@parity/product-lab 0.0.1-placeholder → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,1000 @@
+# @parity/product-lab
+
+## 0.1.1
+
+### Patch Changes
+
+- 9e75e10: A new optional setting, `PRODUCT_LAB_FORK_BUNDLE`, says what a start of a saved local copy of a network does about a newer published fork bundle. `fresh`, the default, downloads it in the background as before. `keep` keeps the bundle you have: the lab reads only the small release record, downloads nothing and logs one line with your bundle's age and when the published one was updated. `product-lab lab --refresh` works the same under both. Any other value is refused with a warning naming the fix.
+- e9c8cac: The lab's reading of Vite's update socket is now checked against Vite 7.3.7, the release that fixes five security advisories in Vite's dev server. The AI kit's two complete reference labs now install `vite@7.3.7`. Nothing changes in how the lab reads Vite's updates: the update messages and the page's client are the same in 7.3.6 and 7.3.7.
+
+## 0.1.0
+
+### Minor Changes
+
+- 96a6d3c: Added: a scenario tagged `@isolated` gives the environment's state back. The lab saves the running state before the scenario and restores it after, whatever the result, so a saved local fork is left as the scenario found it and the next scenario or run starts there. If a run is killed before the restore, the next isolated scenario restores the saved copy first. Under Cucumber, the hooks registered with `registerLabEnvironmentHooks` save the state before the environment's own scenario setup and restore it after the environment's cleanup. An environment can implement the optional `beforeStateChange` and `afterStateChange` to stop and rebind its own background work. The lab's product integration example tags some of its journeys `@isolated`: they can run again on the same saved fork (backlog 17h).
+- 7172fd9: One lab config keeps or starts clean: "Keep chain and people between starts" is a switch in the lab window's environment
+  menu and the terminal app's Chains screen (`k`), on by default in the interactive lab (`product-lab`, `product-lab dev`) and off for `product-lab test`, CI and MCP.
+  `product-lab --keep` or `--clean` chooses for one start, `product-lab test --keep` for a test run, and MCP's `env_start`
+  takes `keep`. Each environment says what it keeps of its chains (`EnvironmentProvider.keeps`) and a lab says what it
+  keeps of its people (`defineLab({ keepBetweenStarts: { people } })`, or `peopleNot` with the reason); the switch shows
+  both, greyed with why when a part keeps nothing. Fixture and what-if commands always keep. Notes needs no second config:
+  `lab.workspace.config.ts` and `bun run lab:workspace` are gone.
+- 9c8b05c: An environment can offer more than one way to run, for example "Full" and "Light (fewer nodes, for smaller laptops)" (`environmentOptions`). A start without an option runs the person's last choice, else the first option this machine meets, and says why. A start that names one (`product-lab --option light`, MCP `env_start` `option`, or a row under the environment in the lab window's picker) runs it and remembers it in `.product-lab/state/environment-options.json`. An option the machine is too small for is greyed with what it needs, and can still be chosen. The registry, the snapshot and `lab_describe` list every option with what it needs, the one the next start picks and why, and the one running. `defineLab({ environmentAliases })` keeps an old environment id starting what it became, with a notice. `createLabRuntime({ stateDir })` gives a test run its own remembered choices. In the Notes example, `paseo-fork` and `previewnet-fork` are Full or Light, and `paseo-fork-light` is now `paseo-fork` with `light`.
+- 3bd850c: Added: the truAPI WASM host can serve from another official `@parity/truapi-host` release than the one the lab installs. `installHostPackage({ version, cacheDir, commands })` installs that release with npm into the lab's cache (`hosts/truapi-wasm/<version>/`, with npm's own download cache beside it) and returns its package directory. Pass that directory as the host's `hostPackage`: its version, WASM core and test server are then the ones used, and the entropy patch still applies to its host page. The install records the registry's integrity for the release, and npm's lock must carry the same one. Every later use hashes the cached files again and refuses a copy that changed since the install. Nothing is published, and no install script runs. The host still refuses a release whose truAPI differs from the `@parity/truapi` the apps use, which is the one in the lab's install (backlog 27).
+- dec1ef7: Added: npm packages as a version source. A lab declares `versions.npm: { "<component>": { package: "<name>" } }`. A suite row's `latest-release` (the package's `latest` dist-tag) or a plain version then resolves from the npm registry, with the tarball's registry integrity recorded as a `sha512` digest. Lock entries can now have an `npm` source. The WASM test host uses it for `host:truapi-wasm`. Before a row runs, the host installs the resolved `@parity/truapi-host` into the lab's cache and checks its tarball against that integrity. The row is served from that package when the release speaks the same truAPI release as the apps' `@parity/truapi`. Otherwise the row is reported unsupported, with the reason (backlog 27).
+- 20673fb: Changed: relay-less chains build and finalize a block every 500 ms by default (was 1000 ms), so scenarios on them wait less for finality. A transaction signed for the usual 64 blocks now stays valid for 32 seconds on them. Set the topology's `blockTime` (one number, or per chain) to choose another block time.
+- 5c54a39: Added: `product-lab test --workers <n> <feature…>` runs the given feature files on several workers at once. A lab declares `workers: { max, env({ index, count }) }` in `defineLab`: the environment variables (its own names for port blocks, state and caches) that keep each worker apart. The run passes only when every worker passes and no two workers' environments reached the same address; `product-lab-workers.json` records each worker and how long they ran at the same time.
+- 7cf08e9: Added: prepared characters. A fixture whose setup makes an identity one of the lab's characters, and does nothing else with it (`Given Wren is a writer with a published note`), saves it as prepared. A scenario that starts from that fixture (`@fixture:<name>`) and says `Given Bob is a writer with a published note` is bound to that identity instead of running the character's steps: Bob has its account and data (its username, where it has one), and every check reads them. Each identity serves one actor per restore; when none is left, when the scenario names the identity itself, or in a later scenario of a `@fixture-shared` group, the character's steps run, and the step's trace (`character`) says why. The fixture key now records the characters its setups use, so changing one makes the fixture stale, and the reason names the character and both lists of steps. `fixture list` and the save and restore reports list the prepared identities.
+- 8dc7d0a: Added: `{actor} is a new actor with no funds`, a framework sentence for someone with nothing to pay with. The lab creates the identity without funding it. It then reads the account's free balance on every chain the session connects, at the finalized head, and the step fails unless each one is 0, naming the chain and the amount. The check is on chain, so the sentence means "no balance" whatever way the app pays. The default session supports it: `LabEnvironment.createActor({ funds: "none" })` and the new `LabEnvironment.fundsOf(actorId)`. A session without `fundsOf` refuses the scenario before it runs. Give it your own name as a character, for example `characters: { "a person with no funds": { steps: ["{actor} is a new actor with no funds"] } }`.
+- f2ef8fc: Added: `product-lab bisect <previous> <current>` finds where a regression came in. It takes two suite runs, as `report compare` does: the scenario passed in the first and fails in the second. The component that changed between them is the range: the lab's own commits, or the published releases of a runtime or host between the two versions (from GitHub releases or npm). Each probe runs that one scenario as its row ran it, twice, with every other version pinned. The two ends run again first: when they no longer pass and fail, the summary says the regression did not reproduce and nothing is halved. Runs that disagree stop the bisect as flaky. A recovery, an infrastructure failure, a change with no recorded cause, or a change only the combination of components carries is refused, with the reason. A probe of the lab's commits runs from a worktree under the lab's cache, installed frozen from that commit's lockfile, and every worktree is removed at the end. Nothing starts with less than 15 GB of free disk. `--dry-run` lists the values and the most probes it would take. The report (`product-lab-bisect.json`) and `summary.md` go to `--out` (backlog 37).
+- 650cb20: Changed: the transaction pool and block readers now read version 5 general transactions. One authorized by the standard `VerifyMultiSignature` extension names its account, as a signed version 4 transaction does, so the reading is complete. One its own call authorized (FRAME's `AuthorizeCall`, no optional authorization filled) is no account's transaction and no longer makes a pool reading incomplete. A filled optional authorization the lab does not read is named in the gap. Before, every general transaction made a reading incomplete, so a check that needs a complete pool could refuse while any of them was pending.
+- 7aeac18: Added: the lab's own readers for sponsored writes. `StatementStoreReader` (`@product-lab/ports/chain`) returns the statements a node holds for some topics, each decoded with its proof checked. Chain-papi's `RpcStatementStoreReader` implements it over `statement_subscribeStatement` and verifies Sr25519 signatures. `BulletinReader` returns the bytes stored under a content id, every block checked against its CID; deploy-bulletin's `BulletinContentReader.bytes` implements it. The Statement Store codec (`decodeStatement`, `encodeSignedStatement`, `statementSignatureMaterial`, `statementExpiry`) now lives in `@product-lab/domain`; env-relayless and deploy-bulletin keep their old names as re-exports.
+- 9de21ec: Added `product-lab init`: run it in your app's repository to set the lab up for that app in one step. It reads your package.json and writes:
+  
+  - `lab.config.ts`, which runs your app's own dev script, unchanged, on its usual port (Vite 5173, Next 3000, or `--port`);
+  - `lab/integration.ts`, with one action and one assertion to wire to your app's test ids (marked TODO);
+  - a first feature in which a new actor opens your app and sees it;
+  - the pinned `lab.lock.json`;
+  - `.env.example` and `.gitignore` entries, and the `lab` and `lab:test` scripts.
+  
+  Your app is not changed. `init` never overwrites a file without `--force`: it lists what exists and writes nothing. `--ai` also installs the AI kit. Options: `--dir`, `--dev-server "<command>"`, `--port`.
+- 362c95e: Added: `apps.<id>.deployed`, the deployed app instead of a dev server. Declare a DotNS `name` (`example.paseo`) or the web gateway's `url` of it (`https://example.paseo.li`), and optionally a `cid` pin. At the start the name is resolved on the environment's Asset Hub, the content read from its Bulletin with every block checked against its CID, and served on loopback behind the lab's proxy; the product id is the name. When Bulletin does not give the content it is read from the network's IPFS gateway, on by default only on a public network (`ipfsGateway` turns it on or off, or names an `https` gateway); which source answered is always recorded. A name that resolves to another CID than the pin, an environment without Asset Hub or Bulletin, a name of another network, and `deployed` beside `devServer` or `watch` are refused by name before anything starts. The gateway program takes `--ipfs-gateway`, and `RetrievedContent` and the gateway report carry `source`.
+- c464504: product-lab is licensed under the Apache License 2.0. The package's `license` is `Apache-2.0` and it ships the licence text as `LICENSE`; its source files carry a Parity copyright line and an Apache-2.0 SPDX licence line as their header (they said GPL-3.0-or-later before). The example files the AI kit's Notes reference gives you carry the same header.
+  
+  `bulletin-deploy` (GPL-3.0-or-later) is no longer installed with product-lab. It is an optional peer dependency now, needed only to deploy to Bulletin (`BulletinDeployer`, `DotnsRegistrar`, the Notes `deployed-local` launch). If you deploy, add it yourself: `npm install --save-dev bulletin-deploy@0.21.0`. Without it, a deploy fails with `BulletinDeployMissingError`, which names the package and that command. Everything else works without it. `@acala-network/chopsticks` is now declared as an optional peer too (1.5.2), so npm warns when you install a version the Chopsticks adapter would refuse.
+- 974bc23: An agent beside the lab window drives that window's lab. `product-lab mcp` attaches to the lab's open window (its record now carries a token new at every start, file mode 600), so a run an agent starts shows live in the window, and `run_report`, `explain_failure` and `step_evidence` read it; `--own-lab` keeps a lab of its own. `run_scenario` and `run_action` take `where: "lab"` (the default while a window is open) or `"headless"` (a lab of its own beside the window, on the lab's second worker block with a clean chain). New tools `lab_open` (asks first, starts the window, waits until it answers) and `lab_close` (stops only a window `lab_open` started), 33 tools. `lab_describe` and `env_status` say whether a window is open and whether the server drives it. `product-lab dev --own-lab [--record <dir>]` starts a lab that keeps no record (or keeps it elsewhere).
+- 6763eec: A recording keeps what each step changed on the chains: the events of every block produced while the step ran, read once per block, and the acting identity's balance and nonce before and after; anything that could not be read is named.
+- f7e8c31: A live chain console: the lab window's environment view has a "Chain console" that, while open, shows the running environment's blocks and the events that mention your scenario's identities (or every event), newest first, marking blocks that are final and best blocks that were replaced. The MCP server's new `chain_console` tool reads the same (31 tools).
+- ad623f9: New: reusable characters. You declare a kind of person once in `lab.config.ts`, by the sentences that make one: `characters: { "a writer with a published note": { steps: ["{actor} is a new actor", '{actor} publishes the note "Hello"'] } }`. Any scenario can then use it as `Given Grace is a writer with a published note`. The trace names the character as the origin of its calls. `product-lab lint` checks each character in every environment, and `product-lab coverage` and MCP `lab_describe` list them.
+- 281fa96: On a live network a product can run people on the truAPI CLI host: the lab downloads and verifies the official release, never a patched build. Local environments still use the truAPI WASM test host until host-rust-core#1166 ships.
+- 4313931: The truAPI CLI host in a product now follows what its locked official release provides. Once a release takes the lab's local endpoints (host-rust-core#1166), your people can run on it on a local environment as well as on a live network; until then a local environment on it is refused with the missing behaviour and the upstream change named. `product-lab doctor` reports the CLI host's locked release, whether it is cached and what it provides, and `product-lab init` makes it the default host when its release takes local endpoints, otherwise the truAPI WASM test host as before. With today's locked release (0.24.0) nothing changes for you.
+- d9aefbb: New scenario sentences for per-actor conditions: `Ada's network is "slow-3g"` (or `fast-3g`, `slow-wifi`, or a lab's
+  own profile from `defineLab({ conditions })`), `Ada goes offline`, `Ada comes back online` and `Ada's device is 4 times
+  slower`. Hosts do not apply them yet, so a scenario that uses them is refused before it runs, with the reason.
+- abe6bde: A recording keeps what each identity's app printed while each step ran: console errors, warnings and uncaught script errors, with the errors no `apps.<id>.consoleAllowed` entry matches flagged as unexpected, and every app whose console could not be watched named. `product-lab recordings <id>` shows the counts per step and the messages under `--step`.
+- 1a0c514: `product-lab coverage` lists which of the lab's sentences its feature scenarios use and which none does, read from the same plan `product-lab lint` checks; it starts nothing.
+- 0989bb9: A lab can choose its own RPC per chain for an environment that takes one: in lab.config (`defineLab({ rpc: { <environment>: { chains: { people: "wss://…" }, reason } } })`), in the lab window (each environment's card has a field per chain, remembered for its next starts and clearable), for one start with `product-lab dev --rpc people=wss://… --rpc-reason "…"`, or over MCP with `env_start`'s `rpc` and `rpcReason`. A URL with a token is accepted only through a secret (`fromEnv`), and never shown or written: views, logs, the run manifest and errors show scheme://host. A remote endpoint needs a reason, and over MCP `--allow-public`. The RPC each chain used is recorded with where it came from.
+- 095b3c4: `product-lab demo [<recording>]` turns a feature scenario's recorded video into a short demo: each Gherkin step's action and result at real speed, waiting sped up and labelled (`×8 waiting for finality` when the step waited on the chain), a caption per step, a WebVTT file, an edit manifest and a summary slide in the lab's style. It uses the system's `ffmpeg` (never bundled); without it the video is refused with how to install it, while `--plan` and `--slide-only` still work.
+- 8d9d80e: The `deployed-local` launch works without a session of your own: for an app with a Vite dev server, the lab builds it, deploys it to the environment's Bulletin and DotNS under a fresh name, and serves the deployed bytes to every host. Another dev server is refused by name before anything starts.
+- 65eb4b3: Added: an identity can run in a window of its own emulating a device (`product-lab dev --detach "Ada=Pixel 7"`, or "Open in own window" beside its tile's Device menu), mirrored live in its tile (Chromium only); its steps run there with the same checks and nothing injected into the app. An app that refuses framing can be opened in its own window from its tile. `AppSurface` gains the optional `conditions` and `device`.
+- 4ea48ed: Added: the lab window knows Playwright's named devices ("Pixel 7", "iPad Mini", …) as device profiles, phones first, for device-sized and detached identity windows.
+- 50a5f61: Added: `DeviceProfile` (`@product-lab/domain/devices`), the device an identity's app is shown as (viewport, pixel ratio, mobile, touch, user agent), with `resolveDevice`: an unknown device name is refused with the nearest names.
+- 5ea24d9: The lab window can show an identity's app at a device's size: an app declares `device: "Pixel 7"` (or a whole device profile) in `defineLab({ apps })`, and each tile has a device menu. The app sees that device's CSS viewport, scaled to fit the tile; pixel ratio, touch and the user agent are not emulated in a tile.
+- 9d3ccdc: Engine forks run previewnet-engine v0.7.0, which adds a TURN/STUN relay (eturnal) beside the identity backend. Each lab port block now names the relay's ports, so two forks never share them. eturnal has no macOS build: `bun run setup` installs it with Homebrew when you can write the Homebrew prefix. Without it, a fork runs with the relay off and says so once (peers on your machine still connect directly), and `product-lab doctor` shows the install command as a note. A second relay on one machine is refused with a clear message, because eturnal allows one per machine. Run `bun run setup` once to prepare the new Engine. A saved fork keeps resuming on the Engine it was created with; a new or refreshed fork uses v0.7.0.
+- e55db2d: Engine forks run previewnet-engine v0.8.0 (it was v0.7.0). A bite made with v0.8.0 resets the relay's HRMP and DMP message queues on every network, so a fork bitten while messages were in flight between the chains no longer stops producing blocks with `HRMP head mismatch` or `DMQ head mismatch`. This applies to the bites your own Engine makes (a fork of the deployed network, `--fresh-bite`); Engine's published bundles are bitten by Engine's own nightly job. v0.8.0 also adds `ppn version`. Run `bun run setup` once to prepare the new Engine. A saved fork keeps resuming on the Engine it was created with; a new or refreshed fork uses v0.8.0.
+- 3047a07: The lab window's Environment section now says whether each service answers. A service is an endpoint your environment publishes that is not a chain, such as an identity backend's HTTP API. The lab probes each one from its own process every few seconds (one bounded `HEAD`, the same way it reads the chains' heads), so a row is green with the HTTP status when the service answers and red with the reason when it does not ("connection refused", "no answer within 2000 ms"). An endpoint that is not HTTP says "not checked" in words. Before, every service showed the same grey dot whether it ran or not.
