[DanielNetzer]

Implements issue #251.

Molecule: mol-251-05bfc0b1b6ddb6230ab605c0
Formula: forgecell-github-issue
Base: e9857d6a777022c60df41ae4448d417525e2e976
Delivery: 11a283760fe574b979fdcf591fb9218c65490773

Awaiting exact-commit CI and human review. Harness-reported checks are not independent CI evidence. No merge, deployment or issue closure is authorized.

[DanielNetzer]

Adversarial review: LOW findings (not fixed in this slice, by policy)

1. Stats load isn't retried after a failure. app.js sets mv.statsKey before the fetch, so after a failure the diff size and estimate stay missing until the key changes. Fix: reset the key on failure.
2. No single-flight for git diff. diffsize.go doesn't cache failures and doesn't de-duplicate requests, so concurrent /stats GETs can each start a git diff (each bounded at 20 s). Fix: add a per-key in-flight guard.
3. Gate job errors show internal category words. They render as category: error (for example "stale: …"). Fix: map categories to plain words.

The two HIGH findings (attempt-based duration; Stop offered only when this UI owns the run) and the two MEDIUM ones (estimate lane/active-time basis; amend parent check under the engine lock) were fixed in plan revision 3.

[DanielNetzer]

Merged main into this branch (d4033e0) to resolve conflicts with #267 (#254) in drive.go and server.go: union of both sides' handler fields and loop struct fields, keeping runIssue: molecule.RunIntake (the per-Issue lock). Verified locally on the merged tree: go build ./..., go vet, and go test -count=1 ./internal/ui/... ./internal/molecule/... ./internal/cli/... (1,697 passed). Visual check done against Plan.html (Inbox card, header, stepper, file badges, sticky decision card, danger zone).