diff --git a/.claude/workflows/bughunt.js b/.claude/workflows/bughunt.js
index 1f84fb77..c90df999 100644
--- a/.claude/workflows/bughunt.js
+++ b/.claude/workflows/bughunt.js
@@ -120,7 +120,7 @@ Method:
      structural reference is evidence of coupling, not of a bug; open the cited file and confirm.
   2. For every candidate, grep for ALL callers before judging - a guard may already live upstream.
   3. Check whether an existing test already locks the behavior you think is wrong. If a test asserts it,
-     it is intended behavior, not a bug. Test files are *_test.go and tests/unit/*.test.ts.
+     it is intended behavior, not a bug. Test files are *_test.go, tests/unit/*.test.ts and tests/contract/*.test.ts.
   4. Report EVERY finding you can prove - there is no cap. The quality bar stays: zero findings is a
      valid, respectable answer, and each finding needs file, line, and a concrete repro.
 
@@ -200,7 +200,7 @@ const SURFACE_LENSES = [
       `an entity when events arrive out of order; read-state that can mark unread messages read, or lose an unread ` +
       `count, across a reconnect; an async handler whose await lets stale state be written after a newer update ` +
       `(last-write-wins race); a route guard bypassable by a rapid navigation sequence.\n` +
-      `Check tests/unit/ before reporting - much of this behavior is already test-locked.`,
+      `Check tests/unit/ and tests/contract/ before reporting - much of this behavior is already test-locked.`,
   },
 ];
 
diff --git a/.superpowers/FINDINGS.md b/.superpowers/FINDINGS.md
index c72d917f..b0c99e22 100644
--- a/.superpowers/FINDINGS.md
+++ b/.superpowers/FINDINGS.md
@@ -4742,7 +4742,7 @@ saveChannelPerms writes the quick "Can access" toggles first (PUT allow=0/deny=0
 
 **Suggested fix:** In saveChannelPerms, record the role IDs the quick-toggle loop actually wrote and skip the matrix step when the selected target is one of them — one guard in the one function: collect `const touched=new Set()` in the loop (add role.role_id on each PUT/DELETE), then wrap the matrix block in `if(path && !(permTargetPath().indexOf('/permissions/')>-1 && touched.has(tid)))`. Cleanest variant: give the quick checkbox an onchange that patches the in-memory role.allow/role.deny in state.permChannel and calls renderPermMatrix(), so the matrix always reflects the pending toggle instead of the stale snapshot.
 
-**Fixed:** `69258a51` · test `Client/tests/unit/admin-static-channel-perms.test.ts` · revert-proof pass
+**Fixed:** `69258a51` · test `Client/tests/contract/server-admin-static-channel-perms.test.ts` · revert-proof pass
 
 ### OC-0155 — medium — Room-key offer pacing budget is per-call, so two back-to-back rotations blow the server's per-second offer cap and strand peers on a dead key
 
