[shim9610]

Host code previously borrowed live component stores, coupling application code to internal layout and invalidation. Replace those loans with named operations and owned configuration commits; support protected hosts through the runner, headless harness and validated recovery. Before the first release, remove ignored tuning values, fix deep cross-pane layer aliasing and check fresh consumer dependency resolution on the minimum Rust version.

API and hosting

• Replace seven mutable Shell component loans with desktop, status/navigation, metrics, backend, access and keyboard operations. Backend replacement attaches before publication, clears old acknowledgements and quarantines attachment faults.
• Add trusted ordinary-host ServiceRequest, narrow ShellView observations, sealed runner/harness support, protected-only replacement and typed settings registration.
• Remove seven unused component values and the duplicate button/switch metric containers. Document canonical ControlSpec/MetricsSpec inputs and per-widget slider precedence. Default built-in widget rendering is unchanged.
• Record compiler-derived API decisions and migrations, including diagnostic layer-slot signatures changing from u32 to u64.

Correctness and documentation

• Separate pane slots with a high u64 bit, warm the next deep slot and preserve transition cleanup. A 33-entry/two-pane regression checks identities, real clicks, push/pop and transforms.
• Add five actual rendering/layout configuration witnesses and six production mutation controls. Replace arithmetic-only observations with painted shapes, text and tile geometry; retain value validation under accurate names.
• Fix small progress-ring stroke bounds, history interruption decoding and motion-lab TOML export; retain their targeted regressions and CI checks.
• Reconcile README, guides, API comments and architecture/verification descriptions with implementation. Cite egui/eframe responsibilities, use separate SVG system/security/session diagrams and regenerate the example gallery. Remove promotional claims, repeated disclaimers and document-self descriptions.
• Align recorded and unrecorded tour timing and add a protected GUI login/work/logout/reauthentication smoke tour. Assign repository paths to @shim9610 through CODEOWNERS.

Dependency refresh

• Update compatible lockfile selections: toml 1.2.1, arboard 3.7.0, log 0.4.35 and related patches. Pin verification-only loom 0.7.3 and generator 0.8.12. Keep spinning_top 0.3.1 with talc 5.1.1 because their lock_api line remains compatible.
• Alternatives considered: retain old pins; update only direct dependencies. The compatible cohort includes the TOML fixes and clipboard corrections and exercises their resolved transitive versions together.
• Selected Linux normal graph: 154 → 154 identities, with the same 11 duplicate-name groups accepted by policy. Main lockfile: 327 → 317 entries; verification lockfile: 111 → 116, including six new Windows-binding version pins used by generator. No runtime/feature dependency declarations are added.
• Licences pass policy; the updated packages have current releases. Dated owner-requested verification approvals and both generated notices are updated; asset notices are byte-for-byte preserved.
• Reviewed build-script changes are libc target/cfg checks and zerocopy SPDX/check-cfg updates; other updated custom-build scripts are unchanged. Compiler/version probes, local Git metadata and conditional PowerPC assembly remain. No build-script download step is introduced. Upstream FFI/unsafe code remains in low-level dependencies; neither product library adds unsafe code.
• Product and verification MSRV remain 1.95. Loom stays optional in the unpublished verification workspace; its six models pass on both Rust 1.99 and 1.95. The normal product graph adds no credentials, decoder or network-protocol implementation.

Release verification

The new fresh-consumer gate extracts both archives, resolves an external project without a seeded lockfile, runs minimal/default/all features on the declared Rust 1.95 minimum and applies dependency policy. CI retains its logs, resolved lockfile, metadata and archive hashes alongside the existing pinned-package checks.

Local validation for ea5752d:

• Strict audit passed: 1,988 tests passed, 0 failed, 16 existing ignored, plus all-target/all-feature Clippy, docs, aarch64 compilation, dependencies/licences, generated files and synchronization checks.
• Verification workspace: 77 native tests passed with 512 generated cases per property and seed 20261101. All six Loom models passed on Rust 1.99 and 1.95.
• GUI: all nine tours passed; the motion-export round-trip test passed.
• API decisions/type schema matched without API changes; nine API-tool tests passed. All 589 documentation links resolve. Common source-bound kernel/path proofs and all/minimal compiled routing checks passed.
• Extracted-package tests passed (273 widgets + 1,450 shell), and pinned external consumers passed in minimal/default/all configurations. Fresh-resolution consumers passed on Rust 1.95 with dependency policy.

All 22 hosted checks passed for ea5752d, including CodeQL, CI, Rust assurance and UI interaction histories.

Migration · Host API decisions · Release checks

Closes #13.
Closes #16.
Closes #17.