diff --git a/dashboards/tracker-web/docs/roadmaps/UX_INTEGRATION_BYTELYST.md b/dashboards/tracker-web/docs/roadmaps/UX_INTEGRATION_BYTELYST.md
index 0d6b66ef..1c6d01d8 100644
--- a/dashboards/tracker-web/docs/roadmaps/UX_INTEGRATION_BYTELYST.md
+++ b/dashboards/tracker-web/docs/roadmaps/UX_INTEGRATION_BYTELYST.md
@@ -250,27 +250,48 @@ pnpm build      # final gate
       (Added `@bytelyst/notifications-ui` workspace dep with a minimal `link:` lockfile entry;
       `SystemBanners` mounts `BannerStack` (env `NEXT_PUBLIC_SYSTEM_NOTICE`, dismissible) +
       a localStorage-dismissible `Announcement` at the top of the dashboard shell. UX-13.2
-      verified: tc/lint/test 165 ✓/build/e2e 18 ✓.)
+      `3d22c303`: tc/lint/test 165 ✓/build/e2e 18 ✓.)
 
 ## Cross-cutting (run continuously)
 
-- [ ] **CC.1** Full suite green after every wave: `pnpm typecheck && pnpm lint && pnpm test && pnpm build`.
-- [ ] **CC.2** Dark mode parity — every migrated surface looks correct in `.dark`.
-- [ ] **CC.3** Zero new hardcoded color literals (grep `slate-|blue-600|#[0-9a-f]{6}` in changed files).
-- [ ] **CC.4** a11y — if `@axe-core/playwright` runs offline, assert no new violations on `/roadmap`
+- [x] **CC.1** Full suite green after every wave: `pnpm typecheck && pnpm lint && pnpm test && pnpm build`.
+      (Run after every UX-9…13 commit; final state UX-13.2: typecheck ✓ / lint ✓ / test 165 ✓ /
+      build ✓ / e2e 18 ✓.)
+- [x] **CC.2** Dark mode parity — every migrated surface looks correct in `.dark`.
+      (Achieved structurally: the extended `--bl-*` bridge maps every adopted token onto tracker's
+      OKLCH vars — which already flip under `.dark` — or `color-mix` of them, plus semantic
+      `--success/--warning/--info` defined per-theme. No adopted component carries a fixed color.)
+- [x] **CC.3** Zero new hardcoded color literals (grep `slate-|blue-600|#[0-9a-f]{6}` in changed files).
+      (`git diff <UX-base>..HEAD -- src` → no new `slate-N` / `blue-600` / `#hex` / `bg-[#…]`; in fact
+      UX-12.1 removed the roadmap toggle's `blue-600` literals.)
+- [x] **CC.4** a11y — if `@axe-core/playwright` runs offline, assert no new violations on `/roadmap`
       and `/login`; otherwise Vitest render assertions for roles/labels.
-- [ ] **CC.5** Update master `docs/ROADMAP.md` Phase 2.1 checkboxes **only if** the operator asks —
+      (axe-core runs offline in the Playwright suite asserting no serious/critical violations on
+      `/login` and `/roadmap`; both green. Added aria-labels where the shared `LoginForm` shipped
+      placeholder-only inputs.)
+- [x] **CC.5** Update master `docs/ROADMAP.md` Phase 2.1 checkboxes **only if** the operator asks —
       default: leave it, this doc is the source of truth for the integration.
+      (Default applied: master `docs/ROADMAP.md` left untouched — operator did not request it.)
 - [x] **CC.6** **UI-drift ratchet:** once UX-9 lands, add an ESLint `no-restricted-imports` rule
       forbidding direct `@bytelyst/ui` imports outside `src/components/ui/Primitives.tsx`, so all
       future UI goes through the adapter. Fix any existing violations in the same commit.
       (Done: rule + adapter exemption in `eslint.config.mjs`; no pre-existing violations; probe confirms it fires.)
-- [ ] **CC.7** **Bundle budget:** after chart/motion/rich-text waves, re-check the `bundlesize`
+- [x] **CC.7** **Bundle budget:** after chart/motion/rich-text waves, re-check the `bundlesize`
       budgets in `package.json`. If a route grows, prefer dynamic `import()` for heavy surfaces
       (charts, rich-text editor) over raising a budget. Note the gzipped sizes in the log.
-- [ ] **CC.8** **Coverage ratchet:** keep the enforced Vitest thresholds (80%) green; each wave
+      (`bundlesize` itself is env-blocked — `iltorb` won't build on Node 25, see TEST_VALIDATION_LOG —
+      so budgets were verified by gzipping the built chunks: all within budget, no budget raised.
+      Largest: framework 58.3 kB / 100, main 37.3 kB / 50, layout 3.6 kB / 150; heaviest route
+      `/dashboard/items` 6.9 kB / 30, `/roadmap` 3.8 kB / 30, `/login` 3.1 kB / 30. No dynamic
+      import needed — charts/motion/rich-text waves were not adopted in this scope.)
+- [x] **CC.8** **Coverage ratchet:** keep the enforced Vitest thresholds (80%) green; each wave
       that adds a component should add the render/export test that keeps `Primitives.tsx` and new
       surfaces above threshold (no silently-dead gates — see `docs/TEST_VALIDATION_LOG.md`).
+      (Enforced thresholds stay green: 94.36% stmts / 86.58% branch / 94.28% funcs / 96.99% lines,
+      165 tests. Added export/import smoke tests for the Primitives adapter, auth-ui and
+      notifications-ui. Note: v8 reports the pure re-export `Primitives.tsx` barrel as 0% — there
+      are no executable bodies to instrument — but the global gate is green and the export test
+      guards every re-export.)
 
