diff --git a/CHANGELOG.md b/CHANGELOG.md
index 89a3344..c594a0c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## v0.4.0
+- **The Browser panel works out of the box now.** The default `panel_mode` is **`minimal`** — a
+  live screenshot + nav toolbar driven through the gated same-origin routes; it works everywhere
+  (host + member), no dashboard daemon needed.
+- **`full` mode is now a launcher, not an embed.** The dashboard is a Next.js app whose assets are
+  **root-absolute** (`/_next/...`) with no base-path, so it can't render under a sub-path panel —
+  that was the long-standing blank panel. Full mode now opens the dashboard at its **own origin**
+  ("Open dashboard ↗", works on a local/host setup) and the **dead sub-path reverse proxy
+  (HTTP + WebSocket) is removed**.
+- **Start the dashboard from the UI** — a live status dot + **Start / Stop** control in the panel
+  (gated `GET`/`POST /api/plugins/agent_browser/dashboard`), so you never need a terminal. Verified
+  end-to-end against the real `agent-browser` binary (status → start → running → stop).
+
 ## v0.3.0
 - **Host-free test suite** (`tests/`) — the tool subprocess wrappers (arg-building +
   graceful error degradation), the panel routers (page / four-rules / gating / dashboard
diff --git a/README.md b/README.md
index 0a4bfa3..6ae2c47 100644
--- a/README.md
+++ b/README.md
@@ -37,15 +37,20 @@ point.
 - **Skill** — a discovery skill that defers to the CLI's always-current workflow
   content (`agent-browser skills get core`), so instructions never go stale.
 - **Workflows** — declarative browser recipes (browse-and-extract, fill-a-form, …).
-- **Browser panel** — a console view (ADR 0026) that **embeds agent-browser's own
-  live dashboard** (`agent-browser dashboard start`, port 4848): the live viewport
-  (CDP screencast) + the command activity / console / network feeds. We hijack their
-  renderer rather than building one. The dashboard is served **same-origin through
-  the plugin's own reverse-proxy route** (`/plugins/agent_browser/panel/dash`,
-  HTTP + WebSocket), so the embed rides the fleet proxy (ADR 0042) on the host and
-  on a member alike — it never points the operator's browser at `localhost:PORT`
-  (issue #6). `minimal` mode (`panel_mode: minimal`) renders a viewport-only page
-  (live screenshot + nav toolbar) with no WS dependency.
+- **Browser panel** — a console view (ADR 0026) for watching/driving the browser. Two
+  modes, set by `panel_mode`:
+  - **`minimal` (default)** — a **live screenshot** of the viewport + a nav toolbar + a
+    **Dashboard control** (start/stop/status), all through the **gated same-origin routes**.
+    Works everywhere (host and member), no dashboard daemon needed. The reliable mode.
+  - **`full`** — a **launcher** for agent-browser's own dashboard (viewport + activity/
+    console/network feeds). It's not embedded: that dashboard is a Next.js app with
+    **root-absolute asset paths** (no base-path), so it can't render under a sub-path
+    panel — it only loads at its **own origin**. Full mode opens it there
+    ("Open dashboard ↗"), which works on a local/host setup. For a remote member, use
+    `minimal`.
+
+  Either mode can **start the dashboard from the panel** (no terminal) — the Start/Stop
+  control hits the gated `POST /api/plugins/agent_browser/dashboard`.
 
 ## Requirements
 
@@ -77,7 +82,7 @@ agent_browser:
 | File | What |
 |---|---|
 | `tools.py` | the browser tools — subprocess wrappers over the `agent-browser` CLI |
-| `browser_panel.py` | the console view that embeds the agent-browser dashboard (same-origin reverse proxy) |
+| `browser_panel.py` | the Browser panel — `minimal` (live viewport + nav + dashboard control) and `full` (a launcher for the dashboard) |
 | `lifecycle.py` | the dashboard daemon surface — start on boot, stop on shutdown (ADR 0018) |
 | `skills/` | the discovery skill (defers to `agent-browser skills get core`) |
 | `workflows/` | declarative browser recipes |
diff --git a/browser_panel.py b/browser_panel.py
index d799010..a22ce94 100644
--- a/browser_panel.py
+++ b/browser_panel.py
@@ -1,22 +1,21 @@
 """Browser panel console view (ADR 0026) — two modes, set by ``panel_mode``.
 
