diff --git a/.claude/scripts/cockpit-serve.sh b/.claude/scripts/cockpit-serve.sh
new file mode 100755
index 0000000..89b22af
--- /dev/null
+++ b/.claude/scripts/cockpit-serve.sh
@@ -0,0 +1,369 @@
+#!/usr/bin/env bash
+# cockpit-serve.sh — Phase 3a (issue #69) live HTTP serve mode for cockpit.sh.
+#
+# Wraps the EXISTING one-shot renderer (cockpit.sh) behind a tiny node
+# `http` server: no new dependencies (node built-ins only), bound to
+# 127.0.0.1 only. Rendering itself is never reimplemented here — every
+# request shells back into `cockpit.sh` so there is exactly ONE HTML
+# generator to keep in sync (mirrors cockpit.sh's own --parse-blocking seam).
+#
+# Usage:
+#   cockpit-serve.sh [port] [--fixtures <dir>]
+#     port          optional positional arg, default 8090
+#     --fixtures    same offline seam as cockpit.sh: read <dir>/issues.json,
+#                   <dir>/prs.json, <dir>/events.jsonl instead of gh/network
+#                   and the real event log. Used by cockpit.test.sh's serve
+#                   smoke case — no network/gh in tests.
+#
+# Routes:
+#   GET  /            the dashboard (cockpit.sh's HTML with the SSE/theme
+#                      client script injected before </body>). Served from a
+#                      short-lived cache (COCKPIT_GH_REFRESH seconds, default
+#                      60) so gh-backed sections aren't re-rendered on every
+#                      request; the client's own timer/button call
+#                      /api/refresh to force an immediate re-render.
+#   GET  /events       SSE stream of the live-progress event log (JSONL).
+#                      Replays whatever is already in the file on connect
+#                      (so a client that connects right after an append still
+#                      sees it), then streams every subsequent appended line
+#                      as its own `data:` event, plus a `: ping` heartbeat
+#                      every 15s. Watches via fs.watch AND a polling fallback
+#                      (fs.watch is unreliable on some filesystems/OSes).
+#   GET  /api/refresh  forces an immediate re-render (bypassing the cache)
+#                      and returns 200 {"ok":true} (or {"ok":false,"error"}
+#                      on failure). The injected client calls this from its
+#                      refresh timer and its manual "Refresh now" button.
+#
+# Foreground process — SIGTERM/SIGINT close the server cleanly (via `exec`,
+# below, node receives signals directly; no bash wrapper indirection).
+set -uo pipefail
+
+# Two-root derivation (issue #63): script_dir = sibling scripts, root = consumer project.
+# shellcheck source=resolve-roots.sh
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/resolve-roots.sh"
+cockpit="$script_dir/cockpit.sh"
+
+# ---------------------------------------------------------------------------
+# Args: [port] [--fixtures <dir>]
+# ---------------------------------------------------------------------------
+port=""
+fixtures=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --fixtures) fixtures="$2"; shift 2 ;;
+    --fixtures=*) fixtures="${1#--fixtures=}"; shift ;;
+    *) port="$1"; shift ;;
+  esac
+done
+port="${port:-8090}"
+
+# Same offline seam as cockpit.sh: in --fixtures mode, watch the fixture's
+# events.jsonl, never the real (gitignored) event log.
+if [ -n "$fixtures" ]; then
+  events_file="$fixtures/events.jsonl"
+else
+  events_file="${CLAUDE_EVENTS_FILE:-$root/.claude/state/events.jsonl}"
+fi
+
+gh_refresh="${COCKPIT_GH_REFRESH:-60}"
+
+tmp_out="$(mktemp "${TMPDIR:-/tmp}/cockpit-serve.XXXXXX.html")"
+trap 'rm -f "$tmp_out"' EXIT
+
+# `exec` replaces this shell with node (same PID) so SIGTERM/SIGINT go
+# straight to node's own handlers below — no bash signal-forwarding needed.
