diff --git a/ui/PLAN.md b/ui/PLAN.md
index 9de8834..52e0576 100644
--- a/ui/PLAN.md
+++ b/ui/PLAN.md
@@ -1905,3 +1905,53 @@ Targeted tests:
   failure tears down the stream and reconnects with backoff.
 - Locale switch persists across reloads and applies to every visible
   string on every platform.
+
+## TODO — deferred follow-ups from Phases 1-5
+
+These items are explicit decisions to defer, not unknown work. Each
+should be picked up either as a follow-up patch or folded into the
+phase listed in the parenthesis when that phase lands.
+
+- **Build `core.wasm` in CI, drop the committed artefacts** — install
+  TinyGo on the Gitea Actions runner (`brew install tinygo` is not
+  available on Linux runners, so use the official tarball or
+  `curl … | tar -xz` step), add `make -C ui wasm` ahead of the Vitest
+  step in `.gitea/workflows/ui-test.yaml`, then remove
+  `ui/frontend/static/core.wasm` and `ui/frontend/static/wasm_exec.js`
+  from the repo and re-tighten `ui/.gitignore`. Phase 5 committed the
+  binaries only as a stop-gap so contributors did not have to install
+  TinyGo. (Phase 5 cleanup, blocks before Phase 33 PWA.)
+- **Restore `js.CopyBytesToGo` when TinyGo fixes the
+  `instanceof Uint8Array` check** — the per-element loop in
+  `ui/wasm/main.go::copyBytesFromJS` is a workaround for TinyGo 0.41
+  panicking on Uint8Arrays whose prototype chain crosses Node's
+  `Buffer`. Track upstream
+  (<https://github.com/tinygo-org/tinygo/issues>) and revert the
+  helper once a release is pinned. (Phase 5 follow-up.)
+- **Migrate TS codegen to Connect-ES v2 BSR plugin once published** —
+  `ui/buf.gen.yaml` runs `protoc-gen-es` v2 locally because
+  `buf.build/connectrpc/es` is still on v1.6.1 and emits
+  v1-incompatible imports. When the v2 plugin lands on the BSR, we
+  can either keep the local plugin (no network dep) or move back to
+  the remote, depending on whether buf.build rate limits are hit in
+  CI. (Phase 5 follow-up; revisit when next regenerating.)
+- **Rename `gateway/internal/grpcapi/` → `gateway/internal/connectapi/`**
+  — the package now hosts a Connect-Go listener that natively serves
+  Connect, gRPC, and gRPC-Web; the `grpcapi` name is historical.
+  Touches imports in `gateway/cmd/gateway/main.go` and a couple of
+  cross-package refs. Pure rename, no behaviour change. (Phase 4
+  cleanup; do alongside the next gateway change.)
+- **Rename `GATEWAY_AUTHENTICATED_GRPC_*` env vars to drop the `GRPC`
+  infix** — they label the authenticated-edge tier, not the wire
+  protocol. Affects `gateway/internal/config/`, the integration
+  testenv defaults in `integration/testenv/gateway.go`, the README,
+  and the runbook. Coordinated with the package rename above.
+  (Phase 4 cleanup; not before the env vars are referenced by
+  external operators.)
+- **Add a Docker-stack integration test for Connect end-to-end** —
+  Phase 4 closed with service-level Connect tests only. Once a phase
+  already brings up the full stack (Phase 7 onward, since auth flow
+  needs backend), drop a `integration/connect_call_test.go` that
+  exercises a unary Connect call and a server-streaming Connect call
+  through `testenv.Bootstrap`. (Phase 7+, fold into the phase that
+  needs it.)
diff --git a/ui/wasm/main.go b/ui/wasm/main.go
index 7836809..7412f01 100644
--- a/ui/wasm/main.go
+++ b/ui/wasm/main.go
@@ -22,6 +22,9 @@
 // All functions return either a Uint8Array, a boolean, or fail closed.
 // They never throw — callers may inspect the boolean result or rely on
 // the canon-byte length to detect malformed input.
+
+//go:build js && wasm
+
 package main
 
 import (