diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index f52c02a..c7eab89 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -102,11 +102,19 @@ jobs:
 
       # --overwrite is not optional. Without it, and with a release directory already
       # present, mix release prompts, gets no stdin, and exits 0 having built nothing.
+      # Slice 013: on Linux, mdex's NIF is built from source for Burrito's musl ERTS, linked
+      # through Zig (scripts/zig-cc-musl; config/config.exs names the three settings and
+      # NOTES.md finding 14 the measurement). rustup installed the musl standard library from
+      # rust-toolchain.toml above. macOS and Windows load the precompiled artifact for their
+      # native ERTS; the smoke step below is what says whether it loaded.
       - name: Build the Burrito binary
         shell: bash
         env:
           BURRITO_TARGET: ${{ matrix.target }}
           MIX_ENV: prod
+          MDEX_NATIVE_BUILD: ${{ runner.os == 'Linux' && '1' || '' }}
+          TRINITY_NIF_TARGET: ${{ runner.os == 'Linux' && 'x86_64-unknown-linux-musl' || '' }}
+          CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: ${{ runner.os == 'Linux' && format('{0}/scripts/zig-cc-musl', github.workspace) || '' }}
         run: |
           set -euo pipefail
           # `mix deps.get` above runs in the default env. On the Windows runner the prod build
@@ -188,6 +196,8 @@ jobs:
           sleep 3
           ours > ps-after.txt
           grep -q '^TRINITY_SMOKE_PORT=[0-9][0-9]*$' smoke.log
+          # Slice 013: the renderer's NIF loaded and rendered in this binary (exit 3 otherwise).
+          grep -q '^TRINITY_SMOKE_MARKDOWN=ok$' smoke.log
           echo "--- ours, before ---"; cat ps-before.txt
           echo "--- ours, after ----"; cat ps-after.txt
           diff ps-before.txt ps-after.txt
@@ -202,6 +212,9 @@ jobs:
           if (-not (Select-String -Path smoke.log -Pattern '^TRINITY_SMOKE_PORT=\d+$')) {
             throw "no port line"
           }
+          if (-not (Select-String -Path smoke.log -Pattern '^TRINITY_SMOKE_MARKDOWN=ok$')) {
+            throw "the markdown renderer did not render in this binary (slice 013)"
+          }
 
       # AC1's property on a runner, and AC6's per-OS cold start, which used to be skipped.
       # `bash` on every OS, Windows included: the job that never curled was the one gap in
@@ -233,7 +246,14 @@ jobs:
             [ -n "${PORT:-}" ] && break
             sleep 0.5
           done
-          test -n "${PORT:-}"
+          # No endpoint line in two minutes says nothing on its own either: runs 35512430836
+          # (slice/011), 35515556177 (slice/012) and 35521749862 all failed here on macOS and
+          # Windows with an empty step log. The log the binary wrote goes to stderr first.
+          if [ -z "${PORT:-}" ]; then
+            echo "no 'Running TrinityWeb.Endpoint' line in serve.log after 120 s" >&2
+            echo "--- serve.log ---" >&2; tail -60 serve.log >&2
+            exit 1
+          fi
           # Bounded. The first version of this loop had no limit and the Windows runner sat in
           # it until the run was cancelled by hand: a step that hangs reports nothing and
           # fails nothing, which is the same shape as a workflow that never fires.
@@ -252,6 +272,13 @@ jobs:
           echo "HTTP $code on port $PORT"
           echo "COLD_START_MS=$elapsed" | tee -a "$GITHUB_ENV"
           echo "### ${{ matrix.name }}: cold start to first HTTP 200: **${elapsed} ms**" >> "$GITHUB_STEP_SUMMARY"
+          # A non-200 says nothing on its own: run 35518054546 (slice 013) printed "HTTP 500"
+          # and nothing else, and the log that would have named the exception was never
+          # read. The body and the tail of serve.log go to stderr before the step fails.
+          if [ "$code" != "200" ]; then
+            echo "--- body of GET / ---" >&2; curl -sS "http://127.0.0.1:$PORT/" | head -c 2000 >&2; echo >&2
+            echo "--- serve.log ---" >&2; tail -60 serve.log >&2
+          fi
           test "$code" = "200"
           # Stopping it, and Windows needs its own verb. `kill` from Git-bash does not stop a
           # native Windows process, so the backgrounded .exe outlived the step and the job hung
diff --git a/.sobelow-skips b/.sobelow-skips
index 71b14d2..1e54748 100644
--- a/.sobelow-skips
+++ b/.sobelow-skips
@@ -1,5 +1,5 @@
-Config.CSP: Missing Content-Security-Policy,lib/trinity_web/router.ex:12,2DBC9F9
-Traversal.FileModule: Directory Traversal in `File.mkdir_p`,lib/trinity/data_dir/lock.ex:57,35AB9EC
-Traversal.FileModule: Directory Traversal in `File.read`,lib/trinity/data_dir/lock.ex:143,55D5ADB
-Traversal.FileModule: Directory Traversal in `File.rm`,lib/trinity/data_dir/lock.ex:82,21D88E2
-Traversal.FileModule: Directory Traversal in `File.write`,lib/trinity/data_dir/lock.ex:132,1C42814
+Config.CSP: Missing Content-Security-Policy,lib/trinity_web/router.ex:14,1DC4768
+Traversal.FileModule: Directory Traversal in `File.mkdir_p`,lib/trinity/data_dir/lock.ex:60,4ECF02C
+Traversal.FileModule: Directory Traversal in `File.read`,lib/trinity/data_dir/lock.ex:146,5EFB666
+Traversal.FileModule: Directory Traversal in `File.rm`,lib/trinity/data_dir/lock.ex:85,7D2B826
+Traversal.FileModule: Directory Traversal in `File.write`,lib/trinity/data_dir/lock.ex:135,42D2817
diff --git a/.sobelow-skips.reasons b/.sobelow-skips.reasons
index 38747f7..3e18106 100644
--- a/.sobelow-skips.reasons
+++ b/.sobelow-skips.reasons
@@ -9,8 +9,8 @@
 # exactly that. Re-run mix sobelow --mark-skip-all and rekey this file when it happens.
 #
 # format: <fingerprint><TAB><reason>
-2DBC9F9	Missing CSP on the browser pipeline. The scaffold ships no Content-Security-Policy, and setting one needs LiveView nonce handling, which belongs with the UI rather than the toolchain. Slice 013 owns it. Skipped rather than fixed blind: a CSP written without the UI it protects is a guess.
-35AB9EC	Slice 010, Trinity.DataDir.Lock.acquire/2: the directory is the application's own data directory from config or Trinity.Paths, never a request or a model output; the lock has to create it before the Repo does. Low confidence traversal by the tool's own label.
-55D5ADB	Slice 010, Trinity.DataDir.Lock read/1: reads <data_dir>/LOCK, a path this module composes from the data directory and a constant file name; no caller supplies it.
-21D88E2	Slice 010, Trinity.DataDir.Lock.release/2: removes <data_dir>/LOCK only when the file carries this process's own token; same composed path as the read.
-1C42814	Slice 010, Trinity.DataDir.Lock take_over/2: rewrites <data_dir>/LOCK after the recorded holder's pid is found dead; same composed path, same constant name.
+1DC4768	Slice 013, the browser pipeline: the policy IS set, by TrinityWeb.Plugs.ContentSecurityPolicy with a nonce per request, placed before put_secure_browser_headers. sobelow recognises only a header map given to put_secure_browser_headers, so it keeps reporting the pipeline. test/trinity_web/plugs/content_security_policy_test.exs asserts the header and the nonce on every browser response. Rekeyed from 2DBC9F9 (router.ex:12, slice 000, "slice 013 owns it") when the plug moved the line to 14.
+4ECF02C	Rekeyed at slice 013 (the moduledoc grew three lines for the macOS and Windows liveness check). Slice 010, Trinity.DataDir.Lock.acquire/2: the directory is the application's own data directory from config or Trinity.Paths, never a request or a model output; the lock has to create it before the Repo does. Low confidence traversal by the tool's own label.
+5EFB666	Rekeyed at slice 013 (the moduledoc grew three lines for the macOS and Windows liveness check). Slice 010, Trinity.DataDir.Lock read/1: reads <data_dir>/LOCK, a path this module composes from the data directory and a constant file name; no caller supplies it.
+7D2B826	Rekeyed at slice 013 (the moduledoc grew three lines for the macOS and Windows liveness check). Slice 010, Trinity.DataDir.Lock.release/2: removes <data_dir>/LOCK only when the file carries this process's own token; same composed path as the read.
+42D2817	Rekeyed at slice 013 (the moduledoc grew three lines for the macOS and Windows liveness check). Slice 010, Trinity.DataDir.Lock take_over/2: rewrites <data_dir>/LOCK after the recorded holder's pid is found dead; same composed path, same constant name.
diff --git a/REUSE.toml b/REUSE.toml
index 70a0864..44888a2 100644
--- a/REUSE.toml
+++ b/REUSE.toml
@@ -11,7 +11,7 @@ SPDX-PackageDownloadLocation = "https://github.com/ScriptKittyOS/Trinity"
 # the gap is recorded rather than glossed.
 
 [[annotations]]
-path = ["mix.lock", "src-tauri/Cargo.lock", "**/*.md", "**/*.json", "**/*.tsv", "**/*.cff", "**/*.toml", ".tool-versions", ".gitignore", ".sobelow-skips", ".sobelow-skips.reasons", "priv/name_digests.txt", ".formatter.exs"]
+path = ["mix.lock", "src-tauri/Cargo.lock", "**/*.md", "**/*.json", "**/*.tsv", "**/*.cff", "**/*.toml", ".tool-versions", ".gitignore", ".sobelow-skips", ".sobelow-skips.reasons", "priv/name_digests.txt", ".formatter.exs", "slices/**/proof/**"]
 precedence = "aggregate"
 SPDX-FileCopyrightText = "Sudo Apt Holdings LLC"
 SPDX-License-Identifier = "Apache-2.0"
diff --git a/ROADMAP.md b/ROADMAP.md
index bea1b92..655e4d4 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -36,7 +36,7 @@ standards register names the rows that ask for them.
 | 010 | Core domain + persistence (Ecto/SQLite, schemas, Repo owner) | 1 Core loop | M | 000 | approved |
 | 011 | LLM provider layer (req_llm behind `Trinity.LLM` behaviour) | 1 Core loop | M | 010 | approved |
 | 012 | Session process + agent loop (gen_statem, DynamicSupervisor, rehydration) | 1 Core loop | L | 010, 011 | approved |
-| 013 | LiveView chat UI with streaming | 1 Core loop | M | 012 | planned |
+| 013 | LiveView chat UI with streaming | 1 Core loop | M | 012 | done |
 | 020 | Tool protocol + registry | 2 Tools | M | 012 | planned |
 | 021 | Permission gate + approval UI (M2 fingerprint-bound, M7) | 2 Tools | M | 020, 013 | planned |
 | 022 | Core tools: filesystem, web fetch/search, shell (MuonTrap) | 2 Tools | L | 021 | planned |
diff --git a/VERSIONS.md b/VERSIONS.md
index 804641f..85aa401 100644
--- a/VERSIONS.md
+++ b/VERSIONS.md
@@ -133,7 +133,9 @@ never pin a version hex marks as retired or vulnerable.
 | `ex_tauri` | ~> 0.2 | ✅ in `mix.lock` | ⚠️ Declares `otp_release: "~> 27.0"`, and Slice 000's probe refutes the reason it gives: OTP 28 macOS universal returns 200 and OTP 27 returns 404. Whether it runs on the pinned OTP is Slice 001's first measurement. ⚠️ 439 downloads all-time, so the ADR-0004 fallback matrix carries real weight. |
 | `nostrum` | ~> 0.10 | 🔍 not yet a dependency | Discord. ⚠️ No release in roughly 18 months. R11's trigger already fires. Check intents and components against the current gateway before Slice 072. |
 | `telegex` | **not pinned** | 🔍 not a single package | Telegram. ⚠️ The latest release on hex is a release candidate, roughly two years old, and this file's own rule forbids pinning an `-rc`. Alternative: ex_gram. Slice 071 decides with the measurement. |
-| `phoenix_streamdown` | **not pinned** | 🔍 not a single package | Streaming markdown renderer for LiveView. ⚠️ Pre-release, and this file's own rule forbids pinning an `-rc`; a beta is the same category. Verify at Slice 013; fallback: earmark or mdex with chunk buffering. |
+| `phoenix_streamdown` | not used (measured at Slice 013, 2026-09-20) | 🔍 not a single package | Streaming markdown renderer for LiveView. Measured at Slice 013: 1.0.0-beta.4 (2026-05-03) was still the latest release with no stable behind it, and this file's own rule forbids a pre-release. It is 801 lines over `mdex`, whose own `streaming: true` option completes fragments; the rest is a rendering rule Slice 013 keeps anyway. The row stays so the decision is visible where a reader would look for the package. |
+| `mdex` | ~> 0.13 | ✅ in `mix.lock` | Markdown renderer for the chat (`TrinityWeb.Markdown`), streaming fragments completed by its `streaming: true` option, raw HTML omitted (`unsafe: false`) and the default sanitizer on top. Added at Slice 013 after the measurement in its NOTES.md: `earmark` 1.4.49 is retired on hex with an open XSS advisory (EEF-CVE-2026-48591), which the gate refuses. ⚠️ A Rust NIF (`mdex_native`): the first in the bundle. Measured at Slice 013 (NOTES finding 13): neither precompiled artifact loads in Burrito's musl ERTS on Linux, so the linux package builds it from source for musl with Zig as the linker (`rustler` below, `scripts/zig-cc-musl`, the three settings in config/config.exs); macOS and Windows load the precompiled artifact. The `--smoke` path prints whether it rendered, and the `package` workflow reads that line on every target. |
+| `rustler` | ~> 0.38 | ✅ in `mix.lock` | Build time only (`runtime: false`): what `rustler_precompiled` needs to compile `mdex_native` from source when `MDEX_NATIVE_BUILD=1`, which the linux package sets (owner decision 2026-09-20, Slice 013 NOTES finding 14). Nothing in the tree calls it. |
 
 ### Dev and quality
 
diff --git a/assets/css/app.css b/assets/css/app.css
index da837e5..a82481c 100644
--- a/assets/css/app.css
+++ b/assets/css/app.css
@@ -20,76 +20,98 @@
   themes: false;
 }
 
-/* daisyUI theme plugin.
-  We ship with two themes, a light one inspired on Phoenix colors and a dark one inspired
-  on Elixir colors. Build your own at: https://daisyui.com/theme-generator/ */
+/* Trinity design tokens, decided at slice 013 (SLICE.md: "the design language is decided here").
+   Every later surface (the approval card at 021, the memory panel at 030, the skills list at
+   040, tasks at 050, gateways at 070, activity and cost at 090, settings at 100) takes these
+   rather than inventing its own. Two daisyUI themes carry the palette; the @theme block below
+   carries the fonts, the two extra text sizes and the radii. Dark is the default.
+
+   Fonts: a stack, no bundled file (NOTES.md, "Design language"): Ubuntu where the OS has it,
+   Comfortaa where installed, then the system font. Slice 100 decides what the packaged app
+   ships once its target list is fixed. */
+@theme {
+  --font-sans: "Ubuntu", "Comfortaa", system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+  --font-mono: "Ubuntu Mono", ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  /* Type scale: Tailwind's default steps, plus the two the chat reads most. */
+  --text-ui: 0.9375rem;
+  --text-ui--line-height: 1.5rem;
+  --text-meta: 0.75rem;
+  --text-meta--line-height: 1rem;
+  /* Radii: panels, fields, pills. daisyUI's --radius-box/field/selector below match them. */
+  --radius-panel: 1rem;
+  --radius-field: 0.75rem;
+  --radius-pill: 9999px;
+}
+
+/* The dark theme: the default. Deep slate surfaces, a teal primary, violet secondary, amber accent. */
 @plugin "daisyui/packages/bundle/daisyui-theme" {
   name: "dark";
-  default: false;
+  default: true;
   prefersdark: true;
   color-scheme: "dark";
-  --color-base-100: oklch(30.33% 0.016 252.42);
-  --color-base-200: oklch(25.26% 0.014 253.1);
-  --color-base-300: oklch(20.15% 0.012 254.09);
-  --color-base-content: oklch(97.807% 0.029 256.847);
-  --color-primary: oklch(58% 0.233 277.117);
-  --color-primary-content: oklch(96% 0.018 272.314);
-  --color-secondary: oklch(58% 0.233 277.117);
-  --color-secondary-content: oklch(96% 0.018 272.314);
-  --color-accent: oklch(60% 0.25 292.717);
-  --color-accent-content: oklch(96% 0.016 293.756);
-  --color-neutral: oklch(37% 0.044 257.287);
-  --color-neutral-content: oklch(98% 0.003 247.858);
-  --color-info: oklch(58% 0.158 241.966);
-  --color-info-content: oklch(97% 0.013 236.62);
-  --color-success: oklch(60% 0.118 184.704);
-  --color-success-content: oklch(98% 0.014 180.72);
-  --color-warning: oklch(66% 0.179 58.318);
-  --color-warning-content: oklch(98% 0.022 95.277);
-  --color-error: oklch(58% 0.253 17.585);
-  --color-error-content: oklch(96% 0.015 12.422);
-  --radius-selector: 0.25rem;
-  --radius-field: 0.25rem;
-  --radius-box: 0.5rem;
-  --size-selector: 0.21875rem;
-  --size-field: 0.21875rem;
-  --border: 1.5px;
-  --depth: 1;
+  --color-base-100: oklch(23% 0.016 262);
+  --color-base-200: oklch(19% 0.015 262);
+  --color-base-300: oklch(29% 0.018 262);
+  --color-base-content: oklch(94% 0.008 262);
+  --color-primary: oklch(75% 0.13 195);
+  --color-primary-content: oklch(18% 0.03 195);
+  --color-secondary: oklch(72% 0.12 300);
+  --color-secondary-content: oklch(18% 0.03 300);
+  --color-accent: oklch(80% 0.14 80);
+  --color-accent-content: oklch(22% 0.05 80);
+  --color-neutral: oklch(33% 0.02 262);
+  --color-neutral-content: oklch(94% 0.008 262);
+  --color-info: oklch(72% 0.14 230);
+  --color-info-content: oklch(18% 0.03 230);
+  --color-success: oklch(72% 0.15 160);
+  --color-success-content: oklch(18% 0.03 160);
+  --color-warning: oklch(78% 0.16 75);
+  --color-warning-content: oklch(22% 0.05 75);
+  --color-error: oklch(66% 0.2 22);
+  --color-error-content: oklch(98% 0.01 22);
+  --radius-selector: 9999px;
+  --radius-field: 0.75rem;
+  --radius-box: 1rem;
+  --size-selector: 0.25rem;
+  --size-field: 0.25rem;
+  --border: 1px;
+  --depth: 0;
   --noise: 0;
 }
 
+/* The light theme: the same hues on paper-white surfaces. */
 @plugin "daisyui/packages/bundle/daisyui-theme" {
   name: "light";
-  default: true;
+  default: false;
   prefersdark: false;
   color-scheme: "light";
-  --color-base-100: oklch(98% 0 0);
-  --color-base-200: oklch(96% 0.001 286.375);
-  --color-base-300: oklch(92% 0.004 286.32);
-  --color-base-content: oklch(21% 0.006 285.885);
-  --color-primary: oklch(70% 0.213 47.604);
-  --color-primary-content: oklch(98% 0.016 73.684);
-  --color-secondary: oklch(55% 0.027 264.364);
-  --color-secondary-content: oklch(98% 0.002 247.839);
-  --color-accent: oklch(0% 0 0);
-  --color-accent-content: oklch(100% 0 0);
-  --color-neutral: oklch(44% 0.017 285.786);
-  --color-neutral-content: oklch(98% 0 0);
-  --color-info: oklch(62% 0.214 259.815);
-  --color-info-content: oklch(97% 0.014 254.604);
-  --color-success: oklch(70% 0.14 182.503);
-  --color-success-content: oklch(98% 0.014 180.72);
-  --color-warning: oklch(66% 0.179 58.318);
-  --color-warning-content: oklch(98% 0.022 95.277);
-  --color-error: oklch(58% 0.253 17.585);
-  --color-error-content: oklch(96% 0.015 12.422);
-  --radius-selector: 0.25rem;
-  --radius-field: 0.25rem;
-  --radius-box: 0.5rem;
-  --size-selector: 0.21875rem;
-  --size-field: 0.21875rem;
-  --border: 1.5px;
-  --depth: 1;
+  --color-base-100: oklch(99% 0.002 262);
+  --color-base-200: oklch(96% 0.004 262);
+  --color-base-300: oklch(91% 0.006 262);
+  --color-base-content: oklch(24% 0.02 262);
+  --color-primary: oklch(52% 0.12 195);
+  --color-primary-content: oklch(98% 0.01 195);
+  --color-secondary: oklch(52% 0.14 300);
+  --color-secondary-content: oklch(98% 0.01 300);
+  --color-accent: oklch(62% 0.15 75);
+  --color-accent-content: oklch(98% 0.01 75);
+  --color-neutral: oklch(90% 0.006 262);
+  --color-neutral-content: oklch(24% 0.02 262);
+  --color-info: oklch(55% 0.16 230);
+  --color-info-content: oklch(98% 0.01 230);
+  --color-success: oklch(55% 0.15 160);
+  --color-success-content: oklch(98% 0.01 160);
+  --color-warning: oklch(62% 0.16 75);
+  --color-warning-content: oklch(98% 0.01 75);
+  --color-error: oklch(58% 0.22 22);
+  --color-error-content: oklch(98% 0.01 22);
+  --radius-selector: 9999px;
+  --radius-field: 0.75rem;
+  --radius-box: 1rem;
+  --size-selector: 0.25rem;
+  --size-field: 0.25rem;
+  --border: 1px;
+  --depth: 0;
   --noise: 0;
 }
 
@@ -104,4 +126,28 @@
 /* Make LiveView wrapper divs transparent for layout */
 [data-phx-session], [data-phx-teleported-src] { display: contents }
 
-/* This file is for your main application CSS */
+/* Rendered markdown (TrinityWeb.Markdown) inside a message. Preflight strips the browser's
+   defaults, so the block elements get theirs back here, in the theme's colours. */
+.md > * + * { margin-top: 0.5rem; }
+.md p { line-height: 1.6; }
+.md h1, .md h2, .md h3 { font-weight: 600; line-height: 1.3; margin-top: 0.75rem; }
+.md h1 { font-size: 1.25rem; }
+.md h2 { font-size: 1.125rem; }
+.md h3 { font-size: 1rem; }
+.md ul { list-style: disc; padding-left: 1.25rem; }
+.md ol { list-style: decimal; padding-left: 1.25rem; }
+.md li + li { margin-top: 0.125rem; }
+.md a { color: var(--color-primary); text-decoration: underline; text-underline-offset: 2px; }
+.md code { font-family: var(--font-mono); font-size: 0.875em; background: var(--color-base-300); padding: 0.1em 0.35em; border-radius: 0.375rem; }
+.md pre { background: var(--color-base-300); border-radius: var(--radius-field); padding: 0.75rem 1rem; overflow-x: auto; }
+.md pre code { background: none; padding: 0; font-size: 0.85em; }
+.md blockquote { border-left: 3px solid var(--color-secondary); padding-left: 0.75rem; opacity: 0.85; }
+.md table { border-collapse: collapse; font-size: 0.9em; }
+.md th, .md td { border: 1px solid var(--color-base-300); padding: 0.25rem 0.6rem; text-align: left; }
+.md th { background: var(--color-base-300); font-weight: 600; }
+.md hr { border: 0; border-top: 1px solid var(--color-base-300); }
+.md strong { font-weight: 600; }
+
+/* The streaming cursor at the end of an in-progress message. */
+.md-streaming::after { content: "▍"; color: var(--color-primary); animation: trinity-blink 1s steps(2) infinite; }
+@keyframes trinity-blink { to { opacity: 0; } }
diff --git a/assets/js/app.js b/assets/js/app.js
index 9456a75..dd02f12 100644
--- a/assets/js/app.js
+++ b/assets/js/app.js
@@ -27,13 +27,14 @@ import {LiveSocket} from "phoenix_live_view"
 import {hooks as colocatedHooks} from "phoenix-colocated/trinity"
 import topbar from "../vendor/topbar"
 import { TauriHook } from "../vendor/ex_tauri"
+import { Composer, Shortcuts, ScrollToBottom, LocalTime } from "./hooks"
 
 
 const csrfToken = document.querySelector("meta[name='csrf-token']").getAttribute("content")
 const liveSocket = new LiveSocket("/live", Socket, {
   longPollFallbackMs: 2500,
   params: {_csrf_token: csrfToken},
-  hooks: { TauriHook,...colocatedHooks},
+  hooks: { TauriHook, Composer, Shortcuts, ScrollToBottom, LocalTime, ...colocatedHooks},
 })
 
