount under home.
-
-**Decision:** Keep the stage-5 sandbox, but allow a small explicit set of
-roots via `allowed_workspace_roots()`:
-
-1. Always `Path.home()`.
-2. `/workspace` when that directory exists (agent-box scratch).
-3. Extra dirs from `SWITCHBAY_WORKSPACE_ROOTS` (`os.pathsep`-separated;
-   expanduser + resolve; skip missing / non-dirs).
-
-`is_within_home(path)` (name retained for call sites) returns true iff
-the resolved path is under any of those roots. Error copy uses
-`home_label()` → e.g. `must live inside /home/box or /workspace`.
-
-**Consequences:** Box corpora register without bind-mount workarounds.
-`/etc`, `/tmp`, `/`, and `..` escapes remain refused unless an operator
-deliberately adds a root via the env var.
diff --git a/docs/CE-EMBED-HOOK.md b/docs/CE-EMBED-HOOK.md
deleted file mode 100644
index 9472c05..0000000
--- a/docs/CE-EMBED-HOOK.md
+++ /dev/null
@@ -1,89 +0,0 @@
-# CE embed hook — dual mounts (shell sidebar + Graph canvas)
-
-**Date:** 2026-09-27 (updated 2026-09-29 for v0.13.0 / CE v1.9.0)  
-**Owners:** Switchbay (mount scaffolding) · CE Benchmarker (CE `embed` mode)
-
-## Goal
-
-- **Shell left column** hosts the **CE sidebar** (Pages | Files + search that
-  highlights both list and canvas) — **persistent** across Graph / Agents /
-  Editor for CE-backed workspaces.
-- **Graph pane** hosts **only the CE atlas canvas** (+ in-canvas graph-search).
-- **One CE embed session**, **two mount points**, shared `data.json` /
-  module state — same-origin, no iframe, no full-document HTML remount.
-- Switchbay keeps tabs, rail, Agents, theme/mode footer. Non-CE / proxied-off
-  workspaces keep native WikiPane + Files|Sources.
-
-## Do not
-
-- Keep Pages only inside the Graph tab (must persist across tabs).
-- Rebuild Switchbay’s sidebar to imitate CE Pages (search-highlight debt).
-- Run two page lists at once.
-
-## Switchbay scaffolding (landed)
-
-| Piece | Role |
-|-------|------|
-| `ceEmbedSession.ts` | Singleton session: `ensure()` → load `/embed/ce` modules + `data.json`; `attachSidebar` / `attachCanvas` / detach; survives Graph unmount |
-| `CeSidebarSlot.tsx` | Shell-left mount (`#ce-sidebar-root`) when `proxied_skill_embeds` |
-| `CeAtlasEmbed.tsx` | Graph tab canvas (`#graph-root`); soft-parks atlas on tab leave (instant return) |
-| `ceEmbedBootstrap.ts` | `prepareSession()`, script order, fetch shim, `window.CEEmbed` prefer |
-| `ceSidebarShell.html` / `ceEmbedShell.html` | DOM fragments (aside vs graph-pane+modal) |
-
-`Sidebar.tsx`: proxied on → `CeSidebarSlot` (full-height); proxied off →
-WikiPane + Files|Sources as before. Workspace remount calls
-`resetCeEmbedSession()`.
-
-## CE hook (landed in curiosity-engine v1.9.0)
-
-Prefer `window.CEEmbed.create` from `/embed/ce/static/embed.js`. Switchbay
-`ceEmbedBootstrap` / `ceEmbedSession` call it when present; the local stub
-path below remains a fallback for older CE tips.
-
-```js
-window.CEEmbed = {
-  /**
-   * Preferred: create a session, then attach external mounts.
-   * @param {{
-   *   embed: true,
-   *   dataUrl: string,       // "/embed/ce/data.json"
-   *   publicBase: string,    // "/embed/ce"
-   *   chrome?: boolean,      // shell owns theme/rail; CE chrome minimal
-   * }} opts
-   */
-  async create(opts) {
-    return {
-      /** Mount CE Pages|Files sidebar into Switchbay's left column. */
-      mountSidebar(el) { /* Sidebar.init + FileBrowser; search↔canvas */ },
-      /** Mount atlas canvas (+ graph-search) into #graph-root. */
-      mountCanvas(el) { /* AtlasViewer / Graph; share session data */ },
-      destroy() { /* tear both; leave Switchbay fetch/body clean */ },
-    };
-  },
-};
-```
-
-Requirements:
-
-- Single shared state / `data.json` for both mounts.
-- Sidebar search highlights **list + canvas** (existing GraphSearch wiring).
-- `mountCanvas` may be called after `mountSidebar`. Leaving Graph should
-  **soft-park** the canvas (`unmountCanvas()` default) — keep atlas/simulation
-  + loaded data alive off-DOM; return calls `mountCanvas` again for **instant
-  reattach** (no N>10k layout). Pass `unmountCanvas({ destroy: true })` only
-  for hard teardown. Optional `revalidate()` refreshes `data.json` in the
-  background after reattach.
-- Honor `CE_PUBLIC_BASE` / `opts.dataUrl`.
-- Optional: `mount({ mounts: { sidebar, canvas } })` one-shot still OK.
-
-When `CEEmbed.create` is missing (older CE), Switchbay’s stub loads CE
-static modules and calls `Sidebar.init` + `AtlasViewer`/`Graph`/`GraphSearch`
-itself. With CE **v1.9.0**+, prefer the real hook (IndexedDB cache + soft-park).
-
-## Verify
-
-- Pages list visible on Agents and Editor (not only Graph).
-- One page list (CE), not WikiPane + CE.
-- Graph = atlas canvas; rail right-docked; Agents not stuck Loading.
-- Leave Graph → Agents → back Graph is **instant** (no "Loading Curiosity Engine atlas…" / no 20s layout).
-- `/embed/ce/data.json` and `/api/graph/data` still serve BioCure nodes+edges.
diff --git a/docs/releases/v0.13.0.md b/docs/releases/v0.13.0.md
index e34b1e3..f84a04f 100644
--- a/docs/releases/v0.13.0.md
+++ b/docs/releases/v0.13.0.md
@@ -39,7 +39,6 @@ okstratr observer; turning it off restores built-ins.
   `SWITCHBAY_*_UPSTREAM` overrides).
 - Injects `X-CE-Host: switchbay` / `X-Okstratr-Host: switchbay`.
 - Vite dev proxies `/embed` to the daemon.
-- ADR: [`ADR-004-same-origin-embed-proxy.md`](../ADR-004-same-origin-embed-proxy.md).
 
 ### Embed v2 — same-document mount
 
@@ -48,7 +47,6 @@ okstratr observer; turning it off restores built-ins.
 - Fetch proxied HTML, rewrite asset URLs, inject markup, **execute** scripts
   (not script-stripped Phase 4a proof).
 - Soft-reload on wiki `files_changed`; tear down scripts on unmount.
-- ADR: [`ADR-004b-embed-v2-same-document-mount.md`](../ADR-004b-embed-v2-same-document-mount.md).
 
 ### Dual-mount Graph (CE sidebar + canvas)
 
@@ -58,7 +56,6 @@ okstratr observer; turning it off restores built-ins.
   instant return; `atlas-cache.js` + workspace key for cold Graph cache.
 - Prefers `window.CEEmbed.create` (CE v1.9.0); session singleton survives
   Graph unmount.
-- Doc: [`CE-EMBED-HOOK.md`](../CE-EMBED-HOOK.md).
 
 ### Core-skills auto-start + host_notify
 
@@ -69,14 +66,11 @@ okstratr observer; turning it off restores built-ins.
 ### Settings → okstratr harness registry
 
 - `/api/okstratr/harness*` thin client; no second Switchbay allowlist.
-- ADR: [`ADR-005-okstratr-harness-registry-client.md`](../ADR-005-okstratr-harness-registry-client.md).
 
 ### Pack + ingest drain
 
 - CE queues pack-runs / ingest-runs under `.workbench/`; Switchbay drains
   them (rail LLM / `local_ingest`, prefer CE drop-ingest endpoint).
-- ADRs: [`ADR-006`](../ADR-006-ce-pack-run-drain.md),
-  [`ADR-007`](../ADR-007-ce-ingest-run-drain.md).
 
 ## What did **not** change
 

From 92b7eddf8f5506def5a7fa9a8d2e87d34c58e8fe Mon Sep 17 00:00:00 2001
From: benjsmith <benjamincharlessmith@gmail.com>
Date: Tue, 29 Sep 2026 21:17:23 +0000
Subject: [PATCH 4/9] docs: add architecture.md as sole public arch doc

Fold current embed/hosting architecture into docs/architecture.md.
Retarget README, CHANGELOG, release notes, concepts, and embed code
comments from deleted ADR/CE-EMBED paths. ADRs remain gitignored.

Signed-off-by: benjsmith <benjamincharlessmith@gmail.com>
---
 CHANGELOG.md                                  |  2 +-
 README.md                                     |  1 +
 docs/architecture.md                          | 76 +++++++++++++++++++
 docs/concepts-and-data-flow.md                |  2 +
 docs/releases/v0.13.0.md                      |  4 +-
 frontend/src/widgets/embed/CeAtlasEmbed.tsx   |  2 +-
 .../src/widgets/embed/ProxiedSkillPanel.tsx   |  2 +-
 .../src/widgets/embed/ceEmbedBootstrap.ts     |  2 +-
 frontend/src/widgets/embed/ceEmbedSession.ts  |  2 +-
 frontend/src/widgets/embed/embedMount.ts      |  2 +-
 src/switchbay/daemon.py                       |  2 +-
 src/switchbay/ingest_run_drain.py             |  2 +-
 12 files changed, 90 insertions(+), 9 deletions(-)
 create mode 100644 docs/architecture.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6f4d695..9c4bc78 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,7 +24,7 @@ Skill pins for this wave (tags pending docs merges):
 | okstratr | **v0.2.0** (pending) | hosted proxy + registry SSOT + observer desk UX |
 | curiosity-merge | **v0.8.4** (pending) | Phase 3 installer / UI-boundary contract |
 
-See [release notes](docs/releases/v0.13.0.md).
+See [release notes](docs/releases/v0.13.0.md) and [architecture](docs/architecture.md).
 
 ### Added
 
diff --git a/README.md b/README.md
index 2b5ab46..ef4fbfb 100644
--- a/README.md
+++ b/README.md
@@ -182,6 +182,7 @@ don’t need to quit and reopen the PWA after each restart.
 
 ## More
 
+- **[`docs/architecture.md`](docs/architecture.md)** — current hosting architecture (embed proxy, CEEmbed, core-skills, drains).
 - **[`docs/concepts-and-data-flow.md`](docs/concepts-and-data-flow.md)** — the map: concepts + data flows.
 - **[`docs/known-issues.md`](docs/known-issues.md)** — rough edges + deliberate deferrals in this release.
 - **[`docs/THIRD-PARTY-NOTICES.md`](docs/THIRD-PARTY-NOTICES.md)** — third-party attributions.
diff --git a/docs/architecture.md b/docs/architecture.md
new file mode 100644
index 0000000..ab8cf20
--- /dev/null
+++ b/docs/architecture.md
@@ -0,0 +1,76 @@
+# Architecture (v0.13)
+
+How Switchbay **hosts** first-party skills today. Product vocabulary and
+data flows stay in [`concepts-and-data-flow.md`](concepts-and-data-flow.md).
+Release detail: [`releases/v0.13.0.md`](releases/v0.13.0.md).
+
+> If a detail here disagrees with the code, the code wins.
+
+## Shape
+
+```
+Browser PWA  ──WS/HTTP──▶  Switchbay daemon :8765
+                              │
+                              ├── /embed/ce/*       → 127.0.0.1:8766  (curiosity-engine)
+                              ├── /embed/okstratr/* → 127.0.0.1:8767  (okstratr)
+                              ├── /api/core-skills/*   (auto-start + status)
+                              ├── /api/okstratr/harness*  (Settings thin client)
+                              └── pack / ingest drainers  (.workbench queues)
+```
+
+Same-origin reverse proxy + **same-document** mounts — **no iframes** for
+Graph / Agents skill surfaces.
+
+## Same-origin reverse proxy
+
+- Daemon always proxies `/embed/ce/*` and `/embed/okstratr/*` to loopback
+  upstreams (`SWITCHBAY_CE_UPSTREAM` / `SWITCHBAY_OKSTRATR_UPSTREAM`;
+  non-loopback rejected).
+- Injects `X-CE-Host: switchbay` / `X-Okstratr-Host: switchbay`.
+- Vite dev proxies `/embed` to the daemon.
+- Settings → **Proxied skill embeds** switches Graph → CE and Agents →
+  okstratr observer; turning it off restores built-ins. The proxy itself
+  stays on either way.
+
+## Embed v2 — same-document mount
+
+- Poll `GET /api/core-skills/status`; wait chrome while `starting` /
+  `building_wiki` / `unhealthy`; mount only when healthy.
+- `fetch` proxied HTML, rewrite asset URLs onto `/embed/…`, inject markup,
+  **execute** scripts via `createElement` + append (not script-stripped).
+- Soft-reload on wiki `files_changed`; tear down scripts on unmount.
+- Implementation: `frontend/src/widgets/embed/` (`ProxiedSkillPanel`,
+  `embedMount.ts`).
+
+## Dual-mount Graph (CEEmbed)
+
+- Shell left column: CE Pages|Files (`CeSidebarSlot`) persists across
+  Graph / Agents / Editor when proxied embeds are on for a CE workspace.
+- Graph pane: atlas canvas only (`CeAtlasEmbed`); soft-park on leave;
+  `atlas-cache.js` + workspace key for cold Graph cache.
+- Prefers `window.CEEmbed.create` / `mount` when CE ships it; one session
+  singleton survives Graph unmount.
+
+## Core-skills auto-start
+
+- curiosity-engine and okstratr **always** auto-start with the shell.
+- Supervised okstratr serve sets `OKSTRATR_HOSTED=switchbay`.
+- Rail receives okstratr `host_notify` envelopes.
+
+## Settings → okstratr harness registry
+
+- `/api/okstratr/harness*` is a thin client over okstratr’s harness /
+  model registry. No second Switchbay allowlist.
+
+## Pack + ingest drain
+
+- CE queues pack-runs and ingest-runs under `.workbench/`.
+- Switchbay drains pack-runs into the rail LLM and ingest-runs via
+  `local_ingest` (prefer CE drop-ingest endpoint; rail LLM only when
+  run metadata opts in).
+
+## Migrate-before-thinning
+
+Built-in GraphTab, AgentDashboardTab, and filebrowser **stay** until the
+skill-shell parity checklist is green. v0.13.0 does not delete them;
+proxied embeds are opt-in.
diff --git a/docs/concepts-and-data-flow.md b/docs/concepts-and-data-flow.md
index 56e8a6a..109357e 100644
--- a/docs/concepts-and-data-flow.md
+++ b/docs/concepts-and-data-flow.md
@@ -13,6 +13,8 @@ running tools, and turning raw material into a knowledge graph.
 > If a detail here disagrees with the code, the code wins — this doc is
 > the map, not the territory.
 
