Part of Plan: a very secure browser in Seed (0.3 and Phase 4). A permission handler on the app's own session; exact host matching for embed frames; never hand frame navigations or child windows to the operating system; strip frame-protection headers only for the app's own origin; a content security policy on the app pages; an allowlist in the preload IPC bridge. Plus the first version of the hostile page suite: a Playwright test that loads a hostile page inside the real Electron build and checks each rule. Follow-up: replace the generic IPC bridge with named methods.