+COCKPIT_SERVE_SELF="$cockpit" \
+COCKPIT_SERVE_FIXTURES="$fixtures" \
+COCKPIT_SERVE_PORT="$port" \
+COCKPIT_SERVE_EVENTS_FILE="$events_file" \
+COCKPIT_SERVE_GH_REFRESH="$gh_refresh" \
+COCKPIT_SERVE_TMP_OUT="$tmp_out" \
+exec node - <<'NODE_SERVE'
+const http = require("http");
+const fs = require("fs");
+const { execFileSync } = require("child_process");
+
+const SELF = process.env.COCKPIT_SERVE_SELF;
+const FIXTURES = process.env.COCKPIT_SERVE_FIXTURES || "";
+const PORT = parseInt(process.env.COCKPIT_SERVE_PORT, 10) || 8090;
+const EVENTS_FILE = process.env.COCKPIT_SERVE_EVENTS_FILE;
+const GH_REFRESH_SECONDS = parseInt(process.env.COCKPIT_SERVE_GH_REFRESH, 10) || 60;
+const GH_REFRESH_MS = GH_REFRESH_SECONDS * 1000;
+const TMP_OUT = process.env.COCKPIT_SERVE_TMP_OUT;
+
+// ---------------------------------------------------------------------------
+// Render cache: re-run cockpit.sh (the ONE renderer) at most once per
+// GH_REFRESH_MS, unless a caller forces it (GET /api/refresh, or the very
+// first request). This is what keeps serve mode from shelling out to gh on
+// every single page load while still staying live.
+// ---------------------------------------------------------------------------
+let cache = { html: null, ts: 0, err: null };
+
+function render() {
+  const args = [SELF];
+  if (FIXTURES) args.push("--fixtures", FIXTURES);
+  args.push(TMP_OUT);
+  execFileSync("bash", args, { stdio: ["ignore", "ignore", "inherit"] });
+  const html = fs.readFileSync(TMP_OUT, "utf8");
+  cache = { html, ts: Date.now(), err: null };
+  return html;
+}
+
+function getHtml(force) {
+  const stale = !cache.html || Date.now() - cache.ts > GH_REFRESH_MS;
+  if (force || stale) {
+    try {
+      return render();
+    } catch (e) {
+      cache.err = e;
+      if (cache.html) return cache.html; // degrade to last-good render
+      throw e;
+    }
+  }
+  return cache.html;
+}
+
+// ---------------------------------------------------------------------------
+// Client script injected into GET / only (never shipped in cockpit.sh's own
+// static output) — SSE live-updates + a "stale since ..." badge + a manual
+// refresh button that also drives the timed gh-backed refresh. Vanilla JS,
+// no frameworks/external assets; every dynamic value from the server lands
+// via textContent, never innerHTML.
+// ---------------------------------------------------------------------------
+function clientScript() {
+  return `
+<script>
+(function () {
+  try {
+    var h1 = document.querySelector("h1");
+    var statusBadge = document.createElement("span");
+    statusBadge.id = "stream-status";
+    statusBadge.style.marginLeft = "0.5rem";
+    statusBadge.style.fontSize = "0.8rem";
+    statusBadge.style.padding = "0.15rem 0.6rem";
+    statusBadge.style.borderRadius = "4px";
+    statusBadge.style.display = "none";
+    var refreshBtn = document.createElement("button");
+    refreshBtn.id = "manual-refresh";
+    refreshBtn.type = "button";
+    refreshBtn.textContent = "Refresh now";
+    refreshBtn.style.marginLeft = "0.5rem";
+    if (h1) { h1.appendChild(refreshBtn); h1.appendChild(statusBadge); }
+
+    function setStale(isStale) {
+      if (!statusBadge) return;
+      if (isStale) {
+        statusBadge.textContent = "stale since " + new Date().toLocaleTimeString();
+        statusBadge.style.background = "#3d330f";
+        statusBadge.style.color = "#ffd873";
+        statusBadge.style.display = "inline-block";
+      } else {
+        statusBadge.style.display = "none";
+      }
+    }
+
+    function ensureLiveTable() {
+      var section = document.getElementById("live");
+      if (!section) return null;
+      var table = section.querySelector("table.routing");
+      if (table) return table.querySelector("tbody");
+      var placeholders = section.querySelectorAll("p");
+      placeholders.forEach(function (p) { p.remove(); });
+      table = document.createElement("table");
+      table.className = "routing";
+      var thead = document.createElement("thead");
+      var headRow = document.createElement("tr");
+      ["Role", "Task", "Model", "Phase", "Lens", "Updated"].forEach(function (label) {
+        var th = document.createElement("th");
+        th.textContent = label;
+        headRow.appendChild(th);
+      });
+      thead.appendChild(headRow);
+      table.appendChild(thead);
+      var tbody = document.createElement("tbody");
+      table.appendChild(tbody);
+      section.appendChild(table);
+      return tbody;
+    }
+
+    // In-place row upsert keyed by (role,task), mirroring cockpit.sh's own
+    // dedup-to-latest-phase semantics -- every field lands via textContent
+    // only, so an event payload can never execute as markup.