-- ``full`` (default): iframes agent-browser's own live dashboard (viewport +
-  activity/console/network/… feeds), reusing their renderer wholesale. The
-  dashboard is served **through this plugin's router** (a same-origin reverse
-  proxy under ``/plugins/agent_browser/panel/dash``) so the iframe rides the
-  fleet proxy (ADR 0042) on the host AND on a member — never a hardcoded
-  ``http://localhost:PORT`` (issue #6: that URL resolved against the operator's
-  own machine, not the member box → "refused to connect").
-- ``minimal``: a viewport-only page we render ourselves — a live screenshot (polled
-  from the CLI, same-origin, no WS-protocol dependency) plus a slim nav toolbar
-  (url / back / forward / reload). "Expose less": just the page, nothing else.
-
-Self-contained vanilla JS (no build step). Every fetch / iframe-src / asset is
-derived from ``base = location.pathname.split("/plugins/")[0]`` (="" on the host,
-``/agents/<slug>`` when proxied) so the page is same-origin + slug-aware — the rule
-that keeps the postMessage token/theme handshake working through the fleet proxy.
-The page reads/drives the browser only through the CLI behind same-origin routes;
-the agent's own browser_* tools are the primary driver — this is an operator viewport.
+- ``minimal`` (default): a viewport-only page we render ourselves — a live screenshot
+  (polled from the CLI through the gated /shot route, same-origin, no WS/proxy
+  dependency) + a nav toolbar (url / back / forward / reload) + a Dashboard control
+  (start/stop/status). Works everywhere — host and member alike.
+- ``full``: a launcher for agent-browser's own dashboard (viewport + activity/console/
+  network feeds). We deliberately do NOT embed it: that dashboard is a prebuilt Next.js
+  app whose assets are ROOT-ABSOLUTE (``/_next/…``) with no base-path option, so it can't
+  render under a sub-path reverse proxy (the long-standing blank panel) — it only renders
+  at its OWN origin. Full mode opens it there ("Open dashboard ↗"), which works on a
+  local/host setup; for a remote member, use minimal.
+
+Self-contained vanilla JS (no build step). Every fetch / link is derived from
+``base = location.pathname.split("/plugins/")[0]`` (="" on the host, ``/agents/<slug>``
+when proxied) so the page is same-origin + slug-aware (the token/theme handshake). The
+browser is driven only through the CLI behind same-origin routes; the agent's own
+browser_* tools are the primary driver — this is an operator viewport.
 """
 
 from __future__ import annotations
@@ -28,20 +27,10 @@
 import tempfile
 import time
 
-# Imported at MODULE scope (not inside the factory) so FastAPI can resolve the
-# string annotations these routes carry — with `from __future__ import annotations`
-# every annotation is a string and FastAPI's get_type_hints() looks them up in the
-# module globals, so `request: Request` / `websocket: WebSocket` must live here.
-# Safe: the host always provides fastapi, and __init__.py catches ImportError
-# (tools still serve if the panel can't import).
-from fastapi import APIRouter, Body, Request, WebSocket
-from fastapi.responses import (
-    FileResponse,
-    HTMLResponse,
-    JSONResponse,
-    Response,
-    StreamingResponse,
-)
+# Module-scope fastapi imports (the host always provides fastapi; __init__.py catches
+# ImportError so the tools still serve if the panel can't import).
+from fastapi import APIRouter, Body
+from fastapi.responses import FileResponse, HTMLResponse, JSONResponse, Response
 
 log = logging.getLogger("protoagent.plugins.agent_browser")
 
@@ -53,132 +42,14 @@ def build_panel_router(cfg: dict | None):
 
     cfg = cfg or {}
     port = int(cfg.get("dashboard_port", 4848))
-    mode = str(cfg.get("panel_mode", "full")).strip().lower()
-    # NB: the page + dash-proxy routes don't shell out (binary/timeout) — they only
-    # reverse-proxy the dashboard daemon on `port`. The shot/nav DATA routes that DO
-    # run the CLI live in build_panel_data_router (gated under /api).
+    mode = str(cfg.get("panel_mode", "minimal")).strip().lower()
 
     router = APIRouter()
 
