diff --git a/.agents/skills/capture-ui-evidence/SKILL.md b/.agents/skills/capture-ui-evidence/SKILL.md
new file mode 100644
index 000000000..09cab32b8
--- /dev/null
+++ b/.agents/skills/capture-ui-evidence/SKILL.md
@@ -0,0 +1,35 @@
+---
+name: capture-ui-evidence
+description: Use the standard Jones Code UI verification and evidence workflow for UI changes and screenshots. Route interactive shared-renderer checks to T3 Browser, native Linux desktop scenarios to the Electron harness after exact-revision qualification, and mobile checks to test-t3-mobile.
+---
+
+# Capture Jones Code UI evidence
+
+This is the default workflow for verifying user-visible UI changes and recording evidence. Choose the affected client:
+
+- Shared web/desktop renderer: [test-t3-app](../test-t3-app/SKILL.md) and T3's Browser panel for live inspection, clicks, typing, screenshots and iteration.
+- Linux native desktop shell: the Electron runner below for repeatable screenshots and scripted interactions after exact-revision qualification.
+- Native mobile: [test-t3-mobile](../test-t3-mobile/SKILL.md).
+
+Exercise the changed flow, assert its observable result, and check backend readback or reload persistence when the change depends on them. Use the same evidence format on every route: full candidate/comparison revisions (plus patch identity for dirty source), build correspondence, client/route, actual viewport/scale/theme, meaningful fixture, action and readback, captures, and coverage limits. The source/build distinction in [runner output and evidence limits](references/runner-output-and-limits.md) applies to Browser evidence too; a dev source OID alone is not an attestation of the served bundle.
+
+T3 Browser remains the shared-renderer route. An unavailable Preview does not authorize switching to a standalone browser or using Electron as a Browser fallback.
+
+The Linux Electron runner is a separate route for behavior that depends on the desktop shell. Require a recorded passing qualification for the exact harness revision; exploratory output alone leaves Electron-specific behavior unverified. This nightly source port does not qualify a host or adopt an installed wrapper. A separately installed host command must remain pinned to its qualified revision, with readback in `~/.local/state/jones-code-ui-evidence/qualification.json`; an older source qualification does not qualify this port.
+
+The runner launches existing built outputs; it does not build the app. On a host with the installed command, first run `jones-code-ui-evidence doctor`, then use `jones-code-ui-evidence run --source /absolute/candidate --build-receipt /absolute/candidate-receipt.json` with a scenario that exercises the changed flow. The default `sidebar-rename` is a qualification/smoke scenario; it does not verify an unrelated UI change. A custom scenario receives a Playwright page and Electron app for inspecting and interacting with the candidate inside the isolated run.
+
+From the Jones Code repository root, use:
+
+```sh
+node apps/desktop/scripts/ui-evidence.mjs doctor [--source DIR]
+node apps/desktop/scripts/ui-evidence.mjs setup [--source DIR]
+node apps/desktop/scripts/ui-evidence.mjs run [--source DIR] [--scenario sidebar-rename|/absolute/path/scenario.mjs] [--size 1280x800] [--scale 1] [--theme system|light|dark] [--comparison OID] [--build-receipt FILE] [--out DIR]
+node apps/desktop/scripts/ui-evidence.mjs cleanup --run <run-id>
+```
+
+The repository also exposes the CLI and its bounded test group as package scripts `ui:evidence` and `test:ui-evidence`, invoked through the existing `vp run <script>` pattern. The test group does not qualify the live Electron route.
+
+`doctor` is read-only and reports prerequisites or exact missing system package names; it installs nothing. `setup` downloads the lockfile-matched Electron runtime into its owned user cache and checks the official checksum. No command elevates privileges. `run` requires an existing built app, defaults to the harness source and `sidebar-rename`, and writes to `<source>/.t3/ui-evidence/runs/<run-id>/` unless `--out` names a path that does not already exist. A full commit OID may be supplied to `--comparison`; `--build-receipt FILE` records a receipt for the exact source and output hashes. Every command emits JSON with an `outcome` of `complete`, `no_change`, `rejected`, `partial`, or `unknown`. A run returns 0 for a pass, 1 for a scenario failure, 2 for a rejected precondition, or 130/143 for cancellation.
+
+Read [runner output and evidence limits](references/runner-output-and-limits.md) before interpreting captures, comparing revisions, or writing a PR claim. Do not weaken isolation or retry a rejected probe by disabling Chromium's sandbox.
diff --git a/.agents/skills/capture-ui-evidence/references/runner-output-and-limits.md b/.agents/skills/capture-ui-evidence/references/runner-output-and-limits.md
new file mode 100644
index 000000000..2ac83ba8e
--- /dev/null
+++ b/.agents/skills/capture-ui-evidence/references/runner-output-and-limits.md
@@ -0,0 +1,57 @@
+# Runner output and evidence limits
+
+## Run lifecycle
+
+The runner uses Xvfb and launches the candidate's built Electron app inside a rootless Bubblewrap sandbox with private namespaces. The sandbox receives the staged app/build inputs and an allowlisted environment, not the real home, `.git`, dotenv files, provider credentials, or host/live network access; its backend uses a private loopback endpoint. It verifies its isolation before app launch and records the probe and resolved backend topology in the manifest. A failed probe rejects the run before launch; report that result and stop. Chromium receives a recorded CDP navigator-online marker so the real renderer attempts its isolated loopback connection; this does not add network interfaces or permit external access.
+
+Runs use separate scratch and artifact directories. The runner registers the exact scratch root before launch, forwards interruption to the owned process, and removes registered scratch on success, failure, or cancellation. Captures and the manifest remain in the artifact directory. Use `cleanup --run <run-id>` only to recover a registered leftover; it rejects unknown IDs, active recorded processes, and paths outside the registered scratch root. Do not remove paths by pattern or clean another run's artifacts.
+
+## Scenarios and captures
+
+A custom scenario is an absolute-path ESM module with a default async function. Its content hash is recorded. Keep it self-contained (Node built-ins are available); only the scenario file is staged, not sibling imports. The context provides the Electron app and Playwright page, `step`, `capture`, `dispatch`, `readSnapshot`, `reload`, `completeOnboarding`, `setTheme`, `setWindowSize`, a disposable workspace, and non-secret logging. Fixture dispatch is limited to `project.create`, `thread.create`, and `thread.metadata.update`. On protocol V2, projects use the authenticated project mutation HTTP endpoint, thread commands use ticket-authenticated WebSocket RPC, and shell readback sends the required protocol header. Tokens and tickets stay inside the private renderer and are not returned as evidence. Create fixture state through the app dispatch or UI; do not write the database directly or send a provider turn.
+
+`setTheme` controls a recorded native-theme and CSS-media fixture and reads the rendered appearance back. It does not prove user theme-preference persistence. Use `ctx.reload()` to restore the recorded navigator-online fixture after navigation.
+
+The built-in `sidebar-rename` scenario completes the normal provider-free first-run UI, then creates a synthetic project and metadata-only thread, captures `before`, renames through the Sidebar, checks the rendered title and backend snapshot, captures `after`, reloads and verifies persistence, then switches to dark theme with readback and captures `after-reload` and `after-reload-dark`.
+
+**Those four capture names describe interaction states in one candidate build. They are not source-code before/after evidence.** The `--comparison OID` option records a declared comparison commit; it does not build or run that revision. To compare a code change, run the same scenario against separately built, exact base and candidate revisions, and retain both run manifests and capture sets.
+
+## Reading the manifest
+
+Each run writes `manifest.json` using schema `jones-code-ui-evidence/v1`. It records the run, harness and source identities, build digests, runtime and window readbacks, fixture and scenario steps, assertions, captures, isolation probe and topology, resource measurements, coverage claims, comparison declaration, status, cleanup outcome, and any error. Capture entries include the PNG hash and actual dimensions, scale, rendered theme, window bounds, and viewport.
+
+Source provenance includes the source HEAD, dirty status, a digest of the tracked diff and untracked-file content, and the declared comparison OID. A dirty-tree capture must be described as that base plus its recorded patch identity, not as a commit-only result. A source OID alone does not prove which code produced existing build outputs: `build.sourceCorrespondence` is `receipt-matched` only when the exact source and build-output receipt match; otherwise describe it as unproved. The unpackaged runtime identity may be `null`.
+
+Use the manifest to state what the run proves and what it leaves open. The built-in scenario covers project/thread metadata and a Sidebar rename with backend readback and reload persistence. It does not cover message content, provider turns, or external services. The Linux harness does not establish behavior for macOS, packaged/fused builds, signing, native dialogs, provider/network flows, or GitHub attachment upload.
+
+## Build receipts
+
+Build the candidate through the repository's desktop build command (`vp run build:desktop`) with development and packaged-executable overrides unset. Keep the source revision and dirty identity unchanged from immediately before the build until the final output digest collection. The harness does not attest an arbitrary receipt's honesty: the operator owns that build sequence.
+
+For automated build orchestration, import `collectProvenance` from `apps/desktop/scripts/ui-evidence/provenance.mjs`. Supply `source`, the pinned `harness`, a new artifact directory, and `buildPaths` with `desktop: <source>/apps/desktop/dist-electron`, `server: <source>/apps/server/dist`, and **`web: <source>/apps/server/dist/client`** (the served client). Collect before and after the build into separate directories, and reject any changed source identity. Write this receipt from the post-build result:
+
+```js
+{
+  schema: "jones-code-ui-evidence-build/v1",
+  source: {
+    head: result.source.head,
+    statusSha256: result.source.statusSha256,
+    patchSha256: result.source.patch.sha256,
+    untrackedSha256: result.source.untracked.sha256
+  },
+  build: Object.fromEntries(
+    ["desktop", "server", "web", "boot"].map(name => [name, result.build[name].sha256])
+  ),
+  invocation: "vp run build:desktop (development/packaged overrides unset)",
+  startedAt: /* ISO timestamp immediately before build */,
+  finishedAt: /* ISO timestamp after successful build */
+}
+```
+
+Pass its absolute path through `--build-receipt`. The command rejects changed source or outputs. Without a receipt, exploratory runs remain usable, but source-to-build correspondence is explicitly unproved. An installed command's pin identifies the harness, not an independently supplied candidate source; use `--source` for a different candidate.
+
+## Sharing evidence
+
+The default `.t3/ui-evidence/runs/` output is task-local and untracked. Attach screenshots or video through the repository's authorized GitHub workflow and verify that each attachment can be retrieved and renders in the PR. The runner does not upload evidence or commit generated captures. Keep the manifest with the PR evidence record so reviewers can identify the exact build, fixture, route, and coverage.
+
+For every evidence set, identify the comparison and candidate revisions, build identity when available, route and platform, actual viewport, scale and theme, fixture and scenario, observable action/readback, and coverage limits. A combined preview must name its integration revision and constituent heads. Refresh any exact-current-head claim after the PR head changes.
diff --git a/.agents/skills/test-t3-app/SKILL.md b/.agents/skills/test-t3-app/SKILL.md
index 06fe9867b..b6e566a8b 100644
--- a/.agents/skills/test-t3-app/SKILL.md
+++ b/.agents/skills/test-t3-app/SKILL.md
@@ -8,7 +8,10 @@ description: Test T3 Code's web and desktop UI through its built-in Browser pane
 Use T3's built-in Browser panel for verification. If its tools are absent or
 the panel reports unavailable, explain the blocker and stop verification.
 Do not install or switch to another automation system. For native mobile
-testing, use [test-t3-mobile](../test-t3-mobile/SKILL.md).
+testing, use [test-t3-mobile](../test-t3-mobile/SKILL.md). For separately
+qualified Linux Electron app-window evidence, see
+[capture-ui-evidence](../capture-ui-evidence/SKILL.md); it does not replace the
+Browser-panel route for shared-renderer work.
 
 ## Start the app
 
@@ -31,8 +34,14 @@ for a fresh one. Keep using the same tab.
 
 ## Verify and retain
 
-Exercise the affected flow and capture the state that proves it works. Keep
-the server, state, and panel available while the user inspects or iterates.
+Follow [capture-ui-evidence](../capture-ui-evidence/SKILL.md) for the common
+evidence format. Exercise the changed flow with snapshots and focused locators,
+assert its visible result, and check backend readback or reload persistence when
+relevant. Record the revision, served build/source correspondence, actual
+viewport/scale/theme, fixture, and coverage limits. Distinguish interaction
+states within one build from two separately built source revisions.
+
+Keep the server, state, and panel available while the user inspects or iterates.
 An assistant turn ending is not teardown. Stop only processes you started,
 using retained terminal sessions or captured PIDs.
 
diff --git a/.agents/skills/test-t3-mobile/SKILL.md b/.agents/skills/test-t3-mobile/SKILL.md
index b2f5443e4..fdb490f0a 100644
--- a/.agents/skills/test-t3-mobile/SKILL.md
+++ b/.agents/skills/test-t3-mobile/SKILL.md
@@ -63,6 +63,11 @@ through AgentDevice. For a backend on the device host, use
 on Android. For a remote backend, use its reachable origin.
 
 Confirm the intended projects appear, exercise the affected flow, and capture
-evidence. Retain the app and environment while iterating. At teardown, remove
+evidence using the common format in
+[capture-ui-evidence](../capture-ui-evidence/SKILL.md). Record the candidate
+revision, native-client and served-backend build correspondence, device and
+platform, actual viewport/scale/theme, fixture, action/readback, and coverage
+limits. Distinguish interaction states in one build from two source builds.
+Retain the app and environment while iterating. At teardown, remove
 the disposable connection, close the AgentDevice session, call `device_close`,
 and stop only your backend and Metro processes.
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 4a66b5d26..471ea789a 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -34,6 +34,12 @@ is insufficient; broad repo-wide checks are not required.
 
 For UI changes, include clear before/after screenshots. Include a short recording
 when motion, timing, transitions, or interaction details are needed to demonstrate
-the change. Upload evidence to GitHub and embed or link it here. Never commit PR-only assets. -->
+the change. Upload evidence to GitHub and embed or link it here. Never commit PR-only assets.
