diff --git a/Cargo.toml b/Cargo.toml
index caea790..b29eb09 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,13 +15,14 @@ getrandom = "0.4"
 google-gmail1 = "7.0"
 lazy_static = "1.5"
 regex = "1.13"
-# Kernel flock() for the cross-process ingest lock: safe wrappers (no unsafe in
-# this crate), tiny with only the fs feature enabled. Unix-only, by design.
-rustix = { version = "1.0", features = ["fs"] }
+# Kernel flock() for the cross-process ingest lock plus kill() for the
+# viewer's owned-child cancel path: safe wrappers (no unsafe in this crate).
+# Unix-only, by design.
+rustix = { version = "1.0", features = ["fs", "process"] }
 serde = "1.0"
 serde_json = "1.0"
 sqlx = { version = "0.9", features = ["runtime-tokio", "sqlite"] }
-tokio = { version = "1.53", features = ["macros", "rt-multi-thread", "signal", "sync", "time"] }
+tokio = { version = "1.53", features = ["io-util", "macros", "process", "rt-multi-thread", "signal", "sync", "time"] }
 yup-oauth2 = "12"
 
 [dev-dependencies]
diff --git a/src/bin/fake_ingester.rs b/src/bin/fake_ingester.rs
new file mode 100644
index 0000000..c1b909a
--- /dev/null
+++ b/src/bin/fake_ingester.rs
@@ -0,0 +1,162 @@
+//! Test-only stand-in for the real ingester, used by the web viewer's
+//! supervision tests (tests/web_mutating.rs) to drive child-process paths that
+//! are impractical with the real binary: crashing mid-run, ignoring SIGTERM,
+//! emitting controlled stderr. It is never spawned in production — the viewer
+//! only launches it when GMAIL_STATS_INGEST_BIN points at it explicitly.
+//!
+//! It speaks just enough of the real CLI (`scan`/`import <path>`, `--db`,
+//! `--quiet`, `--resume`) to be spawned by the viewer, takes the real ingest
+//! flock, and writes real `ingest_runs` rows, so the viewer's observations are
+//! exercised against the genuine coordination primitives.
+//!
+//! Behavior is selected with FAKE_INGESTER_MODE:
+//! - `complete` (default): run row -> brief work -> done, exit 0
+//! - `crash`: run row, then exit(1) leaving the row open (flock freed by the
+//!   kernel; the next real ingester's janitor marks it abandoned)
+//! - `hang_trap`: run row, then wait; on SIGTERM mark the row cancelled and
+//!   exit 0 (the real ingester's clean-shutdown contract)
+//! - `hang_ignore`: run row, then wait forever, ignoring SIGTERM (forces the
+//!   viewer's SIGKILL escalation)
+//! - `stderr`: emit FAKE_INGESTER_STDERR_LINES lines (default 250) to stderr,
+//!   then behave like `hang_trap`
+//! - `norow`: print a failure to stderr and exit(1) before any row exists
+
+use std::path::PathBuf;
+use std::time::Duration;
+
+use sqlx::sqlite::{SqliteConnectOptions, SqliteJournalMode, SqliteSynchronous};
+use sqlx::{Connection, SqliteConnection};
+
+use gmail_stats::ingest;
+
+fn parse_args() -> (String, PathBuf) {
+    let mut source = "gmail_api".to_string();
+    let mut db = PathBuf::from("stats.db");
+    let mut args = std::env::args().skip(1);
+    while let Some(arg) = args.next() {
+        match arg.as_str() {
+            "scan" => source = "gmail_api".to_string(),
+            "import" => {
+                source = "mbox".to_string();
+                let _path = args.next();
+            }
+            "--db" => {
+                if let Some(path) = args.next() {
+                    db = PathBuf::from(path);
+                }
+            }
+            "--resume" => {
+                let _ = args.next();
+            }
+            "--quiet" | "--verbose" => {}
+            other => {
+                eprintln!("fake ingester: ignoring argument {other:?}");
+            }
+        }
+    }
+    (source, db)
+}
+
+/// Tests run in parallel inside one process, so a global env var cannot pick
+/// the mode per spawn; a `fake_mode` file next to the target database wins,
+/// falling back to FAKE_INGESTER_MODE, then `complete`.
+fn resolve_mode(db: &std::path::Path) -> String {
+    if let Some(dir) = db.parent() {
+        if let Ok(mode) = std::fs::read_to_string(dir.join("fake_mode")) {
+            let mode = mode.trim().to_string();
+            if !mode.is_empty() {
+                return mode;
+            }
+        }
+    }
+    std::env::var("FAKE_INGESTER_MODE").unwrap_or_else(|_| "complete".to_string())
+}
+
+/// Hard lifetime cap so a test that forgets to cancel can never leak an
+/// eternally sleeping process.
+const MAX_LIFE: Duration = Duration::from_secs(30);
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    let (source, db) = parse_args();
+    let mode = resolve_mode(&db);
+
+    if mode == "norow" {
+        eprintln!("fake ingester: refusing to start (norow mode)");
+        std::process::exit(1);
+    }
+    if mode == "flockfail" {
+        // Simulate losing the flock race *after* the viewer's friendly
+        // pre-check passed (the TOCTOU window): same message and exit as the
+        // real acquire_ingest_lock failure.
+        eprintln!(
+            "Error: another ingester is already running against {} \
+             (could not acquire exclusive lock); wait for it to finish or stop it first",
+            db.display()
+        );
+        std::process::exit(1);
+    }
+
+    // The real flock, so the viewer's pre-check/probe sees the truth.
+    let _lock = ingest::acquire_ingest_lock(&db)?;
+
+    let options = SqliteConnectOptions::new()
+        .filename(&db)
+        .create_if_missing(true)
+        .journal_mode(SqliteJournalMode::Wal)
+        .synchronous(SqliteSynchronous::Normal)
+        .busy_timeout(Duration::from_secs(5));
+    let mut conn = SqliteConnection::connect_with(&options).await?;
+    ingest::migrate(&mut conn).await?;
+    ingest::abandon_stale_runs(&mut conn).await?;
+    let run_id = ingest::create_run(&mut conn, &source, None).await?;
+    conn.close().await.ok();
+
+    if mode == "stderr" {
+        let lines: usize = std::env::var("FAKE_INGESTER_STDERR_LINES")
+            .ok()
+            .and_then(|v| v.parse().ok())
+            .unwrap_or(250);
+        for i in 1..=lines {
+            eprintln!("fake stderr line {i}");
+        }
+    }
+
+    match mode.as_str() {
+        "complete" => {
+            tokio::time::sleep(Duration::from_millis(200)).await;
+            ingest::finish_run(&options, run_id, "done", None, None).await?;
+        }
+        "crash" => {
+            eprintln!("fake ingester: crashing mid-run");
+            std::process::exit(1);
+        }
+        "hang_ignore" => {
+            // Swallow SIGTERM (up to the lifetime cap); only SIGKILL ends
+            // this mode early.
+            let mut sigterm =
+                tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())?;
+            let deadline = tokio::time::sleep(MAX_LIFE);
+            tokio::pin!(deadline);
+            loop {
+                tokio::select! {
+                    _ = sigterm.recv() => eprintln!("fake ingester: ignoring SIGTERM"),
+                    _ = &mut deadline => break,
+                }
+            }
+        }
+        // hang_trap and stderr: wait for SIGTERM, then the real ingester's
+        // clean-shutdown contract (cancelled row, exit 0).
+        _ => {
+            let mut sigterm =
+                tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())?;
+            tokio::select! {
+                _ = sigterm.recv() => {
+                    ingest::finish_run(&options, run_id, "cancelled", None, None).await?;
+                }
+                _ = tokio::time::sleep(MAX_LIFE) => {}
+            }
+        }
+    }
+    Ok(())
+}
diff --git a/src/bin/web.rs b/src/bin/web.rs
index 204a289..f154331 100644
--- a/src/bin/web.rs
+++ b/src/bin/web.rs
@@ -1,1019 +1,12 @@
-//! Local web viewer for gmail-stats (issue #11 Phase 1, issue #28 Phase B).
-//!
-//! Serves the embedded UI plus read-only JSON endpoints over `./stats.db`,
-//! bound to 127.0.0.1 only. Phase B adds observe-only ingestion state:
-//! `GET /api/status` (db readiness, active/last run, flock probe, viewer-side
-//! rate/ETA, CSRF token slot) and `GET /api/runs` (run history). The viewer
-//! performs no database writes of any kind; the only file it touches is the
-//! ingest lockfile, probed without truncation via open + try-lock + release.
+//! Thin entry point for the local web viewer. The whole application lives in
+//! `gmail_stats::webapp` so integration tests can drive the exact router the
+//! binary serves.
 //!
 //! Usage: `cargo run --bin web [port]` (default port 7878), then open the
 //! printed URL. Run from the repo root so `./stats.db` resolves, or point
 //! GMAIL_STATS_DB at the database.
 