+Skill hosting (same-origin embed proxy, CEEmbed dual-mount Graph, core-skills auto-start, pack/ingest drain, Settings → okstratr registry): **[`architecture.md`](architecture.md)**.
+
 ---
 
 ## The core loop
diff --git a/docs/releases/v0.13.0.md b/docs/releases/v0.13.0.md
index f84a04f..3a41431 100644
--- a/docs/releases/v0.13.0.md
+++ b/docs/releases/v0.13.0.md
@@ -19,8 +19,10 @@ daemon. Settings is a **thin client** over okstratr’s harness registry.
 CE pack-runs and ingest-runs **drain** into Switchbay (rail LLM /
 `local_ingest`).
 
+Canonical architecture: [`architecture.md`](../architecture.md).
+
 **Migrate-before-thinning:** built-in GraphTab, AgentDashboardTab, and
-filebrowser stay until the umbrella parity checklist is green. Turning on
+filebrowser stay until the skill-shell parity checklist is green. Turning on
 Settings → **Proxied skill embeds** switches Graph → CE canvas and Agents →
 okstratr observer; turning it off restores built-ins.
 
diff --git a/frontend/src/widgets/embed/CeAtlasEmbed.tsx b/frontend/src/widgets/embed/CeAtlasEmbed.tsx
index 595b1c9..797c2b5 100644
--- a/frontend/src/widgets/embed/CeAtlasEmbed.tsx
+++ b/frontend/src/widgets/embed/CeAtlasEmbed.tsx
@@ -113,7 +113,7 @@ export default function CeAtlasEmbed() {
           <pre>{state.message}</pre>
           <p className="sy-ce-atlas-embed-hint">
             Dual-mount session: shell hosts CE Pages|Files; this pane is
-            canvas-only. See docs/CE-EMBED-HOOK.md.
+            canvas-only. See docs/architecture.md.
           </p>
         </div>
       )}
diff --git a/frontend/src/widgets/embed/ProxiedSkillPanel.tsx b/frontend/src/widgets/embed/ProxiedSkillPanel.tsx
index deb5679..b0bbbd6 100644
--- a/frontend/src/widgets/embed/ProxiedSkillPanel.tsx
+++ b/frontend/src/widgets/embed/ProxiedSkillPanel.tsx
@@ -21,7 +21,7 @@ import {
  * 5. Tear down (clear root + remove injected scripts) before soft-reload
  *    or unmount to avoid duplicate roots/listeners.
  *
- * JSON responses keep the pretty-print path. No nested frames (ADR-004 / 004b).
+ * JSON responses keep the pretty-print path. No nested frames (see docs/architecture.md).
  */
 
 export type SkillEmbedKind = "ce" | "okstratr";
diff --git a/frontend/src/widgets/embed/ceEmbedBootstrap.ts b/frontend/src/widgets/embed/ceEmbedBootstrap.ts
index 79898f8..d91dc23 100644
--- a/frontend/src/widgets/embed/ceEmbedBootstrap.ts
+++ b/frontend/src/widgets/embed/ceEmbedBootstrap.ts
@@ -5,7 +5,7 @@
  * CE static modules from `/embed/ce/static/…` and run a Switchbay stub that
  * mirrors `main.js` without Sidebar / filebrowser chrome.
  *
- * CE hook (for CE Benchmarker) — see docs/CE-EMBED-HOOK.md:
+ * CE hook (for CE Benchmarker) — see docs/architecture.md:
  *   window.CEEmbed.mount(container, {
  *     embed: true,
  *     dataUrl: "/embed/ce/data.json",
diff --git a/frontend/src/widgets/embed/ceEmbedSession.ts b/frontend/src/widgets/embed/ceEmbedSession.ts
index 47525ed..aa31a6d 100644
--- a/frontend/src/widgets/embed/ceEmbedSession.ts
+++ b/frontend/src/widgets/embed/ceEmbedSession.ts
@@ -9,7 +9,7 @@
  * Prefer window.CEEmbed.create/mount when CE ships dual-mount embed mode;
  * stub path below coordinates Sidebar + AtlasViewer until then.
  *
- * See docs/CE-EMBED-HOOK.md.
+ * See docs/architecture.md.
  */
 
 import {
diff --git a/frontend/src/widgets/embed/embedMount.ts b/frontend/src/widgets/embed/embedMount.ts
index b56a5cd..f65d21b 100644
--- a/frontend/src/widgets/embed/embedMount.ts
+++ b/frontend/src/widgets/embed/embedMount.ts
@@ -1,7 +1,7 @@
 /**
  * Embed v2 same-document mount helpers (no iframe).
  *
- * Mount algorithm (see docs/ADR-004b-embed-v2-same-document-mount.md):
+ * Mount algorithm (see docs/architecture.md):
  * 1. Tear down prior mount (clear panel root + remove injected <script> nodes).
  * 2. fetch(`/embed/{ce|okstratr}/…`) for proxied HTML.
  * 3. rewriteHtmlUrls → absolute `/embed/…` asset paths.
diff --git a/src/switchbay/daemon.py b/src/switchbay/daemon.py
index a277b1b..b928aeb 100644
--- a/src/switchbay/daemon.py
+++ b/src/switchbay/daemon.py
@@ -4381,7 +4381,7 @@ async def handle_ingest_drain(request: web.Request) -> web.Response:
     """Drain CE-queued ``.workbench/ingest-runs/*.json``.
 
     Prefer deterministic ``local_ingest``; escalate to rail LLM only when
-    run metadata opts in (see ADR-007). Returns
+    run metadata opts in (see ``docs/architecture.md``). Returns
     ``{drained, skipped, errors, …}``.
     """
     summary = await ingest_run_drain.drain_once(request.app)
diff --git a/src/switchbay/ingest_run_drain.py b/src/switchbay/ingest_run_drain.py
index de89dcc..683f423 100644
--- a/src/switchbay/ingest_run_drain.py
+++ b/src/switchbay/ingest_run_drain.py
@@ -5,7 +5,7 @@
 ``vault/raw/`` and writes ``.workbench/ingest-runs/<run_id>.json`` with
 ``status: "queued"`` — it does not run ``local_ingest`` or seat an LLM.
 Switchbay owns deterministic CE ingest + skill/LLM execution (same
-pattern as ``pack_run_drain`` / ADR-006).
+pattern as ``pack_run_drain``; see ``docs/architecture.md``).
 
 Default path: deterministic ``local_ingest`` (via ``ce_tools._ce_ingest``)
 for normal vault sources. Escalate to ``_dispatch_chat`` only when the

From ae6cef072cf18bc0388bdef6d065903b349af732 Mon Sep 17 00:00:00 2001
From: benjsmith <benjamincharlessmith@gmail.com>
Date: Tue, 29 Sep 2026 21:18:01 +0000
Subject: [PATCH 5/9] docs: retire stale "two processes" wording for v0.13
 shell

Runtime shape is Switchbay aiohttp + auto-started CE/okstratr, not two
processes. Point README and concepts at docs/architecture.md.

Signed-off-by: benjsmith <benjamincharlessmith@gmail.com>
---
 README.md                      | 15 ++++++++----
 docs/concepts-and-data-flow.md | 43 +++++++++++++++++++++-------------
 2 files changed, 37 insertions(+), 21 deletions(-)

diff --git a/README.md b/README.md
index ef4fbfb..61d26e8 100644
--- a/README.md
+++ b/README.md
@@ -15,8 +15,9 @@ curate captured material into linked wiki pages, run Auto orchestration
 It runs **entirely on your machine**, against whatever models you choose,
 and nothing leaves unless you send it.
 
-- **Local & private** — two processes and your files. No cloud, no
-  accounts; your data and API keys stay on your machine.
+- **Local & private** — a Switchbay aiohttp shell on your machine (auto-starts
+  CE + okstratr) and your files. No cloud, no accounts; your data and API
+  keys stay on your machine. See [`docs/architecture.md`](docs/architecture.md).
 - **Bring your own models** — hosted APIs (Anthropic, xAI Grok, OpenAI,
   Gemini, Meta Muse Spark), subscription coding CLIs (Claude Code, Grok
   Build, Muse Code, Codex, Copilot), or fully-local models (llama.cpp /
@@ -39,7 +40,8 @@ and nothing leaves unless you send it.
 New here? Read **[`docs/concepts-and-data-flow.md`](docs/concepts-and-data-flow.md)**
 — how Switch Bay is put together in one read: the core vocabulary
 (**Workspace → Thread → Run → Turn**), the runtime shape, and the data
-flows behind the things you do most. Provider coverage (what's
+flows behind the things you do most. Hosting / embed architecture:
+**[`docs/architecture.md`](docs/architecture.md)**. Provider coverage (what's
 first-class vs preview, including Muse Code) is
 **[`docs/providers.md`](docs/providers.md)**. The default **open**
 profile is today's consumer product. An optional **enterprise** profile
@@ -99,7 +101,9 @@ make sync           # uv sync (base Python deps; add `make sync-semantic` for em
 make sync-frontend  # pnpm install in frontend/
 ```
 
-Two processes. In one terminal:
+Dev needs the daemon and Vite. The daemon is the Switchbay aiohttp shell
+and **auto-starts** curiosity-engine (`:8766`) + okstratr (`:8767`); Vite
+is only for hot frontend reload. In one terminal:
 
 ```sh
 WORKSPACE=/path/to/workspace make dev-daemon
@@ -112,7 +116,8 @@ make dev-frontend
 ```
 
 Then open the URL vite prints (default `http://localhost:5173`). Vite
-proxies `/api` and `/ws` to the daemon on `:8765`.
+proxies `/api`, `/ws`, and `/embed` to the daemon on `:8765`. Architecture:
+[`docs/architecture.md`](docs/architecture.md).
 
 ## Test
 
diff --git a/docs/concepts-and-data-flow.md b/docs/concepts-and-data-flow.md
index 109357e..091013c 100644
--- a/docs/concepts-and-data-flow.md
+++ b/docs/concepts-and-data-flow.md
@@ -43,21 +43,26 @@ local. Nothing leaves unless you send it.
 
 ## Runtime shape
 
-Two processes and your files. No cloud, no accounts.
+Your browser, the Switchbay aiohttp shell, auto-started core skills, and
+your files. No cloud, no accounts. Hosting / embed detail:
+**[`architecture.md`](architecture.md)**.
 
 ```
  ┌─────────────────────────┐         ┌──────────────────────────────┐
- │  Browser frontend (PWA)  │  WS +   │   Python daemon (aiohttp)    │
- │  installed from          │◀──HTTP─▶│   always-on launchd agent    │
- │  http://127.0.0.1:8765   │  :8765  │   :8765                      │
+ │  Browser frontend (PWA)  │  WS +   │  Switchbay daemon (aiohttp)  │
+ │  installed from          │◀──HTTP─▶│  always-on launchd agent     │
+ │  http://127.0.0.1:8765   │  :8765  │  :8765                       │
  │  Power mode · Zen mode   │         │                              │
- └─────────────────────────┘         │  ┌────────────────────────┐  │
-                                      │  │ LLM gateway (providers) │  │
-   Your knowledge base                │  │  APIs: Anthropic · xAI  │  │
-   (a "workspace"):                   │  │    · OpenAI · Gemini ·  │  │
-     <ws>/wiki/     docs + graph      │  │    Meta                 │  │
-     <ws>/vault/    raw sources       │  │  CLIs: Claude Code ·    │  │
-     <ws>/.workbench/  config+state ◀─┼──┤    Grok Build · Muse ·  │  │
+ └─────────────────────────┘         │  reverse-proxy /embed/…       │
+                                      │    /embed/ce/*       → :8766 │
+                                      │    /embed/okstratr/* → :8767 │
+                                      │  ┌────────────────────────┐  │
+   Your knowledge base                │  │ LLM gateway (providers) │  │
+   (a "workspace"):                   │  │  APIs: Anthropic · xAI  │  │
+     <ws>/wiki/     docs + graph      │  │    · OpenAI · Gemini ·  │  │
+     <ws>/vault/    raw sources       │  │    Meta                 │  │
+     <ws>/.workbench/  config+state ◀─┼──┤  CLIs: Claude Code ·    │  │
+                                      │  │    Grok Build · Muse ·  │  │
                                       │  │    Codex · Copilot      │  │
                                       │  │  local: llama.cpp/Ollama│  │
                                       │  │ tools · MCP bridge      │  │
@@ -69,11 +74,16 @@ Two processes and your files. No cloud, no accounts.
 - **Frontend**: a pure-browser PWA (no Electron/Tauri). Talks to the
   daemon over a WebSocket (live events) plus REST (`/api/*`). Installed
   from `http://127.0.0.1:8765` so it gets a dock icon + standalone
-  window. In dev, vite serves `:5173` and proxies `/api` + `/ws`.
-- **Daemon**: one aiohttp process, always on (launchd agent, restart on
-  crash). Owns everything: the LLM providers, the tool registry, the
-  rail history, the managed local model server, PTY sessions. Closing
-  the window does **not** stop work — runs live in the daemon.
+  window. In dev, vite serves `:5173` and proxies `/api` + `/ws` +
+  `/embed`.
+- **Daemon (shell)**: one aiohttp process, always on (launchd agent,
+  restart on crash). Owns the LLM providers, tool registry, rail
+  history, managed local model server, PTY sessions, and same-origin
+  `/embed` reverse proxy. **Auto-starts** curiosity-engine (`:8766`) and
+  okstratr (`:8767`). Closing the window does **not** stop work — runs
+  live in the daemon. Skill UI mounts (CEEmbed dual-mount Graph, soft-
+  park, pack/ingest drain, Settings → okstratr harness): see
+  [`architecture.md`](architecture.md).
 - **Knowledge base**: a **curiosity-engine**-shaped folder (curiosity-
   engine is bundled as a first-party skill). Durable, user-facing files
   (`wiki/`, `vault/`, figures,
@@ -497,6 +507,7 @@ all. Two interop layers sit on top:
 
 ## See also
 
+- [`architecture.md`](architecture.md) — current hosting / embed architecture (v0.13).
 - `README.md` — what Switch Bay is and how to run it.
 - `CLAUDE.md` — orientation for AI coding sessions.
 - `src/switchbay/` — the daemon; each module's docstring carries its rationale.

From ab7dec74b60eafb3147532c32b1ca1e3c3a0168c Mon Sep 17 00:00:00 2001
From: benjsmith <benjamincharlessmith@gmail.com>
Date: Thu, 1 Oct 2026 09:22:03 +0000
Subject: [PATCH 6/9] docs: revive ADRs as living developer docs linked from
 architecture

Restore ADR-004/004b/005/006/007/008 and CE-EMBED-HOOK from pre-delete
history, refresh status as Accepted (current as of v0.13.0), align
pack/ingest wording with the shell+auto-started CE shape, link them from
architecture.md, un-gitignore the ADR paths (keep skill-shell-rationalization/),
and note in CHANGELOG/release that developer ADRs remain.