+  
+  The environment picker ("Your environments") no longer repeats the chains' heads as one long line; the Environment section shows each chain's heads in its table. The bottom bar's environment pill shows the environment's whole name: the run's line and the pill's detail give way first, and the name shortens only when the bar has no room left (its tooltip still names it whole).
+  
+  For a lab that composes its own system ports: `SystemPorts.http` (the new `HttpProbe` port, optional) is what the probe goes through; without it, services show as not checked.
+- bac2d4a: Every step that changes something now shows two checks in the lab window: what the lab read back on the chain (where,
+  and at which block) and what the person's screen showed. Notes' publish, for example, reads "Verified on Ada's screen and
+  on the chain", with Bulletin at its finalized block, the Statement Store, and the author's allowance on People. Each
+  step line carries a short "screen ✓ · chain ✓ Bulletin #481" summary. A step that changes nothing says so, instead of
+  "no chain check". The lab's own transactions in a step (an XCM stand-in, funding, a root call) are shown apart,
+  "Submitted by the lab (not a check)", and never count as its chain check. A new identity's step ("Ada is a new actor") shows its app ready and its place in People's ring.
+  
+  An action reports its read-back through `reading` (as assertions do) and its writes through `write`. An action whose
+  change no screen can show declares why (`screenCheck: { none: "the app shows no balance" }`); an empty or vague reason
+  is refused. An environment can describe new identities with `actorReadings`.
+  
+  The Transactions view lists every write a run caused: the lab's transactions, those the app sent, those the people's
+  hosts and the lab's services sent (from the finalized blocks), and Statement Store statements and stored content
+  ("a statement, not a transaction"). "Nothing was written" appears only when nothing was.
+- c646b52: Added: a secret may be a `0x` 64-byte expanded sr25519 secret (the key and its nonce, as some chains' sudo keys are kept); it signs as it is and takes no derivation path. A `0x` secret of any other length than 32 or 64 bytes is refused by its length.
+- caf646c: Added: `product-lab explore`, model-based exploration. An integration declares `invariants` (its own assertion sentences over `{actor}` only); the command runs seeded random scenarios of the lab's actions on a local environment, checks every invariant for every actor after each step, shrinks the first failure to the smallest scenario that fails the same way, writes it as Gherkin to the run directory (`--save <dir>` copies it) and confirms it three times, reporting a flaky one as flaky. An action declares `explore: false` to be left out.
+- 06e5d4b: `product-lab fixture check` gives each fixture a cache key (`--json`: `cacheKey`), the sha256 of its setup, lab.lock.json, declared inputs and any fixture it is built on, so a CI cache can keep a fixture's bundle and rebuild it only when one of them changes.
+- 53e5a22: A fixture can be built on another: declare `from: "<fixture>"` in `defineLab({ fixtures })` and its setup runs on that fixture's saved state, with its identities. Restoring it restores it alone, and a change to the fixture below makes it stale.
+- 3c989b3: Flake detection: `product-lab test --rerun-failures <n>` reruns each failed scenario up to n times from the state it
+  started on and reports it flaky (a rerun passed) or failing; `product-lab reproduce <bundle> --reruns <n>` does the same
+  for one bundle. Every run is kept in one bundle per scenario, and a flaky result still fails the command.
+- def0fa6: Changed: a resumed Engine fork is ready once the chains your apps require (`requires.chains`, theirs and their integrations') finalize; the fork's other chains only need to answer. The start's readiness line says which chains were waited on and which only answered. Environments receive the list as `EnvironmentStartContext.requiredChains`.
+- 900c796: Changed: a published first-boot seed (engine.json `seed`) is now used on another port block of the same layout: its node launchers are written again for your block. A seed laid out differently is still skipped, with the reason.
+- 04cada6: Changed: the default session creates the identities a scenario names together at the same time (up to 4) and funds them in one `Utility.batch_all` per chain that waits for finality once; a chain without it funds each alone, a batch the chain reverts is sent again identity by identity so the one that fails is named, and identities stay listed in the order their creation started. Added: `FundingBatch` and `fundingProblems` in `@product-lab/core/chain` for a lab's own sessions, and `HostCapabilities.concurrentSessions` (a host that cannot open sessions at the same time declares `false`; truapi-wasm and dot.li do).
+- 0b8fa83: Host chips now show each host in its own colour: CLI blue (`#2f6fec`), WASM violet (`#7a5af8`) and dot.li teal (`#0e7490`). This covers a person's tile pill, their Identities row and New identity's host menu, in both themes and in the lab's own window. A host with no colour is slate. Variants of one adapter share its colour. A lab can give one host its own with `hosts: { <id>: { kind, options, color: "#rrggbb" } }`.
+  
+  Breaking for a lab's own host adapter: `HostAdapterFactory` now requires `color`, a `#rrggbb` value. A factory without one is refused with "needs a color". Add `color` to a factory you pass in `defineLab({ hostFactories })`, and give its `HostProvider` the same `color` so its people's chips use it.
+- e3ea719: Condition sentences now run on the truAPI CLI host (its own connections through per-identity links, its page through routes) and on the WASM test host in its `main-thread` topology. The host contract checks that offline keeps the app's link to its host and cuts everything else; a host without `conditions` is reported unsupported.
+- ee04d02: A failed run keeps its hosts' logs. Before the run's identities close, its recording keeps each host's own log (the host's output, at whatever level it ran), redacted, as `hosts/<person>-<host>.log` beside the recording. Before, the logs went with the session, so a failure inside the host (a lost chain block) left no trace even with `PRODUCT_LAB_HOST_RUST_LOG` set.
+  
+  - `product-lab test`'s last line names the kept files ("Look at: … the host's log: …/hosts/Ada-truapi-cli.log"), and so does the lab window's replay of the run.
+  - Each log keeps its last 2 MB (`PRODUCT_LAB_RECORDINGS_HOST_LOG_KB`); a passed run keeps none unless `PRODUCT_LAB_RECORDINGS_HOST_LOGS=always` (`off` keeps none).
+  - A host adapter says where its logs are (`HostSession.logs()`); the lab only copies them. The desktop host (`truapi-cli`) names its host process's log; the in-browser host logs into the page, which the recording's console already keeps.
+- 0348723: Host options come from the host adapters. A host adapter declares the switches it offers on its hosts (`hostOptions` on its factory: a name, a plain label, why to turn it on, on/off or a choice, a default, and whether a person may set it for one identity). The lab shows them and applies them; it names none itself:
+  
+  - New identity's host menu shows each host's options under it at the lab's values, and creates the identity with what you set; the identity's row names the options on ("Desktop host · network locked").
+  - A scenario names them by label: `Ada is a new actor on the "desktop" host with "network locked"` (several joined by "and"; the host by its id or its plain name).
+  - MCP's `identities_create` takes `host` and `hostOptions`; `identities_list` lists every host's options.
+  - A lab sets a host's values in `hosts.<id>.options` and can keep old names of a host with some options on as `hosts.<id>.aliases`, so scenarios and saved identities that named them keep working.
+  - An option the host's adapter does not declare, one the lab config sets for the host only, or a value it cannot take is refused by name before anything starts.
+  
+  The truAPI CLI host declares "network locked" (`networkLocked`) and "one wallet for all apps of a person" (`oneWalletForAllApps`); the in-browser host declares "network locked". The Notes example now has two hosts, Desktop and In-browser; `truapi-cli-deny` and `truapi-cli-shared` are aliases of the Desktop host with an option on.
+  
+  Fixed: Escape in New identity's host menu, or an identity's menu, closes that menu only. Before, it also closed the lab.
+- e862cf9: `product-lab host verify` checks that an app cannot act as another product: it cannot learn the actor's account in another product, sign with it, or read what another product stored.
+- 6a57dde: `product-lab host verify` checks that an app cannot bypass its host to reach the chain node the host uses: the app's own WebSocket and HTTP requests to the node must be refused and reported, while its chain reads through the host still work. A verification target supplies the chains in its fixture (`chains`); without them the check is reported unsupported. The cross-product account check now runs where the user refuses (a `deny-all` session): a host may give another product's account once the user approves it, so an approve-all answer is recorded as consent. Under `denyByDefault`, the truAPI CLI host's browser context no longer lets the app open the chain or service routes itself; the app reaches its chains through the host.
+- 2814448: New: `product-lab journeys` writes a user walkthrough for each feature scenario tagged `@journey`. Each one is a Markdown page with a screenshot for every step, taken from the identity that acted, plus an index. It is built from the scenario's newest passed recording, and its captions state only what that recording proves: "finalized" only when the chain said final, otherwise "included, not yet final". Any gap in a step's evidence is named. A failed run never replaces a page. Declare `journeys: { out?, tags? }` in `lab.config.ts` and `product-lab test` rewrites the walkthroughs after each run. They go to `.product-lab/journeys` by default.
+- 615afe2: A chain kept between starts (the interactive lab) now runs in real time unless lab.config.ts sets a pace, so it no longer goes stale after a few hours; clean starts (product-lab test, CI) stay fast. Set pace: "fast" to keep a kept chain fast.
+- 9840e59: Read-only environments for live public networks (`liveNetworkEnvironment`): heads and finality followed over the public endpoints, live runtimes compared with a reference, every write refused; public host routes connect only under their recorded `publicRoutes` reason.
+- 8341b23: Added: new identities on a writable public network. `liveNetworkEnvironment({ access: "read-write", newIdentities: { funder, usernamePrefix, fund, maxPerRun } })` lets a scenario's `{actor} is a new actor` onboard a fresh identity through the network's own identity backend (the truAPI CLI with its network preset) and fund it from the `funder` secret's account, after checking the host, the network's genesis, the per-session cap and the funder's balance; each identity made is recorded. `truapiCliProvisioner({ network: { preset } })` onboards on a public network without the local routing.
+- 7e9ac3f: Labs can declare pre-onboarded actors by secret name (`defineLab({ actors: { Ada: preOnboarded("ada-wallet") } })`), and an environment on a public network declares itself with `offer.public` (a reason; optionally the network, read-only or read-write access, and a finality timeout).
+- c9cd3aa: `product-lab load` runs many new identities at once on the environment and measures them from the load's recording: finalized transactions per second, submission to inclusion and to finality (p50, p95, max), failures grouped by error, peak concurrency, chain lag and machine load. `--ramp 2,4,8,16` runs several loads in turn. A machine guard stops a load starting steps when the machine is overloaded and says so.
+- f12d029: A recording keeps machine and chain health on its timeline: the machine's load and free memory and each chain's heads every 2 seconds. `product-lab recordings <id>` names, per step, an overloaded machine, low memory, a chain that produced no block for 12 seconds and finality more than 10 blocks behind, with the numbers under `--step`.
+- 837a125: The package now ships compiled JavaScript (ES modules) with `.d.ts` type declarations instead of TypeScript sources,
+  and no source maps. Every export resolves to a declaration for TypeScript and a module for Node, so plain `node`
+  imports the package without tsx and TypeScript projects type-check against it with any module resolution, including
+  NodeNext. The `product-lab` command and your lab's own TypeScript files work as before. The lab window now loads its
+  modules from the installed package (its browser imports were left unresolved before). The `test-support` subpath
+  is gone: it held test doubles for this repository's own tests and was never meant for your code.
+- 53672f8: The lab window's replay of a feature scenario has "Download bundle" (the run as one `.plbundle` file) and "Reproduce"
+  (rebuild the run here and see whether it fails the same way; it asks before replacing the running environment's state
+  and refuses, with every reason, what `product-lab reproduce` refuses).
+- 2d815b0: A replay now shows on the stage: a tile per identity with its recorded frame before or after the selected step, a banner over the tiles naming the step (with a before/after switch and Back to live), and a step scrubber under them with the saved-screenshot controls. The lab panel keeps its normal width and lists the recorded steps with who acted. The live app stays mounted and untouched underneath.
+- 3b325f0: The chain adapter now runs on polkadot-api 3.2.1, which ships the fix for a client that never initializes after a runtime upgrade: a lab no longer needs a patched polkadot-api client to follow a chain whose runtime it upgraded. Your app and the product SDK keep their own polkadot-api 2.x; nothing of polkadot-api crosses between an app and the lab.
+  
+  What changes for a lab:
+  
+  - `toPolkadotSigner` is replaced by `toTxCreator` (from `@parity/product-lab/chain-papi`), which turns a `KeySigner`, a polkadot-api 3.x signer or a polkadot-api 2.x signer into polkadot-api 3.x's `TxCreator`. Give `PapiTransactionSubmitter` a `KeySigner` (`{ scheme, publicKey, sign }`) rather than a `getPolkadotSigner(...)` result.
+  - Calls you build from a `PapiChainAccess` API are polkadot-api 3.x transactions: `createSubmitAndWatch`, `createAndSubmit` and `create` take a signer from `toTxCreator`; `getEstimatedFees` takes a signer too (polkadot-api's `getFakeTxCreator(address)` for an estimate). `trackTransaction` reads 3.x events (`inBestBlock`, `notInBestBlock`, `created`).
+  - A typed API needs descriptors generated by the polkadot-api 3.x CLI; descriptors your app generated with 2.x have the same values but 2.x types.
+  - New: `withSignedExtensions(creator, publicKey, seen)`, to read the nonce, era and genesis a transaction is signed with.
+- 8b19ee4: A local copy of Paseo for any app in one line of lab.config.ts: `environments: { ...paseoCopy() }` from `@product-lab/composition` gives "Local copy of Paseo", Full or Light, saved on this machine and resumed on every start (`previewnetCopy()` for Previewnet). Options: `id`, `label`, `portBase` (else `PRODUCT_LAB_FORK_PORT_BASE`, else 42000-42999). The window's greyed "Local copy of a live network" row names this line.
+- e9abc79: The permission audit: `{actor}'s app asked its host at most:` (columns `request` and `times`, in the host's wording, for example `sign transaction`) fails when the actor's apps asked their hosts for a request more often than allowed, or for one the table does not name, and refuses to run where the host keeps no record. A recording keeps what each step's app asked its host, and `product-lab recordings <id>` shows it per step.
+- 866831b: Pre-onboarded actors open with the wallet in their secret: a scenario that names one binds that existing account (never created, funded or deleted), `identities_create` takes `preOnboarded`, and the lab window lists them and shows a banner on a public network. On a public network the default session creates and funds no identity.
+- ddd3d53: The truAPI CLI host runs on a public network with its own endpoints when every route is public, and an environment that mixes endpoints on this machine with public ones is refused before any host or session starts, naming both.
+- 9d652cc: An environment declared read-only public (`offer.public` without `access: "read-write"`) starts with its chains only: no identity is opened, feature runs on it are refused before they start, and it is never reset.
+- d448660: On a public network the lab sizes chain waits and UI-against-chain checks for its finality and says so, refuses work that needs the development authority naming the network, and `withholdCapabilities` rehearses such a target on a local environment.
+- 2bcc5f8: Race hunting: `product-lab test --race <runs>` runs the selection once per seed, waiting before each step an identity takes after another's (and in run-together groups), so actors interleave differently; one actor's steps never change order. Failing seeds are printed; `--race-seed` replays one, recordings keep the seeds and waits, and `product-lab reproduce` applies them again.
+- 6f297d5: Run recordings can include a video of each identity's page. Turn it on with `product-lab test --video` (or `PRODUCT_LAB_RECORDINGS_VIDEO=on`). Each scenario's recording then lists the videos of the pages its steps acted in, with the time each page opened, so you can find any step in them. Videos are kept in the recordings directory's `videos/`, are removed with the last recording that uses them, and are not redacted. The new `product-lab report comment <run>` writes a suite run's pull request comment: the verdict, then each scenario's result, its time and where it starts in each video.
+- 194e336: Channels, a minimum version, and release checks after publishing.
+  
+  - **Channels.** `latest` holds releases and `next` holds prereleases only. Every green `main` is published under the moving `canary` tag, and manual cuts go under the moving `dev` tag; dated tags are no longer created. An installed version follows its channel's tag in the daily check and in `npx product-lab upgrade` (`--to canary` and `--to dev` work).
+  - **Minimum version.** A release can set `productLab.minimumVersion` in its `package.json`. The daily check reads it from `latest`. Below that floor, every command except `upgrade` and `ai` refuses to run and names `npx product-lab upgrade`. Setting `PRODUCT_LAB_ALLOW_BELOW_MINIMUM=1` runs the old version anyway. The floor never applies in CI.
+  - **After a release.** `release.yml` runs `npx @parity/product-lab@<version> --help` against what npm serves. It keeps one `release-failure` issue, which closes itself on the next success. It announces each version once in Matrix, but only after a person adds `MATRIX_TOKEN` and `MATRIX_ROOM`.
+  - **Docs.** The release README documents the RC-first procedure for breaking releases.
+- 3a53efc: The lab onboards new people on the local dev chain (`fast`) from released packages, so an app that writes through Bulletin or the Statement Store now runs in a product. Each new person's People member key comes from `@parity/truapi-host`'s `ringVrfMember`, derived as truAPI 0.23 hosts do: under the label the released truAPI host derives under (the default of `environments.fast.personProduct`), with the suffix of the network the environment copies (`<label>.paseo` on Paseo next-v2, `<label>.testnet` on Previewnet). Their ring is read on People; the truAPI CLI host is no longer involved. The new option `environments.fast.onboarding` selects this: `"released"` is the default everywhere, and `npx --no-install product-lab config` shows it with its reason and the line that changes it. `"truapi-cli"` keeps the truAPI CLI host's `alloc-check`. In a product it is refused by name (host-rust-core#1166), never silently replaced: `product-lab check` lists `fast` as unable to start because of it, and a start refuses at the first new person. A step's People check now names the reader that ran.
+- cd6ca43: New people get 24-word phrases (32 bytes of entropy) instead of 12-word ones. The released truAPI WASM test host page accepts only 32-byte entropy, and a product is now served that page byte for byte: the lab no longer rewrites its entropy check outside product-lab's own checkout. On the WASM test host, a person made from a shorter phrase (an old saved person, a fixture, or a 12-word live phrase) is refused by name. The refusal names the upstream change it waits for. Saved people, fixtures and live phrases keep their own entropy.
+- 12793b8: A scenario that makes root calls can run from the lab window. Run asks first, in the window: what a root call does (the
+  chain's Root origin, through its own Sudo pallet), which calls the lab allows, that the environment is a local copy with
+  a development sudo key, and that a mainnet, a public network or a chain the lab did not start is still refused.
+  Allowed, this session's root calls are confirmed (until a reset, switch or stop) and the scenario runs; refused, nothing
+  runs. The lab's snapshot says whether this session's root calls are confirmed (`rootCalls: { allowed, confirmed }`).