-use std::collections::VecDeque;
-use std::path::{Path, PathBuf};
-use std::sync::{Arc, Mutex};
-use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
-
-use axum::{
-    extract::{Query, Request, State},
-    http::{header, HeaderValue, StatusCode},
-    middleware::{self, Next},
-    response::{Html, IntoResponse, Response},
-    routing::get,
-    Json, Router,
-};
-use serde_json::json;
-use sqlx::sqlite::{SqliteConnectOptions, SqlitePoolOptions, SqliteRow};
-use sqlx::{Row, SqlitePool};
-
-use gmail_stats::ingest;
-
-// CSS/JS are separate same-origin assets, not inline blocks: under the
-// `default-src 'self'` CSP below, `'self'` only allowlists same-origin URLs —
-// inline <style>/<script> would be refused by the browser.
-const INDEX_HTML: &str = include_str!("../../web/index.html");
-const APP_CSS: &str = include_str!("../../web/app.css");
-const APP_JS: &str = include_str!("../../web/app.js");
-const DEFAULT_PORT: u16 = 7878;
-
-/// How far back the in-memory rate window looks. Old observations age out so
-/// the displayed rate tracks the recent pace, not the whole run's average.
-const RATE_WINDOW: Duration = Duration::from_secs(30);
-/// Minimum span between oldest and newest observation before a rate is
-/// reported at all; two samples a few ms apart would just be noise.
-const RATE_MIN_SPAN: Duration = Duration::from_millis(500);
-
-/// Shared state for the router. Everything is read-only against the database;
-/// the rate window lives purely in viewer memory and is never persisted.
-struct AppState {
-    pool: SqlitePool,
-    db_path: PathBuf,
-    /// Per-process CSRF token (32 bytes of CSPRNG output, hex-encoded),
-    /// minted at startup and served via /api/status. No endpoint consumes it
-    /// yet — the first state-changing routes (Phase C) will require it in a
-    /// custom header, and shipping the slot now means clients can already
-    /// learn it the intended way (same-origin GET only; a cross-origin page
-    /// cannot read this response).
-    csrf_token: String,
-    rate: Mutex<RateWindow>,
-}
-
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
-    let port: u16 = match std::env::args().nth(1) {
-        Some(arg) => arg
-            .parse()
-            .map_err(|_| anyhow::anyhow!("invalid port: {arg}"))?,
-        None => DEFAULT_PORT,
-    };
-    let db_path =
-        PathBuf::from(std::env::var("GMAIL_STATS_DB").unwrap_or_else(|_| "./stats.db".to_string()));
-
-    let app = build_router(Arc::new(AppState::new(&db_path)));
-
-    // Loopback only, structurally. The port is the only knob.
-    let listener = tokio::net::TcpListener::bind(("127.0.0.1", port)).await?;
-    // Report the bound address, not the requested port: with port 0 the OS
-    // picks an ephemeral port, and the printed URL must be the real one.
-    let local_addr = listener.local_addr()?;
-    println!("gmail-stats web viewer listening on http://{local_addr}/");
-    axum::serve(listener, app).await?;
-    Ok(())
-}
-
-impl AppState {
-    fn new(db_path: &Path) -> Self {
-        // Read-only at the connection level, not by convention: the viewer
-        // must not be able to touch a mid-scan DB even via a bug.
-        let options = SqliteConnectOptions::new()
-            .filename(db_path)
-            .read_only(true)
-            .pragma("query_only", "ON")
-            .create_if_missing(false)
-            .busy_timeout(Duration::from_secs(5));
-
-        // Lazy connect so the server still starts (and can serve the friendly
-        // onboarding page) when stats.db doesn't exist yet.
-        let pool = SqlitePoolOptions::new()
-            .max_connections(2)
-            .connect_lazy_with(options);
-
-        let mut token_bytes = [0u8; 32];
-        getrandom::fill(&mut token_bytes).expect("operating system CSPRNG unavailable");
-        let csrf_token: String = token_bytes.iter().map(|b| format!("{b:02x}")).collect();
-
-        AppState {
-            pool,
-            db_path: db_path.to_path_buf(),
-            csrf_token,
-            rate: Mutex::new(RateWindow::default()),
-        }
-    }
-}
-
-fn build_router(state: Arc<AppState>) -> Router {
-    Router::new()
-        .route("/", get(index))
-        .route("/app.css", get(app_css))
-        .route("/app.js", get(app_js))
-        .route("/api/summary", get(summary))
-        .route("/api/status", get(status))
-        .route("/api/runs", get(runs))
-        .fallback(not_found)
-        .layer(middleware::from_fn(host_guard_and_security_headers))
-        .with_state(state)
-}
-
-/// DNS-rebinding guard plus defense-in-depth headers on every response.
-async fn host_guard_and_security_headers(req: Request, next: Next) -> Response {
-    let host_allowed = req
-        .headers()
-        .get(header::HOST)
-        .and_then(|value| value.to_str().ok())
-        .map(|host| {
-            let name = host.rsplit_once(':').map_or(host, |(name, _port)| name);
-            name == "127.0.0.1" || name == "localhost"
-        })
-        .unwrap_or(false);
-    if !host_allowed {
-        return (StatusCode::FORBIDDEN, "forbidden").into_response();
-    }
-
-    let mut response = next.run(req).await;
-    let headers = response.headers_mut();
-    headers.insert(
-        header::CONTENT_SECURITY_POLICY,
-        HeaderValue::from_static("default-src 'self'"),
-    );
-    headers.insert(
-        header::X_CONTENT_TYPE_OPTIONS,
-        HeaderValue::from_static("nosniff"),
-    );
-    headers.insert(
-        header::REFERRER_POLICY,
-        HeaderValue::from_static("no-referrer"),
-    );
-    response
-}
-
-async fn index() -> Html<&'static str> {
-    Html(INDEX_HTML)
-}
-
-async fn app_css() -> ([(header::HeaderName, &'static str); 1], &'static str) {
-    ([(header::CONTENT_TYPE, "text/css; charset=utf-8")], APP_CSS)
-}
-
-async fn app_js() -> ([(header::HeaderName, &'static str); 1], &'static str) {
-    (
-        [(header::CONTENT_TYPE, "text/javascript; charset=utf-8")],
-        APP_JS,
-    )
-}
-
-async fn not_found() -> StatusCode {
-    StatusCode::NOT_FOUND
-}
-
-async fn summary(State(state): State<Arc<AppState>>) -> Response {
-    match build_summary(&state.pool).await {
-        Ok(body) => Json(body).into_response(),
-        Err(err) => error_response(&err),
-    }
-}
-
-async fn build_summary(pool: &SqlitePool) -> Result<serde_json::Value, sqlx::Error> {
-    // seen_mails has no PK/unique constraint, so count distinct (matches the
-    // README's own query).
-    let total_messages: i64 = sqlx::query_scalar("SELECT COUNT(DISTINCT mail_id) FROM seen_mails")
-        .fetch_one(pool)
-        .await?;
-
-    // The app assumes one row per sender but nothing enforces it, so merge
-    // here. COALESCE folds NULL senders into '' *before* grouping so they
-    // merge with literal-'' rows instead of forming a separate group. Both
-    // columns need CAST against the schema's loose types: `sender string`
-    // matches none of SQLite's affinity keywords, so the column has NUMERIC
-    // affinity and a numeric-looking From header (e.g. an SMS shortcode like
-    // `40404`) is stored as INTEGER/REAL, which sqlx's String decoder
-    // rejects. CAST ... AS TEXT normalizes the storage class (and merges an
-    // INTEGER 12345 row with a TEXT '12345' row) so decoding — and thus the
-    // whole viewer — survives such rows; the mails_sent CAST likewise guards
-    // against stray TEXT values.
-    let rows: Vec<(String, i64)> = sqlx::query_as(
-        "SELECT CAST(COALESCE(sender, '') AS TEXT) AS sender, \
-                COALESCE(SUM(CAST(mails_sent AS INTEGER)), 0) AS mails_sent \
-         FROM senders GROUP BY CAST(COALESCE(sender, '') AS TEXT) \
-         ORDER BY mails_sent DESC",
-    )
-    .fetch_all(pool)
-    .await?;
-
-    let senders: Vec<serde_json::Value> = rows
-        .into_iter()
-        .map(|(sender, mails_sent)| json!({ "sender": sender, "mails_sent": mails_sent }))
-        .collect();
-
-    Ok(json!({
-        "total_messages": total_messages,
-        "senders": senders,
-        "generated_at_unix": now_unix(),
-    }))
-}
-
-// ---------------------------------------------------------------------------
-// GET /api/status — the single cheap poll target for "watch from the browser"
-// ---------------------------------------------------------------------------
-
-/// How a database-level error should be interpreted.
-enum DbErrorKind {
-    /// The file (or a table the query needs) doesn't exist.
-    MissingFile,
-    MissingTable,
-    Busy,
-    Other,
-}
-
-fn classify_db_error(err: &sqlx::Error) -> DbErrorKind {
-    let lower = err.to_string().to_lowercase();
-    if lower.contains("unable to open database file") {
-        DbErrorKind::MissingFile
-    } else if lower.contains("no such table") {
-        DbErrorKind::MissingTable
-    } else if lower.contains("database is locked") || lower.contains("database is busy") {
-        DbErrorKind::Busy
-    } else {
-        DbErrorKind::Other
-    }
-}
-
-async fn status(State(state): State<Arc<AppState>>) -> Response {
-    match build_status(&state).await {
-        Ok(body) => Json(body).into_response(),
-        Err(err) => error_response(&err),
-    }
-}
-
-/// Assemble the status document. Missing database, missing tables, and empty
-/// tables are all *data* here (they drive onboarding), never errors; only
-/// busy/unexpected failures propagate to the caller as HTTP errors.
-async fn build_status(state: &AppState) -> Result<serde_json::Value, sqlx::Error> {
-    let lock_held = probe_ingest_lock(&state.db_path);
-
-    // Database readiness. `unable to open` ⇒ the file is missing (the pool is
-    // read-only and never creates it); `no such table` ⇒ the file exists but
-    // was never initialized — both are onboarding states, not errors.
-    let db: &str =
-        match sqlx::query_scalar::<_, i64>("SELECT COUNT(DISTINCT mail_id) FROM seen_mails")
-            .fetch_one(&state.pool)
-            .await
-        {
-            Ok(0) => "empty",
-            Ok(_) => "ready",
-            Err(err) => match classify_db_error(&err) {
-                DbErrorKind::MissingFile => {
-                    return Ok(status_document(
-                        state, "missing", None, None, false, lock_held,
-                    ));
-                }
-                DbErrorKind::MissingTable => "empty",
-                DbErrorKind::Busy | DbErrorKind::Other => return Err(err),
-            },
-        };
-
-    // Run rows. An old database without ingest_runs simply has no runs; the
-    // ingester creates the table on its next start.
-    let (active_run, last_run, mixed_sources) = match fetch_runs_view(&state.pool).await {
-        Ok(view) => view,
-        Err(err) => match classify_db_error(&err) {
-            DbErrorKind::MissingFile | DbErrorKind::MissingTable => (None, None, false),
-            DbErrorKind::Busy | DbErrorKind::Other => return Err(err),
-        },
-    };
-
-    Ok(status_document(
-        state,
-        db,
-        active_run,
-        last_run,
-        mixed_sources,
-        lock_held,
-    ))
-}
-
-async fn fetch_runs_view(
-    pool: &SqlitePool,
-) -> Result<(Option<SqliteRow>, Option<SqliteRow>, bool), sqlx::Error> {
-    let active = sqlx::query(
-        "SELECT * FROM ingest_runs \
-         WHERE state NOT IN ('done', 'failed', 'cancelled', 'abandoned') \
-         ORDER BY run_id DESC LIMIT 1",
-    )
-    .fetch_optional(pool)
-    .await?;
-    let last = sqlx::query(
-        "SELECT * FROM ingest_runs \
-         WHERE state IN ('done', 'failed', 'cancelled', 'abandoned') \
-         ORDER BY run_id DESC LIMIT 1",
-    )
-    .fetch_optional(pool)
-    .await?;
-    // Interim mixed-sources caution (removed by Phase D's exact dedupe): true
-    // once more than one source has actually contributed rows — completed, or
-    // got far enough to add new messages before stopping.
-    let mixed: i64 = sqlx::query_scalar(
-        "SELECT COUNT(DISTINCT source) FROM ingest_runs \
-         WHERE state = 'done' OR messages_new > 0",
-    )
-    .fetch_one(pool)
-    .await?;
-    Ok((active, last, mixed >= 2))
-}
-
-fn status_document(
-    state: &AppState,
-    db: &str,
-    active_run: Option<SqliteRow>,
-    last_run: Option<SqliteRow>,
-    mixed_sources: bool,
-    lock_held: Option<bool>,
-) -> serde_json::Value {
-    // Viewer-derived rate/ETA from successive observations of the active
-    // run's counters. Pure viewer memory: nothing here is written anywhere.
-    let mut rate_per_sec = None;
-    let mut eta_seconds = None;
-    {
-        let mut window = state.rate.lock().unwrap_or_else(|e| e.into_inner());
-        match &active_run {
-            Some(row) => {
-                let run_id: i64 = row.try_get("run_id").unwrap_or(0);
-                let messages_seen: i64 = row.try_get("messages_seen").unwrap_or(0);
-                let bytes_done: Option<i64> = row.try_get("bytes_done").unwrap_or(None);
-                let (msg_rate, byte_rate) =
-                    window.observe(Instant::now(), run_id, messages_seen, bytes_done);
-                rate_per_sec = msg_rate.map(|r| (r * 10.0).round() / 10.0);
-                let bytes_total: Option<i64> = row.try_get("bytes_total").unwrap_or(None);
-                let total_estimate: Option<i64> = row.try_get("total_estimate").unwrap_or(None);
-                eta_seconds = compute_eta(
-                    messages_seen,
-                    bytes_done,
-                    bytes_total,
-                    total_estimate,
-                    msg_rate,
-                    byte_rate,
-                );
-            }
-            None => window.reset(),
-        }
-    }
-
-    json!({
-        "db": db,
-        "now_unix": now_unix(),
-        "ingest_lock_held": lock_held,
-        "active_run": active_run.as_ref().map(run_to_json),
-        "last_run": last_run.as_ref().map(run_to_json),
-        // Phase B never spawns anything, so no run is ever owned by the
-        // viewer; the field exists so clients already branch on it.
-        "owns_active_run": false,
-        "mixed_sources": mixed_sources,
-        "rate_per_sec": rate_per_sec,
-        "eta_seconds": eta_seconds,
-        "csrf_token": state.csrf_token,
-    })
-}
-
-/// Serialize one ingest_runs row for the API. resume_token and
-/// mbox_fingerprint are internal resume bookkeeping and stay out of the
-/// payload; everything else is display data (rendered via textContent only on
-/// the client — error text and paths are not trusted).
-fn run_to_json(row: &SqliteRow) -> serde_json::Value {
-    fn i(row: &SqliteRow, col: &str) -> Option<i64> {
-        row.try_get::<Option<i64>, _>(col).unwrap_or(None)
-    }
-    fn s(row: &SqliteRow, col: &str) -> Option<String> {
-        row.try_get::<Option<String>, _>(col).unwrap_or(None)
-    }
-    json!({
-        "run_id": i(row, "run_id"),
-        "source": s(row, "source"),
-        "state": s(row, "state"),
-        "pid": i(row, "pid"),
-        "started_at_unix": i(row, "started_at_unix"),
-        "updated_at_unix": i(row, "updated_at_unix"),
-        "finished_at_unix": i(row, "finished_at_unix"),
-        "messages_seen": i(row, "messages_seen").unwrap_or(0),
-        "messages_new": i(row, "messages_new").unwrap_or(0),
-        "total_estimate": i(row, "total_estimate"),
-        "bytes_total": i(row, "bytes_total"),
-        "bytes_done": i(row, "bytes_done"),
-        "mbox_path": s(row, "mbox_path"),
-        "error_kind": s(row, "error_kind"),
-        "error": s(row, "error"),
-    })
-}
-
-/// Probe the ingest lock without disturbing it: open the lockfile exactly the
-/// way the ingester does (create-if-missing, never truncate — see
-/// `ingest::acquire_ingest_lock`), try a non-blocking exclusive flock, and
-/// release immediately. Held ⇒ an ingester is alive right now, whoever
-/// started it. Returns None if the probe itself failed (e.g. permissions),
-/// which the client treats as "unknown".
-fn probe_ingest_lock(db_path: &Path) -> Option<bool> {
-    let lock_path = ingest::ingest_lock_path(db_path);
-    let file = std::fs::OpenOptions::new()
-        .create(true)
-        .truncate(false)
-        .write(true)
-        .open(&lock_path)
-        .ok()?;
-    match rustix::fs::flock(&file, rustix::fs::FlockOperation::NonBlockingLockExclusive) {
-        Ok(()) => {
-            // Explicit unlock before the fd drops, so the probe's hold time
-            // is as close to zero as possible.
-            let _ = rustix::fs::flock(&file, rustix::fs::FlockOperation::Unlock);
-            Some(false)
-        }
-        Err(rustix::io::Errno::WOULDBLOCK) => Some(true),
-        Err(_) => None,
-    }
-}
-
-/// Sliding window of (time, counters) observations for the active run, kept
-/// only in viewer memory. Rates come from the span between the oldest and
-/// newest sample still inside RATE_WINDOW.
-#[derive(Default)]
-struct RateWindow {
-    run_id: Option<i64>,
-    samples: VecDeque<(Instant, i64, Option<i64>)>,
-}
-
-impl RateWindow {
-    fn reset(&mut self) {
-        self.run_id = None;
-        self.samples.clear();
-    }
-
-    /// Record an observation and return (messages/sec, bytes/sec) over the
-    /// current window, if enough history exists to be meaningful.
-    fn observe(
-        &mut self,
-        now: Instant,
-        run_id: i64,
-        messages_seen: i64,
-        bytes_done: Option<i64>,
-    ) -> (Option<f64>, Option<f64>) {
-        if self.run_id != Some(run_id) {
-            self.reset();
-            self.run_id = Some(run_id);
-        }
-        self.samples.push_back((now, messages_seen, bytes_done));
-        while let Some(&(t, _, _)) = self.samples.front() {
-            if now.duration_since(t) > RATE_WINDOW && self.samples.len() > 2 {
-                self.samples.pop_front();
-            } else {
-                break;
-            }
-        }
-
-        let (first_t, first_msgs, first_bytes) = *self.samples.front().unwrap();
-        let span = now.duration_since(first_t);
-        if span < RATE_MIN_SPAN {
-            return (None, None);
-        }
-        let secs = span.as_secs_f64();
-        let msg_rate = ((messages_seen - first_msgs).max(0) as f64) / secs;
-        let byte_rate = match (bytes_done, first_bytes) {
-            (Some(b), Some(fb)) => Some(((b - fb).max(0) as f64) / secs),
-            _ => None,
-        };
-        (Some(msg_rate), byte_rate)
-    }
-}
-
-/// Estimated seconds to completion. Prefers byte progress (exact for imports)
-/// and falls back to the message-count estimate (scans). None when there is
-/// no total or no forward progress in the window.
-fn compute_eta(
-    messages_seen: i64,
-    bytes_done: Option<i64>,
-    bytes_total: Option<i64>,
-    total_estimate: Option<i64>,
-    msg_rate: Option<f64>,
-    byte_rate: Option<f64>,
-) -> Option<i64> {
-    if let (Some(done), Some(total), Some(rate)) = (bytes_done, bytes_total, byte_rate) {
-        if rate > 0.0 {
-            return Some((((total - done).max(0)) as f64 / rate).ceil() as i64);
-        }
-    }
-    if let (Some(total), Some(rate)) = (total_estimate, msg_rate) {
-        if rate > 0.0 {
-            return Some((((total - messages_seen).max(0)) as f64 / rate).ceil() as i64);
-        }
-    }
-    None
-}
-
-// ---------------------------------------------------------------------------
-// GET /api/runs — run history
-// ---------------------------------------------------------------------------
-
-async fn runs(
-    State(state): State<Arc<AppState>>,
-    Query(params): Query<std::collections::HashMap<String, String>>,
-) -> Response {
-    let limit: i64 = params
-        .get("limit")
-        .and_then(|v| v.parse::<i64>().ok())
-        .unwrap_or(20)
-        .clamp(1, 100);
-    match build_runs(&state.pool, limit).await {
-        Ok(body) => Json(body).into_response(),
-        Err(err) => error_response(&err),
-    }
-}
-
-async fn build_runs(pool: &SqlitePool, limit: i64) -> Result<serde_json::Value, sqlx::Error> {
-    let rows = match sqlx::query("SELECT * FROM ingest_runs ORDER BY run_id DESC LIMIT ?")
-        .bind(limit)
-        .fetch_all(pool)
-        .await
-    {
-        Ok(rows) => rows,
-        // A database that predates ingest_runs (or doesn't exist yet) simply
-        // has no run history; this endpoint powers a strip, not a diagnosis.
-        Err(err) => match classify_db_error(&err) {
-            DbErrorKind::MissingFile | DbErrorKind::MissingTable => Vec::new(),
-            DbErrorKind::Busy | DbErrorKind::Other => return Err(err),
-        },
-    };
-    let runs: Vec<serde_json::Value> = rows.iter().map(run_to_json).collect();
-    Ok(json!({ "runs": runs, "now_unix": now_unix() }))
-}
-
-fn now_unix() -> u64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map(|d| d.as_secs())
-        .unwrap_or(0)
-}
-
-fn error_response(err: &sqlx::Error) -> Response {
-    let detail = err.to_string();
-    let lower = detail.to_lowercase();
-    let (status, kind, message) =
-        if lower.contains("unable to open database file") || lower.contains("no such table") {
-            (
-            StatusCode::SERVICE_UNAVAILABLE,
-            "missing_db",
-            "stats.db (or its tables) not found — set up the database and run the scanner first",
-        )
-        } else if lower.contains("database is locked") || lower.contains("database is busy") {
-            (
-                StatusCode::SERVICE_UNAVAILABLE,
-                "busy",
-                "database busy — scanner is writing, retry shortly",
-            )
-        } else {
-            (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "internal",
-                "internal error",
-            )
-        };
-    (
-        status,
-        Json(json!({ "error": kind, "message": message, "detail": detail })),
-    )
-        .into_response()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use axum::body::Body;
-    use axum::http::Request as HttpRequest;
-    use sqlx::sqlite::SqliteJournalMode;
-    use sqlx::{Connection, SqliteConnection};
-    use tower::ServiceExt;
-
-    async fn memory_pool() -> SqlitePool {
-        // One connection max: each sqlite::memory: connection is a separate
-        // empty database, so the pool must never hand out a second one.
-        let pool = SqlitePoolOptions::new()
-            .max_connections(1)
-            .connect("sqlite::memory:")
-            .await
-            .expect("open in-memory db");
-        // Mirror the README's real schema, quirky type names included.
-        sqlx::query("CREATE TABLE seen_mails (mail_id string)")
-            .execute(&pool)
-            .await
-            .unwrap();
-        sqlx::query("CREATE TABLE senders (sender string, mails_sent int)")
-            .execute(&pool)
-            .await
-            .unwrap();
-        pool
-    }
-
-    /// `sender string` matches none of SQLite's affinity keywords, giving the
-    /// column NUMERIC affinity: numeric-looking From headers (SMS shortcodes,
-    /// `1e5`, `-1.5`) are stored as INTEGER/REAL, which sqlx's String decoder
-    /// rejects unless the query CASTs the column back to TEXT. Regression
-    /// test: one such row must not 500 the whole summary forever.
-    #[tokio::test]
-    async fn summary_survives_numeric_sender_rows() {
-        let pool = memory_pool().await;
-        sqlx::query("INSERT INTO senders VALUES ('40404', 7), ('-1.5', 2), ('a@b.com', 3)")
-            .execute(&pool)
-            .await
-            .unwrap();
-
-        // Sanity-check the poisoned storage classes this test exists for.
-        let types: Vec<(String,)> =
-            sqlx::query_as("SELECT typeof(sender) FROM senders ORDER BY mails_sent DESC")
-                .fetch_all(&pool)
-                .await
-                .unwrap();
-        let types: Vec<&str> = types.iter().map(|(t,)| t.as_str()).collect();
-        assert_eq!(types, ["integer", "text", "real"]);
-
-        let summary = build_summary(&pool)
-            .await
-            .expect("summary must survive numeric-looking sender rows");
-        let senders = summary["senders"].as_array().unwrap();
-        assert_eq!(senders.len(), 3);
-        assert_eq!(senders[0]["sender"], "40404");
-        assert_eq!(senders[0]["mails_sent"], 7);
-        assert_eq!(senders[1]["sender"], "a@b.com");
-        assert_eq!(senders[2]["sender"], "-1.5");
-    }
-
-    /// NULL senders must keep merging with literal-'' rows (pre-existing
-    /// behavior the CAST fix must not regress).
-    #[tokio::test]
-    async fn summary_merges_null_and_empty_senders() {
-        let pool = memory_pool().await;
-        sqlx::query("INSERT INTO senders VALUES (NULL, 4), ('', 1)")
-            .execute(&pool)
-            .await
-            .unwrap();
-
-        let summary = build_summary(&pool).await.unwrap();
-        let senders = summary["senders"].as_array().unwrap();
-        assert_eq!(senders.len(), 1);
-        assert_eq!(senders[0]["sender"], "");
-        assert_eq!(senders[0]["mails_sent"], 5);
-    }
-
-    // -- Phase B endpoint tests ---------------------------------------------
-
-    /// Build a real on-disk database with Phase A's actual DDL (via
-    /// `ingest::migrate`), so the tests exercise the same schema the ingester
-    /// produces.
-    async fn migrated_db(dir: &tempfile::TempDir) -> PathBuf {
-        let db_path = dir.path().join("stats.db");
-        let options = SqliteConnectOptions::new()
-            .filename(&db_path)
-            .create_if_missing(true)
-            .journal_mode(SqliteJournalMode::Wal);
-        let mut conn = SqliteConnection::connect_with(&options).await.unwrap();
-        ingest::migrate(&mut conn).await.unwrap();
-        conn.close().await.ok();
-        db_path
-    }
-
-    async fn exec(db_path: &Path, sql: &str) {
-        let options = SqliteConnectOptions::new()
-            .filename(db_path)
-            .journal_mode(SqliteJournalMode::Wal);
-        let mut conn = SqliteConnection::connect_with(&options).await.unwrap();
-        sqlx::raw_sql(sqlx::AssertSqlSafe(sql.to_string()))
-            .execute(&mut conn)
-            .await
-            .unwrap();
-        conn.close().await.ok();
-    }
-
-    async fn get_json(app: Router, uri: &str) -> (StatusCode, serde_json::Value) {
-        let response = app
-            .oneshot(
-                HttpRequest::builder()
-                    .uri(uri)
-                    .header(header::HOST, "127.0.0.1:7878")
-                    .body(Body::empty())
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-        let status = response.status();
-        let bytes = axum::body::to_bytes(response.into_body(), 1 << 20)
-            .await
-            .unwrap();
-        let value = serde_json::from_slice(&bytes).unwrap_or(serde_json::Value::Null);
-        (status, value)
-    }
-
-    fn app_for(db_path: &Path) -> Router {
-        build_router(Arc::new(AppState::new(db_path)))
-    }
-
-    #[tokio::test]
-    async fn status_with_missing_db_is_200_and_onboardable() {
-        let dir = tempfile::tempdir().unwrap();
-        let db_path = dir.path().join("does-not-exist.db");
-        let (status, body) = get_json(app_for(&db_path), "/api/status").await;
-        assert_eq!(
-            status,
-            StatusCode::OK,
-            "status must never 5xx on missing db"
-        );
-        assert_eq!(body["db"], "missing");
-        assert!(body["active_run"].is_null());
-        assert!(body["last_run"].is_null());
-        assert_eq!(body["owns_active_run"], false);
-        assert_eq!(body["mixed_sources"], false);
-        // CSRF token slot: 32 CSPRNG bytes, hex-encoded.
-        let token = body["csrf_token"].as_str().unwrap();
-        assert_eq!(token.len(), 64);
-        assert!(token.chars().all(|c| c.is_ascii_hexdigit()));
-        // The read-only pool must not have created the file as a side effect.
-        assert!(!db_path.exists(), "viewer must not create the database");
-    }
-
-    #[tokio::test]
-    async fn status_with_empty_db_reports_empty() {
-        let dir = tempfile::tempdir().unwrap();
-        let db_path = migrated_db(&dir).await;
-        let (status, body) = get_json(app_for(&db_path), "/api/status").await;
-        assert_eq!(status, StatusCode::OK);
-        assert_eq!(body["db"], "empty");
-        assert!(body["active_run"].is_null());
-        assert_eq!(body["ingest_lock_held"], false);
-    }
-
-    #[tokio::test]
-    async fn status_without_ingest_runs_table_treats_runs_as_none() {
-        // A pre-Phase-A database: baseline tables with data, no ingest_runs.
-        let dir = tempfile::tempdir().unwrap();
-        let db_path = dir.path().join("old.db");
-        let options = SqliteConnectOptions::new()
-            .filename(&db_path)
-            .create_if_missing(true);
-        let mut conn = SqliteConnection::connect_with(&options).await.unwrap();
-        sqlx::query("CREATE TABLE seen_mails (mail_id string)")
-            .execute(&mut conn)
-            .await
-            .unwrap();
-        sqlx::query("CREATE TABLE senders (sender string, mails_sent int)")
-            .execute(&mut conn)
-            .await
-            .unwrap();
-        sqlx::query("INSERT INTO seen_mails VALUES ('m1')")
-            .execute(&mut conn)
-            .await
-            .unwrap();
-        conn.close().await.ok();
-
-        let (status, body) = get_json(app_for(&db_path), "/api/status").await;
-        assert_eq!(status, StatusCode::OK);
-        assert_eq!(body["db"], "ready");
-        assert!(body["active_run"].is_null());
-        assert!(body["last_run"].is_null());
-
-        let (status, body) = get_json(app_for(&db_path), "/api/runs").await;
-        assert_eq!(status, StatusCode::OK);
-        assert_eq!(body["runs"].as_array().unwrap().len(), 0);
-    }
-
-    #[tokio::test]
-    async fn status_with_active_and_finished_runs() {
-        let dir = tempfile::tempdir().unwrap();
-        let db_path = migrated_db(&dir).await;
-        exec(&db_path, "INSERT INTO seen_mails VALUES ('m1')").await;
-        exec(
-            &db_path,
-            "INSERT INTO ingest_runs \
-             (run_id, source, state, started_at_unix, updated_at_unix, finished_at_unix, \
-              messages_seen, messages_new, error_kind, error) \
-             VALUES (1, 'gmail_api', 'failed', 100, 150, 150, 10, 5, \
-                     'policy_enforced', 'Error 400: policy_enforced')",
-        )
-        .await;
-        exec(
-            &db_path,
-            "INSERT INTO ingest_runs \
-             (run_id, source, state, started_at_unix, updated_at_unix, \
-              messages_seen, messages_new, bytes_total, bytes_done, mbox_path) \
-             VALUES (2, 'mbox', 'running', 200, 205, 1000, 900, 50000, 25000, '/tmp/a.mbox')",
-        )
-        .await;
-
-        let (status, body) = get_json(app_for(&db_path), "/api/status").await;
-        assert_eq!(status, StatusCode::OK);
-        assert_eq!(body["db"], "ready");
-        let active = &body["active_run"];
-        assert_eq!(active["run_id"], 2);
-        assert_eq!(active["source"], "mbox");
-        assert_eq!(active["state"], "running");
-        assert_eq!(active["messages_seen"], 1000);
-        assert_eq!(active["bytes_total"], 50000);
-        assert_eq!(active["bytes_done"], 25000);
-        let last = &body["last_run"];
-        assert_eq!(last["run_id"], 1);
-        assert_eq!(last["state"], "failed");
-        assert_eq!(last["error_kind"], "policy_enforced");
-        assert_eq!(body["owns_active_run"], false);
-        // First observation of this run: no rate window yet.
-        assert!(body["rate_per_sec"].is_null());
-        assert!(body["now_unix"].as_u64().unwrap() > 0);
-    }
-
-    #[tokio::test]
-    async fn status_mixed_sources_flags_dual_source_databases() {
-        let dir = tempfile::tempdir().unwrap();
-        let db_path = migrated_db(&dir).await;
-        exec(&db_path, "INSERT INTO seen_mails VALUES ('m1')").await;
-        exec(
-            &db_path,
-            "INSERT INTO ingest_runs (run_id, source, state, started_at_unix, updated_at_unix, \
-             messages_new) VALUES (1, 'gmail_api', 'done', 100, 150, 10)",
-        )
-        .await;
-        let (_, body) = get_json(app_for(&db_path), "/api/status").await;
-        assert_eq!(body["mixed_sources"], false);
-
-        exec(
-            &db_path,
-            "INSERT INTO ingest_runs (run_id, source, state, started_at_unix, updated_at_unix, \
-             messages_new) VALUES (2, 'mbox', 'done', 200, 250, 3)",
-        )
-        .await;
-        let (_, body) = get_json(app_for(&db_path), "/api/status").await;
-        assert_eq!(body["mixed_sources"], true);
-    }
-
-    #[tokio::test]
-    async fn status_lock_probe_detects_a_running_ingester_without_truncating() {
-        let dir = tempfile::tempdir().unwrap();
-        let db_path = migrated_db(&dir).await;
-        let lock_path = ingest::ingest_lock_path(&db_path);
-        // Pre-existing lockfile content must survive the probe (no truncate).
-        std::fs::write(&lock_path, b"sentinel").unwrap();
-
-        let (_, body) = get_json(app_for(&db_path), "/api/status").await;
-        assert_eq!(body["ingest_lock_held"], false);
-
-        // A live ingester holds the flock; the probe must see it and must not
-        // steal or break it.
-        let held = ingest::acquire_ingest_lock(&db_path).unwrap();
-        let (_, body) = get_json(app_for(&db_path), "/api/status").await;
-        assert_eq!(body["ingest_lock_held"], true);
-        drop(held);
-
-        let (_, body) = get_json(app_for(&db_path), "/api/status").await;
-        assert_eq!(body["ingest_lock_held"], false);
-        assert_eq!(
-            std::fs::read(&lock_path).unwrap(),
-            b"sentinel",
-            "probe must never truncate the lockfile"
-        );
-    }
-
-    #[tokio::test]
-    async fn runs_endpoint_orders_and_limits() {
-        let dir = tempfile::tempdir().unwrap();
-        let db_path = migrated_db(&dir).await;
-        for id in 1..=5 {
-            exec(
-                &db_path,
-                &format!(
-                    "INSERT INTO ingest_runs (run_id, source, state, started_at_unix, \
-                     updated_at_unix) VALUES ({id}, 'mbox', 'done', {id}00, {id}50)"
-                ),
-            )
-            .await;
-        }
-        let (status, body) = get_json(app_for(&db_path), "/api/runs?limit=3").await;
-        assert_eq!(status, StatusCode::OK);
-        let runs = body["runs"].as_array().unwrap();
-        assert_eq!(runs.len(), 3);
-        // Newest first.
-        assert_eq!(runs[0]["run_id"], 5);
-        assert_eq!(runs[1]["run_id"], 4);
-        assert_eq!(runs[2]["run_id"], 3);
-
-        // Default limit, garbage limit, and missing db all behave.
-        let (_, body) = get_json(app_for(&db_path), "/api/runs").await;
-        assert_eq!(body["runs"].as_array().unwrap().len(), 5);
-        let (_, body) = get_json(app_for(&db_path), "/api/runs?limit=bogus").await;
-        assert_eq!(body["runs"].as_array().unwrap().len(), 5);
-        let missing = dir.path().join("nope.db");
-        let (status, body) = get_json(app_for(&missing), "/api/runs").await;
-        assert_eq!(status, StatusCode::OK);
-        assert_eq!(body["runs"].as_array().unwrap().len(), 0);
-    }
-
-    #[tokio::test]
-    async fn new_routes_keep_security_headers_and_emit_no_cors() {
-        let dir = tempfile::tempdir().unwrap();
-        let db_path = migrated_db(&dir).await;
-        for uri in ["/api/status", "/api/runs"] {
-            let response = app_for(&db_path)
-                .oneshot(
-                    HttpRequest::builder()
-                        .uri(uri)
-                        .header(header::HOST, "127.0.0.1:7878")
-                        .header(header::ORIGIN, "https://evil.example")
-                        .body(Body::empty())
-                        .unwrap(),
-                )
-                .await
-                .unwrap();
-            let headers = response.headers();
-            assert_eq!(
-                headers.get(header::CONTENT_SECURITY_POLICY).unwrap(),
-                "default-src 'self'",
-                "{uri} lost the CSP"
-            );
-            assert_eq!(
-                headers.get(header::X_CONTENT_TYPE_OPTIONS).unwrap(),
-                "nosniff"
-            );
-            assert_eq!(headers.get(header::REFERRER_POLICY).unwrap(), "no-referrer");
-            assert!(
-                headers.get(header::ACCESS_CONTROL_ALLOW_ORIGIN).is_none(),
-                "{uri} must never emit CORS headers"
-            );
-            assert!(headers.get(header::ACCESS_CONTROL_ALLOW_METHODS).is_none());
-        }
-    }
-
-    #[tokio::test]
-    async fn new_routes_respect_the_host_guard() {
-        let dir = tempfile::tempdir().unwrap();
-        let db_path = migrated_db(&dir).await;
-        for uri in ["/api/status", "/api/runs"] {
-            let response = app_for(&db_path)
-                .oneshot(
-                    HttpRequest::builder()
-                        .uri(uri)
-                        .header(header::HOST, "attacker.example")
-                        .body(Body::empty())
-                        .unwrap(),
-                )
-                .await
-                .unwrap();
-            assert_eq!(response.status(), StatusCode::FORBIDDEN, "{uri}");
-        }
-    }
-
-    #[tokio::test]
-    async fn csrf_token_is_stable_per_process_state() {
-        let dir = tempfile::tempdir().unwrap();
-        let db_path = migrated_db(&dir).await;
-        let state = Arc::new(AppState::new(&db_path));
-        let (_, a) = get_json(build_router(state.clone()), "/api/status").await;
-        let (_, b) = get_json(build_router(state.clone()), "/api/status").await;
-        assert_eq!(a["csrf_token"], b["csrf_token"]);
-        // And two distinct viewer processes mint distinct tokens.
-        let other = Arc::new(AppState::new(&db_path));
-        assert_ne!(state.csrf_token, other.csrf_token);
-    }
-
-    #[test]
-    fn rate_window_computes_rates_and_resets_across_runs() {
-        let mut window = RateWindow::default();
-        let t0 = Instant::now();
-        // First sample: no span yet.
-        assert_eq!(window.observe(t0, 1, 100, Some(1000)), (None, None));
-        // Two seconds later, 80 more messages and 8000 more bytes.
-        let (msg, bytes) = window.observe(t0 + Duration::from_secs(2), 1, 180, Some(9000));
-        assert_eq!(msg, Some(40.0));
-        assert_eq!(bytes, Some(4000.0));
-
-        // ETA from bytes: (50000-9000)/4000 = 10.25 → 11s.
-        let eta = compute_eta(180, Some(9000), Some(50_000), None, msg, bytes);
-        assert_eq!(eta, Some(11));
-        // ETA from message estimate when no byte totals exist.
-        let eta = compute_eta(180, None, None, Some(580), msg, None);
-        assert_eq!(eta, Some(10));
-        // No forward progress ⇒ no ETA rather than a division blowup.
-        let (msg, _) = window.observe(t0 + Duration::from_secs(3), 1, 180, Some(9000));
-        assert!(eta_is_none_when_rate_zero(msg));
-
-        // A new run id resets the window.
-        assert_eq!(
-            window.observe(t0 + Duration::from_secs(4), 2, 5, None),
-            (None, None)
-        );
-    }
-
-    fn eta_is_none_when_rate_zero(msg_rate: Option<f64>) -> bool {
-        compute_eta(180, None, None, Some(580), msg_rate.map(|_| 0.0), None).is_none()
-    }
+    gmail_stats::webapp::serve().await
 }
diff --git a/src/ingest.rs b/src/ingest.rs
index 04feccb..ba76381 100644
--- a/src/ingest.rs
+++ b/src/ingest.rs
@@ -249,6 +249,15 @@ pub enum WriteMsg {
         /// Scan only: the mailbox's total message count, once known.
         total_estimate: Option<i64>,
     },
+    /// Scan only: OAuth consent progress. The InstalledFlow delegate sets
+    /// state='awaiting_auth' plus the consent URL when Google asks for the
+    /// user; once tokens arrive the scanner sets state back to 'running' and
+    /// clears the URL. Rides the writer channel like every other durable
+    /// write, so single-writer discipline holds.
+    AuthState {
+        state: &'static str,
+        auth_url: Option<String>,
+    },
 }
 
 /// The single DB writer: receives results over the channel and commits them
@@ -304,6 +313,18 @@ pub async fn db_writer(
                     .execute(&mut conn)
                     .await?;
                 }
+                Some(WriteMsg::AuthState { state, auth_url }) => {
+                    sqlx::query(
+                        "UPDATE ingest_runs SET state = ?, auth_url = ?, \
+                         updated_at_unix = ? WHERE run_id = ?",
+                    )
+                    .bind(state)
+                    .bind(auth_url)
+                    .bind(now_unix())
+                    .bind(run_id)
+                    .execute(&mut conn)
+                    .await?;
+                }
             },
             _ = heartbeat.tick() => {
                 sqlx::query("UPDATE ingest_runs SET updated_at_unix = ? WHERE run_id = ?")
@@ -658,6 +679,41 @@ mod tests {
         assert_eq!(mails, 2);
     }
 