Signed-off-by: benjsmith <benjamincharlessmith@gmail.com>
---
 .gitignore                                    |  2 -
 CHANGELOG.md                                  | 11 +--
 docs/ADR-004-same-origin-embed-proxy.md       | 66 ++++++++++++++
 docs/ADR-004b-embed-v2-same-document-mount.md | 78 ++++++++++++++++
 ...DR-005-okstratr-harness-registry-client.md | 52 +++++++++++
 docs/ADR-006-ce-pack-run-drain.md             | 54 +++++++++++
 docs/ADR-007-ce-ingest-run-drain.md           | 60 +++++++++++++
 docs/ADR-008-workspace-sandbox-roots.md       | 32 +++++++
 docs/CE-EMBED-HOOK.md                         | 90 +++++++++++++++++++
 docs/architecture.md                          | 15 ++++
 docs/releases/v0.13.0.md                      |  8 +-
 11 files changed, 460 insertions(+), 8 deletions(-)
 create mode 100644 docs/ADR-004-same-origin-embed-proxy.md
 create mode 100644 docs/ADR-004b-embed-v2-same-document-mount.md
 create mode 100644 docs/ADR-005-okstratr-harness-registry-client.md
 create mode 100644 docs/ADR-006-ce-pack-run-drain.md
 create mode 100644 docs/ADR-007-ce-ingest-run-drain.md
 create mode 100644 docs/ADR-008-workspace-sandbox-roots.md
 create mode 100644 docs/CE-EMBED-HOOK.md

diff --git a/.gitignore b/.gitignore
index 58f9dc2..557ab92 100644
--- a/.gitignore
+++ b/.gitignore
@@ -51,8 +51,6 @@ docs/*-design.md
 docs/product-pilot-judge-results-*.md
 docs/product-pilot-*.md
 docs/vscode-plugin.md
-docs/ADR-*.md
-docs/CE-EMBED-HOOK.md
 
 # ── local skill-shell umbrella workspace (never ship) ──
 skill-shell-rationalization/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c4bc78..21e831b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,7 +24,7 @@ Skill pins for this wave (tags pending docs merges):
 | okstratr | **v0.2.0** (pending) | hosted proxy + registry SSOT + observer desk UX |
 | curiosity-merge | **v0.8.4** (pending) | Phase 3 installer / UI-boundary contract |
 
-See [release notes](docs/releases/v0.13.0.md) and [architecture](docs/architecture.md).
+See [release notes](docs/releases/v0.13.0.md) and [architecture](docs/architecture.md). Developer ADRs (004/004b/005/006/007/008, [CE-EMBED-HOOK](docs/CE-EMBED-HOOK.md)) remain as living docs linked from architecture.md.
 
 ### Added
 
@@ -44,10 +44,11 @@ See [release notes](docs/releases/v0.13.0.md) and [architecture](docs/architectu
 - **Core-skills auto-start** — always start CE + okstratr with the shell;
   rail `host_notify`; `OKSTRATR_HOSTED=switchbay` on supervised serve.
 - **Settings → okstratr harness registry** — thin client (`/api/okstratr/harness*`);
-  no second Switchbay allowlist.
-- **Pack / ingest drain** — drain CE `.workbench/pack-runs/` into rail LLM;
-  drain ingest-runs via `local_ingest` / prefer CE drop-ingest endpoint.
-- **Sandbox roots** — allow `/workspace` (+ env roots) in home-gate.
+  no second Switchbay allowlist (ADR-005).
+- **Pack / ingest drain** — drain CE `.workbench/pack-runs/` into rail LLM
+  (ADR-006); drain ingest-runs via `local_ingest` / prefer CE drop-ingest
+  endpoint (ADR-007).
+- **Sandbox roots** — allow `/workspace` (+ env roots) in home-gate (ADR-008).
 