+- 756d7c8: Added: root calls. `defineLab({ rootCalls: { <environment>: { key, allow, signing? } } })` lets an action dispatch an allowed call with the chain's Root origin through its own Sudo pallet (`ActionContext.rootCall(chain, call, { reason })`). It is refused before anything is signed on a mainnet (always), on a chain the lab neither started nor knows as a public testnet, on a public testnet the environment declares read-only (the default), for a call that carries other calls or is off the allow-list, with a key that is not the chain's `Sudo.Key`, and until the run is confirmed: `product-lab test --root-calls`, MCP `root_calls_allow` or `LabRuntime.allowRootCalls`; a reset revokes the confirmation. The inner call's result is checked, and every root call is journalled under `.product-lab/root-calls/`.
+- a2a021a: `product-lab bundle <recording>` writes a recorded feature scenario as one run bundle (`.plbundle`): its recording, the feature file as it ran, the lab lock, the run manifest and the fixture it started from; `product-lab bundle open <file>` shows a bundle read-only and says whether it could be reproduced here, naming every reason it could not. An identity whose key comes from a lab secret is never bundled.
+- 3aff0f9: The run bundle format: one `.plbundle` file (a zstd-compressed tar, its index `bundle.json` first) holding a run's recordings, the scenario as it ran, the versions and the state it started on, with every file's sha256; and the rule that decides whether it can be reproduced here, naming every reason it cannot.
+- 9021ea0: `product-lab reproduce <bundle.plbundle>` rebuilds a bundled failing run (the fixture it started from, or a fresh
+  environment), runs the same scenario and says whether it fails the same way: at the same step with the same error,
+  block numbers, hashes and ids aside. A bundle from another platform with native state, other app or lab source, a
+  changed feature file, a public network or unsaved state is refused with every reason before anything starts;
+  `--against-current` reruns it as a recheck against your code. A bundle holding both runs is written next to it.
+- 6cccfef: `product-lab test --devices "Pixel 7,Desktop"` runs the selected scenarios once per device profile (or on the lab's `devices`), each identity's app emulating that device's viewport, pixel ratio, touch and user agent, with each device's own visual baselines beside the feature (`__baselines__/<feature>/<scenario>/<device>/`). An unknown device name is refused before anything runs, naming the nearest devices.
+- 01d59e6: On a read-write public network each literal string a feature step writes carries the run's token, so data from different runs never collides; checks in the same scenario read the scoped value back.
+- bf8c488: Scenarios can say where they run, and the lab window shows it. Tag a scenario `@environment:<id>` (one of the lab's
+  environments; several tags mean any of them), `@live-network` (only on a live network) or `@root-calls` (only where
+  `defineLab({ rootCalls })` declares root calls); an action that makes root calls says so with
+  `defineAction({ rootCalls: true })`. The lab works out every declared environment each scenario fits, running or not.
+  
+  In the lab window a scenario tied to environments carries a chip naming them. A live-only scenario is greyed out, never
+  hidden, and its tooltip says what runs it. Run on a scenario for another local environment first warns what the switch
+  costs (the identities it stops, what the environment it leaves keeps, the time a start takes), then switches as the
+  run's first step ("Switch to paseo-fork"), then runs it. `product-lab test`, MCP and the HTTP API never switch: a run
+  whose scenarios fit none of its environment is refused, naming where they run, and the others are left out. `product-lab
+  lint` reports an `@environment:<id>` the lab does not declare.
+  
+  The lab window no longer shows "Cannot set properties of null (setting 'hidden')" in its status line while an
+  environment starts or switches.
+- 60ea596: Added: a sentence can hold optional text in parentheses, as in Cucumber expressions. Write `\(` and `\)` for literal parentheses. An optional `(s)` or `(es)` after the word that follows an `{int}` or `{count}` is that number's plural: `{actor}'s list shows {int} note(s)` matches "Ada's list shows 1 note" and "Ada's list shows 3 notes". The builder and generated steps write the plural the number needs. `product-lab lint` warns, under the rule `wording`, when a step's plural disagrees with its number ("shows 1 notes"), and names the wording to write. The step still runs.
+- dbbb37c: Added: several hosts in one scenario. `{actor} is a new actor on the "<host>" host` (or a `host` column in `these actors exist:`) puts an actor on another of the lab's declared hosts, such as Ada on the truAPI CLI host and Grace on the truAPI WASM test host in one environment. The default session prepares each host the first time it is used and says, for every declared host, whether an actor can be put on it here and why not (`LabEnvironment.hosts()`); a scenario naming a host it cannot use is refused before it runs with that reason. Host adapter factories may implement `routingProblem(options, routes)`. dot.li is not offered per actor yet (its sessions are not signed in).
+- 3a8979a: Optional checks after each feature step: a screenshot compared with a baseline kept beside the feature (`@visual`), and an accessibility scan with axe-core (`@accessibility`), both off unless a scenario's tag or the lab's `checks` turns them on. `PRODUCT_LAB_BASELINES=strict` fails a step that has no baseline (for CI); `update` rewrites baselines. axe-core is an unmodified MPL-2.0 dependency, loaded only when a scan runs.
+- dbdc1f1: The lab window's recording replay shows each step's evidence: its chain changes, its app's console errors and warnings, machine and chain health findings, and what its apps asked their hosts for; a recording made without one of these says so.
+- 24d1915: Speed limits per step: a recorded step is compared with its median over earlier passed runs of the same scenario, and named slower when it takes more than twice as long and at least 2 seconds more.
+- 6b96f28: Fixed: a suite row could pass while scenarios it planned never ran. A suite planned every `.feature` file in the lab, but a row's run selected only what the lab's Cucumber configuration names. Now each row plans exactly what its run selects: the configuration's paths, read with the row's host, or the lab's declared `features`, which the run then gets as its paths. The configuration's tags apply to the plan too. After the run, every planned scenario the run did not report is listed on the row (`unreported`) with the reason when known: stopped by the suite's budget or an interrupt, or not run after the first failure under fail-fast. A planned scenario that went missing without a reason fails the row. A scenario skipped as not for the running environment now records why in the run's report, not only on the console. Notes skips its `@deny-by-default` scenarios on hosts other than the WASM test host through a scenario condition instead of a Cucumber tag filter, so its suite rows report them as skipped, with the reason.
+- 5cc98e8: `product-lab` (every `bun run lab`) in an interactive terminal now shows the running lab full screen and keeps it
+  up to date: the chains and their latest blocks, the people with their host and where each came from, and the latest
+  run step by step with each step's screen and chain checks and what it wrote. Keys open screens: `c` chains (switch
+  or reset, after asking), `p` people (make a person on a host you pick, or remove one after asking), `r` the run,
+  `o` the lab window, `?` help, `q` stop the lab. Pipes, `CI`, `TERM=dumb` and the new `--plain` flag keep the plain
+  lines. The package now depends on `ink` 8.0.0 and `react` 19.3.0 (loaded only when the app shows).
+- ed37285: New `product-lab test --mutate` tests your tests. It changes one expected value in each assertion step of a scenario (a quoted string, or a number) and runs the scenario, which must now fail at that step. A scenario that still passes has an assertion that never checked the value, and the command exits 1. Checks for absence ("does not include", "at most") are left unchanged, with the reason, since changing their value does not make them fail. Use `--plan` to list the changes without running anything and `--max <n>` to cap the runs. The report is written as `mutations.md` and `mutations.json`.
+- dcf6e41: `these steps run together:` now takes a doc string. Each line is a part, and the `|` lines under a part are that part's own table, so a step with a data table can run alongside others. A part can also be a composed step, such as a character ("Grace is a writer with a published note"): its steps run in order as one lane beside the other parts, and the people it introduces are created before the group starts. When two parts hold the same declared resource they still run one after the other, and the call's record now says why ("ran in turn after …: both hold …"). `product-lab lint` reports each part's problem at its own line of the file, including a table row written before any step. It also warns when every part belongs to one person, since those run one after the other. The builder saves a group whose block has its own table in this form. It keeps a group with a composed part exactly as written.
+- c92a34a: The lab window has a Tools page (Lab menu > Tools, key T). It runs the tools that find problems nobody wrote a scenario for: race hunting, explore, what if, test the tests, load, hostile apps, the nightly suite and bisect. For each tool it shows what the tool is for in one sentence and what it needs, checked now, and gives a start form with the CLI's options and defaults. It shows progress while the tool runs, then a report in words with links to each run's replay, plus "Copy the command" for the same run from a terminal. A tool whose needs are not met (for example what if on an environment that cannot save its state) says why and does not start. The page also lists the lab's characters, where each one is used and which saved states hold one ready. Actions and Extensions are now tabs of the same page. Notes' count check reads "The list shows 1 note" instead of "1 notes".
+- 4709419: The lab window's Tools page can watch race hunting and test the tests: "Show the people" offers Watch, where each run's people act in the window's tiles one run after another, or Background, through the lab server as before. Other tabs run tools in the background only.
+  
+  Times now use wall-clock time where they did not: a Tools page run's date and its folder name (they read 1 January 1970 before), its link to each run's replay, and the start and finish times of a suite run record (`product-lab test --suite`) and a bisect report.
+- f76653f: Added: a nightly matrix row can run a newer host release than the locked one (backlog 27). Name the host component as a row's candidate (`versions: { "host:truapi-cli": "latest-release" }`) and declare its release source in `versions.sources`. The policy need not select it. Before the row runs, the host adapter decides how to run that release. If the published release shows every capability the lab's patches add, the row runs it as published ("official"). Otherwise, if the lab's patches apply to the release's commit, they are built on it locally ("patched"). The build is cached by the commit and patch set and never published. Otherwise the row is unsupported, naming the patch and files that no longer apply; an unsupported row never counts as passing. The suite record gives each such row's `hostRoute` (the route, tag, reason and patch set) and `timings.hostRouteMs`, and the row's combination says how its host ran. A host adapter offers this through the optional `HostAdapterFactory.routeRelease`; the truAPI CLI adapter implements it. Notes' nightly matrix is now each host × its locked or latest release × People's locked or latest runtime: eight rows. `product-lab test --suite nightly --row <id>` runs only the rows named.
+- 7bd70bb: product-lab now says when it changed and when a newer version is out.
+  
+  - **What's new after an upgrade.** The package ships its `CHANGELOG.md`. On the first use of a newer version in a repository, the CLI prints what changed since the version that repository last used, breaking changes first, on stderr. The lab window shows the same in a card that can be dismissed. The MCP server adds it to its instructions and to `lab_describe` (`release.whatsNew`).
+  - **Newer version check.** The long-running commands ask the npm registry for the dist-tags at most once a day, with a 3-second limit, without making any command wait. A newer version is printed on a terminal at most once a day, and also appears in the lab window and in `lab_describe` (`release.available`).
+  - **When the check is off.** In CI there is no check and no notice. `PRODUCT_LAB_NO_UPDATE_CHECK=1` or `NO_UPDATE_NOTIFIER=1` turns off the registry check. A 404 or being offline prints nothing.
+  - **`npx product-lab upgrade [--to <version|tag>] [--dry-run] [--force]`.** It installs another version with the project's package manager, keeping the dependency in the same field of the `package.json` that declares it. It refuses to run on a dirty git tree unless `--force` is given. It then runs the new version's `ai init` and `fetch`, and prints what is new.
+  - **Release check.** A packed release now needs `CHANGELOG.md` with an entry for its version. Snapshots are exempt.
+- bc3b0a3: Added: `product-lab what-if <feature>`, "what if" branches. The feature's Background runs once and its state is saved; each scenario (each Examples row of an outline) then runs from that state, which is restored after it, with the lab's invariants and any `--probe` assertions checked at its end. The report compares the branches (result, calls, checks, what differs, an outline row's values) and gives each branch's time beside the trunk's one-time cost. It needs an environment that saves and restores its state (a relay-less named workspace or a saved local fork) and is refused elsewhere, saying so. Each branch begins with the Background's outputs, and each end check with its branch's (`BeginScenarioRequest.outputs` lets any runner begin a scenario with outputs recorded before it); the identities the run created are removed when it ends.
+- 84ea96b: With `PRODUCT_LAB_RECORDINGS_VIDEO=on`, `product-lab dev` records the lab window and each detached identity window as video into the recordings' `videos/` folder, and the recordings of the window's runs name those videos, so each step can be found in them. The lab window's video names no identity; a detached window's names its identity. `--video <dir>` still records the lab window where it says, and a recording then says why that video is not named.
+- e9fe6fb: The package now depends on zod 4.6.7 instead of zod 3.25.76, so `npm audit` no longer reports GHSA-mrhx-c7xc-m3w5 (memory exhaustion when an oversized array fails validation) for products that install it. The optional Chopsticks peer (`@acala-network/chopsticks` 1.5.2) still brings its own zod 3, so a product that installs it still sees the advisory, from Chopsticks.
+  
+  What changes for you:
+  
+  - **Types.** The zod schemas the package exports (`topologyOptionsSchema`, `topologySchemas`, each adapter's options schema, and a factory's `options`) are zod 4 schemas now. They infer the same input and output types as before, but code that uses zod 3's API on them, such as `.merge`, `._def`, `ZodEffects` or the five-parameter `ZodObject`, needs zod 4's form. `OptionsIssue.path` (and the path of a `ParsingSchema` issue) is now `readonly PropertyKey[]`, as zod 4 reports it. The doc comments on schema keys no longer appear in editor hovers.
+  - **Messages.** Errors the lab builds from a schema problem keep their form (`Invalid <adapter> options:` with `- <path>: <problem>` lines), and the messages the lab writes itself are unchanged. zod's own messages are now in zod 4's words. For example, `port: Number must be greater than or equal to 1024` is now `port: Too small: expected number to be >=1024`, and `relay: Required` is now `relay: Invalid input: expected object, received undefined`. Two messages say less than before:
+    - An unknown chain under a chain-keyed option is now reported on the option, as `runtimes: Unrecognized key: "mars"`. Before, it was reported on the key and listed the known chains.
+    - A value that matches none of an option's forms now reads `Invalid input`. For example, `runtimes.people: Invalid input` for a runtime that gives both `wasm` and `spec`, where zod 3 named the extra key.
+  - **Validation.** Options that take a URL (Chopsticks upstreams, for example) now drop spaces at the start and end of the value. Before, they kept them. zod 4 is also stricter about some formats:
+    - a UUID must carry a valid RFC version and variant;
+    - a date-time must include seconds;
+    - an integer must be a safe integer.
+    The lab writes all three itself (`randomUUID()`, `toISOString()`).
+  - **MCP.** In `tools/list`, a tool's integer arguments now declare `maximum: 9007199254740991`, and its map arguments declare string keys (`propertyNames`). The tools take the same arguments as before.
+
+### Patch Changes
+
+- cb987f2: A local network no longer fails to start or resume because one read of the process table missed a node that was still running: the lab reads the table again before it reports a node as exited.
+- 31455bf: The default session now keeps the ports it opens on its own (the app's proxy and dev server, the closed routes, the origin gates) inside your lab's block: the hundred ports around `defineLab({ port })`, clear of every port the lab declares (its own port, the environment's chains, the hosts' ports, an app's fixed dev-server port). Before, without `PRODUCT_LAB_SESSION_PORTS`, it took free ports from 1024, outside the block, where labs running side by side could collide.
+  
+  `PRODUCT_LAB_SESSION_PORTS=<from>-<to>` still overrides it. A lab that declares no `port` uses 40000-40999 and says so in the run's output. The first line of a run's progress names the range and why.
+- 665eabd: The fast local environment (`people-fast` and the other relay-less topologies) no longer fails every publish between 00:00 and about 02:00 UTC. A fresh chain's clock starts about two hours behind the wall clock, and the truAPI host asks for a person's statement allowance by the wall clock's day, so on the chain's previous day signing failed with `UnableToSign`. A start in that window now runs the chain with fast blocks until its clock passes midnight (about 45 seconds), then with its own block time, and says so in the environment's notices.
+- cf5e306: A feature run whose selection matches no scenario (a mistyped scenario name, tags or lines no scenario has) now fails in the lab window and over MCP too, not only in `product-lab test`, with a message naming what was selected and in which files: `No scenario matched the name "…" in features/…; refusing an empty success`. Before, the lab window reported such a run as passed.
+- 9716766: A run's host-bypass evidence now names the chain behind each connection it saw (People, Bulletin, …), also when the WASM test host reached it through one of the lab's chain gates, whose port alone named nothing.
+- db9c6a6: In a replay, the stage counts the recording's people, and the bottom bar and the step ribbon each stay on one line: the run's or step's title ends with an ellipsis, and "Replay" and "Back to live" stay whole. The timeline marks the Gherkin steps that ran no lab run ("Ada is a new actor"). A run that cannot be reproduced here says so in one line ("Reproduce: not available. Why?") that opens on the reasons, with Download bundle inside. The evidence names whose screen each check read when that is not the step's actor, and gives counts and durations in plain words ("0 notes", "60 s"). When a step fails, the recording also keeps a frame of every other person in the run, since the check may have read their screen. The Notes example's store check says what it found in plain words: "not announced after 60 s: Ada's index holds 0 notes".
+  
+  A recording names its people as their runs began, so a test runner that closes them before the recording is written no longer leaves ids in place of names. A step under a second says its time in ms.
+  
+  What the lab could not see around a host is listed one gap a row, under what it saw.
+  
+  A frame that an app replaces while it is being imaged (a check that reloads the app) is looked up again and imaged once more, so the step keeps its after-frame.
+  
+  The section of what the lab did on a person's screen says so ("What the lab did on Ada's screen"), apart from the check's own card. A step with no after-frame shows its before-frame and says so, with After off. The timeline says the selected step's span in the run, of the run's length, on one line ("0:06–0:13 of 0:13"). The Notes store check names the notes the author's index holds ("holds 1 note, "Written", not "Planted"").
+  
+  The host-bypass audit reads as words in Evidence, Past runs and the recording drawer: one verdict line with why one click away, explained extrinsics as a count per kind, one row per extrinsic the lab could not attribute or read in full, people by name with their host, and the record under Raw. A step's audit is one line unless the step has something of its own.
+  
+  A feature run's audit is said once in Evidence, its lab runs' audits combined with each step by its Gherkin number.
+  
+  Extrinsics with the same reason are one row naming their blocks by step, which opens on each.