     @router.get("/panel")
     async def _panel():
-        return HTMLResponse(_MINIMAL_PAGE if mode == "minimal" else _FULL_PAGE)
-
-    # The minimal-mode shot/nav DATA routes moved to build_panel_data_router —
-    # gated under /api/plugins/agent_browser (plugin-view rule 2). The /panel/dash
-    # reverse proxy below stays on the public prefix OF NECESSITY: it's loaded by
-    # an <iframe>, and an iframe navigation can't carry an Authorization bearer.
-    # Gating it needs a designed handoff (tracked upstream) — same posture as the
-    # page itself.
-
-    # ── full-mode backing route: same-origin reverse proxy to the dashboard ────
-    # The dashboard daemon binds the SERVING box's loopback (127.0.0.1:<port>).
-    # Proxying it through our own router makes the embed same-origin (so it rides
-    # the fleet proxy + the postMessage handshake works) instead of an absolute
-    # http://localhost:<port> the operator's browser would resolve against ITS
-    # OWN machine (issue #6 — unreachable for a member). Streaming-safe; upgrades
-    # WebSockets (the dashboard's live viewport/feed channels) when reachable.
-    _DASH = f"http://127.0.0.1:{port}"
-    # Hop-by-hop headers must not cross a proxy boundary (RFC 7230 §6.1).
-    _HOP = {"host", "content-length", "connection", "keep-alive", "transfer-encoding",
-            "te", "trailer", "upgrade", "proxy-authorization", "proxy-authenticate"}
-
-    @router.get("/panel/dash")
-    @router.get("/panel/dash/{path:path}")
-    async def _dash(request: Request, path: str = ""):
-        """HTTP reverse proxy → the local dashboard daemon (same-origin embed).
-        Streams the upstream response unbuffered (SSE-safe); 502 when the daemon
-        isn't up (e.g. ``agent-browser dashboard start`` hasn't run yet)."""
-        try:
-            import httpx
-        except Exception:  # noqa: BLE001 — httpx is a host dep; degrade if somehow absent
-            return Response(status_code=502, content="dashboard proxy unavailable (httpx missing)")
-        url = f"{_DASH}/{path}" if path else _DASH
-        headers = {k: v for k, v in request.headers.items() if k.lower() not in _HOP}
-        body = await request.body()
-        client = httpx.AsyncClient(timeout=httpx.Timeout(None, connect=5.0))
-        try:
-            upstream_req = client.build_request(
-                request.method, url, headers=headers, content=body,
-                params=dict(request.query_params))
-            upstream = await client.send(upstream_req, stream=True)
-        except (httpx.ConnectError, httpx.ConnectTimeout):
-            await client.aclose()
-            return Response(status_code=502,
-                            content="dashboard not reachable — run `agent-browser dashboard start`")
-        except Exception:  # noqa: BLE001
-            await client.aclose()
-            log.warning("[agent_browser] dashboard proxy error", exc_info=True)
-            return Response(status_code=502, content="dashboard proxy error")
-
-        async def _pipe():
-            try:
-                async for chunk in upstream.aiter_raw():
-                    yield chunk
-            finally:
-                await upstream.aclose()
-                await client.aclose()
-
-        resp_headers = {k: v for k, v in upstream.headers.items() if k.lower() not in _HOP}
-        return StreamingResponse(_pipe(), status_code=upstream.status_code, headers=resp_headers)
-
-    @router.websocket("/panel/dash")
-    @router.websocket("/panel/dash/{path:path}")
-    async def _dash_ws(websocket: WebSocket, path: str = ""):
-        """WebSocket reverse proxy → the dashboard's live channels (CDP screencast /
-        activity feeds). Bidirectional pump; both halves close together. Works on the
-        host directly; over the fleet proxy it depends on the hub forwarding upgrades."""
-        try:
-            import websockets
-            from websockets.exceptions import ConnectionClosed
-        except Exception:  # noqa: BLE001 — websockets is a host dep
-            await websocket.close(code=1011)
-            return
-        scheme = "ws"
-        target = f"{scheme}://127.0.0.1:{port}/{path}" if path else f"{scheme}://127.0.0.1:{port}"
-        qs = websocket.url.query
-        if qs:
-            target = f"{target}?{qs}"
-        subprotocols = websocket.scope.get("subprotocols") or None
-        await websocket.accept()
-        try:
-            async with websockets.connect(target, subprotocols=subprotocols,
-                                           open_timeout=5, max_size=None) as upstream:
-                async def _c2s():
-                    try:
-                        while True:
-                            msg = await websocket.receive()
-                            if msg.get("type") == "websocket.disconnect":
-                                break
-                            if (t := msg.get("text")) is not None:
-                                await upstream.send(t)
-                            elif (b := msg.get("bytes")) is not None:
-                                await upstream.send(b)
-                    except Exception:  # noqa: BLE001
-                        pass
-
-                async def _s2c():
-                    try:
-                        async for data in upstream:
-                            if isinstance(data, (bytes, bytearray)):
-                                await websocket.send_bytes(bytes(data))
-                            else:
-                                await websocket.send_text(data)
-                    except (ConnectionClosed, Exception):  # noqa: BLE001
-                        pass
-
-                done, pending = await asyncio.wait(
-                    {asyncio.create_task(_c2s()), asyncio.create_task(_s2c())},
-                    return_when=asyncio.FIRST_COMPLETED)
-                for task in pending:
-                    task.cancel()
-        except Exception:  # noqa: BLE001 — daemon down / handshake failed
-            log.info("[agent_browser] dashboard ws proxy: upstream not reachable", exc_info=True)
-        finally:
-            try:
-                await websocket.close()
-            except Exception:  # noqa: BLE001
-                pass
+        page = _MINIMAL_PAGE if mode == "minimal" else _FULL_PAGE
+        return HTMLResponse(page.replace("__DASH_PORT__", str(port)))
 