diff --git a/.superpowers/findings-ledger.json b/.superpowers/findings-ledger.json
index 3d2fa671..a50fb0c0 100644
--- a/.superpowers/findings-ledger.json
+++ b/.superpowers/findings-ledger.json
@@ -3775,7 +3775,7 @@
       "confidence": "high",
       "fix": {
         "commit": "69258a51",
-        "test": "Client/tests/unit/admin-static-channel-perms.test.ts",
+        "test": "Client/tests/contract/server-admin-static-channel-perms.test.ts",
         "revertProof": "pass"
       },
       "suggestedFix": "In saveChannelPerms, record the role IDs the quick-toggle loop actually wrote and skip the matrix step when the selected target is one of them — one guard in the one function: collect `const touched=new Set()` in the loop (add role.role_id on each PUT/DELETE), then wrap the matrix block in `if(path && !(permTargetPath().indexOf('/permissions/')>-1 && touched.has(tid)))`. Cleanest variant: give the quick checkbox an onchange that patches the in-memory role.allow/role.deny in state.permChannel and calls renderPermMatrix(), so the matrix always reflects the pending toggle instead of the stale snapshot.",
diff --git a/Client/CLAUDE.md b/Client/CLAUDE.md
index 21b48b2e..83e151cf 100644
--- a/Client/CLAUDE.md
+++ b/Client/CLAUDE.md
@@ -9,8 +9,13 @@ Rust backend in `src-tauri/` for native APIs only. LiveKit handles voice/video.
   `src/pages/`, `src/components/` UI
 - `src/lib/protocolTypes.ts` and `src/generated/` are generated — see the root
   CLAUDE.md
-- `tests/unit`, `tests/integration` (vitest, jsdom) · `tests/e2e` (Playwright) ·
+- `tests/unit`, `tests/integration`, `tests/contract` (vitest, jsdom) ·
+  `tests/e2e`, `tests/e2e/admin`, `tests/e2e/native` (Playwright) ·
   `tests/browser` (vitest browser mode)
+- A test whose assertions read, import or execute a **`Server/`-owned**
+  artifact belongs in `tests/contract`, not `tests/unit` — `src-tauri/` is
+  part of this component, so reading it is an ordinary unit test. The rule
+  is in [docs/contributing.md](../docs/contributing.md#testing)
 
 ## Gotchas
 
diff --git a/Client/package.json b/Client/package.json
index 2aa7d88d..18ecad58 100644
--- a/Client/package.json
+++ b/Client/package.json
@@ -15,6 +15,7 @@
     "test": "vitest run",
     "test:unit": "vitest run tests/unit",
     "test:integration": "vitest run tests/integration",
+    "test:contract": "vitest run tests/contract",
     "test:e2e": "playwright test",
     "test:e2e:prod": "npm run build && playwright test --config playwright.config.prod.ts",
     "test:e2e:native": "playwright test --config playwright.config.native.ts",
diff --git a/Client/tests/unit/admin-static-channel-perms.test.ts b/Client/tests/contract/server-admin-static-channel-perms.test.ts
similarity index 91%
rename from Client/tests/unit/admin-static-channel-perms.test.ts
rename to Client/tests/contract/server-admin-static-channel-perms.test.ts
index 455804fa..d15fa0a8 100644
--- a/Client/tests/unit/admin-static-channel-perms.test.ts
+++ b/Client/tests/contract/server-admin-static-channel-perms.test.ts
@@ -1,3 +1,8 @@
+// CONTRACT TEST. The artifact under test is owned by Server/admin; the runner
+// lives here because placement follows capability, not ownership — the Go
+// module carries no JavaScript engine, so nothing under Server/ can execute
+// this SPA. See docs/contributing.md#testing for the membership rule.
+//
 // Loads the real Server/admin/static/index.html (the Go admin panel's
 // single-file SPA) into a scripted jsdom window and drives its inline
 // channel-permissions logic directly, the same way a browser would.
@@ -5,6 +10,9 @@
 // There is no bundler or module system for this file — it is one inline
 // <script> executed as a classic script — so the only faithful way to test
 // it is to actually run it, not to re-implement its logic in TypeScript.
+// A text-level assertion is not a substitute: Server/admin/perm_grid_test.go
+// greps the same file, but flipping the guard at index.html:1182 to `false`
+// reintroduces the bug while leaving every greppable identifier intact.
 import { describe, it, expect, afterEach } from "vitest";
 import { JSDOM } from "jsdom";
 import { readFileSync } from "node:fs";
diff --git a/Client/tests/e2e/helpers.ts b/Client/tests/e2e/helpers.ts
index fb7bd0d7..a63ee3e2 100644
--- a/Client/tests/e2e/helpers.ts
+++ b/Client/tests/e2e/helpers.ts
@@ -345,10 +345,10 @@ export function chatEchoHandlers(): Array<{ type: string; handler: string }> {
 /**
  * Voice WS flow handlers for E2E testing.
  * Simulates the server-side voice protocol defined in:
- *   docs/brain/06-Specs/PROTOCOL.md (voice_join, voice_leave, voice_token, voice_token_refresh)
+ *   docs/protocol.md (voice_join, voice_leave, voice_token, voice_token_refresh)
  *   protocol/schema.json (message type schemas)
  *
- * When PROTOCOL.md voice message types change, update these handlers to match.
+ * When docs/protocol.md voice message types change, update these handlers to match.
  */
 export function voiceWsHandlers(): Array<{ type: string; handler: string }> {
   return [
diff --git a/Client/tests/types/jsdom.d.ts b/Client/tests/types/jsdom.d.ts
index bb83e303..beb8234a 100644
--- a/Client/tests/types/jsdom.d.ts
+++ b/Client/tests/types/jsdom.d.ts
@@ -1,6 +1,8 @@
 // jsdom ships no type declarations and @types/jsdom is not a dependency of
-// this project. Declare the surface the admin-panel test actually uses,
-// following the same pattern as src/types/jitsi-rnnoise.d.ts.
+// this project. Declare the surface the tests/contract/ admin-SPA test
+// actually uses, following the same pattern as src/types/jitsi-rnnoise.d.ts.
+// (jsdom itself stays a required dependency regardless: vitest.config.ts
+// sets environment: "jsdom" for the whole suite.)
 declare module "jsdom" {
   export interface JSDOMOptions {
     url?: string;
diff --git a/Client/tests/unit/capabilities-scope.test.ts b/Client/tests/unit/capabilities-scope.test.ts
index 5e3cddcc..acea39f2 100644
--- a/Client/tests/unit/capabilities-scope.test.ts
+++ b/Client/tests/unit/capabilities-scope.test.ts
@@ -10,6 +10,9 @@
 
