diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 600e583..b216b1f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -123,7 +123,7 @@ jobs:
 
       # usage-example applies three things from mavenLocal: packpack (through the plugin), the
       # toolchain plugin, and python-multiplatform's library and bindings plugin. Versions pinned in
-      # usage-example/gradle/libs.versions.toml (3.15.0-alpha01).
+      # usage-example/gradle/libs.versions.toml (3.15.0-alpha03).
       - name: Publish packpack, the toolchain plugin and python-multiplatform to mavenLocal
         run: |
           (cd .ci/pypackpack && ./gradlew :packpack:publishToMavenLocal --console=plain)
diff --git a/README.md b/README.md
index 0e1a225..4057a1a 100644
--- a/README.md
+++ b/README.md
@@ -85,7 +85,7 @@ plugins {
 }
 
 python {
-    compileSdk = "3.13"
+    compileSdk = "3.15.0"                       // the CPython python-multiplatform provides
     localLibraryPath = "src/commonMain/python"  // a pypackpack package: pyproject.toml + src/main/<pkg>
     packaging {
         fileName = "usage-example"
@@ -120,7 +120,8 @@ python {
 Python only? Skip Gradle builds entirely:
 
 ```shell
-./gradlew :toolchain:runTcl --args="install pythonx-compose"
+uv tool install toolchain-lite
+tcl install pythonx-compose
 ```
 
 ## 🧭 Architecture at a glance
diff --git a/docs/guide/getting-started.html b/docs/guide/getting-started.html
index 542960f..3da9e8c 100644
--- a/docs/guide/getting-started.html
+++ b/docs/guide/getting-started.html
@@ -56,7 +56,7 @@ <h2><span data-lang="en">3. Apply the plugin</span><span data-lang="ko">3. 플
 }
 
 python {
-    compileSdk = &quot;3.13&quot;
+    compileSdk = &quot;3.15.0&quot;
     localLibraryPath = &quot;src/commonMain/python&quot;
     packaging {
         fileName = &quot;usage-example&quot;
diff --git a/docs/guide/guide-staging.html b/docs/guide/guide-staging.html
index 8ec2862..a446939 100644
--- a/docs/guide/guide-staging.html
+++ b/docs/guide/guide-staging.html
@@ -60,6 +60,33 @@ <h2><span data-lang="en">iOS: the Xcode build phase</span><span data-lang="ko">i
 <h2><span data-lang="en">After staging</span><span data-lang="ko">스테이징 이후</span></h2>
 <p data-lang="en">Putting the staged <code>python/</code> on <code>sys.path</code> when the app starts is the runtime's job: <a href="ecosystem.html">python-multiplatform</a>'s side of the boundary, not this plugin's.</p><p data-lang="ko">앱이 시작할 때 스테이징된 <code>python/</code> 을 <code>sys.path</code> 에 올리는 것은 런타임의 일입니다: 이 플러그인이 아니라 <a href="ecosystem.html">python-multiplatform</a> 쪽 경계입니다.</p>
 </section>
+
+<section id="wasm-isolation">
+<h2><span data-lang="en">WASM: cross-origin isolation and its limits</span><span data-lang="ko">WASM: 교차 출처 격리와 그 한계</span></h2>
+<p data-lang="en">WASM runs free-threaded CPython 3.15t with pthreads. WebAssembly threads require <code>SharedArrayBuffer</code>, which browsers only expose when <code>self.crossOriginIsolated === true</code>: <code>Cross-Origin-Opener-Policy: same-origin</code> together with <code>Cross-Origin-Embedder-Policy: require-corp</code> (or <code>credentialless</code> via <code>-Ppython.wasm.coep=credentialless</code>), plus <code>Cross-Origin-Resource-Policy: same-origin</code> on the app's own assets. Cross-origin isolation is on by default for every WASM app this plugin builds:</p><p data-lang="ko">WASM 은 pthreads 기반 자유 스레드 CPython 3.15t 로 실행됩니다. WebAssembly 스레드는 <code>SharedArrayBuffer</code> 가 필요하며, 브라우저는 <code>self.crossOriginIsolated === true</code> 일 때만 이를 열어 줍니다: <code>Cross-Origin-Opener-Policy: same-origin</code> 과 <code>Cross-Origin-Embedder-Policy: require-corp</code>(또는 <code>-Ppython.wasm.coep=credentialless</code> 로 고르는 <code>credentialless</code>), 그리고 앱 자체 자산의 <code>Cross-Origin-Resource-Policy: same-origin</code> 입니다. 이 플러그인이 빌드하는 모든 WASM 앱에는 교차 출처 격리가 기본으로 켜집니다:</p>
+<ul>
+<li><span data-lang="en"><strong>Dev server headers:</strong> every <code>wasmJs*Webpack</code> task writes <code>webpack.config.d/python-cross-origin-isolation.js</code> so the local webpack dev server sends all three headers automatically.</span><span data-lang="ko"><strong>개발 서버 헤더:</strong> 모든 <code>wasmJs*Webpack</code> 태스크가 <code>webpack.config.d/python-cross-origin-isolation.js</code> 를 기록해 로컬 webpack 개발 서버가 세 헤더를 자동으로 보냅니다.</span></li>
+<li><span data-lang="en"><strong>Static host headers (<code>_headers</code>):</strong> <code>stageWasmCrossOriginIsolation</code> emits a Cloudflare Pages and Netlify <code>_headers</code> file into the WASM browser distribution root.</span><span data-lang="ko"><strong>정적 호스트 헤더(<code>_headers</code>):</strong> <code>stageWasmCrossOriginIsolation</code> 이 Cloudflare Pages 와 Netlify 형식의 <code>_headers</code> 파일을 WASM 브라우저 배포 루트에 생성합니다.</span></li>
+<li><span data-lang="en"><strong>Service-worker fallback (<code>coi-serviceworker.js</code>) and check page (<code>coi-check.html</code>):</strong> for hosts that cannot set HTTP headers (such as GitHub Pages), <code>coi-serviceworker.js</code> intercepts fetches and re-serves responses with COOP, COEP and CORP. Its cost is <strong>one reload on the first visit</strong>, and it has <strong>no effect when service workers are unavailable</strong> (non-HTTPS origins other than localhost, or webviews with service workers disabled). At startup the runtime checks <code>self.crossOriginIsolated</code> and fails immediately rather than failing later inside a thread; <code>coi-check.html</code> tests the same invariant on its own.</span><span data-lang="ko"><strong>서비스 워커 폴백(<code>coi-serviceworker.js</code>)과 점검 페이지(<code>coi-check.html</code>):</strong> GitHub Pages 처럼 HTTP 헤더를 설정할 수 없는 호스트를 위해, <code>coi-serviceworker.js</code> 가 요청을 가로채 COOP, COEP, CORP 헤더를 붙여 응답합니다. 그 비용은 <strong>첫 방문 시 1회 새로고침</strong>이며, <strong>서비스 워커를 쓸 수 없는 환경에서는 효과가 없습니다</strong>(localhost 이외의 비-HTTPS 출처나 서비스 워커가 꺼진 웹뷰). 시작 시 런타임이 <code>self.crossOriginIsolated</code> 를 확인해 스레드 안에서 뒤늦게 죽는 대신 즉시 실패하며, <code>coi-check.html</code> 로도 같은 조건을 바로 점검할 수 있습니다.</span></li>
+</ul>
+<h3><span data-lang="en">Browser limits of cross-origin isolation</span><span data-lang="ko">교차 출처 격리의 브라우저 제약</span></h3>
+<div class="table-wrap"><table><thead><tr><th><span data-lang="en">Surface</span><span data-lang="ko">영역</span></th><th><span data-lang="en">What cross-origin isolation changes</span><span data-lang="ko">교차 출처 격리로 달라지는 점</span></th><th><span data-lang="en">What to do</span><span data-lang="ko">대응 방법</span></th></tr></thead><tbody><tr><td><span data-lang="en">Third-party <code>&lt;iframe&gt;</code></span><span data-lang="ko">제3자 <code>&lt;iframe&gt;</code></span></td><td><span data-lang="en">Embedded cross-origin documents must opt in with CORP/COEP headers, or the browser refuses to load them.</span><span data-lang="ko">내장된 교차 출처 문서가 CORP/COEP 헤더로 동의하지 않으면 브라우저가 로드를 거부합니다.</span></td><td><span data-lang="en">Serve the framed document with <code>Cross-Origin-Embedder-Policy</code> and <code>Cross-Origin-Resource-Policy: cross-origin</code>, or open it in a top-level navigation instead of an iframe.</span><span data-lang="ko">iframe 문서에 <code>Cross-Origin-Embedder-Policy</code> 와 <code>Cross-Origin-Resource-Policy: cross-origin</code> 을 설정하거나, iframe 대신 최상위 탐색으로 여세요.</span></td></tr><tr><td><span data-lang="en">Popup OAuth and payment flows</span><span data-lang="ko">팝업 기반 OAuth 및 결제 흐름</span></td><td><span data-lang="en">Under <code>Cross-Origin-Opener-Policy: same-origin</code>, cross-origin popups lose <code>window.opener</code> (it becomes <code>null</code>), so <code>postMessage</code> handshakes back to the opener break.</span><span data-lang="ko"><code>Cross-Origin-Opener-Policy: same-origin</code> 아래에서는 교차 출처 팝업의 <code>window.opener</code> 가 <code>null</code> 이 되어, 부모 창으로의 <code>postMessage</code> 핸드셰이크가 끊깁니다.</span></td><td><span data-lang="en">Use full-page redirect OAuth/payment flows, or configure the host with <code>same-origin-allow-popups</code> where the browser's isolation rules permit it.</span><span data-lang="ko">전체 페이지 리다이렉트 방식의 OAuth/결제 흐름을 쓰거나, 브라우저 격리 규칙이 허용하는 범위에서 호스트에 <code>same-origin-allow-popups</code> 를 설정하세요.</span></td></tr><tr><td><span data-lang="en">External images, scripts, fonts and media</span><span data-lang="ko">외부 이미지, 스크립트, 글꼴, 미디어</span></td><td><span data-lang="en">Under <code>Cross-Origin-Embedder-Policy: require-corp</code>, any cross-origin subresource without a <code>Cross-Origin-Resource-Policy</code> or CORS header is blocked.</span><span data-lang="ko"><code>Cross-Origin-Embedder-Policy: require-corp</code> 아래에서는 <code>Cross-Origin-Resource-Policy</code> 나 CORS 헤더가 없는 교차 출처 하위 리소스가 차단됩니다.</span></td><td><span data-lang="en">Add <code>crossorigin</code> attributes and serve CORS/CORP headers on the asset host, or build with <code>-Ppython.wasm.coep=credentialless</code> so no-cookie cross-origin requests load without CORP.</span><span data-lang="ko"><code>crossorigin</code> 속성을 붙이고 자산 호스트에서 CORS/CORP 헤더를 내려주거나, 쿠키 없는 교차 출처 요청을 CORP 없이 로드하도록 <code>-Ppython.wasm.coep=credentialless</code> 로 빌드하세요.</span></td></tr></tbody></table></div>
+<h3><span data-lang="en">Header snippets for other hosts</span><span data-lang="ko">다른 호스트를 위한 헤더 설정 예시</span></h3>
+<p data-lang="en">Cloudflare Pages and Netlify read the generated <code>_headers</code> file directly. For nginx, Apache, Firebase Hosting or Vercel, add the same headers in the host configuration:</p><p data-lang="ko">Cloudflare Pages 와 Netlify 는 생성된 <code>_headers</code> 파일을 바로 읽습니다. nginx, Apache, Firebase Hosting, Vercel 에서는 호스트 설정에 같은 헤더를 추가하세요:</p>
+<pre><code># nginx
+add_header Cross-Origin-Opener-Policy "same-origin" always;
+add_header Cross-Origin-Embedder-Policy "require-corp" always;
+add_header Cross-Origin-Resource-Policy "same-origin" always;
+
+# Apache (.htaccess)
+Header always set Cross-Origin-Opener-Policy "same-origin"
+Header always set Cross-Origin-Embedder-Policy "require-corp"
+Header always set Cross-Origin-Resource-Policy "same-origin"
+
+# Firebase Hosting (firebase.json) / Vercel (vercel.json)
+# Set headers on "/(.*)" -> Cross-Origin-Opener-Policy: same-origin,
+# Cross-Origin-Embedder-Policy: require-corp, Cross-Origin-Resource-Policy: same-origin</code></pre>
+</section>
 </article></div>
 </main>
 <footer class="site-footer"><div class="wrap">
diff --git a/docs/guide/guide-tcl.html b/docs/guide/guide-tcl.html
index ba9df2f..4aba534 100644
--- a/docs/guide/guide-tcl.html
+++ b/docs/guide/guide-tcl.html
@@ -28,12 +28,12 @@ <h1><span data-lang="en">tcl for Python users</span><span data-lang="ko">Python
 