+For each evidence set, identify the full comparison and candidate revisions (plus
+base and patch identity for dirty source), build correspondence, route/platform,
+actual viewport/scale/theme, fixture/scenario, observable action/readback, and
+coverage limits. State whether before/after describes one interaction in one
+build or two exact source builds. Name the integration revision and constituent
+heads for combined previews; refresh exact-head claims after each PR-head change. -->
 
 <!-- If you used an agent, end with the model and harness that did the work. -->
diff --git a/apps/desktop/scripts/ui-evidence.mjs b/apps/desktop/scripts/ui-evidence.mjs
new file mode 100644
index 000000000..f548e1575
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence.mjs
@@ -0,0 +1,250 @@
+import * as NodeFSP from "node:fs/promises";
+import * as NodeChildProcess from "node:child_process";
+import * as NodePath from "node:path";
+import * as NodeOS from "node:os";
+import * as NodeURL from "node:url";
+import { doctor } from "./ui-evidence/doctor.mjs";
+import { setupRuntime, dependencyClosure, sha256, exec } from "./ui-evidence/runtime.mjs";
+import {
+  allocateRun,
+  removeRun,
+  superviseRun,
+  cleanupRegistered,
+} from "./ui-evidence/lifecycle.mjs";
+import { stageRun, bwrapArguments } from "./ui-evidence/sandbox.mjs";
+import { collectProvenance } from "./ui-evidence/provenance.mjs";
+import { createManifest, writeManifest } from "./ui-evidence/manifest.mjs";
+
+export const harness = NodePath.resolve(
+  NodePath.dirname(NodeURL.fileURLToPath(import.meta.url)),
+  "../../..",
+);
+export function parseOptions(argv) {
+  const [command, ...rest] = argv;
+  if (!["doctor", "setup", "run", "cleanup"].includes(command))
+    throw new Error("Expected doctor, setup, run, or cleanup");
+  const allowed = {
+    doctor: ["source"],
+    setup: ["source"],
+    run: ["source", "scenario", "size", "scale", "theme", "comparison", "out", "build-receipt"],
+    cleanup: ["run"],
+  }[command];
+  const options = {};
+  for (let index = 0; index < rest.length; index += 2) {
+    const key = rest[index].slice(2);
+    if (
+      !rest[index].startsWith("--") ||
+      !allowed.includes(key) ||
+      options[key] !== undefined ||
+      !rest[index + 1] ||
+      rest[index + 1].startsWith("--")
+    )
+      throw new Error(`Invalid option: ${rest[index]}`);
+    options[key] = rest[index + 1];
+  }
+  const size = (options.size || "1280x800").match(/^(\d+)x(\d+)$/);
+  if (!size || size.slice(1).some((value) => Number(value) < 320 || Number(value) > 8192))
+    throw new Error("Size must be 320..8192 by 320..8192");
+  const scale = Number(options.scale || "1");
+  if (!Number.isFinite(scale) || scale < 0.5 || scale > 4)
+    throw new Error("Scale must be between 0.5 and 4");
+  const theme = options.theme || "system";
+  if (!["system", "light", "dark"].includes(theme)) throw new Error("Invalid theme");
+  return {
+    command,
+    ...options,
+    source: NodePath.resolve(options.source || harness),
+    size: { width: Number(size[1]), height: Number(size[2]) },
+    scale,
+    theme,
+  };
+}
+export async function assertHarnessPin() {
+  const pin = process.env.JCUE_HARNESS_OID;
+  if (!pin) return;
+  const head = (await exec("git", ["-C", harness, "rev-parse", "HEAD"])).stdout.trim();
+  const status = (
+    await exec("git", ["-C", harness, "status", "--porcelain=v1", "--untracked-files=all"])
+  ).stdout;
+  if (!/^[a-f0-9]{40}$/.test(pin) || pin !== head || status.length)
+    throw new Error("Pinned harness revision mismatch or dirty harness");
+}
+async function runEvidence(options) {
+  const outerStart = performance.now();
+  const timing = {};
+  const checked = await doctor(options.source);
+  timing.preflightSeconds = (performance.now() - outerStart) / 1000;
+  if (checked.outcome !== "complete") return { code: 2, ...checked };
+  const source = await NodeFSP.realpath(options.source);
+  const scenarioId = options.scenario || "sidebar-rename";
+  const scenario =
+    scenarioId === "sidebar-rename"
+      ? NodePath.join(harness, "apps/desktop/scripts/ui-evidence/scenarios/sidebar-rename.mjs")
+      : scenarioId;
+  if (
+    !NodePath.isAbsolute(scenario) ||
+    !scenario.endsWith(".mjs") ||
+    !(await NodeFSP.lstat(scenario)).isFile()
+  )
+    throw new Error("Custom scenario must be an absolute regular .mjs file");
+  let cancelled = null;
+  const interrupt = () => {
+    cancelled = "SIGINT";
+  };
+  const terminate = () => {
+    cancelled = "SIGTERM";
+  };
+  process.on("SIGINT", interrupt);
+  process.on("SIGTERM", terminate);
+  let run,
+    artifacts,
+    provenance,
+    result,
+    inner = null,
+    cleanup;
+  const identity = {
+    id: scenarioId === "sidebar-rename" ? scenarioId : "custom",
+    path: scenario,
+    sha256: await sha256(scenario),
+  };
+  try {
+    run = await allocateRun();
+    artifacts = NodePath.resolve(
+      options.out || NodePath.join(source, ".t3/ui-evidence/runs", run.id),
+    );
+    if (artifacts === run.root || artifacts.startsWith(`${run.root}/`))
+      throw new Error("Artifacts must be separate from scratch");
+    await NodeFSP.mkdir(NodePath.dirname(artifacts), { recursive: true, mode: 0o700 });
+    await NodeFSP.mkdir(artifacts, { mode: 0o700 });
+    const provenanceStart = performance.now();
+    provenance = await collectProvenance({
+      source,
+      harness,
+      comparison: options.comparison,
+      artifacts,
+      buildPaths: {
+        desktop: NodePath.join(source, "apps/desktop/dist-electron"),
+        server: NodePath.join(source, "apps/server/dist"),
+        web: NodePath.join(source, "apps/server/dist/client"),
+      },
+      buildReceipt: options["build-receipt"],
+    });
+    timing.provenanceSeconds = (performance.now() - provenanceStart) / 1000;
+    const stagingStart = performance.now();
+    const closure = await dependencyClosure(source);
+    const clockTicks = Number((await exec("/usr/bin/getconf", ["CLK_TCK"])).stdout.trim());
+    if (!Number.isFinite(clockTicks) || clockTicks <= 0)
+      throw new Error("Cannot determine CPU clock tick units");
+    const configuration = {
+      size: options.size,
+      scale: options.scale,
+      theme: options.theme,
+      realHome: NodeOS.homedir(),
+      clockTicks,
+      hostEffectiveCores: NodeOS.availableParallelism(),
+    };
+    const stage = await stageRun({ run, source, harness, scenario, closure, configuration });
+    if ((await sha256(NodePath.join(stage, "harness/scenario.mjs"))) !== identity.sha256)
+      throw new Error("Scenario changed during staging");
+    timing.stagingSeconds = (performance.now() - stagingStart) / 1000;
+    if (cancelled) throw new Error("Cancelled during preparation");
+    const args = await bwrapArguments({ stage, runtime: checked.runtime, artifacts });
+    let diagnostic = "";
+    result = await superviseRun({
+      run,
+      start: () => {
+        const child = NodeChildProcess.spawn("/usr/bin/bwrap", args, {
+          stdio: ["ignore", "ignore", "pipe"],
+          env: {},
+        });
+        child.stderr.on("data", (data) => {
+          diagnostic = (diagnostic + data.toString()).slice(-65536);
+        });
+        return child;
+      },
+    });
+    cleanup = result.cleanup;
+    diagnostic = diagnostic
+      .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
+      .replace(/((?:token|ticket|secret|password)=)[^\s&]+/gi, "$1[redacted]");
+    await NodeFSP.writeFile(NodePath.join(artifacts, "sandbox.log"), diagnostic, {
+      mode: 0o600,
+      flag: "wx",
+    });
+    try {
+      const innerPath = NodePath.join(artifacts, "inner.json");
+      if (!(await NodeFSP.lstat(innerPath)).isFile())
+        throw new Error("Sandbox result must be a regular file");
+      inner = JSON.parse(await NodeFSP.readFile(innerPath, "utf8"));
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  } catch (error) {
+    result = {
+      code: cancelled ? (cancelled === "SIGINT" ? 130 : 143) : 2,
+      error: error.message,
+      signal: cancelled,
+    };
+  } finally {
+    if (run && !cleanup)
+      try {
+        cleanup = await removeRun(run);
+      } catch (error) {
+        cleanup = { outcome: "unknown", error: error.message };
+        if (result?.code === 0) result.code = 1;
+      }
+    process.off("SIGINT", interrupt);
+    process.off("SIGTERM", terminate);
+  }
+  const status =
+    result.code === 0 ? "passed" : [130, 143].includes(result.code) ? "cancelled" : "failed";
+  if (provenance) {
+    const manifest = createManifest({
+      runId: run.id,
+      provenance,
+      scenario: identity,
+      inner: {
+        ...inner,
+        error: result.error || inner?.error || null,
+        namespaceProcess: result.namespaceProcess || null,
+        resources: {
+          ...inner?.resources,
+          outer: { ...timing, totalSeconds: (performance.now() - outerStart) / 1000 },
+        },
+      },
+      cleanup,
+      status,
+    });
+    await writeManifest(artifacts, manifest);
+  }
+  return {
+    code: result.code,
+    outcome: result.code === 0 ? "complete" : result.code === 2 ? "rejected" : "partial",
+    status,
+    runId: run?.id,
+    artifacts,
+    cleanup,
+    error: result.error || inner?.error || null,
+  };
+}
+export async function main(argv = process.argv.slice(2)) {
+  try {
+    const options = parseOptions(argv);
+    await assertHarnessPin();
+    if (options.command === "doctor") {
+      const result = await doctor(options.source);
+      return { code: result.outcome === "complete" ? 0 : 2, ...result };
+    }
+    if (options.command === "setup") return { code: 0, ...(await setupRuntime(options.source)) };
+    if (options.command === "cleanup")
+      return { code: 0, ...(await cleanupRegistered(options.run)) };
+    return await runEvidence(options);
+  } catch (error) {
+    return { code: 2, outcome: "rejected", error: error.message };
+  }
+}
+if (process.argv[1] && import.meta.url === NodeURL.pathToFileURL(process.argv[1]).href) {
+  const result = await main();
+  process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  process.exitCode = result.code;
+}
diff --git a/apps/desktop/scripts/ui-evidence/doctor.mjs b/apps/desktop/scripts/ui-evidence/doctor.mjs
new file mode 100644
index 000000000..fbd9d9d1a
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/doctor.mjs
@@ -0,0 +1,128 @@
+import * as NodeFSP from "node:fs/promises";
+import * as NodePath from "node:path";
+import {
+  exec,
+  electronVersion,
+  runtimeDirectory,
+  validateRuntime,
+  dependencyClosure,
+} from "./runtime.mjs";
+
+const libraryPackages = {
+  "libnss3.so": "libnss3",
+  "libatk-1.0.so.0": "libatk1.0-0t64",
+  "libatk-bridge-2.0.so.0": "libatk-bridge2.0-0t64",
+  "libcups.so.2": "libcups2t64",
+  "libdrm.so.2": "libdrm2",
+  "libXcomposite.so.1": "libxcomposite1",
+  "libXdamage.so.1": "libxdamage1",
+  "libXrandr.so.2": "libxrandr2",
+  "libgbm.so.1": "libgbm1",
+  "libasound.so.2": "libasound2t64",
+  "libgtk-3.so.0": "libgtk-3-0t64",
+  "libX11.so.6": "libx11-6",
+  "libxcb.so.1": "libxcb1",
+  "libxkbcommon.so.0": "libxkbcommon0",
+};
+export async function doctor(source) {
+  const checks = [];
+  const aptPackages = new Set();
+  async function check(name, fn, packages = []) {
+    try {
+      const detail = await fn();
+      checks.push({ name, status: "passed", detail });
+      return detail;
+    } catch (error) {
+      checks.push({ name, status: "failed", error: error.message });
+      for (const pkg of packages) aptPackages.add(pkg);
+      return null;
+    }
+  }
+  await check("platform", () => {
+    // oxlint-disable-next-line t3code/no-global-process-runtime -- Standalone evidence script has no Effect runtime.
+    if (process.platform !== "linux" || process.arch !== "x64")
+      throw new Error("Linux x64 required");
+    return "linux-x64";
+  });
+  await check(
+    "node",
+    async () => {
+      const version = (await exec("/usr/bin/node", ["--version"])).stdout.trim();
+      if (Number(version.slice(1).split(".")[0]) < 24) throw new Error("Node >=24 required");
+      return version;
+    },
+    ["nodejs"],
+  );
+  await check("Xvfb", () => NodeFSP.access("/usr/bin/Xvfb"), ["xvfb"]);
+  await check("unzip", () => NodeFSP.access("/usr/bin/unzip"), ["unzip"]);
+  const bwrap = await check("bwrap", () => NodeFSP.access("/usr/bin/bwrap"), ["bubblewrap"]);
+  if (bwrap !== null)
+    await check("nested-user-namespace", async () => {
+      const aliases = [];
+      for (const name of ["bin", "sbin", "lib", "lib64"]) {
+        try {
+          aliases.push("--symlink", await NodeFSP.realpath(`/${name}`), `/${name}`);
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+        }
+      }
+      await exec("/usr/bin/bwrap", [
+        "--unshare-user",
+        "--unshare-pid",
+        "--unshare-net",
+        "--die-with-parent",
+        "--ro-bind",
+        "/usr",
+        "/usr",
+        ...aliases,
+        "--proc",
+        "/proc",
+        "--dev",
+        "/dev",
+        "--",
+        "/usr/bin/unshare",
+        "--user",
+        "--map-root-user",
+        "/usr/bin/true",
+      ]);
+      return true;
+    });
+  await check(
+    "fonts",
+    async () => {
+      const output = (await exec("/usr/bin/fc-list", [])).stdout;
+      if (!output.trim()) throw new Error("No fonts available");
+      return { available: true };
+    },
+    ["fontconfig", "fonts-dejavu-core"],
+  );
+  const version = await check("electron-source-pin", () => electronVersion(source));
+  const runtime =
+    version &&
+    (await check("electron-cache", () => validateRuntime(runtimeDirectory(version), version)));
+  if (runtime)
+    await check("electron-libraries", async () => {
+      const output = (await exec("/usr/bin/ldd", [runtime.executable])).stdout;
+      const missing = [...output.matchAll(/^\s*(\S+)\s+=>\s+not found/gm)].map((match) => match[1]);
+      for (const name of missing) if (libraryPackages[name]) aptPackages.add(libraryPackages[name]);
+      if (missing.length) throw new Error(`Missing libraries: ${missing.join(", ")}`);
+      return { missing: [] };
+    });
+  for (const relative of [
+    "apps/desktop/dist-electron/boot.cjs",
+    "apps/server/dist/bin.mjs",
+    "apps/server/dist/client/index.html",
+  ])
+    await check(relative, () => NodeFSP.access(NodePath.join(source, relative)));
+  await check("external-closure", async () => {
+    const closure = await dependencyClosure(source);
+    return { packages: closure.packages.length };
+  });
+  return {
+    outcome: checks.every((check) => check.status === "passed") ? "complete" : "rejected",
+    source,
+    checks,
+    aptPackages: [...aptPackages].sort(),
+    runtime: runtime || null,
+  };
+}
diff --git a/apps/desktop/scripts/ui-evidence/lifecycle.mjs b/apps/desktop/scripts/ui-evidence/lifecycle.mjs
new file mode 100644
index 000000000..69be445ba
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/lifecycle.mjs
@@ -0,0 +1,155 @@
+import * as NodeCrypto from "node:crypto";
+import * as NodeFSP from "node:fs/promises";
+import * as NodePath from "node:path";
+import * as NodeOS from "node:os";
+import * as NodeEvents from "node:events";
+
+async function processIdentity(pid) {
+  if (!pid) return null;
+  try {
+    const value = await NodeFSP.readFile(`/proc/${pid}/stat`, "utf8");
+    return value.slice(value.lastIndexOf(")") + 2).split(" ")[19];
+  } catch (error) {
+    if (["ENOENT", "ESRCH"].includes(error.code)) return null;
+    throw error;
+  }
+}
+
+export const stateParent = () =>
+  NodePath.join(
+    process.env.XDG_STATE_HOME || NodePath.join(NodeOS.homedir(), ".local/state"),
+    "jones-code-ui-evidence",
+  );
+
+export async function allocateRun(parent = stateParent()) {
+  const scratchParent = NodePath.join(parent, "scratch");
+  const registryParent = NodePath.join(parent, "registry");
+  await NodeFSP.mkdir(scratchParent, { recursive: true, mode: 0o700 });
+  await NodeFSP.mkdir(registryParent, { recursive: true, mode: 0o700 });
+  const id = NodeCrypto.randomUUID();
+  const root = await NodeFSP.mkdtemp(NodePath.join(scratchParent, `${id}-`));
+  await NodeFSP.chmod(root, 0o700);
+  const registry = NodePath.join(registryParent, `${id}.json`);
+  const run = { id, root, registry, parent, pid: null };
+  await NodeFSP.writeFile(registry, JSON.stringify(run), { mode: 0o600, flag: "wx" });
+  return run;
+}
+
+export async function removeRun(run, remove = NodeFSP.rm) {
+  const expectedParent = await NodeFSP.realpath(NodePath.join(run.parent, "scratch"));
+  if (
+    NodePath.dirname(run.root) !== expectedParent ||
+    !NodePath.basename(run.root).startsWith(`${run.id}-`)
+  ) {
+    throw new Error("Scratch ownership could not be established");
+  }
+  const stat = await NodeFSP.lstat(run.root).catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+  if (stat?.isSymbolicLink()) throw new Error("Scratch root became a symlink");
+  if (stat) await remove(run.root, { recursive: true, force: false });
+  if (
+    await NodeFSP.lstat(run.root).catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    })
+  )
+    throw new Error("Scratch removal did not complete");
+  await NodeFSP.writeFile(
+    run.registry,
+    JSON.stringify({ ...run, cleanup: "complete", pid: null }),
+    {
+      mode: 0o600,
+    },
+  );
+  return { outcome: "complete", rootAbsent: true };
+}
+
+export async function cleanupRegistered(id, parent = stateParent()) {
+  if (!/^[a-f0-9-]{36}$/.test(id || "")) throw new Error("Invalid run ID");
+  const registry = NodePath.join(parent, "registry", `${id}.json`);
+  const run = JSON.parse(await NodeFSP.readFile(registry, "utf8"));
+  if (run.id !== id || run.parent !== parent || run.registry !== registry)
+    throw new Error("Registry identity mismatch");
+  if (run.pid) {
+    try {
+      process.kill(run.pid, 0);
+      throw new Error("Recorded process still exists; cleanup rejected");
+    } catch (error) {
+      if (error.code !== "ESRCH") throw error;
+    }
+  }
+  return removeRun(run);
+}
+
+// Wait for the retained namespace handle to exit before deleting its writable tree.