     return router
 
@@ -193,6 +64,7 @@ def build_panel_data_router(cfg: dict | None):
     cfg = cfg or {}
     binary = str(cfg.get("binary") or "agent-browser")
     timeout = float(cfg.get("timeout_s", 60))
+    port = int(cfg.get("dashboard_port", 4848))
 
     router = APIRouter()
 
@@ -235,54 +107,102 @@ async def _nav(body: dict = Body(...)):
             return JSONResponse({"ok": False, "error": f"bad action {action!r}"})
         return JSONResponse({"ok": rc == 0, "error": "" if rc == 0 else err[:200]})
 
+    # ── dashboard control (start it up entirely from the panel UI) ──────────────
+    # The agent-browser dashboard is a standalone daemon. These let the panel show its
+    # status and start/stop it without dropping to a terminal. Status is a live probe of
+    # the daemon's loopback port (there's no `dashboard status` subcommand).
+    @router.get("/dashboard")
+    async def _dash_status():
+        try:
+            import httpx
+
+            async with httpx.AsyncClient(timeout=httpx.Timeout(2.0)) as c:
+                await c.get(f"http://127.0.0.1:{port}/")
+            running = True
+        except Exception:  # noqa: BLE001 — connection refused / down → not running
+            running = False
+        return JSONResponse({"running": running, "port": port})
+
+    @router.post("/dashboard")
+    async def _dash_control(body: dict = Body(...)):
+        """Start or stop the dashboard daemon from the UI. `action` is start|stop."""
+        action = str(body.get("action", "")).strip().lower()
+        if action == "start":
+            rc, err = await asyncio.to_thread(lambda: _run("dashboard", "start", "--port", str(port)))
+        elif action == "stop":
+            rc, err = await asyncio.to_thread(lambda: _run("dashboard", "stop"))
+        else:
+            return JSONResponse({"ok": False, "error": f"action must be start|stop, got {action!r}"})
+        return JSONResponse({"ok": rc == 0, "error": "" if rc == 0 else err[:200], "port": port})
+
     return router
 
