diff --git a/go.mod b/go.mod
index 1afbe7e..a304213 100644
--- a/go.mod
+++ b/go.mod
@@ -2,4 +2,39 @@ module antidrift
 
 go 1.26.3
 
-require github.com/google/uuid v1.6.0 // indirect
+require (
+	github.com/gin-gonic/gin v1.12.0
+	github.com/google/uuid v1.6.0
+)
+
+require (
+	github.com/bytedance/gopkg v0.1.3 // indirect
+	github.com/bytedance/sonic v1.15.0 // indirect
+	github.com/bytedance/sonic/loader v0.5.0 // indirect
+	github.com/cloudwego/base64x v0.1.6 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
+	github.com/gin-contrib/sse v1.1.0 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-playground/validator/v10 v10.30.1 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/goccy/go-yaml v1.19.2 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
+	github.com/quic-go/quic-go v0.59.0 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+	github.com/ugorji/go/codec v1.3.1 // indirect
+	go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
+	golang.org/x/arch v0.22.0 // indirect
+	golang.org/x/crypto v0.48.0 // indirect
+	golang.org/x/net v0.51.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
+)
diff --git a/go.sum b/go.sum
index 7790d7c..0b62b83 100644
--- a/go.sum
+++ b/go.sum
@@ -1,2 +1,91 @@
+github.com/bytedance/gopkg v0.1.3 h1:TPBSwH8RsouGCBcMBktLt1AymVo2TVsBVCY4b6TnZ/M=
+github.com/bytedance/gopkg v0.1.3/go.mod h1:576VvJ+eJgyCzdjS+c4+77QF3p7ubbtiKARP3TxducM=
+github.com/bytedance/sonic v1.15.0 h1:/PXeWFaR5ElNcVE84U0dOHjiMHQOwNIx3K4ymzh/uSE=
+github.com/bytedance/sonic v1.15.0/go.mod h1:tFkWrPz0/CUCLEF4ri4UkHekCIcdnkqXw9VduqpJh0k=
+github.com/bytedance/sonic/loader v0.5.0 h1:gXH3KVnatgY7loH5/TkeVyXPfESoqSBSBEiDd5VjlgE=
+github.com/bytedance/sonic/loader v0.5.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
+github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
+github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
+github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
+github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
+github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
+github.com/gin-gonic/gin v1.12.0 h1:b3YAbrZtnf8N//yjKeU2+MQsh2mY5htkZidOM7O0wG8=
+github.com/gin-gonic/gin v1.12.0/go.mod h1:VxccKfsSllpKshkBWgVgRniFFAzFb9csfngsqANjnLc=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
+github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy06ntQJp0BBvFG0w=
+github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
+github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
+github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
+github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
+github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
+github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
+github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
+go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
+go.mongodb.org/mongo-driver/v2 v2.5.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
+golang.org/x/arch v0.22.0 h1:c/Zle32i5ttqRXjdLyyHZESLD/bB90DCU1g9l/0YBDI=
+golang.org/x/arch v0.22.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/internal/web/static/index.html b/internal/web/static/index.html
new file mode 100644
index 0000000..bd7d4f3
--- /dev/null
+++ b/internal/web/static/index.html
@@ -0,0 +1,102 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>AntiDrift</title>
+<style>
+  :root { color-scheme: dark; }
+  body { margin: 0; font: 16px/1.5 system-ui, sans-serif; background: #11131a; color: #e6e8ee; }
+  main { max-width: 640px; margin: 8vh auto; padding: 0 24px; }
+  h1 { font-size: 14px; letter-spacing: .2em; text-transform: uppercase; color: #7a8095; }
+  .card { background: #1a1d27; border: 1px solid #272b38; border-radius: 14px; padding: 28px; }
+  label { display: block; font-size: 13px; color: #9aa0b4; margin: 16px 0 6px; }
+  input { width: 100%; box-sizing: border-box; padding: 10px 12px; background: #11131a;
+          border: 1px solid #2d3242; border-radius: 8px; color: #e6e8ee; font: inherit; }
+  button { margin-top: 22px; padding: 11px 18px; border: 0; border-radius: 8px;
+           background: #4c6ef5; color: #fff; font: inherit; font-weight: 600; cursor: pointer; }
+  button:disabled { background: #2d3242; color: #6a7186; cursor: not-allowed; }
+  .timer { font-size: 56px; font-weight: 700; font-variant-numeric: tabular-nums; margin: 8px 0 4px; }
+  .action { font-size: 22px; font-weight: 600; }
+  .meta { color: #9aa0b4; }
+  .pill { display: inline-block; font-size: 12px; letter-spacing: .15em; text-transform: uppercase;
+          color: #7a8095; border: 1px solid #272b38; border-radius: 999px; padding: 3px 10px; }