+    #[tokio::test]
+    async fn db_writer_applies_auth_state_transitions() {
+        let dir = tempfile::tempdir().unwrap();
+        let options = file_options(&dir.path().join("stats.db"));
+        let mut conn = SqliteConnection::connect_with(&options).await.unwrap();
+        migrate(&mut conn).await.unwrap();
+        let run_id = create_run(&mut conn, "gmail_api", None).await.unwrap();
+
+        let (tx, rx) = mpsc::channel(4);
+        let writer = tokio::spawn(db_writer(conn, rx, run_id));
+        tx.send(WriteMsg::AuthState {
+            state: "awaiting_auth",
+            auth_url: Some("https://accounts.google.com/o/oauth2/auth?x=1".into()),
+        })
+        .await
+        .unwrap();
+        tx.send(WriteMsg::AuthState {
+            state: "running",
+            auth_url: None,
+        })
+        .await
+        .unwrap();
+        drop(tx);
+        writer.await.unwrap().unwrap();
+
+        let mut conn = SqliteConnection::connect_with(&options).await.unwrap();
+        let row = sqlx::query("SELECT state, auth_url FROM ingest_runs WHERE run_id = ?")
+            .bind(run_id)
+            .fetch_one(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(row.try_get::<String, _>("state").unwrap(), "running");
+        assert_eq!(row.try_get::<Option<String>, _>("auth_url").unwrap(), None);
+    }
+
     #[test]
     fn fingerprint_changes_when_the_file_changes() {
         let dir = tempfile::tempdir().unwrap();
diff --git a/src/lib.rs b/src/lib.rs
index 2975970..ebb1048 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -8,3 +8,4 @@
 
 pub mod ingest;
 pub mod mbox;
+pub mod webapp;
diff --git a/src/main.rs b/src/main.rs
index ec20601..687db5d 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -51,10 +51,13 @@ OPTIONS:
                            [env: GMAIL_STATS_CREDENTIALS] [default: credentials.json]
     --tokens <PATH>        OAuth token cache file (scan only)
                            [env: GMAIL_STATS_TOKENS] [default: tokencache.json]
-    --resume <RUN_ID>      import only: resume a cancelled/failed/abandoned
-                           import from its recorded byte offset; falls back to
-                           a full re-parse if the file changed (dedupe keeps
-                           the counts correct either way)
+    --resume <RUN_ID>      resume an earlier run of the same kind.
+                           import: continue from the recorded byte offset,
+                           falling back to a full re-parse if the file changed;
+                           scan: start listing from the run's persisted page
+                           token, silently restarting from the beginning when
+                           the token has expired (seen-mail dedupe keeps the
+                           counts correct either way)
     --quiet                only errors and the final summary
     --verbose              per-message detail (prints every sender)
     -h, --help             show this help
@@ -88,7 +91,7 @@ fn chatty() -> bool {
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 enum Mode {
-    Scan,
+    Scan { resume: Option<i64> },
     Import { path: PathBuf, resume: Option<i64> },
 }
 
@@ -159,10 +162,7 @@ fn parse_args(
             if positionals.len() > 1 {
                 return Err(format!("unexpected argument {:?}", positionals[1]));
             }
-            if resume.is_some() {
-                return Err("--resume is only valid with the import subcommand".to_string());
-            }
-            Mode::Scan
+            Mode::Scan { resume }
         }
         Some("import") => {
             let path = positionals
@@ -284,7 +284,7 @@ async fn main() -> anyhow::Result<()> {
     let cancel = spawn_signal_handler();
 
     match &cfg.mode {
-        Mode::Scan => run_scan(&cfg, &options, writer_conn, cancel).await,
+        Mode::Scan { resume } => run_scan(&cfg, &options, writer_conn, cancel, *resume).await,
         Mode::Import { path, resume } => {
             let summary = run_import(&options, writer_conn, path, *resume, cancel).await?;
             report_import_summary(&summary, path);
@@ -614,6 +614,7 @@ async fn run_scan(
     options: &SqliteConnectOptions,
     mut writer_conn: SqliteConnection,
     cancel: Arc<AtomicBool>,
+    resume: Option<i64>,
 ) -> anyhow::Result<()> {
     let fetch_concurrency: usize =
         env_or("GMAIL_STATS_FETCH_CONCURRENCY", DEFAULT_FETCH_CONCURRENCY)?;
@@ -635,6 +636,14 @@ async fn run_scan(
         .connect_with(options.clone())
         .await?;
 
+    // Best-effort resume (issue #26 Q4): start listing from the page token the
+    // resumed run persisted. If Gmail rejects the token as expired, work()
+    // silently restarts from page one — seen-mail dedupe keeps that correct.
+    let resumed_token = match resume {
+        None => None,
+        Some(run_id) => resolve_scan_resume(&mut writer_conn, run_id).await?,
+    };
+
     let run_id = ingest::create_run(&mut writer_conn, "gmail_api", None).await?;
     let (mut write_tx, write_rx) = mpsc::channel::<WriteMsg>(100);
     let mut writer_handle = task::spawn(ingest::db_writer(writer_conn, write_rx, run_id));
@@ -673,12 +682,17 @@ async fn run_scan(
 
     // Create an authenticator that uses an InstalledFlow to authenticate. The
     // authentication tokens are persisted to the token cache file, so they are
-    // cached to disk and refreshed once they've expired.
+    // cached to disk and refreshed once they've expired. The custom delegate
+    // surfaces the consent URL on the run row (state='awaiting_auth') so the
+    // web viewer can offer an "Authorize in Google" link for spawned runs.
     let auth = match yup_oauth2::InstalledFlowAuthenticator::builder(
         secret,
         yup_oauth2::InstalledFlowReturnMethod::HTTPRedirect,
     )
     .persist_tokens_to_disk(cfg.tokens.clone())
+    .flow_delegate(Box::new(RunRowAuthDelegate {
+        write_tx: write_tx.downgrade(),
+    }))
     .build()
     .await
     {
@@ -699,6 +713,40 @@ async fn run_scan(
         }
     };
 
+    // Acquire a token up front instead of lazily on the first API call, so an
+    // unattended consent is bounded by GMAIL_STATS_AUTH_TIMEOUT (the run turns
+    // failed/auth_required instead of hanging forever) and the run row can
+    // transition awaiting_auth -> running the moment tokens arrive. When the
+    // token cache is already valid this never prompts.
+    let auth_timeout = Duration::from_secs(env_or(
+        "GMAIL_STATS_AUTH_TIMEOUT",
+        DEFAULT_AUTH_TIMEOUT_SECS,
+    )?);
+    let scopes = ["https://www.googleapis.com/auth/gmail.readonly"];
+    if let Err(e) = consent_within(auth.token(&scopes), auth_timeout).await {
+        drop(write_tx);
+        let _ = writer_handle.await;
+        let msg = format!("{e:#}");
+        ingest::finish_run(
+            options,
+            run_id,
+            "failed",
+            Some(consent_error_kind(&msg)),
+            Some(&msg),
+        )
+        .await
+        .ok();
+        return Err(e);
+    }
+    // Tokens are in hand: leave awaiting_auth (a no-op when consent was never
+    // needed — the row is already 'running').
+    let _ = write_tx
+        .send(WriteMsg::AuthState {
+            state: "running",
+            auth_url: None,
+        })
+        .await;
+
     let hub = Gmail::new(
         hyper_util::client::legacy::Client::builder(hyper_util::rt::TokioExecutor::new()).build(
             hyper_rustls::HttpsConnectorBuilder::new()
@@ -742,7 +790,8 @@ async fn run_scan(
     // progress in between exhaust the budget.
     let mut retries = 0;
     let mut progress = ScanProgress {
-        resume_token: None,
+        resume_unverified: resumed_token.is_some(),
+        resume_token: resumed_token,
         pages_done: 0,
         messages_listed: 0,
     };
@@ -934,6 +983,145 @@ where
     }
 }
 
+/// Default bound on how long an interactive OAuth consent may stay pending
+/// before the run is marked failed/auth_required. Override with the
+/// GMAIL_STATS_AUTH_TIMEOUT env var (seconds).
+const DEFAULT_AUTH_TIMEOUT_SECS: u64 = 600;
+
+/// Look up the persisted page token for `scan --resume <run_id>`. Missing or
+/// wrong-source runs are hard errors (the user named a specific run); a run
+/// without a saved token just means a from-scratch scan.
+async fn resolve_scan_resume(
+    conn: &mut SqliteConnection,
+    run_id: i64,
+) -> anyhow::Result<Option<String>> {
+    let row = sqlx::query("SELECT source, resume_token FROM ingest_runs WHERE run_id = ?")
+        .bind(run_id)
+        .fetch_optional(&mut *conn)
+        .await?;
+    let Some(row) = row else {
+        anyhow::bail!("no ingest run {run_id} to resume");
+    };
+    let source: String = row.try_get("source")?;
+    anyhow::ensure!(
+        source == "gmail_api",
+        "run {run_id} is a {source} run, not a Gmail API scan"
+    );
+    let token: Option<String> = row.try_get("resume_token")?;
+    match token {
+        Some(token) if !token.is_empty() => {
+            if chatty() {
+                println!("resuming scan run {run_id} from its saved page token (best effort)");
+            }
+            Ok(Some(token))
+        }
+        _ => {
+            if chatty() {
+                println!("run {run_id} saved no page token; scanning from the beginning");
+            }
+            Ok(None)
+        }
+    }
+}
+
+/// InstalledFlow delegate that mirrors consent progress onto the run row:
+/// state='awaiting_auth' plus the URL while Google waits for the user, so the
+/// web viewer can render a validated "Authorize in Google" link. Terminal UX
+/// is unchanged: the URL is still printed unless --quiet.
+///
+/// Holds only a *weak* sender: the authenticator (and thus this delegate)
+/// lives as long as the whole scan, and a strong clone here would keep the
+/// writer channel open forever, deadlocking the end-of-scan drain.
+struct RunRowAuthDelegate {
+    write_tx: mpsc::WeakSender<WriteMsg>,
+}
+
+impl yup_oauth2::authenticator_delegate::InstalledFlowDelegate for RunRowAuthDelegate {
+    fn present_user_url<'a>(
+        &'a self,
+        url: &'a str,
+        need_code: bool,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = Result<String, String>> + Send + 'a>>
+    {
+        Box::pin(present_auth_url(self.write_tx.clone(), url, need_code))
+    }
+}
+
+async fn present_auth_url(
+    write_tx: mpsc::WeakSender<WriteMsg>,
+    url: &str,
+    need_code: bool,
+) -> Result<String, String> {
+    // Best-effort: consent must not die just because the writer is gone.
+    if let Some(write_tx) = write_tx.upgrade() {
+        let _ = write_tx
+            .send(WriteMsg::AuthState {
+                state: "awaiting_auth",
+                auth_url: Some(url.to_string()),
+            })
+            .await;
+    }
+    if need_code {
+        // Parity with yup-oauth2's default delegate: interactive fallback
+        // reads the code from stdin. Spawned runs use HTTPRedirect
+        // (need_code=false) and have stdin null, so this path is
+        // terminal-only.
+        if chatty() {
+            println!(
+                "Please direct your browser to {url}, follow the instructions and enter \
+                 the code displayed here: "
+            );
+        }
+        use tokio::io::AsyncBufReadExt;
+        let mut user_input = String::new();
+        tokio::io::BufReader::new(tokio::io::stdin())
+            .read_line(&mut user_input)
+            .await
+            .map_err(|e| format!("couldn't read code: {e}"))?;
+        user_input.truncate(user_input.trim_end().len());
+        Ok(user_input)
+    } else {
+        if chatty() {
+            println!(
+                "Please direct your browser to {url} and follow the instructions \
+                 displayed there."
+            );
+        }
+        Ok(String::new())
+    }
+}
+
+/// Bound an OAuth token acquisition so an unattended consent (nobody ever
+/// opens the URL) becomes a clean failure instead of an eternal hang.
+async fn consent_within<T, E>(
+    fut: impl std::future::Future<Output = Result<T, E>>,
+    timeout: Duration,
+) -> anyhow::Result<T>
+where
+    E: std::error::Error + Send + Sync + 'static,
+{
+    match tokio::time::timeout(timeout, fut).await {
+        Ok(Ok(value)) => Ok(value),
+        Ok(Err(e)) => Err(anyhow::Error::new(e).context("acquiring an OAuth token")),
+        Err(_) => anyhow::bail!(
+            "OAuth consent was not completed within {}s \
+             (set GMAIL_STATS_AUTH_TIMEOUT to adjust)",
+            timeout.as_secs()
+        ),
+    }
+}
+
+/// error_kind for a failed consent: Advanced Protection rejections keep their
+/// dedicated kind so the UI can steer to Takeout; everything else (timeout,
+/// declined consent, broken client secret) is auth_required.
+fn consent_error_kind(message: &str) -> &'static str {
+    if message.contains("policy_enforced") {
+        "policy_enforced"
+    } else {
+        "auth_required"
+    }
+}
+
 struct ScanCtx<'a> {
     pool: &'a Pool<Sqlite>,
     hub: &'a GmailHub,
@@ -947,9 +1135,13 @@ struct ScanCtx<'a> {
 /// token to resume from, advanced only once a page has been fully processed:
 /// a retry re-lists the page that failed instead of restarting the whole
 /// mailbox scan from page one. It is also persisted to the run row after
-/// every page, so a future scan could pick it up best-effort.
+/// every page, so `scan --resume <run_id>` can pick it up best-effort.
 struct ScanProgress {
     resume_token: Option<String>,
+    /// True while resume_token came from a previous run's row and has not yet
+    /// produced a successful list: Gmail rejecting it (expired/invalid) means
+    /// a silent from-scratch restart, not a failure.
+    resume_unverified: bool,
     pages_done: u64,
     messages_listed: u64,
 }
@@ -961,8 +1153,31 @@ async fn work(ctx: &ScanCtx<'_>, progress: &mut ScanProgress) -> anyhow::Result<
         if ctx.cancel.load(Ordering::Relaxed) {
             return Ok(());
         }
-        let result =
-            list_messages(ctx.hub, progress.resume_token.as_deref(), ctx.rate_limiter).await?;
+        let result = match list_messages(
+            ctx.hub,
+            progress.resume_token.as_deref(),
+            ctx.rate_limiter,
+        )
+        .await
+        {
+            Ok(result) => result,
+            Err(e) if progress.resume_unverified => {
+                // The persisted token from a previous run was rejected
+                // (typically expired). Fall back to page one silently —
+                // seen-mail dedupe makes the re-listing idempotent.
+                progress.resume_unverified = false;
+                progress.resume_token = None;
+                if verbose() {
+                    println!(
+                        "persisted resume token was rejected ({e:#}); \
+                             restarting the scan from the beginning"
+                    );
+                }
+                continue;
+            }
+            Err(e) => return Err(e),
+        };
+        progress.resume_unverified = false;
 
         let next_page_token = result.next_page_token;
         let messages = result.messages.unwrap_or_default();
@@ -1497,7 +1712,7 @@ mod tests {
     #[test]
     fn bare_invocation_is_the_scan_with_default_paths() {
         let cfg = run_cfg(&[], no_env);
-        assert_eq!(cfg.mode, Mode::Scan);
+        assert_eq!(cfg.mode, Mode::Scan { resume: None });
         assert_eq!(cfg.db, PathBuf::from("stats.db"));
         assert_eq!(cfg.credentials, PathBuf::from("credentials.json"));
         assert_eq!(cfg.tokens, PathBuf::from("tokencache.json"));
@@ -1506,7 +1721,19 @@ mod tests {
 
     #[test]
     fn explicit_scan_subcommand_is_equivalent() {
-        assert_eq!(run_cfg(&["scan"], no_env).mode, Mode::Scan);
+        assert_eq!(run_cfg(&["scan"], no_env).mode, Mode::Scan { resume: None });
+    }
+
+    #[test]
+    fn scan_accepts_a_resume_run_id() {
+        assert_eq!(
+            run_cfg(&["scan", "--resume", "5"], no_env).mode,
+            Mode::Scan { resume: Some(5) }
+        );
+        assert_eq!(
+            run_cfg(&["--resume", "5"], no_env).mode,
+            Mode::Scan { resume: Some(5) }
+        );
     }
 
     #[test]
@@ -1554,7 +1781,6 @@ mod tests {
         for args in [
             &["--quiet", "--verbose"][..],
             &["import"][..],
-            &["--resume", "3"][..],
             &["--resume", "x", "import", "f.mbox"][..],
             &["frobnicate"][..],
             &["--frobnicate"][..],
@@ -1789,6 +2015,135 @@ mod tests {
         assert_eq!(state, "cancelled");
     }
 