 
-# ── full mode: iframe agent-browser's dashboard (same-origin reverse proxy) ────
-# Chrome is the protoLabs design system: link the no-build plugin-kit (--pl-* tokens
-# + .pl-* components), drive theming from the console handshake (ADR 0038). Only the
-# ~30px wrapper bar is ours; the viewport is agent-browser's third-party dashboard.
-#
-# The iframe src is derived SAME-ORIGIN + SLUG-AWARE (issue #6): the dashboard is
-# served through our own /panel/dash reverse proxy, never a hardcoded
-# http://localhost:PORT (which the operator's browser resolves against its OWN box —
-# unreachable for a member, and cross-origin breaks the postMessage handshake).
-#   base = location.pathname.split("/plugins/")[0]   (="" on host, /agents/<slug> proxied)
-#   src  = base + "/plugins/agent_browser/panel/dash/"
+# ── full mode: a LAUNCHER for agent-browser's dashboard (not an embed) ──────────
+# The dashboard is a prebuilt Next.js app whose assets are root-absolute (/_next/…)
+# with no base-path option, so it can't render under our sub-path panel — it only
+# loads at its OWN origin. So full mode is a launcher: a Start/Stop control + an
+# "Open dashboard ↗" link to that origin (reachable on a local/host setup). For a
+# remote member, minimal mode is the one that works.
 _FULL_PAGE = r"""<!doctype html><html lang="en"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1"><title>Browser</title>
 <link id="dskit" rel="stylesheet" href="">
-<style>
-  html,body{margin:0;height:100%;background:var(--pl-color-bg);font-family:var(--pl-font-sans)}
-  .bar{height:30px;display:flex;align-items:center;gap:8px;padding:0 12px;color:var(--pl-color-fg-muted);
-    font-size:11.5px;border-bottom:var(--pl-border-width) solid var(--pl-color-border)}
-  .bar b{color:var(--pl-color-accent)} a{color:var(--pl-color-accent)}
-  iframe{display:block;width:100%;height:calc(100% - 30px);border:0;background:var(--pl-color-bg)}
-</style></head><body>
 <script>
-// Same-origin base: "" on the host, "/agents/<slug>" when served through the fleet
-// proxy. Prefix EVERY asset / iframe-src / link with it — never hardcode an absolute
-// path or a localhost:PORT origin (issue #6 — breaks the proxy + the token handshake).
 const BASE=location.pathname.split("/plugins/")[0];
-document.getElementById("dskit").href=BASE+"/_ds/plugin-kit.css";   // DS kit, same-origin
-const DASH=BASE+"/plugins/agent_browser/panel/dash/";                // reverse-proxied dashboard
+document.getElementById("dskit").href=BASE+"/_ds/plugin-kit.css";
+const DASH_PORT=__DASH_PORT__;
+function dashOpenUrl(){ return "http://"+location.hostname+":"+DASH_PORT+"/"; }
 </script>
-  <div class="bar"><b>Browser</b><span>agent-browser dashboard
-    · <a id="dashlink" href="#" target="_blank">open</a></span>
-    <span style="margin-left:auto">run <code>agent-browser dashboard start</code> if blank</span></div>
-  <iframe id="f"></iframe>
+<style>
+  html,body{margin:0;height:100%;background:var(--pl-color-bg);color:var(--pl-color-fg);
+    font-family:var(--pl-font-sans);font-size:13px}
+  .bar{height:38px;display:flex;align-items:center;gap:8px;padding:0 12px;
+    border-bottom:var(--pl-border-width) solid var(--pl-color-border)}
+  .bar b{color:var(--pl-color-accent)}
+  .dot{width:7px;height:7px;border-radius:50%;display:inline-block;flex:none}
+  .dot.ok{background:#22c55e}.dot.off{background:var(--pl-color-fg-muted,#9aa0aa)}
+  .stage{height:calc(100% - 38px);display:flex;align-items:center;justify-content:center;
+    padding:24px;background:var(--pl-color-bg-inset);box-sizing:border-box}
+  .card{max-width:440px;text-align:center}
+  .card .t{font-size:15px;font-weight:600;margin-bottom:8px}
+  .card .d{color:var(--pl-color-fg-muted);line-height:1.6;margin-bottom:16px}
+  .card .tip{margin-top:16px;font-size:11.5px;color:var(--pl-color-fg-muted)}
+  .card code{background:var(--pl-color-bg-subtle,rgba(127,127,127,.14));padding:.1em .35em;border-radius:4px}
+</style></head><body>
+  <div class="bar"><b>Browser</b><span id="dash" title="agent-browser dashboard"></span></div>
+  <div class="stage"><div class="card">
+    <div class="t">agent-browser dashboard</div>
+    <div class="d">The full dashboard — live viewport plus activity, console, and network
+      feeds — runs in its own window. It can't embed in this panel (its assets load from the
+      page root, which a sub-path panel can't serve), so it opens in a new tab.</div>
+    <a id="openlink" class="pl-btn pl-btn--primary" href="" target="_blank" rel="noopener">Open dashboard ↗</a>
+    <div class="tip">Want the browser <em>inside</em> the console? Set
+      <code>panel_mode: minimal</code> — a live viewport you can drive right here.</div>
+  </div></div>
 <script type="module">
-document.getElementById("dashlink").href=DASH;
-document.getElementById("f").src=DASH;
-// The DS plugin-kit owns theming THIS page's chrome (the handshake + live
-// re-themes onto --pl-*); it's an ES MODULE, so dynamic import (a classic
-// <script src> throws on its exports). The thin relay below stays: the embedded
-// third-party dashboard wants the RAW console message, which the kit doesn't
-// re-broadcast.
-try { (await import(BASE + "/_ds/plugin-kit.js")).initPluginView(); } catch (e) {}
-window.addEventListener("message",(e)=>{const d=e.data||{};
-  if(d.type==="protoagent:init"||d.type==="protoagent:theme"){
-    const f=document.getElementById("f"); try{f.contentWindow.postMessage(d,"*")}catch(_){} }});
+document.getElementById("openlink").href=dashOpenUrl();
+let kit;
+try { kit = await import(BASE + "/_ds/plugin-kit.js"); kit.initPluginView(); }
+catch (e) { kit = { initPluginView(){}, apiFetch: (p, i) => fetch(BASE + p, i) }; }
+// Dashboard control — start/stop the daemon from the panel (no terminal).
+function renderDash(running){
+  const el=document.getElementById("dash"); if(running===null){ el.innerHTML=""; return; }
+  el.innerHTML = running
+    ? '<span class="dot ok"></span> running <button class="pl-btn pl-btn--ghost pl-btn--sm" onclick="dashAct(\'stop\')">Stop</button>'
+    : '<span class="dot off"></span> stopped <button class="pl-btn pl-btn--sm" onclick="dashAct(\'start\')">Start dashboard</button>';
+}
+async function dashStatus(){
+  try{ const r=await kit.apiFetch("/api/plugins/agent_browser/dashboard"); const d=await r.json();
+    renderDash(!!d.running); }catch(_){ renderDash(null); }
+}
+async function dashAct(action){
+  document.getElementById("dash").innerHTML='<span class="dot off"></span> …';
+  try{ await kit.apiFetch("/api/plugins/agent_browser/dashboard",{method:"POST",
+    headers:{"Content-Type":"application/json"},body:JSON.stringify({action})}); }catch(_){}
+  setTimeout(dashStatus, 900);
+}
+window.dashAct=dashAct;
+dashStatus(); setInterval(dashStatus, 6000);
 </script></body></html>"""
 