+    function upsertRow(ev) {
+      var tbody = ensureLiveTable();
+      if (!tbody) return;
+      var role = ev.role != null ? String(ev.role) : "";
+      var task = ev.task != null ? String(ev.task) : "";
+      var id = "live-row-" + encodeURIComponent(role) + "--" + encodeURIComponent(task);
+      var row = document.getElementById(id);
+      if (!row) {
+        row = document.createElement("tr");
+        row.id = id;
+        for (var i = 0; i < 6; i++) row.appendChild(document.createElement("td"));
+        tbody.appendChild(row);
+      }
+      row.setAttribute("data-role", role);
+      row.setAttribute("data-task", task);
+      var cells = row.children;
+      cells[0].textContent = role;
+      cells[1].textContent = task;
+      cells[2].textContent = ev.model || "(none)";
+      cells[3].textContent = ev.phase || "(unknown)";
+      cells[4].textContent = ev.lens || "";
+      cells[5].textContent = ev.ts || "";
+    }
+
+    function connect() {
+      var es = new EventSource("/events");
+      es.onopen = function () { setStale(false); };
+      es.onerror = function () { setStale(true); };
+      es.onmessage = function (ev) {
+        setStale(false);
+        var payload;
+        try { payload = JSON.parse(ev.data); } catch (e) { return; }
+        if (payload && typeof payload === "object" && !Array.isArray(payload)) upsertRow(payload);
+      };
+    }
+
+    function doRefresh() {
+      fetch("/api/refresh").then(function () { location.reload(); }).catch(function () { location.reload(); });
+    }
+    refreshBtn.addEventListener("click", doRefresh);
+    setInterval(doRefresh, ${GH_REFRESH_MS});
+
+    connect();
+  } catch (e) { /* inert on any DOM/EventSource-less environment */ }
+})();
+</script>`;
+}
+
+function injectClientScript(html) {
+  const script = clientScript();
+  if (html.includes("</body>")) return html.replace("</body>", script + "\n</body>");
+  return html + script;
+}
+
+// ---------------------------------------------------------------------------
+// /events — SSE. Replays whatever is already in EVENTS_FILE on connect (so a
+// line appended just before the client connects is still delivered), then
+// streams each newly appended line as its own event. fs.watch is
+// unreliable on some platforms/filesystems, so a size/mtime poll runs
+// alongside it as a fallback -- both funnel through the same "read from
+// offset" step, so neither path can double-deliver a line.
+// ---------------------------------------------------------------------------
+function handleEvents(req, res) {
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache",
+    Connection: "keep-alive",
+  });
+
+  let offset = 0;
+  let closed = false;
+
+  function pump() {
+    if (closed) return;
+    fs.stat(EVENTS_FILE, (err, stat) => {
+      if (closed) return;
+      if (err) return; // file missing yet -- nothing to send
+      if (stat.size <= offset) return; // no new bytes
+      fs.open(EVENTS_FILE, "r", (openErr, fd) => {
+        if (closed) return;
+        if (openErr) return;
+        const len = stat.size - offset;
+        const buf = Buffer.alloc(len);
+        fs.read(fd, buf, 0, len, offset, (readErr, bytesRead) => {
+          fs.close(fd, () => {});
+          if (closed || readErr) return;
+          offset += bytesRead;
+          const text = buf.toString("utf8", 0, bytesRead);
+          for (const line of text.split("\n")) {
+            const trimmed = line.trim();
+            if (!trimmed) continue;
+            // One JSONL line -> one SSE `data:` line; the payload itself is
+            // JSON (never multi-line here), so no need to fold newlines.
+            res.write(`data: ${trimmed}\n\n`);
+          }
+        });
+      });
+    });
+  }
+
+  const heartbeat = setInterval(() => {
+    if (!closed) res.write(": ping\n\n");
+  }, 15000);
+
+  const poll = setInterval(pump, 1000);
+
+  let watcher = null;
+  try {
+    watcher = fs.watch(EVENTS_FILE, { persistent: false }, () => pump());
+  } catch (e) {
+    // ENOENT (file doesn't exist yet) or platform without fs.watch support
+    // on this path -- the poll interval above still covers it.
+    watcher = null;
+  }
+
+  // Initial replay of whatever's already on disk.
+  pump();
+
+  req.on("close", () => {
+    closed = true;
+    clearInterval(heartbeat);
+    clearInterval(poll);
+    if (watcher) watcher.close();
+  });
+}
+
+function handleRefresh(req, res) {
+  try {
+    getHtml(true);
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ ok: true }));
+  } catch (e) {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ ok: false, error: String((e && e.message) || e) }));
+  }
+}
+
+function handleIndex(req, res) {
+  try {
+    const html = injectClientScript(getHtml(false));
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(html);
+  } catch (e) {
+    res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
+    res.end("cockpit-serve: render failed — " + String((e && e.message) || e));
+  }
+}
+
+const server = http.createServer((req, res) => {
+  const url = (req.url || "/").split("?")[0];
+  if (req.method !== "GET") {
+    res.writeHead(405, { "Content-Type": "text/plain" });
+    res.end("method not allowed");
+    return;
+  }
+  if (url === "/" || url === "/index.html") return handleIndex(req, res);
+  if (url === "/events") return handleEvents(req, res);
+  if (url === "/api/refresh") return handleRefresh(req, res);
+  res.writeHead(404, { "Content-Type": "text/plain" });
+  res.end("not found");
+});
+
+// Best-effort warm cache so the first real request doesn't pay the initial
+// render latency; failure here is not fatal -- getHtml() will retry lazily.
