diff --git a/lab/internal/molecule/amend.go b/lab/internal/molecule/amend.go
index f47dc24..bcec33e 100644
--- a/lab/internal/molecule/amend.go
+++ b/lab/internal/molecule/amend.go
@@ -253,10 +253,17 @@ type AmendRequest struct {
 	AcceptProtectedFailures bool
 	// Run reports that the caller approves and runs the new revision right after
 	// the amend (amend --run).
-	Run             bool
+	Run bool
+	// ExpectParent, when set, is the plan digest the caller reviewed: the amend is
+	// refused with ErrStalePlan unless it is still the latest plan under the lock.
+	ExpectParent    string
 	protectedDeltas []readiness.ProtectedDelta
 }
 
+// ErrStalePlan is the refusal of an amend whose ExpectParent is no longer the
+// latest plan: a newer revision was recorded after the caller read it.
+var ErrStalePlan = errors.New("the latest plan is not the one reviewed; a newer plan exists")
+
 // Bounds of one flag-driven amendment. Plan.Validate bounds the totals.
 const (
 	maxAmendAdditions  = 64
@@ -350,8 +357,9 @@ func refuseSelectionInputChange(previous, next readiness.Plan) error {
 // AmendFromLatest records the successor of the Molecule's latest plan built from
 // req. The parent is the latest plan digest, read under the Molecule flock and the
 // approval lock directory, so a concurrent amend either fails as locked or has
-// already been recorded and becomes the parent: the history never forks. Every
-// check of Amend applies; a refusal writes nothing.
+// already been recorded and becomes the parent: the history never forks. A set
+// req.ExpectParent that is not that latest digest is refused with ErrStalePlan.
+// Every check of Amend applies; a refusal writes nothing.
 func AmendFromLatest(ctx context.Context, lab, id string, req AmendRequest) (Record, error) {
 	var empty Record
 	if err := req.validate(); err != nil {
@@ -386,10 +394,13 @@ func AmendFromLatest(ctx context.Context, lab, id string, req AmendRequest) (Rec
 	if r.Readiness == nil || len(r.Readiness.Plans) == 0 {
 		return r, fmt.Errorf("Molecule has no readiness plan to amend")
 	}
+	latest := r.Readiness.Plans[len(r.Readiness.Plans)-1]
+	if req.ExpectParent != "" && req.ExpectParent != latest.Digest {
+		return r, ErrStalePlan
+	}
 	if r.Workspace.Path == "" || (r.CheckoutStatus != "" && r.CheckoutStatus != "available") {
 		return r, fmt.Errorf("coding checkout unavailable; refresh intake")
 	}
-	latest := r.Readiness.Plans[len(r.Readiness.Plans)-1]
 	if req.AcceptProtectedFailures {
 		if req.protectedDeltas, err = protectedFailureDeltas(ctx, r, latest); err != nil {
 			return r, err
diff --git a/lab/internal/molecule/amend_test.go b/lab/internal/molecule/amend_test.go
new file mode 100644
index 0000000..ffa6601
--- /dev/null
+++ b/lab/internal/molecule/amend_test.go
@@ -0,0 +1,38 @@
+package molecule
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"testing"
+)
+
+// A caller that reviewed one plan, while another amend recorded a newer one
+// before its engine call, is refused as stale under the lock and records nothing.
+func TestAmendFromLatestRefusesStaleExpectedParent(t *testing.T) {
+	t.Parallel()
+	o, r := amendFixture(t)
+	seen := latestPlan(r).Digest
+	// The ledger moves forward between the caller's check and its engine call.
+	advanced, err := AmendFromLatest(context.Background(), o.LabDir, r.ID, AmendRequest{AddAcceptance: []string{"Someone else's note"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	before := ledgerBytes(t, advanced)
+	_, err = AmendFromLatest(context.Background(), o.LabDir, r.ID, AmendRequest{ExpectParent: seen, AddAcceptance: []string{"My note"}})
+	if !errors.Is(err, ErrStalePlan) {
+		t.Fatalf("stale expected parent was not refused as stale: %v", err)
+	}
+	if !bytes.Equal(before, ledgerBytes(t, advanced)) {
+		t.Fatal("a stale amend changed the ledger")
+	}
+	// The digest the caller now sees is accepted and becomes the parent.
+	current := latestPlan(advanced).Digest
+	next, err := AmendFromLatest(context.Background(), o.LabDir, r.ID, AmendRequest{ExpectParent: current, AddAcceptance: []string{"My note"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := latestPlan(next).Plan.ParentDigest; got != current {
+		t.Fatalf("parent = %s, want %s", got, current)
+	}
+}
diff --git a/lab/internal/molecule/diffstat.go b/lab/internal/molecule/diffstat.go
new file mode 100644
index 0000000..33622ce
--- /dev/null
+++ b/lab/internal/molecule/diffstat.go
@@ -0,0 +1,167 @@
+package molecule
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/DanielNetzer/forgecell/lab/internal/process"
+)
+
+// DiffStat is the size of a captured tree against its base commit, as git diff
+// --numstat counts it. Binary files count as changed files with no lines.
+// Truncated means a bound was hit: the counts cover only the files read before
+// it, so they are a lower bound and never the whole change.
+type DiffStat struct {
+	Files     int   `json:"files"`
+	Added     int64 `json:"added"`
+	Removed   int64 `json:"removed"`
+	Binary    int   `json:"binary"`
+	Truncated bool  `json:"truncated"`
+}
+
+// Bounds of one numstat: the files counted, the bytes read and the time taken.
+const (
+	MaxDiffStatFiles = 10000
+	MaxDiffStatBytes = 1 << 20
+	diffStatTimeout  = 20 * time.Second
+	// maxDiffStatLines bounds one file's line count, so no sum can overflow.
+	maxDiffStatLines = 1 << 40
+)
+
+var (
+	// ErrDiffStatInvalid refuses an object id, Lab or workspace the numstat never runs on.
+	ErrDiffStatInvalid = errors.New("diff size refused: invalid object id or workspace")
+	// ErrDiffStatFailed is a git failure, timeout or unreadable output; no size is known.
+	ErrDiffStatFailed = errors.New("diff size unavailable: git diff --numstat failed")
+)
+
+// objectID is a full SHA-1 or SHA-256 Git object id, lower-case hex only.
+var objectID = regexp.MustCompile(`^(?:[0-9a-f]{40}|[0-9a-f]{64})$`)
+
+// DiffNumstat measures tree, a captured tree object, against the base commit with
+// git diff --numstat, run directly (no shell) in workspace, which must be a
+// directory of the Lab's own workspaces/ owned by this user and not a symlink.
+// Both object ids must be full hex ids, so neither can be read as an option or a
+// revision expression. Output, file count and time are bounded; a bound hit is
+// reported as Truncated, a failure as ErrDiffStatFailed. Error values never carry
+// local paths or git output.
+func DiffNumstat(ctx context.Context, lab, workspace, base, tree string) (DiffStat, error) {
+	var out DiffStat
+	if !objectID.MatchString(base) || !objectID.MatchString(tree) {
+		return out, ErrDiffStatInvalid
+	}
+	dir, err := labWorkspace(lab, workspace)
+	if err != nil {
+		return out, err
+	}
+	argv := []string{"git", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", "-c", "core.quotePath=false",
+		"diff", "--numstat", "-z", "--no-renames", "--no-ext-diff", "--no-textconv", "--no-color", base, tree, "--"}
+	r := process.Run(ctx, process.Options{Argv: argv, Dir: dir, Env: numstatEnv(), Stdin: []byte{}, Timeout: diffStatTimeout, MaxOutputBytes: MaxDiffStatBytes})
+	switch {
+	case r.Overflow && r.Reconciled && !r.TimedOut && !r.Interrupted && !r.ParentDeadline:
+		// The output was cut at the byte bound: count the complete records read.
+		out = parseNumstat(r.Stdout, false)
+		out.Truncated = true
+		return out, nil
+	case !r.OK:
+		return DiffStat{}, ErrDiffStatFailed
+	}
+	return parseNumstat(r.Stdout, true), nil
+}
+
+// labWorkspace is workspace when it is exactly <lab>/workspaces/<name> with both
+// directories real (not symlinks) and owned by this user.
+func labWorkspace(lab, workspace string) (string, error) {
+	if lab == "" || workspace == "" || !filepath.IsAbs(workspace) {
+		return "", ErrDiffStatInvalid
+	}
+	lab, err := filepath.Abs(lab)
+	if err != nil {
+		return "", ErrDiffStatInvalid
+	}
+	root := filepath.Join(lab, "workspaces")
+	clean := filepath.Clean(workspace)
+	name := filepath.Base(clean)
+	if filepath.Dir(clean) != root || name == "." || name == ".." || strings.HasPrefix(name, ".") {
+		return "", ErrDiffStatInvalid
+	}
+	for _, dir := range []string{root, clean} {
+		info, err := os.Lstat(dir)
+		if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
+			return "", ErrDiffStatInvalid
+		}
+		if st, ok := info.Sys().(*syscall.Stat_t); !ok || int(st.Uid) != os.Getuid() {
+			return "", ErrDiffStatInvalid
+		}
+	}
+	return clean, nil
+}
+
+// numstatEnv is this process's environment without GIT_* variables, which could
+// point git at another repository, index or config, and with optional locks off,
+// so a read never writes the index.
+func numstatEnv() []string {
+	env := []string{}
+	for _, s := range os.Environ() {
+		name, _, _ := strings.Cut(s, "=")
+		if !strings.HasPrefix(name, "GIT_") {
+			env = append(env, s)
+		}
+	}
+	return append(env, "GIT_OPTIONAL_LOCKS=0", "GIT_CONFIG_NOSYSTEM=1")
+}
+
+// parseNumstat counts NUL-terminated "added\tremoved\tpath" records. A record
+// that is not a complete, well-formed numstat line marks the result truncated
+// instead of being guessed at; complete says the output ended on a record
+// boundary, so a trailing fragment is only expected when it did not.
+func parseNumstat(raw string, complete bool) DiffStat {
+	var out DiffStat
+	records := strings.Split(raw, "\x00")
+	last := records[len(records)-1]
+	records = records[:len(records)-1]
+	if last != "" {
+		// A trailing fragment is a record cut by the byte bound.
+		out.Truncated = true
+	}
+	for _, rec := range records {
+		if rec == "" {
+			continue
+		}
+		if out.Files == MaxDiffStatFiles {
+			out.Truncated = true
+			break
+		}
+		added, rest, ok1 := strings.Cut(rec, "\t")
+		removed, file, ok2 := strings.Cut(rest, "\t")
+		if !ok1 || !ok2 || file == "" {
+			out.Truncated = true
+			continue
+		}
+		if added == "-" && removed == "-" {
+			out.Files++
+			out.Binary++
+			continue
+		}
+		a, errA := strconv.ParseInt(added, 10, 64)
+		d, errD := strconv.ParseInt(removed, 10, 64)
+		if errA != nil || errD != nil || a < 0 || d < 0 || a > maxDiffStatLines || d > maxDiffStatLines {
+			out.Truncated = true
+			continue
+		}
+		out.Files++
+		out.Added += a
+		out.Removed += d
+	}
+	if !complete {
+		out.Truncated = true
+	}
+	return out
+}
diff --git a/lab/internal/molecule/diffstat_test.go b/lab/internal/molecule/diffstat_test.go
new file mode 100644
index 0000000..c9b441d
--- /dev/null
+++ b/lab/internal/molecule/diffstat_test.go
@@ -0,0 +1,150 @@
+package molecule
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// numstatRepo is a Lab with one workspace repository: a base commit and the tree
+// of a second commit that edits one file, adds a text and a binary file and
+// deletes one.
+func numstatRepo(t *testing.T) (lab, workspace, base, tree string) {
+	t.Helper()
+	lab = resolvedTempDir(t)
+	workspace = filepath.Join(lab, "workspaces", "issue-1")
+	if err := os.MkdirAll(workspace, 0700); err != nil {
+		t.Fatal(err)
+	}
+	git := func(args ...string) string {
+		return testGit(t, workspace, append([]string{"-c", "user.name=Test", "-c", "user.email=test@example.test", "-c", "commit.gpgsign=false"}, args...)...)
+	}
+	write := func(name, body string) {
+		if err := os.WriteFile(filepath.Join(workspace, name), []byte(body), 0600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	git("init", "-q")
+	write("edit.txt", "one\ntwo\nthree\n")
+	write("gone.txt", "a\nb\n")
+	git("add", ".")
+	git("commit", "-qm", "base")
+	base = git("rev-parse", "HEAD")
+	write("edit.txt", "one\n2\nthree\nfour\n")
+	write("new.txt", "x\ny\nz\n")
+	write("blob.bin", "\x00\x01\x02binary")
+	if err := os.Remove(filepath.Join(workspace, "gone.txt")); err != nil {
+		t.Fatal(err)
+	}
+	git("add", "-A")
+	git("commit", "-qm", "change")
+	tree = git("rev-parse", "HEAD^{tree}")
+	return lab, workspace, base, tree
+}
+
+func TestDiffNumstatCountsTheCapturedTreeAgainstTheBase(t *testing.T) {
+	lab, workspace, base, tree := numstatRepo(t)
+	got, err := DiffNumstat(context.Background(), lab, workspace, base, tree)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// edit.txt +2 -1, new.txt +3, gone.txt -2, blob.bin binary.
+	if want := (DiffStat{Files: 4, Added: 5, Removed: 3, Binary: 1}); got != want {
+		t.Fatalf("numstat %+v, want %+v", got, want)
+	}
+	// The same tree against itself is no change at all.
+	if same, err := DiffNumstat(context.Background(), lab, workspace, base, testGit(t, workspace, "rev-parse", base+"^{tree}")); err != nil || same != (DiffStat{}) {
+		t.Fatalf("unchanged tree: %+v %v", same, err)
+	}
+}
+
+func TestDiffNumstatRefusesInvalidIdsAndWorkspaces(t *testing.T) {
+	lab, workspace, base, tree := numstatRepo(t)
+	for name, c := range map[string][2]string{
+		"short":      {base[:12], tree},
+		"upper":      {strings.ToUpper(base), tree},
+		"option":     {"--output=/tmp/x", tree},
+		"expression": {base, "HEAD~1"},
+		"range":      {base, base + ".." + tree},
+		"empty":      {"", tree},
+	} {
+		if _, err := DiffNumstat(context.Background(), lab, workspace, c[0], c[1]); !errors.Is(err, ErrDiffStatInvalid) {
+			t.Errorf("%s: %v", name, err)
+		}
+	}
+	outside := resolvedTempDir(t)
+	link := filepath.Join(lab, "workspaces", "link")
+	if err := os.Symlink(workspace, link); err != nil {
+		t.Fatal(err)
+	}
+	for name, dir := range map[string]string{
+		"relative":    "workspaces/issue-1",
+		"outside":     outside,
+		"lab root":    lab,
+		"nested":      filepath.Join(workspace, "sub"),
+		"traversal":   filepath.Join(lab, "workspaces", "..", "workspaces", "..", "x"),
+		"symlink":     link,
+		"missing":     filepath.Join(lab, "workspaces", "absent"),
+		"dot entries": filepath.Join(lab, "workspaces", ".hidden"),
+	} {
+		if _, err := DiffNumstat(context.Background(), lab, dir, base, tree); !errors.Is(err, ErrDiffStatInvalid) {
+			t.Errorf("%s: %v", name, err)
+		}
+	}
+	// An object that does not exist fails safe without a size.
+	if got, err := DiffNumstat(context.Background(), lab, workspace, base, strings.Repeat("0", 40)); !errors.Is(err, ErrDiffStatFailed) || got != (DiffStat{}) {
+		t.Fatalf("missing object: %+v %v", got, err)
+	}
+}
+
+func TestDiffNumstatParseBoundsFailSafe(t *testing.T) {
+	if got := parseNumstat("1\t2\ta.go\x00-\t-\tb.png\x00", true); got != (DiffStat{Files: 2, Added: 1, Removed: 2, Binary: 1}) {
+		t.Fatalf("plain: %+v", got)
+	}
+	// Output cut by the byte bound counts only complete records and is truncated.
+	if got := parseNumstat("1\t2\ta.go\x003\t4\tb.g", false); got != (DiffStat{Files: 1, Added: 1, Removed: 2, Truncated: true}) {
+		t.Fatalf("cut: %+v", got)
+	}
+	// Malformed and hostile records are never counted as sizes.
+	for _, raw := range []string{"x\ty\ta.go\x00", "1\ta.go\x00", "-1\t2\ta.go\x00", "1\t2\t\x00", "99999999999999999999\t1\ta.go\x00"} {
+		if got := parseNumstat(raw, true); !got.Truncated || got.Files != 0 || got.Added != 0 {
+			t.Errorf("%q: %+v", raw, got)
+		}
+	}
+	// More files than the bound stop at the bound, truncated.
+	var b strings.Builder
+	for i := 0; i <= MaxDiffStatFiles; i++ {
+		b.WriteString("1\t0\tf\x00")
+	}
+	if got := parseNumstat(b.String(), true); !got.Truncated || got.Files != MaxDiffStatFiles || got.Added != MaxDiffStatFiles {
+		t.Fatalf("file bound: %+v", got)
+	}
+}
+
+// A change whose numstat output exceeds the byte bound is reported truncated with
+// the complete records read, never as the whole change.
+func TestDiffNumstatOutputBoundIsTruncated(t *testing.T) {
+	lab, workspace, base, _ := numstatRepo(t)
+	// Long names make the output exceed MaxDiffStatBytes with few files.
+	name := strings.Repeat("n", 200)
+	files := MaxDiffStatBytes/len(name) + 64
+	for i := 0; i < files; i++ {
+		if err := os.WriteFile(filepath.Join(workspace, fmt.Sprintf("%s-%06d", name, i)), []byte("x\n"), 0600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	testGit(t, workspace, "add", "-A")
+	testGit(t, workspace, "-c", "user.name=Test", "-c", "user.email=test@example.test", "-c", "commit.gpgsign=false", "commit", "-qm", "many")
+	tree := testGit(t, workspace, "rev-parse", "HEAD^{tree}")
+	got, err := DiffNumstat(context.Background(), lab, workspace, base, tree)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !got.Truncated || got.Files == 0 || got.Files >= files {
+		t.Fatalf("over the byte bound: %+v of %d files", got, files)
+	}
+}
diff --git a/lab/internal/ui/amend.go b/lab/internal/ui/amend.go
new file mode 100644
index 0000000..24d1e49
--- /dev/null
+++ b/lab/internal/ui/amend.go
@@ -0,0 +1,212 @@
+package ui
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/DanielNetzer/forgecell/lab/internal/molecule"
+	"github.com/DanielNetzer/forgecell/lab/internal/readiness"
+)
+
+// POST /api/molecules/{id}/amend {"digest","addAcceptance","addScope"} is
+// Request changes: it records a successor revision of the plan waiting for
+// approval through molecule.AmendFromLatest, the engine path of forgecell amend
+// --add-acceptance and --add-scope PATH --reason TEXT, without --run. It never
+// approves: the new revision waits for its own exact approval through the scope
+// gate. It has the gate write protection (cookie, tab header, exact Origin,
+// Fetch Metadata and one strict JSON object of at most 4 KiB), refuses a digest
+// that is not the one waiting the way the scope gate does, and serves only fixed
+// refusal categories. Committed comes only from the ledger read-back recording
+// a successor of exactly the submitted digest.
+
+// AmendAction is the action name /api/lab lists for the Request changes route.
+const AmendAction = "request plan changes"
+
+const (
+	// maxUIAmendAdditions bounds the acceptance notes and the scope paths of one
+	// request; the engine allows more, the form sends one of each at most.
+	maxUIAmendAdditions = 8
+	// maxUIAmendText bounds one acceptance note or scope reason in bytes.
+	maxUIAmendText = 1000
+	// amendTimeout keeps an amendment inside the server's write timeout.
+	amendTimeout = 45 * time.Second
+)
+
+type amendScope struct {
+	Path   string `json:"path"`
+	Reason string `json:"reason"`
+}
+
+type amendRequest struct {
+	Digest        string       `json:"digest"`
+	AddAcceptance []string     `json:"addAcceptance"`
+	AddScope      []amendScope `json:"addScope"`
+}
+
+// engineAmend is the CLI's amend request for the same additions: --add-scope
+// PATH --reason TEXT pairs and --add-acceptance TEXT, in order, and nothing else
+// (no note, continuation, accepted tree or --run).
+func (q amendRequest) engineAmend() molecule.AmendRequest {
+	var req molecule.AmendRequest
+	for _, s := range q.AddScope {
+		req.AddScope = append(req.AddScope, molecule.ScopeAddition{Path: s.Path, Reason: s.Reason})
+	}
+	req.AddAcceptance = append(req.AddAcceptance, q.AddAcceptance...)
+	return req
+}
+
+// valid checks what the engine would refuse anyway, so a malformed request never
+// reaches it: at least one addition, bounded counts and text, exact repository
+// paths and no path twice.
+func (q amendRequest) valid() bool {
+	if len(q.AddAcceptance)+len(q.AddScope) == 0 || len(q.AddAcceptance) > maxUIAmendAdditions || len(q.AddScope) > maxUIAmendAdditions {
+		return false
+	}
+	for _, a := range q.AddAcceptance {
+		if readiness.ValidateOperatorText(a, maxUIAmendText) != nil {
+			return false
+		}
+	}
+	seen := map[string]bool{}
+	for _, s := range q.AddScope {
+		if readiness.ValidatePath(s.Path) != nil || readiness.ValidateOperatorText(s.Reason, maxUIAmendText) != nil || seen[s.Path] {
+			return false
+		}
+		seen[s.Path] = true
+	}
+	return true
+}
+
+// AmendView is every accepted Request changes response. Committed is true only
+// when the ledger read back holds a revision whose parent is the submitted digest
+// and waits for approval; Digest and Revision are that revision's.
+type AmendView struct {
+	MoleculeID string        `json:"moleculeId"`
+	Committed  bool          `json:"committed"`
+	Revision   int           `json:"revision,omitempty"`
+	Digest     string        `json:"digest,omitempty"`
+	Canonical  MoleculeState `json:"canonical"`
+}
+
+// amendRefusal is one fixed refusal for engine error text that names its cause;
+// its reason is categoryReasons[category].
+type amendRefusal struct {
+	parts             []string
+	code              int
+	category, message string
+}
+
+var amendRefusals = []amendRefusal{
+	{[]string{"already in scope", "acceptance item already present"}, http.StatusConflict, "duplicate", "the plan already lists that path or acceptance note; nothing was recorded"},
+	{[]string{"unsafe repository path", "needs evidence for its parent component", readiness.InScopeDefinitionMessage}, http.StatusUnprocessableEntity, "scope-refused", "the engine refused that scope path: it is unsafe, a frozen check definition, or no frozen manifest covers it; nothing was recorded"},
+	{[]string{"coding checkout unavailable"}, http.StatusConflict, "checkout", "the coding checkout is unavailable; nothing was recorded"},
+	{[]string{"is locked", "lock could not be taken"}, http.StatusConflict, "locked", "the Molecule is locked by another command or a loop; nothing was recorded"},
+}
+
+// amendStaleMessage is the stale refusal of Request changes, before or inside the
+// engine lock: the plan shown is no longer the latest.
+const amendStaleMessage = "a newer plan exists: this plan digest is not the one waiting for approval; reload the Molecule and review the current plan"
+
+// refuseRetiredAmend refuses Request changes on a retired Molecule before the
+// engine, which refuses it too, and reports whether it did.
+func (h *handler) refuseRetiredAmend(w http.ResponseWriter, r molecule.Record) bool {
+	if r.Status != molecule.StatusRetired && r.Retired == nil {
+		return false
+	}
+	h.refuseWith(w, http.StatusConflict, "retired", "this Molecule is retired; nothing was recorded", "Start a new Molecule for the Issue; a retired Molecule keeps every record but is never resumed")
+	return true
+}
+
+func (h *handler) amendPlan(w http.ResponseWriter, r molecule.Record, req amendRequest) {
+	if !sha256Hex.MatchString(req.Digest) || !req.valid() {
+		h.refuseGate(w, http.StatusBadRequest, "invalid", "give the exact plan digest shown and an acceptance note or a scope path with a one-line reason")
+		return
+	}
+	if h.refuseRetiredAmend(w, r) {
+		return
+	}
+	// One amendment at a time from this UI, so the waiting digest checked here is
+	// the parent the engine amends.
+	h.amendMu.Lock()
+	defer h.amendMu.Unlock()
+	record, err := h.records(h.opts.LabDir, r.ID)
+	if err != nil {
+		h.refuseGate(w, http.StatusUnprocessableEntity, "refused", "the ledger was refused: it is invalid, unsafe, oversized or not this Lab's")
+		return
+	}
+	if h.refuseRetiredAmend(w, record) {
+		return
+	}
+	if digest, pending := pendingDigest(record); !pending || req.Digest != digest {
+		h.refuseGate(w, http.StatusConflict, "stale", amendStaleMessage)
+		return
+	}
+	if h.jobs.busy(record.ID) {
+		h.refuseGate(w, http.StatusConflict, "busy", "a gate job is still running for this Molecule; nothing was recorded")
+		return
+	}
+	ctx, cancel := context.WithTimeout(h.jobs.ctx, amendTimeout)
+	defer cancel()
+	// The engine rechecks the shown digest under its lock, so a revision another
+	// command recorded after the check above is refused as stale too.
+	engineReq := req.engineAmend()
+	engineReq.ExpectParent = req.Digest
+	if _, err := guardedAmend(ctx, h.amend, h.opts.LabDir, record.ID, engineReq); err != nil {
+		h.amendRefused(w, err)
+		return
+	}
+	h.json(w, http.StatusOK, h.amendView(record.ID, req.Digest))
+}
+
+// guardedAmend runs the engine call; a panic becomes a refusal.
+func guardedAmend(ctx context.Context, amend func(context.Context, string, string, molecule.AmendRequest) (molecule.Record, error), lab, id string, req molecule.AmendRequest) (r molecule.Record, err error) {
+	defer func() {
+		if recover() != nil {
+			err = errGatePanic
+		}
+	}()
+	return amend(ctx, lab, id, req)
+}
+
+// amendRefused maps an engine error to a fixed category; its text is never served.
+func (h *handler) amendRefused(w http.ResponseWriter, err error) {
+	switch {
+	case errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded):
+		h.refuseGate(w, http.StatusServiceUnavailable, "interrupted", "the request was interrupted before the engine finished; read the Molecule back before trying again")
+		return
+	case errors.Is(err, molecule.ErrMoleculeRetired):
+		h.refuseWith(w, http.StatusConflict, "retired", "this Molecule is retired; nothing was recorded", "Start a new Molecule for the Issue; a retired Molecule keeps every record but is never resumed")
+		return
+	case errors.Is(err, molecule.ErrStalePlan):
+		h.refuseGate(w, http.StatusConflict, "stale", amendStaleMessage)
+		return
+	}
+	text := err.Error()
+	for _, a := range amendRefusals {
+		for _, p := range a.parts {
+			if strings.Contains(text, p) {
+				h.refuseGate(w, a.code, a.category, a.message)
+				return
+			}
+		}
+	}
+	h.refuseGate(w, http.StatusUnprocessableEntity, "refused", "the engine refused the request; nothing else was attempted")
+}
+
+// amendView reads the ledger back: committed once the latest plan is a successor
+// of parent and waits for approval.
+func (h *handler) amendView(id, parent string) AmendView {
+	v := AmendView{MoleculeID: id, Canonical: h.moleculeState(id)}
+	record, err := h.records(h.opts.LabDir, id)
+	if err != nil || record.Readiness == nil || len(record.Readiness.Plans) == 0 {
+		return v
+	}
+	latest := record.Readiness.Plans[len(record.Readiness.Plans)-1]
+	if digest, pending := pendingDigest(record); pending && digest == latest.Digest && latest.Plan.ParentDigest == parent && sha256Hex.MatchString(latest.Digest) {
+		v.Committed, v.Revision, v.Digest = true, latest.Plan.Revision, latest.Digest
+	}
+	return v
+}
diff --git a/lab/internal/ui/amend_test.go b/lab/internal/ui/amend_test.go
new file mode 100644
index 0000000..27654d2
--- /dev/null
+++ b/lab/internal/ui/amend_test.go
@@ -0,0 +1,296 @@
+package ui
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"reflect"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/DanielNetzer/forgecell/lab/internal/molecule"
+	"github.com/DanielNetzer/forgecell/lab/internal/readiness"
+)
+
+// fakeAmend replaces the amend seam: it records every call and, unless err is
+// set, appends the successor revision to the ledger as the engine would, so the
+// read-back can see it. No git or harness process starts.
+type fakeAmend struct {
+	mu    sync.Mutex
+	calls []molecule.AmendRequest
+	err   error
+	write bool
+}
+
+func (f *fakeAmend) count() int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return len(f.calls)
+}
+
+var successorDigest = strings.Repeat("5e", 32)
+
+func installAmend(t *testing.T, h http.Handler, f *fakeAmend) *fakeAmend {
+	t.Helper()
+	hh := h.(*handler)
+	hh.amend = func(_ context.Context, lab, id string, req molecule.AmendRequest) (molecule.Record, error) {
+		f.mu.Lock()
+		f.calls = append(f.calls, req)
+		err, write := f.err, f.write
+		f.mu.Unlock()
+		if err != nil {
+			return molecule.Record{}, err
+		}
+		r, rerr := molecule.ReadRecord(lab, id)
+		if rerr != nil {
+			return r, rerr
+		}
+		if write {
+			latest := r.Readiness.Plans[len(r.Readiness.Plans)-1]
+			next := latest.Plan
+			next.Revision, next.ParentDigest = latest.Plan.Revision+1, latest.Digest
+			r.Readiness.Plans = append(r.Readiness.Plans, readiness.Proposal{Plan: next, Digest: successorDigest})
+			if err := saveRecord(lab, r); err != nil {
+				return r, err
+			}
+		}
+		return r, nil
+	}
+	return f
+}
+
+func amendBody(digest string) string {
+	return `{"digest":"` + digest + `","addAcceptance":["The help text names the flag"],"addScope":[{"path":"lab/x/new.go","reason":"New helper"}]}`
+}
+
+// Request changes calls the engine path of forgecell amend with exactly the
+// request the CLI builds for --add-scope lab/x/new.go --reason "New helper"
+// --add-acceptance "The help text names the flag", and nothing else: no note,
+// continuation, accepted tree or --run. It never approves: no scope job runs and
+// the new revision waits for its own approval. Committed comes only from the
+// ledger read-back of a successor of exactly the submitted digest.
+func TestUIAmendRecordsTheCLIRevisionWithoutApproving(t *testing.T) {
+	lab, r, digest := gateFixture(t)
+	h := testHandler(t, Options{LabDir: lab})
+	if reflect.ValueOf(h.(*handler).amend).Pointer() != reflect.ValueOf(molecule.AmendFromLatest).Pointer() {
+		t.Fatal("Request changes is not wired to molecule.AmendFromLatest")
+	}
+	engine := refuseEngine(t, h)
+	f := installAmend(t, h, &fakeAmend{write: true})
+	v := viewOf[AmendView](t, do(t, h, gatePost("/api/molecules/"+r.ID+"/amend", amendBody(digest))), http.StatusOK)
+	cli := molecule.AmendRequest{AddScope: []molecule.ScopeAddition{{Path: "lab/x/new.go", Reason: "New helper"}}, AddAcceptance: []string{"The help text names the flag"}}
+	if f.count() != 1 || f.calls[0].ExpectParent != digest {
+		t.Fatalf("engine request %+v does not expect the shown digest %s", f.calls, digest)
+	}
+	// Apart from the digest the user saw, it is exactly the CLI's request.
+	sent := f.calls[0]
+	sent.ExpectParent = ""
+	if !reflect.DeepEqual(sent, cli) {
+		t.Fatalf("engine request %+v, want the CLI's %+v", sent, cli)
+	}
+	if f.calls[0].Run || f.calls[0].Note != "" || f.calls[0].Continuation != "" || f.calls[0].AcceptTree != "" || f.calls[0].AcceptProtectedFailures {
+		t.Fatalf("Request changes asked for more than the additions: %+v", f.calls[0])
+	}
+	if !v.Committed || v.Revision != 2 || v.Digest != successorDigest || v.MoleculeID != r.ID || v.Canonical.Phase != "scope-waiting" {
+		t.Fatalf("read-back %+v", v)
+	}
+	if scope, _, _ := engine.counts(); scope != 0 || h.(*handler).jobs.busy(r.ID) {
+		t.Fatal("Request changes approved or started a job")
+	}
+	// The detail now waits for approval of the new digest, offered as a new primary.
+	if d := detailOf(t, h, r.ID); d.View.Decision.Primary == nil || d.View.Decision.Primary.Digest != successorDigest {
+		t.Fatalf("after the amendment the decision is %+v", d.View.Decision)
+	}
+	// The old digest is stale now, for Request changes and approval alike.
+	refusalOf(t, do(t, h, gatePost("/api/molecules/"+r.ID+"/amend", amendBody(digest))), http.StatusConflict, "stale")
+	refusalOf(t, do(t, h, gatePost("/api/molecules/"+r.ID+"/scope", `{"digest":"`+digest+`"}`)), http.StatusConflict, "stale")
+	if f.count() != 1 {
+		t.Fatalf("a stale request reached the engine: %d calls", f.count())
+	}
+
+	// An engine that records nothing is never shown as committed.
+	lab2, r2, digest2 := gateFixture(t)
+	h2 := testHandler(t, Options{LabDir: lab2})
+	installAmend(t, h2, &fakeAmend{})
+	if v := viewOf[AmendView](t, do(t, h2, gatePost("/api/molecules/"+r2.ID+"/amend", amendBody(digest2))), http.StatusOK); v.Committed || v.Digest != "" {
+		t.Fatalf("no successor read back, yet %+v", v)
+	}
+}
+
+// Request changes has the gate write protection and a strict body: forged and
+// malformed requests, stale digests, retired Molecules, busy Molecules and
+// sample data never reach the engine, and nothing in the Lab changes.
+func TestUIAmendRefusalsNeverReachTheEngine(t *testing.T) {
+	lab, r, digest := gateFixture(t)
+	h := testHandler(t, Options{LabDir: lab})
+	f := installAmend(t, h, &fakeAmend{write: true})
+	engine := refuseEngine(t, h)
+	before := snapshot(t, lab)
+	path := "/api/molecules/" + r.ID + "/amend"
+	for name, forged := range forgedWrites(path, amendBody(digest)) {
+		if w := do(t, h, forged); w.Code != http.StatusForbidden {
+			t.Errorf("%s: %d %s", name, w.Code, w.Body)
+		}
+	}
+	many := make([]string, maxUIAmendAdditions+1)
+	for i := range many {
+		many[i] = fmt.Sprintf(`"note %d"`, i)
+	}
+	for name, body := range map[string]string{
+		"nothing to add": `{"digest":"` + digest + `","addAcceptance":[],"addScope":[]}`,
+		"approve field":  `{"digest":"` + digest + `","addAcceptance":["x"],"approve":true}`,
+		"run field":      `{"digest":"` + digest + `","addAcceptance":["x"],"run":true}`,
+		"note field":     `{"digest":"` + digest + `","addAcceptance":["x"],"note":"n"}`,
+		"short digest":   `{"digest":"abc","addAcceptance":["x"]}`,
+		"no digest":      `{"addAcceptance":["x"]}`,
+		"blank note":     `{"digest":"` + digest + `","addAcceptance":["  "]}`,
+		"control note":   `{"digest":"` + digest + `","addAcceptance":["a\u0007"]}`,
+		"long note":      `{"digest":"` + digest + `","addAcceptance":["` + strings.Repeat("n", maxUIAmendText+1) + `"]}`,
+		"too many":       `{"digest":"` + digest + `","addAcceptance":[` + strings.Join(many, ",") + `]}`,
+		"traversal":      `{"digest":"` + digest + `","addScope":[{"path":"../x.go","reason":"r"}]}`,
+		"absolute":       `{"digest":"` + digest + `","addScope":[{"path":"/etc/x","reason":"r"}]}`,
+		"git dir":        `{"digest":"` + digest + `","addScope":[{"path":"a/.git/config","reason":"r"}]}`,
+		"option path":    `{"digest":"` + digest + `","addScope":[{"path":"-x","reason":"r"}]}`,
+		"no reason":      `{"digest":"` + digest + `","addScope":[{"path":"lab/x.go","reason":""}]}`,
+		"duplicate path": `{"digest":"` + digest + `","addScope":[{"path":"lab/x.go","reason":"r"},{"path":"lab/x.go","reason":"r"}]}`,
+		"scope extra":    `{"digest":"` + digest + `","addScope":[{"path":"lab/x.go","reason":"r","evidence":["issue"]}]}`,
+		"trailing data":  amendBody(digest) + `{}`,
+		"oversized":      `{"digest":"` + digest + `"` + strings.Repeat(" ", maxGateBody) + `,"addAcceptance":["x"]}`,
+		"form body":      "digest=" + digest,
+	} {
+		q := gatePost(path, body)
+		if name == "form body" {
+			q.header["Content-Type"] = "application/x-www-form-urlencoded"
+		}
+		if w := do(t, h, q); w.Code != http.StatusBadRequest {
+			t.Errorf("%s: %d %s", name, w.Code, w.Body)
+		}
+	}
+	refusalOf(t, do(t, h, gatePost(path, amendBody(strings.Repeat("0", 64)))), http.StatusConflict, "stale")
+	if w := do(t, h, gatePost("/api/molecules/absent/amend", amendBody(digest))); w.Code != http.StatusNotFound {
+		t.Errorf("absent Molecule: %d", w.Code)
+	}
+	if after := snapshot(t, lab); after != before {
+		t.Fatalf("refused requests changed the Lab:\n%s\n---\n%s", before, after)
+	}
+	if f.count() != 0 || engine.calls() != 0 {
+		t.Fatalf("refused requests reached the engine: %d amend, %d gate calls", f.count(), engine.calls())
+	}
+
+	// A running gate job for the Molecule keeps Request changes out.
+	block := make(chan struct{})
+	engine.scope = func(ctx context.Context, _ molecule.Options) error {
+		select {
+		case <-block:
+		case <-ctx.Done():
+		}
+		return nil
+	}
+	jobOf(t, do(t, h, gatePost("/api/molecules/"+r.ID+"/scope", `{"digest":"`+digest+`"}`)), http.StatusAccepted)
+	refusalOf(t, do(t, h, gatePost(path, amendBody(digest))), http.StatusConflict, "busy")
+	close(block)
+	waitJob(t, h, r.ID)
+
+	// A retired Molecule is refused before the engine.
+	retired := r
+	retired.Status = molecule.StatusRetired
+	retired.Retired = &molecule.Retirement{At: "2026-10-26T20:00:00Z", Reason: "stale", PriorStatus: "waiting"}
+	writeRecord(t, lab, retired)
+	if w := do(t, h, gatePost(path, amendBody(digest))); w.Code != http.StatusConflict || !strings.Contains(w.Body.String(), `"category":"retired"`) {
+		t.Fatalf("retired: %d %s", w.Code, w.Body)
+	}
+	if f.count() != 0 {
+		t.Fatalf("a busy or retired request reached the engine %d times", f.count())
+	}
+
+	demo := testHandler(t, Options{Demo: true})
+	installAmend(t, demo, f)
+	refusalOf(t, do(t, demo, gatePost("/api/molecules/demo-101/amend", amendBody(digest))), http.StatusNotFound, "sample")
+	if f.count() != 0 {
+		t.Fatal("sample data reached the engine")
+	}
+}
+
+// Engine refusals are served as fixed categories with actionable reasons; the
+// engine's text, which can name local paths, is never served.
+func TestUIAmendEngineRefusalsShowFixedCategories(t *testing.T) {
+	for text, want := range map[string]struct {
+		code     int
+		category string
+	}{
+		"lab/x/new.go is already in scope":                                  {http.StatusConflict, "duplicate"},
+		"acceptance item already present: x":                                {http.StatusConflict, "duplicate"},
+		`unsafe repository path: "../x"`:                                    {http.StatusUnprocessableEntity, "scope-refused"},
+		"new path x needs evidence for its parent component: no frozen ...": {http.StatusUnprocessableEntity, "scope-refused"},
+		readiness.InScopeDefinitionMessage:                                  {http.StatusUnprocessableEntity, "scope-refused"},
+		"coding checkout unavailable; refresh intake":                       {http.StatusConflict, "checkout"},
+		"Molecule is locked: another approval, amend or recover holds it":   {http.StatusConflict, "locked"},
+		"something else at /Users/someone/lab/ledgers/x.json":               {http.StatusUnprocessableEntity, "refused"},
+	} {
+		lab, r, digest := gateFixture(t)
+		h := testHandler(t, Options{LabDir: lab})
+		f := installAmend(t, h, &fakeAmend{err: errors.New(text)})
+		w := do(t, h, gatePost("/api/molecules/"+r.ID+"/amend", amendBody(digest)))
+		refusalOf(t, w, want.code, want.category)
+		if strings.Contains(w.Body.String(), text) || f.count() != 1 {
+			t.Errorf("%q: served %s after %d calls", text, w.Body, f.count())
+		}
+	}
+	lab, r, digest := gateFixture(t)
+	h := testHandler(t, Options{LabDir: lab})
+	installAmend(t, h, &fakeAmend{err: fmt.Errorf("wrapped: %w", molecule.ErrMoleculeRetired)})
+	if w := do(t, h, gatePost("/api/molecules/"+r.ID+"/amend", amendBody(digest))); w.Code != http.StatusConflict || !strings.Contains(w.Body.String(), `"category":"retired"`) {
+		t.Fatalf("engine retired refusal: %d %s", w.Code, w.Body)
+	}
+	installAmend(t, h, &fakeAmend{err: context.DeadlineExceeded})
+	refusalOf(t, do(t, h, gatePost("/api/molecules/"+r.ID+"/amend", amendBody(digest))), http.StatusServiceUnavailable, "interrupted")
+}
+
+// A plan revision recorded after the UI checked the shown digest, but before the
+// engine call, is refused by molecule.AmendFromLatest under its lock and served as
+// stale, saying a newer plan exists; nothing more is recorded.
+func TestUIAmendRefusesALedgerAdvancedBeforeTheEngine(t *testing.T) {
+	lab, r, digest := gateFixture(t)
+	h := testHandler(t, Options{LabDir: lab})
+	var sent molecule.AmendRequest
+	h.(*handler).amend = func(ctx context.Context, lab, id string, req molecule.AmendRequest) (molecule.Record, error) {
+		sent = req
+		// Another command records a successor between the UI check and this call.
+		advanced, err := molecule.ReadRecord(lab, id)
+		if err != nil {
+			return advanced, err
+		}
+		latest := advanced.Readiness.Plans[len(advanced.Readiness.Plans)-1]
+		next := latest.Plan
+		next.Revision, next.ParentDigest = latest.Plan.Revision+1, latest.Digest
+		advanced.Readiness.Plans = append(advanced.Readiness.Plans, readiness.Proposal{Plan: next, Digest: successorDigest})
+		if err := saveRecord(lab, advanced); err != nil {
+			return advanced, err
+		}
+		return molecule.AmendFromLatest(ctx, lab, id, req)
+	}
+	w := do(t, h, gatePost("/api/molecules/"+r.ID+"/amend", amendBody(digest)))
+	refusalOf(t, w, http.StatusConflict, "stale")
+	if !strings.Contains(w.Body.String(), "a newer plan exists") || sent.ExpectParent != digest {
+		t.Fatalf("stale race served %s for expected parent %q", w.Body, sent.ExpectParent)
+	}
+	after, err := molecule.ReadRecord(lab, r.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := len(after.Readiness.Plans); n != 2 || after.Readiness.Plans[1].Digest != successorDigest {
+		t.Fatalf("the stale amend recorded a revision: %d plans", n)
+	}
+}
+
+// /api/lab lists Request changes, with or without a source checkout.
+func TestUIAmendAction(t *testing.T) {
+	for _, source := range []string{"", "/src/checkout"} {
+		lab := viewOf[LabView](t, do(t, testHandler(t, Options{LabDir: t.TempDir(), SourceRoot: source}), authed("/api/lab")), http.StatusOK)
+		if !reflect.DeepEqual(lab.Actions[len(lab.Actions)-1:], []string{AmendAction}) || len(lab.Gates) != 2 {
+			t.Errorf("source %q: actions %v gates %v", source, lab.Actions, lab.Gates)
+		}
+	}
+}
diff --git a/lab/internal/ui/diffsize.go b/lab/internal/ui/diffsize.go
new file mode 100644
index 0000000..8e0c8f8
--- /dev/null
+++ b/lab/internal/ui/diffsize.go
@@ -0,0 +1,102 @@
+package ui
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"github.com/DanielNetzer/forgecell/lab/internal/molecule"
+)
+
+// Diff size states: measured from the captured tree, nothing captured yet, or
+// not measurable now (no workspace, an invalid id or a git failure).
+const (
+	DiffMeasured    = "measured"
+	DiffNone        = "none"
+	DiffUnavailable = "unavailable"
+)
+
+// DiffSizeView is the "+412 −96 in 4 files" line of the review and decision
+// cards: git diff --numstat of the Molecule's captured tree against its base
+// commit, computed on demand by the engine and never taken from ledger text.
+// Truncated means a bound stopped the count, so the numbers are a lower bound.
+type DiffSizeView struct {
+	State     string `json:"state"`
+	Files     int    `json:"files,omitempty"`
+	Added     int64  `json:"added,omitempty"`
+	Removed   int64  `json:"removed,omitempty"`
+	Binary    int    `json:"binary,omitempty"`
+	Truncated bool   `json:"truncated,omitempty"`
+}
+
+const (
+	// maxDiffCache bounds the sizes kept; the oldest is dropped first.
+	maxDiffCache = 128
+	// diffSizeTimeout bounds one measurement inside the server's write timeout.
+	diffSizeTimeout = 25 * time.Second
+)
+
+// diffCache keeps each measured size by base commit and tree: those object ids
+// name the exact content, so a size never goes stale. Failures are not kept.
+type diffCache struct {
+	mu      sync.Mutex
+	entries map[string]molecule.DiffStat
+	order   []string
+}
+
+func newDiffCache() *diffCache { return &diffCache{entries: map[string]molecule.DiffStat{}} }
+
+func (c *diffCache) get(key string) (molecule.DiffStat, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	s, ok := c.entries[key]
+	return s, ok
+}
+
+func (c *diffCache) put(key string, s molecule.DiffStat) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if _, ok := c.entries[key]; ok {
+		return
+	}
+	for len(c.order) >= maxDiffCache {
+		delete(c.entries, c.order[0])
+		c.order = c.order[1:]
+	}
+	c.entries[key] = s
+	c.order = append(c.order, key)
+}
+
+// diffBase is the base commit the captured tree is measured against: the latest
+// plan's frozen base, else the workspace's.
+func diffBase(r molecule.Record) string {
+	if r.Readiness != nil && len(r.Readiness.Plans) > 0 {
+		if b := r.Readiness.Plans[len(r.Readiness.Plans)-1].Plan.Inputs.BaseCommit; b != "" {
+			return b
+		}
+	}
+	return r.Workspace.BaseCommit
+}
+
+// diffSize measures the record's captured tree, from the cache when this exact
+// base and tree were measured before. Nothing captured, or a capture with no
+// change, is DiffNone without running git.
+func (h *handler) diffSize(ctx context.Context, r molecule.Record) DiffSizeView {
+	if r.Capture == nil || r.Capture.Tree == "" || len(r.Capture.Changes) == 0 {
+		return DiffSizeView{State: DiffNone}
+	}
+	base, tree := diffBase(r), r.Capture.Tree
+	key := base + ":" + tree
+	s, ok := h.diffs.get(key)
+	if !ok {
+		ctx, cancel := context.WithTimeout(ctx, diffSizeTimeout)
+		defer cancel()
+		var err error
+		if s, err = h.numstat(ctx, h.opts.LabDir, r.Workspace.Path, base, tree); err != nil {
+			// The error is a fixed engine category; it is not served.
+			return DiffSizeView{State: DiffUnavailable}
+		}
+		h.diffs.put(key, s)
+	}
+	return DiffSizeView{State: DiffMeasured, Files: s.Files, Added: s.Added, Removed: s.Removed, Binary: s.Binary, Truncated: s.Truncated}
+}
diff --git a/lab/internal/ui/drive.go b/lab/internal/ui/drive.go
index 6716535..49e57bf 100644
--- a/lab/internal/ui/drive.go
+++ b/lab/internal/ui/drive.go
@@ -332,16 +332,7 @@ func (h *handler) stopMolecule(w http.ResponseWriter, id string) {
 		h.refuseGate(w, http.StatusConflict, "not-running", "the ledger does not show this Molecule running; nothing was signalled")
 		return
 	}
-	stopped := h.jobs.cancelRunning(id, []string{"scope"}, func(time.Time) bool { return true })
-	if !stopped && record.Issue.Number >= 1 && record.Issue.Number <= maxIssueNumber {
-		key := runKey(record.Issue.Number)
-		if j, ok := h.jobs.get(key); ok && j.state == "running" {
-			if owned, found, _ := h.runMolecule(record.Issue.Number, j.started); found && owned == id {
-				stopped = h.jobs.cancelRunning(key, []string{"run"}, j.started.Equal)
-			}
-		}
-	}
-	if !stopped {
+	if runner := h.runner(record, true); runner != RunnerScope && runner != RunnerRun {
 		h.refuseGate(w, http.StatusConflict, "not-owned", "this Lab UI does not run this Molecule's engine call (a loop, another process or the CLI does); nothing was signalled")
 		return
 	}
@@ -350,6 +341,126 @@ func (h *handler) stopMolecule(w http.ResponseWriter, id string) {
 	h.json(w, http.StatusAccepted, v)
 }
 