 // Show progress bar on live navigation and form submits
diff --git a/assets/js/hooks.js b/assets/js/hooks.js
new file mode 100644
index 0000000..ac11358
--- /dev/null
+++ b/assets/js/hooks.js
@@ -0,0 +1,90 @@
+/* SPDX-FileCopyrightText: Sudo Apt Holdings LLC */
+/* SPDX-License-Identifier: Apache-2.0 */
+// The chat's four hooks (slice 013). Each is a few lines and does one thing the server
+// cannot: read a key with its modifiers, keep the message list pinned to the bottom, show a
+// time in the viewer's zone, or tell Enter from Shift+Enter.
+
+// Enter sends, Shift+Enter breaks the line; the server clears the box after a send.
+export const Composer = {
+  mounted() {
+    this.el.addEventListener("keydown", (e) => {
+      if (e.key === "Enter" && !e.shiftKey && !e.isComposing) {
+        e.preventDefault()
+        this.el.form.requestSubmit()
+      }
+    })
+    this.el.addEventListener("input", () => this.grow())
+    this.handleEvent("composer:clear", () => {
+      this.el.value = ""
+      this.grow()
+      this.el.focus()
+    })
+    this.el.focus()
+  },
+  updated() {
+    if (!this.el.disabled) this.el.focus()
+  },
+  grow() {
+    this.el.style.height = "auto"
+    this.el.style.height = Math.min(this.el.scrollHeight, 192) + "px"
+  },
+}
+
+// Ctrl/Cmd+K opens a new session, Esc cancels the turn. Nothing else reaches the server.
+export const Shortcuts = {
+  mounted() {
+    this.onKey = (e) => {
+      if ((e.ctrlKey || e.metaKey) && e.key.toLowerCase() === "k") {
+        e.preventDefault()
+        this.pushEvent("new_session", {})
+      } else if (e.key === "Escape") {
+        this.pushEvent("cancel", {})
+      }
+    }
+    window.addEventListener("keydown", this.onKey)
+  },
+  destroyed() {
+    window.removeEventListener("keydown", this.onKey)
+  },
+}
+
+// The message list follows new content unless the reader has scrolled up to read.
+export const ScrollToBottom = {
+  mounted() {
+    this.pinned = true
+    this.el.addEventListener("scroll", () => {
+      const gap = this.el.scrollHeight - this.el.scrollTop - this.el.clientHeight
+      this.pinned = gap < 48
+    })
+    this.scroll()
+    this.observer = new MutationObserver(() => this.scroll())
+    this.observer.observe(this.el, {childList: true, subtree: true, characterData: true})
+  },
+  updated() {
+    this.scroll()
+  },
+  destroyed() {
+    if (this.observer) this.observer.disconnect()
+  },
+  scroll() {
+    if (this.pinned) this.el.scrollTop = this.el.scrollHeight
+  },
+}
+
+// A <time datetime="..."> rendered as UTC by the server, rewritten in the viewer's zone.
+export const LocalTime = {
+  mounted() {
+    this.render()
+  },
+  updated() {
+    this.render()
+  },
+  render() {
+    const at = new Date(this.el.getAttribute("datetime"))
+    if (isNaN(at)) return
+    const time = {hour: "2-digit", minute: "2-digit"}
+    this.el.textContent = this.el.dataset.format === "datetime"
+      ? at.toLocaleDateString([], {year: "numeric", month: "short", day: "numeric"}) + " " + at.toLocaleTimeString([], time)
+      : at.toLocaleTimeString([], time)
+  },
+}
diff --git a/config/config.exs b/config/config.exs
index b25afce..17fa92a 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -36,6 +36,20 @@ config :trinity,
           other -> raise "TRINITY_DB must be sqlite or postgres, got #{inspect(other)}"
         end)
 
+# Slice 013 (owner decision, 2026-09-20): the packaged Linux binary runs on Burrito's musl ERTS,
+# in which neither precompiled mdex_native artifact loads (both need glibc's libgcc_s), so the
+# linux package builds that NIF from source for the musl target with Zig as the linker
+# (NOTES.md finding 14). Three settings travel together, all compile time:
+#   MDEX_NATIVE_BUILD=1                                  mdex_native compiles instead of downloading
+#   TRINITY_NIF_TARGET=x86_64-unknown-linux-musl         the cargo target, given to Rustler here
+#   CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=scripts/zig-cc-musl
+# Unset, development and the test gate use the precompiled artifact for the host as before.
+nif_target = System.get_env("TRINITY_NIF_TARGET", "")
+
+if nif_target != "" do
+  config :mdex_native, MDExNative.Native, target: nif_target
+end
+
 # Slice 011: the model registry lives in its own file so the live test suite can read it
 # without evaluating the environment-specific imports below.
 import_config "llm.exs"
diff --git a/config/runtime.exs b/config/runtime.exs
index 6ab086a..267d515 100644
--- a/config/runtime.exs
+++ b/config/runtime.exs
@@ -41,6 +41,35 @@ if config_env() == :dev do
     http: [port: String.to_integer(System.get_env("PORT", "4000"))]
 end
 
+# Slice 013. `TRINITY_FAKE_PROVIDER=1 mix phx.server` runs the chat on the scripted provider:
+# the registry becomes the fake's two entries and a fresh stream answers with its markdown
+# demo, so the UI can be exercised and screenshotted with no key and no egress. Development
+# only; the test registry is config/test.exs and production never reads this variable.
+if config_env() == :dev and System.get_env("TRINITY_FAKE_PROVIDER") in ["1", "true"] do
+  config :trinity, :llm,
+    default_model: "fake:chat",
+    providers: %{fake: Trinity.LLM.Providers.Fake},
+    retry: [attempts: 3, base_ms: 1],
+    models: [
+      %{
+        id: "fake:chat",
+        provider: :fake,
+        model: "chat",
+        caps: [:stream, :tools, :json],
+        price: %{input: 1.0, output: 2.0}
+      },
+      %{
+        id: "fake:slow",
+        provider: :fake,
+        model: "chat",
+        caps: [:stream, :tools, :json],
+        price: %{input: 1.0, output: 2.0}
+      }
+    ]
+
+  config :trinity, Trinity.LLM.Providers.Fake, script: :demo
+end
+
 if config_env() == :dev do
   # Reload browser tabs when matching files change.
   config :trinity, TrinityWeb.Endpoint,
diff --git a/coverage.tsv b/coverage.tsv
index 9dabbb9..b6d204c 100644
--- a/coverage.tsv
+++ b/coverage.tsv
@@ -4,3 +4,4 @@ slice_id	percent	sha	date
 010	44.88	45ba4f0	2026-09-20
 011	51.57	ec5334a	2026-09-20
 012	60.82	019d9cf	2026-09-20
+013	64.41	080c543	2026-09-20
diff --git a/docs/01-architecture.md b/docs/01-architecture.md
index 003d656..64c135a 100644
--- a/docs/01-architecture.md
+++ b/docs/01-architecture.md
@@ -115,6 +115,16 @@ Every state transition is persisted before it is broadcast. A crash between pers
 
 **Effect path (Slice 024):** `Session → Permissions.decide → Effects.execute → Authority → tool.execute/2 (local) or a proposal (external adapter) → Receipts.append`. `Effects` is the only caller of `execute/2` for effectful tools; a census test enforces it. Reads emit query receipts.
 
+**The page (Slice 013):** `TrinityWeb.SessionLive.Show` subscribes to `session:<id>` on mount, calls
+`Trinity.Sessions.ensure_started/1`, loads the history from the database into a LiveView stream and the turn in
+flight from `Trinity.Sessions.state/1` (the state name and the draft text), and drops the delta broadcasts that
+were already queued when that reply arrived, because the reply's text contains them. Completed messages render
+once through `TrinityWeb.Markdown` (mdex); the in-progress text is one assign replaced per coalesced delta. Tool
+rows are written without an event of their own, so the page reads what the database has past its last seen
+`seq` whenever a final or interrupted message arrives. A user message's send goes through `Trinity.Sessions`,
+never to the process directly. The `Trinity.LLM.Providers.Fake` provider lives in `lib/` and runs the chat in
+development under `TRINITY_FAKE_PROVIDER=1`.
+
 ## Storage
 