 ### Fixed / polish (embed wave)
 
diff --git a/docs/ADR-004-same-origin-embed-proxy.md b/docs/ADR-004-same-origin-embed-proxy.md
new file mode 100644
index 0000000..309be11
--- /dev/null
+++ b/docs/ADR-004-same-origin-embed-proxy.md
@@ -0,0 +1,66 @@
+# ADR-004: Same-origin embed reverse-proxy (no iframes)
+
+- **Status:** Accepted — current as of **v0.13.0** (Phase 4a); Embed v2 mount → [ADR-004b](./ADR-004b-embed-v2-same-document-mount.md)
+- **Date:** 2026-09-18 (living doc; last aligned with architecture.md for v0.13.0)
+- **Deciders:** Ben / skill-shell rationalization charter
+
+## Context
+
+Switchbay hosts Graph (curiosity-engine atlas/wiki) and Agents (okstratr
+observer/desk) surfaces. Cross-origin iframes pointed at
+`127.0.0.1:8766` / `:8767` break hosted-mode control (okstratr HTML
+settings must hide when `host=switchbay`) and create an opaque nested
+browsing context.
+
+Charter locked decision #1: shells **same-origin reverse-proxy** skill
+daemons; in-app panels load first-party proxied routes — **not nested
+frames**.
+
+## Decision
+
+1. **Daemon reverse-proxy** (always on; independent of the UI flag):
+   - `/embed/ce/*` → `http://127.0.0.1:8766/*` (override:
+     `SWITCHBAY_CE_UPSTREAM`, must remain loopback)
+   - `/embed/okstratr/*` → `http://127.0.0.1:8767/*` (override:
+     `SWITCHBAY_OKSTRATR_UPSTREAM`, must remain loopback)
+   - Upstream allowlist is **loopback-only** (`127.0.0.1` / `::1` /
+     `localhost`). Non-loopback upstreams are rejected (502).
+   - Inject hosted-shell headers on every proxied request:
+     - `X-CE-Host: switchbay`
+     - `X-Okstratr-Host: switchbay`
+
+2. **No iframes** for Graph/Agents skill surfaces. Feature flag
+   `proxied_skill_embeds` (default **false**) switches Graph → CE panel
+   and Agents → okstratr panel that navigate `/embed/*` via same-origin
+   `fetch` + same-document rendering. Phase 4a was script-stripped HTML / JSON; Embed v2 (ADR-004b) executes skill scripts in-panel.
+   Built-in GraphTab / AgentDashboardTab / filebrowser remain the
+   default and are **not deleted**.
+
+3. **Settings → okstratr registry (done — ADR-005).** Switchbay settings
+   is a thin client over okstratr's harness/model registry
+   (`harnesses.toml` via `/api/okstratr/harness…` / embed proxy). No
+   second Switchbay allowlist. See
+   [ADR-005](./ADR-005-okstratr-harness-registry-client.md).
+
+## Consequences
+
+- Dev Vite must proxy `/embed` to the daemon (`vite.config.ts`).
+- CE and okstratr honor public-base + `X-*-Host` (okstratr ADR-004 /
+  `OKSTRATR_PUBLIC_BASE`; CE ADR-001 / `CE_PUBLIC_BASE` — both shipped).
+- Full atlas/observer chrome parity is gated by the parity checklist
+  before any Switchbay duplicate deletion (Phase 4b+).
+  **Migrate-before-thinning:** built-in Graph/Agents/filebrowser stay
+  (v0.13.0 does not delete them).
+- WebSocket upgrade through the embed proxy is deferred; HTTP(S) first.
+- Status as of **v0.13.0:** Phase 4a proxy + Embed v2 mount + dual-mount
+  Graph + core-skills auto-start + Settings harness client are on `main`.
+  `proxied_skill_embeds` remains a Settings opt-in (default false) so the
+  built-in surfaces stay the safe default until operators flip the flag.
+
+## Alternatives considered
+
+| Option | Why not |
+|--------|---------|
+| Cross-origin iframe to :8766/:8767 | Opaque origin; hosted settings leak; charter forbid |
+| Same-origin iframe to `/embed/*` | Still a nested frame; charter: no iframes |
+| Delete built-in Graph/Agents now | Violates parity checklist / dual-stack gate |
diff --git a/docs/ADR-004b-embed-v2-same-document-mount.md b/docs/ADR-004b-embed-v2-same-document-mount.md
new file mode 100644
index 0000000..b4f7493
--- /dev/null
+++ b/docs/ADR-004b-embed-v2-same-document-mount.md
@@ -0,0 +1,78 @@
+# ADR-004b: Embed v2 — same-document interactive mount
+
+- **Status:** Accepted — current as of **v0.13.0** (Embed v2 shipped)
+- **Date:** 2026-09-19 (living doc; last aligned with architecture.md for v0.13.0)
+- **Parent:** [ADR-004](./ADR-004-same-origin-embed-proxy.md)
+- **Contract:** umbrella `CONTRACT-EMBED-V2.md`
+
+## Context
+
+Phase 4a (`ProxiedSkillPanel`) fetched `/embed/*` HTML and injected a
+**script-stripped** body. That proved the reverse-proxy path but left Graph
+and Agents inert (no pan/zoom, no desk controls). Charter + ADR-004 forbid
+`<iframe>` / nested frames for skill surfaces.
+
+CE and okstratr already honor `CE_PUBLIC_BASE` / `OKSTRATR_PUBLIC_BASE`
+(`_/embed/ce_`, `_/embed/okstratr_`) and inject `window.*_PUBLIC_BASE` so
+API helpers resolve under the proxy. Relative asset tags (`static/main.js`,
+`observer.css`) still need rewriting when the HTML is mounted into a
+Switchbay panel rather than navigated as a top-level document.
+
+## Decision
+
+**Same-document microfrontend mount** (no nested browsing context):
+
+1. **Wait chrome first.** While the panel is open, poll
+   `GET /api/core-skills/status` (~2s). Banner states: `starting` /
+   `unhealthy` / `building_wiki` / `live`. Do **not** flash a full 502
+   error while the supervisor is still `starting` or `stopped` —
+   status chrome explains the wait (`suppressFetchError`).
+2. **Fetch** proxied HTML from `/embed/ce/…` or `/embed/okstratr/…` only
+   when the skill slice is `healthy` (`allowMount`).
+3. **Rewrite** relative / root-relative / loopback asset URLs onto the
+   public base (`frontend/src/widgets/embed/embedMount.ts`).
+4. **Extract** `<script>` tags (classic + `type=module`); inject remaining
+   markup (body + head stylesheets) into a dedicated panel root via
+   `innerHTML`.
+5. **Execute** scripts by `document.createElement("script")` + append
+   (with rewritten `src`, or inline `textContent`). Browsers never run
+   scripts inserted via `innerHTML` alone.
+6. **Tear down** before soft-reload (`sy:files-changed`) or unmount:
+   remove tracked script nodes and clear the panel root so listeners /
+   duplicate roots do not accumulate.
+7. **JSON** responses keep the pretty-print path (no script mount).
+
+Built-in `GraphTab` is **not** deleted (parity checklist / Ben lock).
+
+## Consequences
+
+- Interactive CE / okstratr chrome can run under `/embed/*` without iframes.
+- Skill UIs share the Switchbay document: global ID collisions and
+  `document`-level assumptions are residual risks; skills should prefer
+  scoped queries when possible.
+- **WebSocket upgrade** through the embed proxy remains deferred (HTTP
+  first). Live features that require WS may be limited until proxyed.
+- Unit tests cover URL rewrite, script extraction, and status-banner
+  mapping (`embedMount.test.ts`).
+
+## Alternatives considered
+
+| Option | Why not |
+|--------|---------|
+| Keep script-stripping | Inert UI; fails Embed v2 acceptance |
+| Same-origin `<iframe src="/embed/…">` | Nested frame; charter / ADR-004 forbid |
+| `srcdoc` iframe | Still a nested browsing context |
+| Shadow DOM isolation | Extra complexity; CE/okstratr expect light DOM + `getElementById` |
+
+## Mount algorithm (short)
+
+```
+poll status → if !healthy: banner only
+else:
+  teardown prior mount
+  html = fetch(/embed/…/)
+  { markup, scripts } = prepareEmbedHtml(html, publicBase, pagePath)
+  root.innerHTML = markup
+  for s in scripts: createElement(script); set src|text; append; await load
+on files_changed / unmount: teardown
+```
diff --git a/docs/ADR-005-okstratr-harness-registry-client.md b/docs/ADR-005-okstratr-harness-registry-client.md
new file mode 100644
index 0000000..508c3bd
--- /dev/null
+++ b/docs/ADR-005-okstratr-harness-registry-client.md
@@ -0,0 +1,52 @@
+# ADR-005: Settings → okstratr harness registry (SSOT client)
+
+- **Status:** Accepted — current as of **v0.13.0**
+- **Date:** 2026-09-19 (living doc; last aligned with architecture.md for v0.13.0)
+- **Parent:** [ADR-004](./ADR-004-same-origin-embed-proxy.md) (Settings thin client — **done** in v0.13.0)
+- **Deciders:** Ben / skill-shell rationalization charter
+
+## Context
+
+okstratr owns the harness+model registry (`~/.config/okstratr/harnesses.toml`
+via `GET/POST /api/harness…`). Charter: shells are **config UIs** over that
+registry — no second Switchbay allowlist. Hosted mode
+(`X-Okstratr-Host: switchbay`) already disables okstratr HTML settings, so
+Switchbay Settings must become the write path.
+
+## Decision
+
+1. **Thin client module** `switchbay.okstratr_harness`:
+   - Server-side calls loopback `SWITCHBAY_OKSTRATR_UPSTREAM`
+     (default `http://127.0.0.1:8767`) with hosted-shell header.
+   - Loopback guard reused from `embed_proxy` (non-loopback → 502).
+   - `normalize_registry()` maps okstratr `list_for_api` JSON; never
+     invents an allowlist.
+   - Browser may also hit same-origin `/embed/okstratr/api/harness…`.
+
+2. **Daemon routes** (shells/UI need not know embed paths):
+   - `GET  /api/okstratr/harness`
+   - `POST /api/okstratr/harness/enable`   `{ "id": "…" }`
+   - `POST /api/okstratr/harness/disable`  `{ "id": "…" }`
+   - `POST /api/okstratr/harness/set`      `{ "key": "…", "value": "…" }`
+   - `POST /api/okstratr/harness/reload`
+
+3. **Settings UI** — section **Harness registry · okstratr**: list rows,
+   enable/disable, set `harness.<id>.default_model`. Existing Pi / local
+   LLM panels remain as **rail** surfaces and are labeled as not the
+   desk/agent SSOT.
+
+## Consequences
+
+- okstratr must be healthy (core-skill supervisor) for Settings toggles
+  to succeed; UI surfaces a clear 502 when upstream is down.
+- No `harnesses.toml` (or equivalent) under Switchbay state dirs.
+- Pi harness (`/api/llm/harness`) and local LLM panels stay Switchbay-local
+  for rail chat; they must not claim desk registry ownership.
+
+## Alternatives considered
+
+| Option | Why not |
+|--------|---------|
+| Copy allowlist into Switchbay `app_settings` | Second SSOT; charter forbid |
+| Settings UI calls `:8767` cross-origin | Breaks hosted-mode headers / CORS |
+| Only document CLI (`okstratr harness …`) | Users need in-app toggles when HTML settings are hosted-off |
diff --git a/docs/ADR-006-ce-pack-run-drain.md b/docs/ADR-006-ce-pack-run-drain.md
new file mode 100644
index 0000000..2c26ccd
--- /dev/null
+++ b/docs/ADR-006-ce-pack-run-drain.md
@@ -0,0 +1,54 @@
+# ADR-006: CE pack-queue → Switchbay rail LLM drain
+
+- **Status:** Accepted — current as of **v0.13.0**
+- **Date:** 2026-09-19 (living doc; last aligned with architecture.md for v0.13.0)
+- **Parent:** skill-shell rationalization (CE filebrowser packs Phase 2b)
+- **Deciders:** Ben / skill-shell rationalization charter
+
+## Context
+
+Curiosity Engine's proxied filebrowser accepts
+`POST /api/packs/<pack>/action/<action>` and, after sandbox checks,
+writes only:
+
+```text
+.workbench/pack-runs/<run_id>.json   # status: "queued"
+```
+
+It does **not** seat an LLM agent. Switchbay already has
+`handle_pack_action` which seats `_dispatch_chat` with skill
+`<pack>-<action>`, but the CE path never hits that handler — so
+CE-queued runs stayed `queued` forever.
+
+Switchbay and CE share the workspace tree (CE auto-started by the shell),
+so the queue files are the handoff surface.
+
+## Decision
+
+1. **Switchbay drains the shared JSON** (no CE `PATCH` required).
+   Module `switchbay.pack_run_drain`:
+   - `list_queued_runs` / `write_run_status` (atomic JSON rewrite)
+   - `build_pack_prompt` — same text as `handle_pack_action`
+   - `drain_once` — validate pack enabled + skill exists, mark
+     `running`, spawn `_dispatch_chat` (injectable for tests), on
+     task completion mark `done` / `failed`
+   - In-memory `app["pack_run_inflight"]` dedupes concurrent drains
+
+2. **Triggers**
+   - Background poll every ~4s while
+     `<workspace>/.workbench/pack-runs/` exists
+   - Explicit `POST /api/packs/drain` → `{drained, skipped, errors}`
+   - Opportunistic kick from `_broadcast_files_changed_soon` when
+     the pack-runs dir is present
+
+3. **Out of scope (this ADR):** reveal-in-OS, drop-ingest, rewriting
+   CE's queue writer, and refactoring `handle_pack_action` to also
+   write pack-runs JSON (nice-to-have; CE files are the required
+   consumer).
+
+## Consequences
+
+- CE remains the sandbox/accept edge; Switchbay remains the skill/LLM
+  seat. Status fields on the shared JSON are the cross-process progress
+  UI.
+- Tests mock `dispatch_fn` — no paid model seats in CI.
diff --git a/docs/ADR-007-ce-ingest-run-drain.md b/docs/ADR-007-ce-ingest-run-drain.md
new file mode 100644
index 0000000..703f582
--- /dev/null
+++ b/docs/ADR-007-ce-ingest-run-drain.md
@@ -0,0 +1,60 @@
+# ADR-007: CE ingest-queue → Switchbay local_ingest / rail drain
+
+- **Status:** Accepted — current as of **v0.13.0**
+- **Date:** 2026-09-20 (living doc; last aligned with architecture.md for v0.13.0)
+- **Parent:** skill-shell rationalization (CE drop-ingest + pack-run drain parity)
+- **Related:** ADR-006 (CE pack-queue → rail LLM drain)
+- **Deciders:** Ben / skill-shell rationalization charter
+
+## Context
+
+Curiosity Engine's drop-ingest (`POST /api/ingest/from-upload` /
+`from-path`, filebrowser + `/embed/ce/`) stages bytes under
+`vault/raw/` and writes only:
+
+```text
+.workbench/ingest-runs/<run_id>.json   # status: "queued", mode: "staged"
+```
+
+It does **not** run `local_ingest.py` or seat an LLM agent. Pack-runs
+already drain via Switchbay (`POST /api/packs/drain`, ADR-006). Without
+a sibling drain, ingest-runs sit `queued` forever after drop.
+
+Switchbay and CE share the workspace tree (CE auto-started by the shell),
+so the queue files are the handoff surface.
+
+## Decision
+
+1. **Switchbay drains the shared JSON** (no CE `PATCH` required).
+   Module `switchbay.ingest_run_drain`:
+   - `list_queued_runs` / `write_run_status` (atomic JSON rewrite)
+   - `resolve_run_vault_path` — refuse workspace escape / null bytes
+   - Prefer **deterministic** `local_ingest` (`ce_tools._ce_ingest`)
+     for normal vault sources (`mode: staged` and peers)
+   - Escalate to `_dispatch_chat` only when metadata opts in
+     (`mode`/`drain` ∈ {llm,rail,agent,dispatch} or
+     `prefer_rail` / `use_llm` truthy)
+   - `drain_once` — mark `running`, spawn local or rail task, on
+     completion mark `done` / `failed`
+   - In-memory `app["ingest_run_inflight"]` dedupes concurrent drains
+
+2. **Triggers**
+   - Background poll every ~4s while
+     `<workspace>/.workbench/ingest-runs/` exists
+   - Explicit `POST /api/ingest/drain` → `{drained, skipped, errors}`
+   - Opportunistic kick from `_broadcast_files_changed_soon` when
+     the ingest-runs dir is present
+
+3. **Out of scope:** rewriting CE's queue writer, changing
+   Switchbay's own multipart `/api/ingest/from-upload` (still seats
+   rail immediately for non-CE uploads), multimodal CURATE waves.
+
+## Consequences
+
+- CE remains the sandbox/stage edge; Switchbay remains the ingest
+  executor. Status fields on the shared JSON are the cross-process
+  progress UI.
+- Default path stays cheap (no paid model seats). LLM only when the
+  run record asks for it.
+- Tests mock `local_ingest_fn` / `dispatch_fn` — no CE binary or paid
+  model seats in CI.
diff --git a/docs/ADR-008-workspace-sandbox-roots.md b/docs/ADR-008-workspace-sandbox-roots.md
new file mode 100644
index 0000000..b7020c8
--- /dev/null
+++ b/docs/ADR-008-workspace-sandbox-roots.md
@@ -0,0 +1,32 @@
+# ADR-008: Workspace sandbox roots (stage-5 home rule + box `/workspace`)
+
+- **Status:** Accepted — current as of **v0.13.0**
+- **Date:** 2026-09-20 (living doc; last aligned with architecture.md for v0.13.0)
+
+## Context
+
+Stage-5 restricted workspace paths to `$HOME` so file-ops /
+cebridge never get a cwd of `/`, `/etc`, etc. On the Grok Bot box,
+corpora live under `/workspace` (e.g. `/workspace/ce-cb-biocure`).
+`Path.resolve()` follows symlinks, so a `~/Workspaces/...` symlink still
+failed `is_within_home`; E2E had to `unshare`+bind-mount under home.
+
+## Decision
+
+Keep the stage-5 sandbox, but allow a small explicit set of
+roots via `allowed_workspace_roots()`:
+
+1. Always `Path.home()`.
+2. `/workspace` when that directory exists (agent-box scratch).
+3. Extra dirs from `SWITCHBAY_WORKSPACE_ROOTS` (`os.pathsep`-separated;
+   expanduser + resolve; skip missing / non-dirs).
+
+`is_within_home(path)` (name retained for call sites) returns true iff
+the resolved path is under any of those roots. Error copy uses
+`home_label()` → e.g. `must live inside /home/box or /workspace`.
+
+## Consequences
+
+Box corpora register without bind-mount workarounds.
+`/etc`, `/tmp`, `/`, and `..` escapes remain refused unless an operator
+deliberately adds a root via the env var.
diff --git a/docs/CE-EMBED-HOOK.md b/docs/CE-EMBED-HOOK.md
new file mode 100644
index 0000000..c2886a4
--- /dev/null
+++ b/docs/CE-EMBED-HOOK.md
@@ -0,0 +1,90 @@
+# CE embed hook — dual mounts (shell sidebar + Graph canvas)
+
+- **Status:** Accepted — current as of **v0.13.0** (CE **v1.9.0**)
+- **Date:** 2026-09-27 (updated 2026-09-29 for v0.13.0 / CE v1.9.0; living doc)
+- **Owners:** Switchbay (mount scaffolding) · CE Benchmarker (CE `embed` mode)
+
+## Goal
+
+- **Shell left column** hosts the **CE sidebar** (Pages | Files + search that
+  highlights both list and canvas) — **persistent** across Graph / Agents /
+  Editor for CE-backed workspaces.
+- **Graph pane** hosts **only the CE atlas canvas** (+ in-canvas graph-search).
+- **One CE embed session**, **two mount points**, shared `data.json` /
+  module state — same-origin, no iframe, no full-document HTML remount.
+- Switchbay keeps tabs, rail, Agents, theme/mode footer. Non-CE / proxied-off
+  workspaces keep native WikiPane + Files|Sources.
+
+## Do not
+
+- Keep Pages only inside the Graph tab (must persist across tabs).
+- Rebuild Switchbay’s sidebar to imitate CE Pages (search-highlight debt).
+- Run two page lists at once.
+
+## Switchbay scaffolding (landed)
+
+| Piece | Role |
+|-------|------|
+| `ceEmbedSession.ts` | Singleton session: `ensure()` → load `/embed/ce` modules + `data.json`; `attachSidebar` / `attachCanvas` / detach; survives Graph unmount |
+| `CeSidebarSlot.tsx` | Shell-left mount (`#ce-sidebar-root`) when `proxied_skill_embeds` |
+| `CeAtlasEmbed.tsx` | Graph tab canvas (`#graph-root`); soft-parks atlas on tab leave (instant return) |
+| `ceEmbedBootstrap.ts` | `prepareSession()`, script order, fetch shim, `window.CEEmbed` prefer |
+| `ceSidebarShell.html` / `ceEmbedShell.html` | DOM fragments (aside vs graph-pane+modal) |
+
+`Sidebar.tsx`: proxied on → `CeSidebarSlot` (full-height); proxied off →
+WikiPane + Files|Sources as before. Workspace remount calls
+`resetCeEmbedSession()`.
+
+## CE hook (landed in curiosity-engine v1.9.0)
+
+Prefer `window.CEEmbed.create` from `/embed/ce/static/embed.js`. Switchbay
+`ceEmbedBootstrap` / `ceEmbedSession` call it when present; the local stub
+path below remains a fallback for older CE tips.
+
+```js
+window.CEEmbed = {
+  /**
+   * Preferred: create a session, then attach external mounts.
+   * @param {{
+   *   embed: true,
+   *   dataUrl: string,       // "/embed/ce/data.json"
+   *   publicBase: string,    // "/embed/ce"
+   *   chrome?: boolean,      // shell owns theme/rail; CE chrome minimal
+   * }} opts
+   */
+  async create(opts) {
+    return {
+      /** Mount CE Pages|Files sidebar into Switchbay's left column. */
+      mountSidebar(el) { /* Sidebar.init + FileBrowser; search↔canvas */ },
+      /** Mount atlas canvas (+ graph-search) into #graph-root. */
+      mountCanvas(el) { /* AtlasViewer / Graph; share session data */ },
+      destroy() { /* tear both; leave Switchbay fetch/body clean */ },
+    };
+  },
+};
+```
+
+Requirements:
+
+- Single shared state / `data.json` for both mounts.
+- Sidebar search highlights **list + canvas** (existing GraphSearch wiring).
+- `mountCanvas` may be called after `mountSidebar`. Leaving Graph should
+  **soft-park** the canvas (`unmountCanvas()` default) — keep atlas/simulation
+  + loaded data alive off-DOM; return calls `mountCanvas` again for **instant
+  reattach** (no N>10k layout). Pass `unmountCanvas({ destroy: true })` only
+  for hard teardown. Optional `revalidate()` refreshes `data.json` in the
+  background after reattach.
+- Honor `CE_PUBLIC_BASE` / `opts.dataUrl`.
+- Optional: `mount({ mounts: { sidebar, canvas } })` one-shot still OK.
+
+When `CEEmbed.create` is missing (older CE), Switchbay’s stub loads CE
+static modules and calls `Sidebar.init` + `AtlasViewer`/`Graph`/`GraphSearch`
+itself. With CE **v1.9.0**+, prefer the real hook (IndexedDB cache + soft-park).
+
+## Verify
+
+- Pages list visible on Agents and Editor (not only Graph).
+- One page list (CE), not WikiPane + CE.
+- Graph = atlas canvas; rail right-docked; Agents not stuck Loading.
+- Leave Graph → Agents → back Graph is **instant** (no "Loading Curiosity Engine atlas…" / no 20s layout).
+- `/embed/ce/data.json` and `/api/graph/data` still serve BioCure nodes+edges.
diff --git a/docs/architecture.md b/docs/architecture.md
index ab8cf20..e37199c 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -69,6 +69,21 @@ Graph / Agents skill surfaces.
   `local_ingest` (prefer CE drop-ingest endpoint; rail LLM only when
   run metadata opts in).
 
+## Developer decision records
+
+Short public map above; detailed living developer docs below (Accepted as of
+v0.13.0):
+
+| Doc | Topic |
+|-----|--------|
+| [ADR-004](ADR-004-same-origin-embed-proxy.md) | Same-origin embed reverse-proxy (no iframes) |
+| [ADR-004b](ADR-004b-embed-v2-same-document-mount.md) | Embed v2 same-document interactive mount |
+| [CE-EMBED-HOOK](CE-EMBED-HOOK.md) | Dual-mount Graph (CE sidebar + atlas canvas) |
+| [ADR-005](ADR-005-okstratr-harness-registry-client.md) | Settings → okstratr harness registry thin client |
+| [ADR-006](ADR-006-ce-pack-run-drain.md) | CE pack-queue → rail LLM drain |
+| [ADR-007](ADR-007-ce-ingest-run-drain.md) | CE ingest-queue → local_ingest / rail drain |
+| [ADR-008](ADR-008-workspace-sandbox-roots.md) | Workspace sandbox roots (`/workspace` + env) |
+
 ## Migrate-before-thinning
 
 Built-in GraphTab, AgentDashboardTab, and filebrowser **stay** until the
diff --git a/docs/releases/v0.13.0.md b/docs/releases/v0.13.0.md
index 3a41431..9efc94e 100644
--- a/docs/releases/v0.13.0.md
+++ b/docs/releases/v0.13.0.md
@@ -19,7 +19,7 @@ daemon. Settings is a **thin client** over okstratr’s harness registry.
 CE pack-runs and ingest-runs **drain** into Switchbay (rail LLM /
 `local_ingest`).
 
-Canonical architecture: [`architecture.md`](../architecture.md).
+Canonical architecture: [`architecture.md`](../architecture.md). Developer ADRs remain linked from that map (not removed).
 