+// Runners of a running Molecule's engine call, as the Molecule view names them.
+const (
+	// RunnerScope is a scope approval job of this Lab UI; Stop cancels it.
+	RunnerScope = "scope"
+	// RunnerRun is a run job of this Lab UI whose ledger this is; Stop cancels it.
+	RunnerRun = "run"
+	// RunnerLoop is this Lab UI's loop, whose current pass works on the Molecule
+	// (driveLoop.works). One Molecule of a loop is not stopped on its own: the
+	// loop is.
+	RunnerLoop = "loop"
+	// RunnerOther is the command line, another Lab UI or another process.
+	RunnerOther = "other"
+)
+
+// runner names who runs a running Molecule's engine call. It is the ownership
+// check of stopMolecule: with cancel it also cancels the job this Lab UI owns,
+// under the same lock as the check; without it, it only reads.
+func (h *handler) runner(record molecule.Record, cancel bool) string {
+	owned := func(key string, kinds []string, owns func(time.Time) bool) bool {
+		if cancel {
+			return h.jobs.cancelRunning(key, kinds, owns)
+		}
+		return h.jobs.ownsRunning(key, kinds, owns)
+	}
+	if owned(record.ID, []string{"scope"}, func(time.Time) bool { return true }) {
+		return RunnerScope
+	}
+	if record.Issue.Number >= 1 && record.Issue.Number <= maxIssueNumber {
+		key := runKey(record.Issue.Number)
+		if j, ok := h.jobs.get(key); ok && j.state == "running" {
+			if id, found, _ := h.runMolecule(record.Issue.Number, j.started); found && id == record.ID && owned(key, []string{"run"}, j.started.Equal) {
+				return RunnerRun
+			}
+		}
+	}
+	if h.loop.works(record) {
+		return RunnerLoop
+	}
+	return RunnerOther
+}
+
+// loopPass is what this UI's loop pass works on: for each Issue the pass
+// dispatches, keyed by issueKey, the Molecules it leaves alone. The engine starts
+// a Molecule only for an Issue with none and advances only one waiting at the
+// scope gate; every other Molecule of a dispatched Issue it only reports.
+type loopPass map[string]map[string]bool
+
+func issueKey(repo string, number int64) string {
+	return strings.ToLower(repo) + "#" + strconv.FormatInt(number, 10)
+}
+
+// observePass records the pass about to dispatch eligible. Ledgers that existed
+// when it listed and were not at the scope gate are left alone. An incomplete
+// ledger inventory records no pass, so no Molecule is named the loop's.
+func (h *handler) observePass(eligible []intake.OpenIssue) {
+	list := h.list(ledgerETag(h.opts.LabDir))
+	var pass loopPass
+	if list.Complete && !list.Truncated {
+		pass = loopPass{}
+		for _, issue := range eligible {
+			pass[issueKey(issue.Repository, issue.Number)] = map[string]bool{}
+		}
+		for _, m := range list.Molecules {
+			if alone, ok := pass[issueKey(m.Repository, m.Number)]; ok && m.Phase != "scope-waiting" {
+				alone[m.ID] = true
+			}
+		}
+	}
+	h.loop.mu.Lock()
+	h.loop.pass = pass
+	h.loop.mu.Unlock()
+}
+
+// works reports whether this UI's loop is running and its current pass works on
+// record: a Molecule it started for a dispatched Issue, or one it found waiting
+// at the scope gate. A running loop alone never makes a Molecule its own.
+func (l *driveLoop) works(record molecule.Record) bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if !l.running {
+		return false
+	}
+	alone, ok := l.pass[issueKey(record.Issue.Repo, record.Issue.Number)]
+	return ok && !alone[record.ID]
+}
+
+// ControlView is what the Molecule view may do with a running Molecule.
+// Stoppable is true only when this Lab UI runs its engine call; otherwise Text
+// names the runner in plain words and the view offers no Stop.
+type ControlView struct {
+	Stoppable bool   `json:"stoppable"`
+	Runner    string `json:"runner"`
+	Text      string `json:"text,omitempty"`
+}
+
+// runningWork is the plain words of what a running Molecule is doing at step.
+var runningWork = map[int]string{StepPlan: "Its plan is being written", StepCoding: "Its coding is running", StepChecks: "Its checks are running", StepReview: "Its review is running", StepDraft: "Its draft PR is being prepared"}
+
+// control is the stop control of a running Molecule at step, or nil when the
+// ledger does not show it running. It only reads.
+func (h *handler) control(record molecule.Record, step int) *ControlView {
+	if !active(record.Status) {
+		return nil
+	}
+	c := &ControlView{Runner: h.runner(record, false)}
+	work, ok := runningWork[step]
+	if !ok {
+		work = "It is running"
+	}
+	switch c.Runner {
+	case RunnerScope, RunnerRun:
+		c.Stoppable = true
+	case RunnerLoop:
+		c.Text = "Run by this Lab's loop. " + work + "; stop the loop to stop it. Nothing needs you."
+	default:
+		c.Text = "Started from the command line or another Lab UI. " + work + "; nothing needs you."
+	}
+	return c
+}
+
 var (
 	errLoopBusy   = errors.New("a loop is running in this Lab UI")
 	errRunsBusy   = errors.New("a run is running in this Lab UI")
@@ -386,6 +497,8 @@ type driveLoop struct {
 	// freed, a test seam, runs once a loop's slot reads as free, before done
 	// closes; the Lab's marker must already be released by then.
 	freed func()
+	// pass is what the running loop's current pass works on (observePass).
+	pass loopPass
 }
 
 // start refuses while runsBusy reports a UI run job running; the check and the
@@ -417,7 +530,7 @@ func (l *driveLoop) start(o molecule.LoopOptions, runsBusy func() bool, run func
 	// The stop request closes Drain only; Work is cancelled only with the server.
 	o.Drain, o.Work, o.Marker = drained, ctx, marker
 	l.running, l.drain, l.drained, l.cancel, l.done = true, false, drained, cancel, done
-	l.selector, l.max, l.report, l.token = o.Select.String(), o.MaxConcurrent, nil, marker.Token()
+	l.selector, l.max, l.report, l.token, l.pass = o.Select.String(), o.MaxConcurrent, nil, marker.Token(), nil
 	l.state, l.category, l.message, l.reason = "running", "", "", ""
 	freed := l.freed
 	go func() {
@@ -433,7 +546,7 @@ func (l *driveLoop) start(o molecule.LoopOptions, runsBusy func() bool, run func
 		// never meets this loop's own marker.
 		marker.Release()
 		l.mu.Lock()
-		l.running, l.report = false, &report
+		l.running, l.report, l.pass = false, &report, nil
 		l.state, l.category, l.message, l.reason = state, category, message, reason
 		l.mu.Unlock()
 		if freed != nil {
@@ -508,6 +621,17 @@ func (h *handler) startLoop(w http.ResponseWriter, req loopRequest) {
 		return
 	}
 	o := molecule.LoopOptions{Template: molecule.Options{LabDir: h.opts.LabDir, SourceRoot: h.opts.SourceRoot, Resources: h.opts.Resources}, Select: selector, MaxConcurrent: req.MaxConcurrent}
+	// Each pass lists first, so the listing marks which Molecules it works on. A
+	// failed or refused listing dispatches nothing, and records an empty pass.
+	o.ListIssues = func(ctx context.Context, repository string) (intake.OpenIssues, error) {
+		listed, err := h.listIssues(ctx, repository, selector)
+		var eligible []intake.OpenIssue
+		if err == nil && (!listed.Truncated || selector.Kind == "" || selector.Kind == intake.SelectOldest) {
+			eligible = selector.Apply(listed.Issues)
+		}
+		h.observePass(eligible)
+		return listed, err
+	}
 	switch err := h.loop.start(o, func() bool { return h.jobs.running("run") }, h.runLoop); {
 	case errors.Is(err, errLoopBusy):
 		h.refuseGate(w, http.StatusConflict, "busy", "a loop is already running in this Lab UI; this submission was not started")
diff --git a/lab/internal/ui/drive_test.go b/lab/internal/ui/drive_test.go
index c4647c5..2adf674 100644
--- a/lab/internal/ui/drive_test.go
+++ b/lab/internal/ui/drive_test.go
@@ -28,6 +28,8 @@ type fakeDrive struct {
 	loops []molecule.LoopOptions
 	run   func(context.Context, molecule.Options) error
 	loop  func(context.Context, molecule.LoopOptions) (molecule.LoopReport, error)
+	// issues is what the loop's open Issue listing returns.
+	issues []intake.OpenIssue
 }
 
 func (d *fakeDrive) calls() int {
@@ -38,6 +40,11 @@ func (d *fakeDrive) calls() int {
 
 func installDrive(h http.Handler, d *fakeDrive) *fakeDrive {
 	hh := h.(*handler)
+	hh.listIssues = func(context.Context, string, intake.Selector) (intake.OpenIssues, error) {
+		d.mu.Lock()
+		defer d.mu.Unlock()
+		return intake.OpenIssues{Issues: append([]intake.OpenIssue(nil), d.issues...)}, nil
+	}
 	hh.runIssue = func(ctx context.Context, o molecule.Options) (molecule.Record, error) {
 		d.mu.Lock()
 		d.runs = append(d.runs, o)
@@ -399,6 +406,11 @@ func TestUIDriveStopsOnlyAMoleculeThisUIRuns(t *testing.T) {
 		finished <- saveRecord(lab, r)
 		return nil
 	}})
+	// The CLI's running Molecule offers no Stop: the view names its runner.
+	wantControl(t, h, "mol-9-cli", false, RunnerOther, "Started from the command line or another Lab UI. ")
+	if d := detailOf(t, h, base.ID); d.View.Control != nil {
+		t.Fatalf("a Molecule that is not running has a stop control %+v", d.View.Control)
+	}
 	// The crash leftover and the CLI's ledger are refused before any job runs.
 	refusalOf(t, do(t, h, gatePost("/api/molecules/mol-9-cli/stop", `{}`)), http.StatusConflict, "not-owned")
 	refusalOf(t, do(t, h, gatePost("/api/molecules/mol-1-none/stop", `{}`)), http.StatusNotFound, "missing")
@@ -412,6 +424,10 @@ func TestUIDriveStopsOnlyAMoleculeThisUIRuns(t *testing.T) {
 	writeRecord(t, lab, intakeRecord(base, "mol-42-old", 42, "2000-01-01T00:00:00Z", "running", ""))
 	refusalOf(t, do(t, h, gatePost("/api/molecules/mol-42-old/stop", `{}`)), http.StatusConflict, "not-owned")
 	refusalOf(t, do(t, h, gatePost("/api/molecules/mol-9-cli/stop", `{}`)), http.StatusConflict, "not-owned")
+	// The view offers Stop for this UI's run only, and reading it signals nothing.
+	wantControl(t, h, "mol-42-live", true, RunnerRun, "")
+	wantControl(t, h, "mol-42-old", false, RunnerOther, "Started from the command line or another Lab UI. ")
+	wantControl(t, h, "mol-9-cli", false, RunnerOther, "Started from the command line or another Lab UI. ")
 	select {
 	case <-cancelled:
 		t.Fatal("a refused stop signalled the run")
@@ -435,6 +451,101 @@ func TestUIDriveStopsOnlyAMoleculeThisUIRuns(t *testing.T) {
 	}
 }
 