 - Primary: **SQLite** via `ecto_sqlite3`, single file under the OS data dir, WAL mode, one writer (the Repo pool
@@ -134,7 +144,8 @@ Every state transition is persisted before it is broadcast. A crash between pers
 
 ```
 lib/trinity/                 core contexts (one dir per context)
-lib/trinity_web/             Phoenix
+lib/trinity_web/             Phoenix: live/session_live (the chat, 013), components/chat_components.ex
+                             (the component vocabulary), markdown.ex (the one renderer), plugs/ (the CSP)
 priv/repo/migrations/
 priv/skills/               bundled skills (SKILL.md)
 priv/personas/             default SOUL.md
diff --git a/docs/03-conventions.md b/docs/03-conventions.md
index 8c0f0cc..3e72a78 100644
--- a/docs/03-conventions.md
+++ b/docs/03-conventions.md
@@ -27,6 +27,26 @@
   previous slice fails until a NOTES.md justification names the reason. The rule as originally written stored no
   baseline, so nothing could check it, which is the pattern CLAUDE.md §8 forbids.
 
+## UI (decided at slice 013)
+
+- Tokens live in `assets/css/app.css` and nothing else names a colour, a radius or a font: two daisyUI themes
+  (`dark`, the default; `light`) carry the palette as `base-100/200/300`, `primary` (teal), `secondary` (violet),
+  `accent` (amber) and the four status colours; a Tailwind `@theme` block carries the font stack (`font-sans`,
+  `font-mono`), the two chat text sizes (`text-ui`, `text-meta`) and the radii (`rounded-panel`, `rounded-field`,
+  `rounded-pill`). A later surface uses these classes; it does not add a hex value.
+- The component vocabulary is `TrinityWeb.ChatComponents`: `message`, `tool_card`, `draft`, `composer`,
+  `model_picker`, `status_pill`, `banner`, `local_time`. The approval card (021), memory panel (030), skills list
+  (040), tasks (050), gateways (070), activity and cost (090) and settings (100) extend this module or add a
+  sibling with the same tokens; none restyles a bubble.
+- Every page renders inside `Layouts.app` (a 3 rem top bar with the brand, the page's `:bar` slot and the theme
+  toggle, over a main region that fills the viewport). Times are rendered as UTC by the server and rewritten in
+  the viewer's zone by the `LocalTime` hook.
+- Model output reaches the DOM through `TrinityWeb.Markdown.to_html/2` and no other path; `raw/1` appears once in
+  the tree, there.
+- Every browser response carries the Content-Security-Policy `TrinityWeb.Plugs.ContentSecurityPolicy` sets; an
+  inline script needs the request's nonce (`@csp_nonce`), and there is one, the theme script in the root layout.
+- The chat runs without a key in development: `TRINITY_FAKE_PROVIDER=1 mix phx.server`.
+
 ## Git
 
 - `main` is always green (gate passes) and always releasable.
diff --git a/docs/06-risk-register.md b/docs/06-risk-register.md
index e0e2240..b2b0669 100644
--- a/docs/06-risk-register.md
+++ b/docs/06-risk-register.md
@@ -8,6 +8,7 @@
 | R4 | sqlite_vec extension not loadable inside Burrito bundle | Med | Med | 032 on packaged build | Vendor the extension in `priv/`; fallback Nx brute-force over an ETS cache | 032 |
 | R5 | req_llm breaking changes / provider drift | Med | Med | Live tests fail after bump | Behaviour isolates it; LangChain-Elixir fallback | 011 |
 | R6 | LiveView streaming performance (token spam) | Med | Low | UI lag at > 20 msg/s | Coalescing broadcaster; phoenix_streamdown | 013 |
+| R6 | Closed 2026-09-20 at slice 013: the Session coalesces to at most 20 broadcasts a second (012) and the page renders once per broadcast, measured at 6 renders for 1,000 deltas (013 PROOF.md, AC7). The renderer is `mdex`, not `phoenix_streamdown`, which never left beta (013 NOTES.md). The row above stands as written | none | none | none | none | 013 |
 | R7 | Context compaction loses critical information | Med | High | Eval set regression | Always-on tier preserved verbatim; compaction eval harness in 023 | 023 |
 | R8 | Prompt injection via tool output / skills / web | High | High | none | Untrusted-content framing; scanner on skills; permission gate on side effects; see 07-security-model | 021, 041 |
 | R9 | Oban on SQLite limitations (no Pro workflows) | Low | Med | Need for multi-step durable graphs | Postgres path kept alive in CI matrix | 050 |
@@ -20,4 +21,6 @@
 | R20 | Foundation donation may require transferring assets or marks the project intends to keep | Med | Med | Proposal drafting (122) | Unverified: the requirement is asserted from an announcement, not from the charter text. Read the charter, then decide what is offered and what is retained. Legal review before any proposal leaves the tree | 122 |
 | R21 | The tree carries IP that is not this project's to publish | Med | High | Any design in Trinity that reproduces a third party's protected mechanism | Trinity's receipt and policy design is its own. Policy identifiers stay out of `signed_payload` until legal review clears them; 024's field set is reviewed before that slice starts | 024, 120, 122 |
 | R22 | Single maintainer; Growth needs two unaffiliated production users and commits from two orgs | High | Med | 6-month Sandbox checkpoint | Sandbox tolerates it; GOVERNANCE.md documents intent to grow; recruit co-maintainers via the Elixir community once public | 120, 122 |
+| R24 | A native NIF in the desktop bundle: `mdex_native` (the markdown renderer's Rust core, added at 013) is the first, and slice 001 proved the packaging chain with a pure-BEAM release | Med | Med | The `package` workflow fails on one of its three operating systems after 013, or 100's cross-target build finds no artifact for a target | `rustler_precompiled` ships artifacts for every target the chain builds for (013 NOTES.md, measured against the checksum file); the `package` run on 013's `mix.lock` change is the first proof on three runners; lift condition: that run green on all three, cited in 013's PROOF.md; a fallback is `MDEX_NATIVE_BUILD=1` with the pinned Rust toolchain already in the tree | 013, 100 |
+| R24 | Fired 2026-09-20, in slice 013: neither precompiled `mdex_native` artifact loads in Burrito's musl ERTS (both need glibc's `libgcc_s`; `_dl_find_object: symbol not found`). Lifted the same day by the owner's decision: the linux package builds the NIF from source for musl with Zig as the linker (`scripts/zig-cc-musl`, config/config.exs, `rustler` at build time), measured on a fresh install of the packaged binary rendering the real provider's answer; the `--smoke` path now prints `TRINITY_SMOKE_MARKDOWN=ok` and exits 3 otherwise, and the `package` workflow reads that line on every target, so a dead NIF cannot pass again. Residual: macOS and Windows use the precompiled artifact, and the `package` workflow has yet to run green there since the slice/011 tag (an older failure at "Serves HTTP 200", now diagnosed by the step's log). The row above stands as written | none | none | none | none | 013 |
 | R23 | EMA / ID-JAG is beta everywhere (vendors label it so); IETF draft still moving | Med | Med | Spec revision breaks the exchange | Keep the AS small and behaviour-driven; pin the draft version in the ADR; conformance tests against two IdPs' documented flows | 062 |
diff --git a/docs/packaging.md b/docs/packaging.md
index eabacef..b7063b8 100644
--- a/docs/packaging.md
+++ b/docs/packaging.md
@@ -168,3 +168,29 @@ something it is not.
 A screenshot of a real window on a real desktop does not exist for macOS, Windows or Linux, and
 Slice 001 exits saying so rather than counting those criteria as met.
 
+
+## Native code in the bundle (slice 013)
+
+Burrito's Linux ERTS is a musl build, and every NIF in the bundle has to be one too. Burrito cross-compiles C
+NIFs (exqlite) with Zig by itself; a Rust NIF it does not touch. `mdex_native` (the markdown renderer's core)
+ships precompiled artifacts, and neither the gnu nor the musl one loads in that ERTS: both need glibc's
+`libgcc_s.so.1` (`_dl_find_object: symbol not found`). The linux package therefore builds it from source for
+`x86_64-unknown-linux-musl` with Zig as the linker:
+
+```
+MDEX_NATIVE_BUILD=1 TRINITY_NIF_TARGET=x86_64-unknown-linux-musl \
+CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=$PWD/scripts/zig-cc-musl \
+MIX_ENV=prod BURRITO_TARGET=linux_x86_64 mix release desktop --overwrite
+```
+
+`rust-toolchain.toml` names the musl target so rustup installs its standard library; `rustler` is a build-time
+dependency for this alone. The result needs `libc.so` only (`readelf -d`), the same shape as the exqlite NIF.
+macOS and Windows load the precompiled artifact for their native ERTS. Whether it loaded is not inferred from
+a boot: `--smoke` prints `TRINITY_SMOKE_MARKDOWN=ok` after rendering one line through the NIF and exits 3
+otherwise, and the `package` workflow's smoke step reads that line on every target.
+
+Two things measured on the way (slice 013 NOTES.md, findings 12 to 14): Burrito reuses the payload it
+extracted to `~/.local/share/.burrito/<name>_erts-<v>_<app v>` for as long as the app version stays the same,
+so a local run of a new binary at the same version runs the old code until that directory is removed; and the
+Burrito wrapper starts `erlexec` directly, so `RELEASE_NAME` is unset in the packaged app (the migrator no
+longer keys on it).
diff --git a/lib/trinity.ex b/lib/trinity.ex
index c34e237..ca6f07d 100644
--- a/lib/trinity.ex
+++ b/lib/trinity.ex
@@ -5,12 +5,13 @@ defmodule Trinity do
   # export list is environment-dependent. TrinityWeb.ConnCase crosses the boundary to reach
   # DataCase, and the live-tagged tests reach NetworkGuard. Slice 010 exports Paths (the
   # application locks the data directory before the Repo starts), Repo and UUID (the contexts
-  # use them), and the Sessions sub-boundary: a context TrinityWeb may call (docs/01), which
-  # exports only its API module and keeps Store and the schemas inside.
+  # use them), and the Sessions sub-boundary: a context TrinityWeb may call (docs/01). Slice
+  # 013 exports the schemas the chat renders, `Sessions.Message` and `Sessions.SessionRow`,
+  # which the Sessions boundary exports itself; Store stays inside.
   use Boundary,
     deps: [],
     exports:
-      [Paths, Repo, UUID, Config, Sessions, LLM] ++
+      [Paths, Repo, UUID, Config, Sessions, Sessions.Message, Sessions.SessionRow, LLM] ++
         if(Mix.env() == :test, do: [DataCase, NetworkGuard, Factory], else: [])
 
   @moduledoc """
diff --git a/lib/trinity/application.ex b/lib/trinity/application.ex
index 4f5411b..f12e341 100644
--- a/lib/trinity/application.ex
+++ b/lib/trinity/application.ex
@@ -87,8 +87,12 @@ defmodule Trinity.Application do
     end
   end
 
-  defp skip_migrations? do
-    # By default, sqlite migrations are run when using a release
-    System.get_env("RELEASE_NAME") == nil
-  end
+  # Migrations run at boot everywhere except under Mix, where `mix ecto.migrate` and the test
+  # alias own them. The generator's version keyed on RELEASE_NAME, which the release's own
+  # `bin/desktop` script exports and the Burrito wrapper does not: it starts `erlexec`
+  # directly (deps/burrito/src/erlang_launcher.zig), so the packaged binary never migrated
+  # and every table was missing. Latent since slice 010, seen at slice 013 when `/` first
+  # read a table: package run 35519205973, "no such table: sessions" on all three operating
+  # systems, and the same binary locally answering 200 once RELEASE_NAME was set by hand.
+  defp skip_migrations?, do: Code.ensure_loaded?(Mix)
 end
diff --git a/lib/trinity/data_dir/lock.ex b/lib/trinity/data_dir/lock.ex
index fa6ea89..f977a16 100644
--- a/lib/trinity/data_dir/lock.ex
+++ b/lib/trinity/data_dir/lock.ex
@@ -14,9 +14,12 @@ defmodule Trinity.DataDir.Lock do
 
   The file is created with `:exclusive`, so two boots racing for it cannot both win. It
   carries the holder's OS pid, mode (`desktop` or `headless`), a per-boot token and the time.
-  A file whose pid is no longer alive is stale and is taken over; on platforms where
-  liveness cannot be read this module treats the file as held, so the only way past a
-  dead holder there is removing the file by hand, which is the safe direction.
+  A file whose pid is no longer alive is stale and is taken over. Liveness is read from
+  `/proc` on Linux, `kill -0` on the other Unixes and `tasklist` on Windows (slice 013:
+  slice 010 read it on Linux alone and treated any file as held elsewhere, and the packaged
+  binary's second launch on macOS and Windows then refused to start after a clean first run,
+  package runs 35512430836 through 35522642934). When the check itself fails the file is
+  treated as held, which is the safe direction; the message names the pid to remove by hand.
 
   The lock file is not the database and is never inside a transaction; it says nothing
   about the integrity of the data, only about who may open it.
@@ -163,13 +166,34 @@ defmodule Trinity.DataDir.Lock do
 
   defp token, do: Base.url_encode64(:crypto.strong_rand_bytes(9), padding: false)
 
-  # Liveness of an OS pid. Linux answers through /proc; anywhere else this says "alive", so a
-  # stale file from a crashed holder is refused rather than silently taken over. That is
-  # the safe direction and the message names the pid to remove it by hand.
+  # Liveness of an OS pid. Linux answers through /proc; the other Unixes through `kill -0`
+  # (exit 0: exists; 1: gone, or another user's, which this per-user directory does not
+  # expect); Windows through `tasklist`, which prints the pid on a match and an INFO line
+  # otherwise. A check that cannot run says "alive", so a file is refused rather than taken
+  # over on doubt.
   defp alive?(pid) do
     case :os.type() do
       {:unix, :linux} -> File.dir?("/proc/#{pid}")
-      _ -> true
+      {:unix, _} -> alive_by_kill?(pid)
+      {:win32, _} -> alive_by_tasklist?(pid)
     end
   end
+
+  defp alive_by_kill?(pid) do
+    case System.cmd("kill", ["-0", Integer.to_string(pid)], stderr_to_stdout: true) do
+      {_, 0} -> true
+      {_, _} -> false
+    end
+  rescue
+    _ -> true
+  end
+
+  defp alive_by_tasklist?(pid) do
+    case System.cmd("tasklist", ["/FI", "PID eq #{pid}", "/NH"], stderr_to_stdout: true) do
+      {out, 0} -> String.contains?(out, " #{pid} ")
+      {_, _} -> true
+    end
+  rescue
+    _ -> true
+  end
 end
diff --git a/test/support/fake_provider.ex b/lib/trinity/llm/providers/fake.ex
similarity index 64%
rename from test/support/fake_provider.ex
rename to lib/trinity/llm/providers/fake.ex
index 3e28a28..e1ec41a 100644
--- a/test/support/fake_provider.ex
+++ b/lib/trinity/llm/providers/fake.ex
@@ -2,12 +2,18 @@
 # SPDX-License-Identifier: Apache-2.0
 defmodule Trinity.LLM.Providers.Fake do
   @moduledoc """
-  A scripted provider for tests. Slice 011, extended at 012. The default script streams two
+  A scripted provider. Slice 011, extended at 012 and 013. The default script streams two
   text deltas, one tool call in three chunks, usage and done. A test sets a script (`script/1`)
   or a sequence of scripts consumed one per call with the last repeating (`scripts/1`), or asks
   for `n` failures before success (`fail/2`). State is global (a persistent term), because a
   session's Task is not on the test process's `$callers` chain; tests using this provider are
   not `async: true`, and `clear/0` runs in their setup.
+
+  Since slice 013 it lives in `lib/` rather than `test/support`, because development runs it
+  too: `TRINITY_FAKE_PROVIDER=1` puts it in the dev registry (config/runtime.exs) with the
+  `:demo` script, a markdown answer streamed with short pauses, so the chat can be exercised
+  and screenshotted without a key. The script a fresh stream uses when no test set one comes
+  from `config :trinity, Trinity.LLM.Providers.Fake, script: :demo`; absent, the default above.
   """
   @behaviour Trinity.LLM.Provider
 
@@ -24,6 +30,31 @@ defmodule Trinity.LLM.Providers.Fake do
     {:done, :tool_calls}
   ]
 
+  @demo_text """
+  Hello. I am **Trinity**, running on the scripted provider, so nothing here left the machine.
+
+  Things this answer exercises while it streams:
+
+  - inline `code`, *emphasis* and a [link](https://example.com)
+  - a list that grows one item at a time
+  - a fenced block:
+
+  ```elixir
+  defmodule Trinity.Demo do
+    def answer, do: {:ok, "streamed"}
+  end
+  ```
+
+  | column | value |
+  |---|---|
+  | deltas | many |
+  | patches | few |
+
+  > Raw HTML in the answer is dropped, not rendered: <script>alert(1)</script>
+
+  That is the whole demo.
+  """
+
   @type step :: Trinity.LLM.Event.t() | {:sleep, pos_integer()} | :raise_now
 
   @doc "The events every following stream emits."
@@ -48,15 +79,33 @@ defmodule Trinity.LLM.Providers.Fake do
   @spec calls() :: non_neg_integer()
   def calls, do: :persistent_term.get({__MODULE__, :calls}, 0)
 
-  @doc "Forgets scripts, pending failures and the call count."
+  @doc "The last request a stream call received, or nil. Slice 013's model-switch test reads it."
+  @spec last_request() :: Trinity.LLM.Request.t() | nil
+  def last_request, do: :persistent_term.get({__MODULE__, :last_request}, nil)
+
+  @doc "Forgets scripts, pending failures, the call count and the last request."
   @spec clear() :: :ok
   def clear do
-    for key <- [:scripts, :fail, :calls], do: :persistent_term.erase({__MODULE__, key})
+    for key <- [:scripts, :fail, :calls, :last_request],
+        do: :persistent_term.erase({__MODULE__, key})
+
     :ok
   end
 
+  @doc "The `:demo` script: the markdown answer above, word by word, 30 ms apart."
+  @spec demo_script() :: [step()]
+  def demo_script do
+    words = Regex.split(~r/(?<=\s)/, @demo_text)
+    n = length(words)
+
+    Enum.flat_map(words, &[{:text_delta, &1}, {:sleep, 30}]) ++
+      [{:usage, %{input_tokens: 12, output_tokens: n}}, {:done, :stop}]
+  end
+
   @impl true
-  def stream(_request, _opts, emit) do
+  def stream(request, _opts, emit) do
+    :persistent_term.put({__MODULE__, :last_request}, request)
+
     with :ok <- maybe_fail() do
       events = next_script()
 
@@ -117,12 +166,19 @@ defmodule Trinity.LLM.Providers.Fake do
 
   defp next_script do
     case :persistent_term.get({__MODULE__, :scripts}, nil) do
-      nil -> @default_script
+      nil -> configured_script()
       [only] -> only
       [head | rest] -> (:persistent_term.put({__MODULE__, :scripts}, rest) && head) || head
     end
   end
 
+  defp configured_script do
+    case Application.get_env(:trinity, __MODULE__, [])[:script] do
+      :demo -> demo_script()
+      _ -> @default_script
+    end
+  end
+
   defp maybe_fail do
     :persistent_term.put({__MODULE__, :calls}, calls() + 1)
 
diff --git a/lib/trinity/sessions.ex b/lib/trinity/sessions.ex
index 8119e0a..a238614 100644
--- a/lib/trinity/sessions.ex
+++ b/lib/trinity/sessions.ex
@@ -62,6 +62,50 @@ defmodule Trinity.Sessions do
   @spec archive(SessionRow.t()) :: {:ok, SessionRow.t()} | {:error, Ecto.Changeset.t()}
   def archive(%SessionRow{} = session), do: Store.update_session(session, %{status: "archived"})
 
+  @default_persona_name "default"
+
+  @doc """
+  The persona new sessions belong to: the row named `default`, created on first use with no
+  soul (so the prompt keeps its fallback). Slice 013 adds it so the chat can open a session;
+  slice 030 seeds the SOUL into this same row.
+  """
+  @spec default_persona() :: Persona.t()
+  def default_persona do
+    case Store.get_persona_by_name(@default_persona_name) do
+      nil ->
+        case Store.insert_persona(%{name: @default_persona_name}) do
+          {:ok, persona} -> persona
+          # Two callers raced; the unique index let one through, and it is the row.
+          {:error, _} -> Store.get_persona_by_name(@default_persona_name)
+        end
+
+      persona ->
+        persona
+    end
+  end
+
+  @doc "Sets the session's title (the chat uses the first message's opening line)."
+  @spec set_title(session_id(), String.t()) :: {:ok, SessionRow.t()} | {:error, term()}
+  def set_title(session_id, title) do
+    case Store.get_session(session_id) do
+      nil -> {:error, :no_session}
+      session -> Store.update_session(session, %{title: title})
+    end
+  end
+
+  @doc """
+  Sets the session's model to a registry id, or to nil for the registry default; refuses an id
+  the registry does not know. The running process reads the row at the start of each turn, so
+  the next turn uses it (slice 013, AC6).
+  """
+  @spec set_model(session_id(), String.t() | nil) :: {:ok, SessionRow.t()} | {:error, term()}
+  def set_model(session_id, model) do
+    with {:ok, _entry} <- Trinity.LLM.Registry.lookup(model),
+         %SessionRow{} = session <- Store.get_session(session_id) || {:error, :no_session} do
+      Store.update_session(session, %{model: model})
+    end
+  end
+
   @doc "The number of messages in a session."
   @spec message_count(session_id()) :: non_neg_integer()
   def message_count(session_id), do: Store.message_count(session_id)
diff --git a/lib/trinity/sessions/session.ex b/lib/trinity/sessions/session.ex
index 35a9ae3..118dc56 100644
--- a/lib/trinity/sessions/session.ex
+++ b/lib/trinity/sessions/session.ex
@@ -45,12 +45,17 @@ defmodule Trinity.Sessions.Session do
   @spec cancel_turn(pid() | String.t()) :: :ok | {:error, :idle}
   def cancel_turn(ref), do: :gen_statem.call(target(ref), :cancel)
 
-  @doc "The state name and a redacted view of the data: no grants, approvals or pending calls hide here."
+  @doc """
+  The state name and a redacted view of the data: no grants, approvals or pending calls hide
+  here. `text` is the in-progress assistant text (slice 013 reads it when a page mounts
+  mid-stream); it is empty outside a turn.
+  """
   @spec state(pid() | String.t()) :: %{
           state: atom(),
           pending: [map()],
           turns: non_neg_integer(),
-          draft_id: String.t() | nil
+          draft_id: String.t() | nil,
+          text: String.t()
         }
   def state(ref), do: :gen_statem.call(target(ref), :state)
 
@@ -122,7 +127,8 @@ defmodule Trinity.Sessions.Session do
       state: state,
       pending: (turn && turn.pending) || [],
       turns: (turn && turn.turns) || 0,
-      draft_id: turn && turn.draft_id
+      draft_id: turn && turn.draft_id,
+      text: (turn && turn.text) || ""
     }
 
     {:keep_state_and_data, [{:reply, from, view}]}
@@ -212,7 +218,11 @@ defmodule Trinity.Sessions.Session do
 
   ## The turn
 
-  defp start_model_call(%State{id: id, session: session, task_sup: sup, turn: turn} = data) do
+  # The row is read again at every turn (slice 013): a model set between turns through
+  # `Trinity.Sessions.set_model/2` is the next turn's model, not the next incarnation's.
+  defp start_model_call(%State{id: id, task_sup: sup, turn: turn} = data) do
+    session = Store.get_session(id) || data.session
+    data = %{data | session: session}
     persona = session.persona_id && Store.get_persona(session.persona_id)
     request = Prompt.build(session, persona, Trinity.Sessions.history(id, limit: 500))
     ref = make_ref()
diff --git a/lib/trinity/smoke.ex b/lib/trinity/smoke.ex
index c0ea93c..e9ffc57 100644
--- a/lib/trinity/smoke.ex
+++ b/lib/trinity/smoke.ex
@@ -55,17 +55,37 @@ defmodule Trinity.Smoke do
   @spec port_line(:inet.port_number()) :: String.t()
   def port_line(port), do: "TRINITY_SMOKE_PORT=#{port}"
 
+  @doc """
+  The second line (slice 013): whether the markdown renderer's NIF loaded and rendered in this
+  binary. A packaged build whose NIF fails to load still boots and serves, showing escaped
+  text instead of markdown (NOTES.md finding 13), so booting proves nothing about it; this
+  does. `ok` or `failed:<reason>`, one line, no prose.
+  """
+  @spec markdown_line() :: String.t()
+  def markdown_line do
+    case MDEx.to_html("**smoke**", render: [unsafe: false]) do
+      {:ok, html} ->
+        if html =~ "<strong>smoke</strong>",
+          do: "TRINITY_SMOKE_MARKDOWN=ok",
+          else: "TRINITY_SMOKE_MARKDOWN=failed:#{inspect(html)}"
+
+      {:error, reason} ->
+        "TRINITY_SMOKE_MARKDOWN=failed:#{inspect(reason)}"
+    end
+  end
+
   @doc """
   Runs the smoke check: report the listening port, then stop the OS process.
 
   `say` and `halt` are injected so the whole path is exercisable from a test without ending
   the test runner's own OS process.
   """
-  @spec run(say_fun(), halt_fun()) :: any()
-  def run(say \\ &IO.puts/1, halt \\ &System.halt/1) do
+  @spec run(say_fun(), halt_fun(), String.t()) :: any()
+  def run(say \\ &IO.puts/1, halt \\ &System.halt/1, markdown \\ markdown_line()) do
     {:ok, {_ip, port}} = TrinityWeb.Endpoint.server_info(:http)
     say.(port_line(port))
-    halt.(0)
+    say.(markdown)
+    halt.(if markdown == "TRINITY_SMOKE_MARKDOWN=ok", do: 0, else: 3)
   end
 
   @doc """
@@ -79,8 +99,19 @@ defmodule Trinity.Smoke do
   the VM from within the OTP boot sequence: a boot crash rather than a clean exit. `ps`
   cannot tell those apart from the outside; the exit code can, and AC7 reads both.
   """
+  #
+  # The markdown line is computed here, inside `Trinity.Application.start/2`, not in the Task:
+  # `Kernel.CLI` reads the same plain arguments once the application has started and treats