 <section>
 <h2><span data-lang="en">Install a package</span><span data-lang="ko">패키지 설치</span></h2>
-<pre><code class="language-shell">uv tool install toolchain-lite    # once 0.1.0 is on PyPI
+<pre><code class="language-shell">uv tool install toolchain-lite
 tcl install pythonx-compose
 tcl --version
 
 ./gradlew :toolchain:runTcl --args=&quot;install pythonx-compose&quot;    # from a checkout</code></pre>
-<p data-lang="en"><code>tcl install &lt;package&gt;</code> looks for a <code>pyproject.toml</code> in the current directory and its parents. If there is none it runs <code>uv init --bare</code> first; then it adds the package with <code>uv add</code>, through the same pypackpack backend the Gradle plugin uses.</p><p data-lang="ko"><code>tcl install &lt;package&gt;</code> 는 현재 디렉터리와 그 상위에서 <code>pyproject.toml</code> 을 찾습니다. 없으면 먼저 <code>uv init --bare</code> 를 실행하고, Gradle 플러그인과 같은 pypackpack 백엔드로 <code>uv add</code> 를 해서 패키지를 추가합니다.</p>
+<p data-lang="en"><code>tcl install &lt;package&gt;</code> uses the <code>pyproject.toml</code> in the current directory. Inside a git repository it also looks in the parent directories, up to the repository root and never above it; outside a repository it does not look in parents at all, so an unrelated project above you is never edited. If there is none it runs <code>uv init --bare --no-workspace</code> in the current directory first; then it adds the package with <code>uv add</code>, through the same pypackpack backend the Gradle plugin uses.</p><p data-lang="ko"><code>tcl install &lt;package&gt;</code> 는 현재 디렉터리의 <code>pyproject.toml</code> 을 씁니다. git 저장소 안이면 상위 디렉터리도 저장소 루트까지만 찾고 그 위로는 가지 않습니다. 저장소 밖이면 상위 디렉터리를 아예 찾지 않으므로, 위에 있는 관계없는 프로젝트를 고치는 일이 없습니다. 없으면 먼저 현재 디렉터리에서 <code>uv init --bare --no-workspace</code> 를 실행하고, Gradle 플러그인과 같은 pypackpack 백엔드로 <code>uv add</code> 를 해서 패키지를 추가합니다.</p>
 <div class="table-wrap"><table><thead><tr><th><span data-lang="en">Invocation</span><span data-lang="ko">호출</span></th><th><span data-lang="en">Result</span><span data-lang="ko">결과</span></th></tr></thead><tbody><tr><td><code>tcl install pkg</code></td><td><span data-lang="en">exit 0, <code>uv</code> output on stdout</span><span data-lang="ko">종료 코드 0, stdout 에 <code>uv</code> 출력</span></td></tr><tr><td><code>tcl</code></td><td><span data-lang="en">exit 1, <code>Usage: tcl install &lt;package&gt;</code></span><span data-lang="ko">종료 코드 1, <code>Usage: tcl install &lt;package&gt;</code></span></td></tr><tr><td><code>tcl install</code></td><td><span data-lang="en">exit 1, missing argument</span><span data-lang="ko">종료 코드 1, 인자 누락</span></td></tr><tr><td><code>tcl other</code></td><td><span data-lang="en">exit 1, unknown command</span><span data-lang="ko">종료 코드 1, 알 수 없는 명령</span></td></tr></tbody></table></div>
 <div class="note"><p data-lang="en"><code>install</code> is the only command, matching issue #1. <code>tcl</code> needs <code>uv</code> on <code>PATH</code> and network access to PyPI.</p><p data-lang="ko">명령은 이슈 #1 그대로 <code>install</code> 하나뿐입니다. <code>tcl</code> 은 <code>PATH</code> 의 <code>uv</code> 와 PyPI 네트워크 접근이 필요합니다.</p></div>
 </section>
diff --git a/docs/guide/status.html b/docs/guide/status.html
index d6dc6b2..dc9a7fe 100644
--- a/docs/guide/status.html
+++ b/docs/guide/status.html
@@ -29,7 +29,8 @@ <h1><span data-lang="en">Status &amp; FAQ</span><span data-lang="ko">상태와 F
 <section>
 <h2 id="features"><span data-lang="en">Feature status</span><span data-lang="ko">기능 상태</span></h2>
 <div class="table-wrap"><table><thead><tr><th><span data-lang="en">Feature</span><span data-lang="ko">기능</span></th><th><span data-lang="en">Status</span><span data-lang="ko">상태</span></th><th><span data-lang="en">Evidence</span><span data-lang="ko">근거</span></th></tr></thead><tbody><tr><td><span data-lang="en">Applying the plugin: <code>python</code> extension and tasks</span><span data-lang="ko">플러그인 적용: <code>python</code> 확장과 태스크</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonPluginApplyTest</code></td></tr><tr><td><span data-lang="en"><code>compileSdk</code> parsing: alpha · rc · normal</span><span data-lang="ko"><code>compileSdk</code> 파싱: alpha · rc · normal</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonVersionTest</code></td></tr><tr><td><span data-lang="en">Platform → triple mapping, Kotlin target check, min SDK</span><span data-lang="ko">플랫폼 → 트리플 매핑, Kotlin 타깃 확인, 최소 SDK</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonExtensionPlatformDslTest, PlatformTargetMappingTest, PythonPluginPlatformsTest</code></td></tr><tr><td><span data-lang="en"><code>debug</code> / <code>release</code>, <code>-Ppython.buildType</code></span><span data-lang="ko"><code>debug</code> / <code>release</code>, <code>-Ppython.buildType</code></span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonPluginBuildTypeTest</code></td></tr><tr><td><span data-lang="en">Per-variant task graph</span><span data-lang="ko">변형별 태스크 그래프</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonPluginVariantGraphTest</code></td></tr><tr><td><span data-lang="en"><code>compileLevel = instant</code> · <code>bytecode</code> (<code>.venv</code> and <code>compileSdk</code> minor checked); others rejected per variant</span><span data-lang="ko"><code>compileLevel = instant</code> · <code>bytecode</code> (<code>.venv</code> 와 <code>compileSdk</code> 마이너 버전 확인); 나머지는 변형별 거부</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonPluginBuildLevelTest, BytecodeLevelTest</code></td></tr><tr><td><span data-lang="en"><code>srcDirs</code> / <code>metaDirs</code> / <code>libDirs</code></span><span data-lang="ko"><code>srcDirs</code> / <code>metaDirs</code> / <code>libDirs</code></span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonPluginSourceSetTest</code></td></tr><tr><td><span data-lang="en"><code>implementation</code> / <code>integration</code> → <code>uv add</code></span><span data-lang="ko"><code>implementation</code> / <code>integration</code> → <code>uv add</code></span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonPluginDependencyTest, InstallDependenciesTaskTest</code></td></tr><tr><td><span data-lang="en">Bundling via pypackpack's resource bundler</span><span data-lang="ko">pypackpack 리소스 번들러로 번들링</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>BuildPythonArtifactTaskTest</code></td></tr><tr><td><span data-lang="en"><code>packagePython</code> zip</span><span data-lang="ko"><code>packagePython</code> zip</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>AssemblePythonPackageTaskTest</code></td></tr><tr><td><span data-lang="en">Staging copy rule and variant selection</span><span data-lang="ko">스테이징 복사 규칙과 변형 선택</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>StagePythonBundleTaskTest, PythonPluginStagingTest</code></td></tr><tr><td><span data-lang="en"><code>tcl install</code></span><span data-lang="ko"><code>tcl install</code></span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>CliArgsTest, InstallerTest</code></td></tr><tr><td><span data-lang="en"><code>tcl --help</code>, <code>tcl --version</code></span><span data-lang="ko"><code>tcl --help</code>, <code>tcl --version</code></span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>CliArgsTest</code></td></tr><tr><td><span data-lang="en">toolchain-lite on PyPI (<code>uv tool install toolchain-lite</code>)</span><span data-lang="ko">PyPI 의 toolchain-lite (<code>uv tool install toolchain-lite</code>)</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><span data-lang="en">0.1.0 is on PyPI (2026-10-03), four platform wheels, each smoke-tested before upload</span><span data-lang="ko">0.1.0 이 PyPI 에 있음 (2026-10-03). 플랫폼 휠 네 개, 업로드 전에 각각 스모크 테스트</span></td></tr><tr><td><span data-lang="en">Staging into the desktop jar</span><span data-lang="ko">데스크톱 jar 로의 스테이징</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonPluginAttachmentTest</code></td></tr><tr><td><span data-lang="en">Staging into the APK</span><span data-lang="ko">APK 로의 스테이징</span></td><td><span data-lang="en" class="pill part">partial</span><span data-lang="ko" class="pill part">부분</span></td><td><span data-lang="en">asset root tested (<code>PythonPluginAttachmentTest</code>); task dependency untested</span><span data-lang="ko">에셋 루트는 테스트됨 (<code>PythonPluginAttachmentTest</code>), 태스크 의존성은 테스트 없음</span></td></tr><tr><td><span data-lang="en">Hot reload</span><span data-lang="ko">핫 리로드</span></td><td><span data-lang="en" class="pill plan">planned</span><span data-lang="ko" class="pill plan">계획</span></td><td><span data-lang="en">Does not work yet: <code>hotReloadPython</code> fails saying so (#103). A live connection to the running app replaces it</span><span data-lang="ko">아직 동작하지 않습니다. <code>hotReloadPython</code> 은 그렇게 알리며 실패합니다 (#103). 