+// wantControl checks the Molecule view's stop control for id.
+func wantControl(t *testing.T, h http.Handler, id string, stoppable bool, runner, textPrefix string) {
+	t.Helper()
+	c := detailOf(t, h, id).View.Control
+	if c == nil || c.Stoppable != stoppable || c.Runner != runner || !strings.HasPrefix(c.Text, textPrefix) || (stoppable && c.Text != "") || (!stoppable && !strings.HasSuffix(c.Text, "nothing needs you.") && !strings.HasSuffix(c.Text, "Nothing needs you.")) {
+		t.Fatalf("%s: control %+v, want stoppable=%t runner %q", id, c, stoppable, runner)
+	}
+}
+
+// A Molecule the UI loop's pass works on offers no Stop of its own: the view says
+// the loop runs it and that the loop is what to stop. A running loop alone never
+// makes a Molecule its own: one the command line runs, for an Issue the loop
+// listed or not, is named as run from the command line.
+func TestUIDriveLoopMoleculeOffersNoStop(t *testing.T) {
+	lab, base := labFixture(t)
+	running, release := make(chan struct{}), make(chan struct{})
+	gate := intakeRecord(base, "mol-6-gate", 6, now(), "waiting", "scope-waiting")
+	cli := intakeRecord(base, "mol-8-cli", 8, now(), "running", "coding")
+	other := intakeRecord(base, "mol-9-cli", 9, now(), "running", "coding")
+	issues := []intake.OpenIssue{{Repository: "O/R", Number: 5}, {Repository: "o/r", Number: 6}, {Repository: "o/r", Number: 8}}
+	h, _ := driveHandler(t, lab, guardWith(64<<30), &fakeDrive{issues: issues, loop: func(ctx context.Context, o molecule.LoopOptions) (molecule.LoopReport, error) {
+		_, err := o.ListIssues(ctx, "o/r")
+		// The pass starts a Molecule for Issue 5 and approves the one at the gate.
+		approved := gate
+		approved.Status, approved.Readiness = "running", &readiness.State{SchemaVersion: "v1", Phase: "coding"}
+		if err == nil {
+			err = saveRecord(lab, intakeRecord(base, "mol-5-loop", 5, now(), "running", "coding"))
+		}
+		if err == nil {
+			err = saveRecord(lab, approved)
+		}
+		close(running)
+		select {
+		case <-release:
+		case <-ctx.Done():
+		}
+		return molecule.LoopReport{}, err
+	}})
+	for _, r := range []molecule.Record{gate, cli, other} {
+		writeRecord(t, lab, r)
+	}
+	wantControl(t, h, "mol-8-cli", false, RunnerOther, "Started from the command line or another Lab UI. ")
+	viewOf[LoopView](t, do(t, h, gatePost("/api/loop/start", `{"select":"oldest","maxConcurrent":1}`)), http.StatusAccepted)
+	<-running
+	for _, id := range []string{"mol-5-loop", "mol-6-gate"} {
+		wantControl(t, h, id, false, RunnerLoop, "Run by this Lab's loop. ")
+		refusalOf(t, do(t, h, gatePost("/api/molecules/"+id+"/stop", `{}`)), http.StatusConflict, "not-owned")
+	}
+	// The loop runs, on other Molecules; the CLI's are still the command line's.
+	wantControl(t, h, "mol-8-cli", false, RunnerOther, "Started from the command line or another Lab UI. ")
+	wantControl(t, h, "mol-9-cli", false, RunnerOther, "Started from the command line or another Lab UI. ")
+	close(release)
+	waitLoop(t, h)
+	wantControl(t, h, "mol-5-loop", false, RunnerOther, "Started from the command line or another Lab UI. ")
+}
+
+// A pass whose ledger inventory or listing cannot say what it works on names no
+// Molecule the loop's, and a new pass replaces the last one.
+func TestUIDriveLoopPassFailsSafe(t *testing.T) {
+	lab, base := labFixture(t)
+	h, _ := driveHandler(t, lab, nil, &fakeDrive{})
+	hh := h.(*handler)
+	r := intakeRecord(base, "mol-5-loop", 5, now(), "running", "coding")
+	five := []intake.OpenIssue{{Repository: "o/r", Number: 5}}
+	hh.loop.running = true
+	hh.observePass(five)
+	writeRecord(t, lab, r)
+	if !hh.loop.works(r) {
+		t.Fatal("a Molecule new to a dispatched Issue is not the loop's")
+	}
+	hh.loop.running = false
+	if hh.loop.works(r) {
+		t.Fatal("a stopped loop still works on a Molecule")
+	}
+	hh.loop.running = true
+	hh.observePass(nil)
+	if hh.loop.works(r) {
+		t.Fatal("a Molecule of an earlier pass is still the loop's")
+	}
+	// A later pass finds it running and only reports it.
+	hh.observePass(five)
+	if hh.loop.works(r) {
+		t.Fatal("a running Molecule a pass found is the loop's")
+	}
+	// An incomplete inventory records no pass.
+	if err := os.WriteFile(filepath.Join(lab, "ledgers", "mol-4-bad.json"), []byte("{"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	hh.observePass(five)
+	if hh.loop.pass != nil || hh.loop.works(r) {
+		t.Fatalf("an incomplete inventory recorded pass %+v", hh.loop.pass)
+	}
+	hh.loop.running = false
+}
+
 func TestUIDriveStopsAScopeApprovalJob(t *testing.T) {
 	lab, r, digest := gateFixture(t)
 	h, _ := driveHandler(t, lab, nil, &fakeDrive{})
@@ -449,6 +560,10 @@ func TestUIDriveStopsAScopeApprovalJob(t *testing.T) {
 	// The approved Molecule is coding.
 	r.Status = "running"
 	writeRecord(t, lab, r)
+	wantControl(t, h, r.ID, true, RunnerScope, "")
+	if s, _ := h.(*handler).jobs.get(r.ID); s.state != "running" {
+		t.Fatalf("reading the stop control changed the scope job %+v", s)
+	}
 	if v := viewOf[StopView](t, do(t, h, gatePost("/api/molecules/"+r.ID+"/stop", `{}`)), http.StatusAccepted); !v.Requested || v.Committed || v.Canonical.Status != "running" {
 		t.Fatalf("stop %+v", v)
 	}
diff --git a/lab/internal/ui/estimate.go b/lab/internal/ui/estimate.go
new file mode 100644
index 0000000..997d098
--- /dev/null
+++ b/lab/internal/ui/estimate.go
@@ -0,0 +1,159 @@
+package ui
+
+import (
+	"fmt"
+	"math"
+	"sort"
+
+	"github.com/DanielNetzer/forgecell/lab/internal/molecule"
+)
+
+// Estimates ("usually 30–45 min", "~$4") come only from this Lab's own
+// history: the median and interquartile range of the active Atom time (the
+// analytics activeMS, not wall time including time waiting for you) and the
+// reported cost of the most recent comparable finished Molecules. Comparable
+// means the same repository and Formula id, in the Finished lane (a published
+// draft receipt) and with its active time recorded; the Decision, Running,
+// Blocked, Other and Retired lanes never count. An estimate is hidden below
+// minEstimateBasis Molecules, always names its basis, and is never zero-filled:
+// cost uses only attempts that reported one and says when coverage is partial.
+const (
+	// estimateWindow is how many of the most recent comparable Molecules count.
+	estimateWindow = 20
+	// minEstimateBasis is the fewest comparable Molecules an estimate needs.
+	minEstimateBasis = 5
+)
+
+// EstimateView is the estimate shown beside a decision. Shown is false, with
+// Time and Cost absent, when the basis is too small.
+type EstimateView struct {
+	Shown     bool           `json:"shown"`
+	Molecules int            `json:"molecules"`
+	Basis     string         `json:"basis"`
+	Time      *TimeRangeView `json:"time,omitempty"`
+	Cost      *CostRangeView `json:"cost,omitempty"`
+	Note      string         `json:"note"`
+}
+
+// TimeRangeView is the active-time quartiles in milliseconds: Low is the first
+// quartile, High the third.
+type TimeRangeView struct {
+	LowMS    int64 `json:"lowMs"`
+	MedianMS int64 `json:"medianMs"`
+	HighMS   int64 `json:"highMs"`
+}
+
+// CostRangeView is the reported-cost quartiles in USD over the Molecules that
+// reported a cost. Partial means some attempts of the basis reported none, so
+// the cost undercounts them; Coverage says how many.
+type CostRangeView struct {
+	LowUSD    float64 `json:"lowUsd"`
+	MedianUSD float64 `json:"medianUsd"`
+	HighUSD   float64 `json:"highUsd"`
+	Molecules int     `json:"molecules"`
+	Partial   bool    `json:"partial"`
+	Coverage  string  `json:"coverage"`
+}
+
+// estimateNote is said with every shown estimate: it is history, not a promise.
+const estimateNote = "From this Lab's own history; not a promise."
+
+// comparableTo reports a Summary that counts toward an estimate for a Molecule
+// of repo and formulaID, other than self.
+func comparableTo(s Summary, f *moleculeFacts, repo, formulaID, self string) bool {
+	return s.ID != self && s.Repository == repo && s.FormulaID == formulaID && repo != "" && formulaID != "" && f != nil && f.activeOK && f.activeMS >= 0 && s.Lane == LaneFinished
+}
+
+// estimateBasis is the basis label of an estimate over n Molecules.
+func estimateBasis(n int) string {
+	return fmt.Sprintf("based on your last %d finished Molecules · active time, not time waiting for you", n)
+}
+
+// estimate derives the estimate for self from one inventory. It only reads inv.
+func estimate(inv inventory, repo, formulaID, self string) EstimateView {
+	type sample struct {
+		id    string
+		end   int64
+		facts *moleculeFacts
+	}
+	var all []sample
+	for _, s := range inv.list.Molecules {
+		f := inv.facts[s.ID]
+		if comparableTo(s, f, repo, formulaID, self) {
+			// Recency is the finish time; one without a recorded wall time sorts oldest.
+			end := int64(math.MinInt64)
+			if f.wallOK {
+				end = f.wallEnd
+			}
+			all = append(all, sample{id: s.ID, end: end, facts: f})
+		}
+	}
+	sort.Slice(all, func(i, j int) bool {
+		if all[i].end != all[j].end {
+			return all[i].end > all[j].end
+		}
+		return all[i].id < all[j].id
+	})
+	if len(all) > estimateWindow {
+		all = all[:estimateWindow]
+	}
+	n := len(all)
+	if n < minEstimateBasis {
+		return EstimateView{Molecules: n, Note: fmt.Sprintf("Estimates appear once this Lab has published drafts for %d comparable Molecules.", minEstimateBasis)}
+	}
+	active := make([]float64, 0, n)
+	var costs []float64
+	attempts, reported := 0, 0
+	for _, s := range all {
+		active = append(active, float64(s.facts.activeMS))
+		sum, seen := 0.0, false
+		for _, a := range s.facts.attempts {
+			attempts++
+			if a.cost == nil || math.IsNaN(*a.cost) || math.IsInf(*a.cost, 0) || *a.cost < 0 {
+				continue
+			}
+			reported++
+			sum, seen = sum+*a.cost, true
+		}
+		if seen && !math.IsInf(sum, 0) {
+			costs = append(costs, sum)
+		}
+	}
+	v := EstimateView{Shown: true, Molecules: n, Basis: estimateBasis(n), Note: estimateNote}
+	low, mid, high := quartiles(active)
+	v.Time = &TimeRangeView{LowMS: int64(math.Round(low)), MedianMS: int64(math.Round(mid)), HighMS: int64(math.Round(high))}
+	if len(costs) >= minEstimateBasis {
+		low, mid, high := quartiles(costs)
+		v.Cost = &CostRangeView{LowUSD: low, MedianUSD: mid, HighUSD: high, Molecules: len(costs), Partial: reported < attempts || len(costs) < n,
+			Coverage: fmt.Sprintf("cost reported for %d of %d harness attempts", reported, attempts)}
+	}
+	return v
+}
+
+// quartiles is the first quartile, median and third quartile of values by linear
+// interpolation between closest ranks. values is not empty.
+func quartiles(values []float64) (float64, float64, float64) {
+	sorted := append([]float64(nil), values...)
+	sort.Float64s(sorted)
+	at := func(q float64) float64 {
+		pos := q * float64(len(sorted)-1)
+		lo := int(math.Floor(pos))
+		hi := int(math.Ceil(pos))
+		return sorted[lo] + (sorted[hi]-sorted[lo])*(pos-float64(lo))
+	}
+	return at(0.25), at(0.5), at(0.75)
+}
+
+// StatsView is GET /api/molecules/{id}/stats: the diff size and the estimate a
+// decision card shows. Both are read-only; the diff size runs git diff
+// --numstat on demand through the engine, and the estimate reads the same
+// bounded inventory as /api/molecules.
+type StatsView struct {
+	Diff     DiffSizeView `json:"diff"`
+	Estimate EstimateView `json:"estimate"`
+}
+
+func (h *handler) stats(r molecule.Record) StatsView {
+	inv := h.inventory(ledgerETag(h.opts.LabDir))
+	return StatsView{Diff: h.diffSize(h.jobs.ctx, r), Estimate: estimate(inv, r.Issue.Repo, r.FormulaID, r.ID)}
+}
diff --git a/lab/internal/ui/estimate_test.go b/lab/internal/ui/estimate_test.go
new file mode 100644
index 0000000..a980643
--- /dev/null
+++ b/lab/internal/ui/estimate_test.go
@@ -0,0 +1,255 @@
+package ui
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math"
+	"net/http"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/DanielNetzer/forgecell/lab/internal/molecule"
+	"github.com/DanielNetzer/forgecell/lab/internal/verification"
+)
+
+// estimateEpoch is a fixed time, so no estimate test reads the clock.
+const estimateEpoch = int64(1_790_000_000_000)
+
+// historyEntry is one Molecule of a fixture history: minutes of active Atom
+// time; its wall time also holds a long wait for the human at a gate.
+type historyEntry struct {
+	id, repo, formula, lane string
+	minutes                 int64
+	costs                   []*float64
+	noActive                bool
+}
+
+func usdPtr(v float64) *float64 { return &v }
+
+// waitMinutes is the human wait each fixture's wall time adds to its active time.
+const waitMinutes = 600
+
+// historyInventory builds an inventory whose i-th entry finished i hours after
+// the epoch, so later entries are more recent.
+func historyInventory(entries []historyEntry) inventory {
+	inv := inventory{facts: map[string]*moleculeFacts{}}
+	for i, e := range entries {
+		end := estimateEpoch + int64(i+1)*3_600_000
+		s := Summary{ID: e.id, Repository: e.repo, FormulaID: e.formula, Lane: e.lane, StartedAt: "set", FinishedAt: "set"}
+		f := &moleculeFacts{wallOK: true, wallStart: end - (e.minutes+waitMinutes)*60_000, wallEnd: end, activeOK: !e.noActive, activeMS: e.minutes * 60_000}
+		for _, c := range e.costs {
+			f.attempts = append(f.attempts, attemptFact{cost: c})
+		}
+		inv.list.Molecules = append(inv.list.Molecules, s)
+		inv.facts[e.id] = f
+	}
+	return inv
+}
+
+func comparableEntries(n int, minutes func(int) int64, costs func(int) []*float64) []historyEntry {
+	var out []historyEntry
+	for i := 1; i <= n; i++ {
+		out = append(out, historyEntry{id: fmt.Sprintf("m%02d", i), repo: "o/r", formula: "f", lane: LaneFinished, minutes: minutes(i), costs: costs(i)})
+	}
+	return out
+}
+
+func near(a, b float64) bool { return math.Abs(a-b) < 1e-9 }
+
+// With enough history the estimate is the interquartile range and median of the
+// comparable Molecules' active Atom time (never their wall time, which holds the
+// wait for you) and reported cost, labelled with its basis and never a promise.
+func TestEstimateWithEnoughHistory(t *testing.T) {
+	entries := comparableEntries(12, func(i int) int64 { return int64(i) * 10 }, func(i int) []*float64 { return []*float64{usdPtr(float64(i))} })
+	v := estimate(historyInventory(entries), "o/r", "f", "self")
+	if !v.Shown || v.Molecules != 12 || v.Basis != "based on your last 12 finished Molecules · active time, not time waiting for you" || v.Note != estimateNote {
+		t.Fatalf("estimate %+v", v)
+	}
+	// Active minutes 10..120: quartiles 37.5, 65 and 92.5 minutes.
+	if v.Time == nil || v.Time.LowMS != 2_250_000 || v.Time.MedianMS != 3_900_000 || v.Time.HighMS != 5_550_000 {
+		t.Fatalf("time %+v", v.Time)
+	}
+	if c := v.Cost; c == nil || !near(c.LowUSD, 3.75) || !near(c.MedianUSD, 6.5) || !near(c.HighUSD, 9.25) || c.Partial || c.Molecules != 12 || c.Coverage != "cost reported for 12 of 12 harness attempts" {
+		t.Fatalf("cost %+v", v.Cost)
+	}
+	// More recent Decision-lane and Other-lane Molecules, far slower, change nothing.
+	mixed := append([]historyEntry(nil), entries...)
+	for i := range 6 {
+		mixed = append(mixed, historyEntry{id: fmt.Sprintf("d%02d", i), repo: "o/r", formula: "f", lane: LaneDecision, minutes: 5000, costs: []*float64{usdPtr(99)}},
+			historyEntry{id: fmt.Sprintf("o%02d", i), repo: "o/r", formula: "f", lane: LaneOther, minutes: 5000, costs: []*float64{usdPtr(99)}})
+	}
+	if m := estimate(historyInventory(mixed), "o/r", "f", "self"); m.Molecules != 12 || *m.Time != *v.Time || *m.Cost != *v.Cost {
+		t.Fatalf("Decision or Other lane counted: %+v %+v", m, m.Time)
+	}
+	// Only the most recent estimateWindow comparable Molecules count: the older
+	// ones here are far slower and would move the median.
+	window := comparableEntries(estimateWindow+5, func(i int) int64 {
+		if i <= 5 {
+			return 1000
+		}
+		return 10
+	}, func(int) []*float64 { return []*float64{usdPtr(1)} })
+	if v := estimate(historyInventory(window), "o/r", "f", "self"); v.Molecules != estimateWindow || v.Time.HighMS != 600_000 || v.Basis != estimateBasis(estimateWindow) {
+		t.Fatalf("window: %+v %+v", v, v.Time)
+	}
+}
+
+// Fewer than minEstimateBasis comparable Molecules hide the estimate entirely:
+// only the Finished lane (a published draft receipt) counts, so Molecules of
+// another repository or Formula, in the Decision, Running, Blocked, Other or
+// Retired lane, without recorded active time, and the Molecule itself never do.
+func TestEstimateHiddenWithTooLittleHistory(t *testing.T) {
+	entries := comparableEntries(minEstimateBasis-1, func(int) int64 { return 30 }, func(int) []*float64 { return []*float64{usdPtr(2)} })
+	for _, e := range []historyEntry{
+		{id: "other-repo", repo: "o/x", formula: "f", lane: LaneFinished, minutes: 30},
+		{id: "other-formula", repo: "o/r", formula: "g", lane: LaneFinished, minutes: 30},
+		{id: "decision", repo: "o/r", formula: "f", lane: LaneDecision, minutes: 30},
+		{id: "blocked", repo: "o/r", formula: "f", lane: LaneBlocked, minutes: 30},
+		{id: "running", repo: "o/r", formula: "f", lane: LaneRunning, minutes: 30},
+		{id: "retired", repo: "o/r", formula: "f", lane: LaneRetired, minutes: 30},
+		{id: "other", repo: "o/r", formula: "f", lane: LaneOther, minutes: 30},
+		{id: "no-active-time", repo: "o/r", formula: "f", lane: LaneFinished, minutes: 30, noActive: true},
+		{id: "self", repo: "o/r", formula: "f", lane: LaneFinished, minutes: 30},
+	} {
+		entries = append(entries, e)
+	}
+	v := estimate(historyInventory(entries), "o/r", "f", "self")
+	if v.Shown || v.Molecules != minEstimateBasis-1 || v.Time != nil || v.Cost != nil || v.Basis != "" {
+		t.Fatalf("estimate shown on too little history: %+v", v)
+	}
+	if v := estimate(inventory{facts: map[string]*moleculeFacts{}}, "o/r", "f", "self"); v.Shown || v.Molecules != 0 {
+		t.Fatalf("empty history: %+v", v)
+	}
+	// An unknown repository or Formula id matches nothing.
+	if v := estimate(historyInventory(comparableEntries(8, func(int) int64 { return 5 }, func(int) []*float64 { return nil })), "", "f", "self"); v.Shown {
+		t.Fatalf("no repository: %+v", v)
+	}
+}
+
+// Cost uses only attempts that reported one and says when coverage is partial;
+// with fewer than minEstimateBasis Molecules reporting a cost, only the time is
+// shown. A missing cost is never zero-filled.
+func TestEstimatePartialCostCoverageIsLabelled(t *testing.T) {
+	entries := comparableEntries(6, func(int) int64 { return 20 }, func(i int) []*float64 { return []*float64{usdPtr(float64(i)), nil} })
+	v := estimate(historyInventory(entries), "o/r", "f", "self")
+	if c := v.Cost; !v.Shown || c == nil || !c.Partial || c.Molecules != 6 || c.Coverage != "cost reported for 6 of 12 harness attempts" || !near(c.MedianUSD, 3.5) {
+		t.Fatalf("partial cost %+v", v.Cost)
+	}
+	few := comparableEntries(6, func(int) int64 { return 20 }, func(i int) []*float64 {
+		if i <= 3 {
+			return []*float64{usdPtr(9)}
+		}
+		return []*float64{nil, usdPtr(math.NaN()), usdPtr(-1)}
+	})
+	v = estimate(historyInventory(few), "o/r", "f", "self")
+	if !v.Shown || v.Time == nil || v.Cost != nil {
+		t.Fatalf("cost shown from too few reports: %+v", v)
+	}
+	if lo, mid, hi := quartiles([]float64{4}); lo != 4 || mid != 4 || hi != 4 {
+		t.Fatalf("one value: %v %v %v", lo, mid, hi)
+	}
+}
+
+// numstatSeam counts diff measurements and returns stat or err.
+type numstatSeam struct {
+	mu    sync.Mutex
+	calls [][4]string
+	stat  molecule.DiffStat
+	err   error
+}
+
+func (s *numstatSeam) install(h http.Handler) {
+	h.(*handler).numstat = func(_ context.Context, lab, workspace, base, tree string) (molecule.DiffStat, error) {
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		s.calls = append(s.calls, [4]string{lab, workspace, base, tree})
+		return s.stat, s.err
+	}
+}
+
+func (s *numstatSeam) count() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return len(s.calls)
+}
+
+// GET /api/molecules/{id}/stats measures the captured tree against the plan's
+// base through the engine once per tree, serves only the counts, and reports a
+// failed measurement as unavailable without caching it. It needs the tab
+// session and serves nothing for sample data.
+func TestUIStatsMeasuresTheCapturedTreeOncePerTree(t *testing.T) {
+	lab, r, _ := viewFixture(t)
+	tree := strings.Repeat("7", 40)
+	r.Capture = &verification.CaptureResult{Tree: tree, Changes: []string{"lab/internal/ui/web/app.js"}}
+	writeRecord(t, lab, r)
+	h := testHandler(t, Options{LabDir: lab})
+	seam := &numstatSeam{stat: molecule.DiffStat{Files: 4, Added: 412, Removed: 96, Binary: 1}}
+	seam.install(h)
+	path := "/api/molecules/" + r.ID + "/stats"
+	for range 2 {
+		v := viewOf[StatsView](t, do(t, h, authed(path)), http.StatusOK)
+		if v.Diff != (DiffSizeView{State: DiffMeasured, Files: 4, Added: 412, Removed: 96, Binary: 1}) || v.Estimate.Shown {
+			t.Fatalf("stats %+v", v)
+		}
+	}
+	if seam.count() != 1 || seam.calls[0] != [4]string{lab, r.Workspace.Path, r.Workspace.BaseCommit, tree} {
+		t.Fatalf("numstat calls %q", seam.calls)
+	}
+	// A truncated measurement says so.
+	h2 := testHandler(t, Options{LabDir: lab})
+	(&numstatSeam{stat: molecule.DiffStat{Files: 10000, Added: 1, Truncated: true}}).install(h2)
+	if v := viewOf[StatsView](t, do(t, h2, authed(path)), http.StatusOK); !v.Diff.Truncated || v.Diff.State != DiffMeasured {
+		t.Fatalf("truncated %+v", v.Diff)
+	}
+	// A failure is unavailable and measured again next time.
+	h3 := testHandler(t, Options{LabDir: lab})
+	failing := &numstatSeam{err: molecule.ErrDiffStatFailed}
+	failing.install(h3)
+	for range 2 {
+		w := do(t, h3, authed(path))
+		if v := viewOf[StatsView](t, w, http.StatusOK); v.Diff != (DiffSizeView{State: DiffUnavailable}) {
+			t.Fatalf("failed measurement %+v", v.Diff)
+		}
+		noLeak(t, w.Body.String())
+	}
+	if failing.count() != 2 {
+		t.Fatalf("a failed measurement was cached: %d calls", failing.count())
+	}
+	// Nothing captured, or no change, runs no git at all.
+	r.Capture = &verification.CaptureResult{Tree: tree}
+	writeRecord(t, lab, r)
+	h4 := testHandler(t, Options{LabDir: lab})
+	none := &numstatSeam{err: errors.New("must not run")}
+	none.install(h4)
+	if v := viewOf[StatsView](t, do(t, h4, authed(path)), http.StatusOK); v.Diff.State != DiffNone || none.count() != 0 {
+		t.Fatalf("no change measured: %+v after %d calls", v.Diff, none.count())
+	}
+	// The tab session is required, and sample data has no stats.
+	noTab := authed(path)
+	noTab.header = map[string]string{sessionHeader: ""}
+	if w := do(t, h4, noTab); w.Code != http.StatusForbidden {
+		t.Fatalf("stats without the tab session: %d", w.Code)
+	}
+	if w := do(t, testHandler(t, Options{Demo: true}), authed("/api/molecules/demo-101/stats")); w.Code != http.StatusNotFound {
+		t.Fatalf("sample stats: %d", w.Code)
+	}
+}
+
+// The diff cache is bounded: the oldest size is dropped first.
+func TestUIDiffCacheIsBounded(t *testing.T) {
+	c := newDiffCache()
+	for i := 0; i < maxDiffCache+10; i++ {
+		c.put(fmt.Sprint(i), molecule.DiffStat{Files: i})
+	}
+	if len(c.entries) != maxDiffCache || len(c.order) != maxDiffCache {
+		t.Fatalf("cache holds %d", len(c.entries))
+	}
+	if _, ok := c.get("0"); ok {
+		t.Fatal("the oldest size was kept")
+	}
+	if s, ok := c.get(fmt.Sprint(maxDiffCache + 9)); !ok || s.Files != maxDiffCache+9 {
+		t.Fatalf("the newest size is %+v %v", s, ok)
+	}
+}
diff --git a/lab/internal/ui/gates.go b/lab/internal/ui/gates.go
index a2b9d1d..d218032 100644
--- a/lab/internal/ui/gates.go
+++ b/lab/internal/ui/gates.go
@@ -29,6 +29,11 @@ import (
 //	                                                        → delivery.Publish (draft PR) as a job
 //	GET  /api/molecules/{id}/job                            → the job and its canonical read-back
 //
+// Request changes (amend.go) is the same kind of POST and never approves:
+//
+//	POST /api/molecules/{id}/amend  {"digest","addAcceptance","addScope"}
+//	                                → molecule.AmendFromLatest (no --run); the new revision is approved separately
+//
 // The engine validates every digest, lock and receipt; the UI only refuses
 // early what the engine would refuse anyway. There is no merge, deployment or
 // permission route. A job's own outcome never shows a decision as committed:
@@ -60,7 +65,7 @@ func gateRoute(path string) (id, action string, ok bool) {
 	}
 	id, action, _ = strings.Cut(rest, "/")
 	switch action {
-	case "scope", "delivery/preview", "delivery/publish":
+	case "scope", "amend", "delivery/preview", "delivery/publish":
 		return id, action, true
 	}
 	return "", "", false
@@ -149,11 +154,14 @@ func (h *handler) gate(w http.ResponseWriter, r *http.Request, id, action string
 		return
 	}
 	var scope scopeRequest
+	var amend amendRequest
 	var publish publishRequest
 	var body any = &previewRequest{}
 	switch action {
 	case "scope":
 		body = &scope
+	case "amend":
+		body = &amend
 	case "delivery/publish":
 		body = &publish
 	}
@@ -174,6 +182,8 @@ func (h *handler) gate(w http.ResponseWriter, r *http.Request, id, action string
 	switch action {
 	case "scope":
 		h.approveScope(w, record, scope)
+	case "amend":
+		h.amendPlan(w, record, amend)
 	case "delivery/preview":
 		h.previewDelivery(w, record)
 	default:
@@ -386,6 +396,9 @@ var categoryReasons = map[string]string{
 	"reconciliation":        "Check the pull request on GitHub, then reconcile the receipt with forgecell deliver; this page never retries a publication",
 	"demo":                  "This demo Lab never contacts GitHub; run forgecell init in a Lab of your own repository to publish",
 	"interrupted":           "Read the state back here; if the Molecule stays locked, inspect it with forgecell ledger and recover it with forgecell recover",
+	"duplicate":             "Add a path or an acceptance note the plan does not list yet, or approve the plan as it is",
+	"scope-refused":         "Choose an exact path inside a component the plan's evidence covers, or run forgecell amend to see the engine's own reason",
+	"checkout":              "Refresh intake with forgecell run so the Molecule has a coding checkout, then review the new plan",
 }
 
 // engineReasons are exact next steps for engine errors the UI recognises,
@@ -657,6 +670,15 @@ func (g *gateJobs) cancelRunning(id string, kinds []string, owns func(time.Time)
 	return true
 }
 
+// ownsRunning is cancelRunning's check alone: it reports a running job under id
+// whose kind is one of kinds and for which owns(started) holds, and cancels nothing.
+func (g *gateJobs) ownsRunning(id string, kinds []string, owns func(time.Time) bool) bool {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	j := g.jobs[id]
+	return j != nil && j.state == "running" && slices.Contains(kinds, j.kind) && owns(j.started)
+}
+
 func (g *gateJobs) busy(id string) bool {
 	g.mu.Lock()
 	defer g.mu.Unlock()
diff --git a/lab/internal/ui/gates_test.go b/lab/internal/ui/gates_test.go
index e75bccd..95b60f1 100644
--- a/lab/internal/ui/gates_test.go
+++ b/lab/internal/ui/gates_test.go
@@ -191,7 +191,7 @@ func TestUIGateWriteProtectionRefusesForgedAndMalformedWrites(t *testing.T) {
 	engine := refuseEngine(t, h)
 	before := snapshot(t, lab)
 	scope := `{"digest":"` + digest + `"}`
-	for _, action := range []string{"scope", "delivery/preview", "delivery/publish"} {
+	for _, action := range []string{"scope", "amend", "delivery/preview", "delivery/publish"} {
 		for name, forged := range forgedWrites("/api/molecules/"+r.ID+"/"+action, scope) {
 			if w := do(t, h, forged); w.Code != http.StatusForbidden {
 				t.Errorf("%s %s: %d %s", name, action, w.Code, w.Body)
@@ -673,11 +673,16 @@ func TestUIGateServedJSSubmitsOnceAndReadsBack(t *testing.T) {
 		"method: 'POST'",
 		"'Content-Type': 'application/json'",
 		"'/scope'",
+		"'/amend'",
 		"'/delivery/preview'",
 		"'/delivery/publish'",
 		"'/job'",
 		"if (state.gate.pending) return null;",
-		"disabled: state.gate.pending",
+		"const busy = gate.pending || running;",
+		"c.approve.disabled = busy;",
+		"c.preview.disabled = busy;",
+		"c.publish.disabled = busy;",
+		"c.amendSubmit.disabled = busy;",
 		"JSON.stringify({ digest: digest })",
 		"JSON.stringify({ digest: preview.digest, title: title, acceptUnverified: accept })",
 		"readBack(",
@@ -687,6 +692,16 @@ func TestUIGateServedJSSubmitsOnceAndReadsBack(t *testing.T) {
 			t.Errorf("app.js lacks %q", want)
 		}
 	}
+	// An ambiguous response is read back and never resubmitted.
+	submit := jsFunction(t, js, "submitGate")
+	for _, want := range []string{"if (!res || res.status >= 500) {", "readBack(gate);", "return null;"} {
+		if !strings.Contains(submit, want) {
+			t.Errorf("submitGate lacks %q", want)
+		}
+	}
+	if strings.Contains(submit, "gatePost(gate.id, action, payload);\n      res = await gatePost") {
+		t.Error("submitGate posts twice")
+	}
 	for _, gone := range []string{"approvals are not available in this UI", "/merge", "/deploy"} {
 		if strings.Contains(js, gone) {
 			t.Errorf("app.js still has %q", gone)
diff --git a/lab/internal/ui/inbox.go b/lab/internal/ui/inbox.go
index 89edc07..43ad0ba 100644
--- a/lab/internal/ui/inbox.go
+++ b/lab/internal/ui/inbox.go
@@ -48,7 +48,7 @@ const maxInboxCount = 9999
 // Summary stays comparable. Each group of counts is served only with its flag:
 // Planned for Files and Checks, Verified for Passed of Ran, Captured for
 // Changed; without the flag it was not recorded, which is never zero.
-// StepSince is the current step's start as RFC 3339 UTC, for the browser's
+// StepSince is the current attempt's start as RFC 3339 UTC, for the browser's
 // elapsed time only; it is data, never shown.
 type InboxView struct {
 	Kind    string `json:"kind"`
@@ -68,8 +68,11 @@ type InboxView struct {
 	Step      int    `json:"step"`
 	StepLabel string `json:"stepLabel"`
 	StepSince string `json:"stepSince,omitempty"`
-	Queued    bool   `json:"queued,omitempty"`
-	Merged    bool   `json:"merged,omitempty"`
+	// StepNote is a fixed rerun note of the current attempt, "rerun" or "rerun
+	// after a plan revision", or empty.
+	StepNote string `json:"stepNote,omitempty"`
+	Queued   bool   `json:"queued,omitempty"`
+	Merged   bool   `json:"merged,omitempty"`
 }
 
 // inboxView maps one Molecule's lane, phase, Atoms and receipt to its Inbox
@@ -80,8 +83,8 @@ func inboxView(x redactor, r molecule.Record, lane, activity string, d *Delivery
 	if lane == LaneRunning && d.Published() {
 		lane = LaneFinished
 	}
-	step, label, since := progress(r, lane, activity, d)
-	v := InboxView{Step: step, StepLabel: label, StepSince: since}
+	step, label, since, note := stepProgress(r, lane, activity, d)
+	v := InboxView{Step: step, StepLabel: label, StepSince: since, StepNote: note}
 	switch lane {
 	case LaneDecision:
 		if phase(r) == "scope-waiting" {
@@ -217,19 +220,33 @@ func atomStep(typ string, coded bool) int {
 // phaseSteps is the fallback step of a readiness phase when no Atom is current.
 var phaseSteps = map[string]int{"scope-waiting": StepApproval, "approved": StepCoding, "coding": StepCoding, "check-pending": StepChecks, "review-waiting": StepReview}
 
-// progress is a Molecule's current step, its plain label and when it started.
-// A published receipt is the Draft PR step done (Merged when the receipt observed
-// a merge); otherwise the first active or waiting Atom decides, then a failed one,
-// then the readiness phase.
+// Rerun notes of the current attempt.
+const (
+	rerunNote         = "rerun"
+	rerunRevisionNote = "rerun after a plan revision"
+)
+
+// progress is a Molecule's current step, its plain label and when the current
+// attempt of that step started; stepProgress also gives the rerun note.
 func progress(r molecule.Record, lane, activity string, d *DeliveryState) (int, string, string) {
+	step, label, since, _ := stepProgress(r, lane, activity, d)
+	return step, label, since
+}
+
+// stepProgress is a Molecule's current step, its plain label, when the current
+// attempt of that step started, and a rerun note. A published receipt is the
+// Draft PR step done (Merged when the receipt observed a merge); otherwise the
+// first active or waiting Atom decides, then a failed one, then the readiness
+// phase.
+func stepProgress(r molecule.Record, lane, activity string, d *DeliveryState) (int, string, string, string) {
 	if d.Published() {
 		if d.Lifecycle == "MERGED" {
-			return StepMerged, "Merged", ""
+			return StepMerged, "Merged", "", ""
 		}
-		return StepMerged, "Draft published", ""
+		return StepMerged, "Draft published", "", ""
 	}
 	if activity == ActivityQueued {
-		return StepChecks, "Queued for checks", ""
+		return StepChecks, "Queued for checks", "", ""
 	}
 	coded, failedAt := false, -1
 	for _, a := range r.Atoms {
@@ -240,7 +257,8 @@ func progress(r molecule.Record, lane, activity string, d *DeliveryState) (int,
 			if s < 0 {
 				s = StepDraft
 			}
-			return s, StepLabels[s], stepSince(a.StartedAt)
+			since, note := attemptSince(r, a)
+			return s, StepLabels[s], since, note
 		case "failed", "blocked":
 			if failedAt < 0 && s >= 0 {
 				failedAt = s
@@ -248,12 +266,57 @@ func progress(r molecule.Record, lane, activity string, d *DeliveryState) (int,
 		}
 	}
 	if failedAt >= 0 {
-		return failedAt, StepLabels[failedAt], ""
+		return failedAt, StepLabels[failedAt], "", ""
 	}
 	if s, ok := phaseSteps[phase(r)]; ok {
-		return s, StepLabels[s], ""
+		return s, StepLabels[s], "", ""
+	}
+	return StepPlan, StepLabels[StepPlan], "", ""
+}
+
+// attemptSince is when the current attempt of a current Atom started, and its
+// rerun note. Coding counts from the latest harness attempt's start recorded on
+// the Atom, Checks from the latest verification attempt and Review from the
+// latest review pass, never from the Atom's first start, which an earlier
+// attempt set. A step with attempts but no recorded start of the latest one
+// shows no duration; a step with no attempt recorded yet, and other Atoms,
+// which run once, count from the Atom's own start.
+func attemptSince(r molecule.Record, a molecule.Atom) (string, string) {
+	var starts, digests []string
+	switch a.Type {
+	case "harness":
+		recorded := map[string]string{}
+		if a.Provenance != nil {
+			for _, act := range a.Provenance.Actions {
+				recorded[act.AttemptID] = act.StartedAt
+			}
+		}
+		for _, h := range r.HarnessAttempts {
+			starts, digests = append(starts, recorded[h.ID]), append(digests, h.PlanDigest)
+		}
+	case "check":
+		for _, v := range r.VerificationAttempts {
+			starts, digests = append(starts, v.StartedAt), append(digests, v.PlanDigest)
+		}
+	case "review":
+		for _, v := range r.ReviewAttempts {
+			starts, digests = append(starts, v.StartedAt), append(digests, v.PlanDigest)
+		}
+	default:
+		return stepSince(a.StartedAt), ""
+	}
+	n := len(starts)
+	if n == 0 {
+		return stepSince(a.StartedAt), ""
+	}
+	note := ""
+	if n > 1 {
+		note = rerunNote
+		if digests[n-1] != digests[n-2] {
+			note = rerunRevisionNote
+		}
 	}
-	return StepPlan, StepLabels[StepPlan], ""
+	return stepSince(starts[n-1]), note
 }
 