+</style>
+</head>
+<body>
+<main>
+  <h1>AntiDrift</h1>
+  <div class="card" id="view">connecting…</div>
+</main>
+<script>
+const view = document.getElementById('view');
+let countdownTimer = null;
+
+function post(path, body) {
+  return fetch(path, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+}
+
+function fmt(secs) {
+  secs = Math.max(0, Math.floor(secs));
+  const m = String(Math.floor(secs / 60)).padStart(2, '0');
+  const s = String(secs % 60).padStart(2, '0');
+  return `${m}:${s}`;
+}
+
+function render(state) {
+  if (countdownTimer) { clearInterval(countdownTimer); countdownTimer = null; }
+  const rs = state.runtime_state;
+  if (rs === 'locked') {
+    view.innerHTML = `<span class="pill">Locked</span>
+      <p class="meta">No active commitment.</p>
+      <button id="plan">Start planning</button>`;
+    document.getElementById('plan').onclick = () => post('/planning');
+  } else if (rs === 'planning') {
+    view.innerHTML = `<span class="pill">Planning</span>
+      <label>Next action</label><input id="na" placeholder="What exactly will you do?">
+      <label>Success condition</label><input id="sc" placeholder="How do you know it's done?">
+      <label>Minutes</label><input id="mins" type="number" min="1" value="25">
+      <button id="start" disabled>Start commitment</button>`;
+    const na = document.getElementById('na'), sc = document.getElementById('sc'),
+          mins = document.getElementById('mins'), start = document.getElementById('start');
+    const check = () => { start.disabled = !(na.value.trim() && sc.value.trim() && +mins.value > 0); };
+    [na, sc, mins].forEach(el => el.oninput = check);
+    start.onclick = () => post('/commitment', {
+      next_action: na.value.trim(),
+      success_condition: sc.value.trim(),
+      timebox_secs: Math.round(+mins.value * 60),
+    });
+  } else if (rs === 'active') {
+    const c = state.commitment || {};
+    view.innerHTML = `<span class="pill">Active</span>
+      <div class="timer" id="t">--:--</div>
+      <div class="action">${c.next_action || ''}</div>
+      <p class="meta">Done when: ${c.success_condition || ''}</p>
+      <button id="done">Complete</button>`;
+    document.getElementById('done').onclick = () => post('/complete');
+    const t = document.getElementById('t');
+    const tick = () => { t.textContent = fmt((c.deadline_unix_secs || 0) - Date.now() / 1000); };
+    tick();
+    countdownTimer = setInterval(tick, 250);
+  } else if (rs === 'review') {
+    const c = state.commitment || {};
+    view.innerHTML = `<span class="pill">Review</span>
+      <p class="action">Session ended</p>
+      <p class="meta">${c.next_action || ''}</p>
+      <button id="end">End</button>`;
+    document.getElementById('end').onclick = () => post('/end');
+  } else {
+    view.textContent = rs;
+  }
+}
+
+const es = new EventSource('/events');
+es.onmessage = (e) => render(JSON.parse(e.data));
+es.onerror = () => { view.textContent = 'disconnected — is antidriftd running?'; };
+</script>
+</body>
+</html>
diff --git a/internal/web/web.go b/internal/web/web.go
new file mode 100644
index 0000000..044f4d8
--- /dev/null
+++ b/internal/web/web.go
@@ -0,0 +1,185 @@
+// Package web serves the local UI and an SSE state stream, and owns the
+// server-authoritative timebox expiry timer.
+package web
+
+import (
+	"embed"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"net/http"
+	"sync"
+	"time"
+
+	"antidrift/internal/session"
+	"antidrift/internal/statemachine"
+
+	"github.com/gin-gonic/gin"
+)
+
+//go:embed static/*
+var staticFS embed.FS
+
+// Server wires the session controller to HTTP and SSE.
+type Server struct {
+	ctrl  *session.Controller
+	bcast *Broadcaster
+
+	mu    sync.Mutex
+	timer *time.Timer
+}
+
+func NewServer(ctrl *session.Controller) *Server {
+	return &Server{ctrl: ctrl, bcast: NewBroadcaster()}
+}
+
+func (s *Server) Router() *gin.Engine {
+	r := gin.New()
+	r.Use(gin.Recovery())
+
+	sub, _ := fs.Sub(staticFS, "static")
+	r.GET("/", func(c *gin.Context) {
+		c.FileFromFS("/", http.FS(sub))
+	})
+	r.GET("/events", s.handleEvents)
+	r.POST("/planning", s.handlePlanning)
+	r.POST("/commitment", s.handleCommitment)
+	r.POST("/complete", s.handleComplete)
+	r.POST("/end", s.handleEnd)
+	return r
+}
+
+func (s *Server) stateJSON() string {
+	data, _ := json.Marshal(s.ctrl.State())
+	return string(data)
+}
+
+func (s *Server) broadcast() {
+	s.bcast.Publish(s.stateJSON())
+}
+
+// respond maps a controller error to an HTTP status, otherwise broadcasts and
+// returns the new state.