+    // --- scan resume + OAuth consent surfacing ---
+
+    #[tokio::test]
+    async fn resolve_scan_resume_returns_the_persisted_token() {
+        let dir = tempfile::tempdir().unwrap();
+        let options = db_connect_options(&dir.path().join("stats.db"));
+        let mut conn = migrated_conn(&options).await;
+        let run_id = ingest::create_run(&mut conn, "gmail_api", None)
+            .await
+            .unwrap();
+        sqlx::query("UPDATE ingest_runs SET resume_token = 'tok-123' WHERE run_id = ?")
+            .bind(run_id)
+            .execute(&mut conn)
+            .await
+            .unwrap();
+
+        let token = resolve_scan_resume(&mut conn, run_id).await.unwrap();
+        assert_eq!(token.as_deref(), Some("tok-123"));
+    }
+
+    #[tokio::test]
+    async fn resolve_scan_resume_without_a_token_scans_from_scratch() {
+        let dir = tempfile::tempdir().unwrap();
+        let options = db_connect_options(&dir.path().join("stats.db"));
+        let mut conn = migrated_conn(&options).await;
+        let run_id = ingest::create_run(&mut conn, "gmail_api", None)
+            .await
+            .unwrap();
+        assert_eq!(resolve_scan_resume(&mut conn, run_id).await.unwrap(), None);
+    }
+
+    #[tokio::test]
+    async fn resolve_scan_resume_rejects_missing_and_wrong_source_runs() {
+        let dir = tempfile::tempdir().unwrap();
+        let options = db_connect_options(&dir.path().join("stats.db"));
+        let mut conn = migrated_conn(&options).await;
+
+        let err = resolve_scan_resume(&mut conn, 999).await.unwrap_err();
+        assert!(err.to_string().contains("no ingest run"));
+
+        let run_id = ingest::create_run(&mut conn, "mbox", None).await.unwrap();
+        let err = resolve_scan_resume(&mut conn, run_id).await.unwrap_err();
+        assert!(err.to_string().contains("not a Gmail API scan"));
+    }
+
+    /// The consent delegate writes state='awaiting_auth' + auth_url onto the
+    /// run row via the writer channel, and the post-consent AuthState message
+    /// returns it to 'running'. No real OAuth is involved: the delegate is
+    /// called directly, exactly as yup-oauth2 would.
+    #[tokio::test]
+    async fn auth_delegate_surfaces_the_consent_url_on_the_run_row() {
+        use google_gmail1::yup_oauth2::authenticator_delegate::InstalledFlowDelegate;
+
+        let dir = tempfile::tempdir().unwrap();
+        let options = db_connect_options(&dir.path().join("stats.db"));
+        let mut conn = migrated_conn(&options).await;
+        let run_id = ingest::create_run(&mut conn, "gmail_api", None)
+            .await
+            .unwrap();
+
+        let (tx, rx) = mpsc::channel::<WriteMsg>(8);
+        let writer = task::spawn(ingest::db_writer(conn, rx, run_id));
+
+        let delegate = RunRowAuthDelegate {
+            write_tx: tx.downgrade(),
+        };
+        let url = "https://accounts.google.com/o/oauth2/auth?client_id=x&redirect_uri=y";
+        let code = delegate.present_user_url(url, false).await.unwrap();
+        assert_eq!(code, "", "HTTPRedirect mode returns no code");
+
+        // Let the writer drain the awaiting_auth message, then check the row.
+        tx.send(WriteMsg::Progress {
+            messages_seen: 0,
+            bytes_done: None,
+            resume_token: None,
+            total_estimate: None,
+        })
+        .await
+        .unwrap();
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        let mut check = SqliteConnection::connect_with(&options).await.unwrap();
+        let row = sqlx::query("SELECT state, auth_url FROM ingest_runs WHERE run_id = ?")
+            .bind(run_id)
+            .fetch_one(&mut check)
+            .await
+            .unwrap();
+        assert_eq!(row.try_get::<String, _>("state").unwrap(), "awaiting_auth");
+        assert_eq!(row.try_get::<String, _>("auth_url").unwrap(), url);
+
+        // Tokens arrived: the scanner sends the running transition.
+        tx.send(WriteMsg::AuthState {
+            state: "running",
+            auth_url: None,
+        })
+        .await
+        .unwrap();
+        // The delegate holds a Sender clone; both must drop for the writer
+        // to drain and exit.
+        drop(delegate);
+        drop(tx);
+        writer.await.unwrap().unwrap();
+        let row = sqlx::query("SELECT state, auth_url FROM ingest_runs WHERE run_id = ?")
+            .bind(run_id)
+            .fetch_one(&mut check)
+            .await
+            .unwrap();
+        assert_eq!(row.try_get::<String, _>("state").unwrap(), "running");
+        assert_eq!(row.try_get::<Option<String>, _>("auth_url").unwrap(), None);
+    }
+
+    /// An unattended consent (token future never resolves) must convert into
+    /// an error after the timeout, and its kind must map to auth_required.
+    #[tokio::test]
+    async fn consent_timeout_becomes_auth_required() {
+        let err = consent_within(
+            std::future::pending::<Result<(), std::io::Error>>(),
+            Duration::from_millis(50),
+        )
+        .await
+        .unwrap_err();
+        let msg = format!("{err:#}");
+        assert!(msg.contains("consent was not completed"), "got: {msg}");
+        assert_eq!(consent_error_kind(&msg), "auth_required");
+        assert_eq!(
+            consent_error_kind("Error 400: policy_enforced"),
+            "policy_enforced"
+        );
+    }
+
     #[tokio::test]
     async fn import_refuses_a_non_mbox_file() {
         let dir = tempfile::tempdir().unwrap();
diff --git a/src/webapp.rs b/src/webapp.rs
new file mode 100644
index 0000000..a4cbe9f
--- /dev/null
+++ b/src/webapp.rs
@@ -0,0 +1,1738 @@
+//! Local web viewer for gmail-stats (issue #11 Phase 1, issue #28 Phase B,
+//! issue #30 Phase C).
+//!
+//! Serves the embedded UI plus JSON endpoints over `./stats.db`, bound to
+//! 127.0.0.1 only. Phase B added observe-only ingestion state: `GET
+//! /api/status` (db readiness, active/last run, flock probe, viewer-side
+//! rate/ETA, CSRF token) and `GET /api/runs` (run history). Phase C adds the
+//! state-changing surface: `POST /api/runs` (spawn the ingester as a
+//! supervised child), `POST /api/runs/{id}/cancel` (SIGTERM the owned child,
+//! SIGKILL escalation), and `GET /api/runs/{id}/log` (in-memory stderr ring
+//! buffer of owned children).
+//!
+//! The viewer still performs no database writes of any kind: every durable
+//! state change happens inside the spawned `gmail_stats` ingester process.
+//! The only files the viewer touches are the ingest lockfile (probed without
+//! truncation via open + try-lock + release) — its new powers are exactly
+//! spawn, signal-own-child, and hold a stderr ring buffer in memory.
+//!
+//! Every mutating route sits behind the full CSRF stack from issue #26:
+//! strict `Content-Type: application/json` (415 otherwise), the per-process
+//! `X-Gmail-Stats-Csrf` token served by `/api/status`, and Origin /
+//! Sec-Fetch-Site validation when those headers are present. No CORS headers
+//! are ever emitted.
+//!
+//! This module is the whole application; `src/bin/web.rs` is a thin `main`.
+
+use std::collections::{HashMap, VecDeque};
+use std::path::{Path, PathBuf};
+use std::process::Stdio;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+
+use axum::{
+    extract::{Path as UrlPath, Query, Request, State},
+    http::{header, HeaderMap, HeaderValue, StatusCode},
+    middleware::{self, Next},
+    response::{Html, IntoResponse, Response},
+    routing::{get, post},
+    Json, Router,
+};
+use serde_json::json;
+use sqlx::sqlite::{SqliteConnectOptions, SqlitePoolOptions, SqliteRow};
+use sqlx::{Row, SqlitePool};
+use tokio::io::AsyncBufReadExt;
+use tokio::sync::mpsc;
+
+use crate::ingest;
+
+// CSS/JS are separate same-origin assets, not inline blocks: under the
+// `default-src 'self'` CSP below, `'self'` only allowlists same-origin URLs —
+// inline <style>/<script> would be refused by the browser.
+const INDEX_HTML: &str = include_str!("../web/index.html");
+const APP_CSS: &str = include_str!("../web/app.css");
+const APP_JS: &str = include_str!("../web/app.js");
+const DEFAULT_PORT: u16 = 7878;
+
+/// How far back the in-memory rate window looks. Old observations age out so
+/// the displayed rate tracks the recent pace, not the whole run's average.
+const RATE_WINDOW: Duration = Duration::from_secs(30);
+/// Minimum span between oldest and newest observation before a rate is
+/// reported at all; two samples a few ms apart would just be noise.
+const RATE_MIN_SPAN: Duration = Duration::from_millis(500);
+
+/// The custom header carrying the per-process CSRF token. Custom headers
+/// force a CORS preflight from cross-origin JS, which fails because this
+/// server never emits CORS headers; the random value holds even under
+/// degraded fetch-metadata support.
+const CSRF_HEADER: &str = "x-gmail-stats-csrf";
+/// Cap on the in-memory stderr ring buffer of a spawned child.
+const LOG_RING_LINES: usize = 200;
+/// Cap on a single retained stderr line (bytes), so a pathological child
+/// cannot balloon viewer memory through 200 giant lines.
+const LOG_LINE_MAX: usize = 4096;
+/// How long POST /api/runs waits for the spawned child to write its run row
+/// before giving up with spawn_failed.
+const ROW_WAIT: Duration = Duration::from_secs(10);
+/// Grace period between SIGTERM and SIGKILL on cancel.
+const TERM_GRACE: Duration = Duration::from_secs(10);
+
+/// Shared state for the router. Everything is read-only against the database;
+/// the rate window, CSRF token, child handles, and stderr ring buffers live
+/// purely in viewer memory and are never persisted.
+pub struct AppState {
+    pool: SqlitePool,
+    db_path: PathBuf,
+    /// Per-process CSRF token (32 bytes of CSPRNG output, hex-encoded),
+    /// minted at startup and obtainable only via the same-origin
+    /// `GET /api/status`. Required in the CSRF_HEADER of every mutating
+    /// request.
+    csrf_token: String,
+    rate: Mutex<RateWindow>,
+    /// Where the ingester binary lives: GMAIL_STATS_INGEST_BIN, or a sibling
+    /// of current_exe() named `gmail_stats`.
+    ingester_bin: PathBuf,
+    /// SIGTERM → SIGKILL escalation window (only tests shrink it).
+    term_grace: Duration,
+    /// Runs this viewer process spawned, by run_id. Entries persist after the
+    /// child exits so the log stays readable; they are memory-only and gone on
+    /// viewer restart (the child itself survives — kill_on_drop is false).
+    children: Mutex<HashMap<i64, Arc<OwnedRun>>>,
+    /// Serializes spawn attempts from this viewer so two racing POSTs don't
+    /// both pass the friendly pre-check. The child's own flock acquisition
+    /// remains the authoritative cross-process gate.
+    spawn_lock: tokio::sync::Mutex<()>,
+}
+
+/// The in-memory handle to a child this viewer spawned. The pid is captured
+/// from our own child handle at spawn time — never read back from the
+/// database (PID reuse) — and signals only ever travel through the supervisor
+/// task that owns the `tokio::process::Child`.
+struct OwnedRun {
+    pid: u32,
+    ring: Arc<Mutex<VecDeque<String>>>,
+    cancel_tx: mpsc::Sender<()>,
+    exited: Arc<AtomicBool>,
+}
+
+/// Entry point used by the `web` binary: parse the port argument, bind to
+/// loopback, serve.
+pub async fn serve() -> anyhow::Result<()> {
+    let port: u16 = match std::env::args().nth(1) {
+        Some(arg) => arg
+            .parse()
+            .map_err(|_| anyhow::anyhow!("invalid port: {arg}"))?,
+        None => DEFAULT_PORT,
+    };
+    let db_path =
+        PathBuf::from(std::env::var("GMAIL_STATS_DB").unwrap_or_else(|_| "./stats.db".to_string()));
+
+    let app = build_router(Arc::new(AppState::new(&db_path)));
+
+    // Loopback only, structurally. The port is the only knob.
+    let listener = tokio::net::TcpListener::bind(("127.0.0.1", port)).await?;
+    // Report the bound address, not the requested port: with port 0 the OS
+    // picks an ephemeral port, and the printed URL must be the real one.
+    let local_addr = listener.local_addr()?;
+    println!("gmail-stats web viewer listening on http://{local_addr}/");
+    axum::serve(listener, app).await?;
+    Ok(())
+}
+
+/// Resolve the ingester binary: env override first, then a sibling of the
+/// current executable (both binaries come out of the same `cargo build`).
+fn default_ingester_bin() -> PathBuf {
+    if let Ok(path) = std::env::var("GMAIL_STATS_INGEST_BIN") {
+        return PathBuf::from(path);
+    }
+    std::env::current_exe()
+        .ok()
+        .and_then(|exe| exe.parent().map(|dir| dir.join("gmail_stats")))
+        .unwrap_or_else(|| PathBuf::from("gmail_stats"))
+}
+
+impl AppState {
+    pub fn new(db_path: &Path) -> Self {
+        Self::configured(db_path, default_ingester_bin(), TERM_GRACE)
+    }
+
+    /// Full-control constructor for tests: a custom ingester binary (fake
+    /// ingester) and a shortened SIGTERM→SIGKILL grace.
+    pub fn configured(db_path: &Path, ingester_bin: PathBuf, term_grace: Duration) -> Self {
+        // Read-only at the connection level, not by convention: the viewer
+        // must not be able to touch a mid-scan DB even via a bug.
+        let options = SqliteConnectOptions::new()
+            .filename(db_path)
+            .read_only(true)
+            .pragma("query_only", "ON")
+            .create_if_missing(false)
+            .busy_timeout(Duration::from_secs(5));
+
+        // Lazy connect so the server still starts (and can serve the friendly
+        // onboarding page) when stats.db doesn't exist yet.
+        let pool = SqlitePoolOptions::new()
+            .max_connections(2)
+            .connect_lazy_with(options);
+
+        let mut token_bytes = [0u8; 32];
+        getrandom::fill(&mut token_bytes).expect("operating system CSPRNG unavailable");
+        let csrf_token: String = token_bytes.iter().map(|b| format!("{b:02x}")).collect();
+
+        AppState {
+            pool,
+            db_path: db_path.to_path_buf(),
+            csrf_token,
+            rate: Mutex::new(RateWindow::default()),
+            ingester_bin,
+            term_grace,
+            children: Mutex::new(HashMap::new()),
+            spawn_lock: tokio::sync::Mutex::new(()),
+        }
+    }
+}
+
+pub fn build_router(state: Arc<AppState>) -> Router {
+    Router::new()
+        .route("/", get(index))
+        .route("/app.css", get(app_css))
+        .route("/app.js", get(app_js))
+        .route("/api/summary", get(summary))
+        .route("/api/status", get(status))
+        .route("/api/runs", get(runs).post(start_run))
+        .route("/api/runs/{id}/cancel", post(cancel_run))
+        .route("/api/runs/{id}/log", get(run_log))
+        .fallback(not_found)
+        .layer(middleware::from_fn(host_guard_and_security_headers))
+        .with_state(state)
+}
+
+/// DNS-rebinding guard plus defense-in-depth headers on every response.
+async fn host_guard_and_security_headers(req: Request, next: Next) -> Response {
+    let host_allowed = req
+        .headers()
+        .get(header::HOST)
+        .and_then(|value| value.to_str().ok())
+        .map(|host| {
+            let name = host.rsplit_once(':').map_or(host, |(name, _port)| name);
+            name == "127.0.0.1" || name == "localhost"
+        })
+        .unwrap_or(false);
+    if !host_allowed {
+        return (StatusCode::FORBIDDEN, "forbidden").into_response();
+    }
+
+    let mut response = next.run(req).await;
+    let headers = response.headers_mut();
+    headers.insert(
+        header::CONTENT_SECURITY_POLICY,
+        HeaderValue::from_static("default-src 'self'"),
+    );
+    headers.insert(
+        header::X_CONTENT_TYPE_OPTIONS,
+        HeaderValue::from_static("nosniff"),
+    );
+    headers.insert(
+        header::REFERRER_POLICY,
+        HeaderValue::from_static("no-referrer"),
+    );
+    response
+}
+
+async fn index() -> Html<&'static str> {
+    Html(INDEX_HTML)
+}
+
+async fn app_css() -> ([(header::HeaderName, &'static str); 1], &'static str) {
+    ([(header::CONTENT_TYPE, "text/css; charset=utf-8")], APP_CSS)
+}
+
+async fn app_js() -> ([(header::HeaderName, &'static str); 1], &'static str) {
+    (
+        [(header::CONTENT_TYPE, "text/javascript; charset=utf-8")],
+        APP_JS,
+    )
+}
+
+async fn not_found() -> StatusCode {
+    StatusCode::NOT_FOUND
+}
+
+async fn summary(State(state): State<Arc<AppState>>) -> Response {
+    match build_summary(&state.pool).await {
+        Ok(body) => Json(body).into_response(),
+        Err(err) => error_response(&err),
+    }
+}
+
+async fn build_summary(pool: &SqlitePool) -> Result<serde_json::Value, sqlx::Error> {
+    // seen_mails has no PK/unique constraint, so count distinct (matches the
+    // README's own query).
+    let total_messages: i64 = sqlx::query_scalar("SELECT COUNT(DISTINCT mail_id) FROM seen_mails")
+        .fetch_one(pool)
+        .await?;
+
+    // The app assumes one row per sender but nothing enforces it, so merge
+    // here. COALESCE folds NULL senders into '' *before* grouping so they
+    // merge with literal-'' rows instead of forming a separate group. Both
+    // columns need CAST against the schema's loose types: `sender string`
+    // matches none of SQLite's affinity keywords, so the column has NUMERIC
+    // affinity and a numeric-looking From header (e.g. an SMS shortcode like
+    // `40404`) is stored as INTEGER/REAL, which sqlx's String decoder
+    // rejects. CAST ... AS TEXT normalizes the storage class (and merges an
+    // INTEGER 12345 row with a TEXT '12345' row) so decoding — and thus the
+    // whole viewer — survives such rows; the mails_sent CAST likewise guards
+    // against stray TEXT values.
+    let rows: Vec<(String, i64)> = sqlx::query_as(
+        "SELECT CAST(COALESCE(sender, '') AS TEXT) AS sender, \
+                COALESCE(SUM(CAST(mails_sent AS INTEGER)), 0) AS mails_sent \
+         FROM senders GROUP BY CAST(COALESCE(sender, '') AS TEXT) \
+         ORDER BY mails_sent DESC",
+    )
+    .fetch_all(pool)
+    .await?;
+
+    let senders: Vec<serde_json::Value> = rows
+        .into_iter()
+        .map(|(sender, mails_sent)| json!({ "sender": sender, "mails_sent": mails_sent }))
+        .collect();
+
+    Ok(json!({
+        "total_messages": total_messages,
+        "senders": senders,
+        "generated_at_unix": now_unix(),
+    }))
+}
+
+// ---------------------------------------------------------------------------
+// GET /api/status — the single cheap poll target for "watch from the browser"
+// ---------------------------------------------------------------------------
+
+/// How a database-level error should be interpreted.
+enum DbErrorKind {
+    /// The file (or a table the query needs) doesn't exist.
+    MissingFile,
+    MissingTable,
+    Busy,
+    Other,
+}
+
+fn classify_db_error(err: &sqlx::Error) -> DbErrorKind {
+    let lower = err.to_string().to_lowercase();
+    if lower.contains("unable to open database file") {
+        DbErrorKind::MissingFile
+    } else if lower.contains("no such table") {
+        DbErrorKind::MissingTable
+    } else if lower.contains("database is locked") || lower.contains("database is busy") {
+        DbErrorKind::Busy
+    } else {
+        DbErrorKind::Other
+    }
+}
+
+async fn status(State(state): State<Arc<AppState>>) -> Response {
+    match build_status(&state).await {
+        Ok(body) => Json(body).into_response(),
+        Err(err) => error_response(&err),
+    }
+}
+
+/// Assemble the status document. Missing database, missing tables, and empty
+/// tables are all *data* here (they drive onboarding), never errors; only
+/// busy/unexpected failures propagate to the caller as HTTP errors.
+async fn build_status(state: &AppState) -> Result<serde_json::Value, sqlx::Error> {
+    let lock_held = probe_ingest_lock(&state.db_path);
+
+    // Database readiness. `unable to open` ⇒ the file is missing (the pool is
+    // read-only and never creates it); `no such table` ⇒ the file exists but
+    // was never initialized — both are onboarding states, not errors.
+    let db: &str =
+        match sqlx::query_scalar::<_, i64>("SELECT COUNT(DISTINCT mail_id) FROM seen_mails")
+            .fetch_one(&state.pool)
+            .await
+        {
+            Ok(0) => "empty",
+            Ok(_) => "ready",
+            Err(err) => match classify_db_error(&err) {
+                DbErrorKind::MissingFile => {
+                    return Ok(status_document(
+                        state, "missing", None, None, false, lock_held,
+                    ));
+                }
+                DbErrorKind::MissingTable => "empty",
+                DbErrorKind::Busy | DbErrorKind::Other => return Err(err),
+            },
+        };
+
+    // Run rows. An old database without ingest_runs simply has no runs; the
+    // ingester creates the table on its next start.
+    let (active_run, last_run, mixed_sources) = match fetch_runs_view(&state.pool).await {
+        Ok(view) => view,
+        Err(err) => match classify_db_error(&err) {
+            DbErrorKind::MissingFile | DbErrorKind::MissingTable => (None, None, false),
+            DbErrorKind::Busy | DbErrorKind::Other => return Err(err),
+        },
+    };
+
+    Ok(status_document(
+        state,
+        db,
+        active_run,
+        last_run,
+        mixed_sources,
+        lock_held,
+    ))
+}
+
+async fn fetch_runs_view(
+    pool: &SqlitePool,
+) -> Result<(Option<SqliteRow>, Option<SqliteRow>, bool), sqlx::Error> {
+    let active = sqlx::query(
+        "SELECT * FROM ingest_runs \
+         WHERE state NOT IN ('done', 'failed', 'cancelled', 'abandoned') \
+         ORDER BY run_id DESC LIMIT 1",
+    )
+    .fetch_optional(pool)
+    .await?;
+    let last = sqlx::query(
+        "SELECT * FROM ingest_runs \
+         WHERE state IN ('done', 'failed', 'cancelled', 'abandoned') \
+         ORDER BY run_id DESC LIMIT 1",
+    )
+    .fetch_optional(pool)
+    .await?;
+    // Interim mixed-sources caution (removed by Phase D's exact dedupe): true
+    // once more than one source has actually contributed rows — completed, or
+    // got far enough to add new messages before stopping.
+    let mixed: i64 = sqlx::query_scalar(
+        "SELECT COUNT(DISTINCT source) FROM ingest_runs \
+         WHERE state = 'done' OR messages_new > 0",
+    )
+    .fetch_one(pool)
+    .await?;
+    Ok((active, last, mixed >= 2))
+}
+
+fn status_document(
+    state: &AppState,
+    db: &str,
+    active_run: Option<SqliteRow>,
+    last_run: Option<SqliteRow>,
+    mixed_sources: bool,
+    lock_held: Option<bool>,
+) -> serde_json::Value {
+    // Viewer-derived rate/ETA from successive observations of the active
+    // run's counters. Pure viewer memory: nothing here is written anywhere.
+    let mut rate_per_sec = None;
+    let mut eta_seconds = None;
+    {
+        let mut window = state.rate.lock().unwrap_or_else(|e| e.into_inner());
+        match &active_run {
+            Some(row) => {
+                let run_id: i64 = row.try_get("run_id").unwrap_or(0);
+                let messages_seen: i64 = row.try_get("messages_seen").unwrap_or(0);
+                let bytes_done: Option<i64> = row.try_get("bytes_done").unwrap_or(None);
+                let (msg_rate, byte_rate) =
+                    window.observe(Instant::now(), run_id, messages_seen, bytes_done);
+                rate_per_sec = msg_rate.map(|r| (r * 10.0).round() / 10.0);
+                let bytes_total: Option<i64> = row.try_get("bytes_total").unwrap_or(None);
+                let total_estimate: Option<i64> = row.try_get("total_estimate").unwrap_or(None);
+                eta_seconds = compute_eta(
+                    messages_seen,
+                    bytes_done,
+                    bytes_total,
+                    total_estimate,
+                    msg_rate,
+                    byte_rate,
+                );
+            }
+            None => window.reset(),
+        }
+    }
+
+    // A run is "owned" when this viewer process spawned it and still holds
+    // the in-memory child handle: only then are Cancel and Log available.
+    let owns_active_run = active_run
+        .as_ref()
+        .and_then(|row| row.try_get::<i64, _>("run_id").ok())
+        .map(|run_id| {
+            state
+                .children
+                .lock()
+                .unwrap_or_else(|e| e.into_inner())
+                .contains_key(&run_id)
+        })
+        .unwrap_or(false);
+
+    json!({
+        "db": db,
+        "now_unix": now_unix(),
+        "ingest_lock_held": lock_held,
+        "active_run": active_run.as_ref().map(run_to_json),
+        "last_run": last_run.as_ref().map(run_to_json),
+        "owns_active_run": owns_active_run,
+        "mixed_sources": mixed_sources,
+        "rate_per_sec": rate_per_sec,
+        "eta_seconds": eta_seconds,
+        "csrf_token": state.csrf_token,
+    })
+}
+
+/// Serialize one ingest_runs row for the API. resume_token and
+/// mbox_fingerprint are internal resume bookkeeping and stay out of the
+/// payload; everything else is display data (rendered via textContent only on
+/// the client — error text, paths, and auth_url are not trusted; the client
+/// refuses to hyperlink auth_url unless it parses as
+/// https://accounts.google.com/...).
+fn run_to_json(row: &SqliteRow) -> serde_json::Value {
+    fn i(row: &SqliteRow, col: &str) -> Option<i64> {
+        row.try_get::<Option<i64>, _>(col).unwrap_or(None)
+    }
+    fn s(row: &SqliteRow, col: &str) -> Option<String> {
+        row.try_get::<Option<String>, _>(col).unwrap_or(None)
+    }
+    json!({
+        "run_id": i(row, "run_id"),
+        "source": s(row, "source"),
+        "state": s(row, "state"),
+        "pid": i(row, "pid"),
+        "started_at_unix": i(row, "started_at_unix"),
+        "updated_at_unix": i(row, "updated_at_unix"),
+        "finished_at_unix": i(row, "finished_at_unix"),
+        "messages_seen": i(row, "messages_seen").unwrap_or(0),
+        "messages_new": i(row, "messages_new").unwrap_or(0),
+        "total_estimate": i(row, "total_estimate"),
+        "bytes_total": i(row, "bytes_total"),
+        "bytes_done": i(row, "bytes_done"),
+        "mbox_path": s(row, "mbox_path"),
+        "error_kind": s(row, "error_kind"),
+        "error": s(row, "error"),
+        "auth_url": s(row, "auth_url"),
+    })
+}
+
+/// Probe the ingest lock without disturbing it: open the lockfile exactly the
+/// way the ingester does (create-if-missing, never truncate — see
+/// `ingest::acquire_ingest_lock`), try a non-blocking exclusive flock, and
+/// release immediately. Held ⇒ an ingester is alive right now, whoever
+/// started it. Returns None if the probe itself failed (e.g. permissions),
+/// which the client treats as "unknown".
+fn probe_ingest_lock(db_path: &Path) -> Option<bool> {
+    let lock_path = ingest::ingest_lock_path(db_path);
+    let file = std::fs::OpenOptions::new()
+        .create(true)
+        .truncate(false)
+        .write(true)
+        .open(&lock_path)
+        .ok()?;
+    match rustix::fs::flock(&file, rustix::fs::FlockOperation::NonBlockingLockExclusive) {
+        Ok(()) => {
+            // Explicit unlock before the fd drops, so the probe's hold time
+            // is as close to zero as possible.
+            let _ = rustix::fs::flock(&file, rustix::fs::FlockOperation::Unlock);
+            Some(false)
+        }
+        Err(rustix::io::Errno::WOULDBLOCK) => Some(true),
+        Err(_) => None,
+    }
+}
+
+/// Sliding window of (time, counters) observations for the active run, kept
+/// only in viewer memory. Rates come from the span between the oldest and
+/// newest sample still inside RATE_WINDOW.
+#[derive(Default)]
+struct RateWindow {
+    run_id: Option<i64>,
+    samples: VecDeque<(Instant, i64, Option<i64>)>,
+}
+
+impl RateWindow {
+    fn reset(&mut self) {
+        self.run_id = None;
+        self.samples.clear();
+    }
+
+    /// Record an observation and return (messages/sec, bytes/sec) over the
+    /// current window, if enough history exists to be meaningful.
+    fn observe(
+        &mut self,
+        now: Instant,
+        run_id: i64,
+        messages_seen: i64,
+        bytes_done: Option<i64>,
+    ) -> (Option<f64>, Option<f64>) {
+        if self.run_id != Some(run_id) {
+            self.reset();
+            self.run_id = Some(run_id);
+        }
+        self.samples.push_back((now, messages_seen, bytes_done));
+        while let Some(&(t, _, _)) = self.samples.front() {
+            if now.duration_since(t) > RATE_WINDOW && self.samples.len() > 2 {
+                self.samples.pop_front();
+            } else {
+                break;
+            }
+        }
+
+        let (first_t, first_msgs, first_bytes) = *self.samples.front().unwrap();
+        let span = now.duration_since(first_t);
+        if span < RATE_MIN_SPAN {
+            return (None, None);
+        }
+        let secs = span.as_secs_f64();
+        let msg_rate = ((messages_seen - first_msgs).max(0) as f64) / secs;
+        let byte_rate = match (bytes_done, first_bytes) {
+            (Some(b), Some(fb)) => Some(((b - fb).max(0) as f64) / secs),
+            _ => None,
+        };
+        (Some(msg_rate), byte_rate)
+    }
+}
+
+/// Estimated seconds to completion. Prefers byte progress (exact for imports)
+/// and falls back to the message-count estimate (scans). None when there is
+/// no total or no forward progress in the window.
+fn compute_eta(
+    messages_seen: i64,
+    bytes_done: Option<i64>,
+    bytes_total: Option<i64>,
+    total_estimate: Option<i64>,
+    msg_rate: Option<f64>,
+    byte_rate: Option<f64>,
+) -> Option<i64> {
+    if let (Some(done), Some(total), Some(rate)) = (bytes_done, bytes_total, byte_rate) {
+        if rate > 0.0 {
+            return Some((((total - done).max(0)) as f64 / rate).ceil() as i64);
+        }
+    }
+    if let (Some(total), Some(rate)) = (total_estimate, msg_rate) {
+        if rate > 0.0 {
+            return Some((((total - messages_seen).max(0)) as f64 / rate).ceil() as i64);
+        }
+    }
+    None
+}
+
+// ---------------------------------------------------------------------------
+// GET /api/runs — run history
+// ---------------------------------------------------------------------------
+
+async fn runs(
+    State(state): State<Arc<AppState>>,
+    Query(params): Query<std::collections::HashMap<String, String>>,
+) -> Response {
+    let limit: i64 = params
+        .get("limit")
+        .and_then(|v| v.parse::<i64>().ok())
+        .unwrap_or(20)
+        .clamp(1, 100);
+    match build_runs(&state.pool, limit).await {
+        Ok(body) => Json(body).into_response(),
+        Err(err) => error_response(&err),
+    }
+}
+
+async fn build_runs(pool: &SqlitePool, limit: i64) -> Result<serde_json::Value, sqlx::Error> {
+    let rows = match sqlx::query("SELECT * FROM ingest_runs ORDER BY run_id DESC LIMIT ?")
+        .bind(limit)
+        .fetch_all(pool)
+        .await
+    {
+        Ok(rows) => rows,
+        // A database that predates ingest_runs (or doesn't exist yet) simply
+        // has no run history; this endpoint powers a strip, not a diagnosis.
+        Err(err) => match classify_db_error(&err) {
+            DbErrorKind::MissingFile | DbErrorKind::MissingTable => Vec::new(),
+            DbErrorKind::Busy | DbErrorKind::Other => return Err(err),
+        },
+    };
+    let runs: Vec<serde_json::Value> = rows.iter().map(run_to_json).collect();
+    Ok(json!({ "runs": runs, "now_unix": now_unix() }))
+}
+
+// ---------------------------------------------------------------------------
+// Phase C: mutating routes (POST /api/runs, POST /api/runs/{id}/cancel) and
+// the owned-child log (GET /api/runs/{id}/log)
+// ---------------------------------------------------------------------------
+
+fn json_error(status: StatusCode, kind: &str, message: &str) -> Response {
+    (status, Json(json!({ "error": kind, "message": message }))).into_response()
+}
+
+/// Constant-time byte comparison for the CSRF token, so the check leaks no
+/// prefix-length timing signal.
+fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    a.iter().zip(b).fold(0u8, |acc, (x, y)| acc | (x ^ y)) == 0
+}
+
+/// Is this Origin header value an allowed same-machine origin? Only
+/// `http://127.0.0.1[:port]` and `http://localhost[:port]` qualify — the port
+/// is not pinned (mirroring the Host guard: any loopback-origin page served
+/// to this browser is the same local user, and the token check is the
+/// unforgeable layer).
+fn origin_allowed(origin: &str) -> bool {
+    let Some(rest) = origin.strip_prefix("http://") else {
+        return false;
+    };
+    let (host, port) = match rest.split_once(':') {
+        Some((host, port)) => (host, Some(port)),
+        None => (rest, None),
+    };
+    if host != "127.0.0.1" && host != "localhost" {
+        return false;
+    }
+    match port {
+        None => true,
+        Some(port) => !port.is_empty() && port.bytes().all(|b| b.is_ascii_digit()),
+    }
+}
+
+/// The three-layer CSRF gate from issue #26, applied to every mutating route
+/// (all three layers required):
+///
+/// 1. Strict `Content-Type: application/json`, else 415. HTML forms cannot
+///    produce it, and cross-origin JS that sets it triggers a CORS preflight
+///    that fails because this server never emits CORS headers.
+/// 2. `X-Gmail-Stats-Csrf` must equal the per-process CSPRNG token, which is
+///    obtainable only via the same-origin `GET /api/status`.
+/// 3. If `Origin` is present it must be a loopback http origin; if
+///    `Sec-Fetch-Site` is present it must be `same-origin` or `none`. Absent
+///    headers pass: curl is the same local user, who can already run the CLI.
+// The Err variant is a full HTTP Response by design (it is sent as-is);
+// boxing it would just add noise on a cold path.
+#[allow(clippy::result_large_err)]
+fn check_csrf(state: &AppState, headers: &HeaderMap) -> Result<(), Response> {
+    let content_type = headers
+        .get(header::CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or("");
+    let essence = content_type.split(';').next().unwrap_or("").trim();
+    if !essence.eq_ignore_ascii_case("application/json") {
+        return Err(json_error(
+            StatusCode::UNSUPPORTED_MEDIA_TYPE,
+            "content_type",
+            "Content-Type must be application/json",
+        ));
+    }
+
+    let presented = headers
+        .get(CSRF_HEADER)
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or("");
+    if !constant_time_eq(presented.as_bytes(), state.csrf_token.as_bytes()) {
+        return Err(json_error(
+            StatusCode::FORBIDDEN,
+            "csrf",
+            "missing or invalid X-Gmail-Stats-Csrf token (fetch it from GET /api/status)",
+        ));
+    }
+
+    if let Some(origin) = headers.get(header::ORIGIN) {
+        let allowed = origin.to_str().is_ok_and(origin_allowed);
+        if !allowed {
+            return Err(json_error(
+                StatusCode::FORBIDDEN,
+                "csrf",
+                "cross-origin requests are not allowed",
+            ));
+        }
+    }
+    if let Some(site) = headers.get("sec-fetch-site") {
+        let allowed = matches!(site.to_str(), Ok("same-origin") | Ok("none"));
+        if !allowed {
+            return Err(json_error(
+                StatusCode::FORBIDDEN,
+                "csrf",
+                "cross-site requests are not allowed",
+            ));
+        }
+    }
+    Ok(())
+}
+
+/// What POST /api/runs decided to launch. Argv is assembled from these fields
+/// as a fixed array — never a shell — and the only user-influenced element is
+/// a single already-validated path argument.
+enum SpawnPlan {
+    Scan { resume: Option<i64> },
+    Import { path: PathBuf, resume: Option<i64> },
+}
+
+/// Stat-level mbox validation (UX, not a security boundary): absolute,
+/// regular, readable, and starting with the mbox `From ` magic so a confused
+/// click can't slurp an arbitrary file into sender stats.
+fn validate_mbox_path(raw: &str) -> Result<PathBuf, String> {
+    use std::io::Read;
+    let path = PathBuf::from(raw);
+    if !path.is_absolute() {
+        return Err(
+            "path must be absolute (browsers do not reveal picked-file paths; \
+                    paste the full path)"
+                .to_string(),
+        );
+    }
+    let meta = match std::fs::metadata(&path) {
+        Ok(meta) => meta,
+        Err(e) => return Err(format!("cannot read {}: {e}", path.display())),
+    };
+    if !meta.is_file() {
+        return Err(format!("{} is not a regular file", path.display()));
+    }
+    let mut file = match std::fs::File::open(&path) {
+        Ok(file) => file,
+        Err(e) => return Err(format!("cannot open {}: {e}", path.display())),
+    };
+    let mut magic = [0u8; 5];
+    if file.read_exact(&mut magic).is_err() || &magic != b"From " {
+        return Err(format!(
+            "{} does not look like an mbox file (expected it to start with a `From ` separator)",
+            path.display()
+        ));
+    }
+    Ok(path)
+}
+
+async fn start_run(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+    body: axum::body::Bytes,
+) -> Response {
+    if let Err(response) = check_csrf(&state, &headers) {
+        return response;
+    }
+    let parsed: serde_json::Value = match serde_json::from_slice(&body) {
+        Ok(value) => value,
+        Err(_) => return json_error(StatusCode::BAD_REQUEST, "bad_request", "body must be JSON"),
+    };
+    let resume_run_id = parsed["resume_run_id"].as_i64();
+    let plan = match parsed["source"].as_str() {
+        Some("gmail_api") => {
+            if let Some(run_id) = resume_run_id {
+                // The scanner enforces this too; checking here turns a typo
+                // into a friendly 422 instead of a failed spawn.
+                match run_source(&state.pool, run_id).await {
+                    Some(source) if source == "gmail_api" => {}
+                    Some(source) => {
+                        return json_error(
+                            StatusCode::UNPROCESSABLE_ENTITY,
+                            "bad_resume",
+                            &format!("run {run_id} is a {source} run, not a Gmail API scan"),
+                        )
+                    }
+                    None => {
+                        return json_error(
+                            StatusCode::UNPROCESSABLE_ENTITY,
+                            "bad_resume",
+                            &format!("no ingest run {run_id} to resume"),
+                        )
+                    }
+                }
+            }
+            SpawnPlan::Scan {
+                resume: resume_run_id,
+            }
+        }
+        Some("mbox") => {
+            let raw_path = match (parsed["path"].as_str(), resume_run_id) {
+                (Some(path), _) => path.to_string(),
+                (None, Some(run_id)) => match run_mbox_path(&state.pool, run_id).await {
+                    Some(path) => path,
+                    None => {
+                        return json_error(
+                            StatusCode::UNPROCESSABLE_ENTITY,
+                            "bad_resume",
+                            &format!("run {run_id} is not a resumable mbox import"),
+                        )
+                    }
+                },
+                (None, None) => {
+                    return json_error(
+                        StatusCode::UNPROCESSABLE_ENTITY,
+                        "bad_path",
+                        "mbox imports need a \"path\" (or a \"resume_run_id\")",
+                    )
+                }
+            };
+            match validate_mbox_path(&raw_path) {
+                Ok(path) => SpawnPlan::Import {
+                    path,
+                    resume: resume_run_id,
+                },
+                Err(message) => {
+                    return json_error(StatusCode::UNPROCESSABLE_ENTITY, "bad_path", &message)
+                }
+            }
+        }
+        _ => {
+            return json_error(
+                StatusCode::UNPROCESSABLE_ENTITY,
+                "bad_source",
+                "source must be \"gmail_api\" or \"mbox\"",
+            )
+        }
+    };
+
+    // Serialize spawns from this viewer; then the friendly pre-check. The
+    // child's own flock acquisition is the authoritative gate, so the
+    // remaining TOCTOU window is harmless (it surfaces as run_active below).
+    let _guard = state.spawn_lock.lock().await;
+    if probe_ingest_lock(&state.db_path) == Some(true) {
+        return json_error(
+            StatusCode::CONFLICT,
+            "run_active",
+            "an ingester is already running against this database",
+        );
+    }
+    if !state.ingester_bin.is_file() {
+        return json_error(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "spawn_failed",
+            &format!(
+                "ingester binary not found at {} — build it with `cargo build`, \
+                 or point GMAIL_STATS_INGEST_BIN at it",
+                state.ingester_bin.display()
+            ),
+        );
+    }
+
+    match spawn_and_register(&state, &plan).await {
+        Ok(run_id) => (StatusCode::ACCEPTED, Json(json!({ "run_id": run_id }))).into_response(),
+        Err(response) => response,
+    }
+}
+
+async fn run_source(pool: &SqlitePool, run_id: i64) -> Option<String> {
+    sqlx::query_scalar::<_, String>("SELECT source FROM ingest_runs WHERE run_id = ?")
+        .bind(run_id)
+        .fetch_optional(pool)
+        .await
+        .ok()
+        .flatten()
+}
+
+async fn run_mbox_path(pool: &SqlitePool, run_id: i64) -> Option<String> {
+    sqlx::query_scalar::<_, Option<String>>(
+        "SELECT mbox_path FROM ingest_runs WHERE run_id = ? AND source = 'mbox'",
+    )
+    .bind(run_id)
+    .fetch_optional(pool)
+    .await
+    .ok()
+    .flatten()
+    .flatten()
+}
+
+async fn max_run_id(pool: &SqlitePool) -> i64 {
+    sqlx::query_scalar::<_, Option<i64>>("SELECT MAX(run_id) FROM ingest_runs")
+        .fetch_one(pool)
+        .await
+        .ok()
+        .flatten()
+        .unwrap_or(0)
+}
+
+async fn find_new_run(pool: &SqlitePool, after: i64, pid: u32) -> Option<i64> {
+    sqlx::query_scalar::<_, i64>(
+        "SELECT run_id FROM ingest_runs WHERE run_id > ? AND pid = ? \
+         ORDER BY run_id DESC LIMIT 1",
+    )
+    .bind(after)
+    .bind(pid as i64)
+    .fetch_optional(pool)
+    .await
+    .ok()
+    .flatten()
+}
+
+fn push_log_line(ring: &Mutex<VecDeque<String>>, mut line: String) {
+    if line.len() > LOG_LINE_MAX {
+        let mut cut = LOG_LINE_MAX;
+        while !line.is_char_boundary(cut) {
+            cut -= 1;
+        }
+        line.truncate(cut);
+    }
+    let mut ring = ring.lock().unwrap_or_else(|e| e.into_inner());
+    if ring.len() == LOG_RING_LINES {
+        ring.pop_front();
+    }
+    ring.push_back(line);
+}
+
+/// Spawn the ingester with a fixed argv (never a shell), wire up stderr
+/// capture and the supervisor, wait for the child to write its run row, and
+/// register ownership. Returns the run_id for the 202 body.
+#[allow(clippy::result_large_err)] // the Err is the HTTP response, sent as-is
+async fn spawn_and_register(state: &AppState, plan: &SpawnPlan) -> Result<i64, Response> {
+    let before = max_run_id(&state.pool).await;
+    // Absolute db path: the child inherits our cwd today, but the argv should
+    // not depend on that staying true.
+    let db_abs = std::path::absolute(&state.db_path).unwrap_or_else(|_| state.db_path.clone());
+
+    let mut cmd = tokio::process::Command::new(&state.ingester_bin);
+    match plan {
+        SpawnPlan::Scan { resume } => {
+            cmd.arg("scan");
+            if let Some(run_id) = resume {
+                cmd.arg("--resume").arg(run_id.to_string());
+            }
+        }
+        SpawnPlan::Import { path, resume } => {
+            cmd.arg("import").arg(path);
+            if let Some(run_id) = resume {
+                cmd.arg("--resume").arg(run_id.to_string());
+            }
+        }
+    }
+    cmd.arg("--quiet")
+        .arg("--db")
+        .arg(&db_abs)
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::piped())
+        // The run must survive a viewer restart: the child is reparented and
+        // keeps writing; only Cancel and Log are lost.
+        .kill_on_drop(false);
+
+    let mut child = match cmd.spawn() {
+        Ok(child) => child,
+        Err(e) => {
+            return Err(json_error(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "spawn_failed",
+                &format!(
+                    "could not launch {}: {e} — build it with `cargo build`",
+                    state.ingester_bin.display()
+                ),
+            ))
+        }
+    };
+    let Some(pid) = child.id() else {
+        return Err(json_error(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "spawn_failed",
+            "child exited before it could be observed",
+        ));
+    };
+
+    let ring = Arc::new(Mutex::new(VecDeque::new()));
+    let exited = Arc::new(AtomicBool::new(false));
+    let (cancel_tx, cancel_rx) = mpsc::channel::<()>(1);
+
+    // stderr → bounded in-memory ring buffer; never persisted anywhere.
+    if let Some(stderr) = child.stderr.take() {
+        let ring = ring.clone();
+        tokio::spawn(async move {
+            let mut lines = tokio::io::BufReader::new(stderr).lines();
+            while let Ok(Some(line)) = lines.next_line().await {
+                push_log_line(&ring, line);
+            }
+        });
+    }
+    tokio::spawn(supervise_child(
+        child,
+        cancel_rx,
+        exited.clone(),
+        state.term_grace,
+    ));
+
+    // The 202 contract includes the run_id, which the *child* mints by
+    // inserting its run row; wait for it to appear (matched by our child's
+    // pid, newer than anything that existed before the spawn).
+    let deadline = Instant::now() + ROW_WAIT;
+    loop {
+        if let Some(run_id) = find_new_run(&state.pool, before, pid).await {
+            let owned = Arc::new(OwnedRun {
+                pid,
+                ring,
+                cancel_tx,
+                exited,
+            });
+            state
+                .children
+                .lock()
+                .unwrap_or_else(|e| e.into_inner())
+                .insert(run_id, owned);
+            return Ok(run_id);
+        }
+        if exited.load(Ordering::Relaxed) {
+            // One more look: a tiny import can legitimately finish before the
+            // first poll tick.
+            if let Some(run_id) = find_new_run(&state.pool, before, pid).await {
+                let owned = Arc::new(OwnedRun {
+                    pid,
+                    ring,
+                    cancel_tx,
+                    exited,
+                });
+                state
+                    .children
+                    .lock()
+                    .unwrap_or_else(|e| e.into_inner())
+                    .insert(run_id, owned);
+                return Ok(run_id);
+            }
+            let tail: String = {
+                let ring = ring.lock().unwrap_or_else(|e| e.into_inner());
+                ring.iter()
+                    .rev()
+                    .take(5)
+                    .rev()
+                    .cloned()
+                    .collect::<Vec<_>>()
+                    .join(" | ")
+            };
+            // The authoritative flock gate lost a race we pre-checked: the
+            // child refused to run because another ingester holds the lock.
+            if tail.contains("another ingester is already running") {
+                return Err(json_error(
+                    StatusCode::CONFLICT,
+                    "run_active",
+                    "an ingester is already running against this database",
+                ));
+            }
+            return Err(json_error(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "spawn_failed",
+                &format!("the ingester exited before reporting a run: {tail}"),
+            ));
+        }
+        if Instant::now() >= deadline {
+            return Err(json_error(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "spawn_failed",
+                "the ingester started but never reported a run row",
+            ));
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+}
+
+/// Owns the `tokio::process::Child`. Normally just reaps it; on a cancel
+/// request it SIGTERMs the child (clean drain + `cancelled` row, exactly like
+/// terminal Ctrl-C), escalating to SIGKILL after the grace period. A
+/// SIGKILLed child leaves its row open; the next ingester's janitor marks it
+/// abandoned — the viewer itself never writes to the database.
+async fn supervise_child(
+    mut child: tokio::process::Child,
+    mut cancel_rx: mpsc::Receiver<()>,
+    exited: Arc<AtomicBool>,
+    grace: Duration,
+) {
+    let pid = child.id();
+    tokio::select! {
+        _ = child.wait() => {}
+        Some(()) = cancel_rx.recv() => {
+            // The pid comes from our own child handle at spawn, never from
+            // the database.
+            if let Some(pid) = pid.and_then(|p| rustix::process::Pid::from_raw(p as i32)) {
+                let _ = rustix::process::kill_process(pid, rustix::process::Signal::TERM);
+            }
+            if tokio::time::timeout(grace, child.wait()).await.is_err() {
+                // SIGTERM ignored: SIGKILL and reap.
+                let _ = child.kill().await;
+            }
+        }
+    }
+    exited.store(true, Ordering::Relaxed);
+}
+
+async fn cancel_run(
+    State(state): State<Arc<AppState>>,
+    UrlPath(run_id): UrlPath<i64>,
+    headers: HeaderMap,
+) -> Response {
+    if let Err(response) = check_csrf(&state, &headers) {
+        return response;
+    }
+    let owned = state
+        .children
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .get(&run_id)
+        .cloned();
+    match owned {
+        None => json_error(
+            StatusCode::CONFLICT,
+            "not_owned",
+            "this viewer did not start that run — cancel it from its own terminal (Ctrl-C)",
+        ),
+        Some(run) => {
+            // Idempotent: repeated cancels (or cancelling an already-exited
+            // child) are no-ops.
+            let _ = run.cancel_tx.try_send(());
+            (
+                StatusCode::ACCEPTED,
+                Json(json!({ "run_id": run_id, "cancelling": true })),
+            )
+                .into_response()
+        }
+    }
+}
+
+async fn run_log(State(state): State<Arc<AppState>>, UrlPath(run_id): UrlPath<i64>) -> Response {
+    let owned = state
+        .children
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .get(&run_id)
+        .cloned();
+    match owned {
+        None => json_error(
+            StatusCode::NOT_FOUND,
+            "not_owned",
+            "no in-memory log for that run (it was started elsewhere, or the viewer restarted)",
+        ),
+        Some(run) => {
+            let lines: Vec<String> = {
+                let ring = run.ring.lock().unwrap_or_else(|e| e.into_inner());
+                ring.iter().cloned().collect()
+            };
+            Json(json!({
+                "run_id": run_id,
+                "pid": run.pid,
+                "exited": run.exited.load(Ordering::Relaxed),
+                "lines": lines,
+            }))
+            .into_response()
+        }
+    }
+}
+
+fn now_unix() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+}
+
+fn error_response(err: &sqlx::Error) -> Response {
+    let detail = err.to_string();
+    let lower = detail.to_lowercase();
+    let (status, kind, message) =
+        if lower.contains("unable to open database file") || lower.contains("no such table") {
+            (
+            StatusCode::SERVICE_UNAVAILABLE,
+            "missing_db",
+            "stats.db (or its tables) not found — set up the database and run the scanner first",
+        )
+        } else if lower.contains("database is locked") || lower.contains("database is busy") {
+            (
+                StatusCode::SERVICE_UNAVAILABLE,
+                "busy",
+                "database busy — scanner is writing, retry shortly",
+            )
+        } else {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "internal",
+                "internal error",
+            )
+        };
+    (
+        status,
+        Json(json!({ "error": kind, "message": message, "detail": detail })),
+    )
+        .into_response()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::body::Body;
+    use axum::http::Request as HttpRequest;
+    use sqlx::sqlite::SqliteJournalMode;
+    use sqlx::{Connection, SqliteConnection};
+    use tower::ServiceExt;
+
+    async fn memory_pool() -> SqlitePool {
+        // One connection max: each sqlite::memory: connection is a separate
+        // empty database, so the pool must never hand out a second one.
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .expect("open in-memory db");
+        // Mirror the README's real schema, quirky type names included.
+        sqlx::query("CREATE TABLE seen_mails (mail_id string)")
+            .execute(&pool)
+            .await
+            .unwrap();
+        sqlx::query("CREATE TABLE senders (sender string, mails_sent int)")
+            .execute(&pool)
+            .await
+            .unwrap();
+        pool
+    }
+
+    /// `sender string` matches none of SQLite's affinity keywords, giving the
+    /// column NUMERIC affinity: numeric-looking From headers (SMS shortcodes,
+    /// `1e5`, `-1.5`) are stored as INTEGER/REAL, which sqlx's String decoder
+    /// rejects unless the query CASTs the column back to TEXT. Regression
+    /// test: one such row must not 500 the whole summary forever.
+    #[tokio::test]
+    async fn summary_survives_numeric_sender_rows() {
+        let pool = memory_pool().await;
+        sqlx::query("INSERT INTO senders VALUES ('40404', 7), ('-1.5', 2), ('a@b.com', 3)")
+            .execute(&pool)
+            .await
+            .unwrap();
+
+        // Sanity-check the poisoned storage classes this test exists for.
+        let types: Vec<(String,)> =
+            sqlx::query_as("SELECT typeof(sender) FROM senders ORDER BY mails_sent DESC")
+                .fetch_all(&pool)
+                .await
+                .unwrap();
+        let types: Vec<&str> = types.iter().map(|(t,)| t.as_str()).collect();
+        assert_eq!(types, ["integer", "text", "real"]);
+
+        let summary = build_summary(&pool)
+            .await
+            .expect("summary must survive numeric-looking sender rows");
+        let senders = summary["senders"].as_array().unwrap();
+        assert_eq!(senders.len(), 3);
+        assert_eq!(senders[0]["sender"], "40404");
+        assert_eq!(senders[0]["mails_sent"], 7);
+        assert_eq!(senders[1]["sender"], "a@b.com");
+        assert_eq!(senders[2]["sender"], "-1.5");
+    }
+
+    /// NULL senders must keep merging with literal-'' rows (pre-existing
+    /// behavior the CAST fix must not regress).
+    #[tokio::test]
+    async fn summary_merges_null_and_empty_senders() {
+        let pool = memory_pool().await;
+        sqlx::query("INSERT INTO senders VALUES (NULL, 4), ('', 1)")
+            .execute(&pool)
+            .await
+            .unwrap();
+
+        let summary = build_summary(&pool).await.unwrap();
+        let senders = summary["senders"].as_array().unwrap();
+        assert_eq!(senders.len(), 1);
+        assert_eq!(senders[0]["sender"], "");
+        assert_eq!(senders[0]["mails_sent"], 5);
+    }
+
+    // -- Phase B endpoint tests ---------------------------------------------
+
+    /// Build a real on-disk database with Phase A's actual DDL (via
+    /// `ingest::migrate`), so the tests exercise the same schema the ingester
+    /// produces.
+    async fn migrated_db(dir: &tempfile::TempDir) -> PathBuf {
+        let db_path = dir.path().join("stats.db");
+        let options = SqliteConnectOptions::new()
+            .filename(&db_path)
+            .create_if_missing(true)
+            .journal_mode(SqliteJournalMode::Wal);
+        let mut conn = SqliteConnection::connect_with(&options).await.unwrap();
+        ingest::migrate(&mut conn).await.unwrap();
+        conn.close().await.ok();
+        db_path
+    }
+
+    async fn exec(db_path: &Path, sql: &str) {
+        let options = SqliteConnectOptions::new()
+            .filename(db_path)
+            .journal_mode(SqliteJournalMode::Wal);
+        let mut conn = SqliteConnection::connect_with(&options).await.unwrap();
+        sqlx::raw_sql(sqlx::AssertSqlSafe(sql.to_string()))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        conn.close().await.ok();
+    }
+
+    async fn get_json(app: Router, uri: &str) -> (StatusCode, serde_json::Value) {
+        let response = app
+            .oneshot(
+                HttpRequest::builder()
+                    .uri(uri)
+                    .header(header::HOST, "127.0.0.1:7878")
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        let status = response.status();
+        let bytes = axum::body::to_bytes(response.into_body(), 1 << 20)
+            .await
+            .unwrap();
+        let value = serde_json::from_slice(&bytes).unwrap_or(serde_json::Value::Null);
+        (status, value)
+    }
+
+    fn app_for(db_path: &Path) -> Router {
+        build_router(Arc::new(AppState::new(db_path)))
+    }
+
+    #[tokio::test]
+    async fn status_with_missing_db_is_200_and_onboardable() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = dir.path().join("does-not-exist.db");
+        let (status, body) = get_json(app_for(&db_path), "/api/status").await;
+        assert_eq!(
+            status,
+            StatusCode::OK,
+            "status must never 5xx on missing db"
+        );
+        assert_eq!(body["db"], "missing");
+        assert!(body["active_run"].is_null());
+        assert!(body["last_run"].is_null());
+        assert_eq!(body["owns_active_run"], false);
+        assert_eq!(body["mixed_sources"], false);
+        // CSRF token slot: 32 CSPRNG bytes, hex-encoded.
+        let token = body["csrf_token"].as_str().unwrap();
+        assert_eq!(token.len(), 64);
+        assert!(token.chars().all(|c| c.is_ascii_hexdigit()));
+        // The read-only pool must not have created the file as a side effect.
+        assert!(!db_path.exists(), "viewer must not create the database");
+    }
+
+    #[tokio::test]