+  # `--smoke` as a file to run ("No file named --smoke", exit 1), so the Task wins only by
+  # halting at once. Measured at slice 013 when a few milliseconds of rendering inside the
+  # Task lost that race on the first packaged run.
   @spec children([String.t()]) :: [Supervisor.child_spec() | {module(), term()}]
   def children(args) do
-    if requested?(args), do: [{Task, &run/0}], else: []
+    if requested?(args) do
+      markdown = markdown_line()
+      [{Task, fn -> run(&IO.puts/1, &System.halt/1, markdown) end}]
+    else
+      []
+    end
   end
 end
diff --git a/lib/trinity/versions.ex b/lib/trinity/versions.ex
index 8b33972..1c00c9c 100644
--- a/lib/trinity/versions.ex
+++ b/lib/trinity/versions.ex
@@ -255,10 +255,24 @@ defmodule Trinity.Versions do
     },
     %{
       name: "phoenix_streamdown",
-      pin: "**not pinned**",
+      pin: "not used (measured at Slice 013, 2026-09-20)",
       lock: nil,
       note:
-        "Streaming markdown renderer for LiveView. ⚠️ Pre-release, and this file's own rule forbids pinning an `-rc`; a beta is the same category. Verify at Slice 013; fallback: earmark or mdex with chunk buffering."
+        "Streaming markdown renderer for LiveView. Measured at Slice 013: 1.0.0-beta.4 (2026-05-03) was still the latest release with no stable behind it, and this file's own rule forbids a pre-release. It is 801 lines over `mdex`, whose own `streaming: true` option completes fragments; the rest is a rendering rule Slice 013 keeps anyway. The row stays so the decision is visible where a reader would look for the package."
+    },
+    %{
+      name: "mdex",
+      pin: "~> 0.13",
+      lock: "mdex",
+      note:
+        "Markdown renderer for the chat (`TrinityWeb.Markdown`), streaming fragments completed by its `streaming: true` option, raw HTML omitted (`unsafe: false`) and the default sanitizer on top. Added at Slice 013 after the measurement in its NOTES.md: `earmark` 1.4.49 is retired on hex with an open XSS advisory (EEF-CVE-2026-48591), which the gate refuses. ⚠️ A Rust NIF (`mdex_native`): the first in the bundle. Measured at Slice 013 (NOTES finding 13): neither precompiled artifact loads in Burrito's musl ERTS on Linux, so the linux package builds it from source for musl with Zig as the linker (`rustler` below, `scripts/zig-cc-musl`, the three settings in config/config.exs); macOS and Windows load the precompiled artifact. The `--smoke` path prints whether it rendered, and the `package` workflow reads that line on every target."
+    },
+    %{
+      name: "rustler",
+      pin: "~> 0.38",
+      lock: "rustler",
+      note:
+        "Build time only (`runtime: false`): what `rustler_precompiled` needs to compile `mdex_native` from source when `MDEX_NATIVE_BUILD=1`, which the linux package sets (owner decision 2026-09-20, Slice 013 NOTES finding 14). Nothing in the tree calls it."
     }
   ]
 
diff --git a/lib/trinity_web/components/chat_components.ex b/lib/trinity_web/components/chat_components.ex
new file mode 100644
index 0000000..a1a9d75
--- /dev/null
+++ b/lib/trinity_web/components/chat_components.ex
@@ -0,0 +1,358 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+defmodule TrinityWeb.ChatComponents do
+  @moduledoc """
+  The chat's component vocabulary, decided at slice 013 and reused by every later surface:
+  `message` (a bubble with role, time and usage), `tool_card` (name, arguments, status, an
+  expandable result), `draft` (the in-progress assistant message), `composer`, `model_picker`,
+  `status_pill` and `banner`. Tokens come from `assets/css/app.css`; nothing here names a colour
+  outside the theme.
+  """
+  use Phoenix.Component
+  use Gettext, backend: TrinityWeb.Gettext
+
+  import TrinityWeb.CoreComponents, only: [icon: 1]
+
+  alias Phoenix.LiveView.JS
+  alias Trinity.Sessions.Message
+  alias TrinityWeb.Markdown
+
+  @doc "One persisted message. A `tool` row renders as a tool card; the others as bubbles."
+  attr :message, Message, required: true
+  attr :id, :string, required: true
+
+  def message(%{message: %Message{role: "tool"}} = assigns) do
+    ~H"""
+    <div id={@id} class="flex justify-start">
+      <.tool_card
+        name={@message.parts["tool"] || "tool"}
+        status={if @message.parts["ok"], do: :ok, else: :error}
+        result={@message.content}
+      />
+    </div>
+    """
+  end
+
+  def message(assigns) do
+    ~H"""
+    <div id={@id} class={["flex", (@message.role == "user" && "justify-end") || "justify-start"]}>
+      <div class={[
+        "max-w-[min(48rem,90%)] rounded-panel px-4 py-3 text-ui",
+        @message.role == "user" && "bg-primary/15 border border-primary/20",
+        @message.role == "assistant" && "bg-base-100 border border-base-300",
+        @message.role == "system" && "bg-base-300/60 border border-base-300 italic"
+      ]}>
+        <div class="mb-1 flex flex-wrap items-center gap-2 text-meta opacity-70">
+          <span class="font-semibold uppercase tracking-wide">{role_label(@message.role)}</span>
+          <.local_time id={@id <> "-time"} at={@message.inserted_at} />
+          <.usage_badge usage={@message.usage} />
+          <.outcome_label parts={@message.parts} />
+        </div>
+        <div :if={@message.role == "assistant"} class="md">
+          {Markdown.to_html(@message.content)}
+        </div>
+        <div :if={@message.role != "assistant"} class="whitespace-pre-wrap break-words" phx-no-format>{@message.content}</div>
+        <div :if={calls = tool_calls(@message)} class="mt-2 flex flex-col gap-2">
+          <.tool_card
+            :for={call <- calls}
+            name={call["name"]}
+            args={call["args"]}
+            status={:requested}
+          />
+        </div>
+      </div>
+    </div>
+    """
+  end
+
+  @doc "A tool call: its name, an argument summary, a status, and the result behind a disclosure."
+  attr :name, :string, required: true
+  attr :args, :map, default: nil
+  attr :status, :atom, values: [:requested, :running, :ok, :error], required: true
+  attr :result, :string, default: nil
+
+  def tool_card(assigns) do
+    ~H"""
+    <details class="group w-full max-w-[min(48rem,90%)] rounded-field border border-base-300 bg-base-200 text-ui open:bg-base-100">
+      <summary class="flex cursor-pointer list-none items-center gap-2 px-3 py-2">
+        <.icon name="hero-wrench-screwdriver-micro" class="size-4 opacity-70" />
+        <span class="font-mono text-sm">{@name}</span>
+        <span :if={@args} class="truncate font-mono text-meta opacity-60">{args_summary(@args)}</span>
+        <span class="ml-auto flex items-center gap-1 text-meta">
+          <span class={[
+            "size-2 rounded-pill",
+            @status == :requested && "bg-info",
+            @status == :running && "bg-warning animate-pulse",
+            @status == :ok && "bg-success",
+            @status == :error && "bg-error"
+          ]} />
+          {status_label(@status)}
+        </span>
+        <.icon
+          name="hero-chevron-down-micro"
+          class="size-4 opacity-50 transition group-open:rotate-180"
+        />
+      </summary>
+      <div :if={@args && @args != %{}} class="border-t border-base-300 px-3 py-2">
+        <pre class="whitespace-pre-wrap break-words font-mono text-sm">{Jason.encode!(@args, pretty: true)}</pre>
+      </div>
+      <div :if={@result} class="border-t border-base-300 px-3 py-2">
+        <pre class="whitespace-pre-wrap break-words font-mono text-sm">{@result}</pre>
+      </div>
+    </details>
+    """
+  end
+
+  @doc """
+  The assistant message in progress: the text so far rendered with fragment completion, the tool
+  calls this turn has started, and a pulse while nothing has arrived yet.
+  """
+  attr :text, :string, required: true
+  attr :status, :atom, required: true
+  attr :tool_calls, :list, default: []
+
+  def draft(assigns) do
+    ~H"""
+    <div id="draft" class="flex justify-start" data-status={@status}>
+      <div class="max-w-[min(48rem,90%)] rounded-panel border border-base-300 bg-base-100 px-4 py-3 text-ui">
+        <div class="mb-1 flex items-center gap-2 text-meta opacity-70">
+          <span class="font-semibold uppercase tracking-wide">{role_label("assistant")}</span>
+          <.status_pill id="draft-status" status={@status} />
+        </div>
+        <div :if={@text != ""} class="md md-streaming">
+          {Markdown.to_html(@text, streaming: true)}
+        </div>
+        <div
+          :if={@text == "" and @tool_calls == []}
+          class="flex gap-1 py-1"
+          aria-label={gettext("thinking")}
+        >
+          <span class="size-2 animate-bounce rounded-pill bg-primary [animation-delay:0ms]" />
+          <span class="size-2 animate-bounce rounded-pill bg-primary [animation-delay:150ms]" />
+          <span class="size-2 animate-bounce rounded-pill bg-primary [animation-delay:300ms]" />
+        </div>
+        <div :if={@tool_calls != []} class="mt-2 flex flex-col gap-2">
+          <.tool_card :for={call <- @tool_calls} name={call.name} status={:running} />
+        </div>
+      </div>
+    </div>
+    """
+  end
+
+  @doc """
+  The composer: Enter sends, Shift+Enter breaks the line (the `Composer` hook), disabled unless
+  the session is idle. The Cancel button appears while a turn is in flight.
+  """
+  attr :status, :atom, required: true
+  attr :disabled, :boolean, required: true
+
+  def composer(assigns) do
+    ~H"""
+    <form id="composer" phx-submit="send" class="flex items-end gap-2">
+      <textarea
+        id="composer-input"
+        name="content"
+        rows="1"
+        phx-hook="Composer"
+        placeholder={
+          if @disabled,
+            do: gettext("Trinity is working, Esc cancels"),
+            else: gettext("Message Trinity")
+        }
+        disabled={@disabled}
+        autocomplete="off"
+        class="max-h-48 min-h-11 flex-1 resize-none rounded-field border border-base-300 bg-base-100 px-3 py-2.5 text-ui outline-none focus:border-primary disabled:opacity-60"
+      ></textarea>
+      <button
+        :if={not @disabled}
+        type="submit"
+        class="grid size-11 shrink-0 cursor-pointer place-items-center rounded-field bg-primary text-primary-content transition hover:brightness-110"
+        aria-label={gettext("Send")}
+      >
+        <.icon name="hero-paper-airplane-micro" class="size-5" />
+      </button>
+      <button
+        :if={@disabled}
+        type="button"
+        id="cancel"
+        phx-click="cancel"
+        class="flex h-11 shrink-0 cursor-pointer items-center gap-1 rounded-field border border-error/50 px-3 text-ui text-error transition hover:bg-error/10"
+      >
+        <.icon name="hero-stop-micro" class="size-4" /> {gettext("Cancel")}
+      </button>
+    </form>
+    """
+  end
+
+  @doc "The model picker: the registry's ids, the session's current one selected."
+  attr :models, :list, required: true, doc: "registry entries"
+  attr :value, :string, default: nil, doc: "the session's model id, or nil for the default"
+  attr :default, :string, default: nil, doc: "the registry default id"
+
+  def model_picker(assigns) do
+    ~H"""
+    <form id="model-picker" phx-change="set_model" class="contents">
+      <label class="flex items-center gap-1 text-meta opacity-80">
+        <.icon name="hero-cpu-chip-micro" class="size-4" />
+        <select
+          name="model"
+          class="cursor-pointer rounded-field border border-base-300 bg-base-100 px-2 py-1 text-meta"
+          aria-label={gettext("Model")}
+        >
+          <option :for={m <- @models} value={m.id} selected={m.id == (@value || @default)}>
+            {m.id}
+          </option>
+        </select>
+      </label>
+    </form>
+    """
+  end
+
+  @doc "The session's state as a small pill."
+  attr :id, :string, default: "status"
+  attr :status, :atom, required: true
+
+  def status_pill(assigns) do
+    ~H"""
+    <span
+      id={@id}
+      data-status={@status}
+      class={[
+        "inline-flex items-center gap-1 rounded-pill px-2 py-0.5 text-meta",
+        @status == :idle && "bg-base-300",
+        @status in [:thinking, :compacting] && "bg-primary/20 text-primary",
+        @status in [:tool_wait, :approval_wait] && "bg-warning/20 text-warning",
+        @status == :error && "bg-error/20 text-error"
+      ]}
+    >
+      <span class={["size-1.5 rounded-pill bg-current", @status != :idle && "animate-pulse"]} />
+      {status_text(@status)}
+    </span>
+    """
+  end
+
+  @doc "The banner over the composer: an interrupted turn with Retry, or an error."
+  attr :kind, :any, required: true, doc: ":interrupted | {:error, reason} | nil"
+
+  def banner(assigns) do
+    ~H"""
+    <div
+      :if={@kind}
+      id="banner"
+      role="status"
+      class={[
+        "flex items-center gap-3 rounded-field border px-3 py-2 text-ui",
+        @kind == :interrupted && "border-warning/50 bg-warning/10",
+        match?({:error, _}, @kind) && "border-error/50 bg-error/10"
+      ]}
+    >
+      <.icon name="hero-exclamation-triangle-micro" class="size-4 shrink-0" />
+      <span :if={@kind == :interrupted}>
+        {gettext("The last turn was interrupted; what arrived is kept.")}
+      </span>
+      <span :if={match?({:error, _}, @kind)}>
+        {gettext("The turn failed: %{reason}", reason: error_text(@kind))}
+      </span>
+      <button
+        :if={@kind == :interrupted}
+        type="button"
+        phx-click="retry"
+        class="ml-auto cursor-pointer rounded-pill border border-current px-3 py-0.5 text-meta font-semibold hover:bg-base-100"
+      >
+        {gettext("Retry")}
+      </button>
+      <button
+        type="button"
+        phx-click={JS.push("dismiss")}
+        class="cursor-pointer opacity-60 hover:opacity-100"
+        aria-label={gettext("Dismiss")}
+      >
+        <.icon name="hero-x-mark-micro" class="size-4" />
+      </button>
+    </div>
+    """
+  end
+
+  attr :usage, :map, default: nil
+
+  defp usage_badge(assigns) do
+    ~H"""
+    <span
+      :if={@usage && @usage != %{}}
+      class="rounded-pill bg-base-300 px-1.5 font-mono"
+      title={gettext("tokens in / out")}
+    >
+      {@usage["input_tokens"] || 0}/{@usage["output_tokens"] || 0}
+    </span>
+    """
+  end
+
+  attr :parts, :map, required: true
+
+  defp outcome_label(assigns) do
+    ~H"""
+    <span :if={@parts["interrupted"]} class="rounded-pill bg-warning/20 px-1.5 text-warning">
+      {gettext("interrupted")}
+    </span>
+    <span :if={@parts["error"]} class="rounded-pill bg-error/20 px-1.5 text-error">
+      {gettext("error")}
+    </span>
+    <span :if={@parts["cap"]} class="rounded-pill bg-warning/20 px-1.5 text-warning">
+      {gettext("cap: %{cap}", cap: @parts["cap"])}
+    </span>
+    """
+  end
+
+  defp tool_calls(%Message{parts: parts}) do
+    case parts["tool_calls"] do
+      [_ | _] = calls -> calls
+      _ -> nil
+    end
+  end
+
+  defp role_label("user"), do: gettext("you")
+  defp role_label("assistant"), do: gettext("trinity")
+  defp role_label(other), do: other
+
+  defp status_label(:requested), do: gettext("requested")
+  defp status_label(:running), do: gettext("running")
+  defp status_label(:ok), do: gettext("ok")
+  defp status_label(:error), do: gettext("error")
+
+  defp status_text(:idle), do: gettext("idle")
+  defp status_text(:thinking), do: gettext("thinking")
+  defp status_text(:tool_wait), do: gettext("running tools")
+  defp status_text(:approval_wait), do: gettext("waiting for approval")
+  defp status_text(:compacting), do: gettext("compacting")
+  defp status_text(:error), do: gettext("error")
+  defp status_text(other), do: to_string(other)
+
+  defp error_text({:error, reason}) when is_binary(reason), do: reason
+  defp error_text({:error, %{message: message}}) when is_binary(message), do: message
+  defp error_text({:error, reason}), do: inspect(reason)
+
+  defp args_summary(args) when is_map(args) do
+    args
+    |> Enum.map_join(", ", fn {k, v} -> "#{k}: #{inspect(v)}" end)
+    |> String.slice(0, 80)
+  end
+
+  @doc "A time, rendered as UTC and rewritten in the viewer's zone by the LocalTime hook once mounted."
+  attr :id, :string, required: true
+  attr :at, :any, required: true, doc: "a DateTime, or nil for nothing"
+  attr :format, :string, values: ~w(time datetime), default: "time"
+
+  def local_time(assigns) do
+    ~H"""
+    <time
+      :if={@at}
+      id={@id}
+      phx-hook="LocalTime"
+      datetime={DateTime.to_iso8601(@at)}
+      data-format={@format}
+    >
+      {Calendar.strftime(@at, if(@format == "time", do: "%H:%M", else: "%Y-%m-%d %H:%M"))} UTC
+    </time>
+    """
+  end
+end
diff --git a/lib/trinity_web/components/layouts.ex b/lib/trinity_web/components/layouts.ex
index 15697f4..f97b9f8 100644
--- a/lib/trinity_web/components/layouts.ex
+++ b/lib/trinity_web/components/layouts.ex
@@ -14,11 +14,9 @@ defmodule TrinityWeb.Layouts do
   embed_templates "layouts/*"
 
   @doc """
-  Renders your app layout.
-
-  This function is typically invoked from every template,
-  and it often contains your application menu, sidebar,
-  or similar.
+  The application shell: a slim top bar (the brand, a slot for what the page puts beside it,
+  the theme toggle) over a main region that fills the rest of the viewport. Slice 013 decided
+  it; every later surface renders inside it.
 
   ## Examples
 
@@ -34,41 +32,28 @@ defmodule TrinityWeb.Layouts do
     doc: "the current [scope](https://phoenix.hexdocs.pm/scopes.html)"
 
   slot :inner_block, required: true
+  slot :bar, doc: "what the page puts in the top bar, beside the brand"
 
   def app(assigns) do
     ~H"""
-    <header class="navbar px-4 sm:px-6 lg:px-8">
-      <div class="flex-1">
-        <a href="/" class="flex-1 flex w-fit items-center gap-2">
-          <img src={~p"/images/logo.svg"} width="36" />
-          <span class="text-sm font-semibold">v{Application.spec(:phoenix, :vsn)}</span>
-        </a>
-      </div>
-      <div class="flex-none">
-        <ul class="flex flex-column px-1 space-x-4 items-center">
-          <li>
-            <a href="https://phoenixframework.org/" class="btn btn-ghost">Website</a>
-          </li>
-          <li>
-            <a href="https://github.com/phoenixframework/phoenix" class="btn btn-ghost">GitHub</a>
-          </li>
-          <li>
-            <.theme_toggle />
-          </li>
-          <li>
-            <a href="https://phoenix.hexdocs.pm/overview.html" class="btn btn-primary">
-              Get Started <span aria-hidden="true">&rarr;</span>
-            </a>
-          </li>
-        </ul>
-      </div>
-    </header>
-
-    <main class="px-4 py-20 sm:px-6 lg:px-8">
-      <div class="mx-auto max-w-2xl space-y-4">
+    <div class="flex h-dvh flex-col">
+      <header class="flex h-12 shrink-0 items-center gap-3 border-b border-base-300 bg-base-100 px-4">
+        <.link navigate={~p"/"} class="flex items-center gap-2 font-semibold tracking-tight">
+          <span class="grid size-6 place-items-center rounded-pill bg-primary text-primary-content text-meta font-bold">
+            T
+          </span>
+          <span>Trinity</span>
+        </.link>
+        <div class="flex min-w-0 flex-1 items-center gap-3 text-ui">
+          {render_slot(@bar)}
+        </div>
+        <.theme_toggle />
+      </header>
+
+      <main class="min-h-0 flex-1">
         {render_slot(@inner_block)}
-      </div>
-    </main>
+      </main>
+    </div>
 
     <.flash_group flash={@flash} />
     """
diff --git a/lib/trinity_web/components/layouts/root.html.heex b/lib/trinity_web/components/layouts/root.html.heex
index 247c2bf..1228687 100644
--- a/lib/trinity_web/components/layouts/root.html.heex
+++ b/lib/trinity_web/components/layouts/root.html.heex
@@ -4,11 +4,15 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <meta name="csrf-token" content={get_csrf_token()} />
-    <.live_title default="Trinity" suffix=" · Phoenix Framework" phx-no-format>{assigns[:page_title]}</.live_title>
+    <.live_title default="Trinity" suffix=" · Trinity" phx-no-format>{assigns[:page_title]}</.live_title>
     <link phx-track-static rel="stylesheet" href={~p"/assets/css/app.css"} />
     <script defer phx-track-static type="text/javascript" src={~p"/assets/js/app.js"}>
     </script>
-    <script>
+    <%!-- The theme is applied before first paint, so the page never flashes the other theme.
+          The script carries the request's CSP nonce (TrinityWeb.Plugs.ContentSecurityPolicy);
+          without it the policy refuses it. Dark is the default when nothing is stored (slice
+          013); "system", "light" and "dark" remain the three choices of the toggle. --%>
+    <script nonce={assigns[:csp_nonce]}>
       (() => {
         const systemTheme = () => matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light";
 
@@ -24,9 +28,9 @@
           }
         };
         if (!document.documentElement.hasAttribute("data-theme")) {
-          setTheme(localStorage.getItem("phx:theme") || "system");
+          setTheme(localStorage.getItem("phx:theme") || "dark");
         }
-        window.addEventListener("storage", (e) => e.key === "phx:theme" && setTheme(e.newValue || "system"));
+        window.addEventListener("storage", (e) => e.key === "phx:theme" && setTheme(e.newValue || "dark"));
         window.addEventListener("phx:set-theme", (e) => setTheme(e.target.dataset.phxTheme));
 
         matchMedia("(prefers-color-scheme: dark)").addEventListener("change", (e) => {
@@ -37,7 +41,7 @@
       })();
     </script>
   </head>
-  <body>
+  <body class="bg-base-200 text-base-content antialiased">
     <div id="tauri-bridge" phx-hook="TauriHook"></div>
     {@inner_content}
   </body>
diff --git a/lib/trinity_web/controllers/page_controller.ex b/lib/trinity_web/controllers/page_controller.ex
deleted file mode 100644
index 77819b1..0000000
--- a/lib/trinity_web/controllers/page_controller.ex
+++ /dev/null
@@ -1,9 +0,0 @@
-# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
-# SPDX-License-Identifier: Apache-2.0
-defmodule TrinityWeb.PageController do
-  use TrinityWeb, :controller
-
-  def home(conn, _params) do
-    render(conn, :home)
-  end
-end
diff --git a/lib/trinity_web/controllers/page_html.ex b/lib/trinity_web/controllers/page_html.ex
deleted file mode 100644
index 71befc1..0000000
--- a/lib/trinity_web/controllers/page_html.ex
+++ /dev/null
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
-# SPDX-License-Identifier: Apache-2.0
-defmodule TrinityWeb.PageHTML do
-  @moduledoc """
-  This module contains pages rendered by PageController.
-
-  See the `page_html` directory for all templates available.
-  """
-  use TrinityWeb, :html
-
-  embed_templates "page_html/*"
-end
diff --git a/lib/trinity_web/controllers/page_html/home.html.heex b/lib/trinity_web/controllers/page_html/home.html.heex
deleted file mode 100644
index 5a550fd..0000000
--- a/lib/trinity_web/controllers/page_html/home.html.heex
+++ /dev/null
@@ -1,199 +0,0 @@
-<Layouts.flash_group flash={@flash} />
-<div class="left-[40rem] fixed inset-y-0 right-0 z-0 hidden lg:block xl:left-[50rem]">
-  <svg
-    viewBox="0 0 1480 957"
-    fill="none"
-    aria-hidden="true"
-    class="absolute inset-0 h-full w-full"
-    preserveAspectRatio="xMinYMid slice"
-  >
-    <path fill="#EE7868" d="M0 0h1480v957H0z" />
-    <path
-      d="M137.542 466.27c-582.851-48.41-988.806-82.127-1608.412 658.2l67.39 810 3083.15-256.51L1535.94-49.622l-98.36 8.183C1269.29 281.468 734.115 515.799 146.47 467.012l-8.928-.742Z"
-      fill="#FF9F92"
-    />
-    <path
-      d="M371.028 528.664C-169.369 304.988-545.754 149.198-1361.45 665.565l-182.58 792.025 3014.73 694.98 389.42-1689.25-96.18-22.171C1505.28 697.438 924.153 757.586 379.305 532.09l-8.277-3.426Z"
-      fill="#FA8372"
-    />
-    <path
-      d="M359.326 571.714C-104.765 215.795-428.003-32.102-1349.55 255.554l-282.3 1224.596 3047.04 722.01 312.24-1354.467C1411.25 1028.3 834.355 935.995 366.435 577.166l-7.109-5.452Z"
-      fill="#E96856"
-      fill-opacity=".6"
-    />
-    <path
-      d="M1593.87 1236.88c-352.15 92.63-885.498-145.85-1244.602-613.557l-5.455-7.105C-12.347 152.31-260.41-170.8-1225-131.458l-368.63 1599.048 3057.19 704.76 130.31-935.47Z"
-      fill="#C42652"
-      fill-opacity=".2"
-    />
-    <path
-      d="M1411.91 1526.93c-363.79 15.71-834.312-330.6-1085.883-863.909l-3.822-8.102C72.704 125.95-101.074-242.476-1052.01-408.907l-699.85 1484.267 2837.75 1338.01 326.02-886.44Z"
-      fill="#A41C42"
-      fill-opacity=".2"
-    />
-    <path
-      d="M1116.26 1863.69c-355.457-78.98-720.318-535.27-825.287-1115.521l-1.594-8.816C185.286 163.833 112.786-237.016-762.678-643.898L-1822.83 608.665 571.922 2635.55l544.338-771.86Z"
-      fill="#A41C42"
-      fill-opacity=".2"
-    />
-  </svg>
-</div>
-<div class="px-4 py-10 sm:px-6 sm:py-28 lg:px-8 xl:px-28 xl:py-32">
-  <div class="mx-auto max-w-xl lg:mx-0">
-    <svg viewBox="0 0 71 48" class="h-12" aria-hidden="true">
-      <path