 // stepSince re-formats a recorded start time, or returns "" for anything that
diff --git a/lab/internal/ui/inbox_test.go b/lab/internal/ui/inbox_test.go
index 99bcbde..b970d07 100644
--- a/lab/internal/ui/inbox_test.go
+++ b/lab/internal/ui/inbox_test.go
@@ -68,7 +68,10 @@ func inboxLab(t *testing.T) string {
 	writeRecord(t, lab, blocked)
 
 	running := inboxRecord(base, "mol-4-running", 4, "running", "coding", inboxAtoms("done", "done", "active"))
-	running.Atoms[2].StartedAt = "2026-10-26T10:00:00.123+02:00"
+	// The Atom started earlier; the duration counts from the coding attempt.
+	running.Atoms[2].StartedAt = "2026-10-26T05:00:00Z"
+	running.Atoms[2].Provenance = &molecule.AtomProvenance{Actions: []molecule.AtomAction{{AttemptID: "attempt-1", StartedAt: "2026-10-26T10:00:00.123+02:00"}}}
+	running.HarnessAttempts = []molecule.HarnessAttempt{{ID: "attempt-1", PlanDigest: digest64}}
 	writeRecord(t, lab, running)
 
 	queued := inboxRecord(base, "mol-5-queued", 5, "running", "check-pending", inboxAtoms("done", "done", "done", "active"))
@@ -204,10 +207,14 @@ func TestUIInboxProgressStepsFromAtoms(t *testing.T) {
 	published := &DeliveryState{State: "published", Lifecycle: "OPEN"}
 	mergedReceipt := &DeliveryState{State: "published", Lifecycle: "MERGED"}
 	at := func(statuses ...string) []molecule.Atom { return inboxAtoms(statuses...) }
+	// With no attempt recorded yet the Atom's own start is the duration; with
+	// attempts it never is (TestUIProgressCountsFromTheCurrentAttempt).
 	since := at("done", "done", "active")
 	since[2].StartedAt = "2026-10-26T10:00:00Z"
 	bad := at("done", "done", "active")
 	bad[2].StartedAt = "<script>yesterday"
+	plan := at("active")
+	plan[0].StartedAt = "2026-10-26T09:00:00Z"
 	demo := []molecule.Atom{{Type: "intake", Status: "done"}, {Type: "harness", Status: "done"}, {Type: "check", Status: "done"}, {Type: "gate", Status: "waiting"}}
 	for name, c := range map[string]struct {
 		atoms    []molecule.Atom
@@ -220,9 +227,9 @@ func TestUIInboxProgressStepsFromAtoms(t *testing.T) {
 	}{
 		"no atoms, scope phase": {nil, "scope-waiting", "", nil, StepApproval, "Your approval", ""},
 		"no atoms, no phase":    {nil, "", "", nil, StepPlan, "Plan", ""},
-		"planning":              {at("active"), "", "", nil, StepPlan, "Plan", ""},
+		"planning":              {plan, "", "", nil, StepPlan, "Plan", "2026-10-26T09:00:00Z"},
 		"scope gate":            {at("done", "waiting"), "scope-waiting", "", nil, StepApproval, "Your approval", ""},
-		"coding":                {since, "coding", "", nil, StepCoding, "Coding", "2026-10-26T10:00:00Z"},
+		"coding, no attempt":    {since, "coding", "", nil, StepCoding, "Coding", "2026-10-26T10:00:00Z"},
 		"coding, bad time":      {bad, "coding", "", nil, StepCoding, "Coding", ""},
 		"checks":                {at("done", "done", "done", "running"), "check-pending", "", nil, StepChecks, "Checks", ""},
 		"queued":                {at("done", "done", "done", "active"), "check-pending", ActivityQueued, nil, StepChecks, "Queued for checks", ""},
@@ -236,9 +243,12 @@ func TestUIInboxProgressStepsFromAtoms(t *testing.T) {
 		"merged":                {nil, "review-waiting", "", mergedReceipt, StepMerged, "Merged", ""},
 	} {
 		r := molecule.Record{Atoms: c.atoms, Readiness: &readiness.State{Phase: c.phase}}
-		step, label, got := progress(r, "", c.activity, c.d)
-		if step != c.step || label != c.label || got != c.since {
-			t.Errorf("%s: step %d %q since %q, want %d %q %q", name, step, label, got, c.step, c.label, c.since)
+		step, label, got, note := stepProgress(r, "", c.activity, c.d)
+		if s, l, g := progress(r, "", c.activity, c.d); s != step || l != label || g != got {
+			t.Errorf("%s: progress %d %q %q differs from stepProgress", name, s, l, g)
+		}
+		if step != c.step || label != c.label || got != c.since || note != "" {
+			t.Errorf("%s: step %d %q since %q note %q, want %d %q %q", name, step, label, got, note, c.step, c.label, c.since)
 		}
 		if step < 0 || step >= len(StepLabels) {
 			t.Errorf("%s: step %d out of range", name, step)
@@ -249,6 +259,68 @@ func TestUIInboxProgressStepsFromAtoms(t *testing.T) {
 	}
 }
 
+// The shown duration counts from the current attempt: the latest verification
+// attempt for Checks and the latest harness attempt for Coding, never from the
+// Atom's first start. A rerun is labelled, after a plan revision when the latest
+// attempt ran another plan digest, and a latest attempt without a recorded start
+// shows no duration.
+func TestUIProgressCountsFromTheCurrentAttempt(t *testing.T) {
+	first, second := strings.Repeat("1a", 32), strings.Repeat("2b", 32)
+	checks := func(attempts ...molecule.VerificationAttempt) molecule.Record {
+		atoms := inboxAtoms("done", "done", "done", "active")
+		atoms[3].StartedAt = "2026-10-26T08:00:00Z"
+		return molecule.Record{Atoms: atoms, Readiness: &readiness.State{Phase: "check-pending"}, VerificationAttempts: attempts}
+	}
+	coding := func(starts map[string]string, attempts ...molecule.HarnessAttempt) molecule.Record {
+		atoms := inboxAtoms("done", "done", "active")
+		atoms[2].StartedAt = "2026-10-26T08:00:00Z"
+		atoms[2].Provenance = &molecule.AtomProvenance{}
+		for _, a := range attempts {
+			atoms[2].Provenance.Actions = append(atoms[2].Provenance.Actions, molecule.AtomAction{AttemptID: a.ID, StartedAt: starts[a.ID]})
+		}
+		return molecule.Record{Atoms: atoms, Readiness: &readiness.State{Phase: "coding"}, HarnessAttempts: attempts}
+	}
+	for name, c := range map[string]struct {
+		r           molecule.Record
+		step        int
+		since, note string
+	}{
+		"checks, one attempt": {checks(molecule.VerificationAttempt{PlanDigest: first, StartedAt: "2026-10-26T09:00:00Z", Status: "started"}),
+			StepChecks, "2026-10-26T09:00:00Z", ""},
+		"checks, rerun after a revision": {checks(
+			molecule.VerificationAttempt{PlanDigest: first, StartedAt: "2026-10-26T09:00:00Z", FinishedAt: "2026-10-26T09:20:00Z", Status: "failed"},
+			molecule.VerificationAttempt{PlanDigest: second, StartedAt: "2026-10-26T11:00:00Z", Status: "started"}),
+			StepChecks, "2026-10-26T11:00:00Z", rerunRevisionNote},
+		"checks, rerun of the same plan": {checks(
+			molecule.VerificationAttempt{PlanDigest: first, StartedAt: "2026-10-26T09:00:00Z", Status: "interrupted"},
+			molecule.VerificationAttempt{PlanDigest: first, StartedAt: "2026-10-26T10:00:00Z", Status: "started"}),
+			StepChecks, "2026-10-26T10:00:00Z", rerunNote},
+		"checks, latest start missing": {checks(
+			molecule.VerificationAttempt{PlanDigest: first, StartedAt: "2026-10-26T09:00:00Z", Status: "failed"},
+			molecule.VerificationAttempt{PlanDigest: second, Status: "started"}),
+			StepChecks, "", rerunRevisionNote},
+		"coding, rerun after a revision": {coding(map[string]string{"h1": "2026-10-26T09:00:00Z", "h2": "2026-10-26T12:00:00Z"},
+			molecule.HarnessAttempt{ID: "h1", PlanDigest: first}, molecule.HarnessAttempt{ID: "h2", PlanDigest: second}),
+			StepCoding, "2026-10-26T12:00:00Z", rerunRevisionNote},
+		"coding, latest start missing": {coding(map[string]string{"h1": "2026-10-26T09:00:00Z"},
+			molecule.HarnessAttempt{ID: "h1", PlanDigest: first}, molecule.HarnessAttempt{ID: "h2", PlanDigest: first}),
+			StepCoding, "", rerunNote},
+	} {
+		step, _, since, note := stepProgress(c.r, LaneRunning, "", nil)
+		if step != c.step || since != c.since || note != c.note {
+			t.Errorf("%s: step %d since %q note %q, want %d %q %q", name, step, since, note, c.step, c.since, c.note)
+		}
+		if since == "2026-10-26T08:00:00Z" {
+			t.Errorf("%s: the duration counts from the Atom's first start", name)
+		}
+		// The Molecule view's pill carries the same attempt start and note.
+		v := moleculeView(redactor{}, c.r, LaneRunning, "", GateView{}, nil)
+		if v.State.Since != c.since || v.State.Note != c.note {
+			t.Errorf("%s: pill %+v", name, v.State)
+		}
+	}
+}
+
 // A Molecule still in the running lane whose receipt is already published is
 // recorded, never an In-progress row titled Draft published with a full bar; a
 // running Molecule without a published receipt stays In progress.
diff --git a/lab/internal/ui/molecule_view_test.go b/lab/internal/ui/molecule_view_test.go
new file mode 100644
index 0000000..5368046
--- /dev/null
+++ b/lab/internal/ui/molecule_view_test.go
@@ -0,0 +1,464 @@
+package ui
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"reflect"
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/DanielNetzer/forgecell/lab/internal/harness"
+	"github.com/DanielNetzer/forgecell/lab/internal/molecule"
+	"github.com/DanielNetzer/forgecell/lab/internal/readiness"
+)
+
+// viewFormula is a Formula snapshot with a coding override and a review Atom, so
+// the roles and the coding budget come from it.
+const viewFormula = "kind: formula\nid: f\nharness:\n  binding: default\n  command: [/bin/default]\n  timeoutMs: 1800000\nharnesses:\n  coding: {binding: codex, command: [/bin/c]}\n  review: {binding: claude-code, command: [/bin/r]}\natoms:\n  - {id: intake, type: intake}\n  - {id: scope, type: gate, purpose: scope}\n  - {id: harness, type: harness}\n  - {id: check, type: check}\n  - {id: gate, type: gate, purpose: review}\n  - {id: ship, type: ship}\n  - {id: document, type: document}\n  - {id: review, type: review}\n"
+
+// viewPlan is a plan with two scope paths, one in the base tree, a candidate
+// check and the five Formula baseline checks.
+func viewPlan(base string) readiness.Plan {
+	return readiness.Plan{Revision: 1, Inputs: readiness.Inputs{Repository: "o/r", TargetBranch: "main", BaseCommit: base},
+		FormulaBaseline: []string{"base-test", "base-vet", "base-fmt", "base-hygiene", "base-hygiene-test"},
+		Evidence:        []readiness.Evidence{{ID: "file-1", Path: "lab/go.mod", SHA256: strings.Repeat("1", 64)}},
+		Analysis: readiness.Analysis{
+			Summary:    "Add the Molecule view.",
+			Scope:      []readiness.ScopedPath{{Path: "lab/internal/ui/web/app.js", Reason: "Rebuild the view"}, {Path: "lab/internal/ui/estimate.go", Reason: "New estimates; this reason calls it an edit"}},
+			Acceptance: []readiness.Criterion{{Description: "One primary per card"}},
+			Questions:  []readiness.Question{{Question: "Which window?"}},
+			Checks: []readiness.Check{
+				{ID: "targeted", Category: "candidate", Argv: []string{"go", "test", "./internal/ui/...", "./internal/molecule/..."}, Dir: "lab"},
+				{ID: "base-test", Category: "regression", Argv: []string{"go", "test", "-timeout", "20m", "./..."}, Dir: "lab"},
+				{ID: "base-vet", Category: "regression", Argv: []string{"go", "vet", "./..."}, Dir: "lab"},
+				{ID: "base-fmt", Category: "regression", Argv: []string{"sh", "-c", `test -z "$(gofmt -l internal cmd)"`}, Dir: "lab"},
+				{ID: "base-hygiene", Category: "regression", Argv: []string{"sh", "scripts/check-repo-hygiene.sh"}, Dir: "."},
+				{ID: "base-hygiene-test", Category: "regression", Argv: []string{"sh", "scripts/check-repo-hygiene.test.sh"}, Dir: "."},
+			},
+		}}
+}
+
+// viewFixture is labFixture waiting for scope approval of viewPlan, with a
+// frozen base tree that holds app.js but not estimate.go.
+func viewFixture(t *testing.T) (string, molecule.Record, string) {
+	t.Helper()
+	lab, r := labFixture(t)
+	digest := strings.Repeat("cd", 32)
+	sum := sha256.Sum256([]byte(viewFormula))
+	r.FormulaSnapshot = molecule.Snapshot{YAML: viewFormula, SHA256: hex.EncodeToString(sum[:])}
+	r.RepositoryEvidence = &readiness.RepositorySnapshot{Commit: r.Workspace.BaseCommit, Files: []readiness.TreeFile{{Path: "lab/internal/ui/web/app.js"}, {Path: "lab/go.mod"}}}
+	r.Readiness = &readiness.State{SchemaVersion: "v1", Phase: "scope-waiting", Plans: []readiness.Proposal{{Plan: viewPlan(r.Workspace.BaseCommit), Digest: digest}},
+		Events: []readiness.Event{{Kind: "proposed", Digest: digest, At: "2026-10-26T18:46:00Z"}}}
+	cost := 1.82
+	r.AnalysisAttempts = []molecule.AnalysisAttempt{{Ordinal: 1, Status: "completed", Usage: &harness.Usage{TotalCostUSD: &cost}}, {Ordinal: 2, Status: "completed"}}
+	writeRecord(t, lab, r)
+	return lab, r, digest
+}
+
+func detailOf(t *testing.T, h http.Handler, id string) Detail {
+	t.Helper()
+	w := do(t, h, authed("/api/molecules/"+id))
+	if w.Code != http.StatusOK {
+		t.Fatalf("detail %s: %d %s", id, w.Code, w.Body)
+	}
+	var d Detail
+	if err := json.Unmarshal(w.Body.Bytes(), &d); err != nil {
+		t.Fatal(err)
+	}
+	if d.View == nil {
+		t.Fatalf("detail %s has no Molecule view", id)
+	}
+	return d
+}
+
+// Each gate state projects exactly one primary action, and the scope primary is
+// bound to the exact digest the plan shows; states with nothing to decide have
+// none. Request changes is offered at the scope gate only.
+func TestMoleculeViewOnePrimaryPerGateBoundToTheShownDigest(t *testing.T) {
+	lab, r, digest := viewFixture(t)
+	h := testHandler(t, Options{LabDir: lab})
+	d := detailOf(t, h, r.ID)
+	p := d.View.Decision.Primary
+	if d.View.Decision.Kind != DecisionScope || p == nil || p.Action != PrimaryApprove || p.Label != "Approve plan & start coding" || p.Digest != digest {
+		t.Fatalf("scope decision %+v", d.View.Decision)
+	}
+	if p.Digest != d.Gate.Digest || p.Digest != d.View.Plan.Digest || !d.View.Decision.RequestChanges || d.View.Decision.Title != "Approve this plan?" {
+		t.Fatalf("scope primary not bound to the shown plan: gate %q plan %q", d.Gate.Digest, d.View.Plan.Digest)
+	}
+	if want := "Forgecell will code 2 files, then run 6 checks on its own. Nothing is published until you approve the draft PR."; d.View.Decision.Copy != want {
+		t.Errorf("copy %q", d.View.Decision.Copy)
+	}
+
+	// A plan whose digest is not a full digest offers no approval at all.
+	bad := r
+	bad.Readiness = &readiness.State{SchemaVersion: "v1", Phase: "scope-waiting", Plans: []readiness.Proposal{{Plan: viewPlan(r.Workspace.BaseCommit), Digest: "short"}}}
+	writeRecord(t, lab, bad)
+	if d := detailOf(t, h, r.ID); d.View.Decision.Primary != nil || d.View.Decision.RequestChanges {
+		t.Fatalf("an unbindable plan offers %+v", d.View.Decision)
+	}
+
+	// The review gate: Preview delivery is the one primary, bound to nothing yet.
+	review := r
+	review.Status, review.FinishedAt = "recorded", "2026-10-26T19:40:00Z"
+	review.Readiness = &readiness.State{SchemaVersion: "v1", Phase: "review-waiting", Plans: []readiness.Proposal{{Plan: viewPlan(r.Workspace.BaseCommit), Digest: digest}}}
+	writeRecord(t, lab, review)
+	d = detailOf(t, h, r.ID)
+	if d.View.Decision.Kind != DecisionDelivery || d.View.Decision.Primary == nil || d.View.Decision.Primary.Action != PrimaryPreview || d.View.Decision.Primary.Digest != "" || d.View.Decision.RequestChanges {
+		t.Fatalf("review decision %+v", d.View.Decision)
+	}
+	if d.View.State.Label != "Ready to publish" || d.View.State.Tone != ToneNeeds {
+		t.Errorf("review state %+v", d.View.State)
+	}
+
+	// Published and merged: nothing to do, the pull request, no primary.
+	for lifecycle, label := range map[string]string{"OPEN": "Draft published", "MERGED": "Merged"} {
+		writeReceipt(t, lab, r.ID, "published", lifecycle)
+		d = detailOf(t, h, r.ID)
+		if d.View.Decision.Kind != DecisionPublished || d.View.Decision.Primary != nil || d.View.Decision.Title != "Nothing to do" || d.View.Decision.PullURL != "https://github.com/o/r/pull/5" || d.View.State.Label != label {
+			t.Errorf("%s: decision %+v state %+v", lifecycle, d.View.Decision, d.View.State)
+		}
+	}
+
+	// Running, blocked and retired Molecules have no primary.
+	for _, c := range []struct{ status, phase string }{{"running", "coding"}, {"blocked", "failed"}, {molecule.StatusRetired, "scope-waiting"}} {
+		other := r
+		other.Status = c.status
+		other.Readiness = &readiness.State{SchemaVersion: "v1", Phase: c.phase, Plans: []readiness.Proposal{{Plan: viewPlan(r.Workspace.BaseCommit), Digest: digest}}}
+		if c.status == molecule.StatusRetired {
+			other.Retired = &molecule.Retirement{At: "2026-10-26T20:00:00Z", Reason: "stale", PriorStatus: "waiting"}
+		}
+		lab2, _ := labFixture(t)
+		other.LabDir = lab2
+		writeRecord(t, lab2, other)
+		d := detailOf(t, testHandler(t, Options{LabDir: lab2}), other.ID)
+		if d.View.Decision.Primary != nil || d.View.Decision.RequestChanges || d.View.Decision.Kind != DecisionNone {
+			t.Errorf("%s: decision %+v", c.status, d.View.Decision)
+		}
+	}
+}
+
+// NEW and EDIT come from the frozen base tree only: a path absent from it is
+// new, whatever its reason says; without a frozen tree there is no badge.
+func TestMoleculeViewNewAndEditComeFromTheBaseTree(t *testing.T) {
+	lab, r, _ := viewFixture(t)
+	h := testHandler(t, Options{LabDir: lab})
+	files := detailOf(t, h, r.ID).View.Plan.Files
+	if len(files) != 2 || files[0].Path != "lab/internal/ui/web/app.js" || files[0].Change != ChangeEdit || files[1].Path != "lab/internal/ui/estimate.go" || files[1].Change != ChangeNew {
+		t.Fatalf("files %+v", files)
+	}
+	if files[0].Reason != "Rebuild the view" {
+		t.Errorf("reason %q", files[0].Reason)
+	}
+	r.RepositoryEvidence = nil
+	writeRecord(t, lab, r)
+	for _, f := range detailOf(t, h, r.ID).View.Plan.Files {
+		if f.Change != "" {
+			t.Errorf("%s has a badge without a frozen tree: %q", f.Path, f.Change)
+		}
+	}
+}
+
+// Checks are grouped under human names, the plan's own first, then the Formula
+// baseline as Full test suite, Go vet · gofmt and Repository hygiene, each with
+// its exact command quoted as a shell reads it.
+func TestMoleculeViewGroupsAndNamesChecks(t *testing.T) {
+	lab, r, _ := viewFixture(t)
+	plan := detailOf(t, testHandler(t, Options{LabDir: lab}), r.ID).View.Plan
+	got := map[string][]string{}
+	var order []string
+	for _, g := range plan.CheckGroups {
+		order = append(order, g.Name)
+		for _, c := range g.Checks {
+			got[g.Name] = append(got[g.Name], c.Command+" @"+c.Dir)
+		}
+		if g.Baseline == (g.Name == GroupCandidate) {
+			t.Errorf("%s baseline %t", g.Name, g.Baseline)
+		}
+	}
+	if want := []string{GroupCandidate, GroupFullSuite, GroupVet, GroupHygiene}; !reflect.DeepEqual(order, want) {
+		t.Fatalf("groups %q, want %q", order, want)
+	}
+	want := map[string][]string{
+		GroupCandidate: {"go test ./internal/ui/... ./internal/molecule/... @lab"},
+		GroupFullSuite: {"go test -timeout 20m ./... @lab"},
+		GroupVet:       {"go vet ./... @lab", `sh -c 'test -z "$(gofmt -l internal cmd)"' @lab`},
+		GroupHygiene:   {"sh scripts/check-repo-hygiene.sh @", "sh scripts/check-repo-hygiene.test.sh @"},
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("checks %q, want %q", got, want)
+	}
+	if plan.ChecksTotal != 6 || plan.Questions != 1 || plan.BudgetMS != 1800000 || len(plan.Components) != 2 || plan.Components[0] != "lab/internal/ui" || plan.Components[1] != "lab/internal/ui/web" {
+		t.Errorf("plan facts %+v", plan)
+	}
+	// A shell metacharacter in an argument is quoted, never run together.
+	if got := shellJoin([]string{"sh", "-c", "a; b", "it's"}); got != `sh -c 'a; b' 'it'\''s'` {
+		t.Errorf("shellJoin %q", got)
+	}
+}
+
+var (
+	rawDigest = regexp.MustCompile(`[0-9a-f]{40,}`)
+	rawTime   = regexp.MustCompile(`\d{4}-\d{2}-\d{2}T\d{2}:\d{2}`)
+)
+
+// The view's text carries no raw digest, ISO timestamp, Molecule id or phase
+// code: only Plan.Digest (bound, shown short inside Plan details) and the
+// times the browser formats are data.
+func TestMoleculeViewHasNoRawDigestOrTimestampOutsideDetails(t *testing.T) {
+	lab, r, digest := viewFixture(t)
+	p := r.Readiness.Plans[0].Plan
+	p.Analysis.Summary = "Builds on " + strings.Repeat("ef", 32) + " from 2026-10-25T08:00:00Z for mol-12-0123456789abcdef in " + lab
+	p.Analysis.Scope[0].Reason = "Like commit 0123456789abcdef0123456789abcdef01234567 at 2026-10-24T10:00:00+02:00"
+	p.Analysis.Acceptance[0].Description = "Matches assay-0123456789ab"
+	p.OperatorNote = "Note " + strings.Repeat("a1", 32)
+	r.Readiness.Plans[0].Plan = p
+	writeRecord(t, lab, r)
+	v := detailOf(t, testHandler(t, Options{LabDir: lab}), r.ID).View
+	if v.Plan.Digest != digest || v.Plan.PlannedAt != "2026-10-26T18:46:00Z" {
+		t.Fatalf("bound data %q %q", v.Plan.Digest, v.Plan.PlannedAt)
+	}
+	stripped := *v
+	plan := *v.Plan
+	plan.Digest, plan.PlannedAt = "", ""
+	stripped.Plan = &plan
+	stripped.Decision.Primary = nil
+	raw, _ := json.Marshal(stripped)
+	text := string(raw)
+	for name, re := range map[string]*regexp.Regexp{"digest": rawDigest, "timestamp": rawTime, "Molecule id": rawID} {
+		if m := re.FindString(text); m != "" {
+			t.Errorf("the view carries a raw %s %q: %s", name, m, text)
+		}
+	}
+	for _, code := range []string{"scope-waiting", "review-waiting", r.ID} {
+		if strings.Contains(text, code) {
+			t.Errorf("the view carries %q", code)
+		}
+	}
+	noLeak(t, text)
+	if !strings.Contains(v.Plan.Summary, "efefefe…") || !strings.Contains(v.Plan.Summary, "2026-10-25") || !strings.Contains(v.Plan.Summary, "<lab>") {
+		t.Errorf("summary %q", v.Plan.Summary)
+	}
+}
+
+// The stepper and the pill come from the Atoms, the phase and the receipt.
+func TestMoleculeViewStepperAndStateInPlainWords(t *testing.T) {
+	lab, r, _ := viewFixture(t)
+	h := testHandler(t, Options{LabDir: lab})
+	states := func(v *MoleculeView) string {
+		var s []string
+		for _, st := range v.Steps {
+			s = append(s, st.State)
+		}
+		return strings.Join(s, " ")
+	}
+	r.Atoms = inboxAtoms("done", "waiting", "pending", "pending", "pending", "pending")
+	writeRecord(t, lab, r)
+	v := detailOf(t, h, r.ID).View
+	if v.Current != StepApproval || states(v) != "done current todo todo todo todo todo" || v.State.Label != "Waiting for your approval" || v.State.Tone != ToneNeeds {
+		t.Fatalf("scope: current %d %q %+v", v.Current, states(v), v.State)
+	}
+	if v.Roles.Coding != "codex" || v.Roles.Model != "claude-opus-5-5" || v.Roles.Reviewer != "claude-code" {
+		t.Errorf("roles %+v", v.Roles)
+	}
+	if c := v.PlanningCost; c == nil || c.USD == nil || *c.USD != 1.82 || c.Reported != 1 || c.Attempts != 2 || !c.Partial {
+		t.Errorf("planning cost %+v", c)
+	}
+
+	r.Status = "running"
+	r.Readiness.Phase = "coding"
+	r.Atoms = inboxAtoms("done", "done", "active", "pending", "pending", "pending")
+	// The pill counts from the current coding attempt, not the Atom's first start.
+	r.Atoms[2].StartedAt = "2026-10-26T17:00:00Z"
+	r.Atoms[2].Provenance = &molecule.AtomProvenance{Actions: []molecule.AtomAction{{AttemptID: "coding-1", StartedAt: "2026-10-26T19:00:00.5Z"}}}
+	harnessAttempts := r.HarnessAttempts
+	r.HarnessAttempts = []molecule.HarnessAttempt{{ID: "coding-1", PlanDigest: r.Readiness.Plans[0].Digest}}
+	writeRecord(t, lab, r)
+	r.HarnessAttempts = harnessAttempts
+	v = detailOf(t, h, r.ID).View
+	if v.Current != StepCoding || states(v) != "done done current todo todo todo todo" || v.State.Label != "Coding" || v.State.Since != "2026-10-26T19:00:00Z" || v.State.Tone != ToneRunning {
+		t.Fatalf("coding: %q %+v", states(v), v.State)
+	}
+
+	r.Status = "blocked"
+	r.Atoms = inboxAtoms("done", "done", "done", "failed", "pending", "pending")
+	writeRecord(t, lab, r)
+	v = detailOf(t, h, r.ID).View
+	if v.Current != StepChecks || states(v) != "done done done blocked todo todo todo" || v.State.Label != "Blocked · Required checks did not pass" || v.State.Tone != ToneBlocked {
+		t.Fatalf("blocked: %q %+v", states(v), v.State)
+	}
+
+	r.Status = "recorded"
+	r.Readiness.Phase = "review-waiting"
+	r.Atoms = inboxAtoms("done", "done", "done", "done", "done", "done")
+	writeRecord(t, lab, r)
+	writeReceipt(t, lab, r.ID, "published", "MERGED")
+	v = detailOf(t, h, r.ID).View
+	if v.Current != StepMerged || states(v) != "done done done done done done done" {
+		t.Fatalf("merged: %d %q", v.Current, states(v))
+	}
+}
+
+// The served page has the Molecule view inside Work: a breadcrumb, the pill,
+// the steps, one live region, the Plan and Timeline tabs with the Timeline
+// keeping the Atoms, evidence and logs, and the aside for the decision. The
+// danger zone is built by the script, so the page keeps one danger button.
+func TestMoleculeViewServedPage(t *testing.T) {
+	page := do(t, testHandler(t, Options{LabDir: t.TempDir()}), authed("/")).Body.String()
+	view := between(t, page, `<section id="selected" class="molecule-view"`, "</section>\n</div>")
+	for _, want := range []string{
+		`<nav class="breadcrumb" aria-label="Breadcrumb"><a id="mv-back" href="?view=work" data-view="work">Work</a>`,
+		`<span id="mv-state" class="state-pill" data-tone="neutral">`,
+		`<h1 id="mv-title" class="mv-title" tabindex="-1"></h1>`,
+		`<ol id="mv-steps" class="mv-steps" aria-label="Progress"></ol>`,
+		`<p id="mv-live" class="sr-only" role="status" aria-live="polite"></p>`,
+		`role="tab" id="mv-tab-plan"`, `role="tab" id="mv-tab-timeline"`,
+		`id="mv-timeline" class="glass run-panel mv-timeline" role="tabpanel"`,
+		`<div id="atoms" class="atoms"></div>`, `<div id="readiness"></div>`, `<div id="attempts"></div>`, `id="yaml"`,
+		"What Forgecell will do", "Files it may change", "Checks it must pass",
+		`<details id="mv-details" class="mv-details">`, `<button type="button" id="mv-copy-digest"`,
+		`<aside id="mv-aside" class="mv-aside" aria-label="Your decision">`, `<div id="mv-danger-slot"></div>`,
+	} {
+		if !strings.Contains(view, want) {
+			t.Errorf("the Molecule view lacks %s", want)
+		}
+	}
+	if strings.Count(view, "aria-live") != 1 || strings.Contains(view, "btn-danger") || strings.Contains(view, "btn-primary") {
+		t.Error("the Molecule view markup has more than one live region or a static action")
+	}
+	for _, gone := range []string{"GATES AND DECISIONS", "NEXT ACTION", `id="run-title"`} {
+		if strings.Contains(page, gone) {
+			t.Errorf("the page still has %s", gone)
+		}
+	}
+}
+
+// The served script renders the decision card's one primary bound to the shown
+// digest, keeps Retire and Stop behind a disclosure and a confirmation naming
+// the Molecule and apart from any primary, routes ?m= and Back through
+// history, and never rewrites the Publish title while polling.
+func TestMoleculeViewServedJS(t *testing.T) {
+	js := do(t, testHandler(t, Options{LabDir: t.TempDir()}), authed("/app.js")).Body.String()
+	build := jsFunction(t, js, "ensureMoleculeView")
+	decision := between(t, build, "fill($('#mv-decision'),", ");")
+	danger := between(t, build, "c.stopOpen =", "fill($('#mv-danger-slot'), c.runnerNote, c.danger);")
+	if strings.Contains(decision, "stop") || strings.Contains(decision, "retire") || strings.Contains(decision, "danger") {
+		t.Errorf("the decision card holds a destructive action: %s", decision)
+	}
+	if strings.Contains(danger, "btn-primary") || strings.Count(danger, "btn-danger") != 4 {
+		t.Errorf("the danger zone has a primary or a stray danger button:\n%s", danger)
+	}
+	// Three primaries are built (approve, preview, publish); renderDecision shows
+	// one at a time.
+	if n := strings.Count(build, "btn-primary"); n != 3 {
+		t.Errorf("%d primaries built", n)
+	}
+	for name, wants := range map[string][]string{
+		"ensureMoleculeView": {
+			"if (mv.controls) return mv.controls;",
+			"c.approveForm = el('form', { class: 'decision-form', id: 'mv-approve-form', novalidate: true, hidden: true, onsubmit: submitApprove }, c.approve);",
+			"'Request changes…'",
+			"c.amendForm = el('form', { class: 'amend-form', id: 'mv-amend-form'",
+			"name: 'acceptance', maxlength: '1000', autocomplete: 'off', placeholder: 'The help text names the new flag…', 'aria-describedby': 'mv-amend-error'",
+			"name: 'title', maxlength: '256', autocomplete: 'off', placeholder: 'Add the Molecule view to the Lab UI…', 'aria-describedby': 'mv-publish-error', dataset: { gate: 'title' }, oninput: (e) => { state.gate.title = e.target.value; } }",
+			"el('summary', null, 'Not needed anymore?')",
+			"onclick: () => openConfirm('retire') }, 'Retire this Molecule…')",
+			"onclick: () => openConfirm('stop') }, 'Stop this Molecule…')",
+			"onsubmit: submitRetire", "onsubmit: submitStop",
+		},
+		"renderDecision": {
+			"const digest = readOnly ? '' : boundDigest(d);",
+			"c.approveForm.hidden = !scope;",
+			"if (scope) c.approveForm.dataset.digest = digest;",
+			"c.approve.disabled = busy;",
+			"setAttr(c.preview, 'class', preview ? 'btn btn-secondary btn-decision-secondary' : 'btn btn-primary btn-decision');",
+			"c.publishForm.hidden = !preview;",
+			"setText(c.retireQuestion, 'Retire ' + moleculeName(d) + '?');",
+			"setText(c.stopQuestion, 'Stop ' + moleculeName(d) + '?');",
+			"hasAction('request plan changes')",
+			"if (gate.message && gate.announce) { gate.announce = false; target.focus(); }",
+			// Stop only when the server says this Lab UI runs the engine call;
+			// otherwise the runner's plain text replaces it.
+			"const stoppable = live && Boolean(control && control.stoppable === true);",
+			"const canStop = !readOnly && (stoppable || Boolean(gate.stop)) && hasAction('stop Molecule');",
+			"c.stopOpen.hidden = !stoppable || Boolean(gate.stop);",
+			"setText(c.runnerNote, runner);",
+		},
+		"submitGate":    {"if (!res.ok && action === '/amend' && body && body.category === 'stale') {", "'A newer plan exists, so your changes were not recorded."},
+		"withAttempt":   {"if (RERUN_NOTES.includes(note)) parts.push(note);"},
+		"boundDigest":   {"digest === plan.digest && digest === g.digest && digest === latestDigest(d)"},
+		"submitApprove": {"e.preventDefault();", "const digest = mv.controls.approveForm.dataset.digest;", "if (digest) approveScope(digest);"},
+		"requestChanges": {
+			"addAcceptance: acceptance ? [acceptance] : [], addScope: path ? [{ path: path, reason: reason }] : []",
+			"submitGate('/amend', JSON.stringify(body))",
+		},
+		"submitRetire":      {"e.preventDefault();", "retireMolecule();"},
+		"openConfirm":       {"c[kind + 'Form'].hidden = false;"},
+		"viewFromURL":       {"if (!view && moleculeFromURL()) return 'work';"},
+		"restoreSelection":  {"else if (!id && state.selectedId) overview();", "if (VIEWS.includes(from)) mv.from = from;"},
+		"openMolecule":      {"rememberFrom(from);"},
+		"navigate":          {"if (moleculeFromURL()) history.pushState({ view: view }, '', '?view=' + view);", "restoreSelection();"},
+		"renderHeader":      {"whenText(plan.plannedAt)", "dateTitle(plan.plannedAt)"},
+		"renderPlanDetails": {"el('code', null, digest.slice(0, 7))", "setText($('#mv-digest-short'), digest ? short(digest) : 'Not recorded');"},
+		"renderTimeline":    {"if (panel.contains(document.activeElement) && mv.timelineId === d.id) { mv.timelineDirty = true; return; }"},
+		"money":             {"value > 0 && value < 0.01 ? 'under $0.01' : dollars.format(value)"},
+		"fillKeyed":         {"if (node.dataset.key === key) return;"},
+		"showMoleculeView":  {"$('.shelf').hidden = open;"},
+		"renderPlan":        {"if (key === mv.planKey) return;"},
+	} {
+		body := jsFunction(t, js, name)
+		for _, want := range wants {
+			if !strings.Contains(body, want) {
+				t.Errorf("%s lacks %q", name, want)
+			}
+		}
+	}
+	// A poll never rewrites a typed value or rebuilds the card.
+	render := jsFunction(t, js, "renderDecision")
+	for _, gone := range []string{"title.value", "reasonInput.value", "acceptance.value", "fill($('#mv-decision')", "short(", "innerHTML"} {
+		if strings.Contains(render, gone) {
+			t.Errorf("renderDecision has %q", gone)
+		}
+	}
+	// No raw digest or timestamp text is set outside Plan details.
+	for _, name := range []string{"renderHeader", "renderDecision", "renderPlan", "fileItem", "groupItem", "renderRoles"} {
+		body := jsFunction(t, js, name)
+		if regexp.MustCompile(`(setText|el)\([^;]*(\.digest\b[^)]*\)|plannedAt\))`).MatchString(strings.ReplaceAll(strings.ReplaceAll(body, "whenText(plan.plannedAt)", ""), "dateTitle(plan.plannedAt)", "")) {
+			t.Errorf("%s renders a digest or a raw time", name)
+		}
+	}
+	if !strings.Contains(js, "'Committed: the ledger records your approval of this plan. Coding starts on its own.'") || strings.Contains(js, "approval of plan ' + short(") {
+		t.Error("the approval read-back still shows a digest")
+	}
+	if !strings.Contains(js, "const GATE_FORMS = { '/amend': 'amend', '/delivery/publish': 'publish', '/stop': 'stop', '/retire': 'retire' };") {
+		t.Error("gate outcomes are not shown in the form that sent them")
+	}
+}
+
+// The served CSS gives the decision primary 48px, keeps the decision aside
+// sticky, stacks the view on narrow screens and keeps 44px targets and forced
+// colors for its controls.
+func TestMoleculeViewServedCSS(t *testing.T) {
+	css := do(t, testHandler(t, Options{LabDir: t.TempDir()}), authed("/style.css")).Body.String()
+	rules := cssRules(css)
+	wantDecls(t, rules, ".btn-decision", "height: 48px;", "border-radius: 14px;")
+	wantDecls(t, rules, ".mv-aside", "position: sticky;")
+	wantDecls(t, rules, ".mv-steps", "grid-template-columns: repeat(7, minmax(0, 1fr));")
+	wantDecls(t, rules, ".file-badge.is-new", "background: #dcefe9;")
+	wantDecls(t, rules, ".danger-zone", "border: 1px solid #eccfc6;")
+	wantDecls(t, rules, ".state-pill[data-tone=needs]", "background: var(--needs-bg);")
+	wantDecls(t, rules, ".shell.has-molecule .side-panel", "display: none;")
+	wantDecls(t, cssRules(mediaBlock(t, css, "@media (max-width: 1199px)")), ".mv-layout", "grid-template-columns: minmax(0, 1fr);")
+	mobile := cssRules(mediaBlock(t, css, "@media (max-width: 720px)"))
+	wantDecls(t, mobile, ".check-grid", "grid-template-columns: minmax(0, 1fr);")
+	wantDecls(t, mobile, ".file", "grid-template-columns: minmax(0, 1fr);")
+	wantDecls(t, cssRules(mediaBlock(t, css, "@media (pointer: coarse)")), ".mv-tab, .btn-small, .breadcrumb a, .accept-label, .preview-info .text-button", "min-height: 44px;")
+	forced := cssRules(mediaBlock(t, css, "@media (forced-colors: active)"))
+	wantDecls(t, forced, ".mv-tab[aria-selected=true]", "background: Highlight;")
+	wantDecls(t, forced, ".mv-step.is-done .step-bar, .mv-step.is-current .step-bar, .mv-step.is-blocked .step-bar", "background: Highlight;")
+	if bad := uncoveredOutlineResets(css); len(bad) != 0 {
+		t.Errorf("outline resets without a ring: %q", bad)
+	}
+}
diff --git a/lab/internal/ui/projection.go b/lab/internal/ui/projection.go
index 98ff6cc..08767c6 100644
--- a/lab/internal/ui/projection.go
+++ b/lab/internal/ui/projection.go
@@ -5,13 +5,18 @@ import (
 	"encoding/hex"
 	"fmt"
 	"github.com/DanielNetzer/forgecell/lab/internal/delivery"
+	"github.com/DanielNetzer/forgecell/lab/internal/formula"
 	"github.com/DanielNetzer/forgecell/lab/internal/harness"
 	"github.com/DanielNetzer/forgecell/lab/internal/intake"
 	"github.com/DanielNetzer/forgecell/lab/internal/molecule"
+	"github.com/DanielNetzer/forgecell/lab/internal/readiness"
 	"io"
+	"math"
 	"os"
+	"path"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -77,6 +82,8 @@ type Detail struct {
 	Next        NextView       `json:"next"`
 	Retired     *RetiredView   `json:"retired"`
 	Diagnostics []string       `json:"diagnostics"`
+	// View is the plain-words Molecule view (#251): absent for sample data.
+	View *MoleculeView `json:"view,omitempty"`
 }
 