실행 중인 앱으로의 라이브 연결이 대신합니다</span></td></tr><tr><td><span data-lang="en">Dev agent launch: <code>enableHotReload</code> stages python-multiplatform's agent marker; desktop <code>run</code> gets a port, a 32-byte token and <code>build/pythonDevAgent/&lt;task&gt;.json</code></span><span data-lang="ko">개발 에이전트 실행: <code>enableHotReload</code> 가 python-multiplatform 에이전트 마커를 스테이징하고, 데스크톱 <code>run</code> 이 포트, 32바이트 토큰, <code>build/pythonDevAgent/&lt;task&gt;.json</code> 을 받음</span></td><td><span data-lang="en" class="pill part">partial</span><span data-lang="ko" class="pill part">부분</span></td><td><span data-lang="en"><code>DevAgentLaunchTest, StagePythonBundleTaskTest, PythonPluginDevAgentTest</code>; nothing on the laptop connects yet (#105)</span><span data-lang="ko"><code>DevAgentLaunchTest, StagePythonBundleTaskTest, PythonPluginDevAgentTest</code>; 아직 노트북 쪽에서 연결하는 것은 없음 (#105)</span></td></tr><tr><td><span data-lang="en">Code push</span><span data-lang="ko">코드 푸시</span></td><td><span data-lang="en" class="pill part">partial</span><span data-lang="ko" class="pill part">부분</span></td><td><span data-lang="en">validation only</span><span data-lang="ko">검증만</span></td></tr><tr><td><span data-lang="en">Dependencies per source set, installed for each variant's own triple into its bundle</span><span data-lang="ko">소스셋별 의존성을 변형마다 그 트리플용으로 설치해 번들에 포함</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>TargetDependenciesTest, PythonPluginTargetDependenciesTest, InstallTargetDependenciesTaskTest</code></td></tr><tr><td><span data-lang="en"><code>integration()</code>: warn when the wheel has no <code>KLIBDEPENS</code></span><span data-lang="ko"><code>integration()</code>: 휠에 <code>KLIBDEPENS</code> 가 없으면 경고</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>KlibDepensTest, PythonPluginIntegrationListTest</code></td></tr><tr><td><span data-lang="en"><code>native</code> / <code>mixed</code></span><span data-lang="ko"><code>native</code> / <code>mixed</code></span></td><td><span data-lang="en" class="pill plan">planned</span><span data-lang="ko" class="pill plan">계획</span></td><td><span data-lang="en">needs pypackpack#19</span><span data-lang="ko">pypackpack#19 선행 필요</span></td></tr><tr><td><span data-lang="en">iOS: attaching the staged payload (<code>stagePythonBundleIosForXcode</code> prints the path; the Xcode phase is python-multiplatform's, #59)</span><span data-lang="ko">iOS: 스테이징된 페이로드 연결 (<code>stagePythonBundleIosForXcode</code> 가 경로 출력, Xcode 단계는 python-multiplatform #59 소유)</span></td><td><span data-lang="en" class="pill part">partial</span><span data-lang="ko" class="pill part">부분</span></td><td><code>StagePythonBundleIosForXcodeTaskTest, StagePythonPayloadScriptTest</code></td></tr><tr><td><span data-lang="en"><code>buildFeatures { metaclass }</code> and <code>excludeMetaclass</code>: <code>metaDirs</code> forwarded or dropped</span><span data-lang="ko"><code>buildFeatures { metaclass }</code> 와 <code>excludeMetaclass</code>: <code>metaDirs</code> 전달 또는 제외</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>BuildFeaturesTest, PythonPluginBuildFeaturesTest</code></td></tr><tr><td><span data-lang="en"><code>buildFeatures { compose }</code>: installs <code>pythonx-compose</code>, adds <code>python-multiplatform-compose</code> to <code>commonMain</code></span><span data-lang="ko"><code>buildFeatures { compose }</code>: <code>pythonx-compose</code> 설치, <code>commonMain</code> 에 <code>python-multiplatform-compose</code> 추가</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><span data-lang="en"><code>BuildFeaturesTest, PythonPluginBuildFeaturesTest</code>; locations from two Gradle properties</span><span data-lang="ko"><code>BuildFeaturesTest, PythonPluginBuildFeaturesTest</code>; 위치는 Gradle 속성 두 개로 지정</span></td></tr><tr><td><span data-lang="en"><code>embedLevel</code>: 0/1/2 resolved per platform (Android and iOS raise to 2 with a warning), <code>-Ppython.embedLevel</code> override, recorded in <code>embed.json</code> with the expected interpreter version; level 2 means python-multiplatform embeds the interpreter, and the bundle stays <code>python/</code> only</span><span data-lang="ko"><code>embedLevel</code>: 플랫폼별 0/1/2 결정 (Android, iOS 는 경고와 함께 2 로 상향), <code>-Ppython.embedLevel</code> 재정의, 기대 인터프리터 버전과 함께 <code>embed.json</code> 에 기록; 레벨 2 는 python-multiplatform 이 인터프리터를 내장한다는 뜻이고, 번들은 <code>python/</code> 만 담음</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>EmbedLevelTest, PythonPluginEmbedLevelTest, PythonPluginPythonOnlyTest</code></td></tr><tr><td><span data-lang="en"><code>useCodeMinifier</code></span><span data-lang="ko"><code>useCodeMinifier</code></span></td><td><span data-lang="en" class="pill plan">planned</span><span data-lang="ko" class="pill plan">계획</span></td><td><span data-lang="en">declared, unread</span><span data-lang="ko">선언만, 읽히지 않음</span></td></tr><tr><td><span data-lang="en"><code>defaultConfig { pip }</code>: <code>central</code> · <code>local</code> · <code>autoUpdate</code></span><span data-lang="ko"><code>defaultConfig { pip }</code>: <code>central</code> · <code>local</code> · <code>autoUpdate</code></span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PipRepositoriesTest</code></td></tr><tr><td><span data-lang="en"><code>pip { jit }</code></span><span data-lang="ko"><code>pip { jit }</code></span></td><td><span data-lang="en" class="pill plan">planned</span><span data-lang="ko" class="pill plan">계획</span></td><td>-</td></tr><tr><td><span data-lang="en"><code>compileSdk</code> constants (<code>PY3_15_0</code>); unprovided versions and GIL-only CPython before 3.15 refused per task</span><span data-lang="ko"><code>compileSdk</code> 상수(<code>PY3_15_0</code>); 제공되지 않는 버전과 3.15 이전 GIL 전용 CPython 은 태스크에서 거부</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonSdkTest, BuildPythonSdkRejectionTest</code></td></tr><tr><td><span data-lang="en"><code>projectFlavors</code> in the variant graph; <code>-Ppython.flavor</code></span><span data-lang="ko">변형 그래프의 <code>projectFlavors</code>; <code>-Ppython.flavor</code></span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonPluginFlavorsTest</code></td></tr><tr><td><span data-lang="en"><code>defaultConfig { versionCode, versionName }</code> → bundle manifest</span><span data-lang="ko"><code>defaultConfig { versionCode, versionName }</code> → 번들 manifest</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonPluginPayloadVersionTest, BuildPythonArtifactTaskTest</code></td></tr><tr><td><span data-lang="en">toolchain ships only <code>python/</code>: <code>compileSdk</code> selects the wheels' Python version and fetches no interpreter; the interpreter and stdlib come from python-multiplatform</span><span data-lang="ko">toolchain 은 <code>python/</code> 만 실음: <code>compileSdk</code> 는 wheel 의 Python 버전을 고를 뿐 인터프리터를 받지 않음; 인터프리터와 stdlib 는 python-multiplatform 이 제공</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonPluginTargetDependenciesTest, PythonPluginPythonOnlyTest</code></td></tr>
-<tr><td><span data-lang="en"><code>compileSdk</code> checked against python-multiplatform's <code>pythonVersion</code> at level 2 (a mismatch fails only that variant's <code>buildPython…</code>); read from <code>-Ppython.multiplatform.pythonVersion</code>, the <code>:python-multiplatform</code> project's extension, or the published dependency's metadata or jar</span><span data-lang="ko">레벨 2 에서 <code>compileSdk</code> 를 python-multiplatform 의 <code>pythonVersion</code> 과 대조 (다르면 그 변형의 <code>buildPython…</code> 만 실패); <code>-Ppython.multiplatform.pythonVersion</code>, <code>:python-multiplatform</code> 프로젝트의 확장, 또는 배포된 의존의 메타데이터나 jar 에서 읽음</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonVersionAgreementTest, PythonPluginPythonOnlyTest, PublishedPythonVersionTest</code></td></tr></tbody></table></div>
+<tr><td><span data-lang="en"><code>compileSdk</code> checked against python-multiplatform's <code>pythonVersion</code> at level 2 (a mismatch fails only that variant's <code>buildPython…</code>); read from <code>-Ppython.multiplatform.pythonVersion</code>, the <code>:python-multiplatform</code> project's extension, or the published dependency's metadata or jar</span><span data-lang="ko">레벨 2 에서 <code>compileSdk</code> 를 python-multiplatform 의 <code>pythonVersion</code> 과 대조 (다르면 그 변형의 <code>buildPython…</code> 만 실패); <code>-Ppython.multiplatform.pythonVersion</code>, <code>:python-multiplatform</code> 프로젝트의 확장, 또는 배포된 의존의 메타데이터나 jar 에서 읽음</span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>PythonVersionAgreementTest, PythonPluginPythonOnlyTest, PublishedPythonVersionTest</code></td></tr>
+<tr><td><span data-lang="en">WASM cross-origin isolation by default: dev-server COOP/COEP/CORP headers, <code>_headers</code>, <code>coi-serviceworker.js</code> fallback, <code>coi-check.html</code> diagnostic page, and <a href="guide-staging.html#wasm-isolation">documented limits</a></span><span data-lang="ko">WASM 교차 출처 격리 기본 적용: 개발 서버 COOP/COEP/CORP 헤더, <code>_headers</code>, <code>coi-serviceworker.js</code> 폴백, <code>coi-check.html</code> 점검 페이지, <a href="guide-staging.html#wasm-isolation">문서화된 한계</a></span></td><td><span data-lang="en" class="pill ok">implemented</span><span data-lang="ko" class="pill ok">구현</span></td><td><code>WasmCrossOriginIsolationTest</code></td></tr></tbody></table></div>
 </section>
 