 
@@ -308,6 +228,9 @@ async def _nav(body: dict = Body(...)):
     overflow:auto;background:var(--pl-color-bg-inset)}
   img{max-width:100%;display:block}
   .stage .pl-empty{margin:auto}
+  .dash{display:flex;align-items:center;gap:4px;font-size:11px;color:var(--pl-color-fg-muted);margin-left:4px}
+  .dot{width:7px;height:7px;border-radius:50%;display:inline-block;flex:none}
+  .dot.ok{background:#22c55e}.dot.off{background:var(--pl-color-fg-muted,#9aa0aa)}
 </style></head><body>
   <div class="bar">
     <button class="pl-btn pl-btn--ghost pl-btn--icon pl-btn--sm" title="Back" onclick="nav('back')">◀</button>
@@ -315,6 +238,7 @@ async def _nav(body: dict = Body(...)):
     <button class="pl-btn pl-btn--ghost pl-btn--icon pl-btn--sm" title="Reload" onclick="nav('reload')">⟳</button>
     <input id="url" class="pl-input" placeholder="example.com — Enter to open" autocomplete="off">
     <button class="pl-btn pl-btn--primary pl-btn--sm" onclick="go()">Go</button>
+    <span id="dash" class="dash" title="agent-browser dashboard"></span>
   </div>
   <div class="stage"><img id="screen" alt="">
     <div id="hint" class="pl-empty pl-empty--slotted">
@@ -356,11 +280,36 @@ async def _nav(body: dict = Body(...)):
   }catch(_){}
   busy=false;
 }
+// Dashboard control — start/stop the agent-browser dashboard daemon from the UI (no
+// terminal), show its status, and link out to it. The rich dashboard can't be EMBEDDED
+// through our sub-path proxy (its Next.js assets are root-absolute), so "Dashboard ↗"
+// opens it at its own origin in a new tab — which works on a local/host setup.
+var dashPort=__DASH_PORT__;
+function dashOpenUrl(){ return "http://"+location.hostname+":"+dashPort+"/"; }
+async function dashStatus(){
+  try{ var r=await kit.apiFetch("/api/plugins/agent_browser/dashboard"); var d=await r.json();
+    dashPort=d.port||dashPort; renderDash(!!d.running); }catch(_){ renderDash(null); }
+}
+function renderDash(running){
+  var el=$("dash"); if(running===null){ el.innerHTML=""; return; }
+  var open='<a class="pl-btn pl-btn--ghost pl-btn--sm" href="'+dashOpenUrl()+'" target="_blank" rel="noopener" title="Open the full dashboard (viewport + activity/console/network feeds) in a new tab">Dashboard ↗</a>';
+  el.innerHTML = running
+    ? '<span class="dot ok"></span>'+open+'<button class="pl-btn pl-btn--ghost pl-btn--sm" onclick="dashAct(\'stop\')" title="Stop the dashboard daemon">Stop</button>'
+    : '<span class="dot off"></span><button class="pl-btn pl-btn--sm" onclick="dashAct(\'start\')" title="Start the agent-browser dashboard daemon">Start dashboard</button>';
+}
+async function dashAct(action){
+  var el=$("dash"); el.innerHTML='<span class="dot off"></span>…';
+  try{ await kit.apiFetch("/api/plugins/agent_browser/dashboard",{method:"POST",
+    headers:{"Content-Type":"application/json"},body:JSON.stringify({action})}); }catch(_){}
+  setTimeout(dashStatus,800);
+}
+window.dashAct=dashAct;
+
 // Boot ONCE, on whichever fires first: the handshake (the bearer arrives with
 // protoagent:init, so the gated shot/nav calls authenticate) or a short timer
 // for the no-handshake case (standalone page / older host).
 let booted=false;
-function boot(){ if(booted)return; booted=true; refresh(); setInterval(refresh,1200); }
+function boot(){ if(booted)return; booted=true; refresh(); setInterval(refresh,1200); dashStatus(); setInterval(dashStatus,6000); }
 kit.initPluginView(boot);
 setTimeout(boot, 800);
 </script></body></html>"""
diff --git a/protoagent.plugin.yaml b/protoagent.plugin.yaml
index 1955ae7..aa64ff6 100644
--- a/protoagent.plugin.yaml
+++ b/protoagent.plugin.yaml
@@ -1,6 +1,6 @@
 id: agent_browser
 name: Agent Browser
-version: 0.3.0
+version: 0.4.0
 description: >-
   Browser automation for protoAgent, backed by **agent-browser** (vercel-labs) — a
   fast native-Rust CLI/daemon that drives Chrome over CDP with accessibility-tree
@@ -23,8 +23,14 @@ config:
   binary: agent-browser     # the agent-browser CLI on PATH (override for a pinned path)
   dashboard_port: 4848      # agent-browser dashboard start --port; full-mode panel iframes this
   timeout_s: 60             # per-command subprocess timeout
-  panel_mode: full          # Browser panel layout: `full` (iframe the dashboard — viewport +
-                            # feeds) or `minimal` (viewport-only: live screenshot + a nav toolbar)
+  panel_mode: minimal       # Browser panel layout. `minimal` (default): viewport-only — a live
+                            # screenshot + a nav toolbar + a Dashboard control, driven through the
+                            # gated same-origin routes. Works everywhere (host + member), no daemon
+                            # needed. `full`: iframe agent-browser's own dashboard (viewport + feeds)
+                            # — only renders when the dashboard is reachable at its OWN origin from
+                            # your browser (a local/host setup); it can't be embedded through a
+                            # sub-path reverse proxy because its Next.js assets are root-absolute.
+                            # Use the panel's "Open ↗" to view the dashboard directly.
   # Runtime / launch options — a curated set passed to `agent-browser open` so you can
   # shape and lock down the browser the agent spins up. Blank/0/false = CLI default.
   headed: false             # show a real browser window instead of headless
@@ -38,7 +44,7 @@ config:
 