+try { render(); } catch (e) { /* surfaces again on first request */ }
+
+server.listen(PORT, "127.0.0.1", () => {
+  console.log(`cockpit serving on http://127.0.0.1:${PORT}`);
+});
+
+function shutdown() {
+  server.close(() => process.exit(0));
+  // Force-exit if close() hangs on a slow keep-alive connection.
+  setTimeout(() => process.exit(0), 2000).unref();
+}
+process.on("SIGTERM", shutdown);
+process.on("SIGINT", shutdown);
+NODE_SERVE
diff --git a/.claude/scripts/cockpit.sh b/.claude/scripts/cockpit.sh
index 128cd24..0719316 100755
--- a/.claude/scripts/cockpit.sh
+++ b/.claude/scripts/cockpit.sh
@@ -33,6 +33,14 @@
 # Output: self-contained HTML (inline CSS, no external CDN/JS/fonts), default
 # .claude/state/cockpit.html (that dir is gitignored — never commit the
 # generated artifact). Pass a second positional arg to write elsewhere.
+#
+# Phase 3a (issue #69): dark theme by default (with a light-theme toggle,
+# persisted client-side in localStorage — inert/harmless if run in a
+# file:// context with no localStorage), plus a client-side module-header
+# click filter over the issue list. Both are small inline <script> blocks
+# appended near the end of <body>; cockpit-serve.sh (serve mode) injects
+# ITS OWN separate SSE/refresh client script by string-replacing </body>,
+# so the live-stream code never ships in this static output.
 set -uo pipefail
 
 # Two-root derivation (issue #63): script_dir = sibling scripts, root = consumer project.
@@ -328,12 +336,16 @@ function renderLiveProgress() {
   if (workers.length === 0) {
     html += `<p class="muted">no active workers</p>`;
   } else {
-    html += `<table class="routing"><thead><tr><th>Role</th><th>Task</th><th>Model</th><th>Phase</th><th>Lens</th><th>Updated</th></tr></thead><tbody>`;
+    html += `<table class="routing"><thead><tr><th>Role</th><th>Task</th><th>Model</th><th>Phase</th><th>Lens</th><th>Updated</th><th hidden></th></tr></thead><tbody>`;
     for (const w of workers) {
       const badge = phaseBadge(w.phase);
       html += `<tr><td>${esc(w.role)}</td><td>${esc(w.task)}</td><td><code>${esc(w.model || "(none)")}</code></td>`;
       html += `<td><span class="badge ${badge.cls}">${esc(w.phase || "(unknown)")}</span></td>`;
-      html += `<td>${esc(w.lens || "")}</td><td>${esc(w.ts)}</td></tr>`;
+      html += `<td>${esc(w.lens || "")}</td><td>${esc(w.ts)}</td>`;
+      // Hidden trailing cell: stable data-role/data-task hook for a FUTURE
+      // worker inspector (issue 3b). Appended AFTER every column the
+      // existing tests exact-match, so it never disturbs them.
+      html += `<td class="wrow-meta" data-role="${esc(w.role)}" data-task="${esc(w.task)}" hidden></td></tr>`;
     }
     html += `</tbody></table>`;
   }
@@ -368,7 +380,7 @@ function renderIssues() {
     html += `<h3>${esc(key)}</h3><ul class="issue-list">`;
     for (const issue of list) {
       const edges = parseBlocking(issue.body || "");
-      html += `<li id="issue-${issue.number}"><a href="${esc(issue.url || "#")}">#${issue.number}</a> ${esc(issue.title)}`;
+      html += `<li id="issue-${issue.number}" data-module="${esc(key)}"><a href="${esc(issue.url || "#")}">#${issue.number}</a> ${esc(issue.title)}`;
       const rel = [];
       if (edges.blockedBy.length) rel.push(`Blocked by ${refList(edges.blockedBy)}`);
       if (edges.blocks.length) rel.push(`Blocks ${refList(edges.blocks)}`);
@@ -468,42 +480,127 @@ function renderWorktrees() {
 }
 
 const generatedAt = new Date().toISOString();
+// Dark-theme stable marker (issue #69): the `data-theme="dark"` attribute
+// below is the CONTRACT a test/consumer can grep for to confirm the default
+// theme. The tiny <script> right after it restores a saved light-theme
+// preference (localStorage) BEFORE <style> is applied, to avoid a flash;
+// it is wrapped in try/catch so it is inert/harmless under file:// (some
+// browsers restrict localStorage there) or any other odd environment.