-        d="m26.371 33.477-.552-.1c-3.92-.729-6.397-3.1-7.57-6.829-.733-2.324.597-4.035 3.035-4.148 1.995-.092 3.362 1.055 4.57 2.39 1.557 1.72 2.984 3.558 4.514 5.305 2.202 2.515 4.797 4.134 8.347 3.634 3.183-.448 5.958-1.725 8.371-3.828.363-.316.761-.592 1.144-.886l-.241-.284c-2.027.63-4.093.841-6.205.735-3.195-.16-6.24-.828-8.964-2.582-2.486-1.601-4.319-3.746-5.19-6.611-.704-2.315.736-3.934 3.135-3.6.948.133 1.746.56 2.463 1.165.583.493 1.143 1.015 1.738 1.493 2.8 2.25 6.712 2.375 10.265-.068-5.842-.026-9.817-3.24-13.308-7.313-1.366-1.594-2.7-3.216-4.095-4.785-2.698-3.036-5.692-5.71-9.79-6.623C12.8-.623 7.745.14 2.893 2.361 1.926 2.804.997 3.319 0 4.149c.494 0 .763.006 1.032 0 2.446-.064 4.28 1.023 5.602 3.024.962 1.457 1.415 3.104 1.761 4.798.513 2.515.247 5.078.544 7.605.761 6.494 4.08 11.026 10.26 13.346 2.267.852 4.591 1.135 7.172.555ZM10.751 3.852c-.976.246-1.756-.148-2.56-.962 1.377-.343 2.592-.476 3.897-.528-.107.848-.607 1.306-1.336 1.49Zm32.002 37.924c-.085-.626-.62-.901-1.04-1.228-1.857-1.446-4.03-1.958-6.333-2-1.375-.026-2.735-.128-4.031-.61-.595-.22-1.26-.505-1.244-1.272.015-.78.693-1 1.31-1.184.505-.15 1.026-.247 1.6-.382-1.46-.936-2.886-1.065-4.787-.3-2.993 1.202-5.943 1.06-8.926-.017-1.684-.608-3.179-1.563-4.735-2.408l-.043.03a2.96 2.96 0 0 0 .04-.029c-.038-.117-.107-.12-.197-.054l.122.107c1.29 2.115 3.034 3.817 5.004 5.271 3.793 2.8 7.936 4.471 12.784 3.73A66.714 66.714 0 0 1 37 40.877c1.98-.16 3.866.398 5.753.899Zm-9.14-30.345c-.105-.076-.206-.266-.42-.069 1.745 2.36 3.985 4.098 6.683 5.193 4.354 1.767 8.773 2.07 13.293.51 3.51-1.21 6.033-.028 7.343 3.38.19-3.955-2.137-6.837-5.843-7.401-2.084-.318-4.01.373-5.962.94-5.434 1.575-10.485.798-15.094-2.553Zm27.085 15.425c.708.059 1.416.123 2.124.185-1.6-1.405-3.55-1.517-5.523-1.404-3.003.17-5.167 1.903-7.14 3.972-1.739 1.824-3.31 3.87-5.903 4.604.043.078.054.117.066.117.35.005.699.021 1.047.005 3.768-.17 7.317-.965 10.14-3.7.89-.86 1.685-1.817 2.544-2.71.716-.746 1.584-1.159 2.645-1.07Zm-8.753-4.67c-2.812.246-5.254 1.409-7.548 2.943-1.766 1.18-3.654 1.738-5.776 1.37-.374-.066-.75-.114-1.124-.17l-.013.156c.135.07.265.151.405.207.354.14.702.308 1.07.395 4.083.971 7.992.474 11.516-1.803 2.221-1.435 4.521-1.707 7.013-1.336.252.038.503.083.756.107.234.022.479.255.795.003-2.179-1.574-4.526-2.096-7.094-1.872Zm-10.049-9.544c1.475.051 2.943-.142 4.486-1.059-.452.04-.643.04-.827.076-2.126.424-4.033-.04-5.733-1.383-.623-.493-1.257-.974-1.889-1.457-2.503-1.914-5.374-2.555-8.514-2.5.05.154.054.26.108.315 3.417 3.455 7.371 5.836 12.369 6.008Zm24.727 17.731c-2.114-2.097-4.952-2.367-7.578-.537 1.738.078 3.043.632 4.101 1.728.374.388.763.768 1.182 1.106 1.6 1.29 4.311 1.352 5.896.155-1.861-.726-1.861-.726-3.601-2.452Zm-21.058 16.06c-1.858-3.46-4.981-4.24-8.59-4.008a9.667 9.667 0 0 1 2.977 1.39c.84.586 1.547 1.311 2.243 2.055 1.38 1.473 3.534 2.376 4.962 2.07-.656-.412-1.238-.848-1.592-1.507Zm17.29-19.32c0-.023.001-.045.003-.068l-.006.006.006-.006-.036-.004.021.018.012.053Zm-20 14.744a7.61 7.61 0 0 0-.072-.041.127.127 0 0 0 .015.043c.005.008.038 0 .058-.002Zm-.072-.041-.008-.034-.008.01.008-.01-.022-.006.005.026.024.014Z"
-        fill="#FD4F00"
-      />
-    </svg>
-    <div class="mt-10 flex justify-between items-center">
-      <h1 class="flex items-center text-sm font-semibold leading-6">
-        Phoenix Framework
-        <small class="badge badge-warning badge-sm ml-3">
-          v{Application.spec(:phoenix, :vsn)}
-        </small>
-      </h1>
-      <Layouts.theme_toggle />
-    </div>
-
-    <p class="text-[2rem] mt-4 font-semibold leading-10 tracking-tighter text-balance">
-      Peace of mind from prototype to production.
-    </p>
-    <p class="mt-4 leading-7 text-base-content/70">
-      Build rich, interactive web applications quickly, with less code and fewer moving parts. Join our growing community of developers using Phoenix to craft APIs, HTML5 apps and more, for fun or at scale.
-    </p>
-    <div class="flex">
-      <div class="w-full sm:w-auto">
-        <div class="mt-10 grid grid-cols-1 gap-x-6 gap-y-4 sm:grid-cols-3">
-          <a
-            href="https://phoenix.hexdocs.pm/overview.html"
-            class="group relative rounded-box px-6 py-4 text-sm font-semibold leading-6 sm:py-6"
-          >
-            <span class="absolute inset-0 rounded-box bg-base-200 transition group-hover:bg-base-300 sm:group-hover:scale-105"></span>
-            <span class="relative flex items-center gap-4 sm:flex-col">
-              <svg viewBox="0 0 24 24" fill="none" aria-hidden="true" class="h-6 w-6">
-                <path d="m12 4 10-2v18l-10 2V4Z" fill="currentColor" fill-opacity=".15" />
-                <path
-                  d="M12 4 2 2v18l10 2m0-18v18m0-18 10-2v18l-10 2"
-                  stroke="currentColor"
-                  stroke-width="2"
-                  stroke-linecap="round"
-                  stroke-linejoin="round"
-                />
-              </svg>
-              Guides &amp; Docs
-            </span>
-          </a>
-          <a
-            href="https://github.com/phoenixframework/phoenix"
-            class="group relative rounded-box px-6 py-4 text-sm font-semibold leading-6 sm:py-6"
-          >
-            <span class="absolute inset-0 rounded-box bg-base-200 transition group-hover:bg-base-300 sm:group-hover:scale-105"></span>
-            <span class="relative flex items-center gap-4 sm:flex-col">
-              <svg viewBox="0 0 24 24" aria-hidden="true" class="h-6 w-6">
-                <path
-                  fill="currentColor"
-                  fill-rule="evenodd"
-                  clip-rule="evenodd"
-                  d="M12 0C5.37 0 0 5.506 0 12.303c0 5.445 3.435 10.043 8.205 11.674.6.107.825-.262.825-.585 0-.292-.015-1.261-.015-2.291C6 21.67 5.22 20.346 4.98 19.654c-.135-.354-.72-1.446-1.23-1.738-.42-.23-1.02-.8-.015-.815.945-.015 1.62.892 1.845 1.261 1.08 1.86 2.805 1.338 3.495 1.015.105-.8.42-1.338.765-1.645-2.67-.308-5.46-1.37-5.46-6.075 0-1.338.465-2.446 1.23-3.307-.12-.308-.54-1.569.12-3.26 0 0 1.005-.323 3.3 1.26.96-.276 1.98-.415 3-.415s2.04.139 3 .416c2.295-1.6 3.3-1.261 3.3-1.261.66 1.691.24 2.952.12 3.26.765.861 1.23 1.953 1.23 3.307 0 4.721-2.805 5.767-5.475 6.075.435.384.81 1.122.81 2.276 0 1.645-.015 2.968-.015 3.383 0 .323.225.707.825.585a12.047 12.047 0 0 0 5.919-4.489A12.536 12.536 0 0 0 24 12.304C24 5.505 18.63 0 12 0Z"
-                />
-              </svg>
-              Source Code
-            </span>
-          </a>
-          <a
-            href={"https://github.com/phoenixframework/phoenix/blob/v#{Application.spec(:phoenix, :vsn)}/CHANGELOG.md"}
-            class="group relative rounded-box px-6 py-4 text-sm font-semibold leading-6 sm:py-6"
-          >
-            <span class="absolute inset-0 rounded-box bg-base-200 transition group-hover:bg-base-300 sm:group-hover:scale-105"></span>
-            <span class="relative flex items-center gap-4 sm:flex-col">
-              <svg viewBox="0 0 24 24" fill="none" aria-hidden="true" class="h-6 w-6">
-                <path
-                  d="M12 1v6M12 17v6"
-                  stroke="currentColor"
-                  stroke-width="2"
-                  stroke-linecap="round"
-                  stroke-linejoin="round"
-                />
-                <circle
-                  cx="12"
-                  cy="12"
-                  r="4"
-                  fill="currentColor"
-                  fill-opacity=".15"
-                  stroke="currentColor"
-                  stroke-width="2"
-                  stroke-linecap="round"
-                  stroke-linejoin="round"
-                />
-              </svg>
-              Changelog
-            </span>
-          </a>
-        </div>
-        <div class="mt-10 grid grid-cols-1 gap-y-4 text-sm leading-6 text-base-content/80 sm:grid-cols-2">
-          <div>
-            <a
-              href="https://elixirforum.com"
-              class="group -mx-2 -my-0.5 inline-flex items-center gap-3 rounded-lg px-2 py-0.5 hover:bg-base-200 hover:text-base-content"
-            >
-              <svg
-                viewBox="0 0 16 16"
-                aria-hidden="true"
-                class="h-4 w-4 fill-base-content/40 group-hover:fill-base-content"
-              >
-                <path d="M8 13.833c3.866 0 7-2.873 7-6.416C15 3.873 11.866 1 8 1S1 3.873 1 7.417c0 1.081.292 2.1.808 2.995.606 1.05.806 2.399.086 3.375l-.208.283c-.285.386-.01.905.465.85.852-.098 2.048-.318 3.137-.81a3.717 3.717 0 0 1 1.91-.318c.263.027.53.041.802.041Z" />
-              </svg>
-              Discuss on the Elixir Forum
-            </a>
-          </div>
-          <div>
-            <a
-              href="https://discord.gg/elixir"
-              class="group -mx-2 -my-0.5 inline-flex items-center gap-3 rounded-lg px-2 py-0.5 hover:bg-base-200 hover:text-base-content"
-            >
-              <svg
-                viewBox="0 0 16 16"
-                aria-hidden="true"
-                class="h-4 w-4 fill-base-content/40 group-hover:fill-base-content"
-              >
-                <path d="M13.545 2.995c-1.02-.46-2.114-.8-3.257-.994a.05.05 0 0 0-.052.024c-.141.246-.297.567-.406.82a12.377 12.377 0 0 0-3.658 0 8.238 8.238 0 0 0-.412-.82.052.052 0 0 0-.052-.024 13.315 13.315 0 0 0-3.257.994.046.046 0 0 0-.021.018C.356 6.063-.213 9.036.066 11.973c.001.015.01.029.02.038a13.353 13.353 0 0 0 3.996 1.987.052.052 0 0 0 .056-.018c.308-.414.582-.85.818-1.309a.05.05 0 0 0-.028-.069 8.808 8.808 0 0 1-1.248-.585.05.05 0 0 1-.005-.084c.084-.062.168-.126.248-.191a.05.05 0 0 1 .051-.007c2.619 1.176 5.454 1.176 8.041 0a.05.05 0 0 1 .053.006c.08.065.164.13.248.192a.05.05 0 0 1-.004.084c-.399.23-.813.423-1.249.585a.05.05 0 0 0-.027.07c.24.457.514.893.817 1.307a.051.051 0 0 0 .056.019 13.31 13.31 0 0 0 4.001-1.987.05.05 0 0 0 .021-.037c.334-3.396-.559-6.345-2.365-8.96a.04.04 0 0 0-.021-.02Zm-8.198 7.19c-.789 0-1.438-.712-1.438-1.587 0-.874.637-1.586 1.438-1.586.807 0 1.45.718 1.438 1.586 0 .875-.637 1.587-1.438 1.587Zm5.316 0c-.788 0-1.438-.712-1.438-1.587 0-.874.637-1.586 1.438-1.586.807 0 1.45.718 1.438 1.586 0 .875-.63 1.587-1.438 1.587Z" />
-              </svg>
-              Join our Discord server
-            </a>
-          </div>
-          <div>
-            <a
-              href="https://elixir-slack.community/"
-              class="group -mx-2 -my-0.5 inline-flex items-center gap-3 rounded-lg px-2 py-0.5 hover:bg-base-200 hover:text-base-content"
-            >
-              <svg
-                viewBox="0 0 16 16"
-                aria-hidden="true"
-                class="h-4 w-4 fill-base-content/40 group-hover:fill-base-content"
-              >
-                <path d="M3.361 10.11a1.68 1.68 0 1 1-1.68-1.681h1.68v1.682ZM4.209 10.11a1.68 1.68 0 1 1 3.361 0v4.21a1.68 1.68 0 1 1-3.361 0v-4.21ZM5.89 3.361a1.68 1.68 0 1 1 1.681-1.68v1.68H5.89ZM5.89 4.209a1.68 1.68 0 1 1 0 3.361H1.68a1.68 1.68 0 1 1 0-3.361h4.21ZM12.639 5.89a1.68 1.68 0 1 1 1.68 1.681h-1.68V5.89ZM11.791 5.89a1.68 1.68 0 1 1-3.361 0V1.68a1.68 1.68 0 0 1 3.361 0v4.21ZM10.11 12.639a1.68 1.68 0 1 1-1.681 1.68v-1.68h1.682ZM10.11 11.791a1.68 1.68 0 1 1 0-3.361h4.21a1.68 1.68 0 1 1 0 3.361h-4.21Z" />
-              </svg>
-              Join us on Slack
-            </a>
-          </div>
-          <div>
-            <a
-              href="https://fly.io/docs/elixir/getting-started/"
-              class="group -mx-2 -my-0.5 inline-flex items-center gap-3 rounded-lg px-2 py-0.5 hover:bg-base-200 hover:text-base-content"
-            >
-              <svg
-                viewBox="0 0 20 20"
-                aria-hidden="true"
-                class="h-4 w-4 fill-base-content/40 group-hover:fill-base-content"
-              >
-                <path d="M1 12.5A4.5 4.5 0 005.5 17H15a4 4 0 001.866-7.539 3.504 3.504 0 00-4.504-4.272A4.5 4.5 0 004.06 8.235 4.502 4.502 0 001 12.5z" />
-              </svg>
-              Deploy your application
-            </a>
-          </div>
-        </div>
-      </div>
-    </div>
-  </div>
-</div>
diff --git a/lib/trinity_web/live/session_live/index.ex b/lib/trinity_web/live/session_live/index.ex
new file mode 100644
index 0000000..aeb0b58
--- /dev/null
+++ b/lib/trinity_web/live/session_live/index.ex
@@ -0,0 +1,91 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+defmodule TrinityWeb.SessionLive.Index do
+  @moduledoc """
+  The sessions index at `/`: every session, most recently active first, and New session. Slice
+  013. A new session is a row on the default persona; the chat itself is `SessionLive.Show`.
+  """
+  use TrinityWeb, :live_view
+
+  import TrinityWeb.ChatComponents, only: [local_time: 1]
+
+  alias Trinity.Sessions
+
+  @impl true
+  def mount(_params, _session, socket) do
+    {:ok,
+     socket
+     |> assign(page_title: gettext("Sessions"))
+     |> stream(:sessions, Sessions.list_sessions(limit: 100))}
+  end
+
+  @impl true
+  def handle_event("new_session", _params, socket), do: {:noreply, new_session(socket)}
+  def handle_event("cancel", _params, socket), do: {:noreply, socket}
+
+  @impl true
+  def render(assigns) do
+    ~H"""
+    <Layouts.app flash={@flash}>
+      <:bar>
+        <span class="opacity-70">{gettext("Sessions")}</span>
+      </:bar>
+      <div
+        id="index"
+        phx-hook="Shortcuts"
+        class="mx-auto flex h-full max-w-3xl flex-col gap-4 px-4 py-6"
+      >
+        <div class="flex items-center justify-between">
+          <h1 class="text-lg font-semibold">{gettext("Sessions")}</h1>
+          <button
+            id="new-session"
+            type="button"
+            phx-click="new_session"
+            class="flex cursor-pointer items-center gap-1.5 rounded-field bg-primary px-3 py-2 text-ui font-semibold text-primary-content transition hover:brightness-110"
+          >
+            <.icon name="hero-plus-micro" class="size-4" /> {gettext("New session")}
+            <kbd class="ml-1 rounded-pill bg-primary-content/20 px-1.5 font-mono text-meta">⌘K</kbd>
+          </button>
+        </div>
+        <div id="sessions" phx-update="stream" class="flex flex-col gap-2">
+          <p
+            id="sessions-empty"
+            class="hidden only:block rounded-panel border border-dashed border-base-300 p-8 text-center opacity-70"
+          >
+            {gettext("No sessions yet. Start one with New session or Ctrl/Cmd+K.")}
+          </p>
+          <.link
+            :for={{dom_id, session} <- @streams.sessions}
+            id={dom_id}
+            navigate={~p"/s/#{session.id}"}
+            class="flex items-center gap-3 rounded-panel border border-base-300 bg-base-100 px-4 py-3 transition hover:border-primary"
+          >
+            <.icon name="hero-chat-bubble-left-right-micro" class="size-5 opacity-60" />
+            <span class="min-w-0 flex-1 truncate text-ui">{session.title ||
+              gettext("Untitled session")}</span>
+            <span class="font-mono text-meta opacity-60">{session.model || gettext("default model")}</span>
+            <span class="text-meta opacity-60">
+              <.local_time
+                id={dom_id <> "-time"}
+                at={session.last_activity_at || session.inserted_at}
+                format="datetime"
+              />
+            </span>
+          </.link>
+        </div>
+      </div>
+    </Layouts.app>
+    """
+  end
+
+  @doc false
+  @spec new_session(Phoenix.LiveView.Socket.t()) :: Phoenix.LiveView.Socket.t()
+  def new_session(socket) do
+    persona = Sessions.default_persona()
+
+    case Sessions.create_session(%{persona_id: persona.id, origin: "desktop"}) do
+      {:ok, session} -> push_navigate(socket, to: ~p"/s/#{session.id}")
+      {:error, _} -> put_flash(socket, :error, gettext("The session could not be created."))
+    end
+  end
+end
diff --git a/lib/trinity_web/live/session_live/show.ex b/lib/trinity_web/live/session_live/show.ex
new file mode 100644
index 0000000..c28fc25
--- /dev/null
+++ b/lib/trinity_web/live/session_live/show.ex
@@ -0,0 +1,271 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+defmodule TrinityWeb.SessionLive.Show do
+  @moduledoc """
+  The chat at `/s/:id`. Slice 013.
+
+  On a connected mount the view subscribes to the session's events, starts (or finds) its
+  process, loads the history from the database into a stream and the turn in flight from the
+  process (`Trinity.Sessions.state/1`: the state name and the draft text). Delta messages that
+  were already queued when that reply arrived are dropped, because the reply's text contains
+  them: the Session sends both, in order. That is what makes a remount mid-stream show neither
+  a gap nor a duplicate (AC5).
+
+  Assigns stay bounded: completed messages live in the `:messages` stream and are rendered
+  once; the in-progress text is one assign replaced on every coalesced delta and cleared when
+  the final message arrives; the Session already limits deltas to twenty broadcasts a second,
+  so the view renders at most that often (AC7).
+  """
+  use TrinityWeb, :live_view
+
+  import TrinityWeb.ChatComponents
+
+  alias Trinity.LLM
+  alias Trinity.Sessions
+  alias Trinity.Sessions.Message
+
+  @history_limit 500
+
+  @impl true
+  def mount(%{"id" => id}, _session, socket) do
+    case Sessions.get_session(id) do
+      nil ->
+        {:ok,
+         socket
+         |> put_flash(:error, gettext("No such session."))
+         |> push_navigate(to: ~p"/")}
+
+      session ->
+        socket =
+          socket
+          |> assign(
+            session: session,
+            page_title: session.title || gettext("Chat"),
+            status: :idle,
+            draft: "",
+            tool_calls: [],
+            banner: nil,
+            last_seq: 0,
+            last_user_message: nil,
+            models: LLM.models(),
+            default_model: LLM.default_model()
+          )
+          |> stream_configure(:messages, dom_id: &"message-#{&1.id}")
+          |> stream(:messages, [])
+
+        {:ok, if(connected?(socket), do: connect(socket), else: socket)}
+    end
+  end
+
+  # Subscribe first, then start, then read the turn in flight; last, drop the deltas the
+  # state reply already contains.
+  defp connect(%{assigns: %{session: session}} = socket) do
+    id = session.id
+    :ok = Sessions.subscribe(id)
+
+    {status, text} =
+      case Sessions.ensure_started(id) do
+        {:ok, _pid} ->
+          case Sessions.state(id) do
+            %{state: state, text: text} -> {state, text}
+            {:error, _} -> {:idle, ""}
+          end
+
+        {:error, _} ->
+          {:idle, ""}
+      end
+
+    drain_deltas(id)
+    rows = Sessions.history(id, limit: @history_limit)
+    # A row still flagged draft belongs to the turn in flight: its text is what state/1 gave,
+    # and its final form arrives as an event under the same id. Nothing else carries the flag:
+    # the rehydrate marks a leftover draft interrupted before ensure_started/1 returns.
+    done = Enum.reject(rows, &(&1.parts["draft"] == true))
+    last_seq = rows |> Enum.map(& &1.seq) |> Enum.max(fn -> 0 end)
+
+    socket
+    |> assign(status: status, draft: text, last_seq: last_seq)
+    |> assign(
+      last_user_message: done |> Enum.filter(&(&1.role == "user")) |> List.last() |> content()
+    )
+    |> stream(:messages, done)
+  end
+
+  defp drain_deltas(id) do
+    receive do
+      {:session, ^id, {:assistant_delta, _}} -> drain_deltas(id)
+    after
+      0 -> :ok
+    end
+  end
+
+  defp content(nil), do: nil
+  defp content(%Message{content: content}), do: content
+
+  ## Events from the page
+
+  @impl true
+  def handle_event("send", %{"content" => content}, socket) do
+    content = String.trim(content)
+
+    if content == "" do
+      {:noreply, socket}
+    else
+      send_message(socket, content)
+    end
+  end
+
+  def handle_event("cancel", _params, socket) do
+    _ = Sessions.cancel_turn(socket.assigns.session.id)
+    {:noreply, socket}
+  end
+
+  def handle_event("retry", _params, %{assigns: %{last_user_message: nil}} = socket),
+    do: {:noreply, assign(socket, banner: nil)}
+
+  def handle_event("retry", _params, %{assigns: %{last_user_message: content}} = socket),
+    do: send_message(socket, content)
+
+  def handle_event("dismiss", _params, socket), do: {:noreply, assign(socket, banner: nil)}
+
+  def handle_event("set_model", %{"model" => model}, socket) do
+    case Sessions.set_model(socket.assigns.session.id, model) do
+      {:ok, session} ->
+        {:noreply, assign(socket, session: session)}
+
+      {:error, reason} ->
+        {:noreply,
+         put_flash(socket, :error, gettext("Model not set: %{reason}", reason: inspect(reason)))}
+    end
+  end
+
+  def handle_event("new_session", _params, socket),
+    do: {:noreply, TrinityWeb.SessionLive.Index.new_session(socket)}
+
+  defp send_message(socket, content) do
+    id = socket.assigns.session.id
+
+    case Sessions.send_user_message(id, content) do
+      {:ok, _message} ->
+        socket = if socket.assigns.session.title, do: socket, else: title(socket, content)
+
+        {:noreply,
+         socket
+         |> assign(banner: nil, last_user_message: content)
+         |> push_event("composer:clear", %{})}
+
+      {:error, {:busy, state}} ->
+        {:noreply,
+         put_flash(socket, :error, gettext("Trinity is busy (%{state}).", state: state))}
+
+      {:error, reason} ->
+        {:noreply,
+         put_flash(socket, :error, gettext("Not sent: %{reason}", reason: inspect(reason)))}
+    end
+  end
+
+  defp title(socket, content) do
+    case Sessions.set_title(socket.assigns.session.id, String.slice(content, 0, 60)) do
+      {:ok, session} -> assign(socket, session: session, page_title: session.title)
+      {:error, _} -> socket
+    end
+  end
+
+  ## Events from the Session
+
+  @impl true
+  def handle_info({:session, id, event}, %{assigns: %{session: %{id: id}}} = socket) do
+    {:noreply, apply_event(event, socket)}
+  end
+
+  def handle_info(_other, socket), do: {:noreply, socket}
+
+  defp apply_event({:user_message, %Message{} = m}, socket) do
+    socket
+    |> insert(m)
+    |> assign(last_user_message: m.content, banner: nil)
+  end
+
+  defp apply_event({:assistant_delta, text}, %{assigns: %{draft: draft}} = socket) do
+    assign(socket, draft: draft <> text)
+  end
+
+  # The final row replaces the draft. Tool rows are written without an event of their own,
+  # so anything the database has past the last seen seq comes along here.
+  defp apply_event({:assistant_message, %Message{} = m}, socket) do
+    socket
+    |> catch_up()
+    |> insert(m)
+    |> assign(draft: "", tool_calls: [])
+  end
+
+  defp apply_event({:turn_interrupted, %Message{} = m}, socket) do
+    socket
+    |> catch_up()
+    |> insert(m)
+    |> assign(draft: "", tool_calls: [], banner: :interrupted)
+  end
+
+  defp apply_event(
+         {:tool_call, %{id: _, name: _} = call},
+         %{assigns: %{tool_calls: calls}} = socket
+       ),
+       do: assign(socket, tool_calls: calls ++ [call])
+
+  defp apply_event({:state, state}, socket) do
+    socket = assign(socket, status: state)
+    if state == :idle, do: assign(socket, draft: "", tool_calls: []), else: socket
+  end
+
+  defp apply_event({:error, reason}, socket), do: assign(socket, banner: {:error, reason})
+  defp apply_event(_other, socket), do: socket
+
+  defp insert(socket, %Message{} = m) do
+    socket
+    |> stream_insert(:messages, m)
+    |> assign(last_seq: max(socket.assigns.last_seq, m.seq))
+  end
+
+  defp catch_up(%{assigns: %{session: session, last_seq: last_seq}} = socket) do
+    session.id
+    |> Sessions.history(offset: last_seq, limit: @history_limit)
+    |> Enum.reject(&(&1.parts["draft"] == true))
+    |> Enum.reduce(socket, &insert(&2, &1))
+  end
+
+  ## The page
+
+  @impl true
+  def render(assigns) do
+    ~H"""
+    <Layouts.app flash={@flash}>
+      <:bar>
+        <span class="min-w-0 truncate">{@session.title || gettext("Untitled session")}</span>
+        <.status_pill status={@status} />
+        <.model_picker models={@models} value={@session.model} default={@default_model} />
+      </:bar>
+      <div id="chat" phx-hook="Shortcuts" class="mx-auto flex h-full max-w-4xl flex-col">
+        <div
+          id="scroll"
+          phx-hook="ScrollToBottom"
+          class="flex min-h-0 flex-1 flex-col gap-3 overflow-y-auto px-4 py-4"
+        >
+          <div id="messages" phx-update="stream" class="flex flex-col gap-3">
+            <.message :for={{dom_id, message} <- @streams.messages} id={dom_id} message={message} />
+          </div>
+          <.draft
+            :if={@status != :idle or @draft != ""}
+            text={@draft}
+            status={@status}
+            tool_calls={@tool_calls}
+          />
+        </div>
+        <div class="flex flex-col gap-2 border-t border-base-300 bg-base-100/60 px-4 py-3">
+          <.banner kind={@banner} />
+          <.composer status={@status} disabled={@status != :idle} />
+        </div>
+      </div>
+    </Layouts.app>
+    """
+  end
+end
diff --git a/lib/trinity_web/markdown.ex b/lib/trinity_web/markdown.ex
new file mode 100644
index 0000000..3960c80
--- /dev/null
+++ b/lib/trinity_web/markdown.ex
@@ -0,0 +1,57 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+defmodule TrinityWeb.Markdown do
+  @moduledoc """
+  Model output to HTML, and the only place it happens. Slice 013.
+
+  `mdex` renders with raw HTML omitted (`unsafe: false`) and its default sanitizer on top, so a