 <section>
diff --git a/docs/locale/README_ko.md b/docs/locale/README_ko.md
index 86118b8..bbc7a49 100644
--- a/docs/locale/README_ko.md
+++ b/docs/locale/README_ko.md
@@ -84,7 +84,7 @@ plugins {
 }
 
 python {
-    compileSdk = "3.13"
+    compileSdk = "3.15.0"                       // python-multiplatform 이 제공하는 CPython
     localLibraryPath = "src/commonMain/python"  // pypackpack 패키지: pyproject.toml + src/main/<pkg>
     packaging {
         fileName = "usage-example"
@@ -119,7 +119,8 @@ python {
 Python 만 쓰나요? Gradle 빌드 없이:
 
 ```shell
-./gradlew :toolchain:runTcl --args="install pythonx-compose"
+uv tool install toolchain-lite
+tcl install pythonx-compose
 ```
 
 ## 🧭 한눈에 보는 구조
diff --git a/toolchain/build.gradle.kts b/toolchain/build.gradle.kts
index 321f119..6ad66f2 100644
--- a/toolchain/build.gradle.kts
+++ b/toolchain/build.gradle.kts
@@ -93,7 +93,8 @@ gradlePlugin {
 // rejected as out of scope -- `compose-multiplatform 1.7.0` (`gradle/libs.versions.toml`) is not
 // verified against it, and that is exactly the kind of build-wide change a single delegation should
 // not carry.
-// `TypedpythonCheckTaskTest` installs the real `typedpython` gate, which is not on PyPI yet:
+// `TypedpythonCheckTaskTest` installs the real `typedpython` gate, which is not published to PyPI
+// (it ships with the GitHub Release and the distribution):
 // `-Ptypedpython.wheelDir=<dir>` names the directory holding its wheel. Forwarded as-is; the test
 // fails with that instruction when it is missing rather than skipping.
 tasks.test {
diff --git a/toolchain/src/cliMain/kotlin/org/thisisthepy/python/multiplatform/tcl/Installer.kt b/toolchain/src/cliMain/kotlin/org/thisisthepy/python/multiplatform/tcl/Installer.kt
index b483bfc..2d19d2c 100644
--- a/toolchain/src/cliMain/kotlin/org/thisisthepy/python/multiplatform/tcl/Installer.kt
+++ b/toolchain/src/cliMain/kotlin/org/thisisthepy/python/multiplatform/tcl/Installer.kt
@@ -7,16 +7,32 @@ import java.io.File
 
 private const val PYPROJECT_FILE = "pyproject.toml"
 
+private const val GIT_ENTRY = ".git"
+
 /**
- * Finds the `pypackpack`/`uv` project root by walking up from [startDir] looking for a
- * `pyproject.toml` -- mirrors `pypackpack`'s own `findProjectRoot`
- * (`packpack/utils/Workspace.kt`), reimplemented here rather than reused because that function is
- * `internal` to the `packpack` Gradle module and is not part of its published API surface.
+ * Finds the project `tcl install` adds to, starting at [startDir], without ever reaching an
+ * unrelated ancestor project:
+ *
+ * - [startDir]'s own `pyproject.toml` always counts.
+ * - Inside a git repository (a directory holding a `.git` directory, or a `.git` file for a
+ *   worktree), the search walks up to the nearest `pyproject.toml`, and stops at the repository
+ *   root, which is the last directory checked. A `pyproject.toml` above the repository belongs to
+ *   another project.
+ * - Outside any repository there is no boundary to trust, so only [startDir] counts: a stray
+ *   `pyproject.toml` in a parent or the home directory is never edited.
+ *
+ * Returns null when no project qualifies; [Installer.install] then initializes one in [startDir].
  */
 fun findProjectRoot(startDir: File): File? {
-    var current: File? = startDir.canonicalFile
-    while (current != null) {
+    val start = startDir.canonicalFile
+    if (File(start, PYPROJECT_FILE).isFile) return start
+
+    val repositoryRoot = generateSequence(start) { it.parentFile }.firstOrNull { File(it, GIT_ENTRY).exists() }
+        ?: return null
+    var current: File? = start.parentFile
+    while (current != null && current.path.length >= repositoryRoot.path.length) {
         if (File(current, PYPROJECT_FILE).isFile) return current
+        if (current == repositoryRoot) break
         current = current.parentFile
     }
     return null
@@ -45,7 +61,7 @@ class Installer(
 ) {
     /**
      * Adds [packageName] as a dependency of the project rooted at (or above) [workingDir],
-     * initializing a fresh `pyproject.toml` there first via `uv init --bare` if [findProjectRoot]
+     * initializing a fresh `pyproject.toml` there first via `uv init --bare --no-workspace` if [findProjectRoot]
      * finds none. Returns the same `Result<String>` `pypackpack`'s backend does: `uv`'s own
      * combined stdout/stderr on success, or the failure it hit -- including a failed `initProject`,
      * which short-circuits before `addDependencies` is ever attempted.
@@ -58,9 +74,16 @@ class Installer(
 
         val existingRoot = findProjectRoot(workingDir)
         if (existingRoot == null) {
-            // `--bare` matches what `pypackpack init` itself does (`docs/SPEC.md` "Project
-            // creation"): only `pyproject.toml` is generated by `uv`, nothing else assumed.
-            val initResult = backend.initProject(path = null, extraArgs = mapOf("bare" to ""), workingDir = workingDir)
+            // `--bare` matches what `pypackpack init` itself does (pypackpack's `docs/SPEC.md`
+            // "Project creation"): only `pyproject.toml` is generated by `uv`, nothing else assumed.
+            // `--no-workspace` keeps `uv` from registering the new project as a member of an
+            // ancestor's workspace, which would write `[tool.uv.workspace]` into that ancestor.
+            val initResult =
+                backend.initProject(
+                    path = null,
+                    extraArgs = mapOf("bare" to "", "no-workspace" to ""),
+                    workingDir = workingDir,
+                )
             if (initResult.isFailure) return initResult
         }
 
diff --git a/toolchain/src/cliTest/kotlin/org/thisisthepy/python/multiplatform/tcl/InstallerTest.kt b/toolchain/src/cliTest/kotlin/org/thisisthepy/python/multiplatform/tcl/InstallerTest.kt
index a6f42cd..1d1d623 100644
--- a/toolchain/src/cliTest/kotlin/org/thisisthepy/python/multiplatform/tcl/InstallerTest.kt
+++ b/toolchain/src/cliTest/kotlin/org/thisisthepy/python/multiplatform/tcl/InstallerTest.kt
@@ -3,7 +3,9 @@ package org.thisisthepy.python.multiplatform.tcl
 import java.io.File
 import kotlin.io.path.createTempDirectory
 import kotlin.test.Test
+import kotlin.test.assertEquals
 import kotlin.test.assertFalse
+import kotlin.test.assertNull
 import kotlin.test.assertTrue
 