 const html = `<!doctype html>
-<html lang="en">
+<html lang="en" data-theme="dark">
 <head>
 <meta charset="utf-8">
 <title>Cockpit — ai-project-orchestrator</title>
+<script>(function(){try{var t=localStorage.getItem("cockpit-theme");if(t==="light"||t==="dark"){document.documentElement.setAttribute("data-theme",t);}}catch(e){}})();</script>
 <style>
-  body { font-family: -apple-system, Segoe UI, Helvetica, Arial, sans-serif; margin: 2rem; color: #1a1a1a; background: #fafafa; }
-  h1 { margin-bottom: 0.2rem; }
-  .meta { color: #666; font-size: 0.85rem; margin-bottom: 1.5rem; }
-  section { background: #fff; border: 1px solid #ddd; border-radius: 8px; padding: 1rem 1.5rem; margin-bottom: 1.5rem; }
-  h2 { margin-top: 0; border-bottom: 1px solid #eee; padding-bottom: 0.4rem; }
-  h3 { margin-bottom: 0.3rem; color: #444; }
+  :root {
+    --bg: #0d1117;
+    --bg-elevated: #161b22;
+    --border: #30363d;
+    --text: #e6edf3;
+    --text-dim: #8b949e;
+    --link: #6ea8fe;
+    --code-bg: #21262d;
+    --good-bg: #113626; --good-fg: #7ee2a8;
+    --bad-bg: #3d1616; --bad-fg: #ff9b9b;
+    --warn-bg: #3d330f; --warn-fg: #ffd873;
+    --muted-bg: #21262d; --muted-fg: #8b949e;
+    --shadow: rgba(0, 0, 0, 0.4);
+  }
+  html[data-theme="light"] {
+    --bg: #fafafa;
+    --bg-elevated: #fff;
+    --border: #ddd;
+    --text: #1a1a1a;
+    --text-dim: #666;
+    --link: #1a56db;
+    --code-bg: #f2f2f2;
+    --good-bg: #d7f7dd; --good-fg: #1a6b2c;
+    --bad-bg: #fbdada; --bad-fg: #9b1c1c;
+    --warn-bg: #fff3cd; --warn-fg: #8a6100;
+    --muted-bg: #eee; --muted-fg: #888;
+    --shadow: rgba(0, 0, 0, 0.08);
+  }
+  body { font-family: -apple-system, Segoe UI, Helvetica, Arial, sans-serif; margin: 2rem; color: var(--text); background: var(--bg); }
+  h1 { margin-bottom: 0.2rem; display: flex; align-items: center; gap: 0.75rem; flex-wrap: wrap; }
+  #theme-toggle { font: inherit; font-size: 0.75rem; padding: 0.25rem 0.6rem; border-radius: 6px; border: 1px solid var(--border); background: var(--bg-elevated); color: var(--text); cursor: pointer; }
+  #theme-toggle:hover { border-color: var(--link); }
+  .meta { color: var(--text-dim); font-size: 0.85rem; margin-bottom: 1.5rem; }
+  section { background: var(--bg-elevated); border: 1px solid var(--border); border-radius: 8px; padding: 1rem 1.5rem; margin-bottom: 1.5rem; box-shadow: 0 1px 3px var(--shadow); }
+  h2 { margin-top: 0; border-bottom: 1px solid var(--border); padding-bottom: 0.4rem; }
+  h3 { margin-bottom: 0.3rem; color: var(--text-dim); cursor: pointer; user-select: none; }
+  #issues h3:hover { color: var(--link); }
   ul.issue-list, ul.pr-list { list-style: none; padding-left: 0; }
-  ul.issue-list li, ul.pr-list li { padding: 0.4rem 0; border-bottom: 1px dashed #eee; }
-  .rel { font-size: 0.85rem; color: #555; margin-top: 0.2rem; }
+  ul.issue-list li, ul.pr-list li { padding: 0.4rem 0; border-bottom: 1px dashed var(--border); }
+  .rel { font-size: 0.85rem; color: var(--text-dim); margin-top: 0.2rem; }
   .badge { display: inline-block; padding: 0.1rem 0.5rem; border-radius: 4px; font-size: 0.8rem; margin-left: 0.3rem; }
-  .badge.good { background: #d7f7dd; color: #1a6b2c; }
-  .badge.bad { background: #fbdada; color: #9b1c1c; }
-  .badge.warn { background: #fff3cd; color: #8a6100; }
-  .badge.muted { background: #eee; color: #666; }
-  .muted { color: #888; }
-  .unavailable { color: #9b1c1c; font-style: italic; }
+  .badge.good { background: var(--good-bg); color: var(--good-fg); }
+  .badge.bad { background: var(--bad-bg); color: var(--bad-fg); }
+  .badge.warn { background: var(--warn-bg); color: var(--warn-fg); }
+  .badge.muted { background: var(--muted-bg); color: var(--muted-fg); }
+  .muted { color: var(--text-dim); }