+export async function superviseRun({ run, start, signals = process, remove = removeRun }) {
+  let child;
+  let cancelled;
+  let code = 2;
+  let error;
+  const forward = (signal) => {
+    cancelled = signal;
+    if (child && child.exitCode === null && child.signalCode === null) {
+      child.kill(signal);
+      escalation ??= setTimeout(() => {
+        if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+      }, 5000);
+    }
+  };
+  const interrupt = () => forward("SIGINT");
+  const terminate = () => forward("SIGTERM");
+  signals.on("SIGINT", interrupt);
+  signals.on("SIGTERM", terminate);
+  let cleanup;
+  let escalation;
+  let startTicks = null;
+  try {
+    if (cancelled) throw new Error("Cancelled before spawn");
+    child = await start();
+    const closed = new Promise((resolve, reject) => {
+      child.once("error", reject);
+      child.once("close", (exitCode, signal) => resolve({ exitCode, signal }));
+    });
+    run.pid = child.pid;
+    startTicks = await processIdentity(child.pid);
+    run.startTicks = startTicks;
+    await NodeFSP.writeFile(run.registry, JSON.stringify(run), { mode: 0o600 });
+    if (cancelled) forward(cancelled);
+    const result = await closed;
+    code = cancelled ? (cancelled === "SIGINT" ? 130 : 143) : (result.exitCode ?? 1);
+  } catch (caught) {
+    error = caught.message;
+    if (child?.pid && child.exitCode === null && child.signalCode === null) {
+      child.kill("SIGKILL");
+      await NodeEvents.once(child, "close").catch(() => {});
+    }
+    code = cancelled ? (cancelled === "SIGINT" ? 130 : 143) : 2;
+  } finally {
+    clearTimeout(escalation);
+    try {
+      cleanup = await remove(run);
+    } catch (caught) {
+      cleanup = { outcome: "unknown", error: caught.message };
+      if (code === 0) code = 1;
+    }
+    signals.off("SIGINT", interrupt);
+    signals.off("SIGTERM", terminate);
+  }
+  const currentTicks = await processIdentity(child?.pid);
+  const exited =
+    !currentTicks || (startTicks && currentTicks !== startTicks)
+      ? true
+      : child?.pid
+        ? "unknown"
+        : true;
+  return {
+    code,
+    signal: cancelled ?? null,
+    cleanup,
+    error,
+    pid: child?.pid ?? null,
+    namespaceProcess: { pid: child?.pid ?? null, startTicks, exited },
+  };
+}
diff --git a/apps/desktop/scripts/ui-evidence/lifecycle.test.mjs b/apps/desktop/scripts/ui-evidence/lifecycle.test.mjs
new file mode 100644
index 000000000..73cea4536
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/lifecycle.test.mjs
@@ -0,0 +1,108 @@
+import * as NodeTest from "node:test";
+import * as NodeAssert from "node:assert/strict";
+import * as NodeEvents from "node:events";
+import * as NodeFSP from "node:fs/promises";
+import * as NodePath from "node:path";
+import {
+  allocateRun,
+  superviseRun,
+  cleanupRegistered,
+  removeRun,
+  stateParent,
+} from "./lifecycle.mjs";
+
+async function fixture(fn) {
+  const parent = stateParent();
+  await NodeFSP.mkdir(parent, { recursive: true, mode: 0o700 });
+  const root = await NodeFSP.mkdtemp(NodePath.join(parent, "lifecycle-test-"));
+  try {
+    await fn(root);
+  } finally {
+    await NodeFSP.rm(root, { recursive: true, force: true });
+  }
+}
+function fakeChild() {
+  const child = new NodeEvents.EventEmitter();
+  child.pid = undefined;
+  child.exitCode = null;
+  child.signalCode = null;
+  child.finish = (code, signal = null) => {
+    child.exitCode = code;
+    child.signalCode = signal;
+    child.emit("close", code, signal);
+  };
+  child.kill = (signal) => {
+    queueMicrotask(() => child.finish(null, signal));
+    return true;
+  };
+  return child;
+}
+for (const entry of [
+  { name: "success", code: 0 },
+  { name: "failure", code: 7 },
+  { name: "SIGINT", signal: "SIGINT", code: 130 },
+  { name: "SIGTERM", signal: "SIGTERM", code: 143 },
+]) {
+  NodeTest.test(`${entry.name} removes only scratch and preserves artifacts and result`, () =>
+    fixture(async (parent) => {
+      const run = await allocateRun(parent);
+      const artifacts = NodePath.join(parent, "artifacts");
+      await NodeFSP.mkdir(artifacts);
+      await NodeFSP.writeFile(NodePath.join(artifacts, "evidence"), "retained");
+      const signals = new NodeEvents.EventEmitter();
+      const result = await superviseRun({
+        run,
+        signals,
+        start: () => {
+          const child = fakeChild();
+          setImmediate(() =>
+            entry.signal ? signals.emit(entry.signal) : child.finish(entry.code),
+          );
+          return child;
+        },
+      });
+      NodeAssert.equal(result.code, entry.code);
+      NodeAssert.equal(result.cleanup.outcome, "complete");
+      await NodeAssert.rejects(NodeFSP.access(run.root), { code: "ENOENT" });
+      NodeAssert.equal(
+        await NodeFSP.readFile(NodePath.join(artifacts, "evidence"), "utf8"),
+        "retained",
+      );
+      NodeAssert.equal(signals.listenerCount("SIGINT") + signals.listenerCount("SIGTERM"), 0);
+    }),
+  );
+}
+NodeTest.test("cleanup failure changes success but preserves an earlier failure", () =>
+  fixture(async (parent) => {
+    for (const code of [0, 7]) {
+      const run = await allocateRun(parent);
+      const result = await superviseRun({
+        run,
+        signals: new NodeEvents.EventEmitter(),
+        remove: async () => {
+          throw new Error("injected");
+        },
+        start: () => {
+          const child = fakeChild();
+          setImmediate(() => child.finish(code));
+          return child;
+        },
+      });
+      NodeAssert.equal(result.code, code === 0 ? 1 : code);
+      NodeAssert.equal(result.cleanup.outcome, "unknown");
+      await removeRun(run);
+    }
+  }),
+);
+NodeTest.test("concurrent owners cannot remove each other and registry rejects escaped roots", () =>
+  fixture(async (parent) => {
+    const [first, second] = await Promise.all([allocateRun(parent), allocateRun(parent)]);
+    await removeRun(first);
+    await NodeFSP.access(second.root);
+    const record = { ...second, root: NodePath.join(parent, "artifacts") };
+    await NodeFSP.writeFile(second.registry, JSON.stringify(record));
+    await NodeAssert.rejects(cleanupRegistered(second.id, parent), /ownership/);
+    await removeRun(second);
+    await NodeAssert.rejects(cleanupRegistered("unknown", parent), /Invalid run ID/);
+  }),
+);
diff --git a/apps/desktop/scripts/ui-evidence/manifest.mjs b/apps/desktop/scripts/ui-evidence/manifest.mjs
new file mode 100644
index 000000000..4959d0c4a
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/manifest.mjs
@@ -0,0 +1,109 @@
+import * as NodeFSP from "node:fs/promises";
+import * as NodePath from "node:path";
+
+export const NOT_COVERED = [
+  "macOS",
+  "packaged/fused builds",
+  "signing",
+  "native dialogs",
+  "provider/network flows",
+  "message content",
+  "GitHub attachment upload",
+];
+const digest = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+const oid = (value) => typeof value === "string" && /^[a-f0-9]{40}$/.test(value);
+export function validateManifest(value) {
+  if (
+    value?.schema !== "jones-code-ui-evidence/v1" ||
+    typeof value.runId !== "string" ||
+    !value.runId
+  )
+    throw new Error("Invalid manifest identity");
+  if (!["passed", "failed", "cancelled", "rejected"].includes(value.status))
+    throw new Error("Invalid manifest status");
+  if (!oid(value.source?.head) || !oid(value.harness?.head))
+    throw new Error("Manifest needs full source and harness OIDs");
+  if (
+    !digest(value.source?.statusSha256) ||
+    !digest(value.source?.patch?.sha256) ||
+    !digest(value.source?.untracked?.sha256)
+  )
+    throw new Error("Manifest source digests missing");
+  for (const name of ["desktop", "server", "web", "boot"])
+    if (!digest(value.build?.[name]?.sha256))
+      throw new Error(`Manifest build digest missing: ${name}`);
+  if (!digest(value.scenario?.sha256)) throw new Error("Manifest scenario digest missing");
+  if (
+    !Array.isArray(value.captures) ||
+    !Array.isArray(value.scenario.steps) ||
+    !Array.isArray(value.assertions)
+  )
+    throw new Error("Manifest scenario results missing");
+  const names = new Set();
+  for (const capture of value.captures) {
+    if (
+      !digest(capture.sha256) ||
+      !Number.isInteger(capture.width) ||
+      capture.width < 1 ||
+      !Number.isInteger(capture.height) ||
+      capture.height < 1 ||
+      !Number.isFinite(capture.scale) ||
+      capture.scale <= 0 ||
+      !["dark", "light"].includes(capture.theme) ||
+      !/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,79}\.png$/.test(capture.file) ||
+      names.has(capture.file)
+    )
+      throw new Error("Invalid manifest capture");
+    names.add(capture.file);
+  }
+  if (!value.cleanup || typeof value.cleanup !== "object")
+    throw new Error("Manifest cleanup result missing");
+  if (
+    value.status === "passed" &&
+    (value.scenario.steps.some((step) => step.status !== "passed") ||
+      value.assertions.some((assertion) => assertion.status !== "passed"))
+  )
+    throw new Error("Passing manifest contains failed/incomplete scenario evidence");
+  return value;
+}
+export function createManifest({ runId, provenance, scenario, inner = {}, cleanup, status }) {
+  const result = {
+    schema: "jones-code-ui-evidence/v1",
+    runId,
+    recordedAt: new Date().toISOString(),
+    ...provenance,
+    runtime: inner.runtime ?? null,
+    window: inner.window ?? null,
+    themeFixture: inner.themeFixture ?? null,
+    fixture: inner.fixture ?? {},
+    scenario: { ...scenario, steps: inner.steps ?? [] },
+    assertions: inner.assertions ?? [],
+    captures: inner.captures ?? [],
+    isolation: { ...inner.isolation, topology: inner.topology ?? null },
+    resources: inner.resources ?? null,
+    namespaceProcess: inner.namespaceProcess ?? null,
+    coverage: {
+      claims:
+        inner.assertions?.filter((item) => item.status === "passed").map((item) => item.name) ?? [],
+      notCovered: NOT_COVERED,
+      comparison:
+        "Captures show ordered interactions on one candidate build; a comparison OID alone does not establish a code-change before/after result.",
+    },
+    status: status ?? inner.status ?? "failed",
+    cleanup: cleanup ?? { outcome: "unknown" },
+    error: inner.error ?? null,
+  };
+  return validateManifest(result);
+}
+export async function writeManifest(artifacts, manifest) {
+  validateManifest(manifest);
+  await NodeFSP.writeFile(
+    NodePath.join(artifacts, "manifest.json"),
+    `${JSON.stringify(manifest, null, 2)}\n`,
+    {
+      mode: 0o600,
+      flag: "wx",
+    },
+  );
+  return manifest;
+}
diff --git a/apps/desktop/scripts/ui-evidence/manifest.test.mjs b/apps/desktop/scripts/ui-evidence/manifest.test.mjs
new file mode 100644
index 000000000..8caaae7aa
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/manifest.test.mjs
@@ -0,0 +1,77 @@
+import * as NodeFSP from "node:fs/promises";
+import * as NodePath from "node:path";
+import * as NodeURL from "node:url";
+import * as NodeTest from "node:test";
+import * as NodeAssert from "node:assert/strict";
+import { createManifest, validateManifest, NOT_COVERED, writeManifest } from "./manifest.mjs";
+
+function candidate() {
+  const hash = "a".repeat(64),
+    head = "b".repeat(40);
+  return createManifest({
+    runId: "test-run",
+    provenance: {
+      build: Object.fromEntries(
+        ["desktop", "server", "web", "boot"].map((name) => [name, { sha256: hash }]),
+      ),
+      harness: { head },
+      source: { head, statusSha256: hash, patch: { sha256: hash }, untracked: { sha256: hash } },
+    },
+    scenario: { id: "sidebar-rename", sha256: hash },
+    inner: {
+      steps: [{ name: "Read backend", status: "passed" }],
+      assertions: [{ name: "Rename persists", status: "passed" }],
+    },
+    status: "passed",
+    cleanup: { outcome: "complete" },
+  });
+}
+NodeTest.test("manifest round-trips and claims only asserted behavior", () => {
+  const value = candidate();
+  NodeAssert.deepEqual(validateManifest(JSON.parse(JSON.stringify(value))), value);
+  NodeAssert.deepEqual(value.coverage.claims, ["Rename persists"]);
+  NodeAssert.deepEqual(value.coverage.notCovered, NOT_COVERED);
+  NodeAssert.equal(value.runtime, null);
+  NodeAssert.match(value.coverage.comparison, /one candidate build/);
+});
+NodeTest.test("manifest rejects abbreviated identity and false passing evidence", () => {
+  const value = candidate();
+  value.source.head = "b".repeat(8);
+  NodeAssert.throws(() => validateManifest(value), /full source/);
+  const incomplete = candidate();
+  incomplete.scenario.steps[0].status = "running";
+  NodeAssert.throws(() => validateManifest(incomplete), /incomplete/);
+  const capture = candidate();
+  capture.captures.push({
+    file: "../escape.png",
+    sha256: "a".repeat(64),
+    width: 100,
+    height: 100,
+    scale: 1,
+    theme: "dark",
+  });
+  NodeAssert.throws(() => validateManifest(capture), /capture/);
+});
+
+NodeTest.test(
+  "manifest publication rejects a sandbox-created symlink without changing its target",
+  async () => {
+    const parent = NodePath.resolve(
+      NodePath.dirname(NodeURL.fileURLToPath(import.meta.url)),
+      "../../../../.t3/ui-evidence-test-scratch",
+    );
+    await NodeFSP.mkdir(parent, { recursive: true });
+    const root = await NodeFSP.mkdtemp(NodePath.join(parent, "manifest-"));
+    try {
+      const artifacts = NodePath.join(root, "artifacts");
+      await NodeFSP.mkdir(artifacts);
+      const sentinel = NodePath.join(root, "sentinel");
+      await NodeFSP.writeFile(sentinel, "preserved");
+      await NodeFSP.symlink(sentinel, NodePath.join(artifacts, "manifest.json"));
+      await NodeAssert.rejects(writeManifest(artifacts, candidate()), { code: "EEXIST" });
+      NodeAssert.equal(await NodeFSP.readFile(sentinel, "utf8"), "preserved");
+    } finally {
+      await NodeFSP.rm(root, { recursive: true, force: true });
+    }
+  },
+);
diff --git a/apps/desktop/scripts/ui-evidence/probe.mjs b/apps/desktop/scripts/ui-evidence/probe.mjs
new file mode 100644
index 000000000..545e37f84
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/probe.mjs
@@ -0,0 +1,58 @@
+import * as NodeFSP from "node:fs/promises";
+import * as NodeNet from "node:net";
+import * as NodePath from "node:path";
+import { sandboxEnvironment } from "./sandbox.mjs";
+
+export async function isolationProbe(realHome) {
+  const absent = [];
+  for (const name of [".t3", ".config", ".claude", ".codex", ".ssh"]) {
+    const candidate = NodePath.join(realHome, name);
+    let visible = false;
+    try {
+      await NodeFSP.access(candidate);
+      visible = true;
+    } catch (error) {
+      if (!["ENOENT", "EACCES"].includes(error.code)) throw error;
+    }
+    if (visible) throw new Error(`Isolation probe found live home path: ${name}`);
+    absent.push(name);
+  }
+  const interfaces = (await NodeFSP.readFile("/proc/net/dev", "utf8"))
+    .split("\n")
+    .slice(2)
+    .filter((line) => line.includes(":"))
+    .map((line) => line.split(":")[0].trim())
+    .sort();
+  if (interfaces.join(",") !== "lo")
+    throw new Error("Isolation probe found a non-loopback interface");
+  const expected = sandboxEnvironment();
+  if (
+    Object.keys(process.env).sort().join(",") !== Object.keys(expected).sort().join(",") ||
+    Object.entries(expected).some(([key, value]) => process.env[key] !== value)
+  )
+    throw new Error("Isolation environment differs from allowlist");
