Move browser-facing HTTP and WebSocket ownership into a dedicated gateway package, add the frontend API-client boundary, and keep release metadata aligned for the pre-release.
The fifth release-candidate pass removes ~3k LOC of verified duplication without weakening the immune system or regressing governance docs.
Group A (12 direct dedup wins): test_run_shell_string_cmd_is_hard_error duplicate, Python-port tests for never-landed JS helpers (stripPlanPrefix, extractRecallEntries), README prose pins, marketplace.js default export, four web helpers (safeExternalHrefAttr, renderMarkdownSafe, boundedText, fetchJson) consolidated into utils.js SSOT, four copies of _emit_live_log to ouroboros/utils.py::emit_log_event, onboarding IIFE escapeHtml SSOT-mirror with byte-equivalence guard test, three inline style display:none to HTML hidden attribute, _now_iso to utc_now_iso, _write_json_atomic thin wrapper inlined, _CHECKLISTS_PATH duplicate path walk and dead re-exports removed.
Group B (11 doc/prompt redundancy reductions): SYSTEM.md duplicate Versioning sections consolidated AND active git-tag-collision bug removed (previous "Create annotated git tag" instruction conflicted with auto-tag in repo_commit and broke auto-push), BIBLE-doctrine restatements compressed to short pointers, commit/obligation flow narrative compressed to 6-bullet in-loop reminder, CONSCIOUSNESS.md duplicate Tech Radar section removed, README.md ASCII tree + philosophy table + Layered Safety essay + TRUST_NONLOCAL_BIND triple all collapsed into pointers, CREATING_SKILLS.md skill-review enum points back to CHECKLISTS.md (SSOT), two narrow ARCHITECTURE.md "Prior to v4.36.1" historical narratives rewritten as "Why warning-only:" rationale that preserves the *why* under P6.
Group C (4 SSOT consolidations): 850K token budget moves to tools/review_helpers.py::REVIEW_PROMPT_TOKEN_BUDGET (consumed by scope_review/plan_review/deep_self_review); _load_bible / _load_dev_guide_text / _load_architecture_text route through load_governance_doc(..., on_missing="explicit") so missing core docs surface explicit OMISSION markers instead of silent empty strings — fixes a DEVELOPMENT.md "No silent truncation" violation; SETTINGS_FALLBACK_MODELS in settings.js gets a guard test against config.py SETTINGS_DEFAULTS (caught real anthropic/claude-sonnet-4.6 drift); _record_commit_attempt (20-arity, violates DEVELOPMENT.md "<8 parameters") gets @dataclass CommitAttemptRequest while a backward-compat kwargs adapter keeps all 47 existing call sites intact.
Group D (4 frontend cleanups): dead hostPage='settings' defaults in logs/costs/evolution/updates.js flip to 'dashboard' (Dashboard sub-tab migration v5.7+); .dashboard-tabs/.skills-tabs CSS verbatim duplicates of .app-tab-strip/.app-tab deleted; 50 hardcoded rgba(201,53,69,X) literals collapse into nine --accent-* tokens (after dry-run #2 caught a self-reference cycle in :root, test_accent_tokens_have_concrete_rgba_values pins the fix); 30 border-radius: Npx; literals adopt --radius-* tokens with new --radius-md: 10px (added to docs/DEVELOPMENT.md Border radius scale table per advisory).
Group E (5 test dedup; E1/E2/E3 deferred to follow-up RCs): test_review_models_configured (dup with test_settings_effort), test_settings_ui_js_exists + test_render_settings_page_function_present (subsumed by stronger backtick-balance tests), two TestReviewInCommitPipeline tests (strict subsets of test_scope_review), test_imports_after_bughunt_dont_raise (pytest collection already imports), and chat_logs_ui plan-mode JS tests (canonically in test_chat_js_contracts).
Group F (module splits) deferred entirely to follow-up RCs because the plan classifies F1-F4 as "move not delete" (~250 LOC moved, not reduced) and the regression risk in repo_commit's monkeypatch surface outweighs the value of mid-flight architectural splits when A-E already delivered the line-count target.
VERSION bumped 5.8.3-rc.4 -> 5.8.3-rc.5; pyproject.toml carries the PEP 440 5.8.3rc5; README badge + changelog row + ARCHITECTURE.md header all in sync.
Note on changelog rolloff: the v5.8.1 and v5.8.2 patch rows were rolled off to respect the P9 5-patch-row cap; their full bodies remain at git tags v5.8.1 and v5.8.2.
Review process: full local pytest green; visual UI smoke through MCP browser confirmed Chat/Skills (My/ClawHub/OuroborosHub tabs) / Widgets/Settings/Dashboard render and switch. Real triad+scope dry-run via scripts/run_external_review.py converged after four rounds: round 1 preflight-blocked on missing VERSION (expected), round 2 caught CSS self-reference cycle (4 critical findings + 2 advisories — all fixed), round 3 caught residual resultEl.style.display + unused dataclass.field import (2 critical — both fixed), round 4 PASSED with critical_findings empty. Scope review downgraded to non-blocking advisory due to ~975K-token repo pack exceeding 850K budget — documented BIBLE P3 architectural pressure that further dedup passes will need to address.
Adds reviewed skill authoring/runtime capabilities, hardens skill lifecycle/provenance controls, and repairs the mobile/dashboard/marketplace/widget UI surfaces as one coordinated pre-release update.