+    async fn status_with_empty_db_reports_empty() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = migrated_db(&dir).await;
+        let (status, body) = get_json(app_for(&db_path), "/api/status").await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body["db"], "empty");
+        assert!(body["active_run"].is_null());
+        assert_eq!(body["ingest_lock_held"], false);
+    }
+
+    #[tokio::test]
+    async fn status_without_ingest_runs_table_treats_runs_as_none() {
+        // A pre-Phase-A database: baseline tables with data, no ingest_runs.
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = dir.path().join("old.db");
+        let options = SqliteConnectOptions::new()
+            .filename(&db_path)
+            .create_if_missing(true);
+        let mut conn = SqliteConnection::connect_with(&options).await.unwrap();
+        sqlx::query("CREATE TABLE seen_mails (mail_id string)")
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        sqlx::query("CREATE TABLE senders (sender string, mails_sent int)")
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        sqlx::query("INSERT INTO seen_mails VALUES ('m1')")
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        conn.close().await.ok();
+
+        let (status, body) = get_json(app_for(&db_path), "/api/status").await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body["db"], "ready");
+        assert!(body["active_run"].is_null());
+        assert!(body["last_run"].is_null());
+
+        let (status, body) = get_json(app_for(&db_path), "/api/runs").await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body["runs"].as_array().unwrap().len(), 0);
+    }
+
+    #[tokio::test]
+    async fn status_with_active_and_finished_runs() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = migrated_db(&dir).await;
+        exec(&db_path, "INSERT INTO seen_mails VALUES ('m1')").await;
+        exec(
+            &db_path,
+            "INSERT INTO ingest_runs \
+             (run_id, source, state, started_at_unix, updated_at_unix, finished_at_unix, \
+              messages_seen, messages_new, error_kind, error) \
+             VALUES (1, 'gmail_api', 'failed', 100, 150, 150, 10, 5, \
+                     'policy_enforced', 'Error 400: policy_enforced')",
+        )
+        .await;
+        exec(
+            &db_path,
+            "INSERT INTO ingest_runs \
+             (run_id, source, state, started_at_unix, updated_at_unix, \
+              messages_seen, messages_new, bytes_total, bytes_done, mbox_path) \
+             VALUES (2, 'mbox', 'running', 200, 205, 1000, 900, 50000, 25000, '/tmp/a.mbox')",
+        )
+        .await;
+
+        let (status, body) = get_json(app_for(&db_path), "/api/status").await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body["db"], "ready");
+        let active = &body["active_run"];
+        assert_eq!(active["run_id"], 2);
+        assert_eq!(active["source"], "mbox");
+        assert_eq!(active["state"], "running");
+        assert_eq!(active["messages_seen"], 1000);
+        assert_eq!(active["bytes_total"], 50000);
+        assert_eq!(active["bytes_done"], 25000);
+        let last = &body["last_run"];
+        assert_eq!(last["run_id"], 1);
+        assert_eq!(last["state"], "failed");
+        assert_eq!(last["error_kind"], "policy_enforced");
+        assert_eq!(body["owns_active_run"], false);
+        // First observation of this run: no rate window yet.
+        assert!(body["rate_per_sec"].is_null());
+        assert!(body["now_unix"].as_u64().unwrap() > 0);
+    }
+
+    #[tokio::test]
+    async fn status_mixed_sources_flags_dual_source_databases() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = migrated_db(&dir).await;
+        exec(&db_path, "INSERT INTO seen_mails VALUES ('m1')").await;
+        exec(
+            &db_path,
+            "INSERT INTO ingest_runs (run_id, source, state, started_at_unix, updated_at_unix, \
+             messages_new) VALUES (1, 'gmail_api', 'done', 100, 150, 10)",
+        )
+        .await;
+        let (_, body) = get_json(app_for(&db_path), "/api/status").await;
+        assert_eq!(body["mixed_sources"], false);
+
+        exec(
+            &db_path,
+            "INSERT INTO ingest_runs (run_id, source, state, started_at_unix, updated_at_unix, \
+             messages_new) VALUES (2, 'mbox', 'done', 200, 250, 3)",
+        )
+        .await;
+        let (_, body) = get_json(app_for(&db_path), "/api/status").await;
+        assert_eq!(body["mixed_sources"], true);
+    }
+
+    #[tokio::test]
+    async fn status_lock_probe_detects_a_running_ingester_without_truncating() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = migrated_db(&dir).await;
+        let lock_path = ingest::ingest_lock_path(&db_path);
+        // Pre-existing lockfile content must survive the probe (no truncate).
+        std::fs::write(&lock_path, b"sentinel").unwrap();
+
+        let (_, body) = get_json(app_for(&db_path), "/api/status").await;
+        assert_eq!(body["ingest_lock_held"], false);
+
+        // A live ingester holds the flock; the probe must see it and must not
+        // steal or break it.
+        let held = ingest::acquire_ingest_lock(&db_path).unwrap();
+        let (_, body) = get_json(app_for(&db_path), "/api/status").await;
+        assert_eq!(body["ingest_lock_held"], true);
+        drop(held);
+
+        let (_, body) = get_json(app_for(&db_path), "/api/status").await;
+        assert_eq!(body["ingest_lock_held"], false);
+        assert_eq!(
+            std::fs::read(&lock_path).unwrap(),
+            b"sentinel",
+            "probe must never truncate the lockfile"
+        );
+    }
+
+    #[tokio::test]
+    async fn runs_endpoint_orders_and_limits() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = migrated_db(&dir).await;
+        for id in 1..=5 {
+            exec(
+                &db_path,
+                &format!(
+                    "INSERT INTO ingest_runs (run_id, source, state, started_at_unix, \
+                     updated_at_unix) VALUES ({id}, 'mbox', 'done', {id}00, {id}50)"
+                ),
+            )
+            .await;
+        }
+        let (status, body) = get_json(app_for(&db_path), "/api/runs?limit=3").await;
+        assert_eq!(status, StatusCode::OK);
+        let runs = body["runs"].as_array().unwrap();
+        assert_eq!(runs.len(), 3);
+        // Newest first.
+        assert_eq!(runs[0]["run_id"], 5);
+        assert_eq!(runs[1]["run_id"], 4);
+        assert_eq!(runs[2]["run_id"], 3);
+
+        // Default limit, garbage limit, and missing db all behave.
+        let (_, body) = get_json(app_for(&db_path), "/api/runs").await;
+        assert_eq!(body["runs"].as_array().unwrap().len(), 5);
+        let (_, body) = get_json(app_for(&db_path), "/api/runs?limit=bogus").await;
+        assert_eq!(body["runs"].as_array().unwrap().len(), 5);
+        let missing = dir.path().join("nope.db");
+        let (status, body) = get_json(app_for(&missing), "/api/runs").await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body["runs"].as_array().unwrap().len(), 0);
+    }
+
+    #[tokio::test]
+    async fn new_routes_keep_security_headers_and_emit_no_cors() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = migrated_db(&dir).await;
+        for uri in ["/api/status", "/api/runs"] {
+            let response = app_for(&db_path)
+                .oneshot(
+                    HttpRequest::builder()
+                        .uri(uri)
+                        .header(header::HOST, "127.0.0.1:7878")
+                        .header(header::ORIGIN, "https://evil.example")
+                        .body(Body::empty())
+                        .unwrap(),
+                )
+                .await
+                .unwrap();
+            let headers = response.headers();
+            assert_eq!(
+                headers.get(header::CONTENT_SECURITY_POLICY).unwrap(),
+                "default-src 'self'",
+                "{uri} lost the CSP"
+            );
+            assert_eq!(
+                headers.get(header::X_CONTENT_TYPE_OPTIONS).unwrap(),
+                "nosniff"
+            );
+            assert_eq!(headers.get(header::REFERRER_POLICY).unwrap(), "no-referrer");
+            assert!(
+                headers.get(header::ACCESS_CONTROL_ALLOW_ORIGIN).is_none(),
+                "{uri} must never emit CORS headers"
+            );
+            assert!(headers.get(header::ACCESS_CONTROL_ALLOW_METHODS).is_none());
+        }
+    }
+
+    #[tokio::test]
+    async fn new_routes_respect_the_host_guard() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = migrated_db(&dir).await;
+        for uri in ["/api/status", "/api/runs"] {
+            let response = app_for(&db_path)
+                .oneshot(
+                    HttpRequest::builder()
+                        .uri(uri)
+                        .header(header::HOST, "attacker.example")
+                        .body(Body::empty())
+                        .unwrap(),
+                )
+                .await
+                .unwrap();
+            assert_eq!(response.status(), StatusCode::FORBIDDEN, "{uri}");
+        }
+    }
+
+    #[tokio::test]
+    async fn csrf_token_is_stable_per_process_state() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = migrated_db(&dir).await;
+        let state = Arc::new(AppState::new(&db_path));
+        let (_, a) = get_json(build_router(state.clone()), "/api/status").await;
+        let (_, b) = get_json(build_router(state.clone()), "/api/status").await;
+        assert_eq!(a["csrf_token"], b["csrf_token"]);
+        // And two distinct viewer processes mint distinct tokens.
+        let other = Arc::new(AppState::new(&db_path));
+        assert_ne!(state.csrf_token, other.csrf_token);
+    }
+
+    #[test]
+    fn origin_allowlist_is_loopback_http_only() {
+        for good in [
+            "http://127.0.0.1:7878",
+            "http://127.0.0.1",
+            "http://localhost:7878",
+            "http://localhost",
+            "http://localhost:1",
+        ] {
+            assert!(origin_allowed(good), "{good} should be allowed");
+        }
+        for bad in [
+            "https://127.0.0.1:7878",
+            "https://accounts.google.com",
+            "http://evil.example",
+            "http://127.0.0.1.evil.example",
+            "http://localhost:",
+            "http://localhost:7878/path",
+            "http://localhost:78x8",
+            "null",
+            "",
+        ] {
+            assert!(!origin_allowed(bad), "{bad} must be rejected");
+        }
+    }
+
+    #[test]
+    fn constant_time_eq_compares_correctly() {
+        assert!(constant_time_eq(b"abc", b"abc"));
+        assert!(!constant_time_eq(b"abc", b"abd"));
+        assert!(!constant_time_eq(b"abc", b"ab"));
+        assert!(!constant_time_eq(b"", b"a"));
+        assert!(constant_time_eq(b"", b""));
+    }
+
+    #[test]
+    fn mbox_path_validation_is_stat_plus_magic_only() {
+        let dir = tempfile::tempdir().unwrap();
+        let good = dir.path().join("mail.mbox");
+        std::fs::write(&good, b"From a@example.com\nFrom: a@example.com\n\nhi\n").unwrap();
+        assert_eq!(validate_mbox_path(good.to_str().unwrap()).unwrap(), good);
+
+        let not_mbox = dir.path().join("notes.txt");
+        std::fs::write(&not_mbox, b"not mail").unwrap();
+        for (raw, expected) in [
+            ("relative/mail.mbox", "absolute"),
+            (
+                dir.path().join("missing.mbox").to_str().unwrap(),
+                "cannot read",
+            ),
+            (dir.path().to_str().unwrap(), "not a regular file"),
+            (not_mbox.to_str().unwrap(), "does not look like an mbox"),
+        ] {
+            let err = validate_mbox_path(raw).unwrap_err();
+            assert!(err.contains(expected), "{raw}: {err}");
+        }
+    }
+
+    #[test]
+    fn log_ring_caps_lines_and_line_length() {
+        let ring = Mutex::new(VecDeque::new());
+        for i in 0..(LOG_RING_LINES + 30) {
+            push_log_line(&ring, format!("line {i}"));
+        }
+        push_log_line(&ring, "x".repeat(LOG_LINE_MAX + 100));
+        let ring = ring.lock().unwrap();
+        assert_eq!(ring.len(), LOG_RING_LINES);
+        assert_eq!(ring.front().unwrap(), "line 31");
+        assert_eq!(ring.back().unwrap().len(), LOG_LINE_MAX);
+    }
+
+    #[test]
+    fn rate_window_computes_rates_and_resets_across_runs() {
+        let mut window = RateWindow::default();
+        let t0 = Instant::now();
+        // First sample: no span yet.
+        assert_eq!(window.observe(t0, 1, 100, Some(1000)), (None, None));
+        // Two seconds later, 80 more messages and 8000 more bytes.
+        let (msg, bytes) = window.observe(t0 + Duration::from_secs(2), 1, 180, Some(9000));
+        assert_eq!(msg, Some(40.0));
+        assert_eq!(bytes, Some(4000.0));
+
+        // ETA from bytes: (50000-9000)/4000 = 10.25 → 11s.
+        let eta = compute_eta(180, Some(9000), Some(50_000), None, msg, bytes);
+        assert_eq!(eta, Some(11));
+        // ETA from message estimate when no byte totals exist.
+        let eta = compute_eta(180, None, None, Some(580), msg, None);
+        assert_eq!(eta, Some(10));
+        // No forward progress ⇒ no ETA rather than a division blowup.
+        let (msg, _) = window.observe(t0 + Duration::from_secs(3), 1, 180, Some(9000));
+        assert!(eta_is_none_when_rate_zero(msg));
+
+        // A new run id resets the window.
+        assert_eq!(
+            window.observe(t0 + Duration::from_secs(4), 2, 5, None),
+            (None, None)
+        );
+    }
+
+    fn eta_is_none_when_rate_zero(msg_rate: Option<f64>) -> bool {
+        compute_eta(180, None, None, Some(580), msg_rate.map(|_| 0.0), None).is_none()
+    }
+}
diff --git a/tests/frontend/harness.py b/tests/frontend/harness.py
new file mode 100644
index 0000000..5c65c72
--- /dev/null
+++ b/tests/frontend/harness.py
@@ -0,0 +1,363 @@
+#!/usr/bin/env python3
+"""Headless-Chrome harness for the Phase C front-end behaviors (issue #30).
+
+Serves the real web/ assets from a stub server that fakes the viewer API,
+drives Chrome headless through five scenarios, and asserts both sides:
+
+- what the page rendered (extracted from --dump-dom via an injected
+  tests/frontend/test_driver.js that writes a <pre id="harness-results">), and
+- what requests the page actually made (the stub records every POST, so the
+  CSRF header / JSON content type / body are asserted on the wire).
+
+Scenarios:
+  launch      onboarding launch buttons POST /api/runs with the CSRF header
+  demo        /api/status 404s (static hosting): no ingestion UI, no POSTs
+  owns_false  active run not owned: Cancel/Log hidden, terminal hint shown
+  owns_true   owned run: Log renders ring-buffer lines, Cancel POSTs w/ CSRF
+  auth_good   accounts.google.com auth_url renders a safe link
+  auth_evil   any other auth_url renders as inert text (no link)
+
+Run:  python3 tests/frontend/harness.py
+Requires Google Chrome (path override: CHROME env var). Exits non-zero on any
+failure. Not wired into cargo test — run it alongside.
+"""
+
+import html
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent.parent
+WEB = ROOT / "web"
+DRIVER = Path(__file__).resolve().parent / "test_driver.js"
+
+TOKEN = "f" * 64  # stands in for the viewer's per-process CSRF token
+
+CHROME_CANDIDATES = [
+    os.environ.get("CHROME"),
+    "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+    "/usr/bin/google-chrome",
+    "/usr/bin/chromium-browser",
+    "/usr/bin/chromium",
+    shutil.which("google-chrome"),
+    shutil.which("chromium"),
+]
+
+
+def find_chrome():
+    for candidate in CHROME_CANDIDATES:
+        if candidate and Path(candidate).exists():
+            return candidate
+    sys.exit("harness: no Chrome found (set CHROME=/path/to/chrome)")
+
+
+def base_status(**overrides):
+    doc = {
+        "db": "ready",
+        "now_unix": int(time.time()),
+        "ingest_lock_held": False,
+        "active_run": None,
+        "last_run": None,
+        "owns_active_run": False,
+        "mixed_sources": False,
+        "rate_per_sec": None,
+        "eta_seconds": None,
+        "csrf_token": TOKEN,
+    }
+    doc.update(overrides)
+    return doc
+
+
+def active_run(**overrides):
+    run = {
+        "run_id": 7,
+        "source": "gmail_api",
+        "state": "running",
+        "pid": 4242,
+        "started_at_unix": int(time.time()) - 30,
+        "updated_at_unix": int(time.time()),
+        "finished_at_unix": None,
+        "messages_seen": 120,
+        "messages_new": 100,
+        "total_estimate": 1000,
+        "bytes_total": None,
+        "bytes_done": None,
+        "mbox_path": None,
+        "error_kind": None,
+        "error": None,
+        "auth_url": None,
+    }
+    run.update(overrides)
+    return run
+
+
+SUMMARY = {
+    "total_messages": 5,
+    "senders": [{"sender": "a@example.com", "mails_sent": 5}],
+    "generated_at_unix": int(time.time()),
+}
+
+SCENARIOS = {
+    "launch": {
+        "status": base_status(db="missing"),
+        "summary_missing": True,
+    },
+    "demo": {
+        "status_404": True,
+    },
+    "owns_false": {
+        "status": base_status(active_run=active_run(), ingest_lock_held=True),
+    },
+    "owns_true": {
+        "status": base_status(
+            active_run=active_run(), ingest_lock_held=True, owns_active_run=True
+        ),
+        "log_lines": ["stub stderr line 1", "stub stderr line 2", "stub stderr line 3"],
+    },
+    "auth_good": {
+        "status": base_status(
+            active_run=active_run(
+                state="awaiting_auth",
+                auth_url="https://accounts.google.com/o/oauth2/v2/auth?client_id=x",
+            ),
+            ingest_lock_held=True,
+            owns_active_run=True,
+        ),
+    },
+    "auth_evil": {
+        "status": base_status(
+            active_run=active_run(
+                state="awaiting_auth",
+                auth_url="https://accounts.google.com.evil.example/phish",
+            ),
+            ingest_lock_held=True,
+            owns_active_run=True,
+        ),
+    },
+}
+
+
+def make_handler(name, scenario, captured):
+    index_html = (WEB / "index.html").read_text()
+    anchor = '<script src="/app.js" defer></script>'
+    assert index_html.count(anchor) == 1
+    index_html = index_html.replace(
+        anchor, anchor + f'\n<script src="/test.js?scenario={name}" defer></script>'
+    )
+
+    class Handler(BaseHTTPRequestHandler):
+        def log_message(self, *args):
+            pass
+
+        def send_body(self, status, content_type, body):
+            data = body.encode() if isinstance(body, str) else body
+            self.send_response(status)
+            self.send_header("Content-Type", content_type)
+            self.send_header("Content-Length", str(len(data)))
+            # Fidelity with the real viewer: same CSP, so the injected driver
+            # proves same-origin scripts (and nothing else) run.
+            self.send_header("Content-Security-Policy", "default-src 'self'")
+            self.end_headers()
+            self.wfile.write(data)
+
+        def send_json(self, payload, status=200):
+            self.send_body(status, "application/json", json.dumps(payload))
+
+        def do_GET(self):
+            path = self.path.split("?")[0]
+            if path == "/":
+                self.send_body(200, "text/html; charset=utf-8", index_html)
+            elif path == "/app.css":
+                self.send_body(200, "text/css", (WEB / "app.css").read_text())
+            elif path == "/app.js":
+                self.send_body(200, "text/javascript", (WEB / "app.js").read_text())
+            elif path == "/test.js":
+                self.send_body(200, "text/javascript", DRIVER.read_text())
+            elif path == "/api/status":
+                if scenario.get("status_404"):
+                    self.send_body(404, "text/plain", "not found")
+                else:
+                    self.send_json(scenario["status"])
+            elif path == "/api/summary":
+                if scenario.get("summary_missing"):
+                    self.send_json({"error": "missing_db", "message": "no db"}, 503)
+                else:
+                    self.send_json(SUMMARY)
+            elif path == "/api/runs":
+                self.send_json({"runs": [], "now_unix": int(time.time())})
+            elif re.fullmatch(r"/api/runs/\d+/log", path):
+                self.send_json(
+                    {"run_id": 7, "lines": scenario.get("log_lines", []), "exited": False}
+                )
+            else:
+                self.send_body(404, "text/plain", "not found")
+
+        def do_POST(self):
+            length = int(self.headers.get("Content-Length") or 0)
+            body = self.rfile.read(length).decode("utf-8", "replace")
+            captured.append(
+                {
+                    "path": self.path,
+                    "content_type": self.headers.get("Content-Type"),
+                    "csrf": self.headers.get("X-Gmail-Stats-Csrf"),
+                    "sec_fetch_site": self.headers.get("Sec-Fetch-Site"),
+                    "body": body,
+                }
+            )
+            if re.fullmatch(r"/api/runs/\d+/cancel", self.path):
+                self.send_json({"run_id": 7, "cancelling": True}, 202)
+            elif self.path == "/api/runs":
+                self.send_json({"run_id": 9}, 202)
+            else:
+                self.send_body(404, "text/plain", "not found")
+
+    return Handler
+
+
+def run_scenario(chrome, name, scenario):
+    captured = []
+    server = ThreadingHTTPServer(
+        ("127.0.0.1", 0), make_handler(name, scenario, captured)
+    )
+    port = server.server_address[1]
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        with tempfile.TemporaryDirectory() as profile:
+            # Some Chrome builds print the DOM but never exit afterwards, so
+            # collect stdout with a hard deadline and keep whatever arrived.
+            proc = subprocess.Popen(
+                [
+                    chrome,
+                    "--headless=new",
+                    "--disable-gpu",
+                    "--disable-extensions",
+                    "--disable-background-networking",
+                    "--disable-component-update",
+                    "--no-first-run",
+                    "--no-default-browser-check",
+                    f"--user-data-dir={profile}",
+                    "--virtual-time-budget=10000",
+                    "--dump-dom",
+                    f"http://127.0.0.1:{port}/",
+                ],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+            )
+            try:
+                stdout, stderr = proc.communicate(timeout=60)
+            except subprocess.TimeoutExpired:
+                proc.kill()
+                stdout, stderr = proc.communicate()
+        match = re.search(r'<pre id="harness-results">(.*?)</pre>', stdout, re.S)
+        if not match:
+            raise AssertionError(
+                f"no harness results in DOM (chrome rc={proc.returncode}); "
+                f"stderr tail: {stderr[-400:]}"
+            )
+        results = json.loads(html.unescape(match.group(1)))
+        if "error" in results:
+            raise AssertionError(f"driver error: {results['error']}")
+        return results, captured
+    finally:
+        server.shutdown()
+
+
+def check(condition, message, failures):
+    status = "ok" if condition else "FAIL"
+    print(f"    [{status}] {message}")
+    if not condition:
+        failures.append(message)
+
+
+def main():
+    chrome = find_chrome()
+    failures = []
+
+    for name, scenario in SCENARIOS.items():
+        print(f"scenario: {name}")
+        results, captured = run_scenario(chrome, name, scenario)
+
+        if name == "launch":
+            posts = [c for c in captured if c["path"] == "/api/runs"]
+            check(len(posts) == 2, f"two launch POSTs captured (got {len(posts)})", failures)
+            for post in posts:
+                check(
+                    (post["content_type"] or "").startswith("application/json"),
+                    f"POST content type is JSON ({post['content_type']})",
+                    failures,
+                )
+                check(post["csrf"] == TOKEN, "POST carries the CSRF token from /api/status", failures)
+            bodies = sorted(post["body"] for post in posts)
+            check(
+                bodies
+                == sorted(
+                    [
+                        json.dumps({"source": "mbox", "path": "/tmp/harness.mbox"}, separators=(",", ":")),
+                        json.dumps({"source": "gmail_api"}, separators=(",", ":")),
+                    ]
+                ),
+                f"POST bodies are exactly the two launches ({bodies})",
+                failures,
+            )
+        elif name == "demo":
+            check(results["allLaunchHidden"], "launch controls hidden without a status endpoint", failures)
+            check(results["pillHidden"], "pill hidden", failures)
+            check(results["panelHidden"], "panel hidden", failures)
+            check(results["historyHidden"], "history hidden", failures)
+            check(len(captured) == 0, f"no mutating requests fired ({len(captured)})", failures)
+        elif name == "owns_false":
+            check(results["cancelHidden"], "Cancel hidden for non-owned run", failures)
+            check(results["logHidden"], "Log hidden for non-owned run", failures)
+            check("terminal" in results["origin"], "terminal hint shown", failures)
+            check(len(captured) == 0, "no POSTs fired", failures)
+        elif name == "owns_true":
+            check(not results["cancelHidden"], "Cancel visible for owned run", failures)
+            check(not results["logHidden"], "Log visible for owned run", failures)
+            check("stub stderr line 1" in results["logText"], "log tail rendered", failures)
+            cancels = [c for c in captured if c["path"] == "/api/runs/7/cancel"]
+            check(len(cancels) == 1, f"one cancel POST captured (got {len(cancels)})", failures)
+            if cancels:
+                check(cancels[0]["csrf"] == TOKEN, "cancel POST carries the CSRF token", failures)
+                check(
+                    (cancels[0]["content_type"] or "").startswith("application/json"),
+                    "cancel POST content type is JSON",
+                    failures,
+                )
+        elif name == "auth_good":
+            check(results["hasLink"], "accounts.google.com URL renders a link", failures)
+            check(
+                (results["href"] or "").startswith("https://accounts.google.com/"),
+                "href is the Google URL",
+                failures,
+            )
+            check(results["target"] == "_blank", "target=_blank", failures)
+            check(results["rel"] == "noopener noreferrer", "rel=noopener noreferrer", failures)
+        elif name == "auth_evil":
+            check(not results["hasLink"], "hostile auth_url renders no link", failures)
+            check(
+                "accounts.google.com.evil.example" in results["text"],
+                "hostile URL shown as inert text",
+                failures,
+            )
+
+    print()
+    if failures:
+        print(f"FAILED: {len(failures)} assertion(s)")
+        for failure in failures:
+            print(f"  - {failure}")
+        sys.exit(1)
+    print("all front-end harness scenarios passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/frontend/test_driver.js b/tests/frontend/test_driver.js
new file mode 100644
index 0000000..c3c3f0a
--- /dev/null
+++ b/tests/frontend/test_driver.js
@@ -0,0 +1,132 @@
+"use strict";
+
+// Injected by tests/frontend/harness.py after app.js. Drives one scenario in
+// headless Chrome and writes its observations into a <pre id="harness-results">
+// element that the harness extracts from --dump-dom output. Request-side
+// assertions (CSRF header, content type, body) are made by the harness's stub
+// server, not here.
+
+const SCENARIO = new URLSearchParams(new URL(document.currentScript.src).search)
+  .get("scenario");
+
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+async function waitFor(check, what, timeout = 8000) {
+  const started = Date.now();
+  for (;;) {
+    let value = null;
+    try {
+      value = check();
+    } catch (err) {
+      // keep polling
+    }
+    if (value) return value;
+    if (Date.now() - started > timeout) {
+      throw new Error(`timeout waiting for ${what}`);
+    }
+    await sleep(50);
+  }
+}
+
+function hidden(id) {
+  return document.getElementById(id).classList.contains("hidden");
+}
+
+function report(results) {
+  const pre = document.createElement("pre");
+  pre.id = "harness-results";
+  pre.textContent = JSON.stringify(results);
+  document.body.appendChild(pre);
+}
+
+async function run() {
+  if (SCENARIO === "launch") {
+    // Onboarding with the live viewer: launch controls appear; clicking them
+    // POSTs with the CSRF header (asserted server-side).
+    await waitFor(
+      () => !document.getElementById("setup").classList.contains("hidden"),
+      "setup view",
+    );
+    await waitFor(
+      () => !document.getElementById("start-import").closest(".launch").classList.contains("hidden"),
+      "launch controls revealed",
+    );
+    document.getElementById("mbox-path").value = "/tmp/harness.mbox";
+    document.getElementById("start-import").click();
+    await sleep(600);
+    document.getElementById("start-scan").click();
+    await sleep(600);
+    report({
+      scenario: SCENARIO,
+      launchVisible: true,
+    });
+    return;
+  }
+
+  if (SCENARIO === "demo") {
+    // Static hosting: /api/status 404s. No ingestion UI, no launch controls,
+    // and (implicitly) no mutating calls — the stub records any POST.
+    await waitFor(
+      () => !document.getElementById("stats").classList.contains("hidden"),
+      "stats view",
+    );
+    await sleep(800); // give the status probe time to conclude 404
+    const launches = [...document.querySelectorAll(".live-only")];
+    report({
+      scenario: SCENARIO,
+      allLaunchHidden: launches.every(el => el.classList.contains("hidden")),
+      pillHidden: hidden("ingest-pill"),
+      panelHidden: hidden("ingest-panel"),
+      historyHidden: hidden("history"),
+    });
+    return;
+  }
+
+  if (SCENARIO === "owns_false" || SCENARIO === "owns_true") {
+    await waitFor(() => !hidden("ingest-panel"), "progress panel");
+    if (SCENARIO === "owns_false") {
+      await sleep(400);
+      report({
+        scenario: SCENARIO,
+        cancelHidden: hidden("run-cancel"),
+        logHidden: hidden("run-log"),
+        origin: document.getElementById("run-origin").textContent,
+      });
+      return;
+    }
+    await waitFor(() => !hidden("run-cancel"), "cancel button");
+    document.getElementById("run-log").click();
+    await waitFor(
+      () => document.getElementById("run-log-view").textContent.includes("stub stderr line 2"),
+      "log lines",
+    );
+    document.getElementById("run-cancel").click();
+    await sleep(600);
+    report({
+      scenario: SCENARIO,
+      cancelHidden: hidden("run-cancel"),
+      logHidden: hidden("run-log"),
+      logText: document.getElementById("run-log-view").textContent,
+    });
+    return;
+  }
+
+  if (SCENARIO === "auth_good" || SCENARIO === "auth_evil") {
+    await waitFor(() => !hidden("run-auth"), "auth slot");
+    const slot = document.getElementById("run-auth");
+    const link = slot.querySelector("a");
+    report({
+      scenario: SCENARIO,
+      hasLink: Boolean(link),
+      href: link ? link.getAttribute("href") : null,
+      target: link ? link.getAttribute("target") : null,
+      rel: link ? link.getAttribute("rel") : null,
+      text: slot.textContent,
+    });
+    return;
+  }
+
+  report({ scenario: SCENARIO, error: "unknown scenario" });
+}
+
+run().catch(err => report({ scenario: SCENARIO, error: String(err) }));
diff --git a/tests/web_mutating.rs b/tests/web_mutating.rs
new file mode 100644
index 0000000..747ae28
--- /dev/null
+++ b/tests/web_mutating.rs
@@ -0,0 +1,790 @@
+//! Phase C endpoint + supervision tests for the web viewer (issue #30).
+//!
+//! Drives the exact router the `web` binary serves (via `gmail_stats::webapp`)
+//! with `tower::ServiceExt::oneshot`: the full CSRF matrix on the mutating
+//! routes, and child-process supervision paths using the test-only
+//! `fake_ingester` binary (normal completion, crash → abandoned, SIGTERM
+//! honored, SIGTERM ignored → SIGKILL escalation, viewer restart mid-run).
+
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::Duration;
+
+use axum::body::Body;
+use axum::http::{header, HeaderMap, Request, StatusCode};
+use axum::Router;
+use serde_json::{json, Value};
+use tower::ServiceExt;
+
+use gmail_stats::ingest;
+use gmail_stats::webapp::{build_router, AppState};
+
+const FAKE_INGESTER: &str = env!("CARGO_BIN_EXE_fake_ingester");
+const REAL_INGESTER: &str = env!("CARGO_BIN_EXE_gmail_stats");
+
+/// A viewer wired to the fake ingester with a short SIGTERM→SIGKILL grace.
+fn state_for(db: &Path) -> Arc<AppState> {
+    Arc::new(AppState::configured(
+        db,
+        PathBuf::from(FAKE_INGESTER),
+        Duration::from_millis(400),
+    ))
+}
+
+fn app(state: &Arc<AppState>) -> Router {
+    build_router(state.clone())
+}
+
+fn set_fake_mode(dir: &Path, mode: &str) {
+    std::fs::write(dir.join("fake_mode"), mode).unwrap();
+}
+
+fn write_mbox(dir: &Path) -> PathBuf {
+    let path = dir.join("mail.mbox");
+    std::fs::write(
+        &path,
+        "From a@example.com Thu Jan  1 00:00:00 2020\n\
+         From: Alice <a@example.com>\n\
+         Message-ID: <m1@example.com>\n\
+         \n\
+         body\n",
+    )
+    .unwrap();
+    path
+}
+
+async fn read_json(response: axum::response::Response) -> (StatusCode, Value, HeaderMap) {
+    let status = response.status();
+    let headers = response.headers().clone();
+    let bytes = axum::body::to_bytes(response.into_body(), 1 << 20)
+        .await
+        .unwrap();
+    let value = serde_json::from_slice(&bytes).unwrap_or(Value::Null);
+    (status, value, headers)
+}
+
+fn assert_no_cors(headers: &HeaderMap, context: &str) {
+    for name in [
+        "access-control-allow-origin",
+        "access-control-allow-methods",
+        "access-control-allow-headers",
+        "access-control-allow-credentials",
+        "access-control-expose-headers",
+    ] {
+        assert!(
+            headers.get(name).is_none(),
+            "{context}: must never emit CORS header {name}"
+        );
+    }
+}
+
+async fn get_json(state: &Arc<AppState>, uri: &str) -> (StatusCode, Value, HeaderMap) {
+    let response = app(state)
+        .oneshot(
+            Request::builder()
+                .uri(uri)
+                .header(header::HOST, "127.0.0.1:7878")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    read_json(response).await
+}
+
+async fn csrf_token(state: &Arc<AppState>) -> String {
+    let (status, body, _) = get_json(state, "/api/status").await;
+    assert_eq!(status, StatusCode::OK);
+    body["csrf_token"].as_str().unwrap().to_string()
+}
+
+struct PostSpec<'a> {
+    uri: &'a str,
+    content_type: Option<&'a str>,
+    token: Option<&'a str>,
+    origin: Option<&'a str>,
+    sec_fetch_site: Option<&'a str>,
+    body: &'a str,
+}
+
+async fn post(state: &Arc<AppState>, spec: PostSpec<'_>) -> (StatusCode, Value, HeaderMap) {
+    let mut builder = Request::builder()
+        .method("POST")
+        .uri(spec.uri)
+        .header(header::HOST, "127.0.0.1:7878");
+    if let Some(content_type) = spec.content_type {
+        builder = builder.header(header::CONTENT_TYPE, content_type);
+    }
+    if let Some(token) = spec.token {
+        builder = builder.header("x-gmail-stats-csrf", token);
+    }
+    if let Some(origin) = spec.origin {
+        builder = builder.header(header::ORIGIN, origin);
+    }
+    if let Some(site) = spec.sec_fetch_site {
+        builder = builder.header("sec-fetch-site", site);
+    }
+    let response = app(state)
+        .oneshot(builder.body(Body::from(spec.body.to_string())).unwrap())
+        .await
+        .unwrap();
+    read_json(response).await
+}
+
+/// A fully well-formed same-origin browser request (the "valid trio":
+/// JSON content type + correct token + benign browser-context headers).
+async fn post_valid(
+    state: &Arc<AppState>,
+    uri: &str,
+    body: Value,
+) -> (StatusCode, Value, HeaderMap) {
+    let token = csrf_token(state).await;
+    post(
+        state,
+        PostSpec {
+            uri,
+            content_type: Some("application/json"),
+            token: Some(&token),
+            origin: Some("http://127.0.0.1:7878"),
+            sec_fetch_site: Some("same-origin"),
+            body: &body.to_string(),
+        },
+    )
+    .await
+}
+
+/// Poll /api/status until `pred` says stop, or the deadline passes.
+async fn wait_status<F>(state: &Arc<AppState>, mut pred: F, what: &str) -> Value
+where
+    F: FnMut(&Value) -> bool,
+{
+    for _ in 0..200 {
+        let (status, body, _) = get_json(state, "/api/status").await;
+        if status == StatusCode::OK && pred(&body) {
+            return body;
+        }
+        tokio::time::sleep(Duration::from_millis(50)).await;
+    }
+    panic!("timed out waiting for: {what}");
+}
+
+async fn run_state(state: &Arc<AppState>, run_id: i64) -> Option<String> {
+    let (_, body, _) = get_json(state, "/api/runs?limit=50").await;
+    body["runs"]
+        .as_array()?
+        .iter()
+        .find(|run| run["run_id"].as_i64() == Some(run_id))
+        .and_then(|run| run["state"].as_str().map(str::to_string))
+}
+
+// ---------------------------------------------------------------------------
+// CSRF matrix on POST /api/runs and POST /api/runs/{id}/cancel
+// ---------------------------------------------------------------------------
+
+#[tokio::test]
+async fn csrf_matrix_rejects_everything_short_of_the_full_stack() {
+    let dir = tempfile::tempdir().unwrap();
+    let db = dir.path().join("stats.db");
+    let mbox = write_mbox(dir.path());
+    let state = state_for(&db);
+    let token = csrf_token(&state).await;
+    let good_body = json!({ "source": "mbox", "path": mbox }).to_string();
+
+    for uri in ["/api/runs", "/api/runs/1/cancel"] {
+        // Form content types (what a cross-site <form> can produce): 415,
+        // even with an otherwise-valid token.
+        for form_ct in [
+            "application/x-www-form-urlencoded",
+            "multipart/form-data",
+            "text/plain",
+        ] {
+            let (status, body, headers) = post(
+                &state,
+                PostSpec {
+                    uri,
+                    content_type: Some(form_ct),
+                    token: Some(&token),
+                    origin: None,
+                    sec_fetch_site: None,
+                    body: &good_body,
+                },
+            )
+            .await;
+            assert_eq!(
+                status,
+                StatusCode::UNSUPPORTED_MEDIA_TYPE,
+                "{uri} with {form_ct}"
+            );
+            assert_eq!(body["error"], "content_type");
+            assert_no_cors(&headers, uri);
+        }
+
+        // Missing content type entirely: also 415.
+        let (status, _, headers) = post(
+            &state,
+            PostSpec {
+                uri,
+                content_type: None,
+                token: Some(&token),
+                origin: None,
+                sec_fetch_site: None,
+                body: &good_body,
+            },
+        )
+        .await;
+        assert_eq!(status, StatusCode::UNSUPPORTED_MEDIA_TYPE, "{uri} no CT");
+        assert_no_cors(&headers, uri);
+
+        // JSON but no CSRF header: 403.
+        let (status, body, headers) = post(
+            &state,
+            PostSpec {
+                uri,
+                content_type: Some("application/json"),
+                token: None,
+                origin: None,
+                sec_fetch_site: None,
+                body: &good_body,
+            },
+        )
+        .await;
+        assert_eq!(status, StatusCode::FORBIDDEN, "{uri} without token");
+        assert_eq!(body["error"], "csrf");
+        assert_no_cors(&headers, uri);
+
+        // Wrong token: 403.
+        let (status, _, _) = post(
+            &state,
+            PostSpec {
+                uri,
+                content_type: Some("application/json"),
+                token: Some("deadbeef"),
+                origin: None,
+                sec_fetch_site: None,
+                body: &good_body,
+            },
+        )
+        .await;
+        assert_eq!(status, StatusCode::FORBIDDEN, "{uri} wrong token");
+
+        // Hostile Origins: 403 even with a valid token.
+        for origin in [
+            "https://evil.example",
+            "http://evil.example",
+            "https://127.0.0.1:7878",
+            "null",
+        ] {
+            let (status, _, _) = post(
+                &state,
+                PostSpec {
+                    uri,
+                    content_type: Some("application/json"),
+                    token: Some(&token),
+                    origin: Some(origin),
+                    sec_fetch_site: None,
+                    body: &good_body,
+                },
+            )
+            .await;
+            assert_eq!(status, StatusCode::FORBIDDEN, "{uri} origin {origin}");
+        }
+
+        // Cross-site fetch metadata: 403 even with a valid token.
+        for site in ["cross-site", "same-site"] {
+            let (status, _, _) = post(
+                &state,
+                PostSpec {
+                    uri,
+                    content_type: Some("application/json"),
+                    token: Some(&token),
+                    origin: None,
+                    sec_fetch_site: Some(site),
+                    body: &good_body,
+                },
+            )
+            .await;
+            assert_eq!(status, StatusCode::FORBIDDEN, "{uri} sec-fetch-site {site}");
+        }
+    }
+
+    // Benign loopback origins pass the origin layer (proven end-to-end by
+    // the valid-trio 202 below and cancel's 409-not-owned, which are both
+    // past-CSRF outcomes).
+    let (status, body, _) = post(
+        &state,
+        PostSpec {
+            uri: "/api/runs/1/cancel",
+            content_type: Some("application/json"),
+            token: Some(&token),
+            origin: Some("http://localhost:7878"),
+            sec_fetch_site: Some("none"),
+            body: "{}",
+        },
+    )
+    .await;
+    assert_eq!(status, StatusCode::CONFLICT);
+    assert_eq!(body["error"], "not_owned");
+}
+
+#[tokio::test]
+async fn valid_trio_starts_a_run_and_completes_it() {
+    let dir = tempfile::tempdir().unwrap();
+    let db = dir.path().join("stats.db");
+    let mbox = write_mbox(dir.path());
+    set_fake_mode(dir.path(), "complete");
+    let state = state_for(&db);
+
+    let (status, body, headers) = post_valid(
+        &state,
+        "/api/runs",
+        json!({ "source": "mbox", "path": mbox }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::ACCEPTED, "valid trio must 202: {body}");
+    let run_id = body["run_id"].as_i64().expect("202 body carries run_id");
+    assert_no_cors(&headers, "202 response");
+
+    let final_status = wait_status(
+        &state,
+        |s| {
+            s["active_run"].is_null()
+                && s["last_run"]["run_id"].as_i64() == Some(run_id)
+                && s["last_run"]["state"] == "done"
+        },
+        "spawned run to complete",
+    )
+    .await;
+    assert_eq!(final_status["ingest_lock_held"], false);
+}
+
+#[tokio::test]
+async fn bad_paths_and_sources_are_422() {
+    let dir = tempfile::tempdir().unwrap();
+    let db = dir.path().join("stats.db");
+    let state = state_for(&db);
+
+    let not_mbox = dir.path().join("notes.txt");
+    std::fs::write(&not_mbox, "definitely not mail\n").unwrap();
+
+    let cases: Vec<(Value, &str)> = vec![
+        (
+            json!({ "source": "mbox", "path": "relative/mail.mbox" }),
+            "bad_path",
+        ),
+        (
+            json!({ "source": "mbox", "path": dir.path().join("missing.mbox") }),
+            "bad_path",
+        ),
+        (json!({ "source": "mbox", "path": dir.path() }), "bad_path"),
+        (json!({ "source": "mbox", "path": not_mbox }), "bad_path"),
+        (json!({ "source": "mbox" }), "bad_path"),
+        (
+            json!({ "source": "mbox", "resume_run_id": 42 }),
+            "bad_resume",
+        ),
+        (
+            json!({ "source": "gmail_api", "resume_run_id": 42 }),
+            "bad_resume",
+        ),
+        (json!({ "source": "carrier_pigeon" }), "bad_source"),
+        (json!({}), "bad_source"),
+    ];
+    for (body, expected_kind) in cases {
+        let (status, response, _) = post_valid(&state, "/api/runs", body.clone()).await;
+        assert_eq!(
+            status,
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "body {body} => {response}"
+        );
+        assert_eq!(response["error"], expected_kind, "body {body}");
+    }
+
+    // Malformed JSON with the right headers: 400, not a spawn.
+    let token = csrf_token(&state).await;
+    let (status, _, _) = post(
+        &state,
+        PostSpec {
+            uri: "/api/runs",
+            content_type: Some("application/json"),
+            token: Some(&token),
+            origin: None,
+            sec_fetch_site: None,
+            body: "not json",
+        },
+    )
+    .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn second_start_while_active_is_409_and_cancel_is_honored() {
+    let dir = tempfile::tempdir().unwrap();
+    let db = dir.path().join("stats.db");
+    let mbox = write_mbox(dir.path());
+    set_fake_mode(dir.path(), "hang_trap");
+    let state = state_for(&db);
+
+    let (status, body, _) = post_valid(
+        &state,
+        "/api/runs",
+        json!({ "source": "mbox", "path": mbox }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::ACCEPTED, "{body}");
+    let run_id = body["run_id"].as_i64().unwrap();
+
+    // Owned and visibly active.
+    let status_doc = wait_status(
+        &state,
+        |s| s["active_run"]["run_id"].as_i64() == Some(run_id),
+        "run visible as active",
+    )
+    .await;
+    assert_eq!(status_doc["owns_active_run"], true);
+    assert_eq!(status_doc["ingest_lock_held"], true);
+
+    // A second launch while the first holds the flock: 409 run_active.
+    let (status, body, _) = post_valid(
+        &state,
+        "/api/runs",
+        json!({ "source": "mbox", "path": mbox }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::CONFLICT);
+    assert_eq!(body["error"], "run_active");
+
+    // Cancel: 202, SIGTERM honored, clean `cancelled` row.
+    let (status, body, _) =
+        post_valid(&state, &format!("/api/runs/{run_id}/cancel"), json!({})).await;
+    assert_eq!(status, StatusCode::ACCEPTED, "{body}");
+    wait_status(
+        &state,
+        |s| s["active_run"].is_null() && s["ingest_lock_held"] == false,
+        "cancelled child to exit",
+    )
+    .await;
+    assert_eq!(
+        run_state(&state, run_id).await.as_deref(),
+        Some("cancelled")
+    );
+}
+
+#[tokio::test]
+async fn cancelling_a_run_this_viewer_did_not_start_is_409_not_owned() {
+    let dir = tempfile::tempdir().unwrap();
+    let db = dir.path().join("stats.db");
+    let state = state_for(&db);
+
+    // Plant a foreign active run (as if started from a terminal).
+    let options = sqlx::sqlite::SqliteConnectOptions::new()
+        .filename(&db)
+        .create_if_missing(true);
+    let mut conn = <sqlx::SqliteConnection as sqlx::Connection>::connect_with(&options)
+        .await
+        .unwrap();
+    ingest::migrate(&mut conn).await.unwrap();
+    let run_id = ingest::create_run(&mut conn, "gmail_api", None)
+        .await
+        .unwrap();
+
+    let (status, body, _) =
+        post_valid(&state, &format!("/api/runs/{run_id}/cancel"), json!({})).await;
+    assert_eq!(status, StatusCode::CONFLICT);
+    assert_eq!(body["error"], "not_owned");
+
+    // And the log of a non-owned run is equally unavailable.
+    let (status, body, _) = get_json(&state, &format!("/api/runs/{run_id}/log")).await;
+    assert_eq!(status, StatusCode::NOT_FOUND);
+    assert_eq!(body["error"], "not_owned");
+}
+
+// ---------------------------------------------------------------------------
+// Supervision: crash → abandoned, SIGKILL escalation, restart, log ring
+// ---------------------------------------------------------------------------
+
+/// Run the real ingester (import) once, to completion; its startup janitor
+/// marks any stale open rows abandoned.
+fn run_real_import(db: &Path, mbox: &Path) {
+    let output = std::process::Command::new(REAL_INGESTER)
+        .arg("import")
+        .arg(mbox)
+        .arg("--quiet")
+        .arg("--db")
+        .arg(db)
+        .output()
+        .expect("running the real ingester");
+    assert!(
+        output.status.success(),
+        "real ingester failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
+
+#[tokio::test]
+async fn crashed_child_leaves_an_open_row_that_the_next_ingester_abandons() {
+    let dir = tempfile::tempdir().unwrap();
+    let db = dir.path().join("stats.db");
+    let mbox = write_mbox(dir.path());
+    set_fake_mode(dir.path(), "crash");
+    let state = state_for(&db);
+
+    let (status, body, _) = post_valid(
+        &state,
+        "/api/runs",
+        json!({ "source": "mbox", "path": mbox }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::ACCEPTED, "{body}");
+    let run_id = body["run_id"].as_i64().unwrap();
+
+    // The crash frees the flock but leaves the row open ('running').
+    wait_status(
+        &state,
+        |s| s["ingest_lock_held"] == false,
+        "crashed child to release the flock",
+    )
+    .await;
+    assert_eq!(run_state(&state, run_id).await.as_deref(), Some("running"));
+
+    // The next (real) ingester's janitor marks it abandoned.
+    set_fake_mode(dir.path(), "complete"); // irrelevant to the real binary
+    run_real_import(&db, &mbox);
+    assert_eq!(
+        run_state(&state, run_id).await.as_deref(),
+        Some("abandoned")
+    );
+}
+
+#[tokio::test]
+async fn sigterm_ignoring_child_is_sigkilled_and_later_abandoned() {
+    let dir = tempfile::tempdir().unwrap();
+    let db = dir.path().join("stats.db");
+    let mbox = write_mbox(dir.path());
+    set_fake_mode(dir.path(), "hang_ignore");
+    let state = state_for(&db); // 400ms SIGTERM→SIGKILL grace
+
+    let (status, body, _) = post_valid(
+        &state,
+        "/api/runs",
+        json!({ "source": "mbox", "path": mbox }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::ACCEPTED, "{body}");
+    let run_id = body["run_id"].as_i64().unwrap();
+
+    let (status, _, _) = post_valid(&state, &format!("/api/runs/{run_id}/cancel"), json!({})).await;
+    assert_eq!(status, StatusCode::ACCEPTED);
+
+    // SIGTERM is ignored; after the grace the viewer SIGKILLs it, which the
+    // kernel proves by releasing the flock. The row stays open (the child
+    // never got to write a terminal state)...
+    wait_status(
+        &state,
+        |s| s["ingest_lock_held"] == false,
+        "SIGKILL escalation to reap the child",
+    )
+    .await;
+    assert_eq!(run_state(&state, run_id).await.as_deref(), Some("running"));
+
+    // ...until the next ingester's janitor marks it abandoned.
+    run_real_import(&db, &mbox);
+    assert_eq!(
+        run_state(&state, run_id).await.as_deref(),
+        Some("abandoned")
+    );
+}
+
+#[tokio::test]
+async fn viewer_restart_loses_ownership_but_not_the_run() {
+    let dir = tempfile::tempdir().unwrap();
+    let db = dir.path().join("stats.db");
+    let mbox = write_mbox(dir.path());
+    set_fake_mode(dir.path(), "hang_trap");
+    let old_viewer = state_for(&db);
+
+    let (status, body, _) = post_valid(
+        &old_viewer,
+        "/api/runs",
+        json!({ "source": "mbox", "path": mbox }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::ACCEPTED, "{body}");
+    let run_id = body["run_id"].as_i64().unwrap();
+
+    // A "restarted" viewer: fresh state over the same database. The child
+    // keeps running (kill_on_drop=false, still holds the flock), but the new
+    // viewer does not own it: no cancel, no log.
+    let new_viewer = state_for(&db);
+    let status_doc = wait_status(
+        &new_viewer,
+        |s| s["active_run"]["run_id"].as_i64() == Some(run_id),
+        "restarted viewer to see the run",
+    )
+    .await;
+    assert_eq!(status_doc["owns_active_run"], false);
+    assert_eq!(status_doc["ingest_lock_held"], true);
+
+    let (status, body, _) = post_valid(
+        &new_viewer,
+        &format!("/api/runs/{run_id}/cancel"),
+        json!({}),
+    )
+    .await;
+    assert_eq!(status, StatusCode::CONFLICT);
+    assert_eq!(body["error"], "not_owned");
+    let (status, _, _) = get_json(&new_viewer, &format!("/api/runs/{run_id}/log")).await;
+    assert_eq!(status, StatusCode::NOT_FOUND);
+
+    // The original viewer still owns it and can clean up.
+    let (status, _, _) = post_valid(
+        &old_viewer,
+        &format!("/api/runs/{run_id}/cancel"),
+        json!({}),
+    )
+    .await;
+    assert_eq!(status, StatusCode::ACCEPTED);
+    wait_status(
+        &old_viewer,
+        |s| s["active_run"].is_null() && s["ingest_lock_held"] == false,
+        "cancelled child to exit",
+    )
+    .await;
+    assert_eq!(
+        run_state(&old_viewer, run_id).await.as_deref(),
+        Some("cancelled")
+    );
+}
+
+#[tokio::test]
+async fn log_endpoint_serves_the_last_200_stderr_lines_of_owned_runs() {
+    let dir = tempfile::tempdir().unwrap();
+    let db = dir.path().join("stats.db");
+    let mbox = write_mbox(dir.path());
+    set_fake_mode(dir.path(), "stderr"); // emits 250 lines, then hangs
+    let state = state_for(&db);
+
+    let (status, body, _) = post_valid(
+        &state,
+        "/api/runs",
+        json!({ "source": "mbox", "path": mbox }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::ACCEPTED, "{body}");
+    let run_id = body["run_id"].as_i64().unwrap();
+
+    // Wait until the ring has filled to its 200-line cap.
+    let mut lines = Vec::new();
+    for _ in 0..100 {
+        let (status, body, _) = get_json(&state, &format!("/api/runs/{run_id}/log")).await;
+        assert_eq!(status, StatusCode::OK);
+        lines = body["lines"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|line| line.as_str().unwrap().to_string())
+            .collect();
+        if lines
+            .last()
+            .is_some_and(|last| last == "fake stderr line 250")
+        {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(50)).await;
+    }
+    assert_eq!(lines.len(), 200, "ring buffer is capped at 200 lines");
+    assert_eq!(lines.first().unwrap(), "fake stderr line 51");
+    assert_eq!(lines.last().unwrap(), "fake stderr line 250");
+
+    let (status, _, _) = post_valid(&state, &format!("/api/runs/{run_id}/cancel"), json!({})).await;
+    assert_eq!(status, StatusCode::ACCEPTED);
+    wait_status(&state, |s| s["active_run"].is_null(), "child to exit").await;
+}
+
+#[tokio::test]
+async fn missing_ingester_binary_is_spawn_failed_with_a_build_hint() {
+    let dir = tempfile::tempdir().unwrap();
+    let db = dir.path().join("stats.db");
+    let mbox = write_mbox(dir.path());
+    let state = Arc::new(AppState::configured(
+        &db,
+        dir.path().join("no-such-binary"),
+        Duration::from_millis(400),
+    ));
+
+    let (status, body, _) = post_valid(
+        &state,
+        "/api/runs",
+        json!({ "source": "mbox", "path": mbox }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR);
+    assert_eq!(body["error"], "spawn_failed");
+    assert!(
+        body["message"].as_str().unwrap().contains("cargo build"),
+        "spawn_failed must hint at cargo build: {body}"
+    );
+}
+
+#[tokio::test]
+async fn a_child_that_dies_before_reporting_a_run_is_spawn_failed() {
+    let dir = tempfile::tempdir().unwrap();
+    let db = dir.path().join("stats.db");
+    let mbox = write_mbox(dir.path());
+    set_fake_mode(dir.path(), "norow");
+    let state = state_for(&db);
+
+    let (status, body, _) = post_valid(
+        &state,
+        "/api/runs",
+        json!({ "source": "mbox", "path": mbox }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR);
+    assert_eq!(body["error"], "spawn_failed");
+    assert!(
+        body["message"].as_str().unwrap().contains("norow"),
+        "spawn_failed should carry the child's stderr tail: {body}"
+    );
+}
+
+#[tokio::test]
+async fn a_terminal_launched_ingester_beats_the_viewer_to_the_flock() {
+    // A terminal-started ingester holds the flock (no run row needed): the
+    // viewer's friendly pre-check turns the launch into 409 run_active.
+    let dir = tempfile::tempdir().unwrap();
+    let db = dir.path().join("stats.db");
+    let mbox = write_mbox(dir.path());
+    set_fake_mode(dir.path(), "complete");
+    let state = state_for(&db);
+
+    let _terminal_lock = ingest::acquire_ingest_lock(&db).unwrap();
+    let (status, body, _) = post_valid(
+        &state,
+        "/api/runs",
+        json!({ "source": "mbox", "path": mbox }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::CONFLICT, "{body}");
+    assert_eq!(body["error"], "run_active");
+}
+
+#[tokio::test]
+async fn losing_the_flock_race_after_the_precheck_is_still_409() {
+    // The TOCTOU window: the pre-check passes (lock free), but the child
+    // loses the authoritative flock race and exits with the lock message.
+    // The viewer maps that to 409 run_active, not spawn_failed.
+    let dir = tempfile::tempdir().unwrap();
+    let db = dir.path().join("stats.db");
+    let mbox = write_mbox(dir.path());
+    set_fake_mode(dir.path(), "flockfail");
+    let state = state_for(&db);
+
+    let (status, body, _) = post_valid(
+        &state,
+        "/api/runs",
+        json!({ "source": "mbox", "path": mbox }),
+    )
+    .await;
+    assert_eq!(status, StatusCode::CONFLICT, "{body}");
+    assert_eq!(body["error"], "run_active");
+}
diff --git a/web/app.css b/web/app.css
index 45cf7e6..d46ede7 100644
--- a/web/app.css
+++ b/web/app.css
@@ -233,6 +233,63 @@ tr.hidden-row td.act { opacity: 1; }
   color: var(--muted);
 }
 