 ## Progress
 
@@ -286,3 +307,29 @@ all app code imports from), and `src/app/dashboard/items/page.tsx` (the working
 adoption — the reference pattern). Execute **one task at a time**, verify + commit after each, and
 do the **Core** waves (UX-2 … UX-8) before the **Expand** waves (UX-9 … UX-13). Treat 12.3 and all
 of UX-13 as data-gated stretch — leave them `- [ ]` with a note if the backend can't support them.
+
+---
+
+## Status — Expand waves complete (2026-05-28)
+
+The **Expand** waves (UX-9 … UX-13) and **all cross-cutting items (CC.1 … CC.8)** are done,
+strictly scoped to `dashboards/tracker-web`. Each item was verified
+(`typecheck` + `lint` + `test` + `build` + Playwright e2e/axe) and shipped as its own
+conventional commit referencing its roadmap ID:
+
+| Wave / item | Commit     | Summary                                                    |
+| ----------- | ---------- | ---------------------------------------------------------- |
+| UX-9        | `18a09b25` | Broaden Primitives adapter + export-presence test          |
+| CC.6        | `73d2891d` | `no-restricted-imports` UI-drift ratchet                   |
+| UX-10       | `3a9621f0` | `ErrorPage` + `PageHeader` + `LoadingSpinner` page chrome  |
+| UX-1.2 ext  | `ccee7dfa` | Full `--bl-*` token bridge (enables CC.2 dark-mode parity) |
+| UX-11       | `328e3072` | `LoginForm` + `MfaChallenge` on the login surface          |
+| UX-12.1     | `ddf25cf5` | `SegmentedControl` view toggle + board `Tooltip`s          |
+| UX-12.2     | `32dac7d4` | item-detail `ActionMenu` + `Timeline` comments             |
+| UX-13.2     | `3d22c303` | `BannerStack` + `Announcement` system messaging            |
+
+**Deferred (data-gated, documented above):** UX-12.3 (`RichTextEditor` — backend stores plain
+text, no HTML sanitization) and UX-13.1 (`NotificationCenter` — no notifications feed). Both deps
+that are needed are wired/smoke-tested so a future enablement starts from green.
+
+**Out of scope for this run:** the **Core** waves UX-2 … UX-8 remain `⬜`.