+  const refused = await new Promise((resolve, reject) => {
+    const socket = NodeNet.connect({ host: "127.0.0.1", port: 3773 });
+    socket.once("connect", () => {
+      socket.destroy();
+      resolve(false);
+    });
+    socket.once("error", (error) => {
+      socket.destroy();
+      if (error.code === "ECONNREFUSED") resolve(true);
+      else reject(error);
+    });
+    socket.setTimeout(2000, () => {
+      socket.destroy();
+      reject(new Error("Live endpoint isolation probe timed out"));
+    });
+  });
+  if (!refused) throw new Error("Isolation probe reached the live endpoint");
+  return {
+    status: "passed",
+    liveHomeAbsent: absent,
+    liveEndpointRefused: refused,
+    interfaces,
+    environmentNames: Object.keys(expected).sort(),
+  };
+}
diff --git a/apps/desktop/scripts/ui-evidence/provenance.mjs b/apps/desktop/scripts/ui-evidence/provenance.mjs
new file mode 100644
index 000000000..de1b00179
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/provenance.mjs
@@ -0,0 +1,202 @@
+import * as NodeChildProcess from "node:child_process";
+import * as NodeUtil from "node:util";
+import * as NodeCrypto from "node:crypto";
+import * as NodeFSP from "node:fs/promises";
+import * as NodePath from "node:path";
+
+const execute = NodeUtil.promisify(NodeChildProcess.execFile);
+export const sha256 = (data) => NodeCrypto.createHash("sha256").update(data).digest("hex");
+const oidPattern = /^[a-f0-9]{40}$/;
+const protectedPath = (name) =>
+  name
+    .split("/")
+    .some(
+      (part) => part === ".git" || part === ".t3" || part === ".env" || part.startsWith(".env."),
+    );
+async function git(root, args) {
+  return (
+    await execute("git", ["-C", root, ...args], { encoding: "buffer", maxBuffer: 64 * 1024 * 1024 })
+  ).stdout;
+}
+async function hashTree(root) {
+  const entries = [];
+  let earliest = Infinity;
+  let latest = -Infinity;
+  async function visit(relative) {
+    const full = NodePath.join(root, relative);
+    const info = await NodeFSP.lstat(full);
+    earliest = Math.min(earliest, info.mtimeMs);
+    latest = Math.max(latest, info.mtimeMs);
+    if (info.isSymbolicLink()) {
+      entries.push([relative, "symlink", sha256(await NodeFSP.readlink(full))]);
+    } else if (info.isDirectory()) {
+      for (const name of (await NodeFSP.readdir(full)).sort())
+        await visit(NodePath.join(relative, name));
+    } else if (info.isFile()) {
+      entries.push([relative, "file", info.mode & 0o777, sha256(await NodeFSP.readFile(full))]);
+    } else throw new Error(`Unsupported build entry: ${relative}`);
+  }
+  await visit("");
+  if (!entries.length) throw new Error(`Empty build directory: ${root}`);
+  return {
+    path: root,
+    sha256: sha256(JSON.stringify(entries)),
+    files: entries.length,
+    mtime: { earliest: new Date(earliest).toISOString(), latest: new Date(latest).toISOString() },
+  };
+}
+async function repository(root) {
+  const head = (await git(root, ["rev-parse", "--verify", "HEAD"])).toString().trim();
+  if (!oidPattern.test(head)) throw new Error("Invalid source HEAD");
+  const status = await git(root, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
+  return { path: root, head, clean: status.length === 0, statusSha256: sha256(status) };
+}
+export async function collectProvenance({
+  source,
+  harness,
+  comparison,
+  artifacts,
+  buildPaths,
+  buildReceipt,
+}) {
+  source = NodePath.resolve(source);
+  harness = NodePath.resolve(harness);
+  const sourceInfo = await repository(source);
+  const harnessInfo = await repository(harness);
+  if (comparison != null) {
+    if (!oidPattern.test(comparison)) throw new Error("Comparison must be a full commit OID");
+    const resolved = (await git(source, ["rev-parse", "--verify", `${comparison}^{commit}`]))
+      .toString()
+      .trim();
+    if (resolved !== comparison)
+      throw new Error("Comparison does not identify the supplied commit");
+  }
+  const changed = (await git(source, ["diff", "--name-only", "-z", "HEAD"]))
+    .toString()
+    .split("\0")
+    .filter(Boolean);
+  if (changed.some(protectedPath))
+    throw new Error("Protected source path is modified; refusing patch capture");
+  const patch = await git(source, ["diff", "--binary", "HEAD"]);
+  const untrackedNames = (await git(source, ["ls-files", "--others", "--exclude-standard", "-z"]))
+    .toString()
+    .split("\0")
+    .filter(Boolean)
+    .sort();
+  const untracked = [];
+  for (const name of untrackedNames) {
+    const full = NodePath.resolve(source, name);
+    if (
+      protectedPath(name) ||
+      full === NodePath.resolve(artifacts) ||
+      full.startsWith(`${NodePath.resolve(artifacts)}${NodePath.sep}`)
+    )
+      continue;
+    const info = await NodeFSP.lstat(full);
+    if (info.isSymbolicLink())
+      untracked.push([name, "symlink", sha256(await NodeFSP.readlink(full))]);
+    else if (info.isFile())
+      untracked.push([name, "file", info.mode & 0o777, sha256(await NodeFSP.readFile(full))]);
+    else throw new Error(`Unsupported untracked source entry: ${name}`);
+  }
+  const paths = buildPaths ?? {
+    desktop: NodePath.join(source, "apps/desktop/dist-electron"),
+    server: NodePath.join(source, "apps/server/dist"),
+    web: NodePath.join(source, "apps/web/dist"),
+  };
+  const build = {};
+  for (const [name, directory] of Object.entries(paths)) build[name] = await hashTree(directory);
+  const bootPath = NodePath.join(paths.desktop, "boot.cjs");
+  build.boot = { path: bootPath, sha256: sha256(await NodeFSP.readFile(bootPath)) };
+  build.sourceCorrespondence = {
+    status: "unproved",
+    reason:
+      "Build tree hashes and mtimes identify outputs; no qualified source-to-build receipt was supplied.",
+  };
+  // Source drift must reject the record rather than combine identities from different trees.
+  const current = await repository(source);
+  if (
+    current.head !== sourceInfo.head ||
+    current.statusSha256 !== sourceInfo.statusSha256 ||
+    sha256(await git(source, ["diff", "--binary", "HEAD"])) !== sha256(patch)
+  )
+    throw new Error("Source changed during provenance collection");
+  for (const entry of untracked) {
+    const [name, kind] = entry;
+    const full = NodePath.join(source, name);
+    const expected = entry.at(-1);
+    if (
+      sha256(kind === "symlink" ? await NodeFSP.readlink(full) : await NodeFSP.readFile(full)) !==
+      expected
+    )
+      throw new Error("Untracked source changed during provenance collection");
+  }
+  if (buildReceipt) {
+    const bytes = await NodeFSP.readFile(buildReceipt);
+    const receipt = JSON.parse(bytes);
+    const expectedSource = {
+      head: sourceInfo.head,
+      statusSha256: sourceInfo.statusSha256,
+      patchSha256: sha256(patch),
+      untrackedSha256: sha256(JSON.stringify(untracked)),
+    };
+    if (
+      receipt.schema !== "jones-code-ui-evidence-build/v1" ||
+      !receipt.source ||
+      !receipt.build ||
+      typeof receipt.invocation !== "string" ||
+      !receipt.invocation.trim()
+    )
+      throw new Error("Invalid build receipt");
+    for (const [name, value] of Object.entries(expectedSource))
+      if (receipt.source[name] !== value) throw new Error(`Build receipt source mismatch: ${name}`);
+    for (const name of ["desktop", "server", "web", "boot"])
+      if (receipt.build[name] !== build[name]?.sha256)
+        throw new Error(`Build receipt output mismatch: ${name}`);
+    if (
+      ![receipt.startedAt, receipt.finishedAt].every(
+        (value) => typeof value === "string" && Number.isFinite(Date.parse(value)),
+      ) ||
+      Date.parse(receipt.finishedAt) < Date.parse(receipt.startedAt)
+    )
+      throw new Error("Invalid build receipt times");
+    build.sourceCorrespondence = {
+      status: "receipt-matched",
+      receipt: {
+        path: NodePath.resolve(buildReceipt),
+        sha256: sha256(bytes),
+        invocation: receipt.invocation,
+        startedAt: receipt.startedAt,
+        finishedAt: receipt.finishedAt,
+      },
+      basis:
+        "Operator build receipt matches recorded source and output hashes; this is not a runtime embedded commit identity.",
+    };
+  }
+  const currentHarness = await repository(harness);
+  if (
+    currentHarness.head !== harnessInfo.head ||
+    currentHarness.statusSha256 !== harnessInfo.statusSha256
+  )
+    throw new Error("Harness changed during provenance collection");
+  await NodeFSP.writeFile(NodePath.join(artifacts, "source.patch"), patch, {
+    flag: "wx",
+    mode: 0o600,
+  });
+  return {
+    harness: harnessInfo,
+    source: {
+      ...sourceInfo,
+      dirty: !sourceInfo.clean,
+      comparison: comparison ?? null,
+      comparisonKind: comparison ? "commit-reference-only" : "same-source-behavior-sequence",
+      patch: { file: "source.patch", sha256: sha256(patch) },
+      untracked: {
+        count: untracked.length,
+        sha256: sha256(JSON.stringify(untracked)),
+        excluded: ["protected dotenv/git/T3 paths", "artifact output"],
+      },
+    },
+    build,
+  };
+}
diff --git a/apps/desktop/scripts/ui-evidence/provenance.test.mjs b/apps/desktop/scripts/ui-evidence/provenance.test.mjs
new file mode 100644
index 000000000..ae89daf93
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/provenance.test.mjs
@@ -0,0 +1,97 @@
+import * as NodeTest from "node:test";
+import * as NodeAssert from "node:assert/strict";
+import * as NodeChildProcess from "node:child_process";
+import * as NodeUtil from "node:util";
+import * as NodeFSP from "node:fs/promises";
+import * as NodePath from "node:path";
+import * as NodeURL from "node:url";
+import { collectProvenance } from "./provenance.mjs";
+const exec = NodeUtil.promisify(NodeChildProcess.execFile);
+
+NodeTest.test(
+  "provenance distinguishes tracked and untracked changes, excludes secrets, and matches exact build receipt",
+  async () => {
+    const parent = NodePath.resolve(
+      NodePath.dirname(NodeURL.fileURLToPath(import.meta.url)),
+      "../../../../.t3/ui-evidence-test-scratch",
+    );
+    await NodeFSP.mkdir(parent, { recursive: true });
+    const root = await NodeFSP.mkdtemp(NodePath.join(parent, "provenance-"));
+    try {
+      const source = NodePath.join(root, "source");
+      await NodeFSP.mkdir(source);
+      const git = (...args) => exec("git", ["-C", source, ...args]);
+      await git("init", "-b", "test-fixture");
+      await NodeFSP.writeFile(NodePath.join(source, "tracked.txt"), "before\n");
+      await git("add", "tracked.txt");
+      await git(
+        "-c",
+        "user.name=Fixture",
+        "-c",
+        "user.email=fixture@example.invalid",
+        "commit",
+        "-m",
+        "Fixture",
+      );
+      const buildPaths = {};
+      for (const name of ["desktop", "server", "web"]) {
+        buildPaths[name] = NodePath.join(root, name);
+        await NodeFSP.mkdir(buildPaths[name]);
+        await NodeFSP.writeFile(
+          NodePath.join(buildPaths[name], name === "desktop" ? "boot.cjs" : "output.js"),
+          "synthetic output",
+        );
+      }
+      let n = 0;
+      const collect = async (buildReceipt) => {
+        const artifacts = NodePath.join(root, `artifacts-${n++}`);
+        await NodeFSP.mkdir(artifacts);
+        return collectProvenance({ source, harness: source, artifacts, buildPaths, buildReceipt });
+      };
+      const before = await collect();
+      await NodeFSP.writeFile(NodePath.join(source, "tracked.txt"), "after\n");
+      const tracked = await collect();
+      NodeAssert.notEqual(tracked.source.patch.sha256, before.source.patch.sha256);
+      await NodeFSP.writeFile(NodePath.join(source, "untracked.txt"), "first");
+      await NodeFSP.writeFile(NodePath.join(source, ".env.local"), "SECRET_SENTINEL");
+      const first = await collect();
+      await NodeFSP.writeFile(NodePath.join(source, "untracked.txt"), "second");
+      const second = await collect();
+      NodeAssert.notEqual(first.source.untracked.sha256, second.source.untracked.sha256);
+      NodeAssert.equal(second.source.untracked.count, 1);
+      NodeAssert.equal(second.build.sourceCorrespondence.status, "unproved");
+      const receipt = {
+        schema: "jones-code-ui-evidence-build/v1",
+        source: {
+          head: second.source.head,
+          statusSha256: second.source.statusSha256,
+          patchSha256: second.source.patch.sha256,
+          untrackedSha256: second.source.untracked.sha256,
+        },
+        build: Object.fromEntries(
+          ["desktop", "server", "web", "boot"].map((name) => [name, second.build[name].sha256]),
+        ),
+        invocation: "synthetic fixture output",
+        startedAt: "2026-09-30T00:00:00Z",
+        finishedAt: "2026-09-30T00:00:01Z",
+      };
+      const receiptPath = NodePath.join(root, "receipt.json");
+      await NodeFSP.writeFile(receiptPath, JSON.stringify(receipt));
+      NodeAssert.equal(
+        (await collect(receiptPath)).build.sourceCorrespondence.status,
+        "receipt-matched",
+      );
+      receipt.build.boot = "0".repeat(64);
+      await NodeFSP.writeFile(receiptPath, JSON.stringify(receipt));
+      await NodeAssert.rejects(collect(receiptPath), /output mismatch/);
+      NodeAssert.equal(
+        (await NodeFSP.readFile(NodePath.join(root, "artifacts-3/source.patch"), "utf8")).includes(
+          "SECRET_SENTINEL",
+        ),
+        false,
+      );
+    } finally {
+      await NodeFSP.rm(root, { recursive: true, force: true });
+    }
+  },
+);
diff --git a/apps/desktop/scripts/ui-evidence/runner.mjs b/apps/desktop/scripts/ui-evidence/runner.mjs
new file mode 100644
index 000000000..d588608bb
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/runner.mjs
@@ -0,0 +1,255 @@
+import * as NodeChildProcess from "node:child_process";
+import * as NodeFSP from "node:fs/promises";
+import * as NodeOS from "node:os";
+import * as NodeURL from "node:url";
+import { isolationProbe } from "./probe.mjs";
+import { createScenarioContext, loadScenario } from "./scenario-api.mjs";
+
+async function startXvfb(size) {
+  const child = NodeChildProcess.spawn(
+    "/usr/bin/Xvfb",
+    ["-displayfd", "3", "-nolisten", "tcp", "-screen", "0", `${size.width}x${size.height}x24`],
+    { stdio: ["ignore", "ignore", "pipe", "pipe"], env: process.env },
+  );
+  try {
+    const display = await new Promise((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error("Xvfb startup timed out")), 15000);
+      let value = "";
+      const failed = (error) => {
+        clearTimeout(timer);
+        reject(error);
+      };
+      child.once("error", failed);
+      child.once("exit", () => failed(new Error("Xvfb exited before readiness")));
+      child.stdio[3].on("data", (chunk) => {
+        value += chunk;
+        if (value.includes("\n")) {
+          clearTimeout(timer);
+          resolve(`:${value.trim()}`);
+        }
+      });
+    });
+    return { child, display };
+  } catch (error) {
+    child.kill("SIGTERM");
+    throw error;
+  }
+}
+async function stop(child) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) return;
+  const closed = new Promise((resolve) => child.once("close", resolve));
+  child.kill("SIGTERM");
+  const timer = setTimeout(() => child.kill("SIGKILL"), 3000);
+  await closed;
+  clearTimeout(timer);
+}
+async function sampleResources() {
+  let ticks = 0,
+    pssKiB = 0;
+  // /proc belongs to the private PID namespace, so samples cannot inspect sibling work.