 // RetiredView is a retired Molecule's retired event: its time, the status it
@@ -655,9 +662,523 @@ func project(lab string, r molecule.Record, read receiptReader, withYAML bool) D
 	for _, a := range r.ReviewAttempts {
 		out.Attempts = append(out.Attempts, AttemptView{Kind: "review", ID: fmt.Sprintf("review-%d", a.Ordinal), Status: a.Status, StartedAt: a.StartedAt, FinishedAt: a.FinishedAt, Binding: a.Binding, Usage: a.Usage, FailureClass: knownFailureClass(a.FailureClass)})
 	}
+	out.View = moleculeView(x, r, out.Lane, out.Activity, out.Gate, d)
 	return out
 }
 
+// MoleculeView is the Molecule view in plain words: the state pill, the seven
+// steps, the latest plan, the one decision this page offers, the roles and the
+// planning cost. Free text is redacted, bounded to one line and stripped of raw
+// ids, digests and timestamps; Plan.Digest and PlannedAt are data for the
+// browser (the bound digest, shown only short inside Plan details, and a time it
+// formats), never prose.
+type MoleculeView struct {
+	State        StateView         `json:"state"`
+	Steps        []StepView        `json:"steps"`
+	Current      int               `json:"current"`
+	Plan         *PlanBrief        `json:"plan,omitempty"`
+	Decision     DecisionView      `json:"decision"`
+	Roles        RolesView         `json:"roles"`
+	PlanningCost *PlanningCostView `json:"planningCost,omitempty"`
+	// Control is set by the handler for a running Molecule: whether this Lab UI
+	// can stop it and, when not, who runs it.
+	Control *ControlView `json:"control,omitempty"`
+}
+
+// State tones: what the pill's dot and colour say, always with its text.
+const (
+	ToneNeeds   = "needs"
+	ToneRunning = "running"
+	ToneBlocked = "blocked"
+	ToneMerged  = "merged"
+	ToneNeutral = "neutral"
+)
+
+// StateView is the state pill: "Waiting for your approval", "Coding" (the
+// browser appends the minutes since Since, the current attempt's start, then
+// Note, a fixed rerun note), "Ready to publish", "Blocked · …".
+type StateView struct {
+	Label string `json:"label"`
+	Tone  string `json:"tone"`
+	Since string `json:"since,omitempty"`
+	Note  string `json:"note,omitempty"`
+}
+
+// Step states.
+const (
+	StepDone    = "done"
+	StepCurrent = "current"
+	StepFailed  = "blocked"
+	StepTodo    = "todo"
+)
+
+// StepView is one of Plan · Your approval · Coding · Checks · Review · Draft PR
+// · Merged, derived from the Atoms, the readiness phase and the receipt.
+type StepView struct {
+	Label string `json:"label"`
+	State string `json:"state"`
+}
+
+// File changes, from the frozen base tree: absent from it is new, present is an
+// edit. Unknown means the ledger has no frozen tree, so no badge is shown.
+const (
+	ChangeNew  = "new"
+	ChangeEdit = "edit"
+)
+
+// PlanBrief is the latest plan in plain words. Lists are bounded; their Total
+// says how many the plan has, so a cut list is never read as the whole.
+type PlanBrief struct {
+	Revision        int                `json:"revision"`
+	Digest          string             `json:"digest"`
+	PlannedAt       string             `json:"plannedAt,omitempty"`
+	Summary         string             `json:"summary"`
+	Questions       int                `json:"questions"`
+	Components      []string           `json:"components"`
+	ComponentsTotal int                `json:"componentsTotal"`
+	BudgetMS        int                `json:"budgetMs,omitempty"`
+	Note            string             `json:"note,omitempty"`
+	Files           []PlanFileView     `json:"files"`
+	FilesTotal      int                `json:"filesTotal"`
+	CheckGroups     []CheckGroupView   `json:"checkGroups"`
+	ChecksTotal     int                `json:"checksTotal"`
+	Acceptance      []string           `json:"acceptance"`
+	AcceptanceTotal int                `json:"acceptanceTotal"`
+	Evidence        []PlanEvidenceView `json:"evidence"`
+	EvidenceTotal   int                `json:"evidenceTotal"`
+}
+
+// PlanFileView is one scope path with its reason and its change from the base tree.
+type PlanFileView struct {
+	Path   string `json:"path"`
+	Reason string `json:"reason"`
+	Change string `json:"change,omitempty"`
+}
+
+// CheckGroupView is checks under one human name. Baseline marks the Formula's
+// own checks, which every plan carries.
+type CheckGroupView struct {
+	Name     string          `json:"name"`
+	Baseline bool            `json:"baseline"`
+	Checks   []PlanCheckView `json:"checks"`
+}
+
+// PlanCheckView is one check's exact command, quoted as a shell would read it,
+// and its directory.
+type PlanCheckView struct {
+	ID      string `json:"id"`
+	Command string `json:"command"`
+	Dir     string `json:"dir,omitempty"`
+}
+
+// PlanEvidenceView is one frozen evidence file the plan cites.
+type PlanEvidenceView struct {
+	ID   string `json:"id"`
+	Path string `json:"path"`
+}
+
+// Decision kinds: the scope gate, the review gate (preview, then publish), a
+// published draft, or nothing for this page to decide.
+const (
+	DecisionScope     = "scope"
+	DecisionDelivery  = "delivery"
+	DecisionPublished = "published"
+	DecisionNone      = "none"
+)
+
+// DecisionView is the sticky decision card. It has at most one Primary, and a
+// scope Primary carries the exact digest the Plan shows.
+type DecisionView struct {
+	Kind           string       `json:"kind"`
+	Title          string       `json:"title"`
+	Copy           string       `json:"copy"`
+	Primary        *PrimaryView `json:"primary,omitempty"`
+	RequestChanges bool         `json:"requestChanges,omitempty"`
+	PullURL        string       `json:"pullUrl,omitempty"`
+}
+
+// Primary actions.
+const (
+	PrimaryApprove = "approve"
+	PrimaryPreview = "preview"
+)
+
+// PrimaryView is the card's one primary action and the digest it is bound to.
+type PrimaryView struct {
+	Action string `json:"action"`
+	Label  string `json:"label"`
+	Digest string `json:"digest,omitempty"`
+}
+
+// RolesView names who works on the Molecule, from its Formula snapshot and its
+// recorded attempts; an absent value is not recorded.
+type RolesView struct {
+	Coding   string `json:"coding,omitempty"`
+	Model    string `json:"model,omitempty"`
+	Reviewer string `json:"reviewer,omitempty"`
+}
+
+// PlanningCostView is the reported cost of the analysis attempts. USD is null
+// when none reported one; Partial when only some did.
+type PlanningCostView struct {
+	USD      *float64 `json:"usd"`
+	Reported int      `json:"reported"`
+	Attempts int      `json:"attempts"`
+	Partial  bool     `json:"partial"`
+}
+
+// Bounds of the plan in plain words.
+const (
+	maxPlanSummaryRunes = 1200
+	maxPlanReasonRunes  = 400
+	maxPlanPathRunes    = 300
+	maxPlanCommandRunes = 400
+	maxPlanFiles        = 200
+	maxPlanChecks       = 64
+	maxPlanAcceptance   = 64
+	maxPlanEvidence     = 64
+	maxPlanComponents   = 6
+	maxRoleRunes        = 80
+)
+
+// planText is untrusted plan text as one bounded plain line: redacted, controls
+// removed, ids replaced, digests shortened and timestamps cut to their date.
+func planText(x redactor, s string, limit int) string {
+	s = harness.ReviewDisplayText(redactSecrets(x.text(s)), 4*limit)
+	s = rawID.ReplaceAllStringFunc(s, func(id string) string {
+		if id[0] == 'a' {
+			return "an assay"
+		}
+		return "a Molecule"
+	})
+	s = longHex.ReplaceAllStringFunc(s, func(h string) string { return h[:7] + "…" })
+	s = isoTime.ReplaceAllString(s, "$1")
+	return harness.ReviewDisplayText(s, limit)
+}
+
+func moleculeView(x redactor, r molecule.Record, lane, activity string, g GateView, d *DeliveryState) *MoleculeView {
+	v := &MoleculeView{}
+	step, label, since, note := stepProgress(r, lane, activity, d)
+	merged := d.Published() && d.Lifecycle == "MERGED"
+	v.Current = step
+	for i, l := range StepLabels {
+		s := StepTodo
+		switch {
+		case i < step || merged:
+			s = StepDone
+		case i == step && lane == LaneBlocked:
+			s = StepFailed
+		case i == step:
+			s = StepCurrent
+		}
+		v.Steps = append(v.Steps, StepView{Label: l, State: s})
+	}
+	v.State = stateView(r, lane, activity, label, since, note, g, d)
+	if r.Readiness != nil && len(r.Readiness.Plans) > 0 {
+		v.Plan = planBrief(x, r)
+	}
+	v.Decision = decisionView(r, lane, activity, g, v.Plan)
+	f, err := formula.Parse([]byte(r.FormulaSnapshot.YAML))
+	if err == nil {
+		v.Roles = roles(x, r, f)
+		if v.Plan != nil && v.Plan.BudgetMS == 0 {
+			b, _ := f.RoleBinding(formula.CodingHarness)
+			v.Plan.BudgetMS = b.EffectiveTimeoutMS()
+		}
+	} else {
+		v.Roles = roles(x, r, formula.Formula{})
+	}
+	v.PlanningCost = planningCost(r)
+	return v
+}
+
+// stateView is the pill: a gate first, then the lane.
+func stateView(r molecule.Record, lane, activity, label, since, note string, g GateView, d *DeliveryState) StateView {
+	switch {
+	case lane == LaneRetired:
+		return StateView{Label: "Retired", Tone: ToneNeutral}
+	case g.State == GateScope:
+		return StateView{Label: "Waiting for your approval", Tone: ToneNeeds}
+	case g.State == GateDelivery:
+		return StateView{Label: "Ready to publish", Tone: ToneNeeds}
+	case g.State == GatePublished && d != nil && d.Lifecycle == "MERGED":
+		return StateView{Label: "Merged", Tone: ToneMerged}
+	case g.State == GatePublished:
+		return StateView{Label: "Draft published", Tone: ToneMerged}
+	case lane == LaneBlocked:
+		return StateView{Label: "Blocked · " + strings.TrimSuffix(blockedReason(r), "."), Tone: ToneBlocked}
+	case lane == LaneRunning && activity == ActivityQueued:
+		return StateView{Label: "Queued for checks", Tone: ToneRunning}
+	case lane == LaneRunning:
+		return StateView{Label: label, Tone: ToneRunning, Since: since, Note: note}
+	case lane == LaneDecision:
+		return StateView{Label: "Waiting at a gate", Tone: ToneNeeds}
+	}
+	return StateView{Label: "Recorded", Tone: ToneNeutral}
+}
+
+// plannedAt is when the latest plan was proposed or amended, re-formatted, or ""
+// when no valid time is recorded for it.
+func plannedAt(s *readiness.State, digest string) string {
+	at := ""
+	for _, e := range s.Events {
+		if e.Digest == digest && e.Kind != "approved" {
+			at = e.At
+		}
+	}
+	return stepSince(at)
+}
+
+func planBrief(x redactor, r molecule.Record) *PlanBrief {
+	latest := r.Readiness.Plans[len(r.Readiness.Plans)-1]
+	p := latest.Plan
+	a := p.Analysis
+	b := &PlanBrief{Revision: p.Revision, PlannedAt: plannedAt(r.Readiness, latest.Digest), Summary: planText(x, a.Summary, maxPlanSummaryRunes), Questions: len(a.Questions), BudgetMS: max(p.HarnessTimeoutMS, 0),
+		Files: []PlanFileView{}, FilesTotal: len(a.Scope), CheckGroups: []CheckGroupView{}, ChecksTotal: len(a.Checks), Acceptance: []string{}, AcceptanceTotal: len(a.Acceptance), Evidence: []PlanEvidenceView{}, EvidenceTotal: len(p.Evidence), Components: []string{}}
+	if sha256Hex.MatchString(latest.Digest) {
+		b.Digest = latest.Digest
+	}
+	if p.OperatorNote != "" {
+		b.Note = planText(x, p.OperatorNote, maxPlanReasonRunes)
+	}
+	// Newness comes from the frozen base tree only, never from plan text.
+	var tree map[string]bool
+	if r.RepositoryEvidence != nil {
+		tree = map[string]bool{}
+		for _, f := range r.RepositoryEvidence.Files {
+			tree[f.Path] = true
+		}
+	}
+	components := map[string]bool{}
+	var order []string
+	for i, s := range a.Scope {
+		dir := path.Dir(s.Path)
+		if dir == "." {
+			dir = "repository root"
+		}
+		if !components[dir] {
+			components[dir] = true
+			order = append(order, dir)
+		}
+		if i >= maxPlanFiles {
+			continue
+		}
+		f := PlanFileView{Path: planText(x, s.Path, maxPlanPathRunes), Reason: planText(x, s.Reason, maxPlanReasonRunes)}
+		if tree != nil {
+			f.Change = ChangeEdit
+			if !tree[s.Path] {
+				f.Change = ChangeNew
+			}
+		}
+		b.Files = append(b.Files, f)
+	}
+	sort.Strings(order)
+	b.ComponentsTotal = len(order)
+	for _, c := range order[:min(len(order), maxPlanComponents)] {
+		b.Components = append(b.Components, planText(x, c, maxPlanPathRunes))
+	}
+	b.CheckGroups = checkGroups(x, p)
+	for i, c := range a.Acceptance {
+		if i == maxPlanAcceptance {
+			break
+		}
+		b.Acceptance = append(b.Acceptance, planText(x, c.Description, maxPlanReasonRunes))
+	}
+	for i, e := range p.Evidence {
+		if i == maxPlanEvidence {
+			break
+		}
+		b.Evidence = append(b.Evidence, PlanEvidenceView{ID: planText(x, e.ID, maxRoleRunes), Path: planText(x, e.Path, maxPlanPathRunes)})
+	}
+	return b
+}
+
+// The human names of check groups, in display order: the plan's own checks
+// first, then the Formula baseline.
+const (
+	GroupCandidate  = "New tests for this change"
+	GroupRegression = "Regression tests"
+	GroupSetup      = "Setup"
+	GroupFullSuite  = "Full test suite"
+	GroupVet        = "Go vet · gofmt"
+	GroupHygiene    = "Repository hygiene"
+	GroupBaseline   = "Other Formula checks"
+	GroupOther      = "Other checks"
+)
+
+var groupOrder = []string{GroupCandidate, GroupRegression, GroupSetup, GroupOther, GroupFullSuite, GroupVet, GroupHygiene, GroupBaseline}
+
+// checkGroupName names a check by what it runs: a Formula baseline check by its
+// command (go test, go vet or gofmt, the repository hygiene script), any other by
+// its category.
+func checkGroupName(c readiness.Check, baseline bool) string {
+	if !baseline {
+		switch c.Category {
+		case "candidate":
+			return GroupCandidate
+		case "regression":
+			return GroupRegression
+		case "setup":
+			return GroupSetup
+		}
+		return GroupOther
+	}
+	argv := c.Argv
+	has := func(part string) bool {
+		return slices.ContainsFunc(argv, func(a string) bool { return strings.Contains(a, part) })
+	}
+	switch {
+	case len(argv) > 1 && path.Base(argv[0]) == "go" && argv[1] == "test":
+		return GroupFullSuite
+	case len(argv) > 1 && path.Base(argv[0]) == "go" && argv[1] == "vet", has("gofmt"):
+		return GroupVet
+	case has("check-repo-hygiene"):
+		return GroupHygiene
+	}
+	return GroupBaseline
+}
+
+func checkGroups(x redactor, p readiness.Plan) []CheckGroupView {
+	baseline := map[string]bool{}
+	for _, id := range p.FormulaBaseline {
+		baseline[id] = true
+	}
+	groups := map[string]*CheckGroupView{}
+	for i, c := range p.Analysis.Checks {
+		if i == maxPlanChecks {
+			break
+		}
+		name := checkGroupName(c, baseline[c.ID])
+		g := groups[name]
+		if g == nil {
+			g = &CheckGroupView{Name: name, Baseline: baseline[c.ID], Checks: []PlanCheckView{}}
+			groups[name] = g
+		}
+		check := PlanCheckView{ID: planText(x, c.ID, maxRoleRunes), Command: harness.ReviewDisplayText(redactSecrets(x.text(shellJoin(c.Argv))), maxPlanCommandRunes)}
+		if c.Dir != "" && c.Dir != "." {
+			check.Dir = planText(x, c.Dir, maxPlanPathRunes)
+		}
+		g.Checks = append(g.Checks, check)
+	}
+	out := []CheckGroupView{}
+	for _, name := range groupOrder {
+		if g := groups[name]; g != nil {
+			out = append(out, *g)
+		}
+	}
+	return out
+}
+
+// shellJoin quotes argv as a POSIX shell would read it, for display only.
+func shellJoin(argv []string) string {
+	parts := make([]string, 0, len(argv))
+	for _, a := range argv {
+		if a != "" && strings.IndexFunc(a, func(r rune) bool {
+			return !(r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' || strings.ContainsRune("-_./=:,+@%", r))
+		}) < 0 {
+			parts = append(parts, a)
+			continue
+		}
+		parts = append(parts, "'"+strings.ReplaceAll(a, "'", `'\''`)+"'")
+	}
+	return strings.Join(parts, " ")
+}
+
+// decisionView is the one decision this page offers for the gate, in plain words.
+func decisionView(r molecule.Record, lane, activity string, g GateView, plan *PlanBrief) DecisionView {
+	switch g.State {
+	case GateScope:
+		if plan == nil || plan.Digest != g.Digest {
+			break
+		}
+		return DecisionView{Kind: DecisionScope, Title: "Approve this plan?",
+			Copy:    "Forgecell will code " + countWords(plan.FilesTotal, "file", "files") + ", then run " + countWords(plan.ChecksTotal, "check", "checks") + " on its own. Nothing is published until you approve the draft PR.",
+			Primary: &PrimaryView{Action: PrimaryApprove, Label: "Approve plan & start coding", Digest: g.Digest}, RequestChanges: true}
+	case GateDelivery:
+		return DecisionView{Kind: DecisionDelivery, Title: "Ready to publish?",
+			Copy:    "Preview the exact change first. Publishing creates a draft pull request only; it never merges or deploys.",
+			Primary: &PrimaryView{Action: PrimaryPreview, Label: "Preview delivery"}}
+	case GatePublished:
+		text := "The draft PR is published. Merge it on GitHub; Forgecell does not verify merges or production."
+		if g.Lifecycle == "MERGED" {
+			text = "The receipt last observed the pull request merged on GitHub. Forgecell does not verify production."
+		}
+		return DecisionView{Kind: DecisionPublished, Title: "Nothing to do", Copy: text, PullURL: g.URL}
+	}
+	d := DecisionView{Kind: DecisionNone, Title: "Nothing to do", Copy: "This Molecule is recorded and has no open gate."}
+	switch lane {
+	case LaneRunning:
+		d.Title, d.Copy = "Nothing needs you now", "Forgecell is working within the approved scope. It comes back to your Inbox when it needs you."
+		if activity == ActivityQueued {
+			d.Copy = "It is queued for checks: another Molecule in this Lab holds the verification slot."
+		}
+	case LaneBlocked:
+		d.Title, d.Copy = "Blocked", blockedReason(r)+" Failure evidence stays in the timeline."
+		if hint, ok := molecule.NotAuthenticated(r); ok {
+			d.Copy = harness.ReviewDisplayText(hint, maxReasonRunes) + ", then start this Issue again."
+		}
+	case LaneDecision:
+		d.Title, d.Copy = "Waiting at a gate", "This page does not perform this gate. Decide with the forgecell CLI; the engine checks every decision again."
+	case LaneRetired:
+		d.Title, d.Copy = "Retired", "Every record is kept. The loop never resumes it and may start a fresh Molecule for its Issue."
+	}
+	return d
+}
+
+// countWords is a count with its noun: "1 file", "5 files".
+func countWords(n int, one, many string) string {
+	if n == 1 {
+		return "1 " + one
+	}
+	return fmt.Sprintf("%d %s", n, many)
+}
+
+// roles names the coding agent and model and the reviewer: the latest coding
+// attempt's recorded model first, else the Formula's pinned one.
+func roles(x redactor, r molecule.Record, f formula.Formula) RolesView {
+	text := func(s string) string { return harness.ReviewDisplayText(x.text(s), maxRoleRunes) }
+	coding, _ := f.RoleBinding(formula.CodingHarness)
+	v := RolesView{Coding: text(coding.Binding), Model: text(coding.Model)}
+	for i := len(r.HarnessAttempts) - 1; i >= 0; i-- {
+		if m := r.HarnessAttempts[i].Model; m != "" && m != "model unpinned" {
+			v.Model = text(m)
+			break
+		}
+	}
+	if _, ok, err := f.ReviewAtom(); err == nil && ok {
+		if review, bound := f.RoleBinding(formula.ReviewHarness); bound {
+			v.Reviewer = text(review.Binding)
+		}
+	}
+	return v
+}
+
+// planningCost sums the analysis attempts' reported costs; nothing reported is
+// null, never zero.
+func planningCost(r molecule.Record) *PlanningCostView {
+	if len(r.AnalysisAttempts) == 0 {
+		return nil
+	}
+	v := &PlanningCostView{Attempts: len(r.AnalysisAttempts)}
+	sum := 0.0
+	for _, a := range r.AnalysisAttempts {
+		if a.Usage == nil || a.Usage.TotalCostUSD == nil {
+			continue
+		}
+		c := *a.Usage.TotalCostUSD
+		if math.IsNaN(c) || math.IsInf(c, 0) || c < 0 {
+			continue
+		}
+		v.Reported++
+		sum += c
+	}
+	if v.Reported > 0 && !math.IsInf(sum, 0) {
+		v.USD = &sum
+	}
+	v.Partial = v.Reported < v.Attempts
+	return v
+}
+
 // ledgerETag fingerprints the names, sizes and modification times of the Lab's
 // ledgers and delivery receipts, reading no file contents. It is bounded by the
 // shared raw-entry cap; a directory beyond it, or an entry modified within
diff --git a/lab/internal/ui/server.go b/lab/internal/ui/server.go
index 122fed9..3dbd4ce 100644
--- a/lab/internal/ui/server.go
+++ b/lab/internal/ui/server.go
@@ -1,11 +1,14 @@
 // Package ui serves the local Lab UI on the loopback interface. It reads the Lab
 // only through engine Go functions, never a shell. Every read is a GET; the only
 // writes are the human gates in gates.go (scope approval and draft publication),
-// the drive actions in drive.go (start intake, start or stop the loop, stop
-// a Molecule this UI runs) and retiring one Molecule (retire.go), each a POST that needs the session cookie, the exact
-// Origin and the per-tab session header, and each performed by the engine, which
-// validates digests, locks and receipts. It never merges, deploys, recovers or
-// changes permissions.
+// Request changes on a waiting plan (amend.go, which records a revision and never
+// approves it), the drive actions in drive.go (start intake, start or stop the
+// loop, stop a Molecule this UI runs) and retiring one Molecule (retire.go), each
+// a POST that needs the session cookie, the exact Origin and the per-tab session
+// header, and each performed by the engine, which validates digests, locks and
+// receipts. The one read that runs a process is a Molecule's diff size
+// (diffsize.go): git diff --numstat through the engine, bounded and cached by
+// tree. It never merges, deploys, recovers or changes permissions.
 package ui
 
 import (
@@ -20,6 +23,7 @@ import (
 	"fmt"
 	"github.com/DanielNetzer/forgecell/lab/internal/delivery"
 	"github.com/DanielNetzer/forgecell/lab/internal/formula"
+	"github.com/DanielNetzer/forgecell/lab/internal/intake"
 	"github.com/DanielNetzer/forgecell/lab/internal/molecule"
 	"github.com/DanielNetzer/forgecell/lab/internal/resources"
 	"io"
@@ -31,6 +35,7 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
+	"sync"
 	"sync/atomic"
 	"time"
 )
@@ -175,8 +180,20 @@ type handler struct {
 	runIssue func(context.Context, molecule.Options) (molecule.Record, error)
 	runLoop  func(context.Context, molecule.LoopOptions) (molecule.LoopReport, error)
 	loop     *driveLoop
+	// listIssues is the loop's open Issue listing, the engine's default; the UI
+	// wraps it to learn which Molecules each loop pass works on. Tests replace it.
+	listIssues func(context.Context, string, intake.Selector) (intake.OpenIssues, error)
 	// retire is the engine call behind the retire route; tests may replace it.
 	retire func(lab, id, reason string) (molecule.Record, error)
+	// amend is the engine call behind Request changes, the path of forgecell amend
+	// without --run; amendMu keeps one amendment from this UI at a time. Tests may
+	// replace amend.
+	amend   func(context.Context, string, string, molecule.AmendRequest) (molecule.Record, error)
+	amendMu sync.Mutex
+	// numstat measures a captured tree's diff size; diffs keeps each size by base
+	// and tree. Tests may replace numstat.
+	numstat func(ctx context.Context, lab, workspace, base, tree string) (molecule.DiffStat, error)
+	diffs   *diffCache
 }
 
