Spec (normative): 40-layer4-builtin-widgets.md.

9 builtins (stat-card, markdown, table, iframe-embed w/ embedSandbox policy, sessions, usage, cron, instances, activity) as thin RPC-read renders (NOT imports of existing pages); default main workspace seed; polling hygiene (stop on tab leave); DATA_READ_RPC_ALLOWLIST finalized.

• Loading/empty/error per widget; data-shape fixture tests
• iframe-embed sandbox×URL-policy matrix tested
• Default workspace screenshot (light+dark, 1280px + narrow)
• No chart deps; no orphan timers (tested)

Lane: coder; fast-worker for fixtures/i18n sweeps. Blocked by: L3.