 **Migrate-before-thinning:** built-in GraphTab, AgentDashboardTab, and
 filebrowser stay until the skill-shell parity checklist is green. Turning on
@@ -41,6 +41,7 @@ okstratr observer; turning it off restores built-ins.
   `SWITCHBAY_*_UPSTREAM` overrides).
 - Injects `X-CE-Host: switchbay` / `X-Okstratr-Host: switchbay`.
 - Vite dev proxies `/embed` to the daemon.
+- ADR: [`ADR-004-same-origin-embed-proxy.md`](../ADR-004-same-origin-embed-proxy.md).
 
 ### Embed v2 — same-document mount
 
@@ -49,6 +50,7 @@ okstratr observer; turning it off restores built-ins.
 - Fetch proxied HTML, rewrite asset URLs, inject markup, **execute** scripts
   (not script-stripped Phase 4a proof).
 - Soft-reload on wiki `files_changed`; tear down scripts on unmount.
+- ADR: [`ADR-004b-embed-v2-same-document-mount.md`](../ADR-004b-embed-v2-same-document-mount.md).
 
 ### Dual-mount Graph (CE sidebar + canvas)
 
@@ -58,6 +60,7 @@ okstratr observer; turning it off restores built-ins.
   instant return; `atlas-cache.js` + workspace key for cold Graph cache.
 - Prefers `window.CEEmbed.create` (CE v1.9.0); session singleton survives
   Graph unmount.
+- Doc: [`CE-EMBED-HOOK.md`](../CE-EMBED-HOOK.md).
 
 ### Core-skills auto-start + host_notify
 
@@ -68,11 +71,14 @@ okstratr observer; turning it off restores built-ins.
 ### Settings → okstratr harness registry
 
 - `/api/okstratr/harness*` thin client; no second Switchbay allowlist.
+- ADR: [`ADR-005-okstratr-harness-registry-client.md`](../ADR-005-okstratr-harness-registry-client.md).
 
 ### Pack + ingest drain
 
 - CE queues pack-runs / ingest-runs under `.workbench/`; Switchbay drains
   them (rail LLM / `local_ingest`, prefer CE drop-ingest endpoint).
+- ADRs: [`ADR-006`](../ADR-006-ce-pack-run-drain.md),
+  [`ADR-007`](../ADR-007-ce-ingest-run-drain.md).
 
 ## What did **not** change
 

From b6db5057615f399a6eb89311af8f949d25d4ce0c Mon Sep 17 00:00:00 2001
From: benjsmith <benjamincharlessmith@gmail.com>
Date: Thu, 1 Oct 2026 17:21:11 +0000
Subject: [PATCH 7/9] docs: drop internal ADRs from public v0.13.0 tip

Remove ADR-004/004b/005/006/007/008 and CE-EMBED-HOOK from the public
tree again. Keep architecture.md as the short public map (no ADR link
table). Gitignore docs/ADR-*.md and docs/CE-EMBED-HOOK.md; keep
skill-shell-rationalization/. Scrub CHANGELOG and releases/v0.13.0.md
so they do not claim ADRs are linked.

Signed-off-by: benjsmith <benjamincharlessmith@gmail.com>
---
 .gitignore                                    |  4 +
 CHANGELOG.md                                  | 11 ++-
 docs/ADR-004-same-origin-embed-proxy.md       | 66 --------------
 docs/ADR-004b-embed-v2-same-document-mount.md | 78 ----------------
 ...DR-005-okstratr-harness-registry-client.md | 52 -----------
 docs/ADR-006-ce-pack-run-drain.md             | 54 -----------
 docs/ADR-007-ce-ingest-run-drain.md           | 60 -------------
 docs/ADR-008-workspace-sandbox-roots.md       | 32 -------
 docs/CE-EMBED-HOOK.md                         | 90 -------------------
 docs/architecture.md                          | 15 ----
 docs/releases/v0.13.0.md                      |  8 +-
 11 files changed, 10 insertions(+), 460 deletions(-)
 delete mode 100644 docs/ADR-004-same-origin-embed-proxy.md
 delete mode 100644 docs/ADR-004b-embed-v2-same-document-mount.md
 delete mode 100644 docs/ADR-005-okstratr-harness-registry-client.md
 delete mode 100644 docs/ADR-006-ce-pack-run-drain.md
 delete mode 100644 docs/ADR-007-ce-ingest-run-drain.md
 delete mode 100644 docs/ADR-008-workspace-sandbox-roots.md
 delete mode 100644 docs/CE-EMBED-HOOK.md

diff --git a/.gitignore b/.gitignore
index 557ab92..5fe5fec 100644
--- a/.gitignore
+++ b/.gitignore
@@ -52,6 +52,10 @@ docs/product-pilot-judge-results-*.md
 docs/product-pilot-*.md
 docs/vscode-plugin.md
 
+# ── internal ADRs / embed hook (living developer docs — not public tip) ──
+docs/ADR-*.md
+docs/CE-EMBED-HOOK.md
+
 # ── local skill-shell umbrella workspace (never ship) ──
 skill-shell-rationalization/
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 21e831b..9c4bc78 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,7 +24,7 @@ Skill pins for this wave (tags pending docs merges):
 | okstratr | **v0.2.0** (pending) | hosted proxy + registry SSOT + observer desk UX |
 | curiosity-merge | **v0.8.4** (pending) | Phase 3 installer / UI-boundary contract |
 
-See [release notes](docs/releases/v0.13.0.md) and [architecture](docs/architecture.md). Developer ADRs (004/004b/005/006/007/008, [CE-EMBED-HOOK](docs/CE-EMBED-HOOK.md)) remain as living docs linked from architecture.md.
+See [release notes](docs/releases/v0.13.0.md) and [architecture](docs/architecture.md).
 
 ### Added
 
@@ -44,11 +44,10 @@ See [release notes](docs/releases/v0.13.0.md) and [architecture](docs/architectu
 - **Core-skills auto-start** — always start CE + okstratr with the shell;
   rail `host_notify`; `OKSTRATR_HOSTED=switchbay` on supervised serve.
 - **Settings → okstratr harness registry** — thin client (`/api/okstratr/harness*`);
-  no second Switchbay allowlist (ADR-005).
-- **Pack / ingest drain** — drain CE `.workbench/pack-runs/` into rail LLM
-  (ADR-006); drain ingest-runs via `local_ingest` / prefer CE drop-ingest
-  endpoint (ADR-007).
-- **Sandbox roots** — allow `/workspace` (+ env roots) in home-gate (ADR-008).
+  no second Switchbay allowlist.
+- **Pack / ingest drain** — drain CE `.workbench/pack-runs/` into rail LLM;
+  drain ingest-runs via `local_ingest` / prefer CE drop-ingest endpoint.
+- **Sandbox roots** — allow `/workspace` (+ env roots) in home-gate.
 