 import { describe, expect, it } from "vitest";
 
+// Asserts src-tauri/capabilities/default.json, which is inside the Client
+// component — not a cross-component contract test. See
+// docs/contributing.md#testing.
 import capabilityJson from "../../src-tauri/capabilities/default.json";
 
 interface ScopeEntry {
diff --git a/Client/tests/unit/tauri-conf-webview2-args.test.ts b/Client/tests/unit/tauri-conf-webview2-args.test.ts
index a282ca17..433b756a 100644
--- a/Client/tests/unit/tauri-conf-webview2-args.test.ts
+++ b/Client/tests/unit/tauri-conf-webview2-args.test.ts
@@ -12,6 +12,8 @@
 
 import { describe, expect, it } from "vitest";
 
+// Asserts src-tauri/tauri.conf.json, which is inside the Client component —
+// not a cross-component contract test. See docs/contributing.md#testing.
 import tauriConf from "../../src-tauri/tauri.conf.json";
 
 describe("tauri.conf.json — Windows WebView2 additionalBrowserArgs", () => {
diff --git a/Client/tests/unit/types.test.ts b/Client/tests/unit/types.test.ts
index f526808c..bb40cc31 100644
--- a/Client/tests/unit/types.test.ts
+++ b/Client/tests/unit/types.test.ts
@@ -10,7 +10,7 @@ import type {
 } from "../../src/lib/types";
 import { Permission as P } from "../../src/lib/types";
 