+/* --- Phase C: launch, cancel, and consent --------------------------------- */
+
+.launch { display: flex; gap: 0.5rem; align-items: center; flex-wrap: wrap; margin: 0.6rem 0; }
+.launch input[type="text"] {
+  font: inherit;
+  color: var(--fg);
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  padding: 0.4rem 0.7rem;
+  flex: 1 1 16rem;
+  min-width: 12rem;
+}
+.launch input[type="text"]:focus { outline: none; border-color: var(--accent); }
+button.primary {
+  border-color: var(--accent);
+  background: var(--accent);
+  color: #fff;
+}
+button.primary:hover { color: #fff; opacity: 0.9; }
+button.primary:disabled, button:disabled { opacity: 0.5; cursor: default; }
+button.danger { border-color: #dc2626; color: #dc2626; }
+button.danger:hover { background: #dc2626; color: #fff; }
+.inline-error {
+  flex-basis: 100%;
+  color: #dc2626;
+  font-size: 0.85rem;
+  margin: 0.25rem 0 0;
+  overflow-wrap: anywhere;
+}
+.alt-cmd { font-size: 0.85rem; margin: 0.6rem 0 0; }
+.run-actions { display: flex; gap: 0.5rem; margin-top: 0.5rem; }
+.auth-slot { overflow-wrap: anywhere; }
+.auth-slot a { color: var(--accent); font-weight: 600; }
+pre.log {
+  max-height: 16rem;
+  overflow-y: auto;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+  margin-top: 0.6rem;
+}
+.history-actions {
+  flex-basis: 100%;
+  display: flex;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+}
+.history-actions button { font-size: 0.85rem; padding: 0.2rem 0.7rem; }
+.card.flash {
+  animation: card-flash 1.6s ease-out;
+  border-color: var(--accent);
+}
+@keyframes card-flash {
+  0% { box-shadow: 0 0 0 3px color-mix(in srgb, var(--accent) 55%, transparent); }
+  100% { box-shadow: 0 0 0 0 transparent; }
+}
+
 #history { margin-top: 1.5rem; }
 .history-title { font-size: 1rem; margin: 0 0 0.5rem; color: var(--muted); }
 #history-list { list-style: none; margin: 0; padding: 0; }
diff --git a/web/app.js b/web/app.js
index d70e25f..8d45364 100644
--- a/web/app.js
+++ b/web/app.js
@@ -34,12 +34,16 @@ const state = {
   showHidden: false,
   hidden: loadHidden(),
   view: "loading",
+  // Keeps the setup view visible even when data exists: the "use Takeout
+  // instead" deep-link from a policy_enforced failure lands on its card.
+  pinnedSetup: false,
 };
 