+- 2fb53bd: A recording's replay now shows its evidence on the stage beside the frames, not in the side drawer. It opens with where the run failed and which side disagreed. For the selected step it shows each side's Expected and Found, what the person's screen did, and what the app said. It also shows the host lane: what the app asked its host, the traffic around the host, and what landed on the chain. Each part says whether it was seen, not observed on this host, or not recorded. The drawer lists every Gherkin step, the "is a new actor" ones included.
+  
+  Steps are numbered the same way everywhere in the replay, by their Gherkin step: the drawer, the ribbon, the dots under the frames and a frame's note ("while step 4 ran"). On a window 1200 px wide or narrower, the evidence sits above the frames and none of it is hidden behind them. When the host lane is incomplete because the lab could not read a finalized extrinsic in full, it says so.
+- 1834e3b: A feature scenario's recording now keeps every Gherkin step with its times, the "is a new actor" steps included, and starts where the scenario's first step did. Before, it began at the first step that ran a lab run and held no time for the steps before it.
+- 7f2bf09: Run recordings and the `{actor}'s app asked its host at most:` check now see what each person's app asked their host for, also in a lab that writes its own `sessions()`: the lab reads the record through the session's host sessions when the lab gives none.
+- 8505767: The MCP server exits only once its last answers have been sent, so a long answer at the end of a session is no longer cut.
+- c5e89c9: A recording's replay now says, before you click, whether its run can be reproduced, in plain words: for example "Reproduce elsewhere: not available for this run. It started on your saved Previewnet fork, whose starting state was not saved with it. Replay works here." Reproduce is off when it cannot; Download bundle stays. The same answer is `runBundles().reproducibility()`.
+- 47cbc9b: A check can now record what each side read (a person's screen, or a chain or store the lab reads itself), with what it expected and what it found, through `reading()` on its context. The readings are kept with the step whether the check passes or fails, so a failed step says which side disagreed.
+- 75241eb: Recording frames from the lab window are taken once the person's tile holds still, so a frame no longer shows the wrong part of the window when another person's tile appears. A tile that never stops moving gives no frame, and the recording says why.
+- 2def202: A run recorded from the lab window keeps what each step did on screen: every click, fill and screen read with its target, timing and outcome, by step. Headless runs keep none, and their recordings say so.
+- 0376393: The lab window's grid shows each person's whole app instead of cutting it. A tile of at least 480×280 shows its app at 100%, as before. A smaller tile lays the app out at that minimum, in the tile's shape, and scales it down to fit. The grid picks the column count that shows apps largest. No tile gets narrower than 220 px, so a tile's header always shows its person's name and pills. A scaled tile's header says the scale ("56%"). Below 30%, tiles keep that size and the stage scrolls. Device tiles fit by their device's viewport under the same rule. On a narrow window, the grid is now columns rather than a side-scrolling row. Steps that target the app's document by keyboard now also work in a scaled tile.
+- 76870ff: The HTML report's host-bypass blocks are closed by default. Each block's summary says the result in the lab window's
+  words ("Host bypass: none found"), then why, what it found and each person's app and traffic, with the full raw lines
+  inside. A contract deployed by the platform integration now reports its two transactions to its step, so a clean
+  deploy is counted as the lab's own setup instead of reading "Host bypass: warning".
+- df4e875: Notes example: when the truAPI host loses the Bulletin block its upload went into ("Invalid block hash"), an end-to-end
+  publish by hand now says so as the host's cause, with the block read from the Bulletin node (finalized, holding the
+  note). The step still fails.
+- 67ea3bc: Added: restoring an Engine network snapshot reclaims the restored network's stale lock when the lab can prove the restored state predates it: the lock's holder process is gone, it took the lock after the snapshot was saved, and the lock guarded exactly that network. Snapshots now record when their state froze (`savedAt`). Each reclaim is logged as a notice. Any other stale lock still needs the operator's `PRODUCT_LAB_RECLAIM_STALE_LOCK=1`. So an `@isolated` scenario can recover from a run killed during an identity onboarding without a manual reclaim (backlog 17h). In the lab's product integration example, the saved local fork passes its locks to its snapshots.
+- 9954808: Notes example: on the fast local chain, the lab's stand-in for XCM (which gives a new person room on Bulletin) now acts
+  only on the chain it started with. A lab left running after its chain stopped no longer answers the next chain started
+  on the same ports, so a passed run no longer shows the lab's own Bulletin allowance as a failed, stale transaction.
+- 7db9e30: When a step's transaction was signed at a block that a reorg then retracted, "did it land" answers not included at once, and the failed step's explanation says so by name: a reorg retracted the block it was signed at, which is why a node marks such a transaction invalid. A step's evidence names the signing block with `signedAt: { hash, number }` next to its `mortality`, or `mortality.birthHash`.
+- 075414e: On a local copy of Paseo or Previewnet, the Bulletin node now authors the way Asset Hub and People do (slot-based), so its newest block is replaced less often (no more forked blocks; about 2.5 replacements every ten minutes instead of 6 to 10). A product that signs at the newest block is told "Extrinsic marked as invalid" less often, but still each time a replacement removes the block it signed at (2.6 % of stores in an hour on a local Paseo copy). engine.json `bulletinAuthoring: "lookahead"` brings back the old way. Each parachain node now also logs its transaction pool: the counts of invalid transactions by default, and each one named with its reason when engine.json says `txpoolLog: "trace"`. Forks saved before this change get both on their next start.
+- da065ca: The lab's own process does less work while a run goes on: secret redaction skips text that cannot hold a recovery phrase, and a host's product and allowance accounts are derived once per identity instead of at every step. What the lab shows and returns is unchanged.
+- e285250: A long run no longer stands still between its steps. At each step's start and end, the check for apps that reach a chain without their host read the environment's node routes again for every browser request the run had made so far, so the pause grew with the run, to about 20 seconds late in a long session. It now reads them once per session and checks each address once, with the same findings.
+- 5e2a407: A failed fixture save no longer leaves a saved fixture behind: a running state holding two people with one name is refused before anything is saved, and an earlier saved fixture stays as it was. `fixture run --resave` and `fixture save` now refuse before running the setup when the running state already holds the people that setup makes, naming them and the command that starts clean (`fixture save <name> --fresh`).
+- 9f86b24: `product-lab host verify` no longer reports chainReconnect as blocked on a busy machine where the host is slow to start the chain follow: the probe waits for the follow to initialise on its own bound, and judges the reconnect by when the follow ended against when the link was cut.
+- f608ccc: A local fork whose relay chain keeps finalizing 16 blocks late after a session change (seen right after `fixture save --fresh` reset the light fork, where it made new actors' onboarding time out) is now restarted once before the lab uses it, and the start's notice says "finality pinned at the approval threshold after a session change; restarted once" with the numbers. If it happens again after that restart, the start fails with that message instead of restarting again.
+- f8b246b: A recording now says what held a step back. Each health sample also has the CPUs' idle share, the lab's own event-loop delay and how busy that loop was, and on macOS the memory pressure. `product-lab recordings <id>` and the lab window's step evidence say "the machine was the limit" when the CPUs were under 10 % idle or memory pressure was at warn or critical, and "the lab's own loop was the limit" when the loop was busy 90 % of the time or more than 1 second late, each with the numbers. A high load with idle CPUs, or low free memory under normal pressure, is no longer called an overloaded machine. Older recordings read as before.
+- 34e9d44: A fixture bundle saved on one port block can now be imported on another when its environment keeps files of its own beside the network (as an identity pool or workspace record with ports). Importing moves those files' ports and paths with the rest of the network, instead of refusing with "names the old ports and is not a file adoption rewrites".
+- 0f97c72: A fixture bundle now imports into a lab whatever its state folder is called. The bundle records where its state was saved, and an import puts each identity directory at the same place under the running lab's state folder, instead of refusing because the folder names differ. If the directories point at more than one running state folder, the import is refused and names them. Bundles exported earlier import as before.
+- 7533eab: The MCP `recording_show` tool no longer loses a long recording's step health to its answer size. It now leads with `healthSummary`: the steps where the machine was the limit, those where the lab's own loop was, and those with any health finding. With `step`, `health` holds that step's numbers and findings only, as `frames` does. `step_evidence` now says that a step's health is in the run's recording, through `recording_show` with the step.
+- 44f053f: The MCP tool `step_evidence` now gives the step's machine and chain health, with its findings, under `health`. While the run is still recorded, the health comes from the samples taken so far (`live: true`). After the run, it comes from the recording the run was written to (`recording` names it). For a feature run, `health` has one entry for each lab step the Gherkin step ran. When there is no health to give, `none` says why: a hook, a step that has not started, or a feature run in its own process. The runtime offers the same read as `runStepHealth`.
+- aa4001b: The truAPI CLI host now starts when the app checkout is one git cannot read, such as a copy whose git link points nowhere. Before, it stopped with "git status --porcelain exited 128". The app's commit only labels the run's evidence, so `launch.json` now says `appCommitUnknown`, naming the checkout and git's reason, in place of `appCommit` and `appDirty`.
+- b5dd553: A lab can now ask a host whether it can do something, rather than assume it from the host's kind. A scenario condition can call `probeHost(hostId, request)`. It asks the host to try the capability, and the host answers `holds`, `lacks` or `not-probed`, saying what it found and how long it took. The first capability is `bulletin-read`: does the host return content another account stored on Bulletin?
+  
+  The truAPI WASM test host answers this by asking its own package's preimage lookup, run in Node rather than in the host page, for content the lab names. Its "can't read Bulletin" label now follows that answer:
+  - the label goes away once the host reads Bulletin;
+  - if the host still can't, the label gives the probe's reason;
+  - if it hasn't been probed, the label keeps today's text and adds "not probed: …" with why.
+  
+  `@parity/truapi-host` 0.23.0 still can't read Bulletin.
+- 0095e8e: The lab now also hides a recovery phrase written with commas, semicolons, pipes or hyphens between its words, or as a JSON list of words, wherever it appears in what the lab shows or returns. Before, only a phrase with spaces between its words, or one under a secret-named key, was hidden.
+- f300e5a: Faster: a relay-less environment keeps the development chain specs it builds and reuses them on the next start while the node binary, runtime and genesis edits are the same, and builds the specs of several chains at once. A start saves about 2 seconds per chain.
+- dfc4b51: Fixed: a chain check such as "the remark is on the finalized chain" could miss an event that had landed and time out. polkadot-api releases a finalized block as soon as a newer one is finalized, and the check skipped any block it could not read that way, never coming back to it. Faster local chains made this happen every time (seen at 250 ms blocks). Storage reads at an older block now go to the node when polkadot-api has released the block. A scan that still cannot read a block (the node pruned it) never counts that block as "no event": it reads it again while waiting, and a timeout or an absence names the unread blocks.
+- 9ac61be: A lab's secrets no longer reach the terminal or the MCP server's stderr when a lab or environment provider prints them: console lines (from `product-lab` commands, `product-lab test` runs and the MCP server) and the lab's logger now show a secret, such as an RPC URL with its token, as `[redacted]`. A URL secret no longer causes `wss:` to be redacted in every other URL.
+- 6b99c2e: An RPC URL with a user, password, query or fragment on a live network's route (for example a secret RPC URL whose token is in its query) is refused with what is wrong, "people route carries credentials, a query or a fragment (a token?)", instead of a misleading "must be a loopback" message. A token in a path segment works and is kept as a secret.
+- ef1bf16: Fixed: test runs no longer print "RpcError: Method not found" stacks. A chain read at a block that polkadot-api had already released made it try the node's `archive_v1` methods, which local nodes do not offer, and log each refusal. On a node that does not list `archive_v1_storage`, the lab now reads that block's state from the node directly, as it already did after the refusal. Results are unchanged (backlog 90).
+- aee36b5: The locally built truAPI CLI host carries a backport of host-rust-core #1017 (merged upstream, not yet released): it looks a preimage up on the Bulletin node, so a host process reads content another process stored. The locked patch set is now `449d5b8fa884`; `bun run setup` builds it once.
+- 6a31655: The AI kit's Notes reference (`product-lab-integration`) now shows a product that writes the sponsored way: notes stored on Bulletin and announced in People's Statement Store under the person's allowances, checked by the lab's own store reader, with actors made people before they write and no funding.
+- 817085b: A long TMPDIR no longer breaks a local Paseo fork or the truAPI CLI host. Relay validators bind their PVF workers' sockets in TMPDIR, and the CLI host binds its frame socket there; a socket path of 104 bytes or more on macOS (108 on Linux) cannot be bound, so the fork's relay finality stopped a few blocks after its start and the host exited before it was ready. When the inherited TMPDIR is too long, the fork's nodes and each host process now get a short one of their own under /tmp, removed when they stop, and the start says why.
+- 8d5e5b6: Added `checkAfterStateChange` to the Engine environment: wrap an environment's own network check after an `@isolated` save or restore with it. A restored Engine fork's relay chain can stop finalizing for about as long as one readiness check waits, while its validators restart their approval voting. While every chain still answers and only finality has not moved, the network is checked again, up to three times. A chain that does not answer, or any other failure, still fails at once (backlog 93).
+- 53242a4: `product-lab init` runs a Vite app's dev script with `--host 127.0.0.1 --port <port> --strictPort`, so the lab reaches it where `localhost` resolves to IPv6 alone (Vite 8 on macOS). A dev server that answers only on `[::1]` is now named so when it does not answer on 127.0.0.1, with the flag that fixes it.
+  
+  The `.env.example` that `product-lab init` writes also names `PRODUCT_LAB_SESSION_PORTS`, the range for the app's proxy and closed routes, so every port the lab opens can stay in one block.
+- c78a4dd: When a step fails, the lab now also checks the Statement Stores for any statement the step wrote, the same way it checks Bulletin for content a transaction stored. When the step begins, the lab reads every Statement Store it can reach. It reads them again when it checks the failed step. A new statement signed by the identity's account, or by an account its host uses for the app, is the step's write. If the step sent no transaction, it still wrote something, and `afterFailure` says so (for example "people's Statement Store holds a statement signed by 0x…, written since the step began"). The answer is also in the reconciliation's `stores`, on the step's chain card, and in `transaction_landed`, which asks the store again. If a store cannot be read the second time, a step that seemed to send nothing is reported as unknown instead.
+  
+  Some hosts do not name their accounts. For those, a step can report its write itself with `context.report`:
+  - `{ type: "statement", chain, topics, signer? }` for a statement;
+  - `{ type: "preimage", cid }` for content stored on Bulletin.
+  
+  Each report counts as one of the step's submissions. If the step fails, the lab looks for exactly that write. A report with malformed topics fails the step and says why.
+- 8a35372: When a step fails after one of its transactions stored content on Bulletin, the lab now asks Bulletin whether it holds that content, the way it asks the chain about the transaction. The lab reads the content id from the store's own `TransactionStorage.Stored` event; apps declare nothing. The answer is in the failed step's `afterFailure` words (for example "Bulletin holds the content it stored: bafk…"), in its reconciliation's new `stores` field, in a row on the step's chain card in the lab window, and in the MCP tool `transaction_landed`. Each answer is `present`, `missing` (with the reason) or `unread` (when the lab has no reader for the environment's stores, or Bulletin did not answer within 10 seconds).
+- 2166fbb: `platformIntegration({ fundedSigner: true })`: with an existing funded signer, a contract can be deployed on a writable live network (no development authority needed); the platform's chain connector takes the public network's reason (`publicReason`) for its endpoints there.
+- 29afab0: A live network environment can be writable (`liveNetworkEnvironment({ access: "read-write" })`): scenarios write with the lab's pre-onboarded identities only, and nothing resets. On such a network only free-text inputs get the run's token; a choice input keeps its declared option (it was refused before).
+- 1381d8b: `@product-lab/composition` exports `preOnboardedIdentity` and `preOnboardedViews`, so a lab with its own `sessions()` can open existing accounts (pre-onboarded actors) the way the default session does.
+- 699672a: Keep an aborted action's own error in an optional abortDetail result field beside the timeout or cancellation reason. Timed-out generated steps show their final diagnostics in the terminal and reports after cleanup, without changing outcomes, retries or reconciliation.
+- 56e4176: Show separate abort diagnostics in MCP run reports and step evidence, and beside failed steps in the panel and terminal UI. Failure explanations continue to use the original error.
+- 979d2ca: A failed environment cleanup no longer loses the run's report. Cucumber ends the process on an `AfterAll` error before it writes `cucumber.json`, so a cleanup failure after the last scenario used to leave no scenario results ("cucumber.json is not JSON: Unexpected end of JSON input"). The cleanup failure is now recorded beside the report, the run still fails, and it appears after the scenarios as its own failed result, "Environment cleanup", with its whole cause tree, in the panel and in the HTML and JUnit reports.
+- 4479ec5: Documentation in the package only. The package README has a "Configure" section with an example for `app.deployed.resolveOn` (resolve the deployed app's DotNS name on another Asset Hub RPC, read-only) and `environments.fast.personProduct` (the person product label new people's member keys are derived under; default: the label the released truAPI host derives under, which `product-lab config` shows), and the setup skill lists both. The README's "With an AI assistant" says the AI kit, with its skills and two reference labs, ships under `entrypoints/cli/ai-kit/` and that `product-lab ai init` copies it into a project, and that allowing root calls and opening the lab window need a confirmation token too. The setup and debug skills, the two reference labs' notes and the composition, CLI and truAPI CLI host READMEs no longer say the truAPI CLI host is refused on a product's local environment: the locked 0.26.0 release takes the lab's local endpoints, as the README already said (the reference labs still run on the truAPI WASM test host). The integration skill names `HeadlessAppSurface`'s import (`@parity/product-lab/browser-playwright`) and `defaultSessionPage`'s (`@parity/product-lab/composition`), and the AGENTS.md section's MCP tool list adds `root_calls_allow`, `lab_open` and `lab_close`.
+- b5a0793: The AI kit and the MCP guide tell an agent to read `lab_describe`'s `resolvedConfig` before changing `lab.config.ts`, and to propose each change as the entry's `change` line.
+- 6309550: The terminal app's `a` opens Claude Code or Codex beside the lab, in the lab's folder where its MCP config attaches the agent to the running lab: in a tmux split inside tmux, else in a new tab or window of the same terminal (Terminal, iTerm, Ghostty, WezTerm, kitty), else right there, with the app paused and the lab still running until the agent exits. An agent that is not installed is greyed with the line that installs it. The lab window's Tools page lists the same agents, with Copy the command, and Open where the terminal allows it.