+func (s *Server) respond(c *gin.Context, err error) {
+	if err != nil {
+		var illegal statemachine.IllegalTransitionError
+		if errors.As(err, &illegal) {
+			c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	s.broadcast()
+	c.Data(http.StatusOK, "application/json", []byte(s.stateJSON()))
+}
+
+func (s *Server) handlePlanning(c *gin.Context) {
+	s.cancelExpiry()
+	s.respond(c, s.ctrl.EnterPlanning())
+}
+
+type commitmentRequest struct {
+	NextAction       string `json:"next_action"`
+	SuccessCondition string `json:"success_condition"`
+	TimeboxSecs      int64  `json:"timebox_secs"`
+}
+
+func (s *Server) handleCommitment(c *gin.Context) {
+	var req commitmentRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid json"})
+		return
+	}
+	err := s.ctrl.StartManualCommitment(req.NextAction, req.SuccessCondition, time.Duration(req.TimeboxSecs)*time.Second)
+	if err == nil {
+		s.armExpiry()
+	}
+	s.respond(c, err)
+}
+
+func (s *Server) handleComplete(c *gin.Context) {
+	s.cancelExpiry()
+	s.respond(c, s.ctrl.Complete())
+}
+
+func (s *Server) handleEnd(c *gin.Context) {
+	s.respond(c, s.ctrl.End())
+}
+
+func (s *Server) handleEvents(c *gin.Context) {
+	c.Header("Content-Type", "text/event-stream")
+	c.Header("Cache-Control", "no-cache")
+	c.Header("Connection", "keep-alive")
+
+	flusher, ok := c.Writer.(http.Flusher)
+	if !ok {
+		c.Status(http.StatusInternalServerError)
+		return
+	}
+	ch := s.bcast.Subscribe()
+	defer s.bcast.Unsubscribe(ch)
+
+	fmt.Fprintf(c.Writer, "data: %s\n\n", s.stateJSON())
+	flusher.Flush()
+
+	for {
+		select {
+		case <-c.Request.Context().Done():
+			return
+		case msg, open := <-ch:
+			if !open {
+				return
+			}
+			fmt.Fprintf(c.Writer, "data: %s\n\n", msg)
+			flusher.Flush()
+		}
+	}
+}
+
+// armExpiry schedules an Active -> Review transition at the commitment deadline.
+func (s *Server) armExpiry() {
+	deadline := s.ctrl.Deadline()
+	if deadline.IsZero() {
+		return
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.timer != nil {
+		s.timer.Stop()
+	}
+	d := time.Until(deadline)
+	if d < 0 {
+		d = 0
+	}
+	s.timer = time.AfterFunc(d, func() {
+		if err := s.ctrl.Complete(); err == nil {
+			s.broadcast()
+		}
+	})
+}
+
+func (s *Server) cancelExpiry() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.timer != nil {
+		s.timer.Stop()
+		s.timer = nil
+	}
+}
+
+// Init re-arms or expires a restored Active session at startup.
+func (s *Server) Init() {
+	st := s.ctrl.State()
+	if st.RuntimeState != "active" {
+		return
+	}
+	if s.ctrl.Deadline().After(time.Now()) {
+		s.armExpiry()
+		return
+	}
+	if err := s.ctrl.Complete(); err == nil {
+		s.broadcast()
+	}
+}
diff --git a/internal/web/web_test.go b/internal/web/web_test.go
new file mode 100644
index 0000000..34b1a05
--- /dev/null
+++ b/internal/web/web_test.go
@@ -0,0 +1,71 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"antidrift/internal/domain"
+	"antidrift/internal/session"
+
+	"github.com/gin-gonic/gin"
+)
+
+func newTestServer(t *testing.T) *Server {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	path := filepath.Join(t.TempDir(), "state.json")
+	ctrl, err := session.New(path)
+	if err != nil {
+		t.Fatalf("controller: %v", err)
+	}
+	return NewServer(ctrl)
+}
+
+func post(t *testing.T, r http.Handler, path, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+	return w
+}
+
+func TestPlanningThenCommitmentReachesActive(t *testing.T) {
+	s := newTestServer(t)
+	r := s.Router()
+
+	if w := post(t, r, "/planning", ""); w.Code != http.StatusOK {
+		t.Fatalf("/planning code %d", w.Code)
+	}
+	body := `{"next_action":"Build web","success_condition":"web tests pass","timebox_secs":1500}`
+	if w := post(t, r, "/commitment", body); w.Code != http.StatusOK {
+		t.Fatalf("/commitment code %d body %s", w.Code, w.Body.String())
+	}
+	if s.ctrl.State().RuntimeState != domain.RuntimeActive {
+		t.Fatalf("expected Active, got %s", s.ctrl.State().RuntimeState)
+	}
+}
+
+func TestCommitmentRejectsInvalidInput(t *testing.T) {
+	s := newTestServer(t)
+	r := s.Router()
+	_ = post(t, r, "/planning", "")
+	body := `{"next_action":"","success_condition":"x","timebox_secs":1500}`
+	w := post(t, r, "/commitment", body)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", w.Code)
+	}
+}
+
+func TestIllegalTransitionReturns409(t *testing.T) {
+	s := newTestServer(t)
+	r := s.Router()
+	// /complete from Locked is illegal.
+	w := post(t, r, "/complete", "")
+	if w.Code != http.StatusConflict {
+		t.Fatalf("expected 409, got %d", w.Code)
+	}
+}