+  for (const name of await NodeFSP.readdir("/proc")) {
+    if (!/^\d+$/.test(name)) continue;
+    try {
+      const stat = await NodeFSP.readFile(`/proc/${name}/stat`, "utf8");
+      const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+      ticks += Number(fields[11]) + Number(fields[12]);
+      const memory = await NodeFSP.readFile(`/proc/${name}/smaps_rollup`, "utf8");
+      pssKiB += Number(memory.match(/^Pss:\s+(\d+)/m)?.[1] || 0);
+    } catch (error) {
+      if (!["ENOENT", "ESRCH", "EACCES"].includes(error.code)) throw error;
+    }
+  }
+  return { ticks, pssKiB, at: performance.now() };
+}
+export async function runInner() {
+  const configuration = JSON.parse(await NodeFSP.readFile("/harness/config.json", "utf8"));
+  let app, xvfb, ctx, timer;
+  const start = performance.now();
+  const result = {
+    status: "failed",
+    isolation: null,
+    runtime: null,
+    window: null,
+    resources: {
+      cpuUnit: "100% = one fully used logical core",
+      clockTicksPerSecond: configuration.clockTicks,
+      measuredPeakScope: "after app readiness through scenario",
+      settledIntervalSeconds: 20,
+      peakCpuPercent: 0,
+      peakPssKiB: 0,
+    },
+  };
+  let code = 2;
+  try {
+    result.isolation = await isolationProbe(configuration.realHome);
+    const scenario = await loadScenario("/harness/scenario.mjs");
+    xvfb = await startXvfb(configuration.size);
+    const { _electron } = await import("playwright-core");
+    app = await _electron.launch({
+      executablePath: "/electron/electron",
+      args: [
+        "/app/apps/desktop/dist-electron/boot.cjs",
+        `--force-device-scale-factor=${configuration.scale}`,
+      ],
+      env: { ...process.env, DISPLAY: xvfb.display },
+      chromiumSandbox: true,
+      timeout: 60000,
+    });
+    const page = await app.firstWindow({ timeout: 60000 });
+    await page.waitForFunction(() => Boolean(window.desktopBridge), undefined, { timeout: 60000 });
+    const networkState = await app.context().newCDPSession(page);
+    await networkState.send("Network.enable");
+    result.isolation.browserConnectivity = {
+      kind: "CDP navigator state only",
+      latencyMarkerMs: 1,
+      externalNetwork: "unavailable in private namespace",
+      readbacks: [],
+    };
+    const restoreConnectivity = async () => {
+      const onlineBefore = await page.evaluate(() => navigator.onLine);
+      // A nonneutral CDP state enables local-only connectivity without adding a network interface.
+      await networkState.send("Network.overrideNetworkState", {
+        offline: false,
+        latency: 1,
+        downloadThroughput: -1,
+        uploadThroughput: -1,
+        connectionType: "ethernet",
+      });
+      await page.waitForFunction(() => navigator.onLine === true);
+      result.isolation.browserConnectivity.readbacks.push({ onlineBefore, onlineAfter: true });
+    };
+    await restoreConnectivity();
+    const paths = await app.evaluate(({ app }) => ({
+      userData: app.getPath("userData"),
+      home: app.getPath("home"),
+      t3home: process.env.T3CODE_HOME,
+    }));
+    if (
+      !paths.userData.startsWith("/scratch/xdg-config/") ||
+      paths.home !== "/scratch/home" ||
+      paths.t3home !== "/scratch/t3home"
+    )
+      throw new Error("Electron wrote outside its private data roots");
+    result.isolation.assertedPaths = paths;
+    ctx = createScenarioContext({
+      electronApp: app,
+      page,
+      workspace: "/scratch/workspace",
+      artifacts: "/artifacts",
+      size: configuration.size,
+      theme: configuration.theme,
+      configuration,
+      restoreConnectivity,
+    });
+    await ctx.topology();
+    await ctx.setWindowSize(configuration.size.width, configuration.size.height);
+    await ctx.setTheme(configuration.theme);
+    result.resources.startupSeconds = (performance.now() - start) / 1000;
+    result.runtime = await app.evaluate(({ app }) => ({
+      electron: process.versions.electron,
+      chromium: process.versions.chrome,
+      node: process.versions.node,
+      appVersion: app.getVersion(),
+    }));
+    result.runtime.previewAutomationIdentity = await page.evaluate(async () =>
+      window.desktopBridge.getPreviewAutomationRuntimeIdentity
+        ? await window.desktopBridge.getPreviewAutomationRuntimeIdentity()
+        : null,
+    );
+    result.runtime.os = {
+      // oxlint-disable-next-line t3code/no-global-process-runtime -- Standalone evidence script has no Effect runtime.
+      platform: NodeOS.platform(),
+      release: NodeOS.release(),
+      // oxlint-disable-next-line t3code/no-global-process-runtime -- Standalone evidence script has no Effect runtime.
+      arch: NodeOS.arch(),
+    };
+    result.runtime.xvfb = { ...configuration.size, depth: 24 };
+    let previous = await sampleResources();
+    const idleStart = previous;
+    let sampling = false;
+    timer = setInterval(async () => {
+      if (sampling) return;
+      sampling = true;
+      try {
+        const current = await sampleResources();
+        const cpu = Math.max(
+          0,
+          ((current.ticks - previous.ticks) /
+            configuration.clockTicks /
+            ((current.at - previous.at) / 1000)) *
+            100,
+        );
+        result.resources.peakCpuPercent = Math.max(result.resources.peakCpuPercent, cpu);
+        result.resources.peakPssKiB = Math.max(result.resources.peakPssKiB, current.pssKiB);
+        previous = current;
+      } catch {
+        result.resources.samplingIncomplete = true;
+      } finally {
+        sampling = false;
+      }
+    }, 1000);
+    await new Promise((resolve) => setTimeout(resolve, 20000));
+    const settled = await sampleResources();
+    result.resources.settledCpuPercent = Math.max(
+      0,
+      ((settled.ticks - idleStart.ticks) /
+        configuration.clockTicks /
+        ((settled.at - idleStart.at) / 1000)) *
+        100,
+    );
+    result.resources.settledPssKiB = settled.pssKiB;
+    result.resources.settledHostSharePercent =
+      result.resources.settledCpuPercent / configuration.hostEffectiveCores;
+    code = 1;
+    const captureStart = performance.now();
+    await scenario.run(ctx);
+    result.resources.scenarioSeconds = (performance.now() - captureStart) / 1000;
+    result.window = await app.evaluate(({ BrowserWindow, nativeTheme }) => ({
+      bounds: BrowserWindow.getAllWindows()[0].getBounds(),
+      theme: nativeTheme.shouldUseDarkColors ? "dark" : "light",
+      themeSource: nativeTheme.themeSource,
+    }));
+    result.window.viewport = await page.evaluate(() => ({
+      width: innerWidth,
+      height: innerHeight,
+      scale: devicePixelRatio,
+    }));
+    if (Math.abs(result.window.viewport.scale - configuration.scale) > 0.01)
+      throw new Error("Requested device scale readback mismatch");
+    result.status = "passed";
+    code = 0;
+  } catch (error) {
+    result.error = error.message;
+    if (ctx)
+      try {
+        await ctx.capture("failure");
+      } catch {
+        result.failureCapture = "unavailable";
+      }
+  } finally {
+    clearInterval(timer);
+    if (ctx) Object.assign(result, ctx.results());
+    const teardown = performance.now();
+    if (app)
+      try {
+        await app.close();
+      } catch (error) {
+        result.closeError = error.message;
+        if (code === 0) {
+          code = 1;
+          result.status = "failed";
+        }
+      }
+    await stop(xvfb?.child);
+    result.resources.teardownSeconds = (performance.now() - teardown) / 1000;
+    await NodeFSP.writeFile("/artifacts/inner.json", JSON.stringify(result, null, 2), {
+      mode: 0o600,
+    });
+  }
+  return code;
+}
+if (
+  process.argv.includes("--inner") &&
+  import.meta.url === NodeURL.pathToFileURL(process.argv[1]).href
+)
+  process.exitCode = await runInner();
diff --git a/apps/desktop/scripts/ui-evidence/runtime.mjs b/apps/desktop/scripts/ui-evidence/runtime.mjs
new file mode 100644
index 000000000..4ece5c18c
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/runtime.mjs
@@ -0,0 +1,280 @@
+import * as NodeFSP from "node:fs/promises";
+import * as NodeFS from "node:fs";
+import * as NodeCrypto from "node:crypto";
+import * as NodeStreamPromises from "node:stream/promises";
+import * as NodeStream from "node:stream";
+import * as NodeChildProcess from "node:child_process";
+import * as NodeUtil from "node:util";
+import * as NodePath from "node:path";
+import * as NodeOS from "node:os";
+import * as NodeURL from "node:url";
+import { allocateRun, removeRun } from "./lifecycle.mjs";
+
+export const exec = NodeUtil.promisify(NodeChildProcess.execFile);
+export async function sha256(file) {
+  const digest = NodeCrypto.createHash("sha256");
+  for await (const chunk of NodeFS.createReadStream(file)) digest.update(chunk);
+  return digest.digest("hex");
+}
+export async function electronVersion(source) {
+  const pkg = JSON.parse(
+    await NodeFSP.readFile(NodePath.join(source, "apps/desktop/package.json"), "utf8"),
+  );
+  const version = pkg.dependencies?.electron;
+  if (!/^\d+\.\d+\.\d+$/.test(version || ""))
+    throw new Error("Electron version is not an exact source pin");
+  const lock = await NodeFSP.readFile(NodePath.join(source, "pnpm-lock.yaml"), "utf8");
+  if (!lock.includes(`electron@${version}`))
+    throw new Error("Electron package and lockfile disagree");
+  return version;
+}
+export function runtimeDirectory(version) {
+  return NodePath.join(
+    process.env.XDG_CACHE_HOME || NodePath.join(NodeOS.homedir(), ".cache"),
+    "jones-code-ui-evidence/electron",
+    version,
+  );
+}
+export async function validateRuntime(directory, version) {
+  const record = JSON.parse(
+    await NodeFSP.readFile(NodePath.join(directory, "verified.json"), "utf8"),
+  );
+  if (
+    record.version !== version ||
+    record.platform !== "linux-x64" ||
+    !/^[a-f0-9]{64}$/.test(record.archiveSha256 || "")
+  )
+    throw new Error("Runtime verification record mismatch");
+  if ((await sha256(NodePath.join(directory, "electron.zip"))) !== record.archiveSha256)
+    throw new Error("Runtime archive digest mismatch");
+  for (const [file, digest] of Object.entries(record.files || {})) {
+    if (
+      !file ||
+      NodePath.isAbsolute(file) ||
+      file.split("/").includes("..") ||
+      !/^[a-f0-9]{64}$/.test(digest)
+    )
+      throw new Error("Invalid runtime tree digest");
+    if ((await sha256(NodePath.join(directory, file))) !== digest)
+      throw new Error(`Runtime file digest mismatch: ${file}`);
+  }
+  if (!record.files?.electron || !record.files?.["resources/default_app.asar"])
+    throw new Error("Runtime tree digest is incomplete");
+  return {
+    version,
+    directory,
+    executable: NodePath.join(directory, "electron"),
+    archiveSha256: record.archiveSha256,
+  };
+}
+export function checksumFor(sums, name) {
+  const entry = sums
+    .split("\n")
+    .map((line) => line.trim().split(/\s+/))
+    .find((parts) => parts[1]?.replace(/^\*/, "") === name);
+  if (!/^[a-f0-9]{64}$/.test(entry?.[0] || "")) throw new Error("Official checksum entry missing");
+  return entry[0];
+}
+async function download(url, destination, signal) {
+  let current = url;
+  for (let redirects = 0; redirects < 6; redirects++) {
+    const target = new URL(current);
+    if (
+      target.protocol !== "https:" ||
+      ![
+        "github.com",
+        "release-assets.githubusercontent.com",
+        "objects.githubusercontent.com",
+      ].includes(target.hostname)
+    )
+      throw new Error("Runtime download left official HTTPS release hosts");
+    const response = await fetch(current, {
+      redirect: "manual",
+      signal: AbortSignal.any([signal, AbortSignal.timeout(120000)]),
+    });
+    if ([301, 302, 303, 307, 308].includes(response.status)) {
+      current = new URL(response.headers.get("location"), current).href;
+      continue;
+    }
+    if (!response.ok || !response.body)
+      throw new Error(`Runtime download failed: HTTP ${response.status}`);
+    await NodeStreamPromises.pipeline(
+      NodeStream.Readable.fromWeb(response.body),
+      NodeFS.createWriteStream(destination, { mode: 0o600, flags: "wx" }),
+    );
+    return;
+  }
+  throw new Error("Too many runtime download redirects");
+}
+async function treeDigests(root, prefix = "") {
+  const files = {};
+  for (const entry of await NodeFSP.readdir(NodePath.join(root, prefix), { withFileTypes: true })) {
+    const name = NodePath.posix.join(prefix, entry.name);
+    if (entry.isSymbolicLink()) throw new Error(`Runtime archive contained a symlink: ${name}`);
+    if (entry.isDirectory()) Object.assign(files, await treeDigests(root, name));
+    else if (entry.isFile()) files[name] = await sha256(NodePath.join(root, name));
+    else throw new Error("Runtime archive contained a special file");
+  }
+  return files;
+}
+export async function setupRuntime(source) {
+  // oxlint-disable-next-line t3code/no-global-process-runtime -- Standalone evidence script has no Effect runtime.
+  if (process.platform !== "linux" || process.arch !== "x64")
+    throw new Error("Only Linux x64 runtime setup is supported");
+  await NodeFSP.access("/usr/bin/unzip");
+  const version = await electronVersion(source);
+  const directory = runtimeDirectory(version);
+  try {
+    await NodeFSP.stat(directory);
+    return { outcome: "no_change", runtime: await validateRuntime(directory, version) };
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const run = await allocateRun();
+  let cancellation;
+  const controller = new AbortController();
+  const cancel = (signal) => {
+    cancellation = signal;
+    controller.abort();
+  };
+  const interrupt = () => cancel("SIGINT");
+  const terminate = () => cancel("SIGTERM");
+  process.on("SIGINT", interrupt);
+  process.on("SIGTERM", terminate);
+  try {
+    const base = `https://github.com/electron/electron/releases/download/v${version}`;
+    const zip = NodePath.join(run.root, "electron.zip");
+    await download(
+      `${base}/SHASUMS256.txt`,
+      NodePath.join(run.root, "SHASUMS256.txt"),
+      controller.signal,
+    );
+    const name = `electron-v${version}-linux-x64.zip`;
+    const sums = await NodeFSP.readFile(NodePath.join(run.root, "SHASUMS256.txt"), "utf8");
+    const expected = checksumFor(sums, name);
+    await download(`${base}/${name}`, zip, controller.signal);
+    if (cancellation) throw new Error(`Cancelled: ${cancellation}`);
+    if ((await sha256(zip)) !== expected) throw new Error("Official runtime checksum mismatch");
+    const listing = (await exec("/usr/bin/unzip", ["-Z1", zip])).stdout.trim().split("\n");
+    if (
+      listing.some(
+        (name) =>
+          NodePath.isAbsolute(name) || name.split("/").includes("..") || name.includes("\\"),
+      )
+    )
+      throw new Error("Unsafe runtime archive path");
+    const staged = NodePath.join(run.root, "runtime");
+    await NodeFSP.mkdir(staged, { mode: 0o700 });
+    await exec("/usr/bin/unzip", ["-q", zip, "-d", staged], { signal: controller.signal });
+    const files = await treeDigests(staged);
+    await NodeFSP.rename(zip, NodePath.join(staged, "electron.zip"));
+    await NodeFSP.writeFile(
+      NodePath.join(staged, "verified.json"),
+      JSON.stringify({ version, platform: "linux-x64", archiveSha256: expected, files }),
+      { mode: 0o600 },
+    );
+    await NodeFSP.mkdir(NodePath.dirname(directory), { recursive: true, mode: 0o700 });
+    if (cancellation) throw new Error(`Cancelled: ${cancellation}`);
+    await NodeFSP.rename(staged, directory);
+    return { outcome: "complete", runtime: await validateRuntime(directory, version) };
+  } finally {
+    await removeRun(run);
+    process.off("SIGINT", interrupt);
+    process.off("SIGTERM", terminate);
+  }
+}
+
+export async function packageAt(name, from) {
+  let current = from;
+  while (true) {
+    const candidate = NodePath.join(current, "node_modules", name);
+    try {
+      return await NodeFSP.realpath(candidate);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    const parent = NodePath.dirname(current);
+    if (parent === current) throw new Error(`Missing runtime package: ${name}`);
+    current = parent;
+  }
+}
+export async function runtimeExternalDependencies(source, app, dependencies) {
+  if (!["desktop", "server"].includes(app)) throw new Error("Unknown runtime app");
+  const desktop = app === "desktop";
+  const file = NodePath.join(
+    source,
+    "scripts/lib",
+    desktop ? "desktop-external-packages.ts" : "cli-external-packages.ts",
+  );
+  // Node >=24 loads these pure source policies, including exact package-boundary rules.