+- c4db30a: New people on the local dev chain can be derived under your own person product: set `environments: { fast: { personProduct: "<label>" } }` in `lab.config.ts` (the DotNS label alone; the lab adds each network's suffix). Unset, nothing changes: new people get the same member keys as before. The lab refuses a value that is not a label (a full name such as `example.paseo`, or upper case) before it starts, and refuses `personProduct` together with `onboarding: "truapi-cli"`, whose CLI host derives under its own label. `product-lab config` lists the value as `environments.fast.personProduct`. The package's documentation examples now use placeholder names such as `example.paseo`.
+- f1de62e: The AI kit teaches the new config and layout: `lab.config.ts` with only what is about the product, `lab/steps` (`defineSteps`), `lab/features`, `product-lab config`, negative controls by tags with failure reasons, and modes.
+- b7ca6b4: The AI kit now covers what the lab does today. `product-lab ai init` installs a sixth skill, `product-lab-app`: `devServer` and its `updates` for Vite, Next webpack, Next Turbopack, webpack-dev-server/Rspack and `{ hold }`, plus `watch`, `ready`, `account`, `hostBypass`, framing and what each start notice means. It also installs a generated reference of the minimal lab (`product-lab-setup/references/minimal-lab.md`).
+  
+  Setup, integration, test-ids, scenario and debug were rewritten against the code: the default session, `fetch`/`doctor`/`host build`, `chainEventAssertion`, the bundled run, in-process breakpoints and the generic sentences. The MCP registration now passes `PRODUCT_LAB_CACHE_DIR`, `PRODUCT_LAB_SESSION_PORTS` and `PRODUCT_LAB_HOST`.
+  
+  After a package upgrade, an older kit is reported in three places: every CLI command prints one stderr line, the MCP server adds it to its instructions, and `lab_describe` returns an `aiKit` field, each naming `npx product-lab ai init`. `product-lab doctor` also names the setup commands for a consumer repository.
+- 940f0c3: An app whose `package.json` sits beside `lab.config.ts` (no `app/` folder) now has its dev server read from that `package.json` and started in that folder. Before, the lab looked only in `app/`, reported no dev server, then failed to start the default one in a folder that did not exist. A lab whose `app/` folder has no `package.json` of its own (one install at the lab's root) keeps its dev server in `app/`, read from the root's `package.json` and run with the root's binary.
+- 2fba6b2: Step evidence and recordings keep everything an app prints, at every level, not only errors and warnings: `step_evidence` shows what the identities' apps printed while the step ran (identity, app, time, redacted) and names apps whose console cannot be watched; a recording's `console.log` keeps the whole run.
+- 6553783: The host-bypass audit reads People's resource claims. A truAPI host registers a statement allowance and claims Bulletin storage for a person with general extrinsics authorized by `AsResources`, an anonymous ring proof that no account signs. These used to read "unexplained · decoded partial", so every Notes run's audit was "incomplete". The chain adapter now decodes them completely: the claim, its ring position and the account it is for. When that account is one the session's host derives for its app (`session.resourceAccounts()`, `//allowance//statement-store//<product>` and `//allowance//bulletin//<product>`), the audit credits the claim to that app as the host's own submission. A claim for any other account stays unexplained, with one line saying why. A call the runtime authorized itself (FRAME's `AuthorizeCall`, such as a ring-maintenance call) that lands in a finalized block during a run is now read as the chain's origin, not as an unexplained, partly decoded extrinsic.
+- 10ec59e: When the lab window that `product-lab dev` follows from another terminal closes, the terminal app says the window closed and the lab it followed has ended, instead of "the lab did not start".
+- 30c2113: Releases and canary snapshots are published without a build provenance attestation while the source repository is private; attestations return when it is public.
+- c6e421c: At a narrow panel, chains, settings and the view switch wrap instead of squeezing or running past the edge; chips
+  without a tooltip wrap rather than being cut; chains read as their names ("People"); a replay's steps no longer show
+  the action's internal id.
+- d817e8a: `product-lab test` beside this lab's open window (`bun run lab`) runs in the window's lab. The run goes in the window's process on the environment it runs, so it shows there live, while its output streams in the terminal and its report is written as usual. A flag that needs a lab of its own (`--workers`, `--race`, `--suite`, `--keep`, `--cucumber`, …) is refused there with what to do. `--own-lab` runs a lab of its own as before.
+- 6084aa0: A second `bun run lab` in a terminal, while the lab's window runs in another process, opens the terminal app on that window's lab instead of refusing. It shows the window's chains, people and runs; scenarios started from it run in the window. Leaving it (q) keeps the window running. With plain lines (`--plain`, CI) it still refuses, naming the window.
+- ebd9b31: The MCP server no longer starts a second lab beside the one you have open. Each lab window records the lab it serves,
+  with its address, in `.product-lab/running` while it runs. MCP `env_start` refuses while another process serves the
+  same lab's window: "The lab window at http://127.0.0.1:13250 is already running this lab (Notes, process 1234):
+  starting here would start a second lab on the same kept chain and ports. Use that window, or stop it (Ctrl-C in its
+  terminal) and start again." A run tool with no run yet now says the server runs a lab of its own and that the lab
+  window's runs are kept as recordings, listed by the `recordings` tool and opened with `recording_show`.
+- fcb808a: Visual baselines are kept per host kind (`__baselines__/<feature>/<scenario>/<host kind>/`), so a scenario whose screen a host shapes (for example, an app the WASM test host cannot reload) passes when run again on each host.
+- 24e57bb: When a lab declares several hosts, the Run setup lets you choose the host for each new person a scenario creates. The choices are the lab's declared hosts, with its default preselected. A saved person keeps their host, shown read-only. A host the scenario itself names is shown locked as "set by the scenario". The run creates each new person on the chosen host. API callers can do the same with `{ new: { host } }` as an actor's binding. An undeclared host is refused, and the error names the declared ones.
+- ce8e89c: An app opened through the lab's proxy gets its host bridge on the first load even when its dev server is slow to answer an unknown path (a cold Next dev server compiling its not-found page): that check now starts as soon as the bridge is bound and has its own deadline, so a page no longer loads without its host and shows the app's "open it in a host" screen.
+- 5769e44: A local fork no longer starts from a half-downloaded state bundle. The lab downloads (or bites) the bundle beside the one in use, checks that every snapshot is there at its recorded size and decompresses to its end, and only then moves it into place; a download stopped part way, by a crash, Ctrl-C or a full disk, is discarded and fetched again on the next start. A bundle already in your cache is checked once on its next start (a few seconds) instead of being downloaded again. Two starts from one Engine workspace no longer download into the same folder: the second waits for the first.
+- 4085c15: The bottom bar counts scenarios the way the library's "Can run here" filter does: "41 of 45 can run here" instead of
+  "45 scenarios" beside a different number. "Can run here" now leaves out scenarios tied to another environment or a live
+  network, which the running environment cannot run without a switch.
+- 2501f03: Fixed: recordings of `product-lab test` runs, and the replay, run bundles and journey docs built from them, no longer lose the final screens. A scenario's last steps can end in milliseconds, and its apps used to close while their screenshots were still being taken. Screenshots in flight now finish before a scenario removes its identities and before the environment stops. The wait is bounded by the capture limit, 5 s by default. A screenshot that doesn't finish in time is recorded as failed, with the reason.
+- c0d0589: The fast local chain now makes a block every 2 s on People and every 4 s on Bulletin (both were 500 ms), so both clocks run 6 times the wall clock (were 24 and 48) and a session lasts hours before the chain's day ends. The lab window's environment card and the terminal app's config screen say how long is left ("The chain's day ends in 40 min"); at the crossing the lab stops runs with the same words and Reset gives a new chain. `blockTime: { people: 12000, bulletin: 24000 }` in `relaylessTopology({ … })` keeps real time: slower, never runs out.
+- bf5a1a9: Fixed: under a deny-by-default host (`denyByDefault: true` on the truAPI CLI or WASM host), an app can no longer reach the chain node behind its host. The lab now puts an origin gate in front of each local node: the host's own connections pass, and an app's page, frame or worker connection to the node is refused and listed in the session's blocked requests. Before, an app could open the node's WebSocket directly (the page under the WASM host, a dedicated worker under the CLI host). A node's own `--rpc-cors` cannot stop this, because Substrate's RPC server accepts a WebSocket from any origin. Other hosts, and sessions without `denyByDefault`, are routed as before.
+- afd0a7d: A local chain's pace is now plainly one of two modes: `pace: "fast"` (the default: very fast runs; the chain's clock
+  runs about 6x, so a kept chain goes stale after a few hours and must be replaced) or `pace: "real-time"` in
+  `relaylessTopology({ … })` (stable: the chain's clock follows the wall clock, so a kept chain never goes stale; runs are
+  slower). `blockTime` stays the expert's override. The lab window's card, the Keep switch, the terminal app's Chains and
+  config screens and the docs say it in the same words. A start on a kept chain that went stale now asks in a terminal
+  "Replace it with a new chain? The people kept with it are discarded. [y/N]"; without a terminal it names
+  `bun run lab --clean` (from a package script) or `product-lab --clean`, and the lab window offers "Replace the kept chain".
+- 86b1579: `product-lab check` now says a local environment cannot start when its default host is the truAPI CLI host. A product runs that host's official release on a live network only, so the check names the reason and the fix: `defaultHost: "truapi-wasm"` in lab.config.ts, or use a live network.
+- f0af14c: `product-lab check` now warns when a feature file's `@negative-control` tag and the `negativeControls` entries in `lab.config.ts` disagree, with the same words as the lab window's warning. A declared file without the tag runs as a normal scenario. A tagged file without an entry gets the line to add.
+- 3d53be8: A run that fails as the suite ends gets its chain check: stopping the environment now waits for the lab's checks after failed steps (all together, at most 60 s in all) instead of answering "The lab could not check the chain: No environment is running". A check still running at that limit is stopped and says so ("The lab could not check the chain (stopped) …").
+- bd0d319: Keep Chopsticks forks on their configured ports when the parent environment sets PORT. Also isolate child processes from inherited PORTS and PORT_LAST settings.
+- 2bdd04d: A Chopsticks environment now refuses to start when the installed Chopsticks lacks the fixes for V5 general extrinsics (AcalaNetwork/chopsticks #1078 and #1081). Without them nothing a truAPI 0.23 host publishes is ever included. `product-lab check` and suite plans report it before anything starts. Use a relay-less environment, or a Chopsticks release that includes both fixes.
+- ab091d3: Nothing changes in what the package does: its CLI's own test script now runs through `tests/run-tests.mjs`, which can
+  run one share of the test files (`CLI_TEST_SHARD`), so CI splits the CLI's tests over three runners. The architecture
+  rules leave CI's shards for the whole-repo job, which now keeps Nx's cache like the other jobs.
+- 6624fb7: Add an opt-in truAPI CLI attest provisioner for caller-chosen wallets on local environments, with independent public-key binding, private state and optional process confinement. Existing auto provisioning and its defaults remain unchanged.
+- 5711368: Make doctor report missing Playwright Chromium with its install command, and make init's next steps use the app's package manager.
+- b52e979: The truAPI CLI host's official release is now 0.24.0 (it was 0.20.0), and release archives signed under the repository's new name, trinity-user-agents, are verified.
+- 999f1a2: The lab window writes every time of day 24-hour ("18:11:05"), whatever the machine's clock: run history, the evidence
+  header, navigation activity, saved fixtures' expiry, identities' creation times and transaction tooltips no longer
+  show "06:11 AM" beside 24-hour times elsewhere.
+- bfcd8d5: Stopping a lab with a person on the in-browser host (truapi-wasm) no longer takes a minute more. Closing the lab window used to move each such person's session back to the host's own browser, then wait up to 60 s for the app there, only for the lab to stop it right after. A lab that is stopping now leaves every session where it is, and `product-lab dev` starts stopping the lab before it closes the window. On people-fast, close and reopen fell from 69.5 s to 12.5 s.
+- 657b747: A product config's second and later step sets (`app.steps: [mine, checks]`) run: they are offered beside the app, so their sentences are available wherever their own requirements hold. Before, every one of them was refused ("Integration … is used by no app of this lab").
+- 5340a4f: The lab can carry an identity's connections to a local endpoint through a conditioned link (`NodeConditionedLinks`): delayed and slowed while throttled, cut while offline, every byte in order.
+- 0e8c6cd: A conditioned page socket keeps its messages in order and is still decided by the browser context's own socket routes (a network guard, an endpoint bridge).
+- 3de8f88: Per-identity conditions work end to end on the truAPI CLI host: a conditioned link names a local node as the request's host (a Substrate node refuses any other), the app's bridge route is no longer rotated, and the running environment passes its conditions on. An identity a scenario did not create for conditions is refused by name before the run; the truAPI CLI host takes `conditionLinks: "always"` to make every identity conditionable.
+- c7014da: A step set's `scenarioConditions` hook also reads whether the lab window placed the people in its tiles (`placed`) and the session's hosts (`hosts`: kind, default, options), under any session, including the lab's default one. The conditions are read again when the window places or releases the people.
+- de51d34: Groundwork for per-actor conditions (slow network, offline, slower device per actor): the condition values and
+  built-in profiles (`slow-3g`, `fast-3g`, `slow-wifi`). Nothing applies them yet; scenarios behave as before.
+- ca9c084: Config contract: several step sets (`app.steps` as a list), `app.requires` for services and capabilities, `app.navigation`, top-level `secrets`, `live.<network>.people`, and `advanced` for what the shape does not cover yet.
+- 42dc1bc: Config contract: an app may name its contracts (`app.contracts`), a live network the person who deploys them (`deployContractsAs`), and live environments are `live-<network>` (`liveEnvironmentId`).
+- cf048fc: Contract for the new lab config (types only): `defineLab` accepts the product config shape (`app`, `chains`, `environments`, `live`, `hosts`, `modes`, `ports`), `defineSteps` names `defineIntegration`, and failures carry a reason (`fail(reason, message)`, `LabFailure`, the built-in reasons and the negative-control tags). Nothing behind them yet.
+- f0d4e96: The lab window's Config view shows the lab's config while no environment runs (before the first start or after Stop), and its empty state when the loader gives none.
+- 86eca98: The lab window: the Chain console heading no longer shows a second arrow-like icon beside its expand arrow; Replay has its own icon (history) instead of Rerun's circular arrow, and both say on hover what they do (Replay shows the recording and sends nothing; Rerun runs again, live).
+- 7ae0427: Deploying to Bulletin from a product now says what to add when bulletin-deploy 0.21.0 cannot load. Installed next to this package, its host-papp lands on polkadot-api 3, which lacks the `polkadot-api/signer` path it imports. The deployer and `loadBulletinDeploy` now refuse before anything runs and name the two `overrides` your `package.json` needs. Before, Node failed with `ERR_PACKAGE_PATH_NOT_EXPORTED`. The deploy and Chopsticks READMEs say what a product gets without the lab's own patches and overrides.
+- 1f90acd: A negative control that failed as intended now says so: the lab's answer (in the terminal and in MCP's `explain_failure`)
+  reads "The lab caught it: …", naming the step and reason, instead of a failure's advice such as "Infrastructure, not the
+  product". In the lab window, its failed step shows "The lab caught it" in the control's colour, and the run card's "Why?"
+  says the same. When the host check itself fails, it is now explained as the host check (the app sent something outside its
+  host), not as an unreachable environment.
+- f4d5f92: `product-lab test --negative-control --dry-run` plans each control and judges none ("N of M planned (dry run: none judged)"). Before, a dry run reported every control as not valid, because nothing failed.
+- 8f3e230: Negative controls are declared with tags alone. Tag a scenario (or a feature) `@negative-control`, in any folder: it must fail at its last step from that step's own check, never for a timeout or another infrastructure reason. Add `@fails-at-step-N` when it must fail at an earlier step, and `@fails-with:<reason>` for the one reason that counts: one of the lab's checks (`screen-mismatch`, `not-on-chain`, `host-bypass`, …), a chain error by its own name (`Resources.LongTermStorageAllocationFailed`), or a reason your steps declare and throw with `fail(reason, message)`. Every failure now carries its reason, and a control that fails at the right step for another one says "failed for another reason: <reason> (<message>)". The verdict shows the failure's reason and message under it in `product-lab test`, the lab window and MCP (`run_report`'s `failure`, `explain_failure`'s hint). `product-lab test --negative-control` with no path and MCP `run_negative_controls` with no feature run every tagged control: a tagged feature whole, a tagged scenario alone, `@runs-with:keep,rebuild-fixtures` adding those flags. A refusal before the scenario ran counts only when named: `@fails-with:unsupported-here` or `@fails-with:scenario-refused` (a wrong table, actor, reference or input). `defineLab({ negativeControls })` is read only during the migration, with a warning naming the tags that replace it.
+- e24adf8: The lab window never hides a negative control: on a chain or host it does not apply to, it stays in the Scenarios
+  library, greyed, with the reason on its Run button, instead of waiting behind "Show N not for this chain".
+- 525b2d5: The Notes example's `e2e:controls` now starts each negative control with the flags its `@runs-with:` tags ask for (`--keep`, `--rebuild-fixtures`), as `product-lab test --negative-control` does. Before, the shared-restore fixture control ran without `--keep` and failed in its Before hook, which does not count as a valid negative result.
+- 1566b43: `runtime.createActor({ host })` creates an identity on one of the hosts your lab declares, and `snapshot().hosts` lists them with the default and why one is unavailable. An undeclared host is refused, naming the declared ones, and an unavailable one with its reason; nothing is created.
+- eb1c9b1: In the lab window's Watch mode, an identity's cursor and its name are now drawn above the highlight ring around the element it acts on, instead of under it. The lab's menus, dialogs and toasts still cover the cursor.
+- bf5bccb: The lab window's Environment section now sits above the Run, Scenarios and Recordings tabs on every tab: its heading (Environment, with the arrow) opens and closes it, and it stays open or closed as you left it, across tabs and reloads. It replaces the summary card shown there before. Going to Environment from the Lab menu opens the section without leaving your tab.
+- b527761: No change to how the lab runs. Its process adapter can now list the live processes of one tree it recorded, by their recorded identity, so the lab's own fork checks kill only the dashboard they started and never another run's (backlog 235).
+- 5040bbf: A product config's `defaultEnvironment` may name an environment it brings under `advanced.environments`, as its type already allowed: the lab no longer refuses it when it loads.
+- 41abc21: The default session keeps people between starts: with "Keep chain and people between starts" on and the truAPI CLI host, the people a lab made on a kept chain open again at its next start with their own wallets, and every person can be stopped, started again (same account) and deleted.
+- bbfb1f8: The lab window's "Finalized chain state" for a person under the lab's default session shows their funds on every connected chain, read at its finalized head, or why they could not be read.