 /**
@@ -61,14 +63,67 @@ class InstallerTest {
     }
 
     @Test
-    fun `findProjectRoot walks up from a nested directory to the pyproject toml`() {
+    fun `findProjectRoot walks up from a nested directory to the pyproject toml of the same repository`() {
         val root = createTempDirectory("tcl-find-root").toFile()
+        File(root, ".git").mkdirs()
         File(root, "pyproject.toml").writeText("[project]\nname = \"x\"\n")
         val nested = File(root, "a/b/c").apply { mkdirs() }
 
         assertTrue(findProjectRoot(nested) == root.canonicalFile)
     }
 
+    @Test
+    fun `findProjectRoot uses the working directory's own pyproject toml`() {
+        val dir = createTempDirectory("tcl-find-root-cwd").toFile()
+        File(dir, "pyproject.toml").writeText("[project]\nname = \"x\"\n")
+
+        assertTrue(findProjectRoot(dir) == dir.canonicalFile)
+    }
+
+    @Test
+    fun `findProjectRoot does not cross a git boundary into an unrelated parent project`() {
+        val parent = createTempDirectory("tcl-find-root-git-boundary").toFile()
+        File(parent, "pyproject.toml").writeText("[project]\nname = \"unrelated\"\n")
+        val repo = File(parent, "repo").apply { mkdirs() }
+        // A worktree's `.git` is a file, not a directory: both mark the boundary.
+        File(repo, ".git").writeText("gitdir: elsewhere\n")
+        val nested = File(repo, "src").apply { mkdirs() }
+
+        assertNull(findProjectRoot(nested), "the parent's pyproject.toml lies outside the repository")
+    }
+
+    @Test
+    fun `findProjectRoot outside any repository does not take an ancestor's pyproject toml`() {
+        val parent = createTempDirectory("tcl-find-root-no-repo").toFile()
+        File(parent, "pyproject.toml").writeText("[project]\nname = \"unrelated\"\n")
+        val child = File(parent, "child").apply { mkdirs() }
+
+        assertNull(findProjectRoot(child), "with no repository boundary, only the working directory counts")
+    }
+
+    @Test
+    fun `install below an unrelated project creates its own project and leaves the ancestor untouched`() {
+        val parent = createTempDirectory("tcl-install-unrelated-ancestor").toFile()
+        val parentPyproject =
+            """
+            [project]
+            name = "unrelated-ancestor"
+            version = "0.0.1"
+            requires-python = ">=3.13"
+            dependencies = []
+            """.trimIndent()
+        File(parent, "pyproject.toml").writeText(parentPyproject)
+        val child = File(parent, "child").apply { mkdirs() }
+
+        val result = installBlocking("six", child)
+
+        assertTrue(result.isSuccess, "install should succeed: ${result.exceptionOrNull()}")
+        assertEquals(parentPyproject, File(parent, "pyproject.toml").readText(), "the ancestor project must not be edited")
+        val own = File(child, "pyproject.toml")
+        assertTrue(own.isFile, "install should have initialized a project in the working directory")
+        assertTrue(own.readText().contains("six"), "the new project should record the dependency")
+    }
+
     @Test
     fun `findProjectRoot returns null when nothing is found above it`() {
         val dir = createTempDirectory("tcl-find-root-none").toFile()
diff --git a/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/PythonPlugin.kt b/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/PythonPlugin.kt
index 5b1980b..05d0498 100644
--- a/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/PythonPlugin.kt
+++ b/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/PythonPlugin.kt
@@ -143,6 +143,7 @@ class PythonPlugin : Plugin<Project> {
         org.thisisthepy.python.multiplatform.toolchain.bundle.registerStagePythonBundleIosForXcode(
             project, stageTasks.getValue(PythonStagingPlatform.IOS),
         )
+        org.thisisthepy.python.multiplatform.toolchain.wasm.configureWasmCrossOriginIsolation(project)
 
         // python-multiplatform's `pythonVersion` is read from its extension in `afterEvaluate` below
         // (SPEC §1.12, #42), so a `:python-multiplatform` project of this build is evaluated first.
diff --git a/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonCheckTask.kt b/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonCheckTask.kt
index de2af5e..0eaa3e5 100644
--- a/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonCheckTask.kt
+++ b/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonCheckTask.kt
@@ -43,13 +43,9 @@ const val TYPEDPYTHON_NO_STUBS_NOTICE =
  * Statically checks the project's own Python with the TypedPython gate before it is bundled
  * (issue `toolchain#23`, `docs/SPEC.md` section 1.18).
  *
- * The gate's venv ([venvDir], `build/typedpython/venv`) is created through `pypackpack`'s UV backend
- * (`createVirtualEnvironment`). The install into it calls `uv` directly: the backend has no operation
- * that installs named requirements into an existing venv from a local wheel directory.
- * `installDependenciesToTarget` always reads `-r pyproject.toml` into a `--target` directory, and
- * `addDependencies` edits `pyproject.toml`. What is missing is a `pip install <requirements>
- * --python <venv> [--no-index] [--find-links <dir>]` operation; with it, [ensureTypedpythonGate] is
- * the one place to switch. That is a `pypackpack` change, proposed rather than made here.
+ * The gate's venv ([venvDir], `build/typedpython/venv`) is created and populated through
+ * `pypackpack`'s UV backend (`createVirtualEnvironment` and `installRequirementsToVenv`,
+ * `pypackpack#40`).
  */
 abstract class TypedpythonCheckTask : DefaultTask() {
     /** The `.py`/`.pyi` files of the package directory -- see [typedpythonSourceExcluded]. */
@@ -189,14 +185,22 @@ fun ensureTypedpythonGate(venv: File, version: String, pyreflyVersion: String, w
 
     val work = venv.parentFile.apply { mkdirs() }
     createTypedpythonVenv(venv, work)
-    runUv(typedpythonInstallCommand(venv, version, pyreflyVersion, wheelDir), work).let { (exit, output) ->
-        if (exit != 0) {
-            throw GradleException(
-                "Could not install typedpython==$version and pyrefly==$pyreflyVersion into $venv from $wheelDir " +
-                    "(uv exit $exit, --no-index):\n$output\n" +
-                    typedpythonWheelInstruction(version, pyreflyVersion),
-            )
-        }
+    val installed = runBlocking {
+        BackendInterface.create(BackendType.UV).installRequirementsToVenv(
+            venvPath = venv.path,
+            requirements = listOf("typedpython==$version", "pyrefly==$pyreflyVersion"),
+            noIndex = true,
+            findLinks = wheelDir,
+            workingDir = work,
+        )
+    }
+    installed.onFailure {
+        throw GradleException(
+            "Could not install typedpython==$version and pyrefly==$pyreflyVersion into $venv from $wheelDir " +
+                "(--no-index):\n${it.message}\n" +
+                typedpythonWheelInstruction(version, pyreflyVersion),
+            it,
+        )
     }
     if (!executable.isFile) throw GradleException("typedpython was installed into $venv but $executable does not exist")
     marker.writeText(request)
@@ -244,13 +248,20 @@ fun ensureTypedpythonGateFromArchive(venv: File, archive: File, gateDir: File):
     val work = venv.parentFile.apply { mkdirs() }
     createTypedpythonVenv(venv, work)
     val requirements = File(work, "gate-requirements.txt").apply { writeText(requirementsText) }
-    runUv(typedpythonHashedInstallCommand(venv, requirements), work).let { (exit, output) ->
-        if (exit != 0) {
-            throw GradleException(
-                "Could not install typedpython ${manifest.typedpythonVersion} (from $archive) and pyrefly " +
-                    "${manifest.pyreflyVersion} (from PyPI) into $venv with --require-hashes (uv exit $exit):\n$output",
-            )
-        }
+    val installed = runBlocking {
+        BackendInterface.create(BackendType.UV).installRequirementsToVenv(
+            venvPath = venv.path,
+            requirements = emptyList(),
+            extraArgs = linkedMapOf("require-hashes" to "", "requirement" to requirements.path),
+            workingDir = work,
+        )
+    }
+    installed.onFailure {
+        throw GradleException(
+            "Could not install typedpython ${manifest.typedpythonVersion} (from $archive) and pyrefly " +
+                "${manifest.pyreflyVersion} (from PyPI) into $venv with --require-hashes:\n${it.message}",
+            it,
+        )
     }
     if (!executable.isFile) throw GradleException("typedpython was installed into $venv but $executable does not exist")
     marker.writeText(requirementsText)
@@ -307,16 +318,6 @@ fun typedpythonInstallCommand(venv: File, version: String, pyreflyVersion: Strin
         "typedpython==$version", "pyrefly==$pyreflyVersion",
     )
 
-private fun runUv(command: List<String>, workingDir: File): Pair<Int, String> {
-    val process = try {
-        ProcessBuilder(command).directory(workingDir).redirectErrorStream(true).start()
-    } catch (e: IOException) {
-        throw GradleException("typedpythonCheck needs uv on PATH to install the gate: ${e.message}", e)
-    }
-    val output = process.inputStream.bufferedReader().readText()
-    return process.waitFor() to output
-}
-
 private fun typedpythonExecutable(venv: File): File =
     if (System.getProperty("os.name").orEmpty().startsWith("Windows")) {
         File(venv, "Scripts/typedpython.exe")
diff --git a/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonGate.kt b/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonGate.kt
index 6060e6e..ba311f7 100644
--- a/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonGate.kt
+++ b/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonGate.kt
@@ -10,7 +10,7 @@ import java.io.File
  * uses the same). This is the one place both are written; `-Ptypedpython.gate=<group:artifact:version>`
  * overrides it.
  */
-const val DEFAULT_TYPEDPYTHON_GATE = "org.thisisthepy:python-multiplatform-ksp:3.15.0-alpha01"
+const val DEFAULT_TYPEDPYTHON_GATE = "org.thisisthepy:python-multiplatform-ksp:3.15.0-alpha03"
 