+  const policy = await import(NodeURL.pathToFileURL(file).href);
+  const select = desktop
+    ? policy.selectDesktopRuntimeExternalDependencies
+    : policy.selectCliRuntimeExternalDependencies;
+  if (typeof select !== "function")
+    throw new Error("Cannot resolve canonical runtime external policy");
+  return Object.keys(select(dependencies));
+}
+export async function dependencyClosure(source) {
+  const roots = [];
+  const links = new Map();
+  const packages = new Map();
+  for (const app of ["desktop", "server"]) {
+    const dir = NodePath.join(source, "apps", app);
+    const pkg = JSON.parse(await NodeFSP.readFile(NodePath.join(dir, "package.json"), "utf8"));
+    const names = await runtimeExternalDependencies(source, app, pkg.dependencies || {});
+    for (const name of names) {
+      const root = await packageAt(name, dir);
+      roots.push({ name, root, destination: `/app/apps/${app}/node_modules/${name}` });
+    }
+  }
+  // Playwright drives Electron from the harness, without importing the Electron package helper.
+  roots.push({
+    name: "playwright-core",
+    root: await packageAt("playwright-core", NodePath.join(source, "apps/desktop")),
+    destination: "/harness/node_modules/playwright-core",
+  });
+  async function visit(root) {
+    if (packages.has(root)) return;
+    if (
+      !root.includes("/node_modules/") ||
+      root.split("/").some((part) => [".t3", ".git", ".ssh", ".codex", ".claude"].includes(part))
+    )
+      throw new Error("Runtime dependency escaped package storage");
+    const pkg = JSON.parse(await NodeFSP.readFile(NodePath.join(root, "package.json"), "utf8"));
+    packages.set(root, { name: pkg.name, version: pkg.version });
+    for (const name of new Set([
+      ...Object.keys(pkg.dependencies || {}),
+      ...Object.keys(pkg.optionalDependencies || {}),
+    ])) {
+      let dependency;
+      try {
+        dependency = await packageAt(name, root);
+      } catch (error) {
+        if (pkg.optionalDependencies?.[name]) continue;
+        throw error;
+      }
+      let lexical = root;
+      while (true) {
+        const candidate = NodePath.join(lexical, "node_modules", name);
+        try {
+          await NodeFSP.lstat(candidate);
+          links.set(candidate, dependency);
+          break;
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+        }
+        const parent = NodePath.dirname(lexical);
+        if (parent === lexical) throw new Error("Dependency link resolution failed");
+        lexical = parent;
+      }
+      await visit(dependency);
+    }
+  }
+  for (const root of roots) await visit(root.root);
+  return {
+    roots,
+    packages: [...packages].map(([root, identity]) => ({ root, ...identity })),
+    links: [...links].map(([destination, root]) => ({ destination, root })),
+  };
+}
diff --git a/apps/desktop/scripts/ui-evidence/runtime.test.mjs b/apps/desktop/scripts/ui-evidence/runtime.test.mjs
new file mode 100644
index 000000000..5a13f7ab7
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/runtime.test.mjs
@@ -0,0 +1,55 @@
+import * as NodeTest from "node:test";
+import * as NodeAssert from "node:assert/strict";
+import * as NodePath from "node:path";
+import * as NodeURL from "node:url";
+import { checksumFor, runtimeExternalDependencies } from "./runtime.mjs";
+
+NodeTest.test("official checksum accepts binary and text filename markers", () => {
+  const digest = "ad71063e77da29a647f872b090478f9fa9ccffd67de7b2ae6315409cf1f13436";
+  for (const marker of [" ", "*"])
+    NodeAssert.equal(
+      checksumFor(
+        `${digest} ${marker}electron-v44.4.2-linux-x64.zip\n`,
+        "electron-v44.4.2-linux-x64.zip",
+      ),
+      digest,
+    );
+  NodeAssert.throws(() =>
+    checksumFor(`${digest} *different.zip`, "electron-v44.4.2-linux-x64.zip"),
+  );
+  NodeAssert.throws(() => checksumFor("invalid *electron.zip", "electron.zip"));
+});
+
+NodeTest.test(
+  "runtime closure uses nightly canonical prefix and exact-boundary policies",
+  async () => {
+    const source = NodePath.resolve(
+      NodePath.dirname(NodeURL.fileURLToPath(import.meta.url)),
+      "../../../..",
+    );
+    NodeAssert.deepEqual(
+      await runtimeExternalDependencies(source, "server", {
+        "node-pty": "1",
+        "@cursor/sdk": "1",
+        zod: "1",
+        "zod-to-json-schema": "1",
+        "@connectrpc/connect": "1",
+        react: "1",
+      }),
+      ["node-pty", "@cursor/sdk", "zod", "@connectrpc/connect"],
+    );
+    NodeAssert.deepEqual(
+      await runtimeExternalDependencies(source, "desktop", {
+        "playwright-core": "1",
+        "@napi-rs/keyring": "1",
+        electron: "1",
+        react: "1",
+      }),
+      ["playwright-core", "@napi-rs/keyring"],
+    );
+    await NodeAssert.rejects(
+      runtimeExternalDependencies(source, "unknown", {}),
+      /Unknown runtime app/,
+    );
+  },
+);
diff --git a/apps/desktop/scripts/ui-evidence/sandbox.mjs b/apps/desktop/scripts/ui-evidence/sandbox.mjs
new file mode 100644
index 000000000..00f7ca083
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/sandbox.mjs
@@ -0,0 +1,191 @@
+import * as NodeFSP from "node:fs/promises";
+import * as NodePath from "node:path";
+import { packageAt } from "./runtime.mjs";
+
+const writableNames = ["home", "xdg-config", "xdg-data", "xdg-cache", "t3home", "workspace", "tmp"];
+export function sandboxEnvironment() {
+  return {
+    PATH: "/usr/bin:/bin",
+    PWD: "/app",
+    HOME: "/scratch/home",
+    XDG_CONFIG_HOME: "/scratch/xdg-config",
+    XDG_DATA_HOME: "/scratch/xdg-data",
+    XDG_CACHE_HOME: "/scratch/xdg-cache",
+    T3CODE_HOME: "/scratch/t3home",
+    T3CODE_PORT: "43773",
+    TMPDIR: "/scratch/tmp",
+    LANG: "C.UTF-8",
+    TZ: "UTC",
+    T3CODE_AUTO_BOOTSTRAP_PROJECT_FROM_CWD: "false",
+    T3CODE_DISABLE_AUTO_UPDATE: "true",
+    OTEL_SDK_DISABLED: "true",
+  };
+}
+async function copyClosedTree(source, destination) {
+  const base = await NodeFSP.realpath(source);
+  async function inspect(directory) {
+    for (const entry of await NodeFSP.readdir(directory, { withFileTypes: true })) {
+      const file = NodePath.join(directory, entry.name);
+      if (
+        [".git", ".t3"].includes(entry.name) ||
+        entry.name === ".env" ||
+        entry.name.startsWith(".env.")
+      )
+        throw new Error("Protected file appeared in staged closure");
+      if (entry.isSymbolicLink()) {
+        const target = await NodeFSP.realpath(file);
+        if (target !== base && !target.startsWith(`${base}/`))
+          throw new Error(`Staged symlink escaped its package: ${file}`);
+      } else if (entry.isDirectory()) await inspect(file);
+      else if (!entry.isFile()) throw new Error("Special file in staged closure");
+    }
+  }
+  await inspect(base);
+  await NodeFSP.cp(base, destination, {
+    recursive: true,
+    dereference: true,
+    errorOnExist: true,
+    force: false,
+  });
+}
+export async function stageRun({ run, source, harness, scenario, closure, configuration }) {
+  const stage = NodePath.join(run.root, "stage");
+  for (const name of ["app", "harness", "deps", ...writableNames.map((name) => `writable/${name}`)])
+    await NodeFSP.mkdir(NodePath.join(stage, name), { recursive: true, mode: 0o700 });
+  for (const relative of ["apps/desktop/dist-electron", "apps/server/dist"])
+    await copyClosedTree(NodePath.join(source, relative), NodePath.join(stage, "app", relative));
+  for (const relative of [
+    "package.json",
+    "apps/desktop/package.json",
+    "apps/server/package.json",
+  ]) {
+    const destination = NodePath.join(stage, "app", relative);
+    await NodeFSP.mkdir(NodePath.dirname(destination), { recursive: true });
+    await NodeFSP.writeFile(destination, await NodeFSP.readFile(NodePath.join(source, relative)), {
+      mode: 0o600,
+      flag: "wx",
+    });
+  }
+  for (const entry of await NodeFSP.readdir(
+    NodePath.join(harness, "apps/desktop/scripts/ui-evidence"),
+    {
+      withFileTypes: true,
+    },
+  )) {
+    if (entry.isFile() && entry.name.endsWith(".mjs") && !entry.name.endsWith(".test.mjs"))
+      await NodeFSP.cp(
+        NodePath.join(harness, "apps/desktop/scripts/ui-evidence", entry.name),
+        NodePath.join(stage, "harness", entry.name),
+      );
+  }
+  await NodeFSP.cp(scenario, NodePath.join(stage, "harness/scenario.mjs"));
+  await NodeFSP.writeFile(
+    NodePath.join(stage, "harness/config.json"),
+    JSON.stringify(configuration),
+    {
+      mode: 0o600,
+      flag: "wx",
+    },
+  );
+  const mapped = new Map(closure.packages.map((pkg, index) => [pkg.root, `/deps/${index}`]));
+  for (const pkg of closure.packages) {
+    const target = mapped.get(pkg.root);
+    await copyClosedTree(pkg.root, NodePath.join(stage, target));
+    const metadata = JSON.parse(
+      await NodeFSP.readFile(NodePath.join(pkg.root, "package.json"), "utf8"),
+    );
+    for (const name of new Set([
+      ...Object.keys(metadata.dependencies || {}),
+      ...Object.keys(metadata.optionalDependencies || {}),
+    ])) {
+      let resolved;
+      try {
+        resolved = await packageAt(name, pkg.root);
+      } catch (error) {
+        if (metadata.optionalDependencies?.[name]) continue;
+        throw error;
+      }
+      if (!mapped.has(resolved)) throw new Error("Incomplete dependency closure");
+      const destination = NodePath.join(stage, target, "node_modules", name);
+      await NodeFSP.mkdir(NodePath.dirname(destination), { recursive: true });
+      await NodeFSP.symlink(mapped.get(resolved), destination);
+    }
+  }
+  for (const root of closure.roots) {
+    const destination = NodePath.join(stage, root.destination.slice(1));
+    await NodeFSP.mkdir(NodePath.dirname(destination), { recursive: true });
+    await NodeFSP.symlink(mapped.get(root.root), destination);
+  }
+  // Synthetic git metadata contains no copied repository history or credentials.
+  const gitDir = NodePath.join(stage, "writable/workspace/.git");
+  await NodeFSP.mkdir(NodePath.join(gitDir, "objects"), { recursive: true });
+  await NodeFSP.mkdir(NodePath.join(gitDir, "refs/heads"), { recursive: true });
+  await NodeFSP.writeFile(NodePath.join(gitDir, "HEAD"), "ref: refs/heads/main\n");
+  await NodeFSP.writeFile(
+    NodePath.join(gitDir, "config"),
+    "[core]\n\trepositoryformatversion = 0\n\tbare = false\n",
+  );
+  return stage;
+}
+export async function bwrapArguments({ stage, runtime, artifacts }) {
+  const args = [
+    "--unshare-user",
+    "--unshare-pid",
+    "--unshare-ipc",
+    "--unshare-net",
+    "--unshare-uts",
+    "--unshare-cgroup-try",
+    "--die-with-parent",
+    "--new-session",
+    "--clearenv",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+  ];
+  for (const name of ["bin", "sbin", "lib", "lib64"]) {
+    try {
+      const target = await NodeFSP.realpath(`/${name}`);
+      args.push("--symlink", target, `/${name}`);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  args.push("--dir", "/etc");
+  for (const name of [
+    "ld.so.cache",
+    "ld.so.conf",
+    "ld.so.conf.d",
+    "fonts",
+    "passwd",
+    "group",
+    "nsswitch.conf",
+    "localtime",
+    "machine-id",
+  ]) {
+    try {
+      await NodeFSP.lstat(`/etc/${name}`);
+      args.push("--ro-bind", `/etc/${name}`, `/etc/${name}`);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  args.push("--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp", "--tmpfs", "/dev/shm");
+  for (const name of ["app", "harness", "deps"])
+    args.push("--ro-bind", NodePath.join(stage, name), `/${name}`);
+  args.push(
+    "--ro-bind",
+    runtime.directory,
+    "/electron",
+    "--bind",
+    artifacts,
+    "/artifacts",
+    "--dir",
+    "/scratch",
+  );
+  for (const name of writableNames)
+    args.push("--bind", NodePath.join(stage, "writable", name), `/scratch/${name}`);
+  for (const [key, value] of Object.entries(sandboxEnvironment()))
+    args.push("--setenv", key, value);
+  args.push("--chdir", "/app", "/usr/bin/node", "/harness/runner.mjs", "--inner");
+  return args;
+}
diff --git a/apps/desktop/scripts/ui-evidence/sandbox.test.mjs b/apps/desktop/scripts/ui-evidence/sandbox.test.mjs
new file mode 100644
index 000000000..039d2b2ff
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/sandbox.test.mjs
@@ -0,0 +1,62 @@
+import * as NodeTest from "node:test";
+import * as NodeAssert from "node:assert/strict";
+import { sandboxEnvironment, bwrapArguments } from "./sandbox.mjs";
+import { parseOptions } from "../ui-evidence.mjs";
+
+NodeTest.test(
+  "containment has private namespaces, a cleared environment and narrow mounts",
+  async () => {
+    const argv = await bwrapArguments({
+      stage: "/owned/stage",
+      runtime: { directory: "/owned/electron" },
+      artifacts: "/owned/artifacts",
+    });
+    for (const flag of [
+      "--unshare-user",
+      "--unshare-pid",
+      "--unshare-ipc",
+      "--unshare-net",
+      "--unshare-uts",
+      "--die-with-parent",
+      "--new-session",
+      "--clearenv",
+    ])
+      NodeAssert.ok(argv.includes(flag));
+    NodeAssert.equal(
+      argv.filter((value) => value === "--setenv").length,
+      Object.keys(sandboxEnvironment()).length,
+    );
+    NodeAssert.ok(
+      !argv.some(
+        (value) =>
+          value.includes("/home/") ||
+          value.includes(".git") ||
+          value.includes(".env") ||
+          value.includes(".t3") ||
+          value.includes(".config"),
+      ),
+    );
+    NodeAssert.ok(!argv.includes("--no-sandbox"));
+    NodeAssert.deepEqual(argv.slice(-3), ["/usr/bin/node", "/harness/runner.mjs", "--inner"]);
+    const env = sandboxEnvironment();
+    NodeAssert.equal(env.HOME, "/scratch/home");
+    NodeAssert.equal(env.T3CODE_HOME, "/scratch/t3home");
+    NodeAssert.equal(env.T3CODE_AUTO_BOOTSTRAP_PROJECT_FROM_CWD, "false");
+    for (const key of [
+      "DISPLAY",
+      "DBUS_SESSION_BUS_ADDRESS",
+      "SSH_AUTH_SOCK",
+      "T3CODE_DESKTOP_DEV",
+      "T3CODE_PACK_EXE",
+    ])
+      NodeAssert.equal(env[key], undefined);
+  },
+);
+NodeTest.test("CLI rejects malformed options before any work", () => {
+  NodeAssert.throws(() => parseOptions(["run", "--theme", "unknown"]));
+  NodeAssert.throws(() => parseOptions(["run", "--size", "200x800"]));
+  NodeAssert.throws(() => parseOptions(["run", "--scale", "NaN"]));
+  NodeAssert.throws(() => parseOptions(["run", "--out"]));
+  NodeAssert.throws(() => parseOptions(["run", "--source", "/one", "--source", "/two"]));
+  NodeAssert.equal(parseOptions(["run"]).theme, "system");
+});
diff --git a/apps/desktop/scripts/ui-evidence/scenario-api.mjs b/apps/desktop/scripts/ui-evidence/scenario-api.mjs
new file mode 100644
index 000000000..0b8f9e40c
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/scenario-api.mjs
@@ -0,0 +1,365 @@
+import * as NodeFSP from "node:fs/promises";
+import * as NodePath from "node:path";
+import * as NodeURL from "node:url";
+import { sha256 } from "./provenance.mjs";
+
+export function validateCaptureName(name) {
+  if (typeof name !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,79}$/.test(name))
+    throw new Error("Capture name must be a short plain filename stem");
+  return name;
+}
+export function assertLoopbackEndpoint(value, protocols = ["http:", "ws:"]) {
+  const url = new URL(value);
+  if (
+    !protocols.includes(url.protocol) ||
+    !["127.0.0.1", "[::1]", "localhost"].includes(url.hostname) ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash
+  )
+    throw new Error("Backend endpoint must be private loopback without credentials");
+  return url;
+}
+export async function loadScenario(file) {
+  const bytes = await NodeFSP.readFile(file);
+  const module = await import(`${NodeURL.pathToFileURL(file).href}?sha256=${sha256(bytes)}`);
+  if (sha256(await NodeFSP.readFile(file)) !== sha256(bytes))
+    throw new Error("Scenario changed during loading");
+  if (typeof module.default !== "function")
+    throw new Error("Scenario must export a default async function");
+  return { run: module.default, identity: { path: file, sha256: sha256(bytes) } };
+}
+export function pngDimensions(bytes) {
+  if (
+    bytes.length < 24 ||
+    !bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])) ||
+    bytes.toString("ascii", 12, 16) !== "IHDR"
+  )
+    throw new Error("Screenshot is not a PNG");
+  const width = bytes.readUInt32BE(16),
+    height = bytes.readUInt32BE(20);
+  if (!width || !height) throw new Error("Screenshot has invalid dimensions");
+  return { width, height };
+}
+// This function is serialized into the isolated renderer; keep it self-contained.