+- 819c647: The default session reads each new person where its people are persons: their screen (the app ready with their account) and People (their member key in a ring, and the lab's own read of `Members.Members`), shown as the checks of the step that made them.
+- 386bd8e: A demo's slide and captions take the lab window's new colours (the Polkadot pink accent and the new greys), as they
+  did the old ones.
+- c232635: `apps.<id>.deployed` now serves the build your users get. Hosts open a DotNS name's app as `app.<name>` first and use the name's own contenthash only when `app.<name>` has none; the lab read only the name's own, so for a name whose releases go to `app.<name>` it served an older build. The deployed app now resolves `app.<name>` first and falls back to the name, as hosts do. `app.<name>` counts as absent when it has no record, an empty contenthash, or the Asset Hub has no DotNS content resolver; a contenthash that is not an IPFS CID is refused, as hosts refuse it, never replaced by the name's own. A name where neither has a contenthash is refused naming both.
+  
+  The start's progress and the gateway's line say which name was served (`app.<name>, the app of <name>`), and the gateway report's `name` is that name. A `cid` pin is accepted when it is `app.<name>`'s CID or the name's own, and that build is served; the line says which one the pin matched. Before, a pin of `app.<name>`'s build was refused unless you declared `app.<name>` itself as the name, which also made it the product id. The product id now stays `name`, as hosts keep it, so the accounts and the page's origin are the ones your users get.
+- 16b3944: A deployed app can resolve its DotNS name on another Asset Hub than the environment's, read-only:
+  `apps.<id>.deployed.resolveOn: "wss://…"`. Use it when a local copy of a network predates the name's current record
+  (a name re-pointed after the copy's state was taken). The copy then serves the build the public record points at, and
+  `cid` pins it. Only the name's resolution moves: the content, the chains, the host, the accounts and every write stay
+  on the environment. The resolution uses a read-only connection that sends only DotNS storage reads and refuses any
+  other method before it is sent. The gateway's report records the read as public contact (`publicRead`: the endpoint,
+  the names read, the one served, the block number and hash, the pin and every method sent), and the served line names
+  the endpoint and the block. Nothing changes without `resolveOn`. The gateway program takes the read as
+  `--resolve-asset-hub <url>`, and a public one also needs `--allow-public-resolve` (`--allow-public` does not grant it).
+  A pin the record does not match is now refused naming the Asset Hub it was read on. The package exports nothing new.
+- 2410dcb: When you open the lab in its own window, the bottom bar goes with it: Lab, the environment, the run's line, Watch, Background and Replay, and Run, Pause and Stop sit at the bottom of the lab's window in two rows. The people's window becomes the stage only, and its chip says "Lab detached" with the run's progress. Docking back brings the bar home.
+- 2a3ab4a: A detached person's window (`--detach`, or Detach in the lab window) now behaves as you would expect:
+  
+  - A desktop person's window is a normal browser window. It opens at the device's size, and the app follows the window when you resize it, instead of staying at a fixed width.
+  - A phone or tablet is shown inside its device frame, centred and scaled to fit the window. The app inside keeps the device's own viewport, pixel ratio, touch and user agent. The lab window's live mirror shows the app alone, and a step's screenshot is the app's whole screen without the frame, taken without the window flickering or losing the device's pixel ratio. The window's video is what the person saw, frame included.
+  - An app that refuses to be shown in a frame opens at the device's exact size without the frame. The lab window then says "shown without the device frame: the app refuses framing".
+- b6d7032: The lab's own window is styled again in every browser setup: it copies the lab window's styles instead of fetching the stylesheets again, so a window whose stylesheet requests fail no longer shows the panel as raw, unstyled HTML.
+- 03a49a4: Replacing a kept chain (Reset, the terminal's y, the lab window's "Replace the kept chain") now names the chain it
+  discarded (`provenance.workspace.replaced`), so a lab can discard the people it kept with it. The Notes example removes
+  them once the new chain is up and says whom; identities the lab did not make stay.
+- 6fdf10d: The AI kit's skills and the Notes reference describe the new lab shape: one `lab.config.ts` with only what is about your product (`app.steps`, `app.chains`), negative controls by tags with every reason the lab knows (including `screen-unstable` and `scenario-refused`), `product-lab lint` flagging unknown `@fails-with:` reasons, and modes (`test --mode`) instead of suites. The integration skill also covers `companions` (apps your app opens in the same wallet) and `devices`.
+- 5b8eca3: The AI kit's integration skill documents `advancedWhy` (why each `advanced` field is needed, shown by `product-lab config`), and its Notes tour shows Notes' real product config.
+- f0869ff: The docs and the AI kit's debug skill now say where a product can run each host. The truAPI WASM test host runs on every environment. The truAPI CLI host's official release (0.24.0) runs on a live network only. The docs also note that the default session runs the `deployed-local` launch, and that the package ships only the patches its code reads at run time.
+- de019d6: `product-lab doctor` now checks which Engine build your cache holds (`cache:engine`). Before, a cache that held another build passed the doctor and then refused when a local copy of a network started. This happened with caches copied from an older setup that held the retired patched Engine. The check reads `engine-build.json` under `<cache>/engine` (`~/.cache/product-lab`, or `PRODUCT_LAB_CACHE_DIR`) and compares it with the stock Engine release this version pins. If the cache holds another build, the doctor names both builds and the fix: run `npx --no-install product-lab fetch --environment paseo-copy` to prepare the pinned release in that cache, or point `PRODUCT_LAB_CACHE_DIR` at a cache that already has it. Like the `tooling:engine` line, it fails when the copy is asked for (it is your default environment, or you pass `--environment paseo-copy`); otherwise it is a note, because that copy, or another lab that shares the cache, would still refuse to start. A build you chose with `fetch --engine-ref` counts as another build: copies still start from it, but the doctor names it, and fails (exit 1) when that copy is asked for, as your default environment or with `--environment`. A cache with no Engine gets no line, as before. The doctor only reads; it never rebuilds or deletes anything.
+- 3e5ec2a: `product-lab doctor` now also says what fits this machine: the local copy of a network as Full or Light, how many people at once on each environment, and whether the shared cache is set up.
+- bde2d4a: dot.li sessions now keep the dot.li page's console, redacted, from before the first navigation. This covers the page and its frames, and dot.li's own diagnostics (protocol mode, chain backend, init-failed) are picked out. You can read it with `session.console()` and `host.consoleLog()`. The dot.li verify targets write it to `console.json` and print the diagnostics after the run.
+- f19dfd3: dot.li now pins dotli-community `577ddd50e`, the current main, which uses truAPI 0.23 as live paseo.li does. Before, it pinned `d91104b`, which used truAPI 0.13. `product-lab host build --host dotli` builds with npm when the checkout carries a `package-lock.json`, and records the truAPI packages it installed in `acquired.json`. The dot.li targets are no longer greyed for a truAPI mismatch. dot.li's console diagnostics now cover every `[dot.li …]` prefix and truAPI's own `[truapi…]` lines.
+- 34a0b95: A deny-by-default dot.li session now goes through the lab's origin gates in front of the local chain nodes, as the truAPI hosts do. Only dot.li's own page and protocol frame may open a node. A product frame that tries is refused and reported in `session.network.blocked()`, so `hostile-chain-bypass` no longer finds the product reaching the node. The dot.li verify targets are greyed while the kit's probe speaks a different truAPI release from the locked dot.li build: today truAPI 0.23 against 0.13, which is a known gap. The dot.li lock now records the truAPI its build bundles.
+- 85414a0: A host verification target can say why it cannot run here: `unavailable({ lab })` in `defineHostVerifications([...])` returns the reason (a missing build, a tool not installed, or chains of the running lab it cannot use). The lab window's Hostile apps keeps such a host in its menu, greyed, with the reason on hover, and picks one that can run; `product-lab host verify` refuses it with the reason before starting anything. In product-lab's own repository, dot.li is now in that menu: it uses the lab's chain (or starts the lab's environment for the run) like the truAPI hosts, checks the chain-node bypass (its sessions are not signed in, so the other three attacks are reported as not supported), and is greyed with why when it cannot run: its locked build is missing, or the running chain is made from scratch (dot.li serves only the network's own chains, so it needs a copy of Paseo). Before, such a run waited two minutes and reported, wrongly, that the host let a hostile app through.
+- 8f61332: `hosts: { dotli: {} }`, the line `product-lab config` suggests for turning the dot.li host on, now loads: before, the lab refused to start with "Host dotli: hostPort: Required". Without `hostPort` the dot.li host takes a free port the lab reserves when it starts, as the truAPI WASM host does, and `product-lab config` shows the port as given or reserved.
+- c76ec62: `product-lab test --dry-run` now refuses what `product-lab lint` refuses in the features it selects, before anything starts: a step that does not plan (a missing sentence, an "… at the same time" step whose parts are not registered sentences, a malformed table) is reported as an error, with its file and line, instead of the scenario being reported as discovered. A negative control's deliberately broken plan stays a warning, and errors in features the run does not select do not refuse it.
+- 634c6f3: `node --import @product-lab/cli/own-running-record` gives a test or e2e script that serves a lab window a running-lab record of its own, so two window tests of one lab (a quick journey beside a fork journey, an e2e beside a check) run side by side instead of refusing each other. The examples' test and e2e scripts use it. A person's `bun run lab` stays one per folder.
+- b6f00b2: `product-lab fetch` now prepares the Engine checkout that the local copies of a network (`paseo-copy`, `previewnet-copy`) start from, so a product that installs `@parity/product-lab` can run them without product-lab's own repository. Name the copy you use: `npx --no-install product-lab fetch --environment paseo-copy` clones previewnet-engine at the commit the lab tests, applies the lab's patch, builds it and fetches its network's binaries into the shared cache (`~/.cache/product-lab/engine`, or under `PRODUCT_LAB_CACHE_DIR`). It needs Git and network access, and takes a few minutes and about 900 MB the first time. Once prepared, it is only checked. A plain `fetch` prepares only what your default environment needs, so CI on the local dev chain never builds Engine.
+  
+  `product-lab doctor` now says whether that checkout is prepared (`tooling:engine`). Pass `--environment paseo-copy` to make a missing checkout a failure instead of a note. A copy that starts without it now names `npx --no-install product-lab fetch --environment paseo-copy` instead of `bun run setup`, a command a product does not have.
+  
+  To try another Engine, for example one that already carries the fixes the lab patches in, `fetch` takes `--engine-repository <url|path>` (a Git URL or a local repository), `--engine-ref <ref>` and `--no-engine-patch` (stock Engine, recorded as such; the copy then starts from it). A plain `fetch --environment paseo-copy` goes back to the tested default.
+- c50880e: A local fork whose first boot was stopped part way (Ctrl-C or a killed run) now starts on the next try. Before, that start failed at once with "Existing persistent network must be resumed, not initialized again" and only a retry started it. The lab removes what the stopped boot left, says so, and boots, or adopts a published first boot when one fits (backlog 210).
+- 2f74791: Paseo copies onboard people again. The lab now prepares PreviewNet Engine at its current main (2f6d0eba) instead of v0.8.0 (d298d260). Engine's identity backend there is DUB v0.6.0, which signs against People runtimes that carry `CheckMetadataHash`. With v0.8.0, a copy of today's Paseo Next onboarded nobody: "dotNS username did not appear on Asset Hub after attestation". Run `bun run setup` once to prepare the new Engine.
+- 2b0d834: A Paseo copy no longer hangs at its first start when eturnal is installed. Engine then runs its TURN relay (`turn`) for as long as the network, and the start waited for it to exit as if it were a one-shot setup job, so it never became ready. `turn` now counts as one of Engine's services.
+- 6918b48: The lab window shows the environment above the Run, Scenarios and Recordings tabs, on each of them: its name, the option it runs as, what stopping keeps, its health, Start and Stop, a line per chain with its finalized head, and "Environment details" for the rest. A chain kept between starts says "kept between starts" (it said "thrown away when stopped" and "a new chain each start"). At a narrow panel the Environment section's facts no longer break inside words ("5 / not / es") or run over the Reset row.
+- 55548bb: The chain picker lists every kind of chain a lab can run on: a fast local chain, a local copy of a live network, a copy of a live chain through Chopsticks, and the live network. A kind your lab does not configure is greyed under "Not configured in this lab", saying what it is, why you would choose it, and the config that adds it. `nameEnvironment(entry, { label, description, kind })` takes the kind for an environment of your own; a topology's adapter and a live network say it themselves.
+- 5543a52: An environment's line in the lab window's environment list and picker wraps instead of being cut with "…", so its
+  whole text (its chains and where its state is kept) can be read.
+- 37486b1: When a lab has no `lab.lock.json` entry or a locked file is missing from the cache, the message now tells a product what to run: `npx --no-install product-lab fetch`, or `npx --no-install product-lab init` for a pinned lock. It no longer names a path in product-lab's repository or its setup script. When dependencies are missing, the CLI tells a product to reinstall `@parity/product-lab`.
+- 3a561c9: The lab window's evidence now uses plain words, and each part says why it is there.
+  - The host-bypass audit is now the "Host check". It says "Nothing went around the host" and counts what it found by kind, for example "24 the chain wrote itself (each block's time and bookkeeping): expected". Each kind gives its reason on hover, and the check's (i) explains what it does.
+  - A host's approvals read as what the person allowed, counted: "Let it reach a service or chain beyond the app (twice)".
+  - The step's own values read as words with their units: "typed and clicked: 148 ms".
+  - A replay picture taken while the next step ran names that step's work.
+  - The full records are labelled "The full record (JSON)" (they were "Raw").
+- a98f0c3: `explain_failure` names an app's dev server that never served the app in time (rule `dev-server-not-ready`) with the status it answered; a 404 is explained as a server running from another folder or base path, with the `apps.<app>.devServer` setting that changes it. Before, the lab answered "No rule matched this error".
+- 05834fc: A step that fails because the lab cannot do something here (an unsupported operation, such as making a person on a local environment in a product) is now explained as unsupported (`explain_failure` rule `unsupported`). Before, it was explained as a host refusal, with advice to read the host's logs and run `host_verify`.
+- 856626f: `product-lab explore --save <dir>` now saves the smallest failing scenario the way the lab window's "Save as a feature" does: never over a file already there (`explored-seed-<seed>-2.feature`, `-3`), only inside the lab's directory, and only where the lab's features globs list it; otherwise it says why and writes nothing. Its flag and its `Saved: <path>` line are unchanged.
+- 50e841e: In the lab window's Evidence, the list of a feature run's steps under Receipts is no longer rebuilt each time the run's evidence redraws, for example when the lab's check after a failed step answers seconds after the run ended. Unchanged rows stay as they are.
+- 810a369: The scenario list shows a scenario's description whole. Before, it was cut after three lines and the rest was only in its tooltip.
+- e25f744: In the lab window, a long value in a step (a content id, an address) wraps inside its own chip. Before, at a narrow panel, the step's sentence ran a few pixels past its box.
+- 2d42842: The run timeline's axis now ends after its last bar, so a last step that took 0 ms is drawn on the timeline. Before, it was drawn past the timeline's right edge.
+- 9ebd5bb: A run timeline's bar shows its step's number instead of a title cut to a few letters. The bar's tooltip, the detail below the timeline and "As a table" give the step's whole title.
+- 7d7ce70: The run timeline shows a long identity name whole, wrapped in its column. Before, it was clipped to its first words without an ellipsis.
+- 13ede48: A browser context or page with a WebSocket route keeps the browser's own WebSocket accessors, so a truAPI host's bridge (which reads them) still pairs when the lab routes the page's sockets.
+- c6a0b41: The lab window now follows your feature files. Save a `.feature` file in any editor, or add a new one, and the Scenarios list and the open scenario's steps update within about a second. You no longer need to reload the window. Editing `negativeControls` in `lab.config.ts` takes effect while the lab runs, and the next control run is judged with the new entry. A run already going keeps the files it started with. A run started after an edit always read the new file; only the window's list was out of date.
+- e365bb6: Demo videos render with ffmpeg 8 and later again; they failed with "Unrecognized option 'filter_complex_script'".
+- 231ff29: A lab-window fill now reads the field back after typing. If keyboard focus moved away while the field was being typed into (for example, a click elsewhere in the window), the lab focuses the field again and types only the missing part, once. The call's record says that it did. If the field still doesn't hold exactly the text, the step fails before anything is clicked, naming what the field holds and what took focus. Before, the rest of the text was lost silently and the step went on to submit a shortened value.
+  
+  A failed action that knows what became of its submission can now say so: throw `KnownSubmissionError` with `{ outcome, detail }`. The run records this as the step's reconciliation (`source: "action"`) and reports the detail. It no longer says "whether its submission landed is unknown: reconcile the run" when the action already knows. The Notes reference lab uses this once its read-back has read Bulletin.
+- 6e37301: On a busy machine, a saved network whose chains are finalizing no longer fails to start with "Finality did not advance". The readiness wait now restarts every time a chain finalizes a block, so it gives up only when finality has stood still for the whole wait.
+- a633e37: Expose opt-in decoded call arguments alongside finalized extrinsic evidence so integrations can check what an app submitted without retaining payloads in ordinary block watches.
+- 2310078: A fork's first start no longer says it "could not read the live network": with no fork on the machine yet there is nothing to compare, and it says so. The bite phase says what it does and how long it can take ("copying the live network onto this machine (once; often 15 minutes or more; later starts resume in about a minute)").
+- b56175a: While a feature run is active in the lab, including the gaps between its steps and scenarios, a fixture save, restore, import, download, upgrade or rebuild from another client (the lab window, MCP or the CLI) is refused by name. Before, it could change the state the run's scenarios were using (backlog 204).
+- fe226ff: Ctrl-C during `product-lab fixture save` or `fixture run` stops the environment, a start in progress included; before, it printed "Stopping" and the start went on until a second Ctrl-C forced the exit.
+- b60cf1f: `PRODUCT_LAB_RUNNING_DIR` keeps the record of the lab running in a folder somewhere else. It is for labs that share one folder on purpose and never one chain or port, such as test fixtures. A person's lab leaves it unset, and a second lab window of the same folder still refuses to start.
+- b65c544: `product-lab fixture refresh` rebuilds a fixture built on another fixture (`from`) on that fixture's restored state, with its people bound, the way `fixture save` does. Before, it reset the environment and ran the setup with nobody bound (backlog 214).
+- 9ad7240: `product-lab fixture run <name>` keeps chain and people as `fixture save` does, so it restores a fixture saved on a kept start. Before, it started clean and refused with "the session keeps its identities in no directory, but the fixture saved …/kept/…", and on the fast local chain a clean start restored nothing. `LabRuntime.startFromFixture` takes `keep`. A fixture saved before a reset of the Paseo copy is refused before anything runs, with words that name the reset and say to save it again.