-// Everything the observe-only ingestion UI knows, all viewer-side.
+// Everything the ingestion UI knows, all viewer-side.
 const ingest = {
   // False once /api/status turns out not to exist (the static Pages demo, or
-  // any non-viewer host): every piece of ingestion UI hides and polling stops.
+  // any non-viewer host): every piece of ingestion UI hides, polling stops,
+  // and no mutating request is ever attempted.
   available: true,
   status: null,
   runsNow: 0,
@@ -48,6 +52,10 @@ const ingest = {
   lastSummaryAt: 0,
   runsKey: null,
   wasActive: false,
+  // CSRF token from the latest /api/status payload; sent on every POST.
+  csrf: null,
+  launching: false,
+  logOpen: false,
 };
 
 function loadPageSize() {
@@ -191,6 +199,161 @@ function hideIngestUi() {
   document.getElementById("ingest-panel").classList.add("hidden");
   document.getElementById("history").classList.add("hidden");
   document.getElementById("mixed-banner").classList.add("hidden");
+  // Launch controls exist only against the live viewer: without a status
+  // endpoint there is no CSRF token and no spawn surface.
+  for (const el of document.querySelectorAll(".live-only")) {
+    el.classList.add("hidden");
+  }
+}
+
+// --- mutating calls (Phase C) ----------------------------------------------
+
+// Every mutating request carries the full client side of the CSRF stack:
+// JSON content type plus the per-process token learned from /api/status.
+// (The browser adds Origin/Sec-Fetch-Site itself.)
+async function apiPost(path, body) {
+  if (!ingest.available || !ingest.csrf) {
+    throw new Error("ingestion API unavailable");
+  }
+  return fetch(path, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "X-Gmail-Stats-Csrf": ingest.csrf,
+    },
+    body: JSON.stringify(body),
+  });
+}
+
+// Start a run and surface any error inline (all error text via textContent).
+async function startRun(body, errorEl) {
+  if (ingest.launching) return;
+  ingest.launching = true;
+  if (errorEl) errorEl.classList.add("hidden");
+  try {
+    const response = await apiPost("/api/runs", body);
+    if (response.status === 202) {
+      state.pinnedSetup = false;
+      pollStatus();
+      return;
+    }
+    let payload = null;
+    try {
+      payload = await response.json();
+    } catch (err) {
+      // non-JSON error body; fall through to the generic message
+    }
+    if (errorEl) {
+      errorEl.textContent =
+        (payload && payload.message) || `Could not start the run (HTTP ${response.status}).`;
+      errorEl.classList.remove("hidden");
+    }
+  } catch (err) {
+    if (errorEl) {
+      errorEl.textContent = "Could not reach the server.";
+      errorEl.classList.remove("hidden");
+    }
+  } finally {
+    ingest.launching = false;
+  }
+}
+
+async function cancelActiveRun() {
+  const run = activeRun();
+  if (!run || !ingest.status || ingest.status.owns_active_run !== true) return;
+  const errorEl = document.getElementById("cancel-error");
+  errorEl.classList.add("hidden");
+  try {
+    const response = await apiPost(`/api/runs/${Number(run.run_id)}/cancel`, {});
+    if (response.status !== 202) {
+      let payload = null;
+      try {
+        payload = await response.json();
+      } catch (err) {
+        // keep the generic message
+      }
+      errorEl.textContent =
+        (payload && payload.message) || `Cancel failed (HTTP ${response.status}).`;
+      errorEl.classList.remove("hidden");
+    }
+    pollStatus();
+  } catch (err) {
+    errorEl.textContent = "Could not reach the server.";
+    errorEl.classList.remove("hidden");
+  }
+}
+
+async function refreshLog() {
+  const run = activeRun();
+  const view = document.getElementById("run-log-view");
+  if (!run || !ingest.logOpen) return;
+  try {
+    const response = await fetch(`/api/runs/${Number(run.run_id)}/log`);
+    if (!response.ok) return;
+    const body = await response.json();
+    const lines = Array.isArray(body.lines) ? body.lines : [];
+    view.textContent = lines.length > 0 ? lines.join("\n") : "(no stderr output yet)";
+  } catch (err) {
+    // Leave whatever is shown; the next poll retries.
+  }
+}
+
+// Deep-link a policy_enforced failure to the Takeout card: pin the setup view
+// open (even when data already exists) and flash the card.
+function showTakeoutCard() {
+  state.pinnedSetup = true;
+  showView("setup");
+  const card = document.getElementById("takeout-card");
+  card.classList.remove("flash");
+  // Restart the highlight animation on repeat clicks.
+  void card.offsetWidth;
+  card.classList.add("flash");
+  card.scrollIntoView({ behavior: "smooth", block: "center" });
+}
+
+/// The only URL the UI will ever hyperlink: a Google consent URL. Anything
+/// else (however it got into auth_url) renders as inert text.
+function isGoogleAuthUrl(url) {
+  if (typeof url !== "string" || !url.startsWith("https://accounts.google.com/")) {
+    return false;
+  }
+  try {
+    return new URL(url).origin === "https://accounts.google.com";
+  } catch (err) {
+    return false;
+  }
+}
+
+function renderAuthSlot(run) {
+  const slot = document.getElementById("run-auth");
+  if (!run || run.state !== "awaiting_auth") {
+    slot.classList.add("hidden");
+    slot.replaceChildren();
+    return;
+  }
+  slot.replaceChildren();
+  const label = document.createElement("span");
+  label.textContent = "Google is waiting for your consent: ";
+  slot.appendChild(label);
+  const url = run.auth_url;
+  if (isGoogleAuthUrl(url)) {
+    const link = document.createElement("a");
+    link.href = url;
+    link.target = "_blank";
+    link.rel = "noopener noreferrer";
+    link.textContent = "Authorize in Google";
+    slot.appendChild(link);
+  } else if (url) {
+    // Unexpected URL: show it as inert text, never as a link.
+    const inert = document.createElement("span");
+    inert.textContent = String(url);
+    slot.appendChild(inert);
+  } else {
+    const waiting = document.createElement("span");
+    waiting.textContent = "waiting for the consent URL…";
+    slot.appendChild(waiting);
+  }
+  slot.classList.remove("hidden");
 }
 