 # Editable in Settings ▸ Plugins (ADR 0019) — the operator knobs above as UI fields.
 settings:
-  - { key: panel_mode, label: "Browser panel mode", type: select, options: [full, minimal], description: "full = iframe agent-browser's live dashboard (viewport + activity/console/network feeds); minimal = viewport-only (a polled screenshot + a nav toolbar)." }
+  - { key: panel_mode, label: "Browser panel mode", type: select, options: [minimal, full], description: "minimal (recommended): a live screenshot + nav toolbar + Dashboard control, via gated same-origin routes — works everywhere. full: iframe agent-browser's dashboard (viewport + feeds) — only renders when the dashboard is reachable at its own origin from your browser (local/host); it can't embed through a sub-path proxy. Use the panel's Open ↗ either way." }
   - { key: headed, label: "Headed browser", type: bool, description: "Show a real browser window instead of running headless." }
   - { key: allowed_domains, label: "Allowed domains", type: string, description: "Comma-separated navigable-domain allowlist (e.g. example.com,*.foo.com). Blank = unrestricted." }
   - { key: confirm_actions, label: "Confirm actions", type: string, description: "Comma-separated action categories that require confirmation before the agent runs them." }
diff --git a/pyproject.toml b/pyproject.toml
index dd1cb6d..d2f5ecc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "agent-browser-plugin"
-version = "0.3.0"
+version = "0.4.0"
 description = "Browser-automation plugin for protoAgent, backed by vercel-labs/agent-browser (tools + skill + workflows + a live browser panel)."
 requires-python = ">=3.11"
 
diff --git a/tests/test_agent_browser.py b/tests/test_agent_browser.py
index 5fb807e..bfd4ecb 100644
--- a/tests/test_agent_browser.py
+++ b/tests/test_agent_browser.py
@@ -177,27 +177,62 @@ def _app(cfg=None):
     return app
 