+- cbe8083: A fixture saved on another branch, which this checkout no longer declares, no longer breaks `product-lab fixture run` or the fixture list. It is listed as stale with "not declared here", and `product-lab fixture delete <name>` removes it (backlog 215).
+- 051fb72: A saved fork that resumes now waits until every chain's time reaches this machine's clock before it is ready. A chain still at the save's time made the truAPI CLI host's identity onboarding fail with `dotns.signedAt is older than the intake freshness bound (600s)`. If a chain has not caught up after 2 minutes, the start fails with `ChainClockBehindError`. The error names the chain and how far behind it is, and tells you to restart the network or start a fresh fork.
+- 626453c: A local copy of Paseo or Previewnet no longer refuses to start because another program briefly holds a port of its block that the copy does not use: before a first start only the ports the copy binds are checked, and its node ports are placed around busy ones. When a port it needs is taken, the refusal names what holds it, and says when the port lies in the range the operating system gives to outgoing connections. Starting a copy whose port block lies in that range (macOS 49152-65535) now prints a warning with a block below it.
+- 540aef5: A fork (paseo-fork, previewnet-fork) is ready only once its parachains build new blocks again after their nodes start, so onboarding no longer begins while the validators are still preparing the parachains and fail with "dotNS username did not appear on Asset Hub after attestation". A saved fork whose parachains wait like this while the relay chain keeps finalizing is no longer called stalled and restarted.
+- 7396ce4: Stopping a saved Engine fork now leaves a safer save point: the lab stops the collators first and waits until no parachain head has changed for 3 relay blocks and the last change is finalized (at most 2 minutes), then stops the validators. Before, a resumed fork could stop finalizing because validators lost the approval checks of candidates left unfinalized at the stop, and the lab had to restart it.
+- e243a40: A saved local network whose Engine tooling is gone (the cache it was created in was deleted or moved, or `PRODUCT_LAB_CACHE_DIR` now names another cache) is refused before anything starts, naming what is missing and the way out (that cache again, or `product-lab dev --refresh` for a new saved network, which discards its identities), instead of failing on the first process that cannot be spawned.
+- 4e21c36: The Notes example's publish step (`lab/steps/notes.ts`, `publishing`) now reads as four named calls, each with a one-line comment: `typeAndPublish`, `waitUntilAnnounced`, `readBackPublication` and `recordPublication`. Its read-back reads as `checkBulletinHolds`, `checkStatementStoreLists` and `stays`. What the step does and checks is unchanged.
+- 48110ff: Add an optional decision bridge and original review and permission logs to the shared browser host shell. The bridge requires deny-all defaults and denies confirmation, device and remote permission callbacks. Existing durable authorizations still need independent admission.
+- b4ff893: The process registry's once-a-second refresh no longer blocks the event loop: it reads the process table with an asynchronous `ps`, keeps at most one read in flight, and drops a read that a start, a stop or an on-demand refresh overtook. Five gate flakes are fixed at their causes, with no retries; a bound changed only where it measured something the test does not check, and the test says why: engine-owned-start counts timer ticks instead of timing them; the CLI `--browser` test waits for its line or the exit; the stock-app proof takes a settle time; of two card tests in an example, one starts the page's late navigation itself and the other gives a strict-mode refusal time to resolve. A sixth, found by this lane's own check, was in the Engine start tests: a starved test could read the stand-in's pid file before it was written, take pid 0 for the fetch and probe its own process group; the stand-in now writes pid files atomically and the probe refuses anything but a real pid. Record: docs/verification/2026-10-02-gate-flakes.md.
+- 12c4fd1: A lab directory that is not committed yet now has a source revision (git's empty tree, every file uncommitted) instead of none.
+- d4fb359: In the lab window, each greyed row's line to add to lab.config.ts (or the `export` to run) sits in a block of its own with its copy button beside it, and wraps between words only, so a name like `"paseo-next-v2"` is never split, even in a narrow panel.
+- ae34f23: The lab window shows what your lab.config.ts leaves off, greyed, with the line that turns each on: an environment turned off or not listed (Local copy of Previewnet, Chopsticks), a live network not listed, one with no people (read only), a person whose variable is not set here (with the `export` to run), a host turned off or dot.li, and modes when there are none. They appear in the Environments list, the chain picker, New identity's host menu and the Config view, which also marks each entry naming a variable as set or not set. Nothing is hidden.
+- ebb22c7: A command that exits while a helper it started is still finishing (tsx's esbuild service, for example) is no longer refused as having left processes behind on Linux: the lab gives the command's process group up to 2 seconds to empty by itself, and on Linux counts only live members, never zombies. A process that keeps running is still killed and reported.
+- cd3edeb: Closing the terminal that runs `product-lab` (or `bun run lab`) now stops the lab as Ctrl-C does: its window, its
+  people's sessions and its chains are stopped and nothing it started is left running. Before, the lab ended at once
+  and its chains, hosts and dev servers kept running until the next start.
+- 4f735be: An environment can hold its own background work for the length of a feature scenario and of a fixture save (`LabEnvironment.holdBackground`): each begins once background work under way has finished, and none starts until it ends.
+- 63e7281: Refresh the local truAPI CLI host to 0.25.0 and remove the Bulletin preimage backport now carried by that release. Keep the official host release unchanged.
+  
+  `bulletin-preimage-lookup` is no longer an accepted patch name; remove it from `hosts["truapi-cli"].patches` in existing lab configurations.
+  
+  Keep the installed host capability catalogue aligned with this retirement.
+- 0ade3fc: The host check reads Bulletin as well as People. A truAPI host stores a person's data on Bulletin with `TransactionStorage.store`, signed by the account it derives for the app's Bulletin storage (`//allowance//bulletin//<product>`, RFC-0010), with no signing request from the app. The check now reads every chain the lab connected (`LabEnvironment.landingChains`), and the truAPI CLI host reports that account as one it signs with (`session.resourceAccounts()`, `signs: true`). A store it signs is credited to that app as the host's own, so a clean Notes run still reads "Nothing went around the host". A store signed by any other account, such as a key the app holds itself, is still unexplained, and strict mode still fails on it.
+- fa13d9b: A host-bypass report no longer shows an app as `incomplete` with no reason. An app that is incomplete only because of the run's evidence gaps, extrinsics that are not fully decoded, or an environment with no declared scope now carries one line saying which, for example `Incomplete because 1 finalized extrinsic is not fully decoded: people #7 index 2: …`. The line is dropped when a later reconciliation leaves nothing incomplete.
+- 6e5feaf: The Notes example's clean host-check scenario runs only where the host check can be complete (the truAPI CLI host). On
+  the WASM hosts, which return no signatures, it is skipped and shown greyed with the reason, so the suite passes there.
+- 72e0637: The Notes example has a negative control for the lab's host check: on a local dev chain, the app's page sends a remark
+  straight to the People node instead of through its host, and the host check must find it (`truapi-cli`, `truapi-wasm`
+  and the new `truapi-wasm-open` choice, the WASM host with its network open). A clean control publishes through the host.
+- 33e84c2: The host check no longer marks a clean run as incomplete because of the host's own traffic. On truAPI WASM, an unclassified call on the host page's own chain connection is the host's business, not the app's. On the desktop host, an app socket that the page's own browser session saw is now credited to that page when it has no other frame, instead of being reported as "Chromium did not expose the owning page/frame".
+- 43bc9ce: A lab can give each declared host a one-line `description` (`hosts: { "truapi-cli-deny": { kind, description, options } }`). New identity's host menu shows it under the host, and a host without one shows its adapter's name.
+- 318717b: The truAPI CLI host's local-network check now accepts the routing echo from the upcoming host release with the fork and local-network work (host-rust-core #1454), which spells its format version `schema_version`. Before, the lab read only `schemaVersion`, so a host from that release would have been refused at launch ("Host did not confirm the complete local routing contract") and its capability probe would have said it cannot route to a local network. Hosts that print `schemaVersion` still pass; an echo with both spellings, or with anything but the complete routing, is still refused.
+- 1ba38bc: In the Notes example, a publish that the truAPI host reports as failed with "Could not instantiate a client at the required block … Invalid block hash (-32801)" now says what happened. The note's upload went into the finalized Bulletin block it names, then the host lost that block on its block subscription and told the app the upload failed. The step names the block, says the cause is the host's (its subxt client), not the app's or the chain's, and declares the upload included, which the run records as what became of the step's submission.
+- 946dfec: The panel's New identity host menu stays open while the lab's state changes; only a change to the lab's hosts closes it.
+- 3e89810: Three generic sentences for a host that locks the network: `{actor}'s app requests {string}` (the app requests the address from its own document; `<app>` is its origin), `{actor}'s host blocked and recorded {string}` (fails `not-blocked`) and `{actor}'s host reached only declared endpoints` (fails `undeclared-endpoint`, or `observation-incomplete` when the lab cannot see what it reached). A host that does not report its network fails them as `unsupported-here`. They work in the lab window's tiles too.
+- f99b0d9: The desktop host (`truapi-cli`) can log what it does in detail, for a run where you need it: set `PRODUCT_LAB_HOST_RUST_LOG` (a `RUST_LOG` filter, for example `info,subxt=debug` to see its chain connections), or give a host `options: { rustLog }`. The host writes it to the session's host log. Off by default: hosts still get no `RUST_LOG` from your shell.
+- 4073526: Hand a host's polkadot-api 2.x signer its signed extensions in the order the chain's runtime declares them. polkadot-api 3 adds them in its own order, and a host that builds a V4 transaction writes them in the order it receives them: on Asset Hub (no `VerifyMultiSignature`) the signed transaction could not be read and failed with `innerDecoder is not a function`. This fixes `toTxCreator` for 2.x signers and the minimal starter's signer bridge, which now also needs `@polkadot-api/substrate-bindings` (its install command lists it).
+- fb7ff88: Ready for truAPI hosts newer than 0.23.0. Onboarding a new identity (`truapiCliProvisioner`) now works on a host built from host-rust-core after #1124, which removed `--lite-username-prefix`: the lab reads which flags `signing-host` offers and passes `--session <prefix>` alone there, both flags on 0.23.0 as before. `PRODUCT_LAB_HOST_BIN` together with a resolved `host:truapi-cli` in a lab's versions is now an error naming both, instead of the override being silently ignored.
+- 3612d28: In the lab window, a feature that makes a new person on the truAPI WASM host no longer fails its first step with "locator.waitFor: Timeout 10000ms exceeded" when the view does not show that person's tile.
+- 9b704a6: Hostile apps in the lab window no longer asks for `PRODUCT_LAB_BASELINE`. It runs on the lab's own chain: the running local environment, or, when none runs, the lab's default one, started for the run and stopped after. It offers the hosts to test as a menu instead of asking for a targets module, and says in one sentence that it tests the host, not your app. `product-lab host verify` takes `--environment <name>` to do the same from a terminal, which is the command the Tools page shows. Without `PRODUCT_LAB_PORT_BASE`, the repository's host targets take a free port block from 40000 instead of the fixed 13500.
+- 4c61d6b: Hostile apps no longer says "got through" when the host never reached the chain. If the app cannot get the chain through its host, `hostile-chain-bypass` is now inconclusive ("the host never connected to people within 120 s", with the probe's reason) in `product-lab host verify`, in the window's Hostile apps report and in MCP `host_verify`. An inconclusive result does not conform. An app that reaches the chain node directly still fails, whether or not the host reached the chain.
+- 5494236: The two stock hosts are named "truAPI CLI" and "truAPI WASM" everywhere you read them: the lab window, the terminal app, the CLI's and the MCP server's words, and the docs (they were "Desktop host" and "In-browser host"). Their ids are unchanged, and a scenario that names a host by its old name (`on the "desktop" host`, `on the "in-browser" host`) still finds it: a host adapter can declare the names its hosts went by before (`HostAdapterFactory.formerNames`), which no view shows.
+- b640ee4: The lab window follows feature-file saves in a lab that declares no feature globs (it watches its own folder; until now such a watch reported nothing), and a save made while the window was opening. Starting a feature run reads the list again first, so the window shows the tags and description of the file it runs.
+- 7ec2ce9: Each identity in the lab's snapshot now says which host it is on, when the host knows: `ActorSession.host` is
+  `{ id, label }`, for example `{ id: "truapi-cli", label: "CLI" }` or `{ id: "truapi-wasm", label: "WASM" }`. A host
+  adapter names its short label with the optional `HostProvider.label`; without one, the identity's host stays unknown.
+  Custom environments can fill it with `actorHost(provider)`.
+- d208201: Deleting a person says what is lost before anything is removed, in the lab window and the terminal app alike: their keys and the lab's data go for good, what they did on chain stays but no one can act as them again, and while people are kept between starts, that they will not come back at the next start. Every removal reaches the environment with where it was asked (the window, the terminal app, a scenario's own cleanup) and why (`LabEnvironment.deleteActor(id, removal)`, `ActorRemoval`); the Notes example records it in its run's timeline (`actor-removed`), so a person missing after a restart has a recorded cause. `bun run e2e:keep` in examples/notes checks live that a truAPI WASM person comes back after a keep restart and a deleted one does not.
+- fbf16dc: In the lab window, an (i) explanation opens where it can be read whole: near the panel's edge it moves back inside, opens above the (i) when there is more room there, and widens in a short panel docked at the bottom. The chain-day (i) in the Environment view was cut off at the panel's right edge.
+- 20472af: `product-lab init` writes the new layout: a `lab.config.ts` with only what is about the app (its steps, its chains, its own dev server), `lab/steps/<id>.ts` with `defineSteps`, and `lab/features/first.feature`.
+- bb3c311: The paused run's inspection reads cleanly: headings in sentence case, step text in “typographic quotes” (no more nested quotes, also in breakpoint reasons), and Continue, Step and Cancel only in the dock.
+- 32b7ba0: A step set can declare its own panel scenarios (`defineSteps({ scenarios })`): inputs, several steps and several people, listed in the lab window and MCP's `run_scenario` under any session, the lab's default session included. Each step gets what an action gets in a feature step: the lab's readers, the person's resource accounts (another person's by role) and the step's readings and writes. The one-step scenario of every action now gets the readers and resource accounts too.
+- fcd3094: An owned Engine fork with isolation (the default) no longer starts when Engine's IPFS repository does not exist yet: before, Engine's start created a default one after the lab's isolation step, listening on every interface. `bun run setup` now runs Engine's fetch, which creates it.
+- 6f77f63: A run whose `@isolated` scenario fails no longer leaves the local network running after it ends. Before, giving the scenario's start state back could outlast the end hook's five minutes, for example after a step that timed out. The run then stopped its environment, and the give-back started the network again with nothing owning it: the command did not exit, and the next run found its ports taken. The run's stop now waits for that end as it already waits for a fixture restore. A stop that a person asks for still waits only a few seconds.
+- 683af25: An `@isolated` scenario now runs in Watch mode in the lab window: its save and restore no longer make the run's identities "stale" at the first step. A new environment session that a fixture save or restore opens continues the run's (`environmentLineage` in the lab snapshot); a start, switch or reset still ends it.
+- 859f308: A new setting, "Keep each fork run's starting state" (off by default), saves the state a fork scenario starts on, so Reproduce can rebuild a failed fork run. It adds about a minute to each fork scenario's start, and the lab keeps the last 5. With the setting off, a fork run's "Reproduce: not available. Why?" says its starting state was not kept and offers to turn the setting on or to choose a fixture. `product-lab reproduce` names the same way on: turn the setting on and run again, or tag the scenario with a fixture.
+- 2fc1fca: The Notes example's "Keep chain and people between starts" people line now says that only a person on the Desktop host keeps their app's storage between starts; the In-browser host keeps none. With the In-browser host as the lab's host, the line says each start makes new people and how to keep them.
+- 7f7ca80: A chain kept between starts whose clock has run onto a later day than the wall clock (a local fast chain moves its clock 12 s per block) is no longer started: claims and new people would fail there ("NotAvailable", "UnableToSign"). The start says so, naming both clocks, and tells you how to start clean.
+- a1a7c57: The AI kit's Notes reference carries the custom RPC and public deploy changes together.
+- ba5ec63: The AI kit's Notes reference now includes the previewnet fork and the live read-only environments (`lab/previewnet-fork.ts`, `lab/live-networks.ts`).
+- 31765c1: The AI kit's two complete labs (`references/minimal-lab.md` in the product-lab-setup skill and `references/notes-lab.md` in the product-lab-integration skill) are now written from product-lab's examples when the package is packed, so the copy `product-lab ai init` installs always matches the release it came with. A package without them is refused before it is published.
+- ba348e9: The Notes and minimal labs shipped in the AI kit's references now run a product's people on the released truAPI WASM test host: their default host and their modes' hosts are changed for a product. A product no longer has to add `defaultHost: "truapi-wasm"` after copying them. The Notes reference now ships its `two-writers` fixture with the fixture's setup feature, and leaves out Notes' three other fixtures, whose setups it never shipped. It no longer ships Notes' `app/vite.config.ts`, which a product copying the reference beside its own app could have copied over its own: the reference says to keep the app's own dev server configuration.
+- f851fda: Commands in a repository without the product-lab AI kit no longer load the kit to compare it with the installed package; they only look for the kit's record, as before.
+- 85c9209: `checks.accessibility.ignore` is applied: findings of the rules it lists never fail a step. They are still scanned and kept with the step's evidence, and the step's notes count them. A rule may not be both run (`rules`) and ignored.
+- 66746a5: `product-lab config` names an adapter by its label ("Local dev chain (Omni Node)"), never its code id, also for `advanced.environmentAdapters` and `advanced.hostAdapters`. Each environment keeps its run folders under `.product-lab/environments` (or `PRODUCT_LAB_OUTPUT_DIR`), Chopsticks' included, so a config needs no `environmentAdapters` for them; an adapter setting under `advanced` (a Chopsticks `bin`) keeps the lab's folder.
+- 794cd0f: `product-lab check` no longer lists the `lab.lock.json` entries an environment lacks when no app of the lab can run there. Each app's "unavailable" line says why. Such an environment still cannot start.
+- 5ee7957: The function form of `defineLab` may be async, and its context offers `claimPorts(size)`: a block for what the config runs itself, from the lab's ports like the window's (a slice of `ports` or `PRODUCT_LAB_PORTS`, else a claimed block in 20000-32699, the same on every load). A claimed block may be wider than 100 ports. Notes takes its 500-port block this way (no more fixed 13000-13499), and its window and session ports are the lab's own claim.