+  `<script>` in an answer is dropped and a `javascript:` href emptied; the measurement that chose
+  it over the alternatives is in the slice's NOTES.md. With `streaming: true` an unfinished
+  fragment (`**bold te`, an open fence) is completed before rendering, which is what the
+  in-progress message uses; a finished message renders without it, once.
+  """
+
+  require Logger
+
+  # Sobelow reads `@sobelow_skip` from the source; the compiler would call it unused (the same
+  # measure `Trinity.Paths` takes, slice 001 line 4).
+  Module.register_attribute(__MODULE__, :sobelow_skip, persist: true)
+
+  @extension [strikethrough: true, table: true, autolink: true, tasklist: true]
+
+  @doc """
+  The HTML for a markdown string, safe to mark raw. `streaming: true` completes an unfinished
+  fragment first.
+  """
+  # sobelow_skip reason: XSS.Raw fires on every `raw/1`, low confidence. This is the one call
+  # in the tree, on HTML the renderer produced with raw input HTML omitted and the sanitizer
+  # applied, and `TrinityWeb.MarkdownTest` asserts a script tag and a javascript: href do not
+  # survive. Scoped to the function rather than .sobelow-skips, which keys on file and line.
+  @sobelow_skip ["XSS.Raw"]
+  @spec to_html(String.t(), keyword()) :: Phoenix.HTML.safe()
+  def to_html(markdown, opts \\ []) when is_binary(markdown) do
+    options = [
+      extension: @extension,
+      render: [unsafe: false],
+      sanitize: MDEx.Document.default_sanitize_options(),
+      streaming: Keyword.get(opts, :streaming, false)
+    ]
+
+    case MDEx.to_html(markdown, options) do
+      {:ok, html} ->
+        Phoenix.HTML.raw(html)
+
+      # A failure is the renderer's, not the text's: show the text escaped rather than nothing,
+      # so a message is never blank on screen, and say so once at :error, because the one
+      # failure seen so far was a NIF that did not load in a packaged binary (NOTES finding
+      # 13), which must never pass for a rendering choice.
+      {:error, reason} ->
+        unless :persistent_term.get({__MODULE__, :failed}, false) do
+          :persistent_term.put({__MODULE__, :failed}, true)
+          Logger.error("markdown renderer failed; showing escaped text: #{inspect(reason)}")
+        end
+
+        Phoenix.HTML.html_escape(markdown)
+    end
+  end
+end
diff --git a/lib/trinity_web/plugs/content_security_policy.ex b/lib/trinity_web/plugs/content_security_policy.ex
new file mode 100644
index 0000000..b2bef5e
--- /dev/null
+++ b/lib/trinity_web/plugs/content_security_policy.ex
@@ -0,0 +1,50 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+defmodule TrinityWeb.Plugs.ContentSecurityPolicy do
+  @moduledoc """
+  A Content-Security-Policy for every browser response, with a nonce per request. Slice 013;
+  the slice-000 sobelow skip named this slice as its owner because a policy written before the
+  UI it protects is a guess.
+
+  Scripts run only from this origin or with the request's nonce, which the root layout's theme
+  script carries (`@csp_nonce`) and the LiveDashboard reads (`csp_nonce_assign_key`). Styles,
+  images, fonts and connections are this origin only, plus `data:` images for inline SVG.
+  Nothing may frame the page. The header is set before `put_secure_browser_headers`, which
+  keeps a policy that is already present.
+  """
+  @behaviour Plug
+
+  import Plug.Conn
+
+  @impl true
+  def init(opts), do: opts
+
+  @impl true
+  def call(conn, _opts) do
+    nonce = 18 |> :crypto.strong_rand_bytes() |> Base.url_encode64(padding: false)
+
+    conn
+    |> assign(:csp_nonce, nonce)
+    |> put_resp_header("content-security-policy", policy(nonce))
+  end
+
+  @doc "The policy string for a nonce."
+  @spec policy(String.t()) :: String.t()
+  def policy(nonce) do
+    Enum.join(
+      [
+        "default-src 'self'",
+        "script-src 'self' 'nonce-#{nonce}'",
+        "style-src 'self'",
+        "img-src 'self' data:",
+        "font-src 'self'",
+        "connect-src 'self'",
+        "frame-ancestors 'none'",
+        "base-uri 'self'",
+        "form-action 'self'",
+        "object-src 'none'"
+      ],
+      "; "
+    )
+  end
+end
diff --git a/lib/trinity_web/router.ex b/lib/trinity_web/router.ex
index 0d4f6aa..6e7cf67 100644
--- a/lib/trinity_web/router.ex
+++ b/lib/trinity_web/router.ex
@@ -9,6 +9,8 @@ defmodule TrinityWeb.Router do
     plug :fetch_live_flash
     plug :put_root_layout, html: {TrinityWeb.Layouts, :root}
     plug :protect_from_forgery
+    # Slice 013: before put_secure_browser_headers, which keeps a policy already present.
+    plug TrinityWeb.Plugs.ContentSecurityPolicy
     plug :put_secure_browser_headers
   end
 
@@ -16,10 +18,14 @@ defmodule TrinityWeb.Router do
     plug :accepts, ["json"]
   end
 
+  # Slice 013: the chat. One local user, so no scope is fetched; the session id is the URL.
   scope "/", TrinityWeb do
     pipe_through :browser
 
-    get "/", PageController, :home
+    live_session :chat do
+      live "/", SessionLive.Index, :index
+      live "/s/:id", SessionLive.Show, :show
+    end
   end
 
   # Other scopes may use custom stacks.
@@ -39,7 +45,7 @@ defmodule TrinityWeb.Router do
     scope "/dev" do
       pipe_through :browser
 
-      live_dashboard "/dashboard", metrics: TrinityWeb.Telemetry
+      live_dashboard "/dashboard", metrics: TrinityWeb.Telemetry, csp_nonce_assign_key: :csp_nonce
     end
   end
 end
diff --git a/mix.exs b/mix.exs
index 6705a33..d3dbc16 100644
--- a/mix.exs
+++ b/mix.exs
@@ -100,6 +100,14 @@ defmodule Trinity.MixProject do
       # Slice 011: the provider layer behind Trinity.LLM (docs/adr/0003). What it brings into
       # mix.lock is counted in the slice's NOTES.md, because the desktop binary carries it.
       {:req_llm, "~> 1.22"},
+      # Slice 013: the chat's markdown renderer, behind TrinityWeb.Markdown. Chosen by the
+      # measurement in the slice's NOTES.md; it brings a Rust NIF (mdex_native), precompiled.
+      {:mdex, "~> 0.13"},
+      # Slice 013 (owner decision, 2026-09-20): the linux package builds mdex's NIF from
+      # source for musl (MDEX_NATIVE_BUILD=1 and TRINITY_NIF_TARGET in config/config.exs),
+      # because neither precompiled artifact loads in Burrito's musl ERTS (NOTES finding 13).
+      # rustler_precompiled needs Rustler present to run that build; build time only.
+      {:rustler, "~> 0.38", runtime: false},
       {:phoenix_html, "~> 4.1"},
       {:phoenix_live_reload, "~> 1.2", only: :dev},
       {:phoenix_live_view, "~> 1.2.0"},
diff --git a/mix.lock b/mix.lock
index e4c9615..a1a6611 100644
--- a/mix.lock
+++ b/mix.lock
@@ -38,6 +38,8 @@
   "makeup": {:hex, :makeup, "1.2.2", "882d46dc0905e9ff7abf2aab61a7e6b3dcc555533977d8a23b06019e6c89ac94", [:mix], [{:nimble_parsec, "~> 1.4", [hex: :nimble_parsec, repo: "hexpm", optional: false]}], "hexpm", "9a1a24e5b343b8ae16abea0822c10a6f75da27af7fa802ada5251f7579bfccfa"},
   "makeup_elixir": {:hex, :makeup_elixir, "1.0.1", "e928a4f984e795e41e3abd27bfc09f51db16ab8ba1aebdba2b3a575437efafc2", [:mix], [{:makeup, "~> 1.0", [hex: :makeup, repo: "hexpm", optional: false]}, {:nimble_parsec, "~> 1.2.3 or ~> 1.3", [hex: :nimble_parsec, repo: "hexpm", optional: false]}], "hexpm", "7284900d412a3e5cfd97fdaed4f5ed389b8f2b4cb49efc0eb3bd10e2febf9507"},
   "makeup_erlang": {:hex, :makeup_erlang, "1.1.0", "835f7e60792e08824cda445639555d7bf1bbbddb1b60b306e33cb6f6db24dc74", [:mix], [{:makeup, "~> 1.0", [hex: :makeup, repo: "hexpm", optional: false]}], "hexpm", "1cd6780fb1dd1a03979abaed0fe82712b0625118fd5257d3ebbf73f960c73c3c"},
+  "mdex": {:hex, :mdex, "0.13.5", "c1c94d230ccaab01ad0c68090d3b31613c10ece1844f32b55895da4ce0c63029", [:mix], [{:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:lumis, "~> 0.1", [hex: :lumis, repo: "hexpm", optional: true]}, {:mdex_native, ">= 0.2.6", [hex: :mdex_native, repo: "hexpm", optional: false]}, {:nimble_options, "~> 1.0", [hex: :nimble_options, repo: "hexpm", optional: false]}, {:nimble_parsec, "~> 1.0", [hex: :nimble_parsec, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 0.20.0 or ~> 1.0", [hex: :phoenix_live_view, repo: "hexpm", optional: true]}], "hexpm", "c57409fb6b34fbc58fbce0a6da670c9a4b5a2e94f86abdc56e9e213ed74620f2"},
+  "mdex_native": {:hex, :mdex_native, "0.2.8", "20b7cbf330c1ca81b8da4132b8d01952cded11f6dfc2abe8fef25c13681b15e4", [:mix], [{:rustler, "~> 0.32", [hex: :rustler, repo: "hexpm", optional: true]}, {:rustler_precompiled, "~> 0.8", [hex: :rustler_precompiled, repo: "hexpm", optional: false]}], "hexpm", "004a5565b6c96a06400901eb1e4e603585e00b23262d3f595c3f4aa38b83ef66"},
   "mime": {:hex, :mime, "2.0.7", "b8d739037be7cd402aee1ba0306edfdef982687ee7e9859bee6198c1e7e2f128", [:mix], [], "hexpm", "6171188e399ee16023ffc5b76ce445eb6d9672e2e241d2df6050f3c771e80ccd"},
   "mint": {:hex, :mint, "1.10.1", "c53e70867cf74017716884d8d33e0742b08b32e9cdb0031cbc69a429dc5555e3", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:hpax, "~> 0.1.1 or ~> 0.2.0 or ~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}], "hexpm", "0ba2a904605ed8406393444fb8b3356dc58eb59ee6c7fb94ac3f015e1be129e8"},
   "mix_audit": {:hex, :mix_audit, "2.1.5", "c0f77cee6b4ef9d97e37772359a187a166c7a1e0e08b50edf5bf6959dfe5a016", [:make, :mix], [{:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:yaml_elixir, "~> 2.11", [hex: :yaml_elixir, repo: "hexpm", optional: false]}], "hexpm", "87f9298e21da32f697af535475860dc1d3617a010e0b418d2ec6142bc8b42d69"},
@@ -61,6 +63,8 @@
   "req": {:hex, :req, "0.7.4", "23e9ffec17de032a46a4b15ed65c09793893bf4a7c680f4bbf6227fce6bdf74d", [:mix], [{:brotli, "~> 0.3.1", [hex: :brotli, repo: "hexpm", optional: true]}, {:finch, "~> 0.21", [hex: :finch, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:mime, "~> 2.0.6 or ~> 2.1", [hex: :mime, repo: "hexpm", optional: false]}, {:nimble_csv, "~> 1.0", [hex: :nimble_csv, repo: "hexpm", optional: true]}, {:plug, "~> 1.0", [hex: :plug, repo: "hexpm", optional: true]}], "hexpm", "4b192d63253e8dcc6221ef992ea9ebef7d3555166e8423aa5b553e86bc3c69a2"},
   "req_llm": {:hex, :req_llm, "1.24.0", "cdc5c5cd7f38c0e17cf7a949ced99b6760dcba0d860cd4d066fea1aeba422929", [:mix], [{:dotenvy, "~> 1.1", [hex: :dotenvy, repo: "hexpm", optional: false]}, {:ex_aws_auth, "~> 1.4", [hex: :ex_aws_auth, repo: "hexpm", optional: true]}, {:goth, "~> 1.4", [hex: :goth, repo: "hexpm", optional: true]}, {:igniter, "~> 0.7", [hex: :igniter, repo: "hexpm", optional: true]}, {:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:jsv, "~> 0.11", [hex: :jsv, repo: "hexpm", optional: false]}, {:llm_db, ">= 2026.9.3 and < 2027.0.0", [hex: :llm_db, repo: "hexpm", optional: false]}, {:nimble_options, "~> 1.1", [hex: :nimble_options, repo: "hexpm", optional: false]}, {:req, "~> 0.5", [hex: :req, repo: "hexpm", optional: false]}, {:server_sent_events, "~> 1.1.0", [hex: :server_sent_events, repo: "hexpm", optional: false]}, {:splode, "~> 0.3.0", [hex: :splode, repo: "hexpm", optional: false]}, {:websockex, "~> 0.5.1", [hex: :websockex, repo: "hexpm", optional: false]}, {:zoi, "~> 0.14", [hex: :zoi, repo: "hexpm", optional: false]}], "hexpm", "8ab6bda68e28afc3adf070cc6616d51831b42b8ff144116a9f104999af4c763f"},
   "rewrite": {:hex, :rewrite, "1.3.0", "67448ba7975690b35ba7e7f35717efcce317dbd5963cb0577aa7325c1923121a", [:mix], [{:glob_ex, "~> 0.1", [hex: :glob_ex, repo: "hexpm", optional: false]}, {:sourceror, "~> 1.0", [hex: :sourceror, repo: "hexpm", optional: false]}, {:text_diff, "~> 0.1", [hex: :text_diff, repo: "hexpm", optional: false]}], "hexpm", "d111ac7ff3a58a802ef4f193bbd1831e00a9c57b33276e5068e8390a212714a5"},
+  "rustler": {:hex, :rustler, "0.38.0", "7a8906998ff0d28e3021c0a73264abcda719bda344b2e58307c6805b0f87c9b4", [:mix], [{:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "704c03c1bf66be12b031c5a389347b91c81c5cb819a24b068b0de36fe4a5652a"},
+  "rustler_precompiled": {:hex, :rustler_precompiled, "0.9.0", "3a052eda09f3d2436364645cc1f13279cf95db310eb0c17b0d8f25484b233aa0", [:mix], [{:rustler, "~> 0.23", [hex: :rustler, repo: "hexpm", optional: true]}], "hexpm", "471d97315bd3bf7b64623418b3693eedd8e47de3d1cb79a0ac8f9da7d770d94c"},
   "server_sent_events": {:hex, :server_sent_events, "1.1.0", "54606238b9182ba673a10ce90bd95f81a0939c1baa91cdf86b66acc04edd1832", [:mix], [], "hexpm", "8e164db8e295a2d869a8faafbf4a1eeaa749b62fe93f66271adff6394d93ce15"},
   "sobelow": {:hex, :sobelow, "0.15.0", "b067d7f8522a9d758fa89cb2bfcbab7ad72c45a0993cb958c989c6fd956fdd56", [:mix], [{:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "24a800e2d7fa8c3bd21561b6ad8ad4745ed726a09fd606598981d9048708da98"},
   "sourceror": {:hex, :sourceror, "1.12.3", "f58eebef0765c7a369a49a755ab2a5ee88d92777f403ea5a08b722cefcc37f51", [:mix], [], "hexpm", "d5f2f37099de794840f08c54ae546d7f6e4ea015e397be64aebe4996fa9f7da7"},
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index d0c456b..bbe8876 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -8,3 +8,6 @@
 [toolchain]
 channel = "1.92.0"
 components = ["rustfmt", "clippy"]
+# Slice 013: the linux package builds mdex's NIF for Burrito's musl ERTS (NOTES finding 14);
+# rustup installs the standard library for the target when it reads this file.
+targets = ["x86_64-unknown-linux-musl"]
diff --git a/scripts/zig-cc-musl b/scripts/zig-cc-musl
new file mode 100755
index 0000000..7f05364
--- /dev/null
+++ b/scripts/zig-cc-musl
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+# The linker for a Rust NIF built for Burrito's musl ERTS (slice 013, NOTES.md finding 14).
+# Rust's own self-contained musl linking refuses a cdylib without crt-static ("unable to find
+# library -lgcc_s"), and a NIF linked by the host's gcc needs glibc's libgcc_s, which the musl
+# BEAM cannot resolve. Zig, already pinned for Burrito, links against musl and its own
+# compiler-rt, and the result needs libc.so alone, the same shape as the exqlite NIF Burrito
+# cross-compiles itself. Used through CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER.
+exec zig cc -target x86_64-linux-musl "$@"
diff --git a/slices/013-liveview-chat-streaming/NOTES.md b/slices/013-liveview-chat-streaming/NOTES.md
new file mode 100644
index 0000000..56efaec
--- /dev/null
+++ b/slices/013-liveview-chat-streaming/NOTES.md
@@ -0,0 +1,257 @@
+# Slice 013: NOTES
+
+## The renderer, measured 2026-09-20 before any code
+
+SLICE.md names `phoenix_streamdown` as the first candidate and `earmark` or `mdex` as the fallback, and asks
+for the measurement. Packages read from their Hex tarballs in a scratch directory, never added to the tree
+(`mix hex.package fetch <name> <version> --unpack`); the hex.pm API read with `curl -s
+https://hex.pm/api/packages/<name>`.
+
+| Candidate | Result | Derived by |
+|---|---|---|
+| `phoenix_streamdown` 1.0.0-beta.4 | Still the latest release, dated 2026-05-03; `latest_stable_version` is null. 801 lines in four files. It depends on `mdex ~> 0.11` and does two things over it: completes unclosed markdown syntax per token (its `Remend` module) and splits the text into blocks so finished blocks sit under `phx-update="ignore"`. VERSIONS.md forbids a pre-release, and the owner has not accepted one. | the API's `releases[0]`; `find lib -name '*.ex' \| xargs cat \| wc -l`; `grep '{:' mix.exs` |
+| `earmark` 1.4.49 | **Retired on hex** (`retirement.reason: deprecated`, "Earmark is no longer maintained. Migrate to a replacement, for example MDEx") **and carries an open advisory**, EEF-CVE-2026-48591 (medium, stored XSS via unescaped HTML attribute values). Both gate steps refuse it: `mix hex.audit` prints "Found retired packages" and `mix deps.audit` the advisory. Not a candidate. | `mix hex.audit` in the scratch project, exit 0 with both findings printed; the API's `releases/1.4.49` `retirement` field |
+| `mdex` 0.13.5 | Stable, released 2026-07-29, 1.4 M downloads. Its own `streaming: true` option completes fragments (`MDEx.FragmentParser`: `"Some **bold te"` renders `<strong>bold te</strong>`, an unclosed fence closes), which is the half of streamdown that matters; the other half is a design rule SLICE.md already states. With `render: [unsafe: false]` raw HTML is omitted and a `javascript:` href is emptied; the default sanitizer (ammonia) on top drops the omission comments and adds `rel="noopener noreferrer"`. Cost: 6,420 bytes of mixed markdown render in 5.6 ms, 642 bytes in 0.7 ms (100 runs each, `:timer.tc`), so twenty renders a second of a long in-progress message is a tenth of a core. | the scratch `bench.exs`, output kept below |
+| `mdex_native` 0.2.8 (mdex's NIF) | A Rust NIF through `rustler_precompiled`: artifacts for eleven targets, among them the four the packaging chain builds for (x86_64 and aarch64 darwin, x86_64 and aarch64 linux-gnu, x86_64 windows msvc and gnu). This machine downloaded `libmdex_native_nif-v0.2.8-nif-2.15-x86_64-unknown-linux-gnu.so` at compile and `mix hex.audit` reports nothing on the set. Slice 001 proved the packaging chain with a pure-BEAM release; a NIF is new to it. | `mix compile` in the scratch project (the download line is in its log); `checksum-Elixir.MDExNative.Native.exs` in the package |
+
+```
+$ mix run bench.exs         (scratch project, mdex 0.13.5)
+100 streaming renders of 6420 bytes: 563.142 ms total, 5.63142 ms each
+100 streaming renders of 642 bytes: 70.593 ms total, 0.70593 ms each
+```
+
+**Decision at G1: `mdex ~> 0.13`, and no `phoenix_streamdown`.** `earmark` is refused by the gate. The
+pre-release stays unpinned as VERSIONS.md requires; its two contributions are one `mdex` option and one rule this
+slice keeps anyway (completed messages rendered once, the in-progress message as one assign replaced whole). The
+NIF is the cost: the `package` workflow runs on the `mix.lock` change and builds on all three runner operating
+systems, which is the first measurement of a NIF in the bundle, cited in PROOF.md by run id. Open to the owner's
+veto at G1.
+
+## Design language, decided at G1
+
+SLICE.md decides the design language here and asks for tokens later slices consume. Dark by default with the
+three-way toggle kept (system, light, dark), clean rounded panels, and a font stack the tokens name once:
+`Ubuntu, Comfortaa, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif`, with `"Ubuntu Mono", ui-monospace,
+SFMono-Regular, Menlo, Consolas, monospace` for code. **No font file ships at this slice**: Ubuntu is under the
+Ubuntu Font Licence 1.0 and Comfortaa under the OFL 1.1, and bundling either adds a licence file and a REUSE row
+to a tree meant for donation; slice 100 decides what the packaged app carries once its target list is fixed, and
+a web font is an egress this slice does not open (CLAUDE.md §8: every egress gets a redaction row). Until then a
+machine without Ubuntu or Comfortaa installed falls through to its system font, which is what the stack is for.
+Open to the owner's veto at G1: bundling Comfortaa (OFL 1.1) now is the alternative.
+
+The tokens live in `assets/css/app.css` as two daisyUI themes (`trinity-dark`, default; `trinity-light`) and a
+Tailwind `@theme` block (fonts, type scale, radius, spacing); `docs/03-conventions.md` gains a UI section naming
+them and the component vocabulary (`TrinityWeb.ChatComponents`) later surfaces take.
+
+## G1 plan, 2026-09-20
+
+Tree at `835485c` on `main` (012 approved); branch `slice/013-liveview-chat-streaming`; ROADMAP row 013 set to
+`in_progress` in this commit. Each line names its test; the order is the build order.
+
+1. `chore(s013): add mdex ~> 0.13` as its own commit; `lib/trinity/versions.ex` gains the row and marks
+   `phoenix_streamdown` not used, `mix versions.gen` rewrites VERSIONS.md. Test: the gate's audit steps.
+2. `TrinityWeb.Markdown.to_html/2` (`streaming:` boolean): mdex with strikethrough, table, autolink and tasklist,
+   `unsafe: false`, the default sanitizer. Test: raw HTML omitted; a `javascript:` href emptied; an unclosed fence
+   completes when streaming; the same text renders the same HTML twice (pure).
+3. Design tokens in `assets/css/app.css` (above), the root layout defaulting to dark, `docs/03` UI section.
+   Test: `mix assets.build` exits 0 (CI builds no assets; the run is pasted in PROOF.md).
+4. `Trinity.Sessions.default_persona/0` (the row named `default`, created on first use with no soul, so the
+   prompt keeps its "You are Trinity." fallback; slice 030 seeds the SOUL into it), `Sessions.set_model/2`
+   (writes `sessions.model`; refuses an id the registry does not know), and the Session re-reads its row at
+   the start of every turn (one line in 012's `start_model_call`, so a model set between turns is the next
+   turn's model). `Session.state/1` gains `text`, the in-progress draft, for a remount mid-stream. The fake
+   provider records the last request it saw (`last_request/0`). Tests: set_model then a turn, the fake saw the
+   new model (AC6's core); an unknown id refused; `state/1` shows the text mid-stream.
+5. Router: `live_session :chat` with `/` (`SessionLive.Index`) and `/s/:id` (`SessionLive.Show`); the scaffold
+   home page, its controller and its test go, the index is the home. `TrinityWeb.Plugs.ContentSecurityPolicy`
+   on the browser pipeline: a per-request nonce, `script-src 'self' 'nonce-…'`, the inline theme script and the
+   LiveDashboard carry it; the slice-000 sobelow skip that named this slice as the owner is retired. Test: `GET /`
+   answers with the header and the inline script carries the same nonce.
+6. `SessionLive.Index`: the session list (title or first user line, model, last activity), "New session" on
+   the default persona, navigating to it. Test: a session is listed; "New session" creates a row and redirects.
+7. `SessionLive.Show` mount: subscribe, `ensure_started/1`, history into a `:messages` stream, the state view
+   into `@status` and `@draft`; delta messages already queued when the state reply arrives are drained, because
+   the reply's text contains them (the Session sends both, in order). Events: `user_message`,
+   `assistant_message` and `turn_interrupted` insert into the stream and clear the draft; `assistant_delta`
+   appends to the draft assign; `state` sets the status; `tool_call` adds a running tool card; `error` sets the
+   banner. Tests: AC2 (send, deltas, the final message once in the DOM), AC5 (remount mid-stream: the draft so
+   far, then the final message, no duplicate, no gap), AC4's test half (`Process.exit(session, :kill)`: the
+   banner appears, the next message works).
+8. `TrinityWeb.ChatComponents`: `message` (role, time, usage badge, markdown), `tool_card` (name, args summary,
+   status, expandable result), `composer` (textarea; Enter sends, Shift+Enter a newline, through a colocated
+   hook; disabled unless idle), `model_picker` (`Trinity.LLM.models/0`), `cancel_button`, `interrupted_banner`
+   with Retry (re-sends the last user message), `status_pill`. Tests: AC3's test half (cancel: the banner and the
+   interrupted message), AC6 (the picker changes `sessions.model`).
+9. Keyboard: a `Shortcuts` hook on the window (`Ctrl/Cmd+K` new session, `Esc` cancel) pushing two events the
+   LiveView already handles; no other key reaches the server. Test: the two events, driven directly.
+10. AC7: a test attaches to `[:phoenix, :live_view, :render, :stop]` for the Show process, streams 1,000 deltas
+    and asserts at most 25 renders with the text intact; the count is recorded in PROOF.md.
+11. The fake provider in dev: `Trinity.LLM.Providers.Fake` moves from `test/support` to `lib/trinity/llm/providers`
+    (it is the scripted provider, and the dev registry needs it); `TRINITY_FAKE_PROVIDER=1` in `config/runtime.exs`
+    replaces the dev registry with the fake and gives it a markdown demo script with short sleeps. Tests unchanged.
+12. `mix sobelow --exit --skip` with no new finding; the CSP skip retired, the reasons file rekeyed if a line moved.
+13. docs/01 (the web layer at 013: the two LiveViews, the subscribe path); docs/06 gains the NIF-in-the-bundle risk
+    row with its lift condition (the `package` run green on three operating systems).
+14. Screenshots under `proof/` from the running app with the fake provider, taken here where a browser exists;
+    the real-provider run is the owner's.
+15. Gate, coverage row, PROOF.md, ROADMAP to `done`, pull request, tag.
+
+Manual verification queue, for the owner at G4:
+- **AC1**: `TRINITY_FAKE_PROVIDER=1 mix phx.server`, open `/`, New session, send "hello", watch the markdown stream
+  in; then the same with a real provider (`set -a; . ./.env; set +a; mix phx.server`). Screenshot or GIF.
+- **AC3**: send a message with the fake's demo script (it streams for a few seconds), press Cancel or Esc mid-stream:
+  the partial text stays, marked interrupted, with the banner and Retry. Screenshot.
+- **AC4**: with the page open mid-stream, in `iex -S mix phx.server`: `Process.exit(Trinity.Sessions.whereis(id), :kill)`.
+  The banner appears without a reload; the next message works. Screenshot.
+
+Deviations from SLICE.md, stated before building: the renderer is `mdex`, not `phoenix_streamdown` (measured
+above). The fake provider moves into `lib/` so dev can run it (the slice asks for a dev config flag, which needs the
+module compiled in dev). Two small changes land in 012's modules (`start_model_call` re-reads the row; `state/1`