 // staticFiles are the only embedded files served, with their content types.
@@ -257,7 +274,7 @@ func NewHandler(o Options, token, host string) (http.Handler, error) {
 	if err != nil {
 		return nil, err
 	}
-	return &handler{opts: o, token: token, exchanged: make(chan struct{}), session: session, tab: tab, host: host, origin: "http://" + host, cookie: "forgecell_ui_" + port, static: static, records: molecule.ReadRecord, receipts: delivery.ReadReceiptStatus, cache: newListCache(), runScope: molecule.Run, preview: delivery.Preview, publish: delivery.Publish, jobs: newGateJobs(), runIssue: molecule.RunIntake, runLoop: molecule.RunLoop, loop: &driveLoop{}, retire: molecule.Retire}, nil
+	return &handler{opts: o, token: token, exchanged: make(chan struct{}), session: session, tab: tab, host: host, origin: "http://" + host, cookie: "forgecell_ui_" + port, static: static, records: molecule.ReadRecord, receipts: delivery.ReadReceiptStatus, cache: newListCache(), runScope: molecule.Run, preview: delivery.Preview, publish: delivery.Publish, jobs: newGateJobs(), runIssue: molecule.RunIntake, runLoop: molecule.RunLoop, loop: &driveLoop{}, retire: molecule.Retire, listIssues: intake.ReadSelectedOpenIssues, amend: molecule.AmendFromLatest, numstat: molecule.DiffNumstat, diffs: newDiffCache()}, nil
 }
 
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
@@ -441,10 +458,10 @@ func (h *handler) lab(w http.ResponseWriter) {
 		return
 	}
 	id := formula.ActiveIdentity(h.opts.LabDir)
-	// Retiring needs no source checkout; starting work does.
-	actions := []string{RetireAction}
+	// Retiring and Request changes need no source checkout; starting work does.
+	actions := []string{RetireAction, AmendAction}
 	if h.opts.SourceRoot != "" {
-		actions = DriveActions
+		actions = append(append([]string{}, DriveActions...), AmendAction)
 	}
 	h.json(w, http.StatusOK, LabView{Gates: Gates, Actions: actions, Name: filepath.Base(h.opts.LabDir), Version: h.opts.Version, Repository: id.Repository, Binding: id.Binding, Model: id.Model, Formula: id, Unavailable: unavailable, Operator: operatorView(h.opts.Operator)})
 }
@@ -482,7 +499,8 @@ func counts(ms []Summary) map[string]int {
 }
 
 // molecule serves GET /api/molecules/{id}, its read-only file views,
-// /evidence?path=… and /ledger, and its gate job status, /job.
+// /evidence?path=… and /ledger, its gate job status, /job, and its diff size
+// and estimate, /stats.
 func (h *handler) molecule(w http.ResponseWriter, r *http.Request, rest string) {
 	id, view, _ := strings.Cut(rest, "/")
 	withYAML := r.URL.Query().Get("yaml") == "1"
@@ -490,7 +508,7 @@ func (h *handler) molecule(w http.ResponseWriter, r *http.Request, rest string)
 		h.refuse(w, http.StatusBadRequest, "invalid Molecule id")
 		return
 	}
-	if view != "" && view != "evidence" && view != "ledger" && view != "job" {
+	if view != "" && view != "evidence" && view != "ledger" && view != "job" && view != "stats" {
 		h.refuse(w, http.StatusNotFound, "not found")
 		return
 	}
@@ -532,8 +550,14 @@ func (h *handler) molecule(w http.ResponseWriter, r *http.Request, rest string)
 			return
 		}
 		h.json(w, http.StatusOK, text)
+	case "stats":
+		h.json(w, http.StatusOK, h.stats(record))
 	default:
-		h.json(w, http.StatusOK, project(h.opts.LabDir, record, h.receipts, withYAML))
+		d := project(h.opts.LabDir, record, h.receipts, withYAML)
+		if d.View != nil {
+			d.View.Control = h.control(record, d.View.Current)
+		}
+		h.json(w, http.StatusOK, d)
 	}
 }
 
diff --git a/lab/internal/ui/web/app.js b/lab/internal/ui/web/app.js
index 76818b0..ede6897 100644
--- a/lab/internal/ui/web/app.js
+++ b/lab/internal/ui/web/app.js
@@ -1,6 +1,7 @@
 // Forgecell local Lab UI. It reads the Lab, and writes only through the engine:
-// the two human gates (exact scope approval and draft PR publication), starting
-// intake or the loop, and stopping work this UI started. Every value
+// the two human gates (exact scope approval and draft PR publication), Request
+// changes on a waiting plan (a new version, approved separately), starting
+// intake or the loop, and stopping or retiring a Molecule. Every value
 // from the API is untrusted and reaches the page only as a text node or a
 // validated attribute: this file never parses data as markup.
 'use strict';
@@ -70,7 +71,7 @@
 
   // gate is the selected Molecule's gate state: one request in flight at most,
   // the last preview shown, and the last job read back from the server.
-  function newGate(id) { return { id: id, pending: false, preview: null, job: null, stop: null, retire: null, reason: '', message: '', title: '', accept: false, timer: null }; }
+  function newGate(id) { return { id: id, pending: false, preview: null, job: null, stop: null, retire: null, amend: null, reason: '', message: '', where: 'decision', announce: false, title: '', accept: false, timer: null }; }
 
   function notRecorded(value) { return value === undefined || value === null || value === '' ? 'Not recorded' : String(value); }
   function short(digest) { return typeof digest === 'string' && digest.length > 12 ? digest.slice(0, 12) + '…' : notRecorded(digest); }
@@ -441,7 +442,7 @@
       el('strong', null, 'Intake · Issue #' + notRecorded(run.issue) + ' · ' + notRecorded(run.state)),
       el('p', { class: 'scope-note' }, status),
       run.error ? el('p', { class: 'scope-note' }, (run.category ? run.category + ': ' : '') + run.error + '.' + reasonText(run)) : null,
-      run.committed && c.moleculeId ? el('button', { type: 'button', class: 'text-button', dataset: { drive: 'open' }, onclick: () => select(c.moleculeId) }, 'Open Molecule') : null);
+      run.committed && c.moleculeId ? el('button', { type: 'button', class: 'text-button', dataset: { drive: 'open' }, onclick: () => openMolecule(c.moleculeId) }, 'Open Molecule') : null);
   }
 
   function loopText(loop) {
@@ -595,7 +596,9 @@
   const cubes = $('#cubes');
   cubes.addEventListener('click', (e) => {
     const button = e.target.closest('[data-id]');
-    if (button) { hideTip(); select(button.dataset.id); }
+    // A cell opens the Molecule view through history.pushState, so Back returns
+    // to the grid.
+    if (button) { hideTip(); openMolecule(button.dataset.id); }
   });
   // Seven-row, column-major movement among visible cells, as in the prototype.
   cubes.addEventListener('keydown', (e) => {
@@ -649,6 +652,8 @@
   document.addEventListener('scroll', hideTip, true);
 
   // ---- Selection --------------------------------------------------------------
+  // The selected Molecule opens as the Molecule view, which replaces the grid
+  // under Work until the user goes back.
   function select(id) {
     // A Molecule opens under Work, from any view (the Insights queue, Start Work).
     const elsewhere = state.view !== 'work';
@@ -660,7 +665,7 @@
     // The selection lives in the URL (?view=work&m=…), so reload and copied links
     // restore it.
     if (moleculeFromURL() !== id) history.replaceState({ view: 'work', m: id }, '', moleculeHref(id));
-    $('#selected').hidden = false;
+    showMoleculeView(true);
     cells().forEach((b) => b.setAttribute('aria-pressed', String(b.dataset.id === id)));
     const m = molecules().find((x) => x.id === id);
     $('#selection-label').textContent = m ? 'Selected #' + m.number + ' · ' + (m.title || m.id) : 'Selected ' + id;
@@ -676,22 +681,43 @@
     clearTimeout(state.gate.timer);
     state.gate = newGate(null);
     if (moleculeFromURL()) history.replaceState({ view: state.view }, '', '?view=' + state.view);
-    $('#selected').hidden = true;
+    showMoleculeView(false);
     cells().forEach((b) => b.setAttribute('aria-pressed', 'false'));
     $('#selection-label').textContent = 'All Molecules · select a cell to inspect';
     applyFilter();
   }
 
+  // showMoleculeView swaps the grid for the Molecule view, or back. The shell's
+  // side panel steps aside while a Molecule is open, as in the mockup.
+  function showMoleculeView(open) {
+    $('#selected').hidden = !open;
+    $('.shelf').hidden = open;
+    $('.shell').classList.toggle('has-molecule', open);
+    if (!open) { mv.planKey = null; mv.statsKey = null; mv.stats = null; mv.lastDigest = null; chooseTab('plan', false); }
+  }
+
   function renderLoadingDetail(id) {
-    $('#run-id').textContent = id;
-    $('#run-title').textContent = 'Loading…';
-    $('#run-state').textContent = '';
+    setText($('#mv-title'), 'Loading…');
+    setText($('#mv-state-text'), 'Loading');
+    setAttr($('#mv-state'), 'data-tone', 'neutral');
+    setText($('#mv-crumb'), 'Molecule');
+    renderBack();
+    mv.planKey = null;
+    // The previous Molecule's plan and decision card never show under this one's title.
+    $('#mv-aside').hidden = true;
+    $('#mv-plan-sections').hidden = true;
+    $('#mv-no-plan').hidden = true;
+    $('#mv-steps').hidden = true;
+    $('#mv-planned').hidden = true;
     for (const s of ['#run-origin', '#molecule-totals', '#atoms', '#readiness', '#attempts']) fill($(s));
   }
 
   function renderMissingDetail(id, status) {
     renderLoadingDetail(id);
-    $('#run-title').textContent = status === 404 ? 'This Molecule is no longer in the Lab.' : 'This ledger was refused: it is invalid, unsafe, oversized or not this Lab\'s.';
+    $('#mv-plan-sections').hidden = true;
+    $('#mv-no-plan').hidden = false;
+    setText($('#mv-no-plan'), status === 404 ? 'This Molecule is no longer in the Lab.' : 'This ledger was refused: it is invalid, unsafe, oversized or not this Lab\'s.');
+    setText($('#mv-title'), status === 404 ? 'Molecule not found' : 'Ledger refused');
     add($('#run-origin'), el('button', { type: 'button', class: 'text-button', onclick: overview }, 'Clear selection'));
   }
 
@@ -703,13 +729,27 @@
     return '$' + usage.totalCostUsd.toFixed(4) + ' (' + basis + ')';
   }
 
+  // renderDetail patches the Molecule view: its header, plan, decision card and
+  // roles in place, and the Timeline tab, which keeps the Atoms, evidence and
+  // logs as before.
   function renderDetail() {
     const d = state.detail;
-    $('#run-id').textContent = d.id;
-    const pill = $('#run-state');
-    pill.textContent = statusLabel(d);
-    pill.className = 'pill' + (d.lane === 'decision' ? ' current' : '');
-    $('#run-title').textContent = (d.sample ? '[Sample] ' : '') + (d.issue.title || 'Untitled');
+    $('#mv-aside').hidden = false;
+    renderHeader(d);
+    renderPlan(d);
+    renderDecision(d);
+    renderRoles(d);
+    loadStats(d);
+    renderTimeline(d);
+  }
+
+  // renderTimeline is the Atom list, evidence and logs. While focus is inside it,
+  // a poll does not rebuild it; it is brought up to date once focus leaves.
+  function renderTimeline(d) {
+    const panel = $('#mv-timeline');
+    if (panel.contains(document.activeElement) && mv.timelineId === d.id) { mv.timelineDirty = true; return; }
+    mv.timelineDirty = false;
+    mv.timelineId = d.id;
     const issueLink = externalLink(d.issue.url, ISSUE_URL, 'Issue #' + d.issue.number + ' ↗');
     const pullLink = d.delivery ? externalLink(d.delivery.url, PULL_URL, 'Pull request ↗') : null;
     fill($('#run-origin'),
@@ -749,17 +789,6 @@
     const diagnostics = $('#run-diagnostics');
     fill(diagnostics, (d.diagnostics || []).map((text) => el('li', null, text)));
     diagnostics.hidden = !(d.diagnostics || []).length;
-    renderAction(d);
-  }
-
-  // NEXT ACTION and GATES AND DECISIONS render the server's one gate state:
-  // d.next is derived from d.gate, so it names Gates and decisions only while a
-  // gate there is open.
-  function renderAction(d) {
-    const next = d.next || {};
-    $('#action-title').textContent = typeof next.title === 'string' && next.title ? next.title : 'Recorded';
-    $('#action-copy').textContent = typeof next.copy === 'string' ? next.copy : '';
-    renderGate(d);
   }
 
   // ---- Human gates ---------------------------------------------------------------
@@ -768,10 +797,6 @@
   // response (no response, or a 5xx) the page reads the canonical state back
   // and never resubmits. A decision shows as committed only when the server's
   // read-back of the ledger or the receipt says so, never because a job ended.
-  const GATE_COPY = {
-    scope: 'Approving runs coding and verification for exactly this plan. It never publishes, merges or deploys.',
-    delivery: 'Publication creates a draft pull request only. It never merges, deploys or changes permissions.',
-  };
 
   async function gatePost(id, action, body) {
     const session = tabSession();
@@ -792,15 +817,21 @@
   }
 
   function rerenderGate(gate) {
-    if (state.gate === gate && state.detail && state.detail.id === gate.id) keepFocus(() => renderGate(state.detail));
+    if (state.gate === gate && state.detail && state.detail.id === gate.id) keepFocus(() => renderDecision(state.detail));
   }
 
+  // GATE_FORMS names the form whose inline error shows each action's outcome;
+  // every other action reports in the decision card.
+  const GATE_FORMS = { '/amend': 'amend', '/delivery/publish': 'publish', '/stop': 'stop', '/retire': 'retire' };
+
   // submitGate posts once. It returns the accepted body, or null after a refusal
-  // or an ambiguous response, which is read back instead of retried.
+  // or an ambiguous response, which is read back instead of retried. Focus moves
+  // to the inline error of the action's form.
   async function submitGate(action, payload) {
     if (state.gate.pending) return null;
     const gate = state.gate;
     gate.pending = true;
+    gate.where = GATE_FORMS[action] || 'decision';
     gate.message = '';
     rerenderGate(gate);
     let res = null, body = {};
@@ -815,13 +846,30 @@
     if (state.gate !== gate) return null;
     if (!res || res.status >= 500) {
       gate.message = 'The response was lost or ambiguous. The canonical state is read back; nothing is resubmitted.';
+      gate.announce = true;
+      readBack(gate);
+      return null;
+    }
+    if (!res.ok && action === '/amend' && body && body.category === 'stale') {
+      // Someone recorded a newer plan after this one was shown: load it to review.
+      gate.message = 'A newer plan exists, so your changes were not recorded. The newer plan is loaded; review it before requesting changes again.';
+      gate.announce = true;
       readBack(gate);
       return null;
     }
-    if (!res.ok) { gate.message = refusalText(body); rerenderGate(gate); return null; }
+    if (!res.ok) { gate.message = refusalText(body); gate.announce = true; rerenderGate(gate); return null; }
     return body;
   }
 
+  // gateMessage shows a check this page makes before anything is sent.
+  function gateMessage(where, text) {
+    const gate = state.gate;
+    gate.where = where;
+    gate.message = text;
+    gate.announce = true;
+    rerenderGate(gate);
+  }
+
   // fetchJob reads the job and its canonical read-back; while the job runs it
   // reads again, one timer at a time.
   async function fetchJob(gate) {
@@ -843,6 +891,8 @@
     loadDetail(gate.id, false);
   }
 
+  // approveScope posts the exact digest the plan shows; the approval shows as
+  // committed only once the ledger read back records it.
   async function approveScope(digest) {
     const job = await submitGate('/scope', JSON.stringify({ digest: digest }));
     if (job) { state.gate.job = job; readBack(state.gate); }
@@ -857,12 +907,27 @@
   async function publishDelivery() {
     const gate = state.gate;
     const preview = gate.preview, title = gate.title.trim(), accept = gate.accept;
-    if (!preview || !title) { gate.message = 'Enter a one-line title for the draft PR.'; rerenderGate(gate); return; }
-    if (preview.acceptanceUnverified && !accept) { gate.message = 'Independent acceptance is unverified: confirm your own acceptance review first.'; rerenderGate(gate); return; }
+    if (!preview || !title) { gateMessage('publish', 'Enter a one-line title for the draft PR, such as the change in a few words.'); return; }
+    if (preview.acceptanceUnverified && !accept) { gateMessage('publish', 'Tick the box once you have checked the acceptance criteria yourself.'); return; }
     const job = await submitGate('/delivery/publish', JSON.stringify({ digest: preview.digest, title: title, acceptUnverified: accept }));
     if (job && state.gate === gate) { gate.job = job; readBack(gate); }
   }
 
+  // requestChanges posts the additions with the exact digest the plan shows. The
+  // engine records a new version of the plan and approves nothing: the new
+  // version waits for its own approval through Approve plan & start coding.
+  async function requestChanges(digest, acceptance, path, reason) {
+    const gate = state.gate;
+    const body = { digest: digest, addAcceptance: acceptance ? [acceptance] : [], addScope: path ? [{ path: path, reason: reason }] : [] };
+    const amended = await submitGate('/amend', JSON.stringify(body));
+    if (amended && state.gate === gate) {
+      gate.amend = amended;
+      if (amended.committed) clearChanges();
+      rerenderGate(gate);
+      loadDetail(gate.id, false);
+    }
+  }
+
   // stopMolecule posts once; the stop shows as done only when the ledger read back
   // no longer reports the Molecule running.
   async function stopMolecule() {
@@ -876,7 +941,7 @@
   async function retireMolecule() {
     const gate = state.gate;
     const reason = gate.reason.trim();
-    if (!reason || /[\r\n]/.test(reason) || [...reason].length > 200) { gate.message = 'Enter a one-line reason of at most 200 characters.'; rerenderGate(gate); return; }
+    if (!reason || /[\r\n]/.test(reason) || [...reason].length > 200) { gateMessage('retire', 'Enter a one-line reason of at most 200 characters, such as why the Molecule is no longer needed.'); return; }
     const retired = await submitGate('/retire', JSON.stringify({ reason: reason }));
     if (retired && state.gate === gate) { gate.retire = retired; rerenderGate(gate); loadDetail(gate.id, false); }
   }
@@ -884,9 +949,10 @@
   function retireText(d, gate) {
     const r = d.retired;
     if (d.lane === RETIRED && r) {
-      return el('p', { class: 'scope-note', role: gate.retire ? 'status' : null }, 'Retired at ' + notRecorded(r.at) + ' (was ' + notRecorded(r.priorStatus) + '). Reason: ' + notRecorded(r.reason) + '. Every record is kept.');
+      const when = whenText(r.at);
+      return el('p', { class: 'scope-note', title: dateTitle(r.at) }, 'Retired' + (when ? ' ' + when : '') + '. Reason: ' + notRecorded(r.reason) + '. Every record is kept.');
     }
-    if (gate.retire) return el('p', { class: 'scope-note', role: 'status' }, gate.retire.committed ? 'Committed: the ledger records the retirement.' : 'Not committed: the ledger read back does not record the retirement.');
+    if (gate.retire) return el('p', { class: 'scope-note' }, gate.retire.committed ? 'Committed: the ledger records the retirement.' : 'Not committed: the ledger read back does not record the retirement.');
     return null;
   }
 
@@ -904,85 +970,619 @@
     const kind = job.kind === 'scope' ? 'Scope approval' : 'Draft publication';
     let status;
     if (c.unreadable) status = 'The ' + (c.source || 'record') + ' could not be read back; nothing is shown as committed.';
-    else if (job.committed && job.kind === 'scope') status = 'Committed: the ledger records approval of plan ' + short(job.digest) + '.';
+    else if (job.committed && job.kind === 'scope') status = 'Committed: the ledger records your approval of this plan. Coding starts on its own.';
     else if (job.committed) status = 'Committed: receipt ' + notRecorded(c.receipt) + ', lifecycle ' + notRecorded(c.lifecycle) + (c.published ? '. Draft published; merge and production are not verified.' : '. Not published as a draft yet.');
     else if (job.state === 'running') status = 'Running. Not committed until the ' + (job.kind === 'scope' ? 'ledger records the approval.' : 'receipt records it.');
     else status = 'Not committed: the ' + (job.kind === 'scope' ? 'ledger does not record this approval' : 'receipt does not record a committed delivery') + (c.receipt ? ' (receipt ' + c.receipt + (c.lifecycle ? ', lifecycle ' + c.lifecycle : '') + ')' : '') + '.';
-    return el('div', { class: 'gate-job', role: 'status' },
+    // Not a live region itself: the view's one live region, #mv-live, carries it.
+    return el('div', { class: 'gate-job' },
       el('strong', null, kind + ' · ' + notRecorded(job.state)),
       el('p', { class: 'scope-note' }, status),
       job.error ? el('p', { class: 'scope-note' }, (job.category ? job.category + ': ' : '') + job.error + '.' + reasonText(job)) : null);
   }
 