+export async function requestLocalBackend(
+  { endpoint, method, payload },
+  { desktopBridge, fetch, WebSocket, setTimeout, clearTimeout } = globalThis,
+) {
+  if (
+    method !== "snapshot" &&
+    (method !== "dispatch" ||
+      !["project.create", "thread.create", "thread.metadata.update"].includes(payload?.type))
+  )
+    throw new Error("Scenario fixture dispatch is limited to project/thread metadata");
+  for (const [key, protocol] of [
+    ["httpBaseUrl", "http:"],
+    ["wsBaseUrl", "ws:"],
+  ]) {
+    const url = new URL(endpoint[key]);
+    if (
+      url.protocol !== protocol ||
+      !["127.0.0.1", "[::1]", "localhost"].includes(url.hostname) ||
+      url.username ||
+      url.password ||
+      url.search ||
+      url.hash
+    )
+      throw new Error("Backend endpoint must be private loopback without credentials");
+  }
+  if (method === "dispatch") {
+    const fields = {
+      "project.create": ["type", "commandId", "projectId", "title", "workspaceRoot"],
+      "thread.create": [
+        "type",
+        "commandId",
+        "createdBy",
+        "creationSource",
+        "threadId",
+        "projectId",
+        "title",
+        "modelSelection",
+        "runtimeMode",
+        "interactionMode",
+        "branch",
+        "worktreePath",
+      ],
+      "thread.metadata.update": ["type", "commandId", "threadId", "title"],
+    }[payload.type];
+    if (Object.keys(payload).some((key) => !fields.includes(key)))
+      throw new Error("Fixture command contains fields outside metadata scope");
+    if (
+      payload.type === "thread.create" &&
+      (payload.createdBy !== "user" ||
+        payload.creationSource !== "web" ||
+        payload.branch !== null ||
+        payload.worktreePath !== null)
+    )
+      throw new Error("Fixture thread must use the private project without a worktree");
+  }
+  const token = await desktopBridge.getLocalEnvironmentBearerToken();
+  const headers = { authorization: `Bearer ${token}` };
+  if (method === "snapshot") {
+    const response = await fetch(new URL("/api/orchestration/shell", endpoint.httpBaseUrl), {
+      headers: { ...headers, "x-t3-orchestration-protocol": "2" },
+      credentials: "omit",
+      signal: AbortSignal.timeout(15000),
+    });
+    if (!response.ok) throw new Error(`Snapshot HTTP status ${response.status}`);
+    return response.json();
+  }
+  if (payload.type === "project.create") {
+    const response = await fetch(new URL("/api/projects/mutate", endpoint.httpBaseUrl), {
+      method: "POST",
+      headers: { ...headers, "content-type": "application/json" },
+      credentials: "omit",
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(15000),
+    });
+    if (!response.ok) throw new Error(`Project mutation HTTP status ${response.status}`);
+    return response.json();
+  }
+  const response = await fetch(new URL("/api/auth/websocket-ticket", endpoint.httpBaseUrl), {
+    method: "POST",
+    headers,
+    credentials: "omit",
+    signal: AbortSignal.timeout(15000),
+  });
+  if (!response.ok) throw new Error(`WebSocket authorization HTTP status ${response.status}`);
+  const { ticket } = await response.json();
+  if (typeof ticket !== "string" || !ticket)
+    throw new Error("WebSocket authorization missing ticket");
+  const url = new URL(endpoint.wsBaseUrl);
+  url.searchParams.set("wsTicket", ticket);
+  url.searchParams.set("orchestrationProtocol", "2");
+  return new Promise((resolve, reject) => {
+    const socket = new WebSocket(url.href);
+    let settled = false;
+    const finish = (error, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.close();
+      if (error) reject(error);
+      else resolve(value);
+    };
+    const timer = setTimeout(() => finish(new Error("Fixture RPC timed out")), 15000);
+    socket.addEventListener("open", () => {
+      if (settled) return;
+      try {
+        socket.send(
+          JSON.stringify({
+            _tag: "Request",
+            id: "0",
+            tag: "orchestration.dispatchCommand",
+            payload,
+            headers: [],
+          }),
+        );
+      } catch {
+        finish(new Error("Fixture RPC send failed"));
+      }
+    });
+    socket.addEventListener("message", ({ data }) => {
+      if (settled) return;
+      try {
+        const message = JSON.parse(data);
+        if (message._tag === "Ping") {
+          socket.send(JSON.stringify({ _tag: "Pong" }));
+          return;
+        }
+        if (message._tag !== "Exit" || String(message.requestId) !== "0") return;
+        if (message.exit?._tag === "Success") finish(null, message.exit.value);
+        else finish(new Error("Fixture RPC rejected metadata command"));
+      } catch {
+        finish(new Error("Invalid fixture RPC response"));
+      }
+    });
+    socket.addEventListener("error", () => finish(new Error("Fixture RPC connection failed")));
+    socket.addEventListener("close", () => finish(new Error("Fixture RPC closed before result")));
+  });
+}
+
+export function createScenarioContext({
+  electronApp,
+  page,
+  workspace,
+  artifacts,
+  size,
+  theme,
+  configuration = {},
+  restoreConnectivity,
+}) {
+  const state = { steps: [], captures: [], assertions: [], fixture: {}, logs: [], topology: null };
+  async function topology() {
+    const result = await page.evaluate(() => {
+      const values = window.desktopBridge.getLocalEnvironmentBootstraps();
+      return values.map(({ id, httpBaseUrl, wsBaseUrl }) => ({ id, httpBaseUrl, wsBaseUrl }));
+    });
+    if (result.length !== 1 || result[0].id !== "primary")
+      throw new Error("Expected exactly one isolated primary backend");
+    assertLoopbackEndpoint(result[0].httpBaseUrl, ["http:"]);
+    assertLoopbackEndpoint(result[0].wsBaseUrl, ["ws:"]);
+    state.topology = result[0];
+    return result[0];
+  }
+  async function request(method, payload) {
+    const endpoint = await topology();
+    return page.evaluate(requestLocalBackend, { endpoint, method, payload });
+  }
+
+  const ctx = {
+    electronApp,
+    page,
+    workspace,
+    artifacts,
+    size,
+    theme,
+    configuration,
+    fixture: state.fixture,
+    topology,
+    async step(name, fn) {
+      if (typeof name !== "string" || !name.trim() || state.steps.length >= 1000)
+        throw new Error("Invalid scenario step");
+      const entry = { name, status: "running", startedAt: new Date().toISOString() };
+      state.steps.push(entry);
+      const start = performance.now();
+      try {
+        const result = await fn();
+        entry.status = "passed";
+        return result;
+      } catch (error) {
+        entry.status = "failed";
+        throw error;
+      } finally {
+        entry.durationMs = Math.round(performance.now() - start);
+      }
+    },
+    assert(condition, name) {
+      state.assertions.push({ name, status: condition ? "passed" : "failed" });
+      if (!condition) throw new Error(`Scenario assertion failed: ${name}`);
+    },
+    async capture(name) {
+      validateCaptureName(name);
+      if (state.captures.some((capture) => capture.name === name))
+        throw new Error("Duplicate capture name");
+      const window = await electronApp.evaluate(({ BrowserWindow, nativeTheme }) => {
+        const win = BrowserWindow.getAllWindows()[0];
+        return {
+          bounds: win.getBounds(),
+          theme: nativeTheme.shouldUseDarkColors ? "dark" : "light",
+          themeSource: nativeTheme.themeSource,
+        };
+      });
+      const viewport = await page.evaluate(() => ({
+        width: innerWidth,
+        height: innerHeight,
+        scale: devicePixelRatio,
+        renderedTheme: document.documentElement.classList.contains("dark") ? "dark" : "light",
+      }));
+      const bytes = await page.screenshot({ type: "png", animations: "disabled" });
+      const dimensions = pngDimensions(bytes);
+      const file = `${name}.png`;
+      await NodeFSP.writeFile(NodePath.join(artifacts, file), bytes, { flag: "wx", mode: 0o600 });
+      const capture = {
+        name,
+        file,
+        sha256: sha256(bytes),
+        ...dimensions,
+        scale: viewport.scale,
+        theme: viewport.renderedTheme,
+        window,
+        viewport,
+      };
+      state.captures.push(capture);
+      return capture;
+    },
+    async completeOnboarding() {
+      const heading = page.getByRole("heading", { name: "Connect your computers", exact: true });
+      if (!(await heading.isVisible())) return false;
+      await page.getByRole("button", { name: "Continue", exact: true }).click();
+      await page.getByRole("heading", { name: "Connect your agents", exact: true }).waitFor();
+      await page.getByRole("button", { name: "Continue", exact: true }).click();
+      await page.getByRole("button", { name: "Do not import projects", exact: true }).click();
+      await heading.waitFor({ state: "hidden" });
+      await page.waitForFunction(
+        () => location.pathname !== "/welcome" && !location.hash.includes("/welcome"),
+      );
+      ctx.assert(true, "Provider-free first-run UI completed in isolated profile");
+      return true;
+    },
+    async dispatch(command) {
+      if (!["project.create", "thread.create", "thread.metadata.update"].includes(command?.type))
+        throw new Error("Scenario fixture dispatch is limited to project/thread metadata");
+      if (command.type === "project.create" && command.workspaceRoot !== workspace)
+        throw new Error("Fixture project must use the private workspace");
+      return request("dispatch", command);
+    },
+    readSnapshot: () => request("snapshot"),
+    async reload() {
+      await page.reload({ waitUntil: "domcontentloaded" });
+      await page.waitForFunction(() => Boolean(window.desktopBridge));
+      if (restoreConnectivity) await restoreConnectivity();
+    },
+    async setTheme(value) {
+      if (!["dark", "light", "system"].includes(value)) throw new Error("Invalid theme");
+      const actual = await electronApp.evaluate(({ nativeTheme }, desired) => {
+        nativeTheme.themeSource = desired;
+        return { themeSource: nativeTheme.themeSource, dark: nativeTheme.shouldUseDarkColors };
+      }, value);
+      if (
+        actual.themeSource !== value ||
+        (value !== "system" && actual.dark !== (value === "dark"))
+      )
+        throw new Error("Native theme readback mismatch");
+      await page.emulateMedia({ colorScheme: actual.dark ? "dark" : "light" });
+      await page.waitForFunction(
+        (dark) => matchMedia("(prefers-color-scheme: dark)").matches === dark,
+        actual.dark,
+      );
+      await page.waitForFunction(
+        (dark) => document.documentElement.classList.contains("dark") === dark,
+        actual.dark,
+      );
+      const finalNative = await electronApp.evaluate(({ nativeTheme }, desired) => {
+        nativeTheme.themeSource = desired;
+        return { themeSource: nativeTheme.themeSource, dark: nativeTheme.shouldUseDarkColors };
+      }, value);
+      if (finalNative.themeSource !== value || finalNative.dark !== actual.dark)
+        throw new Error("Final native theme fixture readback mismatch");
+      state.themeFixture = {
+        native: finalNative,
+        cssMedia: actual.dark ? "dark" : "light",
+        kind: "Native theme and CSS media fixture; no user preference persistence claim",
+      };
+      state.assertions.push({
+        name: `Native and rendered theme fixture match ${value}`,
+        status: "passed",
+      });
+      ctx.theme = actual.dark ? "dark" : "light";
+      return actual;
+    },
+    async setWindowSize(width, height) {
+      if (
+        ![width, height].every((value) => Number.isInteger(value) && value >= 320 && value <= 8192)
+      )
+        throw new Error("Invalid window dimensions");
+      return electronApp.evaluate(
+        ({ BrowserWindow }, dimensions) => {
+          const win = BrowserWindow.getAllWindows()[0];
+          win.setSize(...dimensions);
+          return win.getBounds();
+        },
+        [width, height],
+      );
+    },
+    log(message) {
+      if (typeof message !== "string" || /token|bearer|secret|credential|wsTicket/i.test(message))
+        throw new Error("Logs must contain nonsecret plain text");
+      state.logs.push(message.slice(0, 2000));
+    },
+    results: () => structuredClone(state),
+  };
+  return ctx;
+}
diff --git a/apps/desktop/scripts/ui-evidence/scenario-api.test.mjs b/apps/desktop/scripts/ui-evidence/scenario-api.test.mjs
new file mode 100644
index 000000000..32f7c1317
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/scenario-api.test.mjs
@@ -0,0 +1,308 @@
+import * as NodeTest from "node:test";
+import * as NodeAssert from "node:assert/strict";
+import * as NodeFSP from "node:fs/promises";
+import * as NodePath from "node:path";
+import * as NodeURL from "node:url";
+import {
+  assertLoopbackEndpoint,
+  loadScenario,
+  pngDimensions,
+  requestLocalBackend,
+  createScenarioContext,
+  validateCaptureName,
+} from "./scenario-api.mjs";
+import { sha256 } from "./provenance.mjs";
+
+NodeTest.test(
+  "scenario loader records exact content and rejects missing default function",
+  async () => {
+    const parent = NodePath.resolve(
+      NodePath.dirname(NodeURL.fileURLToPath(import.meta.url)),
+      "../../../../.t3/ui-evidence-test-scratch",
+    );
+    await NodeFSP.mkdir(parent, { recursive: true });
+    const root = await NodeFSP.mkdtemp(NodePath.join(parent, "scenario-"));
+    try {
+      const file = NodePath.join(root, "scenario.mjs");
+      const bytes = "export default async () => 42;\n";
+      await NodeFSP.writeFile(file, bytes);
+      const loaded = await loadScenario(file);
+      NodeAssert.equal(loaded.identity.sha256, sha256(bytes));
+      NodeAssert.equal(await loaded.run(), 42);
+      const invalid = NodePath.join(root, "invalid.mjs");
+      await NodeFSP.writeFile(invalid, "export const other = 1;\n");
+      await NodeAssert.rejects(loadScenario(invalid), /default async function/);
+    } finally {
+      await NodeFSP.rm(root, { recursive: true, force: true });
+    }
+  },
+);
+NodeTest.test("endpoints and capture paths stay bounded", () => {
+  NodeAssert.equal(assertLoopbackEndpoint("http://127.0.0.1:1234").port, "1234");
+  for (const endpoint of [
+    "https://example.com",
+    "http://127.0.0.1:1?token=secret",
+    "http://user:pass@localhost",
+  ])
+    NodeAssert.throws(() => assertLoopbackEndpoint(endpoint));
+  NodeAssert.equal(validateCaptureName("after-reload"), "after-reload");
+  for (const name of ["../secret", "/absolute", "", "a.png"])
+    NodeAssert.throws(() => validateCaptureName(name));
+});
+NodeTest.test("PNG metadata uses encoded physical dimensions", () => {
+  const bytes = Buffer.alloc(24);
+  Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]).copy(bytes);
+  bytes.write("IHDR", 12);
+  bytes.writeUInt32BE(1280, 16);
+  bytes.writeUInt32BE(800, 20);
+  NodeAssert.deepEqual(pngDimensions(bytes), { width: 1280, height: 800 });
+  NodeAssert.throws(() => pngDimensions(Buffer.from("not a PNG")));
+});
+
+const endpoint = {
+  id: "primary",
+  httpBaseUrl: "http://127.0.0.1:43773",
+  wsBaseUrl: "ws://127.0.0.1:43773/ws",
+};
+const threadCommand = {
+  type: "thread.create",
+  commandId: "fixture-command",