 ### Fixed / polish (embed wave)
 
diff --git a/docs/ADR-004-same-origin-embed-proxy.md b/docs/ADR-004-same-origin-embed-proxy.md
deleted file mode 100644
index 309be11..0000000
--- a/docs/ADR-004-same-origin-embed-proxy.md
+++ /dev/null
@@ -1,66 +0,0 @@
-# ADR-004: Same-origin embed reverse-proxy (no iframes)
-
-- **Status:** Accepted — current as of **v0.13.0** (Phase 4a); Embed v2 mount → [ADR-004b](./ADR-004b-embed-v2-same-document-mount.md)
-- **Date:** 2026-09-18 (living doc; last aligned with architecture.md for v0.13.0)
-- **Deciders:** Ben / skill-shell rationalization charter
-
-## Context
-
-Switchbay hosts Graph (curiosity-engine atlas/wiki) and Agents (okstratr
-observer/desk) surfaces. Cross-origin iframes pointed at
-`127.0.0.1:8766` / `:8767` break hosted-mode control (okstratr HTML
-settings must hide when `host=switchbay`) and create an opaque nested
-browsing context.
-
-Charter locked decision #1: shells **same-origin reverse-proxy** skill
-daemons; in-app panels load first-party proxied routes — **not nested
-frames**.
-
-## Decision
-
-1. **Daemon reverse-proxy** (always on; independent of the UI flag):
-   - `/embed/ce/*` → `http://127.0.0.1:8766/*` (override:
-     `SWITCHBAY_CE_UPSTREAM`, must remain loopback)
-   - `/embed/okstratr/*` → `http://127.0.0.1:8767/*` (override:
-     `SWITCHBAY_OKSTRATR_UPSTREAM`, must remain loopback)
-   - Upstream allowlist is **loopback-only** (`127.0.0.1` / `::1` /
-     `localhost`). Non-loopback upstreams are rejected (502).
-   - Inject hosted-shell headers on every proxied request:
-     - `X-CE-Host: switchbay`
-     - `X-Okstratr-Host: switchbay`
-
-2. **No iframes** for Graph/Agents skill surfaces. Feature flag
-   `proxied_skill_embeds` (default **false**) switches Graph → CE panel
-   and Agents → okstratr panel that navigate `/embed/*` via same-origin
-   `fetch` + same-document rendering. Phase 4a was script-stripped HTML / JSON; Embed v2 (ADR-004b) executes skill scripts in-panel.
-   Built-in GraphTab / AgentDashboardTab / filebrowser remain the
-   default and are **not deleted**.
-
-3. **Settings → okstratr registry (done — ADR-005).** Switchbay settings
-   is a thin client over okstratr's harness/model registry
-   (`harnesses.toml` via `/api/okstratr/harness…` / embed proxy). No
-   second Switchbay allowlist. See
-   [ADR-005](./ADR-005-okstratr-harness-registry-client.md).
-
-## Consequences
-
-- Dev Vite must proxy `/embed` to the daemon (`vite.config.ts`).
-- CE and okstratr honor public-base + `X-*-Host` (okstratr ADR-004 /
-  `OKSTRATR_PUBLIC_BASE`; CE ADR-001 / `CE_PUBLIC_BASE` — both shipped).
-- Full atlas/observer chrome parity is gated by the parity checklist
-  before any Switchbay duplicate deletion (Phase 4b+).
-  **Migrate-before-thinning:** built-in Graph/Agents/filebrowser stay
-  (v0.13.0 does not delete them).
-- WebSocket upgrade through the embed proxy is deferred; HTTP(S) first.
-- Status as of **v0.13.0:** Phase 4a proxy + Embed v2 mount + dual-mount
-  Graph + core-skills auto-start + Settings harness client are on `main`.
-  `proxied_skill_embeds` remains a Settings opt-in (default false) so the
-  built-in surfaces stay the safe default until operators flip the flag.
-
-## Alternatives considered
-
-| Option | Why not |
-|--------|---------|
-| Cross-origin iframe to :8766/:8767 | Opaque origin; hosted settings leak; charter forbid |
-| Same-origin iframe to `/embed/*` | Still a nested frame; charter: no iframes |
-| Delete built-in Graph/Agents now | Violates parity checklist / dual-stack gate |
diff --git a/docs/ADR-004b-embed-v2-same-document-mount.md b/docs/ADR-004b-embed-v2-same-document-mount.md
deleted file mode 100644
index b4f7493..0000000
--- a/docs/ADR-004b-embed-v2-same-document-mount.md
+++ /dev/null
@@ -1,78 +0,0 @@
-# ADR-004b: Embed v2 — same-document interactive mount
-
-- **Status:** Accepted — current as of **v0.13.0** (Embed v2 shipped)
-- **Date:** 2026-09-19 (living doc; last aligned with architecture.md for v0.13.0)
-- **Parent:** [ADR-004](./ADR-004-same-origin-embed-proxy.md)
-- **Contract:** umbrella `CONTRACT-EMBED-V2.md`
-
-## Context
-
-Phase 4a (`ProxiedSkillPanel`) fetched `/embed/*` HTML and injected a
-**script-stripped** body. That proved the reverse-proxy path but left Graph
-and Agents inert (no pan/zoom, no desk controls). Charter + ADR-004 forbid
-`<iframe>` / nested frames for skill surfaces.
-
-CE and okstratr already honor `CE_PUBLIC_BASE` / `OKSTRATR_PUBLIC_BASE`
-(`_/embed/ce_`, `_/embed/okstratr_`) and inject `window.*_PUBLIC_BASE` so
-API helpers resolve under the proxy. Relative asset tags (`static/main.js`,
-`observer.css`) still need rewriting when the HTML is mounted into a
-Switchbay panel rather than navigated as a top-level document.
-
-## Decision
-
-**Same-document microfrontend mount** (no nested browsing context):
-
-1. **Wait chrome first.** While the panel is open, poll
-   `GET /api/core-skills/status` (~2s). Banner states: `starting` /
-   `unhealthy` / `building_wiki` / `live`. Do **not** flash a full 502
-   error while the supervisor is still `starting` or `stopped` —
-   status chrome explains the wait (`suppressFetchError`).
-2. **Fetch** proxied HTML from `/embed/ce/…` or `/embed/okstratr/…` only
-   when the skill slice is `healthy` (`allowMount`).
-3. **Rewrite** relative / root-relative / loopback asset URLs onto the
-   public base (`frontend/src/widgets/embed/embedMount.ts`).
-4. **Extract** `<script>` tags (classic + `type=module`); inject remaining
-   markup (body + head stylesheets) into a dedicated panel root via
-   `innerHTML`.
-5. **Execute** scripts by `document.createElement("script")` + append
-   (with rewritten `src`, or inline `textContent`). Browsers never run
-   scripts inserted via `innerHTML` alone.
-6. **Tear down** before soft-reload (`sy:files-changed`) or unmount:
-   remove tracked script nodes and clear the panel root so listeners /
-   duplicate roots do not accumulate.
-7. **JSON** responses keep the pretty-print path (no script mount).
-
-Built-in `GraphTab` is **not** deleted (parity checklist / Ben lock).
-
-## Consequences
-
-- Interactive CE / okstratr chrome can run under `/embed/*` without iframes.
-- Skill UIs share the Switchbay document: global ID collisions and
-  `document`-level assumptions are residual risks; skills should prefer
-  scoped queries when possible.
-- **WebSocket upgrade** through the embed proxy remains deferred (HTTP
-  first). Live features that require WS may be limited until proxyed.
-- Unit tests cover URL rewrite, script extraction, and status-banner
-  mapping (`embedMount.test.ts`).
-
-## Alternatives considered
-
-| Option | Why not |
-|--------|---------|
-| Keep script-stripping | Inert UI; fails Embed v2 acceptance |
-| Same-origin `<iframe src="/embed/…">` | Nested frame; charter / ADR-004 forbid |
-| `srcdoc` iframe | Still a nested browsing context |
-| Shadow DOM isolation | Extra complexity; CE/okstratr expect light DOM + `getElementById` |
-
-## Mount algorithm (short)
-
-```
-poll status → if !healthy: banner only
-else:
-  teardown prior mount
-  html = fetch(/embed/…/)
-  { markup, scripts } = prepareEmbedHtml(html, publicBase, pagePath)
-  root.innerHTML = markup
-  for s in scripts: createElement(script); set src|text; append; await load
-on files_changed / unmount: teardown
-```
diff --git a/docs/ADR-005-okstratr-harness-registry-client.md b/docs/ADR-005-okstratr-harness-registry-client.md
deleted file mode 100644
index 508c3bd..0000000
--- a/docs/ADR-005-okstratr-harness-registry-client.md
+++ /dev/null
@@ -1,52 +0,0 @@
-# ADR-005: Settings → okstratr harness registry (SSOT client)
-
-- **Status:** Accepted — current as of **v0.13.0**
-- **Date:** 2026-09-19 (living doc; last aligned with architecture.md for v0.13.0)
-- **Parent:** [ADR-004](./ADR-004-same-origin-embed-proxy.md) (Settings thin client — **done** in v0.13.0)
-- **Deciders:** Ben / skill-shell rationalization charter
-
-## Context
-
-okstratr owns the harness+model registry (`~/.config/okstratr/harnesses.toml`
-via `GET/POST /api/harness…`). Charter: shells are **config UIs** over that
-registry — no second Switchbay allowlist. Hosted mode
-(`X-Okstratr-Host: switchbay`) already disables okstratr HTML settings, so
-Switchbay Settings must become the write path.
-
-## Decision
-
-1. **Thin client module** `switchbay.okstratr_harness`:
-   - Server-side calls loopback `SWITCHBAY_OKSTRATR_UPSTREAM`
-     (default `http://127.0.0.1:8767`) with hosted-shell header.
-   - Loopback guard reused from `embed_proxy` (non-loopback → 502).
-   - `normalize_registry()` maps okstratr `list_for_api` JSON; never
-     invents an allowlist.
-   - Browser may also hit same-origin `/embed/okstratr/api/harness…`.
-
-2. **Daemon routes** (shells/UI need not know embed paths):
-   - `GET  /api/okstratr/harness`
-   - `POST /api/okstratr/harness/enable`   `{ "id": "…" }`
-   - `POST /api/okstratr/harness/disable`  `{ "id": "…" }`
-   - `POST /api/okstratr/harness/set`      `{ "key": "…", "value": "…" }`
-   - `POST /api/okstratr/harness/reload`
-
-3. **Settings UI** — section **Harness registry · okstratr**: list rows,
-   enable/disable, set `harness.<id>.default_model`. Existing Pi / local
-   LLM panels remain as **rail** surfaces and are labeled as not the
-   desk/agent SSOT.
-
-## Consequences
-
-- okstratr must be healthy (core-skill supervisor) for Settings toggles
-  to succeed; UI surfaces a clear 502 when upstream is down.
-- No `harnesses.toml` (or equivalent) under Switchbay state dirs.
-- Pi harness (`/api/llm/harness`) and local LLM panels stay Switchbay-local
-  for rail chat; they must not claim desk registry ownership.
-
-## Alternatives considered
-
-| Option | Why not |
-|--------|---------|
-| Copy allowlist into Switchbay `app_settings` | Second SSOT; charter forbid |
-| Settings UI calls `:8767` cross-origin | Breaks hosted-mode headers / CORS |
-| Only document CLI (`okstratr harness …`) | Users need in-app toggles when HTML settings are hosted-off |
diff --git a/docs/ADR-006-ce-pack-run-drain.md b/docs/ADR-006-ce-pack-run-drain.md
deleted file mode 100644
index 2c26ccd..0000000
--- a/docs/ADR-006-ce-pack-run-drain.md
+++ /dev/null
@@ -1,54 +0,0 @@
-# ADR-006: CE pack-queue → Switchbay rail LLM drain
-
-- **Status:** Accepted — current as of **v0.13.0**
-- **Date:** 2026-09-19 (living doc; last aligned with architecture.md for v0.13.0)
-- **Parent:** skill-shell rationalization (CE filebrowser packs Phase 2b)
-- **Deciders:** Ben / skill-shell rationalization charter
-
-## Context
-
-Curiosity Engine's proxied filebrowser accepts
-`POST /api/packs/<pack>/action/<action>` and, after sandbox checks,
-writes only:
-
-```text
-.workbench/pack-runs/<run_id>.json   # status: "queued"
-```
-
-It does **not** seat an LLM agent. Switchbay already has
-`handle_pack_action` which seats `_dispatch_chat` with skill
-`<pack>-<action>`, but the CE path never hits that handler — so
-CE-queued runs stayed `queued` forever.
-
-Switchbay and CE share the workspace tree (CE auto-started by the shell),
-so the queue files are the handoff surface.
-
-## Decision
-
-1. **Switchbay drains the shared JSON** (no CE `PATCH` required).
-   Module `switchbay.pack_run_drain`:
-   - `list_queued_runs` / `write_run_status` (atomic JSON rewrite)
-   - `build_pack_prompt` — same text as `handle_pack_action`
-   - `drain_once` — validate pack enabled + skill exists, mark
-     `running`, spawn `_dispatch_chat` (injectable for tests), on
-     task completion mark `done` / `failed`
-   - In-memory `app["pack_run_inflight"]` dedupes concurrent drains
-
-2. **Triggers**
-   - Background poll every ~4s while
-     `<workspace>/.workbench/pack-runs/` exists
-   - Explicit `POST /api/packs/drain` → `{drained, skipped, errors}`
-   - Opportunistic kick from `_broadcast_files_changed_soon` when
-     the pack-runs dir is present
-
-3. **Out of scope (this ADR):** reveal-in-OS, drop-ingest, rewriting
-   CE's queue writer, and refactoring `handle_pack_action` to also
-   write pack-runs JSON (nice-to-have; CE files are the required
-   consumer).
-
-## Consequences
-
-- CE remains the sandbox/accept edge; Switchbay remains the skill/LLM
-  seat. Status fields on the shared JSON are the cross-process progress
-  UI.
-- Tests mock `dispatch_fn` — no paid model seats in CI.
diff --git a/docs/ADR-007-ce-ingest-run-drain.md b/docs/ADR-007-ce-ingest-run-drain.md
deleted file mode 100644
index 703f582..0000000
--- a/docs/ADR-007-ce-ingest-run-drain.md
+++ /dev/null
@@ -1,60 +0,0 @@
-# ADR-007: CE ingest-queue → Switchbay local_ingest / rail drain
-
-- **Status:** Accepted — current as of **v0.13.0**
-- **Date:** 2026-09-20 (living doc; last aligned with architecture.md for v0.13.0)
-- **Parent:** skill-shell rationalization (CE drop-ingest + pack-run drain parity)
-- **Related:** ADR-006 (CE pack-queue → rail LLM drain)
-- **Deciders:** Ben / skill-shell rationalization charter
-
-## Context
-
-Curiosity Engine's drop-ingest (`POST /api/ingest/from-upload` /
-`from-path`, filebrowser + `/embed/ce/`) stages bytes under
-`vault/raw/` and writes only:
-
-```text
-.workbench/ingest-runs/<run_id>.json   # status: "queued", mode: "staged"
-```
-
-It does **not** run `local_ingest.py` or seat an LLM agent. Pack-runs
-already drain via Switchbay (`POST /api/packs/drain`, ADR-006). Without
-a sibling drain, ingest-runs sit `queued` forever after drop.
-
-Switchbay and CE share the workspace tree (CE auto-started by the shell),
-so the queue files are the handoff surface.
-
-## Decision
-
-1. **Switchbay drains the shared JSON** (no CE `PATCH` required).
-   Module `switchbay.ingest_run_drain`:
-   - `list_queued_runs` / `write_run_status` (atomic JSON rewrite)
-   - `resolve_run_vault_path` — refuse workspace escape / null bytes
-   - Prefer **deterministic** `local_ingest` (`ce_tools._ce_ingest`)
-     for normal vault sources (`mode: staged` and peers)
-   - Escalate to `_dispatch_chat` only when metadata opts in
-     (`mode`/`drain` ∈ {llm,rail,agent,dispatch} or
-     `prefer_rail` / `use_llm` truthy)
-   - `drain_once` — mark `running`, spawn local or rail task, on
-     completion mark `done` / `failed`
-   - In-memory `app["ingest_run_inflight"]` dedupes concurrent drains
-
-2. **Triggers**
-   - Background poll every ~4s while
-     `<workspace>/.workbench/ingest-runs/` exists
-   - Explicit `POST /api/ingest/drain` → `{drained, skipped, errors}`
-   - Opportunistic kick from `_broadcast_files_changed_soon` when
-     the ingest-runs dir is present
-
-3. **Out of scope:** rewriting CE's queue writer, changing
-   Switchbay's own multipart `/api/ingest/from-upload` (still seats
-   rail immediately for non-CE uploads), multimodal CURATE waves.
-
-## Consequences
-
-- CE remains the sandbox/stage edge; Switchbay remains the ingest
-  executor. Status fields on the shared JSON are the cross-process
-  progress UI.
-- Default path stays cheap (no paid model seats). LLM only when the
-  run record asks for it.
-- Tests mock `local_ingest_fn` / `dispatch_fn` — no CE binary or paid
-  model seats in CI.
diff --git a/docs/ADR-008-workspace-sandbox-roots.md b/docs/ADR-008-workspace-sandbox-roots.md
deleted file mode 100644
index b7020c8..0000000
--- a/docs/ADR-008-workspace-sandbox-roots.md
+++ /dev/null
@@ -1,32 +0,0 @@
-# ADR-008: Workspace sandbox roots (stage-5 home rule + box `/workspace`)
-
-- **Status:** Accepted — current as of **v0.13.0**
-- **Date:** 2026-09-20 (living doc; last aligned with architecture.md for v0.13.0)
-
-## Context
-
-Stage-5 restricted workspace paths to `$HOME` so file-ops /
-cebridge never get a cwd of `/`, `/etc`, etc. On the Grok Bot box,
-corpora live under `/workspace` (e.g. `/workspace/ce-cb-biocure`).
-`Path.resolve()` follows symlinks, so a `~/Workspaces/...` symlink still
-failed `is_within_home`; E2E had to `unshare`+bind-mount under home.
-
-## Decision
-
-Keep the stage-5 sandbox, but allow a small explicit set of
-roots via `allowed_workspace_roots()`:
-
-1. Always `Path.home()`.
-2. `/workspace` when that directory exists (agent-box scratch).
-3. Extra dirs from `SWITCHBAY_WORKSPACE_ROOTS` (`os.pathsep`-separated;
-   expanduser + resolve; skip missing / non-dirs).
-
-`is_within_home(path)` (name retained for call sites) returns true iff
-the resolved path is under any of those roots. Error copy uses
-`home_label()` → e.g. `must live inside /home/box or /workspace`.
-
-## Consequences
-
-Box corpora register without bind-mount workarounds.
-`/etc`, `/tmp`, `/`, and `..` escapes remain refused unless an operator
-deliberately adds a root via the env var.
diff --git a/docs/CE-EMBED-HOOK.md b/docs/CE-EMBED-HOOK.md
deleted file mode 100644
index c2886a4..0000000
--- a/docs/CE-EMBED-HOOK.md
+++ /dev/null
@@ -1,90 +0,0 @@
-# CE embed hook — dual mounts (shell sidebar + Graph canvas)
-
-- **Status:** Accepted — current as of **v0.13.0** (CE **v1.9.0**)
-- **Date:** 2026-09-27 (updated 2026-09-29 for v0.13.0 / CE v1.9.0; living doc)
-- **Owners:** Switchbay (mount scaffolding) · CE Benchmarker (CE `embed` mode)
-
-## Goal
-
-- **Shell left column** hosts the **CE sidebar** (Pages | Files + search that
-  highlights both list and canvas) — **persistent** across Graph / Agents /
-  Editor for CE-backed workspaces.
-- **Graph pane** hosts **only the CE atlas canvas** (+ in-canvas graph-search).
-- **One CE embed session**, **two mount points**, shared `data.json` /
-  module state — same-origin, no iframe, no full-document HTML remount.
-- Switchbay keeps tabs, rail, Agents, theme/mode footer. Non-CE / proxied-off
-  workspaces keep native WikiPane + Files|Sources.
-
-## Do not
-
-- Keep Pages only inside the Graph tab (must persist across tabs).
-- Rebuild Switchbay’s sidebar to imitate CE Pages (search-highlight debt).
-- Run two page lists at once.
-
-## Switchbay scaffolding (landed)
-
-| Piece | Role |
-|-------|------|
-| `ceEmbedSession.ts` | Singleton session: `ensure()` → load `/embed/ce` modules + `data.json`; `attachSidebar` / `attachCanvas` / detach; survives Graph unmount |
-| `CeSidebarSlot.tsx` | Shell-left mount (`#ce-sidebar-root`) when `proxied_skill_embeds` |
-| `CeAtlasEmbed.tsx` | Graph tab canvas (`#graph-root`); soft-parks atlas on tab leave (instant return) |
-| `ceEmbedBootstrap.ts` | `prepareSession()`, script order, fetch shim, `window.CEEmbed` prefer |
-| `ceSidebarShell.html` / `ceEmbedShell.html` | DOM fragments (aside vs graph-pane+modal) |
-
-`Sidebar.tsx`: proxied on → `CeSidebarSlot` (full-height); proxied off →
-WikiPane + Files|Sources as before. Workspace remount calls
-`resetCeEmbedSession()`.
-
-## CE hook (landed in curiosity-engine v1.9.0)
-
-Prefer `window.CEEmbed.create` from `/embed/ce/static/embed.js`. Switchbay
-`ceEmbedBootstrap` / `ceEmbedSession` call it when present; the local stub
-path below remains a fallback for older CE tips.
-
-```js
-window.CEEmbed = {
-  /**
-   * Preferred: create a session, then attach external mounts.
-   * @param {{
-   *   embed: true,
-   *   dataUrl: string,       // "/embed/ce/data.json"
-   *   publicBase: string,    // "/embed/ce"
-   *   chrome?: boolean,      // shell owns theme/rail; CE chrome minimal
-   * }} opts
-   */
-  async create(opts) {
-    return {
-      /** Mount CE Pages|Files sidebar into Switchbay's left column. */
-      mountSidebar(el) { /* Sidebar.init + FileBrowser; search↔canvas */ },
-      /** Mount atlas canvas (+ graph-search) into #graph-root. */
-      mountCanvas(el) { /* AtlasViewer / Graph; share session data */ },
-      destroy() { /* tear both; leave Switchbay fetch/body clean */ },
-    };
-  },
-};
-```
-
-Requirements:
-
-- Single shared state / `data.json` for both mounts.
-- Sidebar search highlights **list + canvas** (existing GraphSearch wiring).
-- `mountCanvas` may be called after `mountSidebar`. Leaving Graph should
-  **soft-park** the canvas (`unmountCanvas()` default) — keep atlas/simulation
-  + loaded data alive off-DOM; return calls `mountCanvas` again for **instant
-  reattach** (no N>10k layout). Pass `unmountCanvas({ destroy: true })` only
-  for hard teardown. Optional `revalidate()` refreshes `data.json` in the
-  background after reattach.
-- Honor `CE_PUBLIC_BASE` / `opts.dataUrl`.
-- Optional: `mount({ mounts: { sidebar, canvas } })` one-shot still OK.
-
-When `CEEmbed.create` is missing (older CE), Switchbay’s stub loads CE
-static modules and calls `Sidebar.init` + `AtlasViewer`/`Graph`/`GraphSearch`
-itself. With CE **v1.9.0**+, prefer the real hook (IndexedDB cache + soft-park).
-
-## Verify
-
-- Pages list visible on Agents and Editor (not only Graph).
-- One page list (CE), not WikiPane + CE.
-- Graph = atlas canvas; rail right-docked; Agents not stuck Loading.
-- Leave Graph → Agents → back Graph is **instant** (no "Loading Curiosity Engine atlas…" / no 20s layout).
-- `/embed/ce/data.json` and `/api/graph/data` still serve BioCure nodes+edges.
diff --git a/docs/architecture.md b/docs/architecture.md
index e37199c..ab8cf20 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -69,21 +69,6 @@ Graph / Agents skill surfaces.
   `local_ingest` (prefer CE drop-ingest endpoint; rail LLM only when
   run metadata opts in).
 