+  .unavailable { color: var(--bad-fg); font-style: italic; }
   table.routing { border-collapse: collapse; width: 100%; margin: 0.5rem 0 1rem; }
-  table.routing th, table.routing td { border: 1px solid #eee; padding: 0.3rem 0.6rem; text-align: left; font-size: 0.9rem; }
-  code { background: #f2f2f2; padding: 0.05rem 0.3rem; border-radius: 3px; }
-  a { color: #1a56db; }
+  table.routing th, table.routing td { border: 1px solid var(--border); padding: 0.3rem 0.6rem; text-align: left; font-size: 0.9rem; }
+  code { background: var(--code-bg); padding: 0.05rem 0.3rem; border-radius: 3px; }
+  a { color: var(--link); }
 </style>
 </head>
 <body>
-<h1>Cockpit</h1>
-<p class="meta">Generated ${esc(generatedAt)} &middot; read-only Phase 1 snapshot (issue #51) + Phase 2 live progress (issue #52) &middot; re-run <code>cockpit.sh</code> to refresh</p>
+<h1>Cockpit <button id="theme-toggle" type="button">Toggle theme</button></h1>
+<p class="meta">Generated ${esc(generatedAt)} &middot; read-only Phase 1 snapshot (issue #51) + Phase 2 live progress (issue #52) + Phase 3a serve/theme/filter (issue #69) &middot; re-run <code>cockpit.sh</code> to refresh (or run <code>cockpit-serve.sh</code> for live auto-update)</p>
 ${renderLiveProgress()}
 ${renderIssues()}
 ${renderPRs()}
 ${renderRouting()}
 ${renderWorktrees()}
+<script>
+// Light/dark theme toggle (issue #69): flips html[data-theme] and persists
+// the choice to localStorage. Wrapped in try/catch so a file:// context (or
+// any environment without localStorage) never throws — purely cosmetic, so
+// it is safe to no-op.
+(function () {
+  try {
+    var KEY = "cockpit-theme";
+    var root = document.documentElement;
+    var btn = document.getElementById("theme-toggle");
+    if (btn) {
+      btn.addEventListener("click", function () {
+        var current = root.getAttribute("data-theme") === "light" ? "light" : "dark";
+        var next = current === "dark" ? "light" : "dark";
+        root.setAttribute("data-theme", next);
+        try { localStorage.setItem(KEY, next); } catch (e) { /* ignore */ }
+      });
+    }
+  } catch (e) { /* inert if the DOM/localStorage is unavailable */ }
+})();
+// Module-header click filter (issue #69): clicking a module <h3> in the
+// issues section shows only that module's <li data-module="..."> rows;
+// clicking the same header again (or filtering was already active) restores
+// all rows. Pure client-side, no server round-trip, inert if #issues is
+// absent (e.g. the gh-unavailable degrade path renders no list at all).
+(function () {
+  try {
+    var headers = document.querySelectorAll("#issues h3");
+    var items = document.querySelectorAll("#issues li[data-module]");
+    headers.forEach(function (h) {
+      h.addEventListener("click", function () {
+        var mod = h.textContent;
+        var wasActive = h.getAttribute("data-active") === "1";
+        headers.forEach(function (hh) { hh.removeAttribute("data-active"); });
+        items.forEach(function (li) {
+          if (wasActive) {
+            li.style.display = "";
+          } else {
+            li.style.display = li.getAttribute("data-module") === mod ? "" : "none";
+          }
+        });
+        if (!wasActive) h.setAttribute("data-active", "1");
+      });
+    });
+  } catch (e) { /* inert if the DOM is unavailable */ }
+})();
+</script>
 </body>
 </html>
 `;
diff --git a/.claude/scripts/cockpit.test.sh b/.claude/scripts/cockpit.test.sh
index ae8c1e3..3839beb 100755
--- a/.claude/scripts/cockpit.test.sh
+++ b/.claude/scripts/cockpit.test.sh
@@ -1,27 +1,52 @@
 #!/usr/bin/env bash
 # cockpit.test.sh — offline smoke test for cockpit.sh (issue #51, extended for
-# Phase 2 live progress in issue #52).