-// Sample PROTOCOL.md JSON payloads for parsing validation
+// Sample docs/protocol.md JSON payloads for parsing validation
 const sampleAuthOk = {
   type: "auth_ok" as const,
   payload: {
diff --git a/Server/CLAUDE.md b/Server/CLAUDE.md
index 577b2064..e83fb7b8 100644
--- a/Server/CLAUDE.md
+++ b/Server/CLAUDE.md
@@ -22,6 +22,11 @@ prometheus.
 - Build tags gate whole files, so all four variants must compile: default,
   `-tags otel`, `-tags wazero`, `-tags otel,wazero`. Tests must also pass under
   `-race` and under `-tags deadlock`. The `ci-check` skill has the commands.
+- `admin/static/index.html` is server-owned, and its invariants are locked from
+  two places: text-level ones from `admin/perm_grid_test.go` and
+  `admin/emoji_section_test.go`, execution-level ones from
+  `Client/tests/contract/` — Go has no JS engine, so a Go port could only grep.
+  Do not "fix" that split by rewriting the contract test as a regex.
 - `ws` is the hub: broadcast fan-out, per-client send queues, replay, and voice
   state all interact under several locks. Sequenced frames share one per-client
   FIFO because clients ack only `max(seq)` — a frame that skips the queue, or a
diff --git a/Server/updater/tauri_key_contract_test.go b/Server/updater/tauri_key_contract_test.go
new file mode 100644
index 00000000..3f5dc1ea
--- /dev/null
+++ b/Server/updater/tauri_key_contract_test.go
@@ -0,0 +1,37 @@
+package updater
+
+// CONTRACT TEST. It reads an artifact owned by the Client component
+// (Client/src-tauri/tauri.conf.json) but asserts a Server constant, using the
+// client value only as a reference — so placement stays here, in the package
+// that owns the assertion, and only the file name has to declare the crossing.
+// See docs/contributing.md#testing for the membership rule.
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestDefaultServerSignaturePublicKey_DiffersFromTauriUpdaterKey(t *testing.T) {
+	tauriConfigPath := filepath.Clean(filepath.Join("..", "..", "Client", "src-tauri", "tauri.conf.json"))
+	raw, err := os.ReadFile(tauriConfigPath)
+	if err != nil {
+		t.Fatalf("ReadFile(%s): %v", tauriConfigPath, err)
+	}
+
+	var cfg struct {
+		Plugins struct {
+			Updater struct {
+				PubKey string `json:"pubkey"`
+			} `json:"updater"`
+		} `json:"plugins"`
+	}
+	if err := json.Unmarshal(raw, &cfg); err != nil {
+		t.Fatalf("Unmarshal tauri.conf.json: %v", err)
+	}
+
+	if cfg.Plugins.Updater.PubKey == defaultServerSignaturePublicKey {
+		t.Fatalf("server updater signing key must differ from tauri.conf.json updater pubkey")
+	}
+}
diff --git a/Server/updater/updater_test.go b/Server/updater/updater_test.go
index 26342929..0c3d204a 100644
--- a/Server/updater/updater_test.go
+++ b/Server/updater/updater_test.go
@@ -627,29 +627,6 @@ func TestAssetFilenameFromURL(t *testing.T) {
 	}
 }
 
-func TestDefaultServerSignaturePublicKey_DiffersFromTauriUpdaterKey(t *testing.T) {
-	tauriConfigPath := filepath.Clean(filepath.Join("..", "..", "Client", "src-tauri", "tauri.conf.json"))
-	raw, err := os.ReadFile(tauriConfigPath)
-	if err != nil {
-		t.Fatalf("ReadFile(%s): %v", tauriConfigPath, err)
-	}
-
-	var cfg struct {
-		Plugins struct {
-			Updater struct {
-				PubKey string `json:"pubkey"`
-			} `json:"updater"`
-		} `json:"plugins"`
-	}
-	if err := json.Unmarshal(raw, &cfg); err != nil {
-		t.Fatalf("Unmarshal tauri.conf.json: %v", err)
-	}
-
-	if cfg.Plugins.Updater.PubKey == defaultServerSignaturePublicKey {
-		t.Fatalf("server updater signing key must differ from tauri.conf.json updater pubkey")
-	}
-}
-
 func TestDefaultServerSignaturePublicKey_Parseable(t *testing.T) {
 	u := NewUpdater("1.0.0", "", "J3vb", "OwnCord")
 	if _, err := u.serverSignaturePublicKey(); err != nil {
diff --git a/docs/contributing.md b/docs/contributing.md
index aa49db8e..5ff7ec0f 100644
--- a/docs/contributing.md
+++ b/docs/contributing.md
@@ -92,8 +92,10 @@ next section, and using them directly is equally correct.
 | `npm test`                 | Run all tests (vitest)                 |
 | `npm run test:unit`        | Unit tests only                        |
 | `npm run test:integration` | Integration tests only                 |
+| `npm run test:contract`    | Cross-component contract tests only    |
 | `npm run test:e2e`         | Playwright E2E (mocked Tauri)          |
 | `npm run test:e2e:native`  | Playwright E2E (real Tauri exe + CDP)  |
+| `npm run test:e2e:admin`   | Playwright E2E (real Go server + SPA)  |
 | `npm run test:e2e:prod`    | Playwright E2E (prod build)            |
 | `npm run test:e2e:ui`      | Playwright UI mode                     |
 | `npm run test:watch`       | Vitest watch mode                      |
@@ -230,6 +232,56 @@ the Go suite has deliberately no floor (T-2026-07-25-19) — use `make cover-all
 to see the honest cross-package number. Follow a test-driven workflow and never
 lower a threshold to make a change fit.
 