-  function renderGate(d) {
-    const card = document.querySelector('.decision-panel .action-card');
-    if (!card) return;
+  // ---- Molecule view ---------------------------------------------------------------
+  // The Molecule view (?view=work&m=…) replaces the grid: a breadcrumb back, the
+  // state pill, the seven steps, the plan in plain words and a sticky decision
+  // card with one primary action, bound to the exact digest the plan shows.
+  // Retire and Stop sit apart, in the collapsed Not needed anymore? block, each
+  // behind a confirmation that names the Molecule. Every value is the server's
+  // plain MoleculeView: no phase code, id or full digest is turned into prose,
+  // and the plan's digest appears only short, inside Plan details. Controls are
+  // built once and patched in place, so a poll never rebuilds a form being
+  // typed in, and the one live region changes only when its text does.
+  const mv = { controls: null, steps: null, from: 'work', planKey: null, statsKey: null, statsToken: 0, stats: null, lastDigest: null, replaced: false, timelineId: null, timelineDirty: false };
+  const TONES = ['needs', 'running', 'blocked', 'merged', 'neutral'];
+  const STEP_STATES = ['done', 'current', 'blocked', 'todo'];
+  const VIEW_NAMES = { inbox: 'Inbox', issues: 'Issues', work: 'Work', insights: 'Insights', formula: 'Formula' };
+  const CHANGE_BADGES = { new: ['NEW', 'Not in the base tree: a new file'], edit: ['EDIT', 'In the base tree: an edit'] };
+  const timeOnly = new Intl.DateTimeFormat('en-US', { timeStyle: 'short' });
+  const dayOnly = new Intl.DateTimeFormat('en-US', { dateStyle: 'medium' });
+  const wholeNumber = new Intl.NumberFormat('en-US');
+  // One money rule: two decimals, and an amount under a cent says so instead of
+  // rounding to $0.00.
+  const dollars = new Intl.NumberFormat('en-US', { style: 'currency', currency: 'USD', minimumFractionDigits: 2, maximumFractionDigits: 2 });
+  function money(value) {
+    if (typeof value !== 'number' || !Number.isFinite(value) || value < 0) return '';
+    return value > 0 && value < 0.01 ? 'under $0.01' : dollars.format(value);
+  }
+
+  // whenText is a recorded time in words: "today at 6:46 PM", "on Oct 24, 2026
+  // at 9:00 AM"; dateTitle gives the full date for a tooltip.
+  function whenText(iso) {
+    const t = Date.parse(iso || '');
+    if (!Number.isFinite(t)) return '';
+    const day = (ms) => new Date(ms).toDateString();
+    const time = timeOnly.format(t);
+    if (day(t) === day(Date.now())) return 'today at ' + time;
+    if (day(t) === day(Date.now() - 86400000)) return 'yesterday at ' + time;
+    return 'on ' + dayOnly.format(t) + ' at ' + time;
+  }
+
+  // submitButton is a form's submit button, so Enter submits the form.
+  function submitButton(props, ...children) {
+    const button = el('button', props, ...children);
+    button.type = 'submit';
+    return button;
+  }
+  function field(id, label, input) { return el('div', { class: 'drive-field' }, el('label', { class: 'field-label', for: id }, label), input); }
+  // fillKeyed rebuilds node only when key changes, so an unchanged status is
+  // neither rebuilt nor announced again.
+  function fillKeyed(node, key, build) {
+    if (node.dataset.key === key) return;
+    node.dataset.key = key;
+    fill(node, key ? build() : null);
+  }
+  function moleculeName(d) {
+    const title = plainText(d.issue && d.issue.title, 'Untitled');
+    const number = d.issue && Number.isInteger(d.issue.number) ? '#' + d.issue.number + ' · ' : '';
+    return number + ([...title].length > 80 ? [...title].slice(0, 79).join('') + '…' : title);
+  }
+
+  // ensureMoleculeView builds the decision card, the danger zone, the roles and
+  // the steps once.
+  function ensureMoleculeView() {
+    if (mv.controls) return mv.controls;
+    const c = {};
+    c.heading = el('h2', { class: 'decision-title', id: 'mv-decision-title', tabindex: '-1' });
+    c.copy = el('p', { class: 'decision-copy' });
+    c.changed = el('p', { class: 'decision-changed', hidden: true });
+    c.size = el('p', { class: 'decision-size', hidden: true });
+    // The scope gate: Approve is the card's one primary, bound through its form to
+    // the digest the plan shows; Request changes is secondary and approves nothing.
+    c.approve = submitButton({ class: 'btn btn-primary btn-decision', 'aria-describedby': 'mv-gate-error', dataset: { gate: 'scope' } }, 'Approve plan & start coding');
+    c.approveForm = el('form', { class: 'decision-form', id: 'mv-approve-form', novalidate: true, hidden: true, onsubmit: submitApprove }, c.approve);
+    c.changes = el('button', { type: 'button', class: 'btn btn-secondary btn-decision-secondary', 'aria-expanded': 'false', 'aria-controls': 'mv-amend-form', hidden: true, dataset: { gate: 'changes' }, onclick: toggleChanges }, 'Request changes…');
+    c.acceptance = el('input', { type: 'text', id: 'mv-amend-acceptance', name: 'acceptance', maxlength: '1000', autocomplete: 'off', placeholder: 'The help text names the new flag…', 'aria-describedby': 'mv-amend-error', dataset: { gate: 'acceptance' } });
+    c.path = el('input', { type: 'text', id: 'mv-amend-path', name: 'path', maxlength: '300', autocomplete: 'off', spellcheck: 'false', placeholder: 'lab/internal/ui/web/app.js…', 'aria-describedby': 'mv-amend-error', dataset: { gate: 'path' } });
+    c.reason = el('input', { type: 'text', id: 'mv-amend-reason', name: 'reason', maxlength: '1000', autocomplete: 'off', placeholder: 'Wire the new button…', 'aria-describedby': 'mv-amend-error', dataset: { gate: 'path-reason' } });
+    c.amendError = el('p', { class: 'drive-error', id: 'mv-amend-error', tabindex: '-1', hidden: true });
+    c.amendSubmit = submitButton({ class: 'btn btn-secondary', dataset: { gate: 'amend' } }, 'Record changes');
+    c.amendForm = el('form', { class: 'amend-form', id: 'mv-amend-form', 'aria-labelledby': 'mv-amend-title', novalidate: true, hidden: true, onsubmit: submitChanges },
+      el('h3', { class: 'amend-title', id: 'mv-amend-title' }, 'Request changes'),
+      el('p', { class: 'drive-help' }, 'Forgecell records your changes as a new version of this plan. Nothing is approved now: you review and approve the new version on its own.'),
+      field('mv-amend-acceptance', 'Add an acceptance note', c.acceptance),
+      el('fieldset', { class: 'amend-scope' }, el('legend', { class: 'field-label' }, 'Or let it change one more file'),
+        field('mv-amend-path', 'File path', c.path), field('mv-amend-reason', 'Why it needs to change', c.reason)),
+      c.amendError, c.amendSubmit);
+    c.amendStatus = el('div', { class: 'gate-status' });
+    // The review gate: Preview is the primary until a preview is shown; then
+    // Publish is, and Preview again turns secondary.
+    c.preview = el('button', { type: 'button', class: 'btn btn-primary btn-decision', 'aria-describedby': 'mv-gate-error', hidden: true, dataset: { gate: 'preview' }, onclick: previewDelivery }, 'Preview delivery');
+    c.previewInfo = el('div', { class: 'preview-info' });
+    c.title = el('input', { type: 'text', id: 'mv-publish-title', name: 'title', maxlength: '256', autocomplete: 'off', placeholder: 'Add the Molecule view to the Lab UI…', 'aria-describedby': 'mv-publish-error', dataset: { gate: 'title' }, oninput: (e) => { state.gate.title = e.target.value; } });
+    c.accept = el('input', { type: 'checkbox', id: 'mv-publish-accept', name: 'acceptUnverified', 'aria-describedby': 'mv-accept-help', dataset: { gate: 'accept' }, onchange: (e) => { state.gate.accept = e.target.checked; } });
+    c.acceptField = el('div', { class: 'accept-field', hidden: true },
+      el('label', { class: 'accept-label', for: 'mv-publish-accept' }, c.accept, el('span', null, 'I checked the acceptance criteria myself')),
+      el('p', { class: 'drive-help', id: 'mv-accept-help' }, 'No independent check confirmed that this change meets its acceptance criteria. Tick this only once you have reviewed them yourself; your confirmation is recorded with the draft PR.'));
+    c.publishError = el('p', { class: 'drive-error', id: 'mv-publish-error', tabindex: '-1', hidden: true });
+    c.publish = submitButton({ class: 'btn btn-primary btn-decision', dataset: { gate: 'publish' } }, 'Publish draft PR');
+    c.publishForm = el('form', { class: 'decision-form', id: 'mv-publish-form', novalidate: true, hidden: true, onsubmit: submitPublish },
+      field('mv-publish-title', 'Draft PR title', c.title), c.acceptField, c.publishError, c.publish);
+    c.pull = el('a', { class: 'btn btn-secondary decision-link', target: '_blank', rel: 'noopener noreferrer', hidden: true }, 'Open the pull request ↗');
+    c.error = el('p', { class: 'drive-error', id: 'mv-gate-error', tabindex: '-1', hidden: true });
+    c.job = el('div', { class: 'gate-status' });
+    c.estimate = el('p', { class: 'decision-estimate', hidden: true });
+    fill($('#mv-decision'), c.heading, c.copy, c.changed, c.size,
+      c.approveForm, c.changes, c.amendForm, c.amendStatus,
+      c.preview, c.previewInfo, c.publishForm, c.pull,
+      c.error, c.job, c.estimate);
+
+    // The danger zone: its own collapsed block, never beside a primary. Each
+    // action opens a confirmation that names the Molecule.
+    c.stopOpen = el('button', { type: 'button', class: 'btn btn-danger', 'aria-expanded': 'false', 'aria-controls': 'mv-stop-form', dataset: { gate: 'stop-open' }, onclick: () => openConfirm('stop') }, 'Stop this Molecule…');
+    c.stopQuestion = el('p', { class: 'confirm-question', id: 'mv-stop-question' });
+    c.stopError = el('p', { class: 'drive-error', id: 'mv-stop-error', tabindex: '-1', hidden: true });
+    c.stopSubmit = submitButton({ class: 'btn btn-danger', 'aria-describedby': 'mv-stop-error', dataset: { gate: 'stop' } }, 'Stop Molecule');
+    c.stopForm = el('form', { class: 'confirm-form', id: 'mv-stop-form', 'aria-labelledby': 'mv-stop-question', novalidate: true, hidden: true, onsubmit: submitStop },
+      c.stopQuestion,
+      el('p', { class: 'drive-help' }, 'Its process group is stopped and the ledger records the stop. Work a loop or the forgecell CLI runs is refused.'),
+      c.stopError,
+      el('div', { class: 'confirm-actions' }, c.stopSubmit, el('button', { type: 'button', class: 'btn btn-secondary', dataset: { gate: 'stop-cancel' }, onclick: () => closeConfirm('stop', true) }, 'Cancel')));
+    c.stopStatus = el('div', { class: 'gate-status' });
+    c.stopBlock = el('div', { class: 'danger-item' }, el('p', null, 'Stopping ends the work this Lab UI started for this Molecule.'), c.stopOpen, c.stopForm, c.stopStatus);
+    c.retireOpen = el('button', { type: 'button', class: 'btn btn-danger', 'aria-expanded': 'false', 'aria-controls': 'mv-retire-form', dataset: { gate: 'retire-open' }, onclick: () => openConfirm('retire') }, 'Retire this Molecule…');
+    c.retireQuestion = el('p', { class: 'confirm-question', id: 'mv-retire-question' });
+    c.reasonInput = el('input', { type: 'text', id: 'mv-retire-reason', name: 'reason', maxlength: '200', autocomplete: 'off', placeholder: 'Replaced by a fresh Molecule…', 'aria-describedby': 'mv-retire-error', dataset: { gate: 'reason' }, oninput: (e) => { state.gate.reason = e.target.value; } });
+    c.retireError = el('p', { class: 'drive-error', id: 'mv-retire-error', tabindex: '-1', hidden: true });
+    c.retireSubmit = submitButton({ class: 'btn btn-danger', dataset: { gate: 'retire' } }, 'Retire Molecule');
+    c.retireForm = el('form', { class: 'confirm-form', id: 'mv-retire-form', 'aria-labelledby': 'mv-retire-question', novalidate: true, hidden: true, onsubmit: submitRetire },
+      c.retireQuestion, field('mv-retire-reason', 'Reason', c.reasonInput), c.retireError,
+      el('div', { class: 'confirm-actions' }, c.retireSubmit, el('button', { type: 'button', class: 'btn btn-secondary', dataset: { gate: 'retire-cancel' }, onclick: () => closeConfirm('retire', true) }, 'Cancel')));
+    c.retireStatus = el('div', { class: 'gate-status' });
+    c.retireBlock = el('div', { class: 'danger-item' }, el('p', null, 'Retiring keeps every record, but this Molecule can’t be resumed. You can start a fresh one for the Issue later.'), c.retireOpen, c.retireForm, c.retireStatus);
+    c.danger = el('details', { class: 'danger-zone', id: 'mv-danger', hidden: true }, el('summary', null, 'Not needed anymore?'), el('div', { class: 'danger-body' }, c.stopBlock, c.retireBlock));
+    // runnerNote replaces Stop when this Lab UI does not run the engine call.
+    c.runnerNote = el('p', { class: 'drive-help runner-note', id: 'mv-runner-note', hidden: true });
+    fill($('#mv-danger-slot'), c.runnerNote, c.danger);
+
+    c.roles = { coding: el('dd'), reviewer: el('dd'), cost: el('dd', { class: 'num' }) };
+    fill($('#mv-roles'),
+      el('div', null, el('dt', null, 'Coding agent'), c.roles.coding),
+      el('div', null, el('dt', null, 'Reviewer'), c.roles.reviewer),
+      el('div', null, el('dt', null, 'Planning cost so far'), c.roles.cost));
+    c.issue = el('a', { class: 'mv-issue-link', target: '_blank', rel: 'noopener noreferrer', hidden: true });
+    c.issueText = el('span', { hidden: true });
+    fill($('#mv-issue'), c.issue, c.issueText);
+    mv.steps = STEPS.map((label) => el('li', { class: 'mv-step is-todo' }, el('span', { class: 'step-bar', 'aria-hidden': 'true' }), el('span', { class: 'mv-step-label' }, label)));
+    fill($('#mv-steps'), mv.steps);
+    mv.controls = c;
+    return c;
+  }
+
+  // resetDecision clears what was typed for the previous Molecule: a title, a
+  // reason or a requested change never carries over to another one.
+  function resetDecision(c) {
+    for (const input of [c.title, c.acceptance, c.path, c.reason, c.reasonInput]) input.value = '';
+    c.accept.checked = false;
+    c.amendForm.hidden = true;
+    c.changes.setAttribute('aria-expanded', 'false');
+    for (const kind of ['stop', 'retire']) { c[kind + 'Form'].hidden = true; c[kind + 'Open'].setAttribute('aria-expanded', 'false'); }
+    c.danger.open = false;
+    c.previewInfo.dataset.key = '';
+    mv.replaced = false;
+  }
+
+  function submitApprove(e) {
+    e.preventDefault();
+    const digest = mv.controls.approveForm.dataset.digest;
+    if (digest) approveScope(digest);
+  }
+  function submitChanges(e) {
+    e.preventDefault();
+    const c = mv.controls, digest = c.approveForm.dataset.digest;
+    const acceptance = c.acceptance.value.trim(), path = c.path.value.trim(), reason = c.reason.value.trim();
+    if (!digest) return;
+    if (!acceptance && !path && !reason) { gateMessage('amend', 'Add an acceptance note, or a file path with the reason it needs to change.'); return; }
+    if (path && !reason) { gateMessage('amend', 'Say why this file needs to change, such as the behaviour it adds.'); return; }
+    if (reason && !path) { gateMessage('amend', 'Add the file path this reason is for, such as lab/internal/ui/web/app.js.'); return; }
+    requestChanges(digest, acceptance, path, reason);
+  }
+  function submitPublish(e) { e.preventDefault(); publishDelivery(); }
+  function submitStop(e) { e.preventDefault(); stopMolecule(); }
+  function submitRetire(e) { e.preventDefault(); retireMolecule(); }
+
+  function toggleChanges() {
+    const c = mv.controls;
+    if (!c.amendForm.hidden) { closeChanges(true); return; }
+    c.amendForm.hidden = false;
+    c.changes.setAttribute('aria-expanded', 'true');
+    c.acceptance.focus();
+  }
+  function closeChanges(focus) {
+    const c = mv.controls, had = c.amendForm.contains(document.activeElement);
+    c.amendForm.hidden = true;
+    c.changes.setAttribute('aria-expanded', 'false');
+    if (focus || had) (c.changes.hidden ? $('#mv-decision-title') : c.changes).focus({ preventScroll: true });
+  }
+  function clearChanges() {
+    const c = mv.controls;
+    for (const input of [c.acceptance, c.path, c.reason]) input.value = '';
+    closeChanges(false);
+  }
+  function openConfirm(kind) {
+    const c = mv.controls;
+    c[kind + 'Form'].hidden = false;
+    c[kind + 'Open'].setAttribute('aria-expanded', 'true');
+    (kind === 'retire' ? c.reasonInput : c.stopSubmit).focus();
+  }
+  function closeConfirm(kind, focus) {
+    const c = mv.controls, form = c[kind + 'Form'], open = c[kind + 'Open'];
+    const had = form.contains(document.activeElement);
+    form.hidden = true;
+    open.setAttribute('aria-expanded', 'false');
+    if (focus || had) (open.hidden ? c.danger.querySelector('summary') : open).focus({ preventScroll: true });
+  }
+
+  // boundDigest is the digest the Approve form posts: the decision's primary
+  // digest, only when it is the plan's, the gate's and the latest plan's too.
+  function boundDigest(d) {
+    const v = d.view || {}, dec = v.decision || {}, primary = dec.primary || {}, plan = v.plan || {}, g = d.gate || {};
+    const digest = typeof primary.digest === 'string' && /^[0-9a-f]{64}$/.test(primary.digest) ? primary.digest : '';
+    return digest && primary.action === 'approve' && digest === plan.digest && digest === g.digest && digest === latestDigest(d) ? digest : '';
+  }
+
+  // renderDecision patches the decision card and the danger zone in place. It
+  // never sets the Publish title or any other typed value: only resetDecision,
+  // for another Molecule, clears them.
+  function renderDecision(d) {
+    const c = ensureMoleculeView();
     if (state.gate.id !== d.id) {
       clearTimeout(state.gate.timer);
       state.gate = newGate(d.id);
+      resetDecision(c);
       if (!d.sample) fetchJob(state.gate);
     }
     const gate = state.gate;
-    const label = el('span', { class: 'label' }, 'GATES AND DECISIONS');
-    if (d.sample || (state.lab && state.lab.readOnly)) {
-      fill(card, label, el('p', { class: 'unavailable' }, 'Unavailable'), el('p', { class: 'scope-note' }, 'Sample data has no gates. Nothing here writes.'));
-      return;
-    }
+    const v = d.view || {}, dec = v.decision || {};
+    const readOnly = Boolean(d.sample || (state.lab && state.lab.readOnly));
     const running = Boolean(gate.job && gate.job.state === 'running');
-    const parts = [label];
-    const g = d.gate || { state: 'none' };
-    const digest = typeof g.digest === 'string' && /^[0-9a-f]{64}$/.test(g.digest) && g.digest === latestDigest(d) ? g.digest : '';
-    if (g.state === 'scope' && digest) {
-      parts.push(el('div', { class: 'gate' },
-        el('strong', null, 'Approve exact scope'),
-        el('code', { title: digest }, 'plan ' + digest),
-        el('p', { class: 'scope-note' }, GATE_COPY.scope),
-        el('button', { type: 'button', class: 'text-button', dataset: { gate: 'scope' }, disabled: state.gate.pending || running, onclick: () => approveScope(digest) }, gate.pending ? 'Submitting…' : 'Approve this plan')));
-    }
-    if (g.state === 'published') {
-      parts.push(el('div', { class: 'gate' },
-        el('strong', null, 'Review gate · resolved by draft publication'),
-        el('p', { class: 'scope-note' }, 'Receipt ' + notRecorded(g.receipt) + (g.lifecycle ? ' · lifecycle ' + g.lifecycle : '') + '. Merge on GitHub; merge and production are not verified by Forgecell.'),
-        externalLink(g.url, PULL_URL, 'Pull request ↗') || el('span', { class: 'muted' }, 'PR link unavailable')));
-    }
-    if (g.state === 'delivery') {
-      const preview = gate.preview;
-      parts.push(el('div', { class: 'gate' },
-        el('strong', null, 'Publish a draft PR'),
-        el('p', { class: 'scope-note' }, GATE_COPY.delivery),
-        el('button', { type: 'button', class: 'text-button', dataset: { gate: 'preview' }, disabled: state.gate.pending || running, onclick: previewDelivery }, preview ? 'Preview again' : 'Preview delivery'),
-        preview ? [
-          el('code', { title: notRecorded(preview.digest) }, 'preview ' + notRecorded(preview.digest)),
-          el('p', { class: 'scope-note' }, 'Base ' + notRecorded(preview.baseBranch) + ' · branch ' + notRecorded(preview.branch) + ' · ' + (preview.files || []).length + ' files: ' + (preview.files || []).join(', ')),
-          el('button', { type: 'button', class: 'text-button', dataset: { gate: 'diff' }, onclick: () => show('Delivery diff · ' + d.id, typeof preview.diff === 'string' ? preview.diff : '', (preview.diffTruncated ? 'Truncated · showing the first part of ' + preview.diffBytes + ' bytes.' : 'Complete · ' + preview.diffBytes + ' bytes.') + ' Secrets and local paths are redacted; the CLI shows the full diff.') }, 'View diff ↗'),
-          el('label', null, 'Title ', el('input', { type: 'text', maxlength: '256', value: gate.title, dataset: { gate: 'title' }, oninput: (e) => { gate.title = e.target.value; } })),
-          preview.acceptanceUnverified ? el('label', null, el('input', { type: 'checkbox', checked: gate.accept, dataset: { gate: 'accept' }, onchange: (e) => { gate.accept = e.target.checked; } }), ' Independent acceptance is unverified; I reviewed acceptance myself') : null,
-          el('button', { type: 'button', class: 'text-button', dataset: { gate: 'publish' }, disabled: state.gate.pending || running, onclick: publishDelivery }, gate.pending ? 'Submitting…' : 'Publish draft PR'),
-        ] : null));
+    const busy = gate.pending || running;
+    const digest = readOnly ? '' : boundDigest(d);
+    const scope = dec.kind === 'scope' && Boolean(digest);
+    const delivery = !readOnly && dec.kind === 'delivery' && Boolean(d.gate && d.gate.state === 'delivery');
+    setText(c.heading, readOnly ? 'Sample data' : plainText(dec.title, 'Nothing to do'));
+    setText(c.copy, readOnly ? 'Sample data has no gates. Nothing here writes.' : plainText(dec.copy, ''));
+
+    // A plan replaced while it is open says so before it can be approved.
+    if (scope) {
+      const own = gate.amend && gate.amend.digest === digest;
+      if (mv.lastDigest && mv.lastDigest.id === d.id && mv.lastDigest.digest !== digest && !own) mv.replaced = true;
+      mv.lastDigest = { id: d.id, digest: digest };
     }
+    const replaced = scope && mv.replaced ? 'This plan was replaced by version ' + count(v.plan && v.plan.revision) + ' while it was open. Review it before you approve.' : '';
+    setText(c.changed, replaced);
+    c.changed.hidden = !replaced;
+
+    // The scope gate.
+    c.approveForm.hidden = !scope;
+    if (scope) c.approveForm.dataset.digest = digest;
+    else delete c.approveForm.dataset.digest;
+    c.approve.disabled = busy;
+    c.approve.setAttribute('aria-disabled', String(busy));
+    setText(c.approve, gate.pending && gate.where === 'decision' && scope ? 'Approving…' : 'Approve plan & start coding');
+    const amendable = scope && dec.requestChanges === true && hasAction('request plan changes');
+    c.changes.hidden = !amendable;
+    if (!amendable && !c.amendForm.hidden) closeChanges(false);
+    c.changes.disabled = busy;
+    c.amendSubmit.disabled = busy;
+    setText(c.amendSubmit, gate.pending && gate.where === 'amend' ? 'Recording…' : 'Record changes');
+    fillKeyed(c.amendStatus, gate.amend ? JSON.stringify(gate.amend) : '', () => amendText(gate.amend));
+
+    // The review gate: exactly one primary at a time.
+    const preview = delivery ? gate.preview : null;
+    c.preview.hidden = !delivery;
+    setAttr(c.preview, 'class', preview ? 'btn btn-secondary btn-decision-secondary' : 'btn btn-primary btn-decision');
+    setText(c.preview, gate.pending && gate.where === 'decision' && delivery ? 'Previewing…' : preview ? 'Preview again' : 'Preview delivery');
+    c.preview.disabled = busy;
+    c.publishForm.hidden = !preview;
+    c.acceptField.hidden = !(preview && preview.acceptanceUnverified);
+    c.publish.disabled = busy;
+    setText(c.publish, gate.pending && gate.where === 'publish' ? 'Publishing…' : 'Publish draft PR');
+    renderPreviewInfo(c, preview);
+
+    // A published or merged Molecule: nothing to do, and its pull request.
+    const pull = !readOnly && dec.kind === 'published' && typeof dec.pullUrl === 'string' && PULL_URL.test(dec.pullUrl) ? dec.pullUrl : '';
+    c.pull.hidden = !pull;
+    if (pull) setAttr(c.pull, 'href', pull);
+    else c.pull.removeAttribute('href');
+
+    // The diff size on both gates; the estimate before coding.
+    const stats = (scope || delivery) && mv.stats && mv.stats.id === d.id ? mv.stats.data : null;
+    const size = stats ? diffText(stats.diff) : '';
+    setText(c.size, size);
+    c.size.hidden = !size;
+    const estimate = stats && scope ? estimateText(stats.estimate) : '';
+    setText(c.estimate, estimate);
+    c.estimate.hidden = !estimate;
+    fillKeyed(c.job, gate.job ? JSON.stringify(gate.job) : '', () => jobText(gate.job));
+
+    // The danger zone.
     const live = d.status === 'running' || d.status === 'allocating';
-    if ((live || gate.stop) && hasAction('stop Molecule')) {
-      let note = 'Stops the engine call this Lab UI runs for this Molecule; its process group is killed and the ledger records the stop. Work run by a loop or the CLI is refused.';
-      if (gate.stop) note = live ? 'Stop requested. Not committed until the ledger no longer shows this Molecule running.' : 'Stopped: the ledger shows status ' + notRecorded(d.status) + (d.phase ? ' · phase ' + d.phase : '') + '. Inspect or re-run it with the forgecell CLI.';
-      parts.push(el('div', { class: 'gate' },
-        el('strong', null, 'Stop this Molecule'),
-        el('p', { class: 'scope-note', role: gate.stop ? 'status' : null }, note),
-        live ? el('button', { type: 'button', class: 'text-button', dataset: { gate: 'stop' }, disabled: gate.pending || Boolean(gate.stop), onclick: stopMolecule }, gate.pending ? 'Submitting…' : 'Stop Molecule') : null));
+    const retired = d.lane === RETIRED || Boolean(gate.retire);
+    // Stop is offered only when the server says this Lab UI runs the engine call.
+    const control = d.view && d.view.control;
+    const stoppable = live && Boolean(control && control.stoppable === true);
+    const canStop = !readOnly && (stoppable || Boolean(gate.stop)) && hasAction('stop Molecule');
+    const canRetire = !readOnly && !live && !retired && hasAction('retire Molecule');
+    const runner = live && !stoppable && !gate.stop && control && typeof control.text === 'string' ? plainText(control.text, '') : '';
+    setText(c.runnerNote, runner);
+    c.runnerNote.hidden = !runner;
+    c.stopBlock.hidden = !canStop;
+    c.stopOpen.hidden = !stoppable || Boolean(gate.stop);
+    if (c.stopOpen.hidden && !c.stopForm.hidden) closeConfirm('stop', false);
+    c.stopSubmit.disabled = gate.pending;
+    setText(c.stopSubmit, gate.pending && gate.where === 'stop' ? 'Stopping…' : 'Stop Molecule');
+    setText(c.stopQuestion, 'Stop ' + moleculeName(d) + '?');
+    fillKeyed(c.stopStatus, gate.stop ? JSON.stringify([gate.stop, live]) : '', () => stopText(gate, live));
+    c.retireBlock.hidden = !(canRetire || (!readOnly && retired));
+    c.retireOpen.hidden = !canRetire;
+    if (!canRetire && !c.retireForm.hidden) closeConfirm('retire', false);
+    c.retireSubmit.disabled = gate.pending || running;
+    setText(c.retireSubmit, gate.pending && gate.where === 'retire' ? 'Retiring…' : 'Retire Molecule');
+    setText(c.retireQuestion, 'Retire ' + moleculeName(d) + '?');
+    fillKeyed(c.retireStatus, JSON.stringify([d.lane, d.retired, gate.retire]), () => retireText(d, gate));
+    c.danger.hidden = c.stopBlock.hidden && c.retireBlock.hidden;
+    if (c.danger.hidden) c.danger.open = false;
+
+    // One inline error, in the form that sent the request; focus moves to it once.
+    const errors = { decision: c.error, amend: c.amendError, publish: c.publishError, stop: c.stopError, retire: c.retireError };
+    let target = errors[gate.where] || c.error;
+    if (target.parentElement.closest('[hidden]')) target = c.error;
+    for (const node of Object.values(errors)) {
+      const text = node === target ? gate.message : '';
+      setText(node, text);
+      node.hidden = !text;
     }
-    if (d.lane === RETIRED || gate.retire) {
-      parts.push(el('div', { class: 'gate' }, el('strong', null, 'Retired'), retireText(d, gate)));
-    } else if (!live && hasAction('retire Molecule')) {
-      parts.push(el('div', { class: 'gate' },
-        el('strong', null, 'Retire this Molecule'),
-        el('p', { class: 'scope-note' }, 'Marks a stale Molecule retired: it leaves All and Needs my decision, and every record is kept. The loop never resumes it and may start a fresh Molecule for its Issue. The engine refuses a running, locked or delivering Molecule.'),
-        el('label', null, 'Reason ', el('input', { type: 'text', maxlength: '200', value: gate.reason, dataset: { gate: 'reason' }, oninput: (e) => { gate.reason = e.target.value; } })),
-        el('button', { type: 'button', class: 'text-button', dataset: { gate: 'retire' }, disabled: gate.pending || running, onclick: retireMolecule }, gate.pending ? 'Submitting…' : 'Retire Molecule')));
+    if (gate.message && gate.announce) { gate.announce = false; target.focus(); }
+    // The one live region of the view carries the outcomes read back.
+    setText($('#mv-live'), [c.job, c.amendStatus, c.stopStatus, c.retireStatus].map((n) => n.textContent).filter(Boolean).join(' '));
+  }
+
+  function amendText(a) {
+    return el('p', { class: 'scope-note' }, a.committed
+      ? 'Version ' + count(a.revision) + ' of the plan is recorded and waits for your approval. Nothing was approved.'
+      : 'Not committed: the ledger read back shows no new version of this plan.');
+  }
+  function stopText(gate, live) {
+    if (!gate.stop) return null;
+    return el('p', { class: 'scope-note' }, live ? 'Stop requested. Not committed until the ledger no longer shows this Molecule running.' : 'Stopped: the ledger no longer shows this Molecule running.');
+  }
+
+  // renderPreviewInfo shows the preview once per preview, so its View diff
+  // button is not rebuilt by a poll.
+  function renderPreviewInfo(c, preview) {
+    const key = preview && typeof preview.digest === 'string' ? preview.digest : '';
+    fillKeyed(c.previewInfo, key, () => {
+      const files = Array.isArray(preview.files) ? preview.files : [];
+      const bytes = count(preview.diffBytes);
+      return [
+        el('p', { class: 'preview-line' }, 'Branch ', el('code', null, notRecorded(preview.branch)), ' into ', el('code', null, notRecorded(preview.baseBranch)), ' · ' + counted(files.length, 'file', 'files')),
+        el('button', { type: 'button', class: 'text-button', dataset: { gate: 'diff' }, onclick: () => show('Delivery diff · ' + moleculeName(state.detail || {}), typeof preview.diff === 'string' ? preview.diff : '', (preview.diffTruncated ? 'Truncated · showing the first part of ' + wholeNumber.format(bytes) + ' bytes.' : 'Complete · ' + wholeNumber.format(bytes) + ' bytes.') + ' Secrets and local paths are redacted; the CLI shows the full diff.') }, 'View diff ↗'),
+      ];
+    });
+  }
+
+  // diffText is the measured size, "+412 −96 in 4 files"; a count stopped at a
+  // bound says it is a lower bound. Nothing measured shows nothing.
+  function diffText(diff) {
+    if (!diff || diff.state !== 'measured' || !Number.isInteger(diff.files) || diff.files < 1) return '';
+    const text = '+' + wholeNumber.format(count(diff.added)) + ' −' + wholeNumber.format(count(diff.removed)) + ' in ' + counted(diff.files, 'file', 'files') + (count(diff.binary) ? ' (' + counted(count(diff.binary), 'binary file', 'binary files') + ')' : '');
+    return diff.truncated ? 'At least ' + text + ' · the count stopped at a safety bound' : text;
+  }
+
+  // estimateText is the history-based estimate with its basis, or nothing when
+  // the server hides it.
+  function estimateText(e) {
+    if (!e || e.shown !== true || !e.time || typeof e.basis !== 'string' || !e.basis) return '';
+    let text = 'Usually ' + rangeText(count(e.time.lowMs), count(e.time.highMs));
+    const cost = e.cost && money(e.cost.medianUsd);
+    if (cost) text += ' · about ' + cost + (e.cost.partial ? ' (' + plainText(e.cost.coverage, 'partial cost') + ')' : '');
+    return text + ', ' + e.basis + '. ' + plainText(e.note, '');
+  }
+  function rangeText(low, high) {
+    const a = minutesText(low), b = minutesText(high);
+    if (a === b) return 'about ' + a;
+    if (/^\d+ min$/.test(a) && /^\d+ min$/.test(b)) return a.slice(0, -4) + '–' + b;
+    return a + '–' + b;
+  }
+
+  // ---- Molecule view: header, steps, plan, roles and stats --------------------------
+  function renderBack() {
+    const from = VIEW_NAMES[mv.from] ? mv.from : 'work';
+    const back = $('#mv-back');
+    setAttr(back, 'href', '?view=' + from);
+    if (back.dataset.view !== from) back.dataset.view = from;
+    setText(back, VIEW_NAMES[from]);
+  }
+  function crumbText(d) {
+    const kind = d.view && d.view.decision && d.view.decision.kind;
+    const number = d.issue && Number.isInteger(d.issue.number) ? '#' + d.issue.number + ' · ' : '';
+    return number + ({ scope: 'Review plan', delivery: 'Review & publish' }[kind] || 'Molecule');
+  }
+  // pillText is the state in plain words, with the minutes of a running step.
+  function pillText(d) {
+    const s = d.view && d.view.state;
+    if (!s || typeof s.label !== 'string' || !s.label) return laneLabel(d);
+    return withAttempt(s.label, s.since, s.note);
+  }
+
+  // RERUN_NOTES are the fixed rerun notes the server sends; nothing else shows.
+  const RERUN_NOTES = ['rerun', 'rerun after a plan revision'];
+  // withAttempt appends the current attempt's elapsed minutes, when its start is
+  // recorded, and its rerun note: "Checks · 10 min · rerun after a plan revision".
+  function withAttempt(label, since, note) {
+    const parts = [label];
+    const t = Date.parse(since || '');
+    if (Number.isFinite(t)) parts.push(minutesText(Math.max(0, Date.now() - t)));
+    if (RERUN_NOTES.includes(note)) parts.push(note);
+    return parts.join(' · ');
+  }
+
+  function renderHeader(d) {
+    const c = ensureMoleculeView();
+    const v = d.view || {}, s = v.state || {};
+    setText($('#mv-title'), (d.sample ? '[Sample] ' : '') + plainText(d.issue && d.issue.title, 'Untitled'));
+    setText($('#mv-crumb'), crumbText(d));
+    renderBack();
+    setAttr($('#mv-state'), 'data-tone', TONES.includes(s.tone) ? s.tone : 'neutral');
+    setText($('#mv-state-text'), pillText(d));
+    const number = d.issue && Number.isInteger(d.issue.number) ? '#' + d.issue.number : '';
+    const url = d.issue && typeof d.issue.url === 'string' && ISSUE_URL.test(d.issue.url) ? d.issue.url : '';
+    c.issue.hidden = !url;
+    c.issueText.hidden = Boolean(url) || !number;
+    if (url) setAttr(c.issue, 'href', url);
+    setText(c.issue, 'Issue ' + number + ' ↗');
+    setText(c.issueText, 'Issue ' + number);
+    const plan = v.plan;
+    const when = plan ? whenText(plan.plannedAt) : '';
+    const planned = $('#mv-planned');
+    setText(planned, when ? '· planned ' + when + ' from the Issue as written then' : '');
+    setAttr(planned, 'title', when ? dateTitle(plan.plannedAt) : '');
+    planned.hidden = !when;
+    renderSteps(v);
+  }
+
+  // renderSteps marks each of the seven steps from the server's states, with
+  // aria-current on the current one.
+  function renderSteps(v) {
+    const steps = Array.isArray(v.steps) && v.steps.length === STEPS.length ? v.steps : null;
+    $('#mv-steps').hidden = !steps;
+    if (!steps) return;
+    mv.steps.forEach((li, i) => {
+      const s = steps[i] && STEP_STATES.includes(steps[i].state) ? steps[i].state : 'todo';
+      const current = i === v.current;
+      setAttr(li, 'class', 'mv-step is-' + s + (current ? ' is-now' : ''));
+      if (current) setAttr(li, 'aria-current', 'step');
+      else if (li.hasAttribute('aria-current')) li.removeAttribute('aria-current');
+      setText(li.lastChild, STEPS[i] + (s === 'done' ? ' · done' : s === 'blocked' ? ' · stopped' : current ? ' · now' : ''));
+    });
+  }
+
+  // renderPlan rebuilds the plan sections only when the plan itself changes.
+  function renderPlan(d) {
+    const plan = d.view && d.view.plan;
+    const key = plan ? JSON.stringify(plan) : 'none';
+    if (key === mv.planKey) return;
+    mv.planKey = key;
+    $('#mv-plan-sections').hidden = !plan;
+    const none = $('#mv-no-plan');
+    none.hidden = Boolean(plan);
+    if (!plan) { setText(none, d.sample ? 'Sample data has no plan.' : 'No plan is recorded for this Molecule yet.'); return; }
+    setText($('#mv-summary'), plainText(plan.summary, 'No summary was recorded for this plan.'));
+    fill($('#mv-chips'), planChips(plan).map((text) => el('li', { class: 'chip' }, text)));
+    const note = $('#mv-note');
+    setText(note, plan.note ? 'Your note for this version: ' + plan.note : '');
+    note.hidden = !plan.note;
+    const files = Array.isArray(plan.files) ? plan.files : [];
+    setText($('#mv-files-count'), wholeNumber.format(count(plan.filesTotal)));
+    fill($('#mv-files'), files.map(fileItem));
+    moreLine($('#mv-files-more'), count(plan.filesTotal) - files.length, 'file', 'files');
+    const groups = Array.isArray(plan.checkGroups) ? plan.checkGroups : [];
+    setText($('#mv-checks-count'), wholeNumber.format(count(plan.checksTotal)));
+    fill($('#mv-checks'), groups.map(groupItem));
+    const acceptance = Array.isArray(plan.acceptance) ? plan.acceptance : [];
+    setText($('#mv-acceptance-count'), wholeNumber.format(count(plan.acceptanceTotal)));
+    fill($('#mv-acceptance'), acceptance.map((text) => el('li', null, plainText(text, ''))));
+    moreLine($('#mv-acceptance-more'), count(plan.acceptanceTotal) - acceptance.length, 'criterion', 'criteria');
+    $('#mv-acceptance-section').hidden = count(plan.acceptanceTotal) === 0;
+    renderPlanDetails(plan);
+  }
+
+  function planChips(plan) {
+    const chips = [];
+    const questions = count(plan.questions);
+    chips.push(questions ? counted(questions, 'open question', 'open questions') : 'No open questions');
+    const parts = Array.isArray(plan.components) ? plan.components.filter((p) => typeof p === 'string' && p) : [];
+    const extra = count(plan.componentsTotal) - parts.length;
+    if (parts.length) chips.push('Touches ' + parts.join(', ') + (extra > 0 ? ' and ' + counted(extra, 'more', 'more') : ''));
+    if (Number.isInteger(plan.budgetMs) && plan.budgetMs > 0) chips.push('Coding budget ' + minutesText(plan.budgetMs));
+    return chips;
+  }
+
+  // fileItem is one scope path with its NEW or EDIT badge, which the server
+  // derives from the frozen base tree; without that tree there is no badge.
+  function fileItem(f) {
+    const badge = CHANGE_BADGES[f.change];
+    return el('li', { class: 'file' },
+      badge ? el('span', { class: 'file-badge is-' + f.change, title: badge[1] }, badge[0]) : el('span', { class: 'file-badge is-unknown', title: 'The base tree is not recorded' }, '·'),
+      el('div', { class: 'file-text' }, el('code', null, plainText(f.path, '')), f.reason ? el('p', { class: 'file-reason' }, f.reason) : null));
+  }
+
+  function groupItem(g) {
+    const checks = Array.isArray(g.checks) ? g.checks : [];
+    return el('li', { class: 'check-group' + (g.baseline ? ' is-baseline' : '') },
+      el('h3', { class: 'check-name' }, plainText(g.name, 'Checks')),
+      el('ul', { class: 'check-commands' }, checks.map((x) => el('li', null, el('code', null, plainText(x.command, '')), x.dir ? el('span', { class: 'check-dir' }, ' in ' + x.dir) : null))));
+  }
+
+  function moreLine(node, extra, one, many) {
+    setText(node, extra > 0 ? counted(extra, 'more ' + one, 'more ' + many) + ' in the full plan, under Timeline · Ledger record.' : '');
+    node.hidden = extra <= 0;
+  }
+
+  // renderPlanDetails fills the collapsed Plan details: the version, the short
+  // digest with a copy button and the frozen evidence.
+  function renderPlanDetails(plan) {
+    const digest = typeof plan.digest === 'string' && /^[0-9a-f]{64}$/.test(plan.digest) ? plan.digest : '';
+    fill($('#mv-details-summary'), 'Plan details · version ' + count(plan.revision) + (digest ? ' · ' : ''), digest ? el('code', null, digest.slice(0, 7)) : null);
+    setText($('#mv-digest-short'), digest ? short(digest) : 'Not recorded');
+    const copy = $('#mv-copy-digest');
+    copy.hidden = !digest;
+    copy.dataset.digest = digest;
+    const evidence = Array.isArray(plan.evidence) ? plan.evidence : [];
+    fill($('#mv-evidence'), evidence.map((e) => el('li', null, el('code', null, plainText(e.path, '')))));
+    moreLine($('#mv-evidence-more'), count(plan.evidenceTotal) - evidence.length, 'evidence file', 'evidence files');
+  }
+
+  async function copyDigest() {
+    const button = $('#mv-copy-digest'), digest = button.dataset.digest || '';
+    if (!/^[0-9a-f]{64}$/.test(digest)) return;
+    try {
+      await navigator.clipboard.writeText(digest);
+      setText(button, 'Copied');
+    } catch (error) { setText(button, 'Copy unavailable'); }
+    setTimeout(() => setText(button, 'Copy full digest'), 2000);
+  }
+
+  function renderRoles(d) {
+    const c = ensureMoleculeView();
+    const v = d.view;
+    $('#mv-roles').hidden = !v;
+    if (!v) return;
+    const r = v.roles || {};
+    setText(c.roles.coding, [plainText(r.coding, ''), plainText(r.model, '')].filter(Boolean).join(' · ') || 'Not recorded');
+    setText(c.roles.reviewer, typeof r.reviewer === 'string' && r.reviewer ? r.reviewer + ', read-only' : 'No review step');
+    const p = v.planningCost, total = p && money(p.usd);
+    setText(c.roles.cost, !total ? 'Not recorded' : p.partial ? total + ' · reported for ' + count(p.reported) + ' of ' + counted(count(p.attempts), 'attempt', 'attempts') : total);
+  }
+
+  // loadStats reads the diff size and the estimate once per Molecule, gate and
+  // plan; a response for another selection is dropped.
+  async function loadStats(d) {
+    const v = d.view, kind = v && v.decision && v.decision.kind;
+    if (d.sample || (kind !== 'scope' && kind !== 'delivery')) { mv.statsKey = null; mv.stats = null; return; }
+    const key = d.id + ':' + kind + ':' + ((v.plan && v.plan.digest) || '');
+    if (key === mv.statsKey) return;
+    mv.statsKey = key;
+    mv.stats = null;
+    const token = ++mv.statsToken;
+    try {
+      const res = await api('/api/molecules/' + encodeURIComponent(d.id) + '/stats');
+      if (token !== mv.statsToken || !res.ok) return;
+      const data = await res.json();
+      if (token !== mv.statsToken) return;
+      mv.stats = { id: d.id, data: data };
+      if (state.detail && state.detail.id === d.id) renderDecision(state.detail);
+    } catch (error) { failed(error); }
+  }
+
+  // The Plan and Timeline tabs. The Timeline keeps the Atom list, evidence and
+  // logs unchanged.
+  function chooseTab(tab, focus) {
+    const plan = tab !== 'timeline';
+    for (const [tabId, panelId, on] of [['#mv-tab-plan', '#mv-plan', plan], ['#mv-tab-timeline', '#mv-timeline', !plan]]) {
+      const button = $(tabId);
+      button.setAttribute('aria-selected', String(on));
+      button.tabIndex = on ? 0 : -1;
+      $(panelId).hidden = !on;
+      if (on && focus) button.focus();
     }
-    if (parts.length === 1) parts.push(el('p', { class: 'scope-note' }, 'No human gate is open for this Molecule. This page updates from the ledger.'));
-    if (gate.message) parts.push(el('p', { class: 'scope-note', role: 'alert' }, gate.message));
-    parts.push(jobText(gate.job));
-    fill(card, parts);
+    if (!plan && mv.timelineDirty && state.detail) renderTimeline(state.detail);
   }
+  $('#mv-tabs').addEventListener('click', (e) => { const b = e.target.closest('[data-tab]'); if (b) chooseTab(b.dataset.tab, false); });
+  $('#mv-tabs').addEventListener('keydown', (e) => {
+    const b = e.target.closest('[data-tab]');
+    if (!b || !['ArrowLeft', 'ArrowRight', 'Home', 'End'].includes(e.key)) return;
+    e.preventDefault();
+    chooseTab(e.key === 'Home' ? 'plan' : e.key === 'End' ? 'timeline' : b.dataset.tab === 'plan' ? 'timeline' : 'plan', true);
+  });
+  $('#mv-timeline').addEventListener('focusout', (e) => {
+    if (mv.timelineDirty && state.detail && !$('#mv-timeline').contains(e.relatedTarget)) renderTimeline(state.detail);
+  });
+  $('#mv-copy-digest').addEventListener('click', copyDigest);
+  // A running step's minutes move on without a ledger change.
+  setInterval(() => { if (!document.hidden && state.detail && !$('#selected').hidden) setText($('#mv-state-text'), pillText(state.detail)); }, 30000);
 
