Backend exposes a backend-only overlay/drawing registry contract. Object Tree overlay rows must stay sourced from this registry plus runtime getOverlays snapshots.

• src/control-plane/widget-type-registry/widget-type-registry.controller.ts -> @Controller("admin/widget-types") + @Get("klinecharts-runtime/overlays/contract")

Backend documents drawing mode, overlay events, object-tree sync and trusted plugin policy without exposing executable custom code.

• src/control-plane/widget-type-registry/klinecharts-overlay-interaction.contract.ts -> object_tree_get_overlays
• Runtime bootstrap handoff mentions object-tree sync and trusted registerOverlay policy

Backend has a built-in overlay test/restore handoff. Server persistence must honor restore-after-refresh and symbol-switch semantics before live writes are enabled.

• src/control-plane/widget-type-registry/widget-type-registry.controller.ts -> @Get("klinecharts-runtime/overlays/built-in-tests/part-1/contract")

Backend exposes indicator lifecycle/registry contract. Object Tree indicator rows must remain registry-driven and JSON-safe.

• src/control-plane/widget-type-registry/widget-type-registry.controller.ts -> @Get("klinecharts-runtime/indicators/contract")

Backend handoff says getIndicators/getOverlays are safe redacted snapshots for Object Tree/Admin Preview; raw chart instance must stay inside chart-runtime.

• src/control-plane/widget-type-registry/klinecharts-chart-instance-api-part1.contract.ts -> getIndicators/getOverlays productDecision

Backend handoff covers getSize, convertToPixel and convertFromPixel for safe pane/object-tree selection without exposing DOM or chart instance to backend.

• src/control-plane/widget-type-registry/klinecharts-chart-instance-api-part2.contract.ts -> getDom/getSize/convertToPixel/convertFromPixel handoff

Backend exposes an admin overlay registry endpoint, but it is admin-token protected. Frontend QA must not require manual admin token input or render token values.

• src/control-plane/admin-api/admin-api.controller.ts -> @ApiBearerAuth() + @Get("kline/overlay-registry")

Backend exposes an admin indicator registry endpoint, but it is admin-token protected. Dashboard must use controlled admin flows and never expose token evidence.

• src/control-plane/admin-api/admin-api.controller.ts -> @ApiBearerAuth() + @Get("kline/indicator-registry")

No matching backend controller was found in the uploaded backend ZIP. F026 preflight remains a frontend contract until backend implements this route with tenant/auth/audit/revision enforcement.

• No @Post("object-tree-drafts/preflight") or runtime object-tree draft controller found in backend source scan

Server-side Object Tree writes are still blocked. Persist must not be enabled until backend has idempotency replay, optimistic revision locking and audit-log enforcement.

• Backend currently has registry/config contracts, not tenant-owned Object Tree draft persistence

No runtime restore endpoint was found. Iframe runtime must keep using local/contract restore paths until backend adds a runtime-token protected restore API.

• Runtime widget controller exposes /api/v1/widget/bootstrap and /api/v1/widget/bootstrap/contract only; no /api/v1/widget/object-tree route found