-## Developer decision records
-
-Short public map above; detailed living developer docs below (Accepted as of
-v0.13.0):
-
-| Doc | Topic |
-|-----|--------|
-| [ADR-004](ADR-004-same-origin-embed-proxy.md) | Same-origin embed reverse-proxy (no iframes) |
-| [ADR-004b](ADR-004b-embed-v2-same-document-mount.md) | Embed v2 same-document interactive mount |
-| [CE-EMBED-HOOK](CE-EMBED-HOOK.md) | Dual-mount Graph (CE sidebar + atlas canvas) |
-| [ADR-005](ADR-005-okstratr-harness-registry-client.md) | Settings → okstratr harness registry thin client |
-| [ADR-006](ADR-006-ce-pack-run-drain.md) | CE pack-queue → rail LLM drain |
-| [ADR-007](ADR-007-ce-ingest-run-drain.md) | CE ingest-queue → local_ingest / rail drain |
-| [ADR-008](ADR-008-workspace-sandbox-roots.md) | Workspace sandbox roots (`/workspace` + env) |
-
 ## Migrate-before-thinning
 
 Built-in GraphTab, AgentDashboardTab, and filebrowser **stay** until the
diff --git a/docs/releases/v0.13.0.md b/docs/releases/v0.13.0.md
index 9efc94e..3a41431 100644
--- a/docs/releases/v0.13.0.md
+++ b/docs/releases/v0.13.0.md
@@ -19,7 +19,7 @@ daemon. Settings is a **thin client** over okstratr’s harness registry.
 CE pack-runs and ingest-runs **drain** into Switchbay (rail LLM /
 `local_ingest`).
 
-Canonical architecture: [`architecture.md`](../architecture.md). Developer ADRs remain linked from that map (not removed).
+Canonical architecture: [`architecture.md`](../architecture.md).
 
 **Migrate-before-thinning:** built-in GraphTab, AgentDashboardTab, and
 filebrowser stay until the skill-shell parity checklist is green. Turning on
@@ -41,7 +41,6 @@ okstratr observer; turning it off restores built-ins.
   `SWITCHBAY_*_UPSTREAM` overrides).
 - Injects `X-CE-Host: switchbay` / `X-Okstratr-Host: switchbay`.
 - Vite dev proxies `/embed` to the daemon.
-- ADR: [`ADR-004-same-origin-embed-proxy.md`](../ADR-004-same-origin-embed-proxy.md).
 
 ### Embed v2 — same-document mount
 
@@ -50,7 +49,6 @@ okstratr observer; turning it off restores built-ins.
 - Fetch proxied HTML, rewrite asset URLs, inject markup, **execute** scripts
   (not script-stripped Phase 4a proof).
 - Soft-reload on wiki `files_changed`; tear down scripts on unmount.
-- ADR: [`ADR-004b-embed-v2-same-document-mount.md`](../ADR-004b-embed-v2-same-document-mount.md).
 
 ### Dual-mount Graph (CE sidebar + canvas)
 
@@ -60,7 +58,6 @@ okstratr observer; turning it off restores built-ins.
   instant return; `atlas-cache.js` + workspace key for cold Graph cache.
 - Prefers `window.CEEmbed.create` (CE v1.9.0); session singleton survives
   Graph unmount.
-- Doc: [`CE-EMBED-HOOK.md`](../CE-EMBED-HOOK.md).
 
 ### Core-skills auto-start + host_notify
 
@@ -71,14 +68,11 @@ okstratr observer; turning it off restores built-ins.
 ### Settings → okstratr harness registry
 
 - `/api/okstratr/harness*` thin client; no second Switchbay allowlist.
-- ADR: [`ADR-005-okstratr-harness-registry-client.md`](../ADR-005-okstratr-harness-registry-client.md).
 
 ### Pack + ingest drain
 
 - CE queues pack-runs / ingest-runs under `.workbench/`; Switchbay drains
   them (rail LLM / `local_ingest`, prefer CE drop-ingest endpoint).
-- ADRs: [`ADR-006`](../ADR-006-ce-pack-run-drain.md),
-  [`ADR-007`](../ADR-007-ce-ingest-run-drain.md).
 
 ## What did **not** change
 

From d961817312176dc8aacd8cf5a20a5f18517afb85 Mon Sep 17 00:00:00 2001
From: benjsmith <benjamincharlessmith@gmail.com>
Date: Sat, 3 Oct 2026 08:30:47 +0000
Subject: [PATCH 8/9] chore: refresh uv.lock for switchbay 0.13.0

The version bump left uv.lock on 0.12.19, so uv sync --locked failed CI.

Signed-off-by: benjsmith <benjamincharlessmith@gmail.com>
---
 uv.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/uv.lock b/uv.lock
index a3705a0..bfbf92d 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2515,7 +2515,7 @@ wheels = [
 
 [[package]]
 name = "switchbay"
-version = "0.12.19"
+version = "0.13.0"
 source = { virtual = "." }
 dependencies = [
     { name = "aiohttp" },

From b0efbec21c188f556bd32b4430f603aa8627758f Mon Sep 17 00:00:00 2001
From: benjsmith <benjamincharlessmith@gmail.com>
Date: Sat, 3 Oct 2026 08:41:56 +0000
Subject: [PATCH 9/9] docs: rewrite v0.13.0 public prose for readers

Drop process jargon (Phase labels, Embed v2, migrate-before-thinning,
skill-shell charter, Ben lock, tags-pending SHAs). State skill versions
plainly. Keep Graph/Agents; scrub internal names from README/concepts.

Signed-off-by: benjsmith <benjamincharlessmith@gmail.com>
---
 CHANGELOG.md                   | 43 +++++++++++-----------
 README.md                      | 15 ++++----
 docs/architecture.md           | 27 +++++++-------
 docs/concepts-and-data-flow.md | 25 +++++++------
 docs/enterprise.md             |  2 +-
 docs/releases/v0.13.0.md       | 65 ++++++++++++++++------------------
 6 files changed, 85 insertions(+), 92 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c4bc78..0342451 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,62 +5,59 @@ Human-curated release notes. Earlier 0.9.x notes also live on the
 
 ## 2026-09-29 — v0.13.0
 
-**Migration:** none (feature-preserving vs v0.12.19 architecture cutover).
-**Breaking:** none for wiki/vault format. After pull, run `make refresh BUILD=1`
-and hard-reload the PWA. No new VSIX. Do **not** tag from the docs PR alone.
+**Migration:** none. **Breaking:** none for wiki/vault format. After pull,
+run `make refresh BUILD=1` and hard-reload the PWA. No new VSIX.
 
-Architecture cutover under the skill-shell import charter: Switchbay
-**same-origin reverse-proxies** CE + okstratr (no iframes), mounts skill UIs
-same-document (Embed v2), dual-mounts CE sidebar + Graph canvas, auto-starts
-core skills, and becomes a thin client over okstratr’s harness registry.
-Built-in Graph / Agents / filebrowser remain until the parity checklist is
-green (**migrate-before-thinning**).
+Switchbay **0.13.0** same-origin reverse-proxies curiosity-engine and
+okstratr (no iframes), mounts skill UIs in the same document, dual-mounts
+CE sidebar + Graph canvas, auto-starts core skills, and is a thin client
+over okstratr’s harness registry. Built-in Graph, Agents, and filebrowser
+remain; proxied embeds are opt-in in Settings.
 
-Skill pins for this wave (tags pending docs merges):
+Skill versions:
 
 | Skill | Version | Notes |
 |---|---|---|
-| curiosity-engine | **v1.9.0** (pending) | tip `3018580`; CEEmbed dual-mount + IndexedDB cache + soft-park |
-| okstratr | **v0.2.0** (pending) | hosted proxy + registry SSOT + observer desk UX |
-| curiosity-merge | **v0.8.4** (pending) | Phase 3 installer / UI-boundary contract |
+| curiosity-engine | **1.9.0** | Dual-mount Pages + atlas; IndexedDB cache |
+| okstratr | **0.2.0** | Hosted proxy; registry SSOT; observer desk UX |
+| curiosity-merge | **0.8.4** | Installer / UI-boundary contract |
 
 See [release notes](docs/releases/v0.13.0.md) and [architecture](docs/architecture.md).
 
 ### Added
 
-- **Phase 4a same-origin embed reverse-proxy** — `/embed/ce/*` → `:8766`,
+- **Same-origin embed reverse-proxy** — `/embed/ce/*` → `:8766`,
   `/embed/okstratr/*` → `:8767`; loopback-only upstreams; inject
   `X-CE-Host` / `X-Okstratr-Host: switchbay`. Feature flag
   `proxied_skill_embeds` (Settings) switches Graph → CE / Agents → okstratr;
   daemon proxy is always on. Built-ins **not** deleted.
-- **Embed v2 same-document mount** — fetch proxied HTML when core-skills
+- **Same-document skill mount** — fetch proxied HTML when core-skills
   healthy; rewrite assets; execute scripts in-panel; wait chrome via
   `GET /api/core-skills/status` (`starting` / `unhealthy` / `building_wiki` /
   `live`). Soft-reload on `sy:files-changed`.
 - **Dual-mount CE Graph** — shell-left `CeSidebarSlot` (Pages|Files persists
   across Graph/Agents/Editor) + Graph-pane `CeAtlasEmbed` canvas; shared
-  `ceEmbedSession`; prefers `window.CEEmbed.create` when present; soft-park
-  atlas across tab switches; loads `atlas-cache.js` for cold Graph cache.
+  `ceEmbedSession`; prefers `window.CEEmbed.create` when present; keeps
+  atlas warm across tab switches; loads `atlas-cache.js` for cold Graph cache.
 - **Core-skills auto-start** — always start CE + okstratr with the shell;
   rail `host_notify`; `OKSTRATR_HOSTED=switchbay` on supervised serve.
 - **Settings → okstratr harness registry** — thin client (`/api/okstratr/harness*`);
   no second Switchbay allowlist.
-- **Pack / ingest drain** — drain CE `.workbench/pack-runs/` into rail LLM;
-  drain ingest-runs via `local_ingest` / prefer CE drop-ingest endpoint.
+- **Pack / ingest queues** — process CE `.workbench/pack-runs/` via rail LLM;
+  process ingest-runs via `local_ingest` / prefer CE drop-ingest endpoint.
 - **Sandbox roots** — allow `/workspace` (+ env roots) in home-gate.
 
-### Fixed / polish (embed wave)
+### Fixed / polish
 
 - Keep CE atlas warm across Graph tab switches; dual-mount sidebar bugs after
   Graph mount; gzip large JSON + guard soft-remount during CE load; retarget
   viewer on workspace switch; serve `data.json` fast / enrich off hot path;
   vault missing-extract UX from `vault.db`.
 
-### Unchanged (feature-preserving)
+### Unchanged
 
 - v0.12.19 Curate / desks / Web / Comms / watch-folder / Zen behavior remains
-  the product baseline. This release is the embed/architecture cutover on top
-  of that gate — not a revert of Graph/Agents chrome.
+  the product baseline. Graph and Agents chrome stay; proxied mode is opt-in.
 
 ## 2026-09-20 — v0.12.19
 
diff --git a/README.md b/README.md
index 61d26e8..b59367a 100644
--- a/README.md
+++ b/README.md
@@ -15,9 +15,10 @@ curate captured material into linked wiki pages, run Auto orchestration
 It runs **entirely on your machine**, against whatever models you choose,
 and nothing leaves unless you send it.
 
-- **Local & private** — a Switchbay aiohttp shell on your machine (auto-starts
-  CE + okstratr) and your files. No cloud, no accounts; your data and API
-  keys stay on your machine. See [`docs/architecture.md`](docs/architecture.md).
+- **Local & private** — a Switchbay daemon on your machine (auto-starts
+  curiosity-engine + okstratr) and your files. No cloud, no accounts; your
+  data and API keys stay on your machine. See
+  [`docs/architecture.md`](docs/architecture.md).
 - **Bring your own models** — hosted APIs (Anthropic, xAI Grok, OpenAI,
   Gemini, Meta Muse Spark), subscription coding CLIs (Claude Code, Grok
   Build, Muse Code, Codex, Copilot), or fully-local models (llama.cpp /
@@ -101,9 +102,9 @@ make sync           # uv sync (base Python deps; add `make sync-semantic` for em
 make sync-frontend  # pnpm install in frontend/
 ```
 
-Dev needs the daemon and Vite. The daemon is the Switchbay aiohttp shell
-and **auto-starts** curiosity-engine (`:8766`) + okstratr (`:8767`); Vite
-is only for hot frontend reload. In one terminal:
+Dev needs the daemon and Vite. The daemon **auto-starts** curiosity-engine
+(`:8766`) + okstratr (`:8767`); Vite is only for hot frontend reload. In
+one terminal:
 
 ```sh
 WORKSPACE=/path/to/workspace make dev-daemon
@@ -187,7 +188,7 @@ don’t need to quit and reopen the PWA after each restart.
 