 /** Project property overriding [DEFAULT_TYPEDPYTHON_GATE]. */
 const val TYPEDPYTHON_GATE_PROPERTY = "typedpython.gate"
diff --git a/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/wasm/WasmCrossOriginIsolation.kt b/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/wasm/WasmCrossOriginIsolation.kt
new file mode 100644
index 0000000..2eb6239
--- /dev/null
+++ b/toolchain/src/main/kotlin/org/thisisthepy/python/multiplatform/toolchain/wasm/WasmCrossOriginIsolation.kt
@@ -0,0 +1,310 @@
+package org.thisisthepy.python.multiplatform.toolchain.wasm
+
+import org.gradle.api.DefaultTask
+import org.gradle.api.Project
+import org.gradle.api.file.DirectoryProperty
+import org.gradle.api.provider.Property
+import org.gradle.api.tasks.Copy
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.OutputDirectory
+import org.gradle.api.tasks.TaskAction
+import org.thisisthepy.python.multiplatform.toolchain.PythonPlugin
+import org.thisisthepy.python.multiplatform.toolchain.deleteWithoutFollowingLinks
+import java.io.File
+
+/**
+ * Cross-origin isolation defaults for WASM apps (`docs/SPEC.md` section 1.20, issue `toolchain#81`).
+ *
+ * Free-threaded CPython 3.15t on WebAssembly uses pthreads, which require `SharedArrayBuffer`.
+ * Browsers only expose `SharedArrayBuffer` when `self.crossOriginIsolated === true`:
+ * `Cross-Origin-Opener-Policy: same-origin` together with `Cross-Origin-Embedder-Policy: require-corp`
+ * (or `credentialless`), plus `Cross-Origin-Resource-Policy: same-origin` on our own assets.
+ */
+
+const val STAGE_WASM_ISOLATION_TASK = "stageWasmCrossOriginIsolation"
+const val WASM_ISOLATION_DIRECTORY = "pythonWasmIsolation"
+const val WASM_COEP_PROPERTY = "python.wasm.coep"
+const val DEFAULT_WASM_COEP_POLICY = "require-corp"
+val VALID_WASM_COEP_POLICIES = setOf("require-corp", "credentialless")
+
+const val WASM_HEADERS_FILE = "_headers"
+const val WASM_COI_SERVICE_WORKER_FILE = "coi-serviceworker.js"
+const val WASM_COI_CHECK_PAGE_FILE = "coi-check.html"
+const val WASM_WEBPACK_CONFIG_FILE = "python-cross-origin-isolation.js"
+
+/**
+ * Resolves the `Cross-Origin-Embedder-Policy` value for WASM builds.
+ * Defaults to [DEFAULT_WASM_COEP_POLICY] (`require-corp`); `credentialless` is the other valid option.
+ */
+fun resolveWasmCoepPolicy(raw: String?): String {
+    val policy = raw?.trim().orEmpty().ifEmpty { DEFAULT_WASM_COEP_POLICY }
+    require(policy in VALID_WASM_COEP_POLICIES) {
+        "Invalid -P$WASM_COEP_PROPERTY='$policy': Cross-Origin-Embedder-Policy for WASM must be " +
+            "'require-corp' or 'credentialless'."
+    }
+    return policy
+}
+
+/**
+ * The three HTTP response headers that make a WASM page cross-origin isolated and mark its own
+ * assets safe to embed under `require-corp`.
+ */
+fun wasmCrossOriginHeaders(coepPolicy: String = DEFAULT_WASM_COEP_POLICY): Map<String, String> {
+    val resolved = resolveWasmCoepPolicy(coepPolicy)
+    return linkedMapOf(
+        "Cross-Origin-Opener-Policy" to "same-origin",
+        "Cross-Origin-Embedder-Policy" to resolved,
+        "Cross-Origin-Resource-Policy" to "same-origin",
+    )
+}
+
+/**
+ * Renders the Cloudflare Pages and Netlify `_headers` file emitted next to the WASM distribution.
+ */
+fun renderWasmHeadersFile(coepPolicy: String = DEFAULT_WASM_COEP_POLICY): String {
+    val headers = wasmCrossOriginHeaders(coepPolicy)
+    return buildString {
+        appendLine("# Generated by org.thisisthepy.python.multiplatform (toolchain#81).")
+        appendLine("# Cross-origin isolation headers required by CPython 3.15t pthreads (SharedArrayBuffer).")
+        appendLine("/*")
+        for ((name, value) in headers) {
+            appendLine("  $name: $value")
+        }
+    }
+}
+
+/**
+ * Renders our own service-worker fallback (`coi-serviceworker.js`) for static hosts that cannot set
+ * HTTP response headers (such as GitHub Pages).
+ *
+ * The header comment states the two costs required by `toolchain#81`:
+ * 1. One reload on the first visit (the service worker must install, claim the page, and reload).
+ * 2. No effect when service workers are unavailable (insecure contexts other than localhost, private
+ *    modes or webviews that disable service workers).
+ */
+fun renderWasmCoiServiceWorkerScript(coepPolicy: String = DEFAULT_WASM_COEP_POLICY): String {
+    val resolved = resolveWasmCoepPolicy(coepPolicy)
+    return """
+        |// Generated by org.thisisthepy.python.multiplatform (toolchain#81).
+        |// Service-worker fallback that re-serves responses with Cross-Origin-Opener-Policy and
+        |// Cross-Origin-Embedder-Policy headers on hosts that cannot set HTTP headers (e.g. GitHub Pages).
+        |//
+        |// Cost and limits:
+        |// 1. Costs one reload on the first visit: the first page load registers this worker and reloads
+        |//    once the worker controls the page so the document response carries COOP/COEP.
+        |// 2. Has no effect when service workers are unavailable (non-HTTPS origins other than localhost,
+        |//    or browsers/webviews with service workers disabled).
+        |(function () {
+        |  "use strict";
+        |  var COOP = "same-origin";
+        |  var COEP = "$resolved";
+        |  var CORP = "same-origin";
+        |
+        |  if (typeof window === "undefined") {
+        |    self.addEventListener("install", function () {
+        |      self.skipWaiting();
+        |    });
+        |    self.addEventListener("activate", function (event) {
+        |      event.waitUntil(self.clients.claim());
+        |    });
+        |    self.addEventListener("fetch", function (event) {
+        |      var request = event.request;
+        |      if (request.cache === "only-if-cached" && request.mode !== "same-origin") {
+        |        return;
+        |      }
+        |      event.respondWith(
+        |        fetch(request).then(function (response) {
+        |          if (!response || response.status === 0) {
+        |            return response;
+        |          }
+        |          var headers = new Headers(response.headers);
+        |          headers.set("Cross-Origin-Opener-Policy", COOP);
+        |          headers.set("Cross-Origin-Embedder-Policy", COEP);
+        |          headers.set("Cross-Origin-Resource-Policy", CORP);
+        |          return new Response(response.body, {
+        |            status: response.status,
+        |            statusText: response.statusText,
+        |            headers: headers
+        |          });
+        |        })
+        |      );
+        |    });
+        |    return;
+        |  }
+        |
+        |  if (self.crossOriginIsolated) {
+        |    return;
+        |  }
+        |  if (!window.isSecureContext || !("serviceWorker" in navigator)) {
+        |    console.error(
+        |      "python-multiplatform WASM: self.crossOriginIsolated is false and service workers are unavailable. " +
+        |        "Serve the app with Cross-Origin-Opener-Policy: " + COOP +
+        |        " and Cross-Origin-Embedder-Policy: " + COEP + "."
+        |    );
+        |    return;
+        |  }
+        |  var currentScript = document.currentScript;
+        |  var workerUrl = currentScript && currentScript.src ? currentScript.src : "$WASM_COI_SERVICE_WORKER_FILE";
+        |  navigator.serviceWorker.register(workerUrl).then(
+        |    function (registration) {
+        |      if (registration.active && !navigator.serviceWorker.controller) {
+        |        window.location.reload();
+        |        return;
+        |      }
+        |      navigator.serviceWorker.addEventListener("controllerchange", function () {
+        |        window.location.reload();
+        |      });
+        |    },
+        |    function (err) {
+        |      console.error("python-multiplatform WASM: failed to register " + workerUrl + ":", err);
+        |    }
+        |  );
+        |})();
+        |