 function renderPill() {
@@ -220,6 +383,9 @@ function renderPanel() {
   const panel = document.getElementById("ingest-panel");
   if (!ingestActive()) {
     panel.classList.add("hidden");
+    ingest.logOpen = false;
+    document.getElementById("run-log-view").classList.add("hidden");
+    document.getElementById("run-log").textContent = "Show log";
     return;
   }
   const run = activeRun();
@@ -269,9 +435,21 @@ function renderPanel() {
     stalled.classList.add("hidden");
   }
 
-  // Phase B never owns a run (owns_active_run is always false): every run was
-  // started from a terminal, and that's where it can be cancelled.
-  document.getElementById("run-origin").textContent = status.owns_active_run
+  renderAuthSlot(run);
+
+  // Cancel and Log exist only for runs this viewer process spawned; a
+  // terminal-started (or pre-restart) run is watch-only here.
+  const owned = status.owns_active_run === true && Boolean(run);
+  document.getElementById("run-cancel").classList.toggle("hidden", !owned);
+  document.getElementById("run-log").classList.toggle("hidden", !owned);
+  if (!owned) {
+    ingest.logOpen = false;
+    document.getElementById("run-log-view").classList.add("hidden");
+    document.getElementById("run-log").textContent = "Show log";
+  } else if (ingest.logOpen) {
+    refreshLog();
+  }
+  document.getElementById("run-origin").textContent = owned
     ? ""
     : "Started from the terminal — cancel it with Ctrl-C there.";
 
@@ -307,9 +485,63 @@ function historyItem(run, nowUnix) {
     error.textContent = run.error_kind ? `${run.error_kind}: ${run.error}` : run.error;
     li.appendChild(error);
   }
+
+  const actions = historyActions(run);
+  if (actions) li.appendChild(actions);
   return li;
 }
 
+// Retry/Resume affordances for finished runs (issue #26): interrupted imports
+// resume from their byte offset (fingerprint-validated by the ingester);
+// failed scans get a best-effort resume from the persisted page token; and
+// policy_enforced steers to the Takeout card. Only rendered against the live
+// viewer, and only while nothing is running.
+function historyActions(run) {
+  if (!ingest.available || ingestActive()) return null;
+  const finished = ["failed", "cancelled", "abandoned"].includes(run.state);
+  if (!finished) return null;
+
+  const actions = document.createElement("div");
+  actions.className = "history-actions";
+  const addButton = (label, body) => {
+    const btn = document.createElement("button");
+    btn.type = "button";
+    btn.textContent = label;
+    btn.addEventListener("click", () => startRun(body, null));
+    actions.appendChild(btn);
+  };
+
+  if (run.source === "mbox") {
+    if (Number(run.bytes_done) > 0 && run.mbox_path) {
+      addButton("Resume import", { source: "mbox", resume_run_id: Number(run.run_id) });
+    } else if (run.mbox_path) {
+      addButton("Retry", { source: "mbox", path: String(run.mbox_path) });
+    }
+  } else if (run.source === "gmail_api") {
+    if (run.state === "failed" || run.state === "abandoned") {
+      addButton("Retry", { source: "gmail_api" });
+    }
+    if (Number(run.messages_seen) > 0) {
+      addButton("Resume — may restart from the beginning", {
+        source: "gmail_api",
+        resume_run_id: Number(run.run_id),
+      });
+    } else if (run.state === "cancelled") {
+      addButton("Start again", { source: "gmail_api" });
+    }
+  }
+
+  if (run.error_kind === "policy_enforced") {
+    const btn = document.createElement("button");
+    btn.type = "button";
+    btn.textContent = "Use Takeout instead →";
+    btn.addEventListener("click", showTakeoutCard);
+    actions.appendChild(btn);
+  }
+
+  return actions.childElementCount > 0 ? actions : null;
+}
+
 function renderHistory(runs, nowUnix) {
   const section = document.getElementById("history");
   const list = document.getElementById("history-list");
@@ -346,12 +578,13 @@ async function fetchRuns() {
 // status changes can flip it: onboarding appears when the DB is missing/empty
 // and idle, and leaves as soon as a run starts or data exists.
 function reconcileMainView() {
-  if (shouldOnboard()) {
+  if (shouldOnboard() || (state.pinnedSetup && !ingestActive())) {
     if (state.view === "stats" || state.view === "setup" || state.view === "loading") {
       showView("setup");
     }
     return;
   }
+  state.pinnedSetup = false;
   if (state.view === "setup") {
     // Onboarding no longer applies (a run started, or data appeared).
     if (state.data) {
@@ -367,6 +600,11 @@ function renderIngest() {
     hideIngestUi();
     return;
   }
+  // Live viewer confirmed: reveal the launch controls (they start hidden so
+  // the static demo never shows them, even before the first status probe).
+  for (const el of document.querySelectorAll(".live-only")) {
+    el.classList.toggle("hidden", !ingest.status);
+  }
   renderPill();
   renderPanel();
   document
@@ -429,6 +667,7 @@ async function pollStatus() {
   }
 
   ingest.status = body;
+  ingest.csrf = typeof body.csrf_token === "string" ? body.csrf_token : null;
   renderIngest();
 
   const key = runsKeyOf(body);
@@ -491,7 +730,7 @@ async function refreshSummary() {
 }
 
 function update() {
-  if (shouldOnboard()) {
+  if (shouldOnboard() || (state.pinnedSetup && !ingestActive())) {
     showView("setup");
     return;
   }
@@ -582,8 +821,44 @@ async function load() {
   update();
 }
 
-document.getElementById("retry-setup").addEventListener("click", load);
+document.getElementById("retry-setup").addEventListener("click", () => {
+  state.pinnedSetup = false;
+  load();
+});
 document.getElementById("retry-error").addEventListener("click", load);
+
+// Launch buttons (Phase C). Guarded by ingest.available: they are hidden —
+// and inert — on static hosting.
+document.getElementById("start-scan").addEventListener("click", () => {
+  if (!ingest.available) return;
+  startRun({ source: "gmail_api" }, document.getElementById("scan-error"));
+});
+document.getElementById("start-import").addEventListener("click", () => {
+  if (!ingest.available) return;
+  const path = document.getElementById("mbox-path").value.trim();
+  const errorEl = document.getElementById("import-error");
+  if (!path) {
+    errorEl.textContent = "Paste the absolute path to the .mbox file first.";
+    errorEl.classList.remove("hidden");
+    return;
+  }
+  startRun({ source: "mbox", path }, errorEl);
+});
+document.getElementById("mbox-path").addEventListener("keydown", event => {
+  if (event.key === "Enter") document.getElementById("start-import").click();
+});
+document.getElementById("run-cancel").addEventListener("click", cancelActiveRun);
+document.getElementById("run-log").addEventListener("click", () => {
+  ingest.logOpen = !ingest.logOpen;
+  const view = document.getElementById("run-log-view");
+  const btn = document.getElementById("run-log");
+  view.classList.toggle("hidden", !ingest.logOpen);
+  btn.textContent = ingest.logOpen ? "Hide log" : "Show log";
+  if (ingest.logOpen) {
+    view.textContent = "Loading…";
+    refreshLog();
+  }
+});
 document.getElementById("search").addEventListener("input", event => {
   state.query = event.target.value;
   state.page = 1;
diff --git a/web/index.html b/web/index.html
index ed07cda..bcd490f 100644
--- a/web/index.html
+++ b/web/index.html
@@ -22,19 +22,23 @@ <h1>gmail-stats <span>· local viewer</span></h1>
   </section>
 
   <!-- Onboarding: shown when the database is missing or empty and nothing is
-       running. Phase B is observe-only, so these cards show the exact CLI
-       commands to copy; launch buttons arrive in Phase C. -->
+       running. The launch buttons (Phase C) only appear when the live viewer's
+       status endpoint exists; static hosting keeps the copyable CLI commands. -->
   <section id="setup" class="notice hidden">
     <h2>No mail data yet</h2>
-    <p>Get your Gmail data into <code>stats.db</code> one of two ways, running the
-       command from the repo root in a terminal. Once a run starts, this page
-       notices it and fills in live.</p>
+    <p>Get your Gmail data into <code>stats.db</code> one of two ways. Once a
+       run starts, this page follows it live.</p>
     <div class="cards">
       <div class="card">
         <h3>Scan Gmail (OAuth)</h3>
         <p>Reads message metadata over the Gmail API. Needs a Google Cloud OAuth
            client (<code>credentials.json</code> in the repo root) plus a one-time
            browser consent.</p>
+        <div class="launch live-only hidden">
+          <button id="start-scan" type="button" class="primary">Start scan</button>
+          <p id="scan-error" class="inline-error hidden"></p>
+        </div>
+        <p class="muted alt-cmd">Or from a terminal, in the repo root:</p>
         <div class="cmd">
           <pre>cargo run</pre>
           <button class="copy-btn" type="button">Copy</button>
@@ -43,7 +47,7 @@ <h3>Scan Gmail (OAuth)</h3>
            outright (<code>Error 400: policy_enforced</code>) — use the Takeout
            import instead.</p>
       </div>
-      <div class="card">
+      <div id="takeout-card" class="card">
         <h3>Import a Google Takeout mailbox</h3>
         <ol>
           <li>At <code>takeout.google.com</code>, export only <strong>Mail</strong>
@@ -53,6 +57,13 @@ <h3>Import a Google Takeout mailbox</h3>
               accounts.</li>
           <li>Download, unzip, and import the <code>.mbox</code> file:</li>
         </ol>
+        <div class="launch live-only hidden">
+          <input id="mbox-path" type="text" autocomplete="off" spellcheck="false"
+                 placeholder="/absolute/path/to/All mail Including Spam and Trash.mbox">
+          <button id="start-import" type="button" class="primary">Import</button>
+          <p id="import-error" class="inline-error hidden"></p>
+        </div>
+        <p class="muted alt-cmd">Or from a terminal, in the repo root:</p>
         <div class="cmd">
           <pre>cargo run -- import "path/to/All mail Including Spam and Trash.mbox"</pre>
           <button class="copy-btn" type="button">Copy</button>
@@ -68,7 +79,8 @@ <h2>Something went wrong</h2>
     <button id="retry-error" type="button">Retry</button>
   </section>
 
-  <!-- Observe-only progress panel for the active ingestion run. -->
+  <!-- Progress panel for the active ingestion run. Cancel and Log only appear
+       for runs this viewer process spawned (owns_active_run). -->
   <section id="ingest-panel" class="notice hidden">
     <details open>
       <summary>
@@ -82,8 +94,15 @@ <h2>Something went wrong</h2>
           <span id="run-rate" class="muted"></span>
           <span id="run-eta" class="muted"></span>
         </p>
+        <p class="auth-slot hidden" id="run-auth"></p>
         <p class="warn hidden" id="run-stalled"></p>
         <p class="muted" id="run-origin"></p>
+        <div class="run-actions">
+          <button id="run-cancel" type="button" class="danger hidden">Cancel</button>
+          <button id="run-log" type="button" class="hidden">Show log</button>
+        </div>
+        <p id="cancel-error" class="inline-error hidden"></p>
+        <pre id="run-log-view" class="log hidden"></pre>
       </div>
     </details>
   </section>