Part of Plan: a very secure browser in Seed (0.4). Electron fuses set in the packaged app (no run-as-node, no Node options, no CLI inspect, ASAR integrity, only load from ASAR), macOS entitlements trimmed to what the app uses, and update manifests signed with a release key and verified by the app before install, with per-asset hashes. A packaging check reads the fuses from the built binary.