+    """.trimMargin()
+}
+
+/**
+ * Renders `coi-check.html`, a diagnostic page emitted alongside the WASM distribution that loads
+ * [WASM_COI_SERVICE_WORKER_FILE] and verifies `self.crossOriginIsolated` and `SharedArrayBuffer`,
+ * failing loudly if the page is not isolated so the failure happens at startup rather than later
+ * inside a thread (`toolchain#81` item 5).
+ */
+fun renderWasmCoiCheckPage(): String =
+    """
+        |<!DOCTYPE html>
+        |<html lang="en">
+        |<head>
+        |  <meta charset="utf-8">
+        |  <title>WASM Cross-Origin Isolation Check</title>
+        |  <script src="$WASM_COI_SERVICE_WORKER_FILE"></script>
+        |</head>
+        |<body>
+        |  <pre id="coi-status">Checking cross-origin isolation...</pre>
+        |  <script>
+        |    (function () {
+        |      var status = document.getElementById("coi-status");
+        |      var isolated = self.crossOriginIsolated === true;
+        |      var hasSab = typeof SharedArrayBuffer === "function";
+        |      if (isolated && hasSab) {
+        |        status.textContent = "OK: self.crossOriginIsolated is true and SharedArrayBuffer is available.";
+        |      } else {
+        |        var msg = "ERROR: self.crossOriginIsolated is " + self.crossOriginIsolated +
+        |          " (SharedArrayBuffer: " + typeof SharedArrayBuffer + "). " +
+        |          "A page that is not cross-origin isolated cannot start the threaded CPython 3.15t runtime. " +
+        |          "Configure Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp " +
+        |          "(or credentialless), or load " + "$WASM_COI_SERVICE_WORKER_FILE" + " before the app bundle.";
+        |        status.textContent = msg;
+        |        console.error(msg);
+        |      }
+        |    })();
+        |  </script>
+        |</body>
+        |</html>
+        |
+    """.trimMargin()
+
+/**
+ * Renders the webpack `config.d` script that configures `devServer.headers` for Kotlin/Wasm `run`
+ * and `dev` tasks (`wasmJsBrowserDevelopmentRun`, `wasmJsBrowserProductionRun`, etc.).
+ */
+fun renderWasmWebpackConfigScript(coepPolicy: String = DEFAULT_WASM_COEP_POLICY): String {
+    val resolved = resolveWasmCoepPolicy(coepPolicy)
+    return """
+        |// Generated by org.thisisthepy.python.multiplatform (toolchain#81).
+        |// Enables cross-origin isolation on the Kotlin/Wasm webpack dev server so CPython 3.15t pthreads
+        |// have SharedArrayBuffer.
+        |config.devServer = config.devServer || {};
+        |config.devServer.headers = Object.assign(
+        |  {
+        |    "Cross-Origin-Opener-Policy": "same-origin",
+        |    "Cross-Origin-Embedder-Policy": "$resolved",
+        |    "Cross-Origin-Resource-Policy": "same-origin"
+        |  },
+        |  config.devServer.headers || {}
+        |);
+        |
+    """.trimMargin()
+}
+
+/**
+ * Writes `webpack.config.d/python-cross-origin-isolation.js` inside [wasmPackageDir]
+ * (`<rootBuildDir>/wasm/packages/<module>`), where Kotlin/Wasm's `KotlinWebpack` task reads
+ * generated `webpack.config.d` `.js` snippets.
+ */
+fun patchWasmWebpackConfigDirectory(wasmPackageDir: File, coepPolicy: String = DEFAULT_WASM_COEP_POLICY): File {
+    val configDir = File(wasmPackageDir, "webpack.config.d").apply { mkdirs() }
+    val scriptFile = File(configDir, WASM_WEBPACK_CONFIG_FILE)
+    scriptFile.writeText(renderWasmWebpackConfigScript(coepPolicy))
+    return scriptFile
+}
+
+/**
+ * Writes `_headers`, `coi-serviceworker.js` and `coi-check.html` into [destinationDir], replacing
+ * any previous contents.
+ */
+fun writeWasmCrossOriginIsolationAssets(destinationDir: File, coepPolicy: String = DEFAULT_WASM_COEP_POLICY) {
+    val resolved = resolveWasmCoepPolicy(coepPolicy)
+    destinationDir.deleteWithoutFollowingLinks()
+    destinationDir.mkdirs()
+    File(destinationDir, WASM_HEADERS_FILE).writeText(renderWasmHeadersFile(resolved))
+    File(destinationDir, WASM_COI_SERVICE_WORKER_FILE).writeText(renderWasmCoiServiceWorkerScript(resolved))
+    File(destinationDir, WASM_COI_CHECK_PAGE_FILE).writeText(renderWasmCoiCheckPage())
+}
+
+/**
+ * Emits the static cross-origin isolation assets (`_headers`, `coi-serviceworker.js`, `coi-check.html`)
+ * into `build/pythonWasmIsolation/`, wired into `wasmJsProcessResources` so they ship at the root of
+ * the WASM browser distribution.
+ */
+abstract class StageWasmCrossOriginIsolationTask : DefaultTask() {
+    @get:Input
+    abstract val coepPolicy: Property<String>
+
+    @get:OutputDirectory
+    abstract val destinationDir: DirectoryProperty
+
+    @TaskAction
+    fun stage() {
+        val dir = destinationDir.get().asFile
+        val policy = resolveWasmCoepPolicy(coepPolicy.orNull)
+        writeWasmCrossOriginIsolationAssets(dir, policy)
+        logger.lifecycle(
+            "Staged WASM cross-origin isolation assets ($WASM_HEADERS_FILE, $WASM_COI_SERVICE_WORKER_FILE, " +
+                "$WASM_COI_CHECK_PAGE_FILE; COEP=$policy) into $dir",
+        )
+    }
+}
+
+/**
+ * Registers [STAGE_WASM_ISOLATION_TASK] and wires it into `wasmJsProcessResources` and every
+ * `wasmJs*Webpack` task when the consumer's build declares a `wasmJs` target.
+ */
+fun configureWasmCrossOriginIsolation(project: Project) {
+    val coepProvider = project.providers.gradleProperty(WASM_COEP_PROPERTY).orElse(DEFAULT_WASM_COEP_POLICY)
+    val destination = project.layout.buildDirectory.dir(WASM_ISOLATION_DIRECTORY)
+    val stageTask = project.tasks.register(STAGE_WASM_ISOLATION_TASK, StageWasmCrossOriginIsolationTask::class.java) {
+        group = PythonPlugin.TASK_GROUP
+        description = "Generates WASM cross-origin isolation headers (_headers) and service-worker fallback (coi-serviceworker.js)"
+        coepPolicy.set(coepProvider)
+        destinationDir.set(destination)
+    }
+
+    project.tasks.matching { it.name == "wasmJsProcessResources" }.configureEach {
+        dependsOn(stageTask)
+        (this as? Copy)?.from(stageTask)
+    }
+
+    val modulePrefix = if (project == project.rootProject) {
+        project.name
+    } else {
+        "${project.rootProject.name}-${project.path.removePrefix(":").replace(":", "-")}"
+    }
+    project.tasks.matching { it.name.startsWith("wasmJs") && it.name.endsWith("Webpack") }.configureEach {
+        dependsOn(stageTask)
+        val wasmPackageDir = project.rootProject.layout.buildDirectory.dir("wasm/packages/$modulePrefix")
+        doFirst("configureWasmCrossOriginIsolationHeaders") {
+            patchWasmWebpackConfigDirectory(wasmPackageDir.get().asFile, coepProvider.get())
+        }
+    }
+}
diff --git a/toolchain/src/test/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonGateArtifactTest.kt b/toolchain/src/test/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonGateArtifactTest.kt
index 95ad4c3..4229335 100644
--- a/toolchain/src/test/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonGateArtifactTest.kt
+++ b/toolchain/src/test/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonGateArtifactTest.kt
@@ -20,11 +20,14 @@ import kotlin.test.assertTrue
  * comes from PyPI). Without the zip these tests are skipped with that reason, as on CI.
  */
 class TypedpythonGateArtifactTest {
-    private val mavenLocalZip = File(
-        System.getProperty("user.home"),
-        ".m2/repository/org/thisisthepy/python-multiplatform-ksp/3.15.0-alpha01/" +
-            "python-multiplatform-ksp-3.15.0-alpha01-typedpython-gate.zip",
-    )
+    // Derived from DEFAULT_TYPEDPYTHON_GATE so a version bump cannot leave this test probing an old path.
+    private val mavenLocalZip = DEFAULT_TYPEDPYTHON_GATE.split(':').let { (group, artifact, version) ->
+        File(
+            System.getProperty("user.home"),
+            ".m2/repository/${group.replace('.', '/')}/$artifact/$version/" +
+                "$artifact-$version-$TYPEDPYTHON_GATE_CLASSIFIER.zip",
+        )
+    }
 