+### Tiers
+
+| Tier                       | Command                    | CI job                                      | Blocking |
+| -------------------------- | -------------------------- | ------------------------------------------- | -------- |
+| `Client/tests/unit`        | `npm run test:unit`        | Client Unit Tests                           | yes      |
+| `Client/tests/integration` | `npm run test:integration` | Client Unit Tests                           | yes      |
+| `Client/tests/contract`    | `npm run test:contract`    | Client Unit Tests                           | yes      |
+| `Client/tests/browser`     | `npm run test:browser`     | —                                           | no       |
+| `Client/tests/e2e`         | `npm run test:e2e`         | Client E2E (Playwright)                     | yes      |
+| `Client/tests/e2e` @parity | —                          | Client E2E (parity subset, blocking)        | yes      |
+| `Client/tests/e2e/native`  | `npm run test:e2e:native`  | —                                           | no       |
+| `Client/tests/e2e/admin`   | `npm run test:e2e:admin`   | Admin Panel E2E (real server, non-blocking) | **no**   |
+| `Server/**/*_test.go`      | `make test`                | Server Build & Test                         | yes      |
+| `Client/src-tauri`         | `cargo test --lib`         | Rust Unit Tests                             | yes      |
+
+`npm test` — not `npm run test:unit` — is what CI runs and what
+`npm run check:client` invokes, so it is the command that covers
+`tests/contract`.
+
+### What belongs in `tests/contract`
+
+A test is a **contract test** when its assertions read, import or execute an
+artifact owned by a _different top-level component_ (`Server/`, `Client/`, root
+`protocol/`) than the one its runner lives in. A comment referencing the other
+side does not count.
+
+1. **Placement follows capability, not ownership.** A contract test lives in the
+   tier whose runtime can execute or parse the artifact. If the owning component
+   can execute it, it stays in that component's own suite —
+   `Server/updater/tauri_key_contract_test.go` reads
+   `Client/src-tauri/tauri.conf.json` and stays in Go, because Go parses JSON
+   fine and the assertion is about a server constant.
+2. **Ownership is declared in the name, never in the directory.** The file name
+   and the top-level `describe`/`Test` name must name the owned artifact's path.
+3. **A contract test may only live in a blocking tier.** A non-blocking job is
+   not coverage. `Admin Panel E2E` is `continue-on-error: true`
+   (`.github/workflows/ci.yml`), so it is ineligible however well it fits
+   topically — until it graduates.
+4. `Client/` is one component: its TypeScript frontend and its thin Rust backend
+   in `src-tauri/` are the same side of the boundary, so a `tests/unit` test that
+   reads `src-tauri/tauri.conf.json` is an ordinary unit test. The same goes for a
+   Go test reading its own package's embedded assets
+   (`Server/admin/perm_grid_test.go`).
+
+E2E is _runtime_ coupling rather than artifact coupling; it stays in `tests/e2e`.
+
+If a tier ever gains a runner of its own, model its anti-vacuity guard on
+`Server/invariants/invariants_test.go` — it fails loudly when a configured scope
+resolves to nothing, rather than passing on an empty set.
+
 ## Code Style
 
 - **TypeScript**: See [Client Architecture](architecture/client.md)