   // Atom statuses the engine writes (done, failed, active, waiting, skipped,
   // blocked, pending) and the sample fixture's labels, mapped to a tab mark and
@@ -1164,7 +1764,7 @@
     $('#aggregate-count').textContent = 'All ' + all.length + ' Molecules';
     const waiting = all.filter((m) => m.lane === 'decision');
     fill($('#review-queue'), (waiting.length
-      ? waiting.slice(0, 5).map((m) => el('button', { type: 'button', class: 'review-row', dataset: { review: m.id }, onclick: () => select(m.id) },
+      ? waiting.slice(0, 5).map((m) => el('button', { type: 'button', class: 'review-row', dataset: { review: m.id }, onclick: () => openMolecule(m.id) },
         el('span', { class: 'review-id' }, '#' + m.number), el('strong', null, m.title || m.id), el('span', null, notRecorded(m.phase)), el('span', { 'aria-hidden': 'true' }, '→')))
       : [el('p', { class: 'scope-note' }, 'No Molecules wait at a human gate.')]));
     if (waiting.length > 5) add($('#review-queue'), el('p', { class: 'scope-note' }, (waiting.length - 5) + ' more under Needs my decision.'));
@@ -1234,6 +1834,8 @@
   const VIEWS = ['inbox', 'issues', 'work', 'insights', 'formula'];
   function viewFromURL() {
     const view = new URLSearchParams(location.search).get('view');
+    // A bare ?m=<id> link opens the Molecule view under Work.
+    if (!view && moleculeFromURL()) return 'work';
     return VIEWS.includes(view) ? view : 'inbox';
   }
   function showView(view) {
@@ -1249,8 +1851,11 @@
     hideTip();
   }
   function navigate(view, focus) {
-    if (view !== viewFromURL()) history.pushState({ view: view }, '', '?view=' + view);
+    // Leaving a Molecule view, even for Work, is a new entry, so Back reopens it.
+    if (moleculeFromURL()) history.pushState({ view: view }, '', '?view=' + view);
+    else if (view !== viewFromURL()) history.pushState({ view: view }, '', '?view=' + view);
     showView(view);
+    restoreSelection();
     if (focus) $('#main').focus({ preventScroll: true });
   }
   document.addEventListener('click', (e) => {
@@ -1269,15 +1874,30 @@
     const id = new URLSearchParams(location.search).get('m');
     return id && MOLECULE_ID.test(id) ? id : null;
   }
+  // restoreSelection follows the URL: ?m= opens that Molecule's view, and a URL
+  // without one closes it, so Back and Forward move between the two.
   function restoreSelection() {
     const id = moleculeFromURL();
+    const from = history.state && history.state.from;
+    if (VIEWS.includes(from)) mv.from = from;
     if (state.view === 'work' && id && id !== state.selectedId) select(id);
+    else if (!id && state.selectedId) overview();
   }
   function openMolecule(id) {
+    const from = state.view || 'work';
     if (location.search !== moleculeHref(id)) history.pushState({ view: 'work', m: id }, '', moleculeHref(id));
+    rememberFrom(from);
     showView('work');
     if (id !== state.selectedId || $('#selected').hidden) select(id);
-    $('#main').focus({ preventScroll: true });
+    window.scrollTo(0, 0);
+    $('#mv-title').focus({ preventScroll: true });
+  }
+  // rememberFrom keeps the view a Molecule was opened from in its history entry,
+  // so its breadcrumb leads back there after Back, Forward or a reload.
+  function rememberFrom(from) {
+    mv.from = VIEWS.includes(from) ? from : 'work';
+    renderBack();
+    try { history.replaceState(Object.assign({}, history.state, { from: mv.from }), ''); } catch (error) { /* the breadcrumb falls back to Work */ }
   }
   document.addEventListener('click', (e) => {
     const link = e.target.closest('a[data-molecule]');
@@ -1424,9 +2044,7 @@
   // stepText is the current step with its elapsed time: "Coding · 18 min".
   function stepText(v) {
     if (v.queued) return 'Queued for checks';
-    const label = plainText(v.stepLabel, STEPS[stepIndex(v)]);
-    const t = Date.parse(v.stepSince || '');
-    return Number.isFinite(t) ? label + ' · ' + minutesText(Math.max(0, Date.now() - t)) : label;
+    return withAttempt(plainText(v.stepLabel, STEPS[stepIndex(v)]), v.stepSince, v.stepNote);
   }
   function detailText(v) {
     const parts = [];
@@ -1496,8 +2114,7 @@
     const detail = slot(node, 'detail'), text = detailText(v);
     setText(detail, text);
     detail.hidden = !text;
-    // One primary action per card. Until the plan view (slice 3) exists, every
-    // action opens the Molecule's detail under Work.
+    // One primary action per card; each opens the Molecule view (?view=work&m=…).
     setLink(slot(node, 'action'), m, plainText(v.action, 'Open'));
   }
 
diff --git a/lab/internal/ui/web/index.html b/lab/internal/ui/web/index.html
index a29f92d..3b9c381 100644
--- a/lab/internal/ui/web/index.html
+++ b/lab/internal/ui/web/index.html
@@ -110,43 +110,85 @@ <h1 id="issues-title">Issues</h1>
   </div>
 </section>
 
-<section id="selected" class="workspace" aria-label="Selected Molecule" hidden>
-  <div class="glass run-panel">
-    <div class="panel-head"><span class="mono">MOLECULE / <span id="run-id"></span></span><span id="run-state" class="pill"></span></div>
-    <h2 id="run-title"></h2>
-    <div id="run-origin" class="origin"></div>
-    <div id="molecule-totals" class="molecule-totals"></div>
-    <div class="formula card">
-      <span class="icon-tile" aria-hidden="true">≡</span>
-      <div class="formula-text"><span class="label">FORMULA SNAPSHOT</span><strong id="formula-name"></strong><small id="formula-sha" class="mono-text"></small></div>
-      <button type="button" class="text-button" id="yaml">View YAML ↗</button>
+<section id="selected" class="molecule-view" aria-labelledby="mv-title" hidden>
+  <nav class="breadcrumb" aria-label="Breadcrumb"><a id="mv-back" href="?view=work" data-view="work">Work</a><span class="crumb-sep" aria-hidden="true">/</span><span id="mv-crumb" aria-current="page">Molecule</span></nav>
+  <div class="mv-head">
+    <div class="mv-meta">
+      <span id="mv-state" class="state-pill" data-tone="neutral"><span class="state-dot" aria-hidden="true"></span><span id="mv-state-text"></span></span>
+      <span id="mv-issue" class="mv-issue"></span>
+      <span id="mv-planned" class="mv-planned" hidden></span>
     </div>
-    <p id="run-delivery" class="delivery-line" hidden></p>
-    <div class="section-label"><span class="mono">ATOMS</span><span>Select a step to inspect its record</span></div>
-    <div id="atoms" class="atoms"></div>
-    <details class="ledger-inline"><summary>Readiness revisions and events</summary><div id="readiness"></div></details>
-    <details class="ledger-inline"><summary>Harness attempts · model and usage as recorded</summary><div id="attempts"></div></details>
-    <ul id="run-diagnostics" class="diagnostics" hidden></ul>
+    <h1 id="mv-title" class="mv-title" tabindex="-1"></h1>
   </div>
-  <aside class="glass decision-panel">
-    <div class="panel-head"><span class="mono">NEXT ACTION</span></div>
-    <h2 id="action-title"></h2>
-    <p id="action-copy" class="aside-copy"></p>
-    <div class="action-card card">
-      <span class="label">GATES AND DECISIONS</span>
-      <p class="unavailable">Unavailable</p>
-      <p class="scope-note">Approvals, pause and retries are not wired into this read-only UI. Use the forgecell CLI; this page updates from the ledger.</p>
-    </div>
-    <div class="action-card card">
-      <span class="label">LEDGER AND EVIDENCE · BOUNDED TEXT</span>
-      <p class="scope-note">Open the ledger record, or an evidence file from an Atom, as bounded text with secrets and local paths redacted. Only files the ledger lists with a matching SHA-256 are served; a longer file shows its first part and says so.</p>
-    </div>
-    <div class="action-card card">
-      <span class="label">SUGGESTIONS · EVALUATION</span>
-      <p class="unavailable">Unavailable</p>
-      <p class="scope-note">Not connected in this slice. Nothing is inferred in their place.</p>
+  <ol id="mv-steps" class="mv-steps" aria-label="Progress"></ol>
+  <p id="mv-live" class="sr-only" role="status" aria-live="polite"></p>
+  <div id="mv-tabs" class="mv-tabs" role="tablist" aria-label="Molecule sections">
+    <button type="button" role="tab" id="mv-tab-plan" class="mv-tab" aria-controls="mv-plan" aria-selected="true" data-tab="plan">Plan</button>
+    <button type="button" role="tab" id="mv-tab-timeline" class="mv-tab" aria-controls="mv-timeline" aria-selected="false" tabindex="-1" data-tab="timeline">Timeline</button>
+  </div>
+  <div class="mv-layout">
+    <div class="mv-main">
+      <div id="mv-plan" class="mv-plan" role="tabpanel" aria-labelledby="mv-tab-plan">
+        <p id="mv-no-plan" class="glass mv-card mv-empty" hidden></p>
+        <div id="mv-plan-sections" class="mv-sections">
+          <section class="glass mv-card" aria-labelledby="mv-do-title">
+            <h2 id="mv-do-title" class="mv-card-title">What Forgecell will do</h2>
+            <p id="mv-summary" class="mv-summary"></p>
+            <ul id="mv-chips" class="chips" aria-label="About this plan"></ul>
+            <p id="mv-note" class="mv-note" hidden></p>
+          </section>
+          <section class="glass mv-card mv-list-card" aria-labelledby="mv-files-title">
+            <div class="mv-card-head"><h2 id="mv-files-title" class="mv-card-title">Files it may change <span id="mv-files-count" class="mv-count"></span></h2><span class="mv-card-aside">Anything else needs your approval first</span></div>
+            <ul id="mv-files" class="file-list"></ul>
+            <p id="mv-files-more" class="mv-more" hidden></p>
+          </section>
+          <section class="glass mv-card mv-list-card" aria-labelledby="mv-checks-title">
+            <div class="mv-card-head"><h2 id="mv-checks-title" class="mv-card-title">Checks it must pass <span id="mv-checks-count" class="mv-count"></span></h2><span class="mv-card-aside">Run independently in a fresh checkout</span></div>
+            <ul id="mv-checks" class="check-grid"></ul>
+          </section>
+          <section id="mv-acceptance-section" class="glass mv-card mv-list-card" aria-labelledby="mv-acceptance-title">
+            <div class="mv-card-head"><h2 id="mv-acceptance-title" class="mv-card-title">What counts as done <span id="mv-acceptance-count" class="mv-count"></span></h2></div>
+            <ul id="mv-acceptance" class="acceptance-list"></ul>
+            <p id="mv-acceptance-more" class="mv-more" hidden></p>
+          </section>
+          <details id="mv-details" class="mv-details">
+            <summary id="mv-details-summary">Plan details</summary>
+            <div class="mv-details-body">
+              <p class="drive-help">Approval binds this exact plan. If the Issue or Formula changes before you approve, Forgecell asks you to review again. The full plan, evidence and ledger are in the Timeline.</p>
+              <div class="digest-row"><span class="field-label">Plan digest</span><code id="mv-digest-short"></code><button type="button" id="mv-copy-digest" class="btn btn-secondary btn-small" hidden>Copy full digest</button></div>
+              <p class="field-label">Evidence it was planned from</p>
+              <ul id="mv-evidence" class="evidence-names"></ul>
+              <p id="mv-evidence-more" class="mv-more" hidden></p>
+            </div>
+          </details>
+        </div>
+      </div>
+      <div id="mv-timeline" class="glass run-panel mv-timeline" role="tabpanel" aria-labelledby="mv-tab-timeline" hidden>
+        <div id="run-origin" class="origin"></div>
+        <div id="molecule-totals" class="molecule-totals"></div>
+        <div class="formula card">
+          <span class="icon-tile" aria-hidden="true">≡</span>
+          <div class="formula-text"><span class="label">FORMULA SNAPSHOT</span><strong id="formula-name"></strong><small id="formula-sha" class="mono-text"></small></div>
+          <button type="button" class="text-button" id="yaml">View YAML ↗</button>
+        </div>
+        <p id="run-delivery" class="delivery-line" hidden></p>
+        <div class="section-label"><span class="mono">ATOMS</span><span>Select a step to inspect its record</span></div>
+        <div id="atoms" class="atoms"></div>
+        <details class="ledger-inline"><summary>Readiness revisions and events</summary><div id="readiness"></div></details>
+        <details class="ledger-inline"><summary>Harness attempts · model and usage as recorded</summary><div id="attempts"></div></details>
+        <ul id="run-diagnostics" class="diagnostics" hidden></ul>
+        <div class="action-card card">
+          <span class="label">LEDGER AND EVIDENCE · BOUNDED TEXT</span>
+          <p class="scope-note">Open the ledger record, or an evidence file from an Atom, as bounded text with secrets and local paths redacted. Only files the ledger lists with a matching SHA-256 are served; a longer file shows its first part and says so.</p>
+        </div>
+      </div>
     </div>
-  </aside>
+    <aside id="mv-aside" class="mv-aside" aria-label="Your decision">
+      <section id="mv-decision" class="decision-card" aria-labelledby="mv-decision-title"></section>
+      <dl id="mv-roles" class="mv-roles"></dl>
+      <div id="mv-danger-slot"></div>
+    </aside>
+  </div>
 </section>
 </div>
 
diff --git a/lab/internal/ui/web/style.css b/lab/internal/ui/web/style.css
index 650df99..ae2c289 100644
--- a/lab/internal/ui/web/style.css
+++ b/lab/internal/ui/web/style.css
@@ -319,10 +319,118 @@ main:focus-visible { outline: 2px solid var(--focus); outline-offset: 4px; }
 #cube-tooltip dt { color: var(--muted); }
 #cube-tooltip dd { margin: 0; font-family: ui-monospace, monospace; font-size: 11px; text-align: right; }
 
-/* Selected Molecule. */
-.workspace { display: grid; grid-template-columns: minmax(0, 1.55fr) minmax(0, 1fr); gap: 18px; margin-top: 22px; align-items: start; }
-.workspace > * { min-width: 0; }
-.run-panel, .decision-panel { padding: 22px; }
+/* Molecule view (Plan.html): the breadcrumb, state pill and title, the seven
+   steps, the plan in plain words and a sticky decision card. The shell's side
+   panel steps aside while a Molecule is open. */
+.shell.has-molecule { grid-template-columns: 216px minmax(0, 1fr); }
+.shell.has-molecule .side-panel { display: none; }
+.molecule-view { display: flex; flex-direction: column; gap: 20px; min-width: 0; }
+.breadcrumb { display: flex; align-items: center; flex-wrap: wrap; gap: 8px; font-size: 14px; color: #56695e; min-width: 0; }
+.breadcrumb a { color: #3e5448; text-decoration: none; min-height: 32px; display: inline-flex; align-items: center; }
+.breadcrumb a:hover { color: var(--ink); text-decoration: underline; text-underline-offset: 3px; }
+.crumb-sep { color: #9fb3a6; }
+#mv-crumb { color: var(--ink); overflow-wrap: anywhere; font-variant-numeric: tabular-nums; }
+.mv-head { min-width: 0; }
+.mv-meta { display: flex; align-items: center; flex-wrap: wrap; gap: 8px 10px; font-size: 14px; }
+.mv-title { margin-top: 12px; font-size: 32px; font-weight: 500; letter-spacing: -.02em; line-height: 1.2; text-wrap: balance; overflow-wrap: anywhere; }
+.mv-title:focus-visible { outline-offset: 4px; }
+.mv-issue a { color: var(--forest); }
+.mv-planned { color: #6b7f72; font-variant-numeric: tabular-nums; }
+.state-pill { display: inline-flex; align-items: center; gap: 8px; min-height: 26px; padding: 0 12px; border-radius: 999px; background: #eef0e6; color: #3e5448; font-size: 13px; font-weight: 600; font-variant-numeric: tabular-nums; overflow-wrap: anywhere; }
+.state-dot { flex: none; width: 8px; height: 8px; border-radius: 50%; background: #9fb3a6; }
+.state-pill[data-tone=needs] { background: var(--needs-bg); color: var(--needs-ink); }
+.state-pill[data-tone=needs] .state-dot { background: #d99a2b; }
+.state-pill[data-tone=running] { background: #dcefe9; color: #1f5f52; }
+.state-pill[data-tone=running] .state-dot { background: var(--teal); }
+.state-pill[data-tone=blocked] { background: #f4ddd5; color: var(--danger-ink); }
+.state-pill[data-tone=blocked] .state-dot { background: #b4492f; }
+.state-pill[data-tone=merged] { background: #e3ede6; color: #2d5b46; }
+.state-pill[data-tone=merged] .state-dot { background: #2d5b46; }
+.mv-steps { list-style: none; margin: 0; padding: 18px 20px; display: grid; grid-template-columns: repeat(7, minmax(0, 1fr)); gap: 8px; border-radius: 18px; background: #fffef8b3; border: 1px solid #1e4d3b14; }
+.mv-step { display: flex; flex-direction: column; gap: 8px; min-width: 0; font-size: 13px; color: #6b7f72; overflow-wrap: anywhere; }
+.mv-step.is-done { color: #3e5448; }
+.mv-step.is-done .step-bar { background: #1e4d3b; }
+.mv-step.is-current { color: var(--needs-ink); font-weight: 600; }
+.mv-step.is-current .step-bar { background: #d99a2b; }
+.mv-step.is-blocked { color: var(--danger-ink); font-weight: 600; }
+.mv-step.is-blocked .step-bar { background: #b4492f; }
+.mv-tabs { display: flex; gap: 4px; padding: 4px; width: max-content; max-width: 100%; border-radius: var(--radius-control); background: #eef0e6; border: 1px solid var(--shell-edge); }
+.mv-tab { min-height: 36px; padding: 0 16px; border: 0; border-radius: 9px; background: transparent; color: #3e5448; font-size: 14px; font-weight: 500; }
+.mv-tab:hover { background: #ffffff99; }
+.mv-tab[aria-selected=true] { background: var(--paper); color: var(--ink); font-weight: 600; box-shadow: 0 1px 2px #1a3a2a24; }
+.mv-layout { display: grid; grid-template-columns: minmax(0, 1fr) 340px; gap: 28px; align-items: start; }
+.mv-main, .mv-plan, .mv-sections { display: flex; flex-direction: column; gap: 20px; min-width: 0; }
+.mv-card { padding: 24px 28px; min-width: 0; }
+.mv-card-head { display: flex; align-items: baseline; justify-content: space-between; flex-wrap: wrap; gap: 4px 16px; }
+.mv-card-title { font-size: 18px; font-weight: 600; letter-spacing: 0; }
+.mv-count { color: #6b7f72; font-weight: 400; font-variant-numeric: tabular-nums; }
+.mv-card-aside { font-size: 13px; color: #6b7f72; }
+.mv-summary { margin-top: 10px; font-size: 15px; line-height: 1.6; color: #2e4639; overflow-wrap: anywhere; }
+.mv-note { margin-top: 12px; font-size: 14px; color: var(--needs-ink); overflow-wrap: anywhere; }
+.mv-empty { font-size: 15px; color: #56695e; }
+.mv-more { margin-top: 10px; font-size: 13px; color: #6b7f72; }
+.chips { list-style: none; display: flex; flex-wrap: wrap; gap: 10px; margin: 16px 0 0; padding: 0; }
+.chip { display: inline-flex; align-items: center; min-height: 28px; padding: 2px 12px; border-radius: 999px; background: #eef0e6; font-size: 13px; overflow-wrap: anywhere; font-variant-numeric: tabular-nums; }
+.file-list, .check-grid, .acceptance-list, .evidence-names { list-style: none; margin: 12px 0 0; padding: 0; }
+.file { display: grid; grid-template-columns: 64px minmax(0, 1fr); gap: 16px; padding: 14px 0; border-top: 1px solid #1e4d3b0f; }
+.file:hover { background: #1e4d3b08; }
+.file-badge { align-self: start; display: inline-flex; justify-content: center; height: 22px; line-height: 22px; border-radius: 6px; background: #eef0e6; color: #3e5448; font-size: 11px; font-weight: 600; letter-spacing: .04em; }
+.file-badge.is-new { background: #dcefe9; color: #1f5f52; }
+.file-badge.is-unknown { background: transparent; color: #9fb3a6; }
+.file-text { min-width: 0; }
+.file-text code, .check-commands code, .evidence-names code { font-size: 13px; color: var(--ink); }
+.file-reason { margin-top: 4px; font-size: 14px; color: #56695e; overflow-wrap: anywhere; }
+.check-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; }
+.check-group { padding: 12px 14px; border-radius: var(--radius-control); background: #f6f7f0; border: 1px solid #1e4d3b0f; min-width: 0; }
+.check-name { font-size: 14px; font-weight: 500; }
+.check-commands { list-style: none; margin: 4px 0 0; padding: 0; display: grid; gap: 2px; }
+.check-commands code { font-size: 12px; color: #56695e; }
+.check-dir { font-size: 12px; color: #6b7f72; }
+.acceptance-list { padding-left: 20px; list-style: disc; display: grid; gap: 6px; font-size: 14px; color: #2e4639; overflow-wrap: anywhere; }
+.mv-details { border-radius: 16px; background: #fffef880; border: 1px solid #1e4d3b14; padding: 0 24px; min-width: 0; }
+.mv-details summary { cursor: pointer; padding: 16px 0; min-height: 44px; font-size: 14px; color: #3e5448; font-weight: 500; overflow-wrap: anywhere; }
+.mv-details-body { padding-bottom: 16px; display: grid; gap: 10px; min-width: 0; }
+.digest-row { display: flex; align-items: center; flex-wrap: wrap; gap: 8px 12px; }
+.digest-row code { font-size: 13px; }
+.btn-small { height: 32px; min-height: 32px; padding: 0 12px; font-size: 12px; }
+.mv-aside { position: sticky; top: 24px; display: flex; flex-direction: column; gap: 16px; min-width: 0; }
+.decision-card { display: flex; flex-direction: column; gap: 10px; padding: 26px; border-radius: 22px; background: var(--paper); border: 1px solid #1e4d3b24; box-shadow: inset 0 1px 0 #ffffff, 0 2px 4px #1a3a2a14, 0 20px 48px #1a3a2a1f; min-width: 0; }
+.decision-title { font-size: 20px; font-weight: 600; letter-spacing: -.01em; }
+.decision-title:focus-visible { outline-offset: 4px; }
+.decision-copy { font-size: 14px; line-height: 1.55; color: #3e5448; overflow-wrap: anywhere; }
+.decision-changed { padding: 8px 12px; border-radius: var(--radius-control); background: var(--needs-bg); color: var(--needs-ink); font-size: 13px; }
+.decision-size { font-size: 14px; font-weight: 500; font-variant-numeric: tabular-nums; }
+.decision-estimate { font-size: 12px; color: #6b7f72; font-variant-numeric: tabular-nums; overflow-wrap: anywhere; }
+.decision-form { display: flex; flex-direction: column; gap: 10px; margin-top: 10px; }
+.btn-decision { width: 100%; height: 48px; min-height: 48px; border-radius: 14px; font-size: 15px; white-space: normal; }
+.btn-decision-secondary, .decision-link { width: 100%; height: 44px; min-height: 44px; text-decoration: none; white-space: normal; }
+.amend-form, .confirm-form { display: flex; flex-direction: column; gap: 12px; padding: 16px; border-radius: var(--radius-card); background: #f6f7f0; border: 1px solid #1e4d3b14; min-width: 0; }
+.amend-title { font-size: 15px; font-weight: 600; }
+.amend-scope { display: grid; gap: 10px; margin: 0; padding: 0; border: 0; min-width: 0; }
+.amend-form .drive-help, .confirm-form .drive-help, .accept-field .drive-help { margin-top: 0; }
+.preview-info { display: grid; gap: 4px; font-size: 13px; color: #3e5448; overflow-wrap: anywhere; }
+.preview-info .text-button { justify-self: start; padding: 4px 0; }
+.accept-field { display: grid; gap: 6px; }
+.accept-label { display: flex; align-items: flex-start; gap: 8px; font-size: 14px; font-weight: 500; cursor: pointer; min-height: 32px; }
+.accept-label input { margin-top: 3px; width: 18px; height: 18px; accent-color: #1d5943; flex: none; }
+.accept-label input:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; }
+.gate-status:empty { display: none; }
+.gate-status .gate-job { padding: 8px 12px; border-radius: var(--radius-control); background: #f1f6ee; border: 1px solid #d6e2d4; font-size: 12px; overflow-wrap: anywhere; }
+.gate-status .scope-note { margin-top: 0; }
+.mv-roles { display: flex; flex-direction: column; gap: 10px; margin: 0; padding: 18px 20px; border-radius: 18px; background: #fffef8b3; border: 1px solid #1e4d3b14; font-size: 13px; color: #3e5448; }
+.mv-roles > div { display: flex; justify-content: space-between; gap: 12px; min-width: 0; }
+.mv-roles dd { margin: 0; color: var(--ink); font-weight: 500; text-align: right; overflow-wrap: anywhere; min-width: 0; }
+.mv-roles .num { font-variant-numeric: tabular-nums; }
+.danger-zone { padding: 0 20px; border-radius: 18px; border: 1px solid #eccfc6; background: #fdf8f5; min-width: 0; }
+.danger-zone > summary { cursor: pointer; padding: 14px 0; min-height: 44px; font-size: 13px; font-weight: 500; color: var(--danger-ink); }
+.danger-body { display: flex; flex-direction: column; gap: 16px; padding-bottom: 16px; }
+.danger-item { display: flex; flex-direction: column; gap: 10px; font-size: 13px; color: #5e3a31; }
+.danger-item > .btn { align-self: stretch; }
+.confirm-form { background: var(--paper); border-color: #eccfc6; }
+.confirm-question { font-size: 14px; font-weight: 600; color: var(--ink); overflow-wrap: anywhere; }
+.confirm-actions { display: flex; flex-wrap: wrap; gap: 10px; }
+.confirm-actions .btn { flex: 1 1 auto; }
+.run-panel { padding: 22px; }
 .panel-head { display: flex; align-items: center; justify-content: space-between; gap: 12px; margin-bottom: 10px; min-height: 30px; color: var(--muted); }
 .panel-head .mono { overflow-wrap: anywhere; }
 .pill { border: 1px solid #9abb9f; padding: 4px 10px; border-radius: 20px; font-size: 10px; color: #315b43; text-align: right; }
@@ -425,7 +533,6 @@ dialog::backdrop { background: #071b16b3; backdrop-filter: blur(6px); }
 dialog pre { white-space: pre-wrap; overflow-wrap: anywhere; font: 12px/1.7 ui-monospace, monospace; margin-top: 18px; }
 
 @media (max-width: 1000px) {
-  .workspace { grid-template-columns: minmax(0, 1.3fr) minmax(0, 1fr); }
   .formula { flex-wrap: wrap; }
   .formula .text-button { margin-left: 28px; }
   .molecule-totals { grid-template-columns: repeat(2, minmax(0, 1fr)); }
@@ -436,6 +543,9 @@ dialog pre { white-space: pre-wrap; overflow-wrap: anywhere; font: 12px/1.7 ui-m
   .side-panel { grid-column: 2; display: grid; grid-template-columns: minmax(0, 220px) minmax(0, 1fr); align-items: start; }
   .side-panel .drive-groups { grid-template-columns: minmax(0, 1fr) minmax(0, 1.7fr); }
   .art-orchid { display: none; }
+  .shell.has-molecule { grid-template-columns: 200px minmax(0, 1fr); }
+  .mv-layout { grid-template-columns: minmax(0, 1fr); }
+  .mv-aside { position: static; }
 }
 @media (max-width: 900px) {
   .art { display: none; }
@@ -491,8 +601,20 @@ dialog pre { white-space: pre-wrap; overflow-wrap: anywhere; font: 12px/1.7 ui-m
   .shelf-caption > span:first-child { white-space: normal; max-width: 100%; font-size: 10px; }
   .shelf-caption > span:last-child { font-size: 10px; line-height: 1.6; }
   .active-formula { align-items: flex-start; flex-direction: column; gap: 6px; }
-  .workspace { grid-template-columns: minmax(0, 1fr); gap: 18px; }
-  .run-panel, .decision-panel { padding: 18px; border-radius: 16px; }
+  .shell.has-molecule { grid-template-columns: minmax(0, 1fr); }
+  .mv-title { font-size: 24px; }
+  .mv-steps { padding: 14px; gap: 4px; }
+  .mv-step { font-size: 0; gap: 0; }
+  .mv-step.is-now { font-size: 11px; gap: 4px; }
+  .mv-card { padding: 18px; border-radius: 16px; }
+  .file { grid-template-columns: minmax(0, 1fr); gap: 6px; }
+  .file-badge { justify-self: start; padding: 0 8px; }
+  .check-grid { grid-template-columns: minmax(0, 1fr); }
+  .mv-details { padding: 0 16px; }
+  .decision-card { padding: 18px; border-radius: 16px; }
+  .mv-roles > div { flex-direction: column; gap: 2px; }
+  .mv-roles dd { text-align: left; }
+  .run-panel { padding: 18px; border-radius: 16px; }
   .section-label { flex-direction: column; gap: 4px; }
   .molecule-totals { grid-template-columns: minmax(0, 1fr); gap: 10px; }
   .formula { padding: 12px; }
@@ -516,6 +638,7 @@ dialog pre { white-space: pre-wrap; overflow-wrap: anywhere; font: 12px/1.7 ui-m
 @media (pointer: coarse) {
   .nav-link, .tab, .btn, .loop-pill-action, .lane-segment, .text-button, summary, .motion-option { min-height: 44px; }
   .seg, .stepper-button, .inbox-watch, .inbox-recent-row { min-height: 44px; }
+  .mv-tab, .btn-small, .breadcrumb a, .accept-label, .preview-info .text-button { min-height: 44px; }
 }
 
 /* Motion: running cells and the resident's working pose animate; everything
@@ -548,6 +671,12 @@ dialog pre { white-space: pre-wrap; overflow-wrap: anywhere; font: 12px/1.7 ui-m
   .step-bar { forced-color-adjust: none; background: Canvas; border: 1px solid CanvasText; }
   .inbox-steps li.is-done .step-bar, .inbox-steps li.is-current .step-bar { background: Highlight; }
   .recent-dot { background: CanvasText; }
+  .state-pill, .file-badge, .chip, .check-group, .mv-steps, .mv-tabs, .decision-card, .mv-roles, .danger-zone, .amend-form, .confirm-form, .mv-details, .decision-changed { background: Canvas; color: CanvasText; box-shadow: none; border: 1px solid CanvasText; }
+  .state-dot { forced-color-adjust: none; background: CanvasText; }
+  .mv-step .step-bar { forced-color-adjust: none; background: Canvas; border: 1px solid CanvasText; }
+  .mv-step.is-done .step-bar, .mv-step.is-current .step-bar, .mv-step.is-blocked .step-bar { background: Highlight; }
+  .mv-tab { border: 1px solid ButtonText; }
+  .mv-tab[aria-selected=true] { background: Highlight; color: HighlightText; border-color: Highlight; }
   .cube-button[aria-pressed=true], .atom-tab[aria-selected=true], .lane-segment[aria-pressed=true] { outline: 2px solid Highlight; }
   button:focus-visible, summary:focus-visible, a:focus-visible, input:focus-visible { outline-color: Highlight; }
 }