 ## More
 
-- **[`docs/architecture.md`](docs/architecture.md)** — current hosting architecture (embed proxy, CEEmbed, core-skills, drains).
+- **[`docs/architecture.md`](docs/architecture.md)** — how Switchbay hosts CE and okstratr (embed proxy, core-skills, pack/ingest queues).
 - **[`docs/concepts-and-data-flow.md`](docs/concepts-and-data-flow.md)** — the map: concepts + data flows.
 - **[`docs/known-issues.md`](docs/known-issues.md)** — rough edges + deliberate deferrals in this release.
 - **[`docs/THIRD-PARTY-NOTICES.md`](docs/THIRD-PARTY-NOTICES.md)** — third-party attributions.
diff --git a/docs/architecture.md b/docs/architecture.md
index ab8cf20..c7688f7 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -15,7 +15,7 @@ Browser PWA  ──WS/HTTP──▶  Switchbay daemon :8765
                               ├── /embed/okstratr/* → 127.0.0.1:8767  (okstratr)
                               ├── /api/core-skills/*   (auto-start + status)
                               ├── /api/okstratr/harness*  (Settings thin client)
-                              └── pack / ingest drainers  (.workbench queues)
+                              └── pack / ingest queues  (.workbench)
 ```
 
 Same-origin reverse proxy + **same-document** mounts — **no iframes** for
@@ -32,24 +32,24 @@ Graph / Agents skill surfaces.
   okstratr observer; turning it off restores built-ins. The proxy itself
   stays on either way.
 
-## Embed v2 — same-document mount
+## Same-document skill mount
 
 - Poll `GET /api/core-skills/status`; wait chrome while `starting` /
   `building_wiki` / `unhealthy`; mount only when healthy.
 - `fetch` proxied HTML, rewrite asset URLs onto `/embed/…`, inject markup,
-  **execute** scripts via `createElement` + append (not script-stripped).
+  **execute** scripts via `createElement` + append.
 - Soft-reload on wiki `files_changed`; tear down scripts on unmount.
 - Implementation: `frontend/src/widgets/embed/` (`ProxiedSkillPanel`,
   `embedMount.ts`).
 
-## Dual-mount Graph (CEEmbed)
+## Dual-mount Graph
 
 - Shell left column: CE Pages|Files (`CeSidebarSlot`) persists across
   Graph / Agents / Editor when proxied embeds are on for a CE workspace.
-- Graph pane: atlas canvas only (`CeAtlasEmbed`); soft-park on leave;
-  `atlas-cache.js` + workspace key for cold Graph cache.
-- Prefers `window.CEEmbed.create` / `mount` when CE ships it; one session
-  singleton survives Graph unmount.
+- Graph pane: atlas canvas only (`CeAtlasEmbed`); keeps the atlas warm
+  when you leave the tab; `atlas-cache.js` + workspace key for cold Graph cache.
+- Prefers `window.CEEmbed.create` / `mount` when CE provides it; one
+  session survives Graph unmount.
 
 ## Core-skills auto-start
 
@@ -62,15 +62,14 @@ Graph / Agents skill surfaces.
 - `/api/okstratr/harness*` is a thin client over okstratr’s harness /
   model registry. No second Switchbay allowlist.
 
-## Pack + ingest drain
+## Pack + ingest queues
 
 - CE queues pack-runs and ingest-runs under `.workbench/`.
-- Switchbay drains pack-runs into the rail LLM and ingest-runs via
+- Switchbay processes pack-runs via the rail LLM and ingest-runs via
   `local_ingest` (prefer CE drop-ingest endpoint; rail LLM only when
   run metadata opts in).
 
-## Migrate-before-thinning
+## Built-in Graph and Agents
 
-Built-in GraphTab, AgentDashboardTab, and filebrowser **stay** until the
-skill-shell parity checklist is green. v0.13.0 does not delete them;
-proxied embeds are opt-in.
+Built-in GraphTab, AgentDashboardTab, and filebrowser stay available.
+Proxied skill embeds are opt-in in Settings.
diff --git a/docs/concepts-and-data-flow.md b/docs/concepts-and-data-flow.md
index 091013c..1de05c3 100644
--- a/docs/concepts-and-data-flow.md
+++ b/docs/concepts-and-data-flow.md
@@ -13,7 +13,7 @@ running tools, and turning raw material into a knowledge graph.
 > If a detail here disagrees with the code, the code wins — this doc is
 > the map, not the territory.
 
-Skill hosting (same-origin embed proxy, CEEmbed dual-mount Graph, core-skills auto-start, pack/ingest drain, Settings → okstratr registry): **[`architecture.md`](architecture.md)**.
+Skill hosting (same-origin embed proxy, dual-mount Graph, core-skills auto-start, pack/ingest queues, Settings → okstratr registry): **[`architecture.md`](architecture.md)**.
 
 ---
 
@@ -43,13 +43,13 @@ local. Nothing leaves unless you send it.
 
 ## Runtime shape
 
-Your browser, the Switchbay aiohttp shell, auto-started core skills, and
-your files. No cloud, no accounts. Hosting / embed detail:
+Your browser, the Switchbay daemon, auto-started core skills, and your
+files. No cloud, no accounts. Hosting / embed detail:
 **[`architecture.md`](architecture.md)**.
 
 ```
  ┌─────────────────────────┐         ┌──────────────────────────────┐
- │  Browser frontend (PWA)  │  WS +   │  Switchbay daemon (aiohttp)  │
+ │  Browser frontend (PWA)  │  WS +   │  Switchbay daemon            │
  │  installed from          │◀──HTTP─▶│  always-on launchd agent     │
  │  http://127.0.0.1:8765   │  :8765  │  :8765                       │
  │  Power mode · Zen mode   │         │                              │
@@ -76,14 +76,13 @@ your files. No cloud, no accounts. Hosting / embed detail:
   from `http://127.0.0.1:8765` so it gets a dock icon + standalone
   window. In dev, vite serves `:5173` and proxies `/api` + `/ws` +
   `/embed`.
-- **Daemon (shell)**: one aiohttp process, always on (launchd agent,
-  restart on crash). Owns the LLM providers, tool registry, rail
-  history, managed local model server, PTY sessions, and same-origin
-  `/embed` reverse proxy. **Auto-starts** curiosity-engine (`:8766`) and
-  okstratr (`:8767`). Closing the window does **not** stop work — runs
-  live in the daemon. Skill UI mounts (CEEmbed dual-mount Graph, soft-
-  park, pack/ingest drain, Settings → okstratr harness): see
-  [`architecture.md`](architecture.md).
+- **Daemon**: one always-on process (launchd agent, restart on crash).
+  Owns the LLM providers, tool registry, rail history, managed local
+  model server, PTY sessions, and same-origin `/embed` reverse proxy.
+  **Auto-starts** curiosity-engine (`:8766`) and okstratr (`:8767`).
+  Closing the window does **not** stop work — runs live in the daemon.
+  Skill UI mounts (dual-mount Graph, pack/ingest queues, Settings →
+  okstratr harness): see [`architecture.md`](architecture.md).
 - **Knowledge base**: a **curiosity-engine**-shaped folder (curiosity-
   engine is bundled as a first-party skill). Durable, user-facing files
   (`wiki/`, `vault/`, figures,
@@ -507,7 +506,7 @@ all. Two interop layers sit on top:
 
 ## See also
 
-- [`architecture.md`](architecture.md) — current hosting / embed architecture (v0.13).
+- [`architecture.md`](architecture.md) — how Switchbay hosts CE and okstratr (v0.13).
 - `README.md` — what Switch Bay is and how to run it.
 - `CLAUDE.md` — orientation for AI coding sessions.
 - `src/switchbay/` — the daemon; each module's docstring carries its rationale.
diff --git a/docs/enterprise.md b/docs/enterprise.md
index 2bf4296..8184059 100644
--- a/docs/enterprise.md
+++ b/docs/enterprise.md
@@ -205,7 +205,7 @@ normal-sensitivity thread stays pending until explicit Approve, and
 confirm Revoke stops a subsequent poll. Do not treat a green unit suite
 as tenant certification.
 
-Release notes: [`releases/v0.13.0.md`](releases/v0.13.0.md) (embed/architecture cutover); prior gate [`releases/v0.12.19.md`](releases/v0.12.19.md).
+Release notes: [`releases/v0.13.0.md`](releases/v0.13.0.md); prior [`releases/v0.12.19.md`](releases/v0.12.19.md).
 
 ## SentinelOne / EDR
 
diff --git a/docs/releases/v0.13.0.md b/docs/releases/v0.13.0.md
index 3a41431..499249d 100644
--- a/docs/releases/v0.13.0.md
+++ b/docs/releases/v0.13.0.md
@@ -1,67 +1,65 @@
 # v0.13.0 — 2026-09-29
 
-**Migration:** no wiki/vault format changes. **Architecture cutover** under the
-skill-shell import charter — feature-preserving vs **v0.12.19**. After pull:
+**Migration:** none (wiki and vault formats unchanged). After pull:
 
 ```sh
 git pull
 make refresh BUILD=1
 ```
 
-Hard-reload the PWA. No new VSIX. Do **not** treat this docs PR as a tag.
+Hard-reload the PWA. No new VSIX.
 
 ## What changed
 
-Switchbay now **hosts** curiosity-engine (Graph / filebrowser / atlas) and
+Switchbay **0.13.0** hosts curiosity-engine (Graph, filebrowser, atlas) and
 okstratr (Agents / observer) through a **same-origin reverse proxy** and
-**same-document** mount — **no iframes**. Core skills **auto-start** with the
-daemon. Settings is a **thin client** over okstratr’s harness registry.
-CE pack-runs and ingest-runs **drain** into Switchbay (rail LLM /
+**same-document** mount — no iframes. Core skills start with the daemon.
+Settings is a thin client over okstratr’s harness registry. Pack-runs and
+ingest-runs from CE workspaces are handled by Switchbay (rail LLM /
 `local_ingest`).
 
-Canonical architecture: [`architecture.md`](../architecture.md).
+Built-in Graph and Agents remain available. Settings → **Proxied skill
+embeds** switches Graph to the CE canvas and Agents to the okstratr
+observer; turning it off restores the built-ins.
 
-**Migrate-before-thinning:** built-in GraphTab, AgentDashboardTab, and
-filebrowser stay until the skill-shell parity checklist is green. Turning on
-Settings → **Proxied skill embeds** switches Graph → CE canvas and Agents →
-okstratr observer; turning it off restores built-ins.
+Canonical architecture: [`architecture.md`](../architecture.md).
 
-### Skill pins (tags pending)
+### Skill versions
 
-| Skill | Version | Role in this release |
+| Skill | Version | Role |
 |---|---|---|
-| [curiosity-engine](https://github.com/benjsmith/curiosity-engine) | **v1.9.0** (pending; tip `3018580`) | `/embed/ce` viewer; `CEEmbed.create` dual-mount; IndexedDB atlas cache; soft-park |
-| [okstratr](https://github.com/benjsmith/okstratr) | **v0.2.0** (pending) | `/embed/okstratr` observer; registry SSOT; host_notify; `OKSTRATR_PUBLIC_BASE` |
-| [curiosity-merge](https://github.com/benjsmith/curiosity-merge) | **v0.8.4** (pending) | Headless federation; Phase 3 installer / UI-boundary contract |
+| [curiosity-engine](https://github.com/benjsmith/curiosity-engine) | **1.9.0** | `/embed/ce` viewer; dual-mount Pages + atlas; IndexedDB atlas cache |
+| [okstratr](https://github.com/benjsmith/okstratr) | **0.2.0** | `/embed/okstratr` observer; harness registry; `OKSTRATR_PUBLIC_BASE` |
+| [curiosity-merge](https://github.com/benjsmith/curiosity-merge) | **0.8.4** | Headless federation; installer / UI-boundary contract |
 
-### Phase 4a — reverse proxy
+### Same-origin reverse proxy
 
-- Daemon always proxies `/embed/ce/*` → `127.0.0.1:8766` and
+- Daemon proxies `/embed/ce/*` → `127.0.0.1:8766` and
   `/embed/okstratr/*` → `127.0.0.1:8767` (loopback-only;
   `SWITCHBAY_*_UPSTREAM` overrides).
 - Injects `X-CE-Host: switchbay` / `X-Okstratr-Host: switchbay`.
 - Vite dev proxies `/embed` to the daemon.
 
-### Embed v2 — same-document mount
+### Same-document skill mount
 
 - Poll `GET /api/core-skills/status`; wait chrome while `starting` /
   `building_wiki`; mount only when healthy.
-- Fetch proxied HTML, rewrite asset URLs, inject markup, **execute** scripts
-  (not script-stripped Phase 4a proof).
+- Fetch proxied HTML, rewrite asset URLs, inject markup, and run scripts
+  in-panel.
 - Soft-reload on wiki `files_changed`; tear down scripts on unmount.
 
 ### Dual-mount Graph (CE sidebar + canvas)
 
 - Shell left column: CE Pages|Files (`CeSidebarSlot`) persists across
   Graph / Agents / Editor for CE-backed workspaces when proxied embeds are on.
-- Graph pane: CE atlas canvas only (`CeAtlasEmbed`); soft-park on leave for
-  instant return; `atlas-cache.js` + workspace key for cold Graph cache.
-- Prefers `window.CEEmbed.create` (CE v1.9.0); session singleton survives
-  Graph unmount.
+- Graph pane: CE atlas canvas only (`CeAtlasEmbed`); keeps the atlas warm
+  when you leave the tab; `atlas-cache.js` + workspace key for cold Graph cache.
+- Prefers `window.CEEmbed.create` when CE provides it; one session
+  survives Graph unmount.
 
 ### Core-skills auto-start + host_notify
 
-- CE + okstratr always auto-start with the shell (Ben lock).
+- CE and okstratr always start with the shell.
 - Supervised okstratr serve sets `OKSTRATR_HOSTED=switchbay`.
 - Rail receives okstratr `host_notify` envelopes.
 
@@ -69,17 +67,16 @@ okstratr observer; turning it off restores built-ins.
 
 - `/api/okstratr/harness*` thin client; no second Switchbay allowlist.
 
-### Pack + ingest drain
+### Pack + ingest queues
 
-- CE queues pack-runs / ingest-runs under `.workbench/`; Switchbay drains
-  them (rail LLM / `local_ingest`, prefer CE drop-ingest endpoint).
+- CE queues pack-runs / ingest-runs under `.workbench/`; Switchbay
+  processes them (rail LLM / `local_ingest`, prefer CE drop-ingest endpoint).
 
 ## What did **not** change
 
 - v0.12.19 Curate settlement, desk live-worker caps, Web default-off,
   Comms metadata-first, watch folders, Zen/rail geometry — still the
-  behavior baseline ([v0.12.19 notes](v0.12.19.md),
-  [import gate](../handoff/2026-09-20-skill-shell-parity.md)).
+  behavior baseline ([v0.12.19 notes](v0.12.19.md)).
 - Graph and Agents are **not** removed; proxied mode is opt-in via Settings.
 
 ## After pull
@@ -88,7 +85,7 @@ okstratr observer; turning it off restores built-ins.
 make refresh BUILD=1
 ```
 
-Enable **Proxied skill embeds** in Settings to exercise Graph→CE /
+Enable **Proxied skill embeds** in Settings to use Graph→CE /
 Agents→okstratr. Confirm core-skills status goes `live`, Graph paints from
 cache on hard-reload, and Agents shows the okstratr observer (no nested
 iframe).
@@ -98,6 +95,6 @@ iframe).
 - Unit: embed mount / URL rewrite / status banner; version sync
   (`test_version_sync` — 0.13.0 across pyproject / `__init__` / frontend).
 - Manual: proxied on/off round-trip; dual-mount Pages persist on Agents;
-  Graph leave→return instant; pack/ingest drain smoke on a CE workspace.
+  Graph leave→return stays warm; pack/ingest queue smoke on a CE workspace.
 
 Live iCloud / enterprise-tenant limits from v0.12.19 still apply.