     @BeforeTest
     fun requireGate() {
diff --git a/toolchain/src/test/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonGateTest.kt b/toolchain/src/test/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonGateTest.kt
index 05fada3..327c204 100644
--- a/toolchain/src/test/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonGateTest.kt
+++ b/toolchain/src/test/kotlin/org/thisisthepy/python/multiplatform/toolchain/typedpython/TypedpythonGateTest.kt
@@ -41,9 +41,9 @@ class TypedpythonGateTest {
 
     @Test
     fun `the gate is the typedpython-gate zip of python-multiplatform-ksp, from one constant`() {
-        assertEquals("org.thisisthepy:python-multiplatform-ksp:3.15.0-alpha01", DEFAULT_TYPEDPYTHON_GATE)
+        assertEquals("org.thisisthepy:python-multiplatform-ksp:3.15.0-alpha03", DEFAULT_TYPEDPYTHON_GATE)
         assertEquals(
-            "org.thisisthepy:python-multiplatform-ksp:3.15.0-alpha01:typedpython-gate@zip",
+            "org.thisisthepy:python-multiplatform-ksp:3.15.0-alpha03:typedpython-gate@zip",
             typedpythonGateNotation(DEFAULT_TYPEDPYTHON_GATE),
         )
         assertEquals("typedpython.gate", TYPEDPYTHON_GATE_PROPERTY)
diff --git a/toolchain/src/test/kotlin/org/thisisthepy/python/multiplatform/toolchain/wasm/WasmCrossOriginIsolationTest.kt b/toolchain/src/test/kotlin/org/thisisthepy/python/multiplatform/toolchain/wasm/WasmCrossOriginIsolationTest.kt
new file mode 100644
index 0000000..1478a70
--- /dev/null
+++ b/toolchain/src/test/kotlin/org/thisisthepy/python/multiplatform/toolchain/wasm/WasmCrossOriginIsolationTest.kt
@@ -0,0 +1,128 @@
+package org.thisisthepy.python.multiplatform.toolchain.wasm
+
+import org.gradle.api.tasks.Copy
+import org.gradle.testfixtures.ProjectBuilder
+import org.jetbrains.kotlin.gradle.dsl.KotlinMultiplatformExtension
+import java.io.File
+import kotlin.io.path.createTempDirectory
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertFailsWith
+import kotlin.test.assertTrue
+
+/**
+ * `docs/SPEC.md` section 1.20, issue `toolchain#81`: WASM apps ship cross-origin isolation by default
+ * (dev-server headers, `_headers`, `coi-serviceworker.js` fallback, and `coi-check.html` diagnostic page).
+ */
+class WasmCrossOriginIsolationTest {
+    private fun tmp(): File = createTempDirectory("wasm-coi-test").toFile()
+
+    @Test
+    fun `default headers use COOP same-origin, COEP require-corp and CORP same-origin`() {
+        val policy = resolveWasmCoepPolicy(null)
+        assertEquals(DEFAULT_WASM_COEP_POLICY, policy)
+        assertEquals(
+            mapOf(
+                "Cross-Origin-Opener-Policy" to "same-origin",
+                "Cross-Origin-Embedder-Policy" to "require-corp",
+                "Cross-Origin-Resource-Policy" to "same-origin",
+            ),
+            wasmCrossOriginHeaders(policy),
+        )
+    }
+
+    @Test
+    fun `credentialless COEP is accepted and invalid values are rejected naming both options`() {
+        assertEquals("credentialless", resolveWasmCoepPolicy("credentialless"))
+        assertEquals("credentialless", wasmCrossOriginHeaders("credentialless")["Cross-Origin-Embedder-Policy"])
+
+        val error = assertFailsWith<IllegalArgumentException> {
+            resolveWasmCoepPolicy("unsafe-none")
+        }
+        assertTrue("require-corp" in error.message.orEmpty(), error.message)
+        assertTrue("credentialless" in error.message.orEmpty(), error.message)
+    }
+
+    @Test
+    fun `renderWasmHeadersFile emits Cloudflare Pages and Netlify _headers format`() {
+        val text = renderWasmHeadersFile("require-corp")
+        assertTrue(text.contains("/*\n"), text)
+        assertTrue(text.contains("  Cross-Origin-Opener-Policy: same-origin\n"), text)
+        assertTrue(text.contains("  Cross-Origin-Embedder-Policy: require-corp\n"), text)
+        assertTrue(text.contains("  Cross-Origin-Resource-Policy: same-origin\n"), text)
+    }
+
+    @Test
+    fun `renderWasmCoiServiceWorkerScript re-serves with isolation headers and states both costs`() {
+        val script = renderWasmCoiServiceWorkerScript("require-corp")
+        assertTrue("one reload on the first visit" in script, script)
+        assertTrue("no effect when service workers are unavailable" in script, script)
+        assertTrue("self.crossOriginIsolated" in script, script)
+        assertTrue("Cross-Origin-Opener-Policy" in script && "same-origin" in script, script)
+        assertTrue("Cross-Origin-Embedder-Policy" in script && "require-corp" in script, script)
+        assertTrue("Cross-Origin-Resource-Policy" in script, script)
+        assertTrue("navigator.serviceWorker.register" in script, script)
+    }
+
+    @Test
+    fun `renderWasmCoiCheckPage loads the fallback worker and fails loudly when not isolated`() {
+        val page = renderWasmCoiCheckPage()
+        assertTrue("<script src=\"$WASM_COI_SERVICE_WORKER_FILE\"></script>" in page, page)
+        assertTrue("self.crossOriginIsolated" in page, page)
+        assertTrue("SharedArrayBuffer" in page, page)
+        assertTrue("cannot start the threaded CPython 3.15t runtime" in page, page)
+    }
+
+    @Test
+    fun `patchWasmWebpackConfigDirectory writes webpack config d script setting devServer headers`() {
+        val packageDir = tmp()
+        val file = patchWasmWebpackConfigDirectory(packageDir, "credentialless")
+        assertEquals(File(packageDir, "webpack.config.d/$WASM_WEBPACK_CONFIG_FILE"), file)
+        val text = file.readText()
+        assertTrue("config.devServer" in text, text)
+        assertTrue("\"Cross-Origin-Opener-Policy\": \"same-origin\"" in text, text)
+        assertTrue("\"Cross-Origin-Embedder-Policy\": \"credentialless\"" in text, text)
+        assertTrue("\"Cross-Origin-Resource-Policy\": \"same-origin\"" in text, text)
+    }
+
+    @Test
+    fun `writeWasmCrossOriginIsolationAssets writes _headers, service worker and check page`() {
+        val dir = tmp()
+        writeWasmCrossOriginIsolationAssets(dir, "require-corp")
+        assertTrue(File(dir, WASM_HEADERS_FILE).isFile)
+        assertTrue(File(dir, WASM_COI_SERVICE_WORKER_FILE).isFile)
+        assertTrue(File(dir, WASM_COI_CHECK_PAGE_FILE).isFile)
+    }
+
+    @Test
+    fun `plugin registers stageWasmCrossOriginIsolation and wires it into wasmJsProcessResources`() {
+        val project = ProjectBuilder.builder().withProjectDir(tmp()).build()
+        project.pluginManager.apply("org.jetbrains.kotlin.multiplatform")
+        project.pluginManager.apply("org.thisisthepy.python.multiplatform")
+        @OptIn(org.jetbrains.kotlin.gradle.ExperimentalWasmDsl::class)
+        project.extensions.getByType(KotlinMultiplatformExtension::class.java).wasmJs {
+            browser()
+        }
+
+        val stageTask = project.tasks.getByName(STAGE_WASM_ISOLATION_TASK) as StageWasmCrossOriginIsolationTask
+        val processResources = project.tasks.getByName("wasmJsProcessResources") as Copy
+
+        assertTrue(
+            stageTask in processResources.taskDependencies.getDependencies(processResources),
+            "wasmJsProcessResources does not depend on $STAGE_WASM_ISOLATION_TASK",
+        )
+
+        stageTask.stage()
+        val outDir = stageTask.destinationDir.get().asFile
+        val headersFile = File(outDir, WASM_HEADERS_FILE)
+        val workerFile = File(outDir, WASM_COI_SERVICE_WORKER_FILE)
+        val checkPage = File(outDir, WASM_COI_CHECK_PAGE_FILE)
+        assertTrue(headersFile.isFile, "_headers was not generated in $outDir")
+        assertTrue(workerFile.isFile, "coi-serviceworker.js was not generated in $outDir")
+        assertTrue(checkPage.isFile, "coi-check.html was not generated in $outDir")
+        assertTrue(
+            headersFile.canonicalFile in processResources.source.files.map { it.canonicalFile },
+            "wasmJsProcessResources does not include $outDir: ${processResources.source.files}",
+        )
+    }
+}
diff --git a/usage-example/gradle/libs.versions.toml b/usage-example/gradle/libs.versions.toml
index 8686b1f..d00bb42 100644
--- a/usage-example/gradle/libs.versions.toml
+++ b/usage-example/gradle/libs.versions.toml
@@ -13,7 +13,8 @@ compose-plugin = "1.11.1-ext.3"
 kotlin = "2.4.20-Beta2"
 kotlinx-coroutines = "1.10.1"
 # python-multiplatform's library, KSP and bindings plugin share one version (its #70, #95, #318, #333).
-python-multiplatform = "3.15.0-alpha01"
+# Keep it equal to the toolchain plugin's DEFAULT_TYPEDPYTHON_GATE.
+python-multiplatform = "3.15.0-alpha03"
 # The toolchain plugin, from ../toolchain via mavenLocal (`./gradlew :toolchain:publishToMavenLocal`).
 toolchain = "1.0.0-alpha"
 
diff --git a/usage-example/src/wasmJsMain/resources/index.html b/usage-example/src/wasmJsMain/resources/index.html
index 8cbac19..f3e3800 100644
--- a/usage-example/src/wasmJsMain/resources/index.html
+++ b/usage-example/src/wasmJsMain/resources/index.html
@@ -5,6 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Toolchain</title>
     <link type="text/css" rel="stylesheet" href="styles.css">
+    <script type="application/javascript" src="coi-serviceworker.js"></script>
     <script type="application/javascript" src="Project.js"></script>
 </head>
 <body>

Surface영역	What cross-origin isolation changes교차 출처 격리로 달라지는 점	What to do대응 방법
Third-party `<iframe>`제3자 `<iframe>`	Embedded cross-origin documents must opt in with CORP/COEP headers, or the browser refuses to load them.내장된 교차 출처 문서가 CORP/COEP 헤더로 동의하지 않으면 브라우저가 로드를 거부합니다.	Serve the framed document with `Cross-Origin-Embedder-Policy` and `Cross-Origin-Resource-Policy: cross-origin`, or open it in a top-level navigation instead of an iframe.iframe 문서에 `Cross-Origin-Embedder-Policy` 와 `Cross-Origin-Resource-Policy: cross-origin` 을 설정하거나, iframe 대신 최상위 탐색으로 여세요.
Popup OAuth and payment flows팝업 기반 OAuth 및 결제 흐름	Under `Cross-Origin-Opener-Policy: same-origin`, cross-origin popups lose `window.opener` (it becomes `null`), so `postMessage` handshakes back to the opener break.`Cross-Origin-Opener-Policy: same-origin` 아래에서는 교차 출처 팝업의 `window.opener` 가 `null` 이 되어, 부모 창으로의 `postMessage` 핸드셰이크가 끊깁니다.	Use full-page redirect OAuth/payment flows, or configure the host with `same-origin-allow-popups` where the browser's isolation rules permit it.전체 페이지 리다이렉트 방식의 OAuth/결제 흐름을 쓰거나, 브라우저 격리 규칙이 허용하는 범위에서 호스트에 `same-origin-allow-popups` 를 설정하세요.
External images, scripts, fonts and media외부 이미지, 스크립트, 글꼴, 미디어	Under `Cross-Origin-Embedder-Policy: require-corp`, any cross-origin subresource without a `Cross-Origin-Resource-Policy` or CORS header is blocked.`Cross-Origin-Embedder-Policy: require-corp` 아래에서는 `Cross-Origin-Resource-Policy` 나 CORS 헤더가 없는 교차 출처 하위 리소스가 차단됩니다.	Add `crossorigin` attributes and serve CORS/CORP headers on the asset host, or build with `-Ppython.wasm.coep=credentialless` so no-cookie cross-origin requests load without CORP.`crossorigin` 속성을 붙이고 자산 호스트에서 CORS/CORP 헤더를 내려주거나, 쿠키 없는 교차 출처 요청을 CORP 없이 로드하도록 `-Ppython.wasm.coep=credentialless` 로 빌드하세요.