 
-def test_panel_page_full_mode_is_four_rules_compliant():
+def test_panel_page_full_mode_is_a_launcher():
     from fastapi.testclient import TestClient
 
-    c = TestClient(_app({"panel_mode": "full"}))
+    c = TestClient(_app({"panel_mode": "full", "dashboard_port": 4955}))
     r = c.get("/plugins/agent_browser/panel")
     assert r.status_code == 200
     html = r.text
     assert "/_ds/plugin-kit.css" in html  # DS kit
     assert 'location.pathname.split("/plugins/")[0]' in html  # slug-aware base
-    assert "/plugins/agent_browser/panel/dash/" in html  # same-origin proxied dashboard
-    # never a hardcoded http origin (issue #6) — the iframe src is BASE-derived same-origin.
+    assert "Open dashboard" in html  # a launcher to the dashboard's own origin (not an embed)
+    assert "/api/plugins/agent_browser/dashboard" in html  # the start/stop control
+    assert "panel_mode: minimal" in html  # points users at the mode that embeds inline
+    # full mode no longer embeds a sub-path proxy; the port placeholder is interpolated.
+    assert "/panel/dash" not in html
+    assert "__DASH_PORT__" not in html and "4955" in html
+    # the "open" link is built from location.hostname, never a hardcoded origin.
     assert "http://localhost" not in html and "http://127.0.0.1" not in html
 
 
 def test_panel_page_minimal_mode_uses_gated_data_routes():
     from fastapi.testclient import TestClient
 
-    html = TestClient(_app({"panel_mode": "minimal"})).get("/plugins/agent_browser/panel").text
+    html = TestClient(_app({"panel_mode": "minimal", "dashboard_port": 4933})).get(
+        "/plugins/agent_browser/panel"
+    ).text
     assert "/api/plugins/agent_browser/shot" in html  # gated screenshot
     assert "/api/plugins/agent_browser/nav" in html  # gated nav
     assert "kit.apiFetch" in html  # authed fetch via the kit
+    # the dashboard control (start it from the UI) + the port placeholder is interpolated
+    assert "/api/plugins/agent_browser/dashboard" in html and "Start dashboard" in html
+    assert "__DASH_PORT__" not in html and "4933" in html
+
+
+def test_default_panel_mode_is_minimal():
+    import yaml
+
+    m = yaml.safe_load((ROOT / "protoagent.plugin.yaml").read_text())
+    assert m["config"]["panel_mode"] == "minimal"  # the reliable mode is the default now
+    by_key = {f["key"]: f for f in m["settings"]}
+    assert by_key["panel_mode"]["options"][0] == "minimal"  # recommended first
+
+
+def test_dashboard_control_endpoint(monkeypatch):
+    from fastapi.testclient import TestClient
+
+    c = TestClient(_app({"dashboard_port": 4934}))  # nothing listens → status "stopped"
+    st = c.get("/api/plugins/agent_browser/dashboard").json()
+    assert st["running"] is False and st["port"] == 4934
+    # start/stop run the CLI (mocked); bad action is rejected.
+    rec = []
+    monkeypatch.setattr(bp.subprocess, "run", fake_run(record=rec))
+    assert c.post("/api/plugins/agent_browser/dashboard", json={"action": "x"}).json()["ok"] is False
+    assert c.post("/api/plugins/agent_browser/dashboard", json={"action": "start"}).json()["ok"] is True
+    assert ["agent-browser", "dashboard", "start", "--port", "4934"] in rec
+    assert c.post("/api/plugins/agent_browser/dashboard", json={"action": "stop"}).json()["ok"] is True
+    assert ["agent-browser", "dashboard", "stop"] in rec
 
 
 def test_shot_route_503s_without_a_frame(monkeypatch):
@@ -220,9 +255,3 @@ def test_nav_route_validates(monkeypatch):
     assert c.post("/api/plugins/agent_browser/nav", json={"action": "reload"}).json()["ok"] is True
 
 
-def test_dash_proxy_502s_when_daemon_down():
-    from fastapi.testclient import TestClient
-
-    # nothing listens on the dashboard port in CI → the reverse proxy returns 502, not a crash.
-    r = TestClient(_app({"dashboard_port": 4999})).get("/plugins/agent_browser/panel/dash/")
-    assert r.status_code == 502