+carries the draft text), each a `fix(s012)`-style line inside this slice's commits, because AC5 and AC6 cannot be
+met without them. The CSP arrives here because the slice-000 skip named 013 as its owner.
+
+## Lines 1 to 14, 2026-09-20: what was built, and what building it found
+
+**Built.** `mdex ~> 0.13` (its own commit); `TrinityWeb.Markdown` (one `to_html/2`, the tree's only `raw/1`);
+the tokens in `assets/css/app.css` (two daisyUI themes, dark the default, a `@theme` block for fonts, the two
+chat text sizes and the radii) with the UI section in docs/03; `TrinityWeb.ChatComponents` (`message`,
+`tool_card`, `draft`, `composer`, `model_picker`, `status_pill`, `banner`, `local_time`); `Layouts.app` as the
+shell (top bar with the brand, a `:bar` slot, the theme toggle); `SessionLive.Index` and `SessionLive.Show`;
+four hooks in `assets/js/hooks.js`; `TrinityWeb.Plugs.ContentSecurityPolicy`; `Sessions.default_persona/0`,
+`set_model/2`, `set_title/2`; `Session.state/1` with `text`; the Session re-reading its row per turn; the fake
+provider in `lib/` with `last_request/0`, a `:demo` script and the `TRINITY_FAKE_PROVIDER=1` flag.
+
+**Found while building, each recorded rather than smoothed.**
+
+1. **`earmark` is refused by the gate, not just unattractive.** The measurement meant to compare render cost
+   found the package retired on hex with an open XSS advisory before a line of it ran (`mix hex.audit` in the
+   scratch project). SLICE.md's fallback pair was really one candidate.
+2. **A stream container cannot hold the in-progress message.** The draft sat in a sibling below the
+   `phx-update="stream"` list, which put it at the bottom of the viewport with a gap above it in the first
+   screenshot. One scroll region now wraps the stream container and the draft.
+3. **The formatter reflowed a `whitespace-pre-wrap` element** across three lines, and the newline rendered as a
+   blank line above every user message; caught in a screenshot, fixed with `phx-no-format` (its own commit).
+4. **Tool rows have no event.** 012 broadcasts `tool_call` at the start of a call and nothing when the row is
+   written, so a page would never show a tool result until a reload. The page reads the rows past its last seen
+   `seq` on every final or interrupted message; no new event shape, so `Events` is untouched.
+5. **A new incarnation says idle before it says interrupted.** With `state_enter`, the enter broadcast for `idle`
+   precedes the internal rehydrate event, so a test waiting for `turn_interrupted` and then `state idle` waited
+   five seconds for a message that had already passed. The kill test waits for the second only.
+6. **The Show page's status pill and the draft's pill shared an id**, which LiveViewTest refuses (duplicate id);
+   the component takes an `id` now.
+7. **sobelow does not see a policy set by a plug.** It recognises only a header map given to
+   `put_secure_browser_headers`, so the CSP finding stays reported with the plug in place; the skip is rekeyed
+   (the plug moved the pipeline's line) with the reason naming the test that asserts the header.
+8. **`@sobelow_skip` on a function is an unused attribute to the compiler**, which `--warnings-as-errors` turns
+   into a gate failure; `Trinity.Paths` had met the same at 001 and registers the attribute as persisted, and
+   `TrinityWeb.Markdown` does the same.
+9. **The dev database was behind on migrations** (011's `usage_events`), so the first `mix phx.server` answered
+   503 with `PendingMigrationError`; `mix ecto.migrate` and a restart.
+10. **One uncaptured failure in eleven runs** of `mix test test/trinity_web` (the run right after commit
+    `e33f5bc`: 20/21, the failing test's name lost to a `tail`); ten later runs of the same directory and six
+    of `test/trinity_web/live` alone were green, the gate run was green. Recorded so a recurrence in CI has a
+    place to land; the output goes here when it does.
+
+**Deviations from SLICE.md**, in addition to the four stated at G1: the screenshots for AC1, AC3 and AC4 were
+taken here, from the dev server driven by a headless chromium (`playwright-core` in a scratch directory, the
+browser from the machine's playwright cache), rather than left entirely to the owner; the manual queue stands,
+and the owner's own run is the one that counts. `Ctrl/Cmd+K` and `Esc` reach the server as two pushed events
+from one hook rather than `phx-window-keydown` bindings, so ordinary typing never round-trips. The `LocalTime`
+hook rewrites server-rendered UTC times in the viewer's zone, which the slice did not ask for and a desktop app
+cannot do without.
+
+```
+$ mix test test/trinity_web              → 21 passed (markdown, csp, index, AC2 to AC7)
+$ mix gate                               → exit 0; 176 passed, 10 excluded; plan_check: PASS
+$ mix test --cover                       → 64.50% total (Show 81.58%, Index 91.67%, ChatComponents 67.74%, Markdown 80.00%, CSP 100%)
+$ mix credo --strict --all               → 596 mods/funs, found no issues
+$ mix sobelow --exit --skip              → exit 0, no finding
+```
+
+## Follow-ups
+- Slice 100 decides the font the packaged app ships (Ubuntu under UFL 1.0 or Comfortaa under OFL 1.1, each with
+  its licence file and REUSE row); until then the stack falls through to the system font.
+- The `package` workflow run on this branch's `mix.lock` change is the first proof of a NIF in the bundle (R24);
+  100's cross-target build re-proves it per target.
+- A tool result has no event of its own (finding 4); 020 may add one to `Events` when tools are real, or keep the
+  catch-up read, which costs one query per final message.
+- Syntax highlighting in code blocks: `mdex_native` ships a `lumis` variant; not taken here (a larger artifact for
+  a nicety), open for 022 when tool output makes code blocks common.
+- `CoreComponents` is the generator's file at 17% coverage; the chat does not use its `input`, `table` or `list`.
+  A later slice that needs them styles them with the tokens or removes them.
+
+## Corrections, 2026-09-20, after the gate on the final tree
+
+11. **The gate refused the inline sobelow skip once its file was tracked.** `test/sobelow_skips_test.exs` reads
+    `git ls-files`, so the first green gate (markdown.ex untracked) could not see the `@sobelow_skip` whose
+    comment block said the reason without the `# sobelow_skip reason:` marker the enforcer looks for. Fixed in
+    `080c543`; distinct from finding 10, whose one failure was in `test/trinity_web` and stays uncaptured.
+
+Supersedes the coverage line in the block above: `mix test --cover` on the final code tree (`080c543`) reports
+**64.41%** total, the value `coverage.tsv` carries; 64.50% was the tree two commits earlier.
+
+## The package workflow, 2026-09-20, after the pull request opened
+
+The `package` workflow did not fire on the push (its `paths` filter did not match a new branch), so it was
+dispatched by hand: run 35518054546, then 35519205973 with the serve step taught to print `serve.log` on any
+non-200 (a `fix(s001)` line: the first run printed "HTTP 500" and nothing else). Three findings, each
+reproduced here on a fresh install of the locally built linux binary (`rm -rf ~/.local/share/.burrito`, a fresh
+`DATABASE_PATH`), which is the only kind of local run that means anything: Burrito reuses an extracted payload
+keyed by name and version, so the first local run of the new binary executed the payload from 2026-09-06 and
+answered 200 for the old home page.
+
+12. **The packaged binary never ran a migration** (`fix(s010)`, commit `1f677b0`). `skip_migrations?/0` keyed on
+    `RELEASE_NAME`, which `bin/desktop` exports and the Burrito wrapper does not (it starts `erlexec` directly),
+    so every table was missing and `/`, the first page to read one, answered 500 on all three operating
+    systems. Now "skip under Mix". Measured after: four migrations logged, `/` 200 three times.
+13. **The mdex NIF does not load in the Linux bundle.** Burrito's Linux ERTS is a musl build (`make_triplet/1`
+    appends `-musl`; `beam.smp`'s interpreter is a musl libc), and both precompiled artifacts fail in it: the
+    gnu one and the musl one (`TARGET_ABI=musl`) each NEED `libgcc_s.so.1`, which resolves to the host's glibc
+    copy and dies on `_dl_find_object: symbol not found`. `TrinityWeb.Markdown` then falls back to escaped text,
+    so the chat works but shows `**bold**` literally (the screenshot from that run is kept out of `proof/`).
+    R24 fired; its lift condition is not met by the precompiled route.
+14. **A source build for musl with Zig as the linker loads and renders.** `rustup target add
+    x86_64-unknown-linux-musl`, then `cargo build --release --target x86_64-unknown-linux-musl
+    --no-default-features --features nif_version_2_15` with `CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER` set
+    to a two-line `zig cc -target x86_64-linux-musl` wrapper (Zig 0.16.0 is already pinned for Burrito): 23 s,
+    NEEDED `libc.so` only, the same shape as the exqlite NIF Burrito itself cross-compiles. Swapped into the
+    extracted payload, the packaged chat renders the real provider's answer as markdown, no `on_load` warning
+    (screenshot `proof/ac1-final-openrouter-packaged.png`). Rust's own self-contained musl linking refused
+    (`unable to find library -lgcc_s`), and the crate's `.cargo/config.toml` turns `crt-static` off for musl.
+
+**Open decision for the owner, before this slice closes.** Two ways to a packaged Linux binary that renders:
+(a) keep `mdex` and build its NIF from source in the linux packaging job: `rustler` joins the tree as a
+build-time dependency, the job installs the musl Rust target and links through Zig, `MDEX_NATIVE_BUILD=1` and
+`config :mdex_native, MDExNative.Native, target: "x86_64-unknown-linux-musl"` for that build only; macOS and
+Windows keep the precompiled artifacts, unproven there because the `package` workflow has failed at "Serves
+HTTP 200" on both since the slice/011 tag run (35512430836), before this slice, and now prints why; or (b) a
+pure-Elixir renderer: `earmark_parser` 1.4.46 (the AST half of earmark, not retired, no advisory as of today's
+`hex.audit`) with Trinity's own HTML emitter and fragment completion, no NIF anywhere, the renderer's
+measurement redone. My recommendation is (a): the measurement above is the proof, the cost is one build-time
+dependency and thirty seconds of the linux job, and (b) rewrites the renderer against a parser whose author
+retired its sibling. Until the owner decides, the pull request stays open with the migration fix on it; the
+required checks (`gate`, `postgres`) are green on every commit.
+
+## The decision, 2026-09-20: (a), keep mdex and build its NIF for musl
+
+Owner's words: "go with a and continue". Built in one commit: `rustler ~> 0.38` at build time; the three
+compile-time settings in `config/config.exs` (`MDEX_NATIVE_BUILD=1`, `TRINITY_NIF_TARGET`, the Zig linker
+`scripts/zig-cc-musl`), set by the package workflow's linux job alone; the musl target named in
+`rust-toolchain.toml`; `Trinity.Smoke` printing `TRINITY_SMOKE_MARKDOWN=ok` (exit 3 otherwise) and the
+workflow's smoke step reading it on every target; `TrinityWeb.Markdown` logging once at `:error` on a fallback.
+
+15. **The smoke Task lost a race it had always been winning.** Rendering one line inside the Task before the
+    halt took long enough for `Kernel.CLI` to reach the plain argument `--smoke` and treat it as a file ("No
+    file named --smoke", exit 1). The render now happens inside `Application.start/2`, in `children/1`, and the
+    Task prints and halts at once as before. Three fresh-install smoke runs: `ok`, exit 0; with the gnu artifact
+    swapped into the payload: `failed:%MDEx.DecodeError{}`, exit 3.
+
+16. **The macOS and Windows serve failures were the data-directory lock.** Run 35522642934 printed the reason
+    the older runs had hidden: "is held by OS pid ... in desktop mode; refusing to start" on the launch after
+    the smoke run. Slice 010 read liveness on Linux alone and treated any file as held elsewhere, and the smoke
+    path halts without `terminate/2`, so the file it left refused every second launch on both platforms. Tried
+    first: `System.stop/1` in the smoke path so the lock's terminate runs; it is asynchronous, and `Kernel.CLI`'s
+    "No file named --smoke" (finding 15) won two runs in three. Kept: `System.halt/1` as slice 001 had it, and
+    liveness read through `kill -0` and `tasklist` (`fix(s010)`, the commit before this record). Run **35523664194**: green
+    on all three operating systems, `TRINITY_SMOKE_MARKDOWN=ok` on each, HTTP 200 in 1,526 ms (linux),
+    1,680 ms (macOS) and 1,761 ms (windows) from launch. The first green `package` run since the slice/011 tag.
diff --git a/slices/013-liveview-chat-streaming/PROOF.md b/slices/013-liveview-chat-streaming/PROOF.md
new file mode 100644
index 0000000..4d19177
--- /dev/null
+++ b/slices/013-liveview-chat-streaming/PROOF.md
@@ -0,0 +1,229 @@
+# Proof for slice 013: LiveView chat UI with streaming
+
+Agent: Trinity · Coding Agent · Date: 2026-09-20 · Branch: slice/013-liveview-chat-streaming · Final commit: (the commit carrying this file; named in the closing correction below)
+
+## Summary
+A usable chat over slice 012's Session: a sessions index at `/`, the chat at `/s/:id`, the assistant's text
+streamed as markdown through one renderer (`mdex`, chosen by the measurement in NOTES.md after `earmark` turned
+out to be retired with an open XSS advisory and `phoenix_streamdown` still a beta), tool cards, a model picker,
+Cancel and Esc, an interrupted banner with Retry, `Ctrl/Cmd+K` for a new session, and a remount mid-stream that
+shows the draft so far with neither a gap nor a duplicate. The design language is decided here as tokens (two
+themes, dark by default; fonts, text sizes, radii) and a component vocabulary later surfaces take. Every browser
+response carries a Content-Security-Policy with a per-request nonce, the debt slice 000 left to this slice. The
+hard parts, all in NOTES.md: tool rows have no event of their own (the page reads past its last seen `seq`), a
+stream container cannot hold the in-progress message, the formatter reflowed a pre-wrap element, and the fake
+provider had to move into `lib/` for the dev flag the slice asks for.
+
+## Gate
+```
+$ mix gate                                   (this machine, OTP 28.5.0.5, Elixir 1.20.4, under a 32 GiB cgroup, tree 080c543)
+596 mods/funs, found no issues.
+... SCAN COMPLETE ...                        (sobelow --exit --skip: no finding)
+No retired or security advisory packages found
+No vulnerabilities found.
+versions.verify: OK. 83 locked packages, none disagreeing with 47 pins
+versions.gen: VERSIONS.md already matches Trinity.Versions and mix.lock
+trinity.names: OK over 266 tracked files
+trinity.secrets.scan: OK over 266 files
+trinity.reuse: OK. Every commentable tracked file carries an SPDX header
+AC7: 6 renders of the page for 1,000 deltas
+Result: 176 passed, 10 excluded
+trinity.coverage: 012 60.82% vs 011 51.57%: OK
+plan_check: PASS
+exit=0
+```
+`mix credo --strict --all`: 596 mods/funs, found no issues. `mix assets.build`: exit 0 (tailwind 4.3.0, daisyUI
+5.5.20, esbuild; CI builds no assets, so this run is the record).
+
+## Tests
+```
+$ mix test --cover                           (tree 080c543)
+Result: 176 passed, 10 excluded
+    |     17.07% | TrinityWeb.CoreComponents              |
+    |     50.00% | TrinityWeb.ErrorHTML                   |
+    |     67.48% | TrinityWeb.ChatComponents              |
+    |     80.00% | TrinityWeb.Markdown                    |
+    |     81.25% | Trinity.LLM.Providers.Fake             |
+    |     81.58% | TrinityWeb.SessionLive.Show            |
+    |     84.66% | Trinity.Sessions.Session               |
+    |     91.67% | TrinityWeb.SessionLive.Index           |
+    |    100.00% | TrinityWeb.Layouts                     |
+    |    100.00% | TrinityWeb.Plugs.ContentSecurityPolicy |
+    |     64.41% | Total                                  |
+```
+`coverage.tsv` row: `013  64.41  080c543  2026-09-20` (from 60.82 at 012).
+
+The slice's tests, `mix test test/trinity_web test/trinity/sessions/model_and_persona_test.exs --trace`:
+```
+test GET / sets the policy and the theme script carries the same nonce (67.2ms)
+test two requests get two nonces (1.1ms)
+test raw HTML in the answer is omitted, block and inline (5.0ms)
+test a javascript: href is emptied and ordinary links get rel=noopener (2.8ms)
+test markdown structure renders: emphasis, code, list, table, fence (14.2ms)
+test streaming completes an unfinished fragment; a finished render is not touched (28.4ms)
+test the same text renders the same HTML twice (4.8ms)
+test the index lists sessions, and New session creates a row and opens it (4.2ms)
+test the index Ctrl/Cmd+K reaches the same event through the Shortcuts hook (2.5ms)
+test the index a missing session redirects home with a flash (2.1ms)
+test a turn (AC2) send, deltas update the draft, the final message appears once (538.0ms)
+test cancel (AC3, the test half) the partial text is kept as interrupted, the banner shows, Retry sends again (66.7ms)
+test cancel (AC3, the test half) Esc reaches cancel through the Shortcuts hook (59.5ms)
+test the Session dies under the page (AC4, the test half) the banner appears without a reload, the page stays usable, the next message works (769.3ms)
+test a remount mid-stream (AC5) history comes from the database, the draft so far from the process; nothing doubles or goes missing (813.5ms)
+test the model picker (AC6) changes sessions.model and the next turn uses it (7.7ms)
+test render count (AC7) 1,000 deltas in well under a second render the page at most 25 times
+test default_persona/0 creates the row named default once and returns the same row after (1.2ms)
+test set_model/2 (AC6's core) refuses an id the registry does not know, and the row is unchanged (0.5ms)
+test set_model/2 (AC6's core) refuses a session that does not exist (2.0ms)
+test set_model/2 (AC6's core) the next turn of a running session uses the model set between turns (31.0ms)
+test state/1 carries the in-progress text mid-stream the view holds what has arrived; idle it is empty (403.4ms)
+```
+The red for the Session change was committed first (`ce4b1f4`, "the next turn of a running session uses the
+model set between turns": `left: nil, right: "fake:embed"`) and the fix references it (`57aca61`).
+
+## Acceptance criteria evidence
+
+### AC1 [manual]: create session, send "hello", see the streamed markdown response (fake provider and a real provider), screenshot
+Taken here from the dev server driven by a headless chromium (NOTES.md, deviations); the owner's own run is the
+manual queue below.
+- Fake provider (`TRINITY_FAKE_PROVIDER=1 mix phx.server`, the `:demo` script): `proof/ac1-streaming-fake.png`
+  (mid-stream: bold, list, an open fence completed, the cursor, status `thinking`, Cancel showing) and
+  `proof/ac1-final-fake.png` (the whole answer: fence, table, blockquote, the `<script>` in the answer dropped,
+  usage badge `12/95`, status `idle`).
+- Real provider (`set -a; . ./.env; set +a; mix phx.server`, model `openrouter:ling`):
+  `proof/ac1-streaming-openrouter.png` and `proof/ac1-final-openrouter.png` (two paragraphs and a list, usage
+  `43/276`). The browser console reported no error under the strict policy in either run.
+
+### AC2 [auto]: send → assistant_delta updates → the final message appears once in the DOM
+`a turn (AC2) send, deltas update the draft, the final message appears once`: after the first delta the draft
+element is present, status `thinking`, Cancel present; after `{:state, :idle}` the final text occurs exactly
+once in the rendered page (`length(String.split(html, final)) - 1 == 1`), the draft is gone, both rows of
+`history/1` have their elements, the usage badge reads `29/29`, and the session's title is the first message.
+
+### AC3 [manual]: cancel during streaming; interrupted message with banner (test + screenshot)
+Test: `cancel (AC3, the test half) the partial text is kept as interrupted, the banner shows, Retry sends again`:
+Cancel mid-stream; the banner and the `interrupted` label render; the partial text is on the page and the
+rest never arrives; the row carries `parts.interrupted == true`; Retry sends the same message again and the
+banner clears; history is `["user", "assistant", "user", "assistant"]`. `Esc reaches cancel through the
+Shortcuts hook` drives the same event the key pushes. Screenshot: `proof/ac3-cancelled.png` (Esc pressed
+mid-stream: the partial answer marked interrupted, the banner with Retry, the composer enabled again).
+
+### AC4 [manual]: kill the Session process while the page is open: banner appears; page remains usable; next message works (manual + test)
+Test: `the Session dies under the page (AC4, the test half) ...`: `Process.exit(pid, :kill)` after a draft row
+exists; the page process is alive; the banner appears from the new incarnation's rehydrate broadcast, without a
+reload; the kept text is on the page; status `idle`; the new pid differs; the next message completes and
+history is four rows. Screenshots: `proof/ac4-killed-banner.png` (the kill from a second node with
+`:rpc.call(node, Process, :exit, [pid, :kill])` while streaming: the partial answer marked interrupted and the
+banner) and `proof/ac4-next-message-works.png` (the next message answered in full).
+
+### AC5 [auto]: reload mid-stream: history from DB; no duplicate or missing messages
+`a remount mid-stream (AC5) ...`: two earlier rows, a turn in flight with "one two " received; a second page
+mounted for the same session shows both earlier rows and "one two" in the draft; after idle the final text
+occurs once, the draft is gone, every one of the four rows in `history/1` has its element on both pages, and the
+page holds exactly four message elements.
+
+### AC6 [auto]: the model picker changes sessions.model and the next turn uses it
+`the model picker (AC6) changes sessions.model and the next turn uses it`: the picker shows `fake:chat` selected
+(the registry default); changing to `mock:chat` writes `sessions.model` and re-selects; changing to `fake:embed`
+and sending a message, the fake's `last_request/0` carries `model: "fake:embed"`. Its core, in the Sessions
+suite: the same through `Sessions.set_model/2` on a running process whose pid does not change; an unknown id and
+a missing session refused by name.
+
+### AC7 [auto]: 1,000 deltas in 1 s do not exceed ~25 DOM patches; number recorded
+`render count (AC7) ...`: a handler on `[:phoenix, :live_view, :render, :stop]` counts renders in the page's
+process while the fake streams 1,000 single-character deltas; **6 renders** (printed by the test in every gate run
+above), asserted `<= 25`; the final page holds all 1,000 characters. Each render is one diff to the client, so the
+patch count is at most the render count.
+
+### AC8 [auto]: gate green; mix sobelow no new findings
+The gate block above, exit 0. `mix sobelow --exit --skip` exits 0; `mix sobelow --exit` (no skip file) reports the
+same set as before the slice plus the one `raw/1`, which carries a scoped `@sobelow_skip` with its reason; the
+slice-000 CSP skip is rekeyed with the reason that the policy is now set by a plug sobelow cannot see (the test
+asserts the header).
+
+### The design language
+`assets/css/app.css` (two themes, `@theme` tokens), `docs/03-conventions.md` UI section, `TrinityWeb.ChatComponents`.
+`proof/design-light-theme.png` is the same chat under the light theme; every other screenshot is the dark default.
+
+## Manual verification for the reviewer
+1. AC1: `TRINITY_FAKE_PROVIDER=1 mix phx.server`, open `http://localhost:4000/`, New session, type "hello", Enter.
+   Expected: the answer streams in as markdown with a cursor, status `thinking`, then `idle` with a usage badge.
+   Then `set -a; . ./.env; set +a; mix phx.server` and the same with `openrouter:ling` in the picker.
+2. AC3: with the fake provider, send anything and press Esc (or Cancel) while it streams. Expected: the partial
+   answer stays, labelled `interrupted`, the banner offers Retry, the composer is enabled.
+3. AC4: with the page open mid-stream, in `iex -S mix phx.server`: `Process.exit(Trinity.Sessions.whereis("<id from the URL>"), :kill)`.
+   Expected: the banner appears without a reload, status returns to `idle`, the next message is answered.
+
+## Deviations from SLICE.md
+See NOTES.md: `mdex` rather than `phoenix_streamdown` (measured); the fake provider in `lib/` for the dev flag;
+two changes in 012's modules (the row re-read per turn, `state/1` with `text`); the CSP here because the
+slice-000 skip named 013; screenshots taken here as well as left to the owner; shortcuts through one hook; the
+`LocalTime` hook.
+
+## Versions touched
+`VERSIONS.md` updated: yes. `mdex ~> 0.13` added (row new, ✅ in `mix.lock`); `phoenix_streamdown` reads not used
+with the measurement. `mix.lock` gained `mdex` 0.13.5, `mdex_native` 0.2.8, `rustler_precompiled` 0.9.0.
+`mix hex.audit` and `mix deps.audit` clean. The `package` workflow run triggered by this branch's `mix.lock`
