Units + polkit rule + systemd_control helper + start endpoints + installed flag + UI wiring all landed. SWARM-host start/stop and crash-quarantine policy stay as named deferrals.