+  threadId: "fixture-thread",
+  projectId: "fixture-project",
+  title: "Synthetic",
+  createdBy: "user",
+  creationSource: "web",
+  modelSelection: { instanceId: "codex", model: "gpt-5" },
+  runtimeMode: "approval-required",
+  interactionMode: "default",
+  branch: null,
+  worktreePath: null,
+};
+function backendFixture({
+  httpStatus = 200,
+  rpcExit = { _tag: "Success", value: { sequence: 1 } },
+  malformed = false,
+  socketError = false,
+} = {}) {
+  const calls = [],
+    sockets = [];
+  const dependencies = {
+    setTimeout,
+    clearTimeout,
+    desktopBridge: { getLocalEnvironmentBearerToken: async () => "synthetic-bearer" },
+    fetch: async (url, options) => {
+      calls.push({ url: String(url), options });
+      return {
+        ok: httpStatus === 200,
+        status: httpStatus,
+        json: async () =>
+          String(url).endsWith("websocket-ticket")
+            ? { ticket: "synthetic-ticket" }
+            : { threads: [{ id: "fixture-thread", title: "Renamed" }] },
+      };
+    },
+    WebSocket: class {
+      listeners = new Map();
+      messages = [];
+      closed = false;
+      constructor(url) {
+        this.url = url;
+        sockets.push(this);
+        queueMicrotask(() => this.emit(socketError ? "error" : "open"));
+      }
+      addEventListener(type, listener) {
+        this.listeners.set(type, listener);
+      }
+      emit(type, event) {
+        this.listeners.get(type)?.(event);
+      }
+      send(data) {
+        this.messages.push(JSON.parse(data));
+        if (this.messages.at(-1)._tag !== "Request") return;
+        queueMicrotask(() => {
+          this.emit("message", {
+            data: JSON.stringify({ _tag: "Exit", requestId: "unrelated", exit: rpcExit }),
+          });
+          this.emit("message", { data: JSON.stringify({ _tag: "Ping" }) });
+          this.emit("message", {
+            data: malformed
+              ? "bad JSON"
+              : JSON.stringify({ _tag: "Exit", requestId: "0", exit: rpcExit }),
+          });
+        });
+      }
+      close() {
+        this.closed = true;
+        this.emit("close");
+      }
+    },
+  };
+  return { dependencies, calls, sockets };
+}
+NodeTest.test(
+  "V2 fixture snapshot authenticates with bearer, omits cookies, and negotiates protocol",
+  async () => {
+    const fixture = backendFixture();
+    const value = await requestLocalBackend({ endpoint, method: "snapshot" }, fixture.dependencies);
+    NodeAssert.equal(value.threads[0].title, "Renamed");
+    NodeAssert.equal(fixture.calls[0].url, "http://127.0.0.1:43773/api/orchestration/shell");
+    NodeAssert.deepEqual(fixture.calls[0].options.headers, {
+      authorization: "Bearer synthetic-bearer",
+      "x-t3-orchestration-protocol": "2",
+    });
+    NodeAssert.equal(fixture.calls[0].options.credentials, "omit");
+    NodeAssert.equal(fixture.sockets.length, 0);
+  },
+);
+NodeTest.test(
+  "V2 project fixtures use project mutation HTTP rather than legacy orchestration dispatch",
+  async () => {
+    const fixture = backendFixture();
+    const command = {
+      type: "project.create",
+      commandId: "c",
+      projectId: "p",
+      title: "Synthetic",
+      workspaceRoot: "/scratch/workspace",
+    };
+    await requestLocalBackend(
+      { endpoint, method: "dispatch", payload: command },
+      fixture.dependencies,
+    );
+    NodeAssert.equal(fixture.calls[0].url, "http://127.0.0.1:43773/api/projects/mutate");
+    NodeAssert.equal(fixture.calls[0].options.method, "POST");
+    NodeAssert.deepEqual(JSON.parse(fixture.calls[0].options.body), command);
+    NodeAssert.equal(fixture.calls[0].options.credentials, "omit");
+    NodeAssert.equal(fixture.sockets.length, 0);
+  },
+);
+NodeTest.test(
+  "V2 thread fixture RPC negotiates a private ticket, handles ping, and closes on success",
+  async () => {
+    const fixture = backendFixture();
+    NodeAssert.deepEqual(
+      await requestLocalBackend(
+        { endpoint, method: "dispatch", payload: threadCommand },
+        fixture.dependencies,
+      ),
+      { sequence: 1 },
+    );
+    NodeAssert.equal(fixture.calls[0].url, "http://127.0.0.1:43773/api/auth/websocket-ticket");
+    NodeAssert.equal(fixture.calls[0].options.credentials, "omit");
+    const socket = fixture.sockets[0];
+    const url = new URL(socket.url);
+    NodeAssert.equal(url.pathname, "/ws");
+    NodeAssert.equal(url.searchParams.get("orchestrationProtocol"), "2");
+    NodeAssert.equal(url.searchParams.get("wsTicket"), "synthetic-ticket");
+    NodeAssert.deepEqual(socket.messages[0], {
+      _tag: "Request",
+      id: "0",
+      tag: "orchestration.dispatchCommand",
+      payload: threadCommand,
+      headers: [],
+    });
+    NodeAssert.deepEqual(socket.messages[1], { _tag: "Pong" });
+    NodeAssert.equal(socket.closed, true);
+  },
+);
+NodeTest.test("V2 fixture HTTP failures reject before opening a socket", async () => {
+  for (const method of ["snapshot", "dispatch"]) {
+    const fixture = backendFixture({ httpStatus: 401 });
+    await NodeAssert.rejects(
+      requestLocalBackend({ endpoint, method, payload: threadCommand }, fixture.dependencies),
+      /HTTP status 401/,
+    );
+    NodeAssert.equal(fixture.sockets.length, 0);
+  }
+});
+NodeTest.test(
+  "V2 fixture RPC failures preserve rejection and close only the owned socket",
+  async () => {
+    for (const { options, expected } of [
+      {
+        options: { rpcExit: { _tag: "Failure", cause: "synthetic-ticket" } },
+        expected: /rejected metadata command/,
+      },
+      { options: { malformed: true }, expected: /Invalid fixture RPC response/ },
+      { options: { socketError: true }, expected: /connection failed/ },
+    ]) {
+      const fixture = backendFixture(options);
+      await NodeAssert.rejects(
+        requestLocalBackend(
+          { endpoint, method: "dispatch", payload: threadCommand },
+          fixture.dependencies,
+        ),
+        (error) => expected.test(error.message) && !error.message.includes("synthetic-ticket"),
+      );
+      NodeAssert.equal(fixture.sockets[0].closed, true);
+    }
+  },
+);
+NodeTest.test(
+  "V2 fixture scope rejects provider effects and nonloopback endpoints before credentials",
+  async () => {
+    const fixture = backendFixture();
+    fixture.dependencies.desktopBridge.getLocalEnvironmentBearerToken = () => {
+      throw new Error("credentials reached");
+    };
+    for (const payload of [
+      { type: "thread.turn.start" },
+      { type: "thread.meta.update" },
+      { type: "thread.metadata.update", commandId: "c", threadId: "t", regenerateTitle: true },
+      { ...threadCommand, worktreePath: "/live/worktree" },
+    ])
+      await NodeAssert.rejects(
+        requestLocalBackend({ endpoint, method: "dispatch", payload }, fixture.dependencies),
+        /metadata|private project/,
+      );
+    await NodeAssert.rejects(
+      requestLocalBackend(
+        { endpoint: { ...endpoint, wsBaseUrl: "ws://example.test/ws" }, method: "snapshot" },
+        fixture.dependencies,
+      ),
+      /private loopback/,
+    );
+    NodeAssert.equal(fixture.calls.length, 0);
+  },
+);
+NodeTest.test("scenario context restricts project fixtures to its owned workspace", async () => {
+  const fixture = backendFixture();
+  const page = { evaluate: (fn, input) => (input ? fn(input, fixture.dependencies) : [endpoint]) };
+  const ctx = createScenarioContext({ page, workspace: "/scratch/workspace" });
+  await NodeAssert.rejects(
+    ctx.dispatch({ type: "project.create", workspaceRoot: "/app" }),
+    /private workspace/,
+  );
+  await ctx.dispatch({
+    type: "thread.metadata.update",
+    commandId: "c",
+    threadId: "t",
+    title: "Renamed",
+  });
+  NodeAssert.equal(fixture.sockets[0].messages[0].payload.title, "Renamed");
+});
+
+NodeTest.test(
+  "V2 fixture RPC timeout rejects and closes its owned socket without waiting on wall time",
+  async () => {
+    const fixture = backendFixture();
+    fixture.dependencies.setTimeout = (fn, milliseconds) => {
+      NodeAssert.equal(milliseconds, 15000);
+      queueMicrotask(fn);
+      return "synthetic-timer";
+    };
+    let cleared;
+    fixture.dependencies.clearTimeout = (timer) => {
+      cleared = timer;
+    };
+    await NodeAssert.rejects(
+      requestLocalBackend(
+        { endpoint, method: "dispatch", payload: threadCommand },
+        fixture.dependencies,
+      ),
+      /timed out/,
+    );
+    NodeAssert.equal(fixture.sockets[0].closed, true);
+    NodeAssert.equal(cleared, "synthetic-timer");
+  },
+);
diff --git a/apps/desktop/scripts/ui-evidence/scenarios/example.mjs b/apps/desktop/scripts/ui-evidence/scenarios/example.mjs
new file mode 100644
index 000000000..52f55350f
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/scenarios/example.mjs
@@ -0,0 +1,11 @@
+export default async function customScenario(ctx) {
+  await ctx.step("Resize native window and verify dark theme", async () => {
+    const bounds = await ctx.setWindowSize(720, 600);
+    ctx.assert(
+      bounds.width === 720 && bounds.height === 600,
+      "Native window size matches requested narrow dimensions",
+    );
+    await ctx.setTheme("dark");
+  });
+  await ctx.capture("narrow-dark");
+}
diff --git a/apps/desktop/scripts/ui-evidence/scenarios/sidebar-rename.mjs b/apps/desktop/scripts/ui-evidence/scenarios/sidebar-rename.mjs
new file mode 100644
index 000000000..3f817217a
--- /dev/null
+++ b/apps/desktop/scripts/ui-evidence/scenarios/sidebar-rename.mjs
@@ -0,0 +1,88 @@
+import * as NodeCrypto from "node:crypto";
+
+export default async function sidebarRename(ctx) {
+  const projectId = NodeCrypto.randomUUID(),
+    threadId = NodeCrypto.randomUUID();
+  const initialTitle = "UI evidence synthetic thread";
+  const renamedTitle = "UI evidence renamed thread";
+  Object.assign(ctx.fixture, {
+    projectId,
+    threadId,
+    initialTitle,
+    renamedTitle,
+    workspaceRoot: ctx.workspace,
+  });
+  await ctx.step("Complete provider-free first-run UI", () => ctx.completeOnboarding());
+  await ctx.step("Create synthetic project and metadata-only thread", async () => {
+    await ctx.dispatch({
+      type: "project.create",
+      commandId: NodeCrypto.randomUUID(),
+      projectId,
+      title: "UI evidence synthetic project",
+      workspaceRoot: ctx.workspace,
+    });
+    await ctx.dispatch({
+      type: "thread.create",
+      createdBy: "user",
+      creationSource: "web",
+      commandId: NodeCrypto.randomUUID(),
+      projectId,
+      threadId,
+      title: initialTitle,
+      modelSelection: { instanceId: "codex", model: "gpt-5" },
+      runtimeMode: "approval-required",
+      interactionMode: "default",
+      branch: null,
+      worktreePath: null,
+    });
+    await ctx.page.getByRole("button", { name: initialTitle }).first().waitFor();
+  });
+  await ctx.step("Open synthetic thread before editing its title", async () => {
+    await ctx.page.getByRole("button", { name: initialTitle }).first().click();
+    await ctx.page.waitForFunction(
+      (id) => location.pathname.includes(id) || location.hash.includes(id),
+      threadId,
+    );
+    await ctx.page.getByTestId("composer-editor").waitFor();
+    await ctx.page.getByTestId("composer-editor").focus();
+  });
+  await ctx.capture("before");
+  await ctx.step("Rename through Sidebar UI", async () => {
+    await ctx.page
+      .getByRole("button", { name: initialTitle })
+      .first()
+      .locator("span[aria-hidden]")
+      .filter({ hasText: initialTitle })
+      .dblclick();
+    const input = ctx.page.getByRole("textbox", { name: "Thread title", exact: true });
+    await input.fill(renamedTitle);
+    await input.press("Enter");
+    await ctx.page.getByRole("button", { name: renamedTitle }).first().waitFor();
+    ctx.assert(
+      await ctx.page.getByRole("button", { name: renamedTitle }).first().isVisible(),
+      "Sidebar shows renamed title",
+    );
+    const snapshot = await ctx.readSnapshot();
+    ctx.assert(
+      snapshot.threads.some((thread) => thread.id === threadId && thread.title === renamedTitle),
+      "Backend snapshot stores renamed title",
+    );
+  });
+  await ctx.capture("after");
+  await ctx.step("Verify rename persists after reload", async () => {
+    await ctx.reload();
+    await ctx.page.getByRole("button", { name: renamedTitle }).first().waitFor();
+    ctx.assert(
+      await ctx.page.getByRole("button", { name: renamedTitle }).first().isVisible(),
+      "Reloaded Sidebar shows renamed title",
+    );
+    const snapshot = await ctx.readSnapshot();
+    ctx.assert(
+      snapshot.threads.some((thread) => thread.id === threadId && thread.title === renamedTitle),
+      "Backend snapshot retains renamed title after reload",
+    );
+  });
+  await ctx.capture("after-reload");
+  await ctx.step("Verify native and rendered dark theme", () => ctx.setTheme("dark"));
+  await ctx.capture("after-reload-dark");
+}
diff --git a/knip.jsonc b/knip.jsonc
index 386b71089..281a59584 100644
--- a/knip.jsonc
+++ b/knip.jsonc
@@ -55,6 +55,11 @@
         "src/preview-pip-preload.ts!",
         "src/mac-permission-preload.ts!",
         "src/preview/Annotation.css!",
+        // The namespace launcher stages and loads these modules by filename.
+        "scripts/ui-evidence/probe.mjs",
+        "scripts/ui-evidence/runner.mjs",
+        "scripts/ui-evidence/scenarios/example.mjs",
+        "scripts/ui-evidence/scenarios/sidebar-rename.mjs",
       ],
       // The injected runtime resolves Playwright by string; release tooling runs
       // electron-builder from this workspace, outside its package scripts.
diff --git a/package.json b/package.json
index e4b92d711..afadc28d3 100644
--- a/package.json
+++ b/package.json
@@ -35,6 +35,8 @@
     "test:perf:v2-wire": "vp test run apps/server/src/orchestration-v2/WireProjection.test.ts apps/server/src/orchestration-v2/threadHistoryPaging.test.ts apps/server/src/orchestration-v2/ThreadStream.test.ts apps/server/src/orchestration-v2/ThreadTransportPerformance.test.ts apps/server/src/orchestration-v2/ShellStream.test.ts apps/server/src/orchestration-v2/CommandPolicy.test.ts apps/server/src/orchestration-v2/runtimeLayer.test.ts apps/server/src/ws.test.ts packages/contracts/src/environmentHttp.test.ts packages/contracts/src/orchestrationV2.test.ts packages/client-runtime/src/operations/commands.test.ts packages/client-runtime/src/operations/commands.performance.test.ts packages/client-runtime/src/state/boundedThreadSnapshotHttp.test.ts packages/client-runtime/src/state/threadHistoryController.test.ts packages/client-runtime/src/state/threadHistoryMerge.test.ts packages/client-runtime/src/state/threadDetail.test.ts packages/client-runtime/src/state/threads-sync.test.ts packages/client-runtime/src/state/shellReducer.test.ts",
     "test:resource-monitor": "cargo test --locked --manifest-path native/resource-monitor/Cargo.toml",
     "test:desktop-smoke": "vp run --filter @t3tools/desktop smoke-test",
+    "ui:evidence": "node apps/desktop/scripts/ui-evidence.mjs",
+    "test:ui-evidence": "node --test --test-concurrency=1 apps/desktop/scripts/ui-evidence/*.test.mjs",
     "fmt": "vp fmt",
     "fmt:check": "vp fmt --check",
     "dist:desktop:artifact": "node scripts/build-desktop-artifact.ts",