+change is cited in the closing correction below once it has run.
+
+## Git
+```
+$ git log --oneline main..HEAD
+080c543 fix(s013): the inline sobelow skip names its reason the way the enforcer reads it
+84a4aba test(s013): the kill test waits for the rehydrate broadcast only
+e33f5bc fix(s013): a user bubble keeps its own whitespace only
+50f35db feat(s013): the chat: two LiveViews, the component vocabulary, the renderer, the policy
+57aca61 fix(s012): the Session reads its row at the start of every turn
+ce4b1f4 test(s013): a model set between turns is not the next turn's model (red)
+482b9e6 chore(s013): add mdex ~> 0.13
+454a12e docs(s013): G1 plan with the renderer measured, and the slice opens
+```
+
+## Closing correction, 2026-09-20
+Supersedes the "Final commit" field in the header: the commit carrying this file is `8cc90b7`
+(`feat(s013): complete slice 013 (LiveView chat UI with streaming)`), and the `git log` block above lists the
+commits before it. The `package` workflow run and the pull request are named in a later correction once they exist.
+
+## Correction, 2026-09-20: the packaged binary, after the owner's decision
+Supersedes the "Versions touched" paragraph's last sentence and adds to AC1 and AC8. The `package` workflow,
+dispatched by hand (runs 35518054546 and 35519205973), found three things (NOTES.md findings 12 to 15): the
+packaged binary never ran a migration (`fix(s010)`), the mdex NIF does not load in Burrito's musl ERTS, and a
+musl build of it linked through Zig does. The owner chose to keep mdex with that build. Measured here on a fresh
+install (`rm -rf ~/.local/share/.burrito`, a fresh `DATABASE_PATH`) of the linux binary built exactly as the
+workflow builds it:
+```
+$ readelf -d _build/prod/lib/mdex_native/priv/native/mdex_native_nif.so | grep NEEDED
+ 0x0000000000000001 (NEEDED)             Shared library: [libc.so]
+$ ./burrito_out/desktop_linux_x86_64 --no-halt --smoke      (three runs)
+TRINITY_SMOKE_PORT=44875
+TRINITY_SMOKE_MARKDOWN=ok                                    exit 0, each run
+$ (the gnu artifact copied over the NIF in the extracted payload)
+TRINITY_SMOKE_MARKDOWN=failed:%MDEx.DecodeError{document: #MDEx.Document(0 nodes)<>, error: nil}   exit 3
+```
+The packaged chat against `openrouter:ling` renders the answer as markdown with no `on_load` warning in the
+log: `proof/ac1-final-openrouter-packaged.png`. `VERSIONS.md` gained the `rustler` row (build time only);
+`versions.verify`: 84 locked packages, 48 pins. Gate on this tree: exit 0, 177 tests. The `package` run on the
+final tree is named in the next correction.
+
+## Correction, 2026-09-20: the package run on the decided tree
+Supersedes "the `package` run on the final tree is named in the next correction" above. Run **35521749862**
+(dispatched on `22cd58c`'s tree, the musl NIF build): **linux x86_64 green end to end**, the NIF compiled from
+source in the job, the smoke step reading `TRINITY_SMOKE_MARKDOWN=ok`, the serve step HTTP 200. **macOS
+aarch64 and windows x86_64: the smoke step passed on both**, `TRINITY_SMOKE_MARKDOWN=ok` from the precompiled
+artifact on each, so the renderer's NIF loads on all three operating systems; both then failed the serve step
+exactly as the slice/011 and slice/012 tag runs did before this slice, with an empty log (the port loop timing
+out). The step now prints `serve.log` on that path too (`fix(s001)`), and run 35522642934 was dispatched to read
+it; its result is the next correction.
+
+## Correction, 2026-09-20: the package run, green on three operating systems
+Supersedes the previous correction's last sentence. Run 35522642934 printed the macOS and Windows failure at
+last: the data-directory lock refusing the launch after the smoke run (NOTES.md finding 16, `fix(s010)`). Run
+**35523664194**, on the tree with that fix: **linux x86_64, macOS aarch64 and windows x86_64 all green**,
+`TRINITY_SMOKE_MARKDOWN=ok` on each (the NIF built from source for musl on Linux, precompiled on the other two),
+`HTTP 200` from the packaged binary in 1,526 ms, 1,680 ms and 1,761 ms from launch. R24's lift condition is met.
+The final commit and the pull request are named in the closing correction.
+
+## Closing correction, 2026-09-20
+Supersedes the closing correction above it: the branch grew past `8cc90b7` while the package workflow was
+brought green (commits `68c00a6` to `ff2b316`, listed by `git log --oneline main..HEAD` on pull request #24). The
+ROADMAP row stays `done`; the pull request is #24; the merge commit and the tag come after the owner's review.
diff --git a/slices/013-liveview-chat-streaming/proof/ac1-final-fake.png b/slices/013-liveview-chat-streaming/proof/ac1-final-fake.png
new file mode 100644
index 0000000..9d4f486
Binary files /dev/null and b/slices/013-liveview-chat-streaming/proof/ac1-final-fake.png differ
diff --git a/slices/013-liveview-chat-streaming/proof/ac1-final-openrouter-packaged.png b/slices/013-liveview-chat-streaming/proof/ac1-final-openrouter-packaged.png
new file mode 100644
index 0000000..7a746b5
Binary files /dev/null and b/slices/013-liveview-chat-streaming/proof/ac1-final-openrouter-packaged.png differ
diff --git a/slices/013-liveview-chat-streaming/proof/ac1-final-openrouter.png b/slices/013-liveview-chat-streaming/proof/ac1-final-openrouter.png
new file mode 100644
index 0000000..7dc723d
Binary files /dev/null and b/slices/013-liveview-chat-streaming/proof/ac1-final-openrouter.png differ
diff --git a/slices/013-liveview-chat-streaming/proof/ac1-streaming-fake.png b/slices/013-liveview-chat-streaming/proof/ac1-streaming-fake.png
new file mode 100644
index 0000000..0bf8311
Binary files /dev/null and b/slices/013-liveview-chat-streaming/proof/ac1-streaming-fake.png differ
diff --git a/slices/013-liveview-chat-streaming/proof/ac1-streaming-openrouter.png b/slices/013-liveview-chat-streaming/proof/ac1-streaming-openrouter.png
new file mode 100644
index 0000000..03ce551
Binary files /dev/null and b/slices/013-liveview-chat-streaming/proof/ac1-streaming-openrouter.png differ
diff --git a/slices/013-liveview-chat-streaming/proof/ac3-cancelled.png b/slices/013-liveview-chat-streaming/proof/ac3-cancelled.png
new file mode 100644
index 0000000..f8ad8d4
Binary files /dev/null and b/slices/013-liveview-chat-streaming/proof/ac3-cancelled.png differ
diff --git a/slices/013-liveview-chat-streaming/proof/ac4-killed-banner.png b/slices/013-liveview-chat-streaming/proof/ac4-killed-banner.png
new file mode 100644
index 0000000..3276ce2
Binary files /dev/null and b/slices/013-liveview-chat-streaming/proof/ac4-killed-banner.png differ
diff --git a/slices/013-liveview-chat-streaming/proof/ac4-next-message-works.png b/slices/013-liveview-chat-streaming/proof/ac4-next-message-works.png
new file mode 100644
index 0000000..60db936
Binary files /dev/null and b/slices/013-liveview-chat-streaming/proof/ac4-next-message-works.png differ
diff --git a/slices/013-liveview-chat-streaming/proof/design-light-theme.png b/slices/013-liveview-chat-streaming/proof/design-light-theme.png
new file mode 100644
index 0000000..429a8f7
Binary files /dev/null and b/slices/013-liveview-chat-streaming/proof/design-light-theme.png differ
diff --git a/test/smoke_test.exs b/test/smoke_test.exs
index 1c250ff..3d1fb0c 100644
--- a/test/smoke_test.exs
+++ b/test/smoke_test.exs
@@ -62,5 +62,16 @@ defmodule SmokeTest do
 
       assert status == 0
     end
+
+    # Slice 013: a packaged binary whose markdown NIF does not load still boots and serves
+    # (NOTES.md finding 13), so the smoke path says whether it rendered, and exits 3 if not.
+    test "says whether the markdown renderer rendered, on its own line" do
+      me = self()
+      Smoke.run(&send(me, {:said, &1}), &send(me, {:halted, &1}))
+      assert_received {:said, "TRINITY_SMOKE_PORT=" <> _}
+      assert_received {:said, "TRINITY_SMOKE_MARKDOWN=ok"}
+      assert_received {:halted, 0}
+      assert Smoke.markdown_line() == "TRINITY_SMOKE_MARKDOWN=ok"
+    end
   end
 end
diff --git a/test/trinity/sessions/model_and_persona_test.exs b/test/trinity/sessions/model_and_persona_test.exs
new file mode 100644
index 0000000..c9b2c14
--- /dev/null
+++ b/test/trinity/sessions/model_and_persona_test.exs
@@ -0,0 +1,74 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+defmodule Trinity.Sessions.ModelAndPersonaTest do
+  @moduledoc """
+  Slice 013 line 4: the default persona, `set_model/2`, the Session reading its row at the
+  start of every turn, and the draft text in the state view.
+  """
+  use Trinity.SessionCase
+  @moduletag :capture_log
+
+  alias Trinity.Factory
+  alias Trinity.LLM.Providers.Fake
+
+  describe "default_persona/0" do
+    test "creates the row named default once and returns the same row after" do
+      first = Sessions.default_persona()
+      assert first.name == "default"
+      assert first.soul == nil
+      assert Sessions.default_persona().id == first.id
+    end
+  end
+
+  describe "set_model/2 (AC6's core)" do
+    setup do
+      row = Factory.session!()
+      :ok = Sessions.subscribe(row.id)
+      {:ok, id: row.id}
+    end
+
+    test "refuses an id the registry does not know, and the row is unchanged", %{id: id} do
+      assert {:error, {:unknown_model, "nope:model"}} = Sessions.set_model(id, "nope:model")
+      assert Sessions.get_session(id).model == nil
+    end
+
+    test "refuses a session that does not exist" do
+      assert {:error, :no_session} = Sessions.set_model(Trinity.UUID.generate(), "mock:chat")
+    end
+
+    test "the next turn of a running session uses the model set between turns", %{id: id} do
+      Fake.script(script_deltas(2, "a"))
+      {:ok, pid} = start_drained(id)
+      {:ok, _} = Session.send_user_message(pid, "one")
+      _ = collect(id, &match?({:assistant_message, _}, &1))
+      assert Fake.last_request().model == nil
+
+      assert {:ok, %{model: "fake:embed"}} = Sessions.set_model(id, "fake:embed")
+      {:ok, _} = Session.send_user_message(pid, "two")
+      _ = collect(id, &match?({:assistant_message, _}, &1))
+      assert Fake.last_request().model == "fake:embed"
+      assert Sessions.whereis(id) == pid, "the process was not restarted to pick the model up"
+    end
+  end
+
+  describe "state/1 carries the in-progress text" do
+    test "mid-stream the view holds what has arrived; idle it is empty" do
+      row = Factory.session!()
+      :ok = Sessions.subscribe(row.id)
+
+      Fake.script([
+        {:text_delta, "so far "},
+        {:sleep, 400},
+        {:text_delta, "done"},
+        {:done, :stop}
+      ])
+
+      {:ok, pid} = start_drained(row.id)
+      {:ok, _} = Session.send_user_message(pid, "go")
+      _ = collect(row.id, &match?({:assistant_delta, _}, &1))
+      assert %{state: :thinking, text: "so far "} = Session.state(pid)
+      _ = collect(row.id, &match?({:assistant_message, _}, &1))
+      assert %{state: :idle, text: ""} = Session.state(pid)
+    end
+  end
+end
diff --git a/test/trinity_web/controllers/page_controller_test.exs b/test/trinity_web/controllers/page_controller_test.exs
deleted file mode 100644
index 8e58ed8..0000000
--- a/test/trinity_web/controllers/page_controller_test.exs
+++ /dev/null
@@ -1,10 +0,0 @@
-# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
-# SPDX-License-Identifier: Apache-2.0
-defmodule TrinityWeb.PageControllerTest do
-  use TrinityWeb.ConnCase
-
-  test "GET /", %{conn: conn} do
-    conn = get(conn, ~p"/")
-    assert html_response(conn, 200) =~ "Peace of mind from prototype to production"
-  end
-end
diff --git a/test/trinity_web/live/session_live_test.exs b/test/trinity_web/live/session_live_test.exs
new file mode 100644
index 0000000..0d785be
--- /dev/null
+++ b/test/trinity_web/live/session_live_test.exs
@@ -0,0 +1,286 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+defmodule TrinityWeb.SessionLiveTest do
+  @moduledoc """
+  Slice 013 AC2, AC4 (the test half), AC5, AC6 and AC7, with AC3's test half, through the scripted
+  provider. The test subscribes to the same session events as the page; a `render/1` after an
+  event is received is a render after the page handled it, because the Session sends both
+  mailboxes in order and `render/1` is a call the page answers in order.
+  """
+  use TrinityWeb.ConnCase, async: false
+  @moduletag :capture_log
+
+  import Phoenix.LiveViewTest
+  import Trinity.SessionCase, only: [script_deltas: 2, collect: 3]
+
+  alias Trinity.Factory
+  alias Trinity.LLM.Providers.Fake
+  alias Trinity.Sessions
+
+  setup do
+    Fake.clear()
+    on_exit(fn -> Trinity.SessionCase.stop_all_sessions() end)
+    row = Factory.session!()
+    :ok = Sessions.subscribe(row.id)
+    {:ok, id: row.id}
+  end
+
+  defp send_message(view, text) do
+    view |> form("#composer", %{"content" => text}) |> render_submit()
+  end
+
+  defp wait_for(id, until, timeout \\ 5_000), do: collect(id, until, timeout)
+
+  describe "the index" do
+    test "lists sessions, and New session creates a row and opens it", %{conn: conn, id: id} do
+      {:ok, view, html} = live(conn, ~p"/")
+      assert html =~ "message-" == false
+      assert has_element?(view, "#sessions-#{id}")
+      before = length(Sessions.list_sessions())
+
+      assert {:error, {:live_redirect, %{to: "/s/" <> new_id}}} =
+               view |> element("#new-session") |> render_click()
+
+      assert length(Sessions.list_sessions()) == before + 1
+      assert Sessions.get_session(new_id).persona_id == Sessions.default_persona().id
+    end
+
+    test "Ctrl/Cmd+K reaches the same event through the Shortcuts hook", %{conn: conn} do
+      {:ok, view, _} = live(conn, ~p"/")
+      assert {:error, {:live_redirect, %{to: "/s/" <> _}}} = render_hook(view, "new_session", %{})
+    end
+
+    test "a missing session redirects home with a flash", %{conn: conn} do
+      assert {:error, {:live_redirect, %{to: "/"}}} =
+               live(conn, ~p"/s/#{Trinity.UUID.generate()}")
+    end
+  end
+
+  describe "a turn (AC2)" do
+    test "send, deltas update the draft, the final message appears once", %{conn: conn, id: id} do
+      # A pause after the first delta, so the page is caught mid-stream.
+      Fake.script([{:text_delta, "word "}, {:sleep, 500}] ++ script_deltas(29, "word "))
+      {:ok, view, _} = live(conn, ~p"/s/#{id}")
+      assert has_element?(view, "#status[data-status=idle]")
+
+      send_message(view, "hello **there**")
+      _ = wait_for(id, &match?({:assistant_delta, _}, &1))
+      html = render(view)
+      assert html =~ "hello **there**"
+      assert has_element?(view, "#draft")
+      assert has_element?(view, "#status[data-status=thinking]")
+      assert has_element?(view, "#cancel")
+
+      _ = wait_for(id, &match?({:state, :idle}, &1))
+      html = render(view)
+      final = String.duplicate("word ", 30) |> String.trim()
+      assert length(String.split(html, final)) - 1 == 1, "the final text appears more than once"
+      refute has_element?(view, "#draft")
+      assert has_element?(view, "#status[data-status=idle]")
+      [user, assistant] = Sessions.history(id)
+      assert has_element?(view, "#message-#{user.id}")
+      assert has_element?(view, "#message-#{assistant.id}")
+      assert html =~ "29/29"
+      assert Sessions.get_session(id).title == "hello **there**"
+    end
+  end
+
+  describe "cancel (AC3, the test half)" do
+    test "the partial text is kept as interrupted, the banner shows, Retry sends again", %{
+      conn: conn,
+      id: id
+    } do
+      Fake.scripts([
+        [{:text_delta, "partial "}, {:sleep, 3_000}, {:text_delta, "never"}, {:done, :stop}],
+        script_deltas(2, "again ")
+      ])
+
+      {:ok, view, _} = live(conn, ~p"/s/#{id}")
+      send_message(view, "go")
+      _ = wait_for(id, &match?({:assistant_delta, _}, &1))
+      view |> element("#cancel") |> render_click()
+      _ = wait_for(id, &match?({:state, :idle}, &1))
+      html = render(view)
+      assert has_element?(view, "#banner")
+      assert html =~ "interrupted"
+      assert html =~ "partial"
+      refute html =~ "never"
+      [_, interrupted] = Sessions.history(id)
+      assert interrupted.parts["interrupted"] == true
+
+      view |> element("#banner button", "Retry") |> render_click()
+      _ = wait_for(id, &match?({:assistant_message, _}, &1))
+      refute has_element?(view, "#banner")
+
+      assert Enum.map(Sessions.history(id), & &1.role) == [
+               "user",
+               "assistant",
+               "user",
+               "assistant"
+             ]
+
+      assert render(view) =~ "again again"
+    end
+
+    test "Esc reaches cancel through the Shortcuts hook", %{conn: conn, id: id} do
+      Fake.script([{:text_delta, "p "}, {:sleep, 3_000}, {:done, :stop}])
+      {:ok, view, _} = live(conn, ~p"/s/#{id}")
+      send_message(view, "go")
+      _ = wait_for(id, &match?({:assistant_delta, _}, &1))
+      render_hook(view, "cancel", %{})
+      _ = wait_for(id, &match?({:turn_interrupted, _}, &1))
+      assert has_element?(view, "#banner")
+    end
+  end
+
+  describe "the Session dies under the page (AC4, the test half)" do
+    test "the banner appears without a reload, the page stays usable, the next message works", %{
+      conn: conn,
+      id: id
+    } do
+      # Long enough for a draft row to be written (500 ms) before the kill.
+      Fake.scripts([
+        [
+          {:text_delta, "before "},
+          {:sleep, 700},
+          {:text_delta, "x"},
+          {:sleep, 3_000},
+          {:done, :stop}
+        ],
+        script_deltas(2, "after ")
+      ])
+
+      {:ok, view, _} = live(conn, ~p"/s/#{id}")
+      send_message(view, "go")
+      _ = wait_for(id, fn e -> e == {:assistant_delta, "x"} end)
+      pid = Sessions.whereis(id)
+      Process.exit(pid, :kill)
+
+      # The new incarnation enters idle (its first broadcast) and then rehydrates the draft.
+      _ = wait_for(id, &match?({:turn_interrupted, _}, &1))
+      assert Process.alive?(view.pid)
+      html = render(view)
+      assert has_element?(view, "#banner")
+      assert html =~ "before"
+      assert has_element?(view, "#status[data-status=idle]")
+      refute has_element?(view, "#draft")
+      assert Sessions.whereis(id) != pid
+
+      send_message(view, "again")
+      _ = wait_for(id, &match?({:assistant_message, _}, &1))
+      assert render(view) =~ "after after"
+
+      assert Enum.map(Sessions.history(id), & &1.role) == [
+               "user",
+               "assistant",
+               "user",
+               "assistant"
+             ]
+    end
+  end
+
+  describe "a remount mid-stream (AC5)" do
+    test "history comes from the database, the draft so far from the process; nothing doubles or goes missing",
+         %{conn: conn, id: id} do
+      Factory.message!(id, %{role: "user", content: "earlier question"})
+      Factory.message!(id, %{role: "assistant", content: "earlier answer"})
+
+      Fake.script([
+        {:text_delta, "one "},
+        {:text_delta, "two "},
+        {:sleep, 800},
+        {:text_delta, "three"},
+        {:done, :stop}
+      ])
+
+      {:ok, first, _} = live(conn, ~p"/s/#{id}")
+      send_message(first, "go")
+
+      _ =
+        wait_for(id, fn e ->
+          e == {:assistant_delta, "one two "} or e == {:assistant_delta, "two "}
+        end)
+
+      # The reload: a second page for the same session, mounted while the turn is in flight.
+      {:ok, second, html} = live(conn, ~p"/s/#{id}")
+      assert html =~ "earlier question"
+      assert html =~ "earlier answer"
+      assert html =~ "one two"
+      assert has_element?(second, "#draft")
+
+      _ = wait_for(id, &match?({:state, :idle}, &1))
+      html = render(second)
+      assert length(String.split(html, "one two three")) - 1 == 1
+      refute has_element?(second, "#draft")
+      rows = Sessions.history(id)
+      assert length(rows) == 4
+
+      for row <- rows do
+        assert has_element?(second, "#message-#{row.id}"),
+               "row seq #{row.seq} missing after remount"
+
+        assert has_element?(first, "#message-#{row.id}"),
+               "row seq #{row.seq} missing on the first page"
+      end
+
+      assert length(Regex.scan(~r/id="message-[0-9a-f-]+" class=/, html)) == 4
+    end
+  end
+
+  describe "the model picker (AC6)" do
+    test "changes sessions.model and the next turn uses it", %{conn: conn, id: id} do
+      Fake.script(script_deltas(1, "ok"))
+      {:ok, view, _} = live(conn, ~p"/s/#{id}")
+      assert has_element?(view, "#model-picker option[selected][value='fake:chat']")
+
+      view |> form("#model-picker", %{"model" => "mock:chat"}) |> render_change()
+      assert Sessions.get_session(id).model == "mock:chat"
+      assert has_element?(view, "#model-picker option[selected][value='mock:chat']")
+
+      # Back to the fake, which records the request it was given.
+      view |> form("#model-picker", %{"model" => "fake:embed"}) |> render_change()
+      send_message(view, "which model?")
+      _ = wait_for(id, &match?({:assistant_message, _}, &1))
+      assert Fake.last_request().model == "fake:embed"
+    end
+  end
+
+  describe "render count (AC7)" do
+    test "1,000 deltas in well under a second render the page at most 25 times", %{
+      conn: conn,
+      id: id
+    } do
+      Fake.script(script_deltas(1_000, "y"))
+      {:ok, view, _} = live(conn, ~p"/s/#{id}")
+      test_pid = self()
+      view_pid = view.pid
+
+      :telemetry.attach(
+        "ac7-#{id}",
+        [:phoenix, :live_view, :render, :stop],
+        fn _event, _measure, _meta, _config ->
+          if self() == view_pid, do: send(test_pid, :rendered)
+        end,
+        nil
+      )
+
+      on_exit(fn -> :telemetry.detach("ac7-#{id}") end)
+
+      send_message(view, "go")
+      _ = wait_for(id, &match?({:state, :idle}, &1))
+      html = render(view)
+      renders = count(:rendered, 0)
+      IO.puts("\nAC7: #{renders} renders of the page for 1,000 deltas")
+      assert renders <= 25, "#{renders} renders"
+      assert html =~ String.duplicate("y", 1_000)
+    end
+
+    defp count(msg, n) do
+      receive do
+        ^msg -> count(msg, n + 1)
+      after
+        0 -> n
+      end
+    end
+  end
+end
diff --git a/test/trinity_web/markdown_test.exs b/test/trinity_web/markdown_test.exs
new file mode 100644
index 0000000..fed3401
--- /dev/null
+++ b/test/trinity_web/markdown_test.exs
@@ -0,0 +1,45 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+defmodule TrinityWeb.MarkdownTest do
+  @moduledoc "Slice 013 line 2: the renderer drops raw HTML, empties script hrefs, completes fragments, and is pure."
+  use ExUnit.Case, async: true
+
+  alias TrinityWeb.Markdown
+
+  defp html(md, opts \\ []), do: md |> Markdown.to_html(opts) |> Phoenix.HTML.safe_to_string()
+
+  test "raw HTML in the answer is omitted, block and inline" do
+    out = html("before\n\n<script>alert(1)</script>\n\n<b onclick=\"x()\">bold</b> after")
+    refute out =~ "<script"
+    refute out =~ "onclick"
+    assert out =~ "before"
+    assert out =~ "bold"
+  end
+
+  test "a javascript: href is emptied and ordinary links get rel=noopener" do
+    out = html("[js](javascript:alert(1)) and [ok](https://example.com)")
+    refute out =~ "javascript:"
+    assert out =~ ~s(href="https://example.com")
+    assert out =~ "noopener"
+  end
+
+  test "markdown structure renders: emphasis, code, list, table, fence" do
+    out = html("**b** `c`\n\n- one\n\n| a |\n|---|\n| 1 |\n\n```elixir\nx\n```\n")
+    assert out =~ "<strong>b</strong>"
+    assert out =~ "<code>c</code>"
+    assert out =~ "<li>one</li>"
+    assert out =~ "<table>"
+    assert out =~ ~s(<code class="language-elixir">)
+  end
+
+  test "streaming completes an unfinished fragment; a finished render is not touched" do
+    assert html("Some **bold te", streaming: true) =~ "<strong>bold te</strong>"
+    assert html("```elixir\ndef x, do", streaming: true) =~ "<pre>"
+    refute html("Some **bold te") =~ "<strong>"
+  end
+
+  test "the same text renders the same HTML twice" do
+    md = "# T\n\ntext *em*\n"
+    assert html(md) == html(md)
+  end
+end
diff --git a/test/trinity_web/plugs/content_security_policy_test.exs b/test/trinity_web/plugs/content_security_policy_test.exs
new file mode 100644
index 0000000..6b8131e
--- /dev/null
+++ b/test/trinity_web/plugs/content_security_policy_test.exs
@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+defmodule TrinityWeb.Plugs.ContentSecurityPolicyTest do
+  @moduledoc "Slice 013 line 5: every browser response carries the policy, with a nonce the inline script shares."
+  use TrinityWeb.ConnCase, async: false
+
+  test "GET / sets the policy and the theme script carries the same nonce", %{conn: conn} do
+    conn = get(conn, ~p"/")
+    assert [policy] = get_resp_header(conn, "content-security-policy")
+    assert [_, nonce] = Regex.run(~r/script-src 'self' 'nonce-([A-Za-z0-9_-]+)'/, policy)
+    assert policy =~ "default-src 'self'"
+    assert policy =~ "frame-ancestors 'none'"
+    assert policy =~ "object-src 'none'"
+    assert html_response(conn, 200) =~ ~s(<script nonce="#{nonce}">)
+  end
+
+  test "two requests get two nonces", %{conn: conn} do
+    [a, b] = for _ <- 1..2, do: conn |> get(~p"/") |> get_resp_header("content-security-policy")
+    assert a != b
+  end
+end