+# Phase 2 live progress in issue #52, and Phase 3a serve/theme/filter in
+# issue #69).
 #
 # Runs the generator against controlled FIXTURE issue/PR/events JSON (never
 # live gh/network, and never the real event log — see cockpit.sh's
 # --fixtures mode), then asserts the produced HTML contains every required
 # section (issues-by-module with blocking relationships, PRs with review/CI
 # badges, a routing table with a real `model:` value, a worktrees section,
-# a live-progress panel deduped to each worker's latest phase) and that the
-# blocking-relationship parser (`cockpit.sh --parse-blocking`) produces the
-# expected edges for a known fixture body. Also exercises the "gh/network
-# unavailable" degrade path via COCKPIT_GH_BIN, entirely offline (no real gh
-# call, no .env).
+# a live-progress panel deduped to each worker's latest phase, the default
+# dark-theme marker) and that the blocking-relationship parser
+# (`cockpit.sh --parse-blocking`) produces the expected edges for a known
+# fixture body. Also exercises the "gh/network unavailable" degrade path via
+# COCKPIT_GH_BIN, entirely offline (no real gh call, no .env), and a serve-mode
+# smoke case (cockpit-serve.sh) against the SAME fixtures, over 127.0.0.1 only
+# — no real network/gh either way.
 #
 # Exit 0 on success, non-zero if any assertion fails. Runnable bare:
 #   bash .claude/scripts/cockpit.test.sh
 set -uo pipefail
 
+# Isolate from the CALLER's environment: this test is now wired into
+# .claude/self/checks.sh's `test` case, which itself typically runs under
+# `GATES_FILE=.claude/self/gates.json` (the self-host loop). Since env vars
+# set before a command propagate to every child process it spawns, an
+# ambient GATES_FILE would silently redirect the DEFAULT-adapter assertions
+# below (section 2) onto the self-adapter. Section 3 sets GATES_FILE
+# explicitly where it actually wants the override; everywhere else must see
+# the default (.claude/gates.json).
+unset GATES_FILE
+
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cockpit="$script_dir/cockpit.sh"
+cockpit_serve="$script_dir/cockpit-serve.sh"
 
 work="$(mktemp -d "${TMPDIR:-/tmp}/cockpit-test.XXXXXX")"
-trap 'rm -rf "$work"' EXIT
+# server_pid is set once the serve-mode smoke case (section 5, below) starts
+# cockpit-serve.sh in the background -- declared here so the SAME EXIT trap
+# cleans it up no matter where in the script a later assertion fails.
+server_pid=""
+cleanup() {
+  if [ -n "$server_pid" ]; then
+    kill "$server_pid" >/dev/null 2>&1 || true
+    wait "$server_pid" 2>/dev/null || true
+  fi
+  rm -rf "$work"
+}
+trap cleanup EXIT
 
 fail=0
 ok=0
@@ -177,6 +202,12 @@ check "live-section field escaping: raw <script> absent, escaped form present" b
   grep -qF "&lt;script&gt;xss()&lt;/script&gt;&quot;" "$1"
 ' _ "$html"
 
+# Dark theme by default (issue #69): stable marker a consumer/test can grep
+# for, plus the client-side module-filter hook (data-module on issue <li>s).
+check "dark theme marker present by default" grep -qF 'data-theme="dark"' "$html"
+check "theme-toggle button present" grep -q 'id="theme-toggle"' "$html"
+check "issue rows carry data-module for the client-side filter" grep -q 'data-module="module:harness"' "$html"
+
 # ---------------------------------------------------------------------------
 # 3. GATES_FILE override is honored (self-host adapter), still with fixtures
 #    (no gh/network either way).
@@ -207,6 +238,61 @@ check "PRs section shows unavailable placeholder" grep -q '<section id="prs"><h2
 check "routing/worktrees sections still render (no crash) despite gh failure" bash -c 'grep -q "routing" "$1" && grep -q "worktrees" "$1"' _ "$html_unavail"
 check "missing events file renders 'no active workers' placeholder" grep -q '<section id="live"><h2>Live worker progress</h2><p class="muted">no active workers</p>' "$html_unavail"
 
+# ---------------------------------------------------------------------------
+# 5. Serve mode (cockpit-serve.sh, issue #69): dashboard over HTTP + SSE live
+#    updates, entirely offline against the SAME fixtures used above (127.0.0.1
+#    only, no gh, no real network). server_pid + the EXIT trap declared near
+#    the top of this file guarantee the port/process are reclaimed even if an
+#    assertion below fails.
+# ---------------------------------------------------------------------------
+port="$(node -e '
+  const s = require("net").createServer();
+  s.listen(0, "127.0.0.1", () => { console.log(s.address().port); s.close(); });
+')"
+
+serve_log="$work/serve.log"
+: > "$serve_log"
+bash "$cockpit_serve" "$port" --fixtures "$work/fixtures" >"$serve_log" 2>&1 &
+server_pid=$!
+
+ready=0
+for _ in $(seq 1 50); do
+  grep -q "cockpit serving" "$serve_log" 2>/dev/null && { ready=1; break; }
+  kill -0 "$server_pid" 2>/dev/null || break # server died early -- stop polling
+  sleep 0.2
+done
+check "cockpit-serve.sh prints a startup line within the readiness timeout" [ "$ready" -eq 1 ]
+
+resp="$(curl -s -o - -w '%{http_code}' "http://127.0.0.1:$port/" 2>/dev/null)"
+serve_code="${resp: -3}"
+serve_body="${resp%???}"
+check "GET / returns HTTP 200" [ "$serve_code" = "200" ]
+check "GET / serves the dashboard (issues section present)" bash -c 'printf "%s" "$1" | grep -qF '"'"'<section id="issues"'"'"'' _ "$serve_body"
+check "GET / carries the dark-theme marker" bash -c 'printf "%s" "$1" | grep -qF '"'"'data-theme="dark"'"'"'' _ "$serve_body"
+check "GET / injects the SSE client script (EventSource)" bash -c 'printf "%s" "$1" | grep -q "EventSource"' _ "$serve_body"
+
+# Append a fresh event line to the SAME fixtures events.jsonl the server is
+# watching, then assert an /events subscriber sees it arrive within a few
+# seconds (fs.watch + poll fallback, see cockpit-serve.sh).
+printf '{"ts":"2026-01-01T00:10:00Z","role":"implementer","model":"sonnet","task":"69","phase":"implementing","lens":"","detail":""}\n' >>"$work/fixtures/events.jsonl"
+sse_out="$work/sse.out"
+: > "$sse_out"
+timeout 6 curl -sN "http://127.0.0.1:$port/events" >"$sse_out" 2>/dev/null &
+sse_pid=$!
+deadline=$((SECONDS + 5))
+sse_seen=0
+while [ "$SECONDS" -lt "$deadline" ]; do
+  grep -q '"task":"69"' "$sse_out" 2>/dev/null && { sse_seen=1; break; }
+  sleep 0.2
+done
+kill "$sse_pid" >/dev/null 2>&1 || true
+wait "$sse_pid" 2>/dev/null || true
+check "SSE /events delivers the newly appended events.jsonl line within the timeout" [ "$sse_seen" -eq 1 ]
+
+kill "$server_pid" >/dev/null 2>&1 || true
+wait "$server_pid" 2>/dev/null || true
+server_pid=""
+
 echo ""
 if [ "$fail" -eq 0 ]; then
   echo "cockpit.test.sh: PASS ($ok checks)"
diff --git a/.claude/self/checks.sh b/.claude/self/checks.sh
index 62a6469..4127cd7 100644
--- a/.claude/self/checks.sh
+++ b/.claude/self/checks.sh
@@ -5,7 +5,11 @@
 #
 #   build → every JSON config parses and each adapter has the required shape
 #   lint  → `bash -n` every shell script + `node --check` every workflow
-#   test  → build + lint smoke (validates the harness end-to-end on itself)
+#   test  → build + lint, PLUS every .claude/scripts/*.test.sh smoke test
+#           (cockpit.test.sh, log-event.test.sh, ...) — each is a standalone,
+#           offline (no gh/network) script that exits non-zero on failure, so
+#           new *.test.sh files are picked up automatically without touching
+#           this file again.
 set -uo pipefail
 
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
@@ -70,9 +74,19 @@ do_lint() {
   return "$rc"
 }
 
+do_test() {
+  local rc=0 f
+  for f in .claude/scripts/*.test.sh; do
+    [ -e "$f" ] || continue
+    echo "test: running $f"
+    bash "$f" || { echo "test: FAILED — $f"; rc=1; }
+  done
+  return "$rc"
+}
+
 case "$cmd" in
   build) do_build ;;
   lint)  do_lint ;;
-  test)  do_build && do_lint && echo "test: harness smoke OK" ;;
+  test)  do_build && do_lint && do_test && echo "test: harness smoke OK" ;;
   *) echo "checks.sh: unknown check '$cmd' (build|lint|test)"; exit 2 ;;
 esac