+- a393c3f: "the contract … returns N from …" fails with the reason `not-on-chain` when the contract returns another number, so a negative control that expects that reason matches it.
+- 82dd27f: The default session launches its browser with the network policy's resolver backstop when a declared host denies by default. Before this, a person on the network-locked truAPI WASM host (on by default in the product config) was refused with "deny-by-default needs the browser launched with the network policy's resolver backstop".
+- 787e7bb: A fixture rebuilt on a kept chain holds only the identities its setup made (and the base fixture's it is bound to), never the people an earlier start kept, so running a fixture control twice no longer fails with two identities of one name.
+- 1a0b0df: A product config's lab says what keeping keeps of its people: each person and their wallet when the default host is the truAPI CLI host, else that each start makes new people and how to keep them (the lab window's switch and `product-lab dev` show it). Notes keeps people and runs workers through the lab's own (no `advanced.keepBetweenStarts`; `advanced.workers` only for named blocks or per-worker caches).
+- a191b7a: A mode, and `defaultEnvironment`, can name an environment your config brings under `advanced.environments`: `defineLab` infers its keys, so `modes: { merge: { environment: "local" } }` type-checks when `advanced.environments.local` exists, and a name that is neither the lab's nor yours is still a type error. In the function form, write the arrow with its `context` parameter so the names are inferred.
+- 88f2070: The one-time move of state saved under an old environment name prints its notice on stderr, so `--json` output (`product-lab config --json`, `lint --json`, `test --json`) stays valid JSON on the first run after upgrading.
+- a393c3f: `defineLab({ app, … })` runs: the lab works out the rest from your app. `app.steps` names the app (a list: the first set is the app's, the others are offered beside it). The lab offers `fast` (People and the app's chains on this machine, Omni Node) and `paseo-copy`, plus `previewnet-copy`, `chopsticks` and `live.<network>` when you list them. `false` turns one off. A live network without `people` is read only. Its `people` sign with the phrase in the variable you name, and `newPeople.fund` ("5 PAS") is paid on the app's first chain. Both truAPI hosts are on (the CLI with the local network patch, WASM network locked), and dot.li is off unless listed. `advanced` takes any field of the full definition, merged over what the lab worked out.
+  
+  The lab's registry carries the config as it runs: every value, where it came from (yours, the lab's default, detected, advanced) and the line that changes it, with no environment started. It shows a secret's variable name, never its value. `modes` are kept as written. `labDefinitionFrom(config, { root, env })` from `@product-lab/composition` gives the definition the lab runs.
+  
+  A lab that declares no ports claims a free block of 100 between 20000 and 32699 (a lock file per block, released when the process ends), so labs side by side never collide. The truAPI CLI and WASM hosts take their ports from it when none are given. `ports: { from, to }` and `PRODUCT_LAB_PORTS=<from>-<to>` still override it. The older `defineLab({ apps, environments, … })` shape works as before.
+  
+  Without `app.devServer` the lab reads the dev server from `app/package.json`: Vite, Next (webpack App Router or Turbopack) or webpack-dev-server, on the port it gives and loopback only. A declared bare command (`vite`) runs the app's own copy. Fixtures without `inputs` are rebuilt when `app/src/**`, `app/index.html` or `lab/**` change. `rootCalls` are allowed on local copies only, signed with the copy's sudo key. `product-lab test --workers <n>` works with no declaration: each worker gets its own folder (`PRODUCT_LAB_OUTPUT_DIR`) and its own ports. Secrets sign outside the runtime too (Sr25519 keys).
+  
+  The lab window and its sessions take ports the lab claims when your config names none: a block of their own, kept for the whole run, instead of port 5202 and the shared 40000-40999.
+  
+  `versions: { runtime, hosts }` ("locked" or "latest") sets the version policy for the lab's runtimes and hosts. Where each one is published is declared for you, so a mode or a suite row can ask for the latest. `keepBetweenStarts: false` turns off the lab window's keeping by default. `--keep` still keeps.
+  
+  The local dev chain (`fast`) also runs on ports the lab claims, apart from the window's. A reopened lab gets the same ports again (the claim starts from the lab's folder), so its kept chain and people are where it left them.
+  
+  On the local dev chain, an app whose chains include Bulletin, or whose requires name the Statement Store, gets new people who are persons on People: the lab recognises them, and stands in for the XCM to Bulletin. Nobody funds them, as on a real network. Other apps keep funded wallets, which are quicker to make. `product-lab config` shows which, as "detected".
+  
+  The config view says whether each secret's variable is set where the lab runs (never its value), and points every value you wrote at its line in `lab.config.ts`.
+  
+  `companions` declares apps beside yours that it opens in the same wallet (their own sentences, chains and requires). `devices` lists the devices the window and modes offer.
+  
+  `advancedWhy` says why each `advanced` field is needed. `product-lab config` shows it beside the field, and `product-lab lint` warns on one that names no `advanced` field. Under `advanced`, an app's or a host's fields merge into the ones the lab works out (so `advanced.hosts["truapi-cli"] = { aliases }` keeps its options). The Paseo and Previewnet copies also answer to their old `-light` and `-full` names.
+- c990387: Actions now get the lab's own readers (`context.readers`) and the person's resource accounts (`context.resourceAccounts()`), as checks do, so an action can read back what it stored with `statementReader`. On both actions and checks, `resourceAccounts("Bea")` gives another scenario actor's accounts by the name the feature uses; a name the scenario does not bind is refused by name. An action or check that acts as no actor gets no resource accounts.
+- eb15ed2: A negative control that did not run is no longer reported as "passed". When every scenario of a control is skipped (for example not for this chain, such as `@policy-1` on a chain with another policy), its verdict is `not-run`, "not run here: <why>". That is inconclusive, never a pass, and the run exits 3. `product-lab test --negative-control` with no path lists a control whose `@environment:`, `@live-network` or `@root-calls` tags rule out the run's environment as not for it, without starting it. It passes only when at least one control ran and every control that ran failed as intended; the others are listed as "not run here (not passed)".
+- bad4436: The minimal example the AI kit's setup skill refers to now declares `modes`: `merge` (fast, the truAPI CLI host, locked) and `nightly` (fast and the local copy of Paseo, both hosts, locked), run with `product-lab test --mode <name>`. latest-sdk and counter-contract declare the same, and each example has tests that plan both modes and refuse an undeclared one.
+- 4e0885e: `product-lab test --mode` no longer fails a row that passed because of a scenario tagged for another environment. A row now plans only the scenarios its run runs on its environment, by the same rule the run uses (`@environment:`, `@live-network`, `@root-calls`), so `--plan` shows what will run. Before, a feature tagged `@environment:live-next-v2` was counted in a `fast` row and reported as "planned but not reported by the run". A row whose selected scenarios all run elsewhere is shown as empty, with the reason.
+- 2c427b9: Modes take two more version choices and their own change scopes. `versions: ["locked", "latest", "runtime-latest", "hosts-latest"]` adds rows where only the runtimes, or only the row's own host, move to their latest release, so `hosts × versions` tells which upgrade breaks a run. `scopes: { "app/**": "@notes", "viewer/**": "@viewer" }` (with `onlyAffected`) runs only the scenarios tagged for the globs a change touches. A change to feature files only still runs just those files, and a change outside every glob still runs the whole mode. `hosts-latest` without a host, and `scopes` without `onlyAffected`, are refused with the reason.
+- eb0bfc1: `modes` in `lab.config.ts`: `product-lab test --mode <name>` runs one way to run the lab, its environments, hosts, versions (`locked`, `latest`) and devices (one row per combination), its tags, `onlyAffected` (a change to feature files runs only those files), `workers` (rows at once; one combination shared out by feature file) and `budget`. It reports like `--suite`, which keeps working. MCP `run_scenario` takes `mode` (and `row`).
+- e300b97: `statementReader` with `content: "bulletin"`: a content id that Bulletin does not return no longer refuses the whole statement. The entry is kept and the content id is listed in `unreadable` with why. Bytes that do not match their content id still refuse it. Refused statements now carry their expiry and proof result. Notes reads its store through the reader (`lab/on-chain.ts`).
+- ab6b90f: polkadot-omni-node's `latest` release now resolves. polkadot-sdk tags its releases `polkadot-stable2606-2`, which is not a dotted version, so the lab found no release to move to. A GitHub version source can now declare `order`: a pattern whose numbers rank the tags. With it, polkadot-omni-node's latest is the newest patch of the newest stable line (today `polkadot-stable2606-2`), not the most recently published release (a patch of an older line, which ships no omni-node binary), and never a release candidate.
+- 4fdfdd6: `statementReader({ topics, decode, content: "bulletin" })`: a check reads what an app stored for a person in the Statement Store by its topics and gets the decoded entries, newest first. The lab keeps an entry only when its proof verifies and it is signed by the person's statement account for the product. The lab derives that account itself from the identity it started the host with. With `content: "bulletin"`, each content id an entry names must also hold matching bytes on Bulletin. Everything refused comes back with why. `statementTopic(name)` hashes a topic. Checks get `resourceAccounts()`.
+- c66ddc8: A product config's lab selects every component its lab.lock.json pins, so `versions: ["locked", "latest"]` in a mode and `versions: { runtime, hosts }` resolve real components. A `latest` row moves each pinned component, and its own host, to its latest release. A host set to `locked` that the lock doesn't pin is no longer selected; it used to refuse every run as "not locked". A lock that is missing or pins nothing makes a `latest` row unsupported, with a message naming the lock. Mode `latest` rows now use the `latest-release` selector; before, they asked for `latest`, which is not a selector. polkadot-omni-node's release source (paritytech/polkadot-sdk) is new, checked against the repository's live release listing. The small examples' nightly modes run `latest` again.
+- 8f7bcbf: examples/notes: every negative control declares where and why it must fail by its tags (`@fails-with:<reason>`, `@fails-at-step-N`, `@runs-with:`), and Notes' own checks fail with `fail(reason, message)` (`not-on-chain`, `screen-mismatch`, People's `Resources.LongTermStorageAllocationFailed`); `NOTES_NEGATIVE_CONTROLS` is gone.
+- e45b73f: examples/notes: under the lab's default session the publish reads back what it wrote through the lab's readers as the host's statement account, and "{actor} sees {actor}'s note" reads the author's account by their role.
+- d43b5aa: The Notes example uses the new layout: its features live in `lab/features/`, and its live features in `lab/features/live/`. The AI kit's Notes reference names the new paths.
+- 2b30094: examples/notes: Notes' real sentences are `lab/steps/notes.ts` (`notes`, `defineSteps`); the planted lies the lab's own self-tests use are a second step set, `lab/self-test/steps.ts` (`labSelfTest`, id `lab-self-test`), with their features in `lab/features/self-test/` tagged `@lab-self-test`. The kit's Notes reference lists both files.
+- 9146c8a: examples/notes: each step asks one resolver what it works with (`lab/steps/context.ts`, `notesStep`): Notes' own lab while its own sessions run, the lab's default session's page, statement account, readers and stand-in for XCM otherwise.
+- 28291a5: The lab window has the bottom bar's Lab button on top of Run, Scenarios and Recordings as well. It opens the same Lab menu, just under it. In that menu, Environments (E) opens the whole Environment view (Start and Stop, chains, chain console, apps, environments, Advanced) in place of the tab's content, and any tab brings you back. The panel is no longer split by an Environment section above the tabs, and it reopens on the place you left it after a reload.
+- 57fde7e: The lab window keeps its place:
+  
+  - The panel keeps the width you chose (Panel size, or the handle) on every section. Before, a scenario's detail and the Timeline widened it to 760 px. The Builder, an editor in three columns, still takes the whole frame; its new "Back to the panel" gives your width back.
+  - The top bar says how the chosen scenario's last run ended ("last run passed", "last run failed as intended"), or "ready to run". Before, it read "not running" after a run had passed.
+  - Recordings sits apart from Watch | Background in the bottom bar: it opens your recorded runs and runs nothing.
+  - A run picked in History shows in Steps, Timeline and Evidence, with "A past run, picked in History" and "Back to the latest run".
+  - Opening a section, the Scenarios tab included, closes a scenario's detail and brings the library back.
+  - Run on a scenario while another run goes says so: "Publish a note is running", with "Stop it and run this one" (one click) and "Keep it running". Before, it selected the scenario and started nothing, silently. When nothing can start, it says why.
+- e1c3900: Moving around the lab window takes one click:
+  
+  - Run on a scenario while you look at a recording goes back to live and starts the run. Before, the recording stayed in front of the app the run drives.
+  - "Back to live" keeps the left panel open, on the section and at the size it had. Before, it closed the panel.
+  - A new run clears the failure line of the run before it. A failure that arrives after a newer run started no longer lands on the newer run. A negative control that failed as intended no longer shows a red failure line.
+  - A run started while the window lays out its people waits for the person's app to be shown, up to 5 s. Before, it refused with "The app frame … has no visible box".
+  - The (i) next to Recordings and on a replay opens its explanation when clicked. Before, it only said it on hover.
+- 434c530: The lab window now opens with each identity's cursor shown, so you can follow every click and keystroke; turn it off in Settings. Headless windows still open without it, and `--cursor` turns it on there.
+- 5a9591d: A headless lab window can open at a higher pixel ratio for sharp captures: `deviceScaleFactor` on `openLabWindow` and `startDev`, for example 2.
+- 314c5a1: The lab window opens as soon as its own panel is ready instead of waiting for every app tile to finish loading, so a slow first compile of an app's dev server no longer makes the window fail to open (it waited 22-26 s, and gave up after 30 s on a loaded machine).
+- c3e30f0: The lab window's Settings (Show cursor, cursor speed, theme) are now kept with the lab, in `.product-lab/settings.json`, so your choices come back the next time you open the lab window.
+- 7642b87: Every browser the lab launches now runs Chromium's synthetic camera and microphone, so no page in a lab run can prompt for or take your machine's own camera or microphone: a video call holding your camera can no longer fail a run, and a run no longer depends on your devices. This covers the lab window and every detached window, and every browser the Playwright adapter launches (`PlaywrightBrowser`, `PlaywrightBrowserLauncher`, the browsers a lab's sessions get); nothing turns it off. `--synthetic-media` is still accepted and changes nothing; `openLabWindow` no longer takes `syntheticMedia`. Recordings label the window's frames `synthetic`.
+- 498d3d7: The lab window shows a person on the WASM test host. Their tile is their host page, with the app inside it, so Watch runs act on the app and screen checks read it. The tile says "network open" when the host's deny-by-default policy cannot apply in the shared window, and closing the window moves the session back to a headless page.
+- 3ab07ba: The lab's check after a failed step reads every chain the lab connected for the environment, not only the chains the lab's sessions answer for: a failed run on people-fast that stored on Bulletin no longer says "The environment has no chain bulletin to read (it has people)" (`LabEnvironment.landingChains`).
+- b044c1b: An owned Engine fork can be laid out for a smaller machine: engine.json `forkTopology: "light"` runs 4 relay validators instead of 6, Asset Hub on one core (6 s blocks, no elastic scaling) instead of three, and one PVF worker of each kind per validator. A light fork keeps its own Engine workspace and bundle, bitten from the live network on its first start, because Engine publishes only its own layout; it offers `--update-runtime` but not `--refresh`. The default (`faithful`) is unchanged.
+- 859b28b: `openLabWindow` takes a `launch` option, the function that opens the window's browser (default: Chromium's own launch), so a test can open the lab window in a fixed locale and time zone. Nothing changes for a window opened without it.
+- 5016b75: Hints and messages name the local dev chain by what you write in lab.config.ts: `environments: { fast: { pace: "real-time" } }` for real-time blocks, `environments: { fast: {} }` to turn it on, and "the local dev chain" instead of "relay-less".
+- b53b2c6: Allow an explicitly routed persisted CLI wallet to serve a canonical localhost product binding, while retaining namespace checks for DotNS products.
+- fd52c9b: Reproduce no longer calls the same failure "failed differently" because its error names something generated for that run, such as a Notes note's text.
+- 7981643: `product-lab mcp` answers its client in well under a second: it answers `initialize` and the tool, prompt and resource lists before it loads your lab's runtime, and loads it in the background; a tool call made meanwhile waits for it. Before, it loaded everything first (twice), which took 3 to 14 s on a busy machine, and Codex, which drops a server that has not answered in 10 s, showed no product-lab tools. The first tool call is faster too: the runtime loads once, not twice.
+- df2a10d: A feature run started through the MCP server (`run_scenario` with `feature`, `run_report`) now reports its result when no environment runs in the server itself, the usual case: its Cucumber process starts and stops its own. Since 6 October such a report answered "No environment is running" in place of the run's scenarios and their errors.
+- a2356a2: `product-lab mcp` uses `@modelcontextprotocol/sdk` 1.32.1 (was 1.30.1), which fixes GHSA-6qxp-vccf-f47h: the SDK's OAuth client could send credentials to an authorization server chosen by the MCP server.
+- 079f778: When a step fails, the lab's check of what it sent now reads a block's runtime metadata a second time if the first read fails. If both reads fail, the message says why ("the runtime at 0x…, read twice: <error>") instead of only "runtime metadata unavailable" (backlog 217).
+- 6e564d1: `product-lab test --negative-control` with no feature path now runs every negative control your `lab.config.ts` declares in `negativeControls`, one run each, and prints `Negative controls: N of M failed as intended` with the ones that did not. It exits 0 only when every control failed at its declared step for its declared reason, so you no longer need a script of your own to run them.
+  
+  A pre-onboarded actor now belongs to the environments where its secret has a source. With `secrets: { "ada-wallet": { "live-next-v2": fromEnv("MY_ADA_MNEMONIC") } }`, Ada is opened from that phrase on `live-next-v2` and created as a new actor on every other environment, so one `lab.config.ts` can hold both your local chains and a live network. Until the variable is set, the live environment is greyed in the chain picker and its start is refused, with a message that names the variable and says to add it to `.env`.
+  
+  In the lab window's environment picker, an environment that cannot start is now greyed like an unconfigured one, with its "can't start" chip and the reason as its tooltip.
+- c38f3a3: See the config the lab runs with, and where each value came from: `product-lab config [<group or key>] [--json]`, the lab window's Config view (Lab menu, More, Config) and MCP `lab_describe` section `resolvedConfig` show every value as yours (written in lab.config.ts), the lab's default (with why), detected from your app, or advanced, with the line in lab.config.ts that changes it. A value from a secret shows its variable's name only. The fast local chain is called "Local dev chain (Omni Node)" wherever you read it (it was "relay-less"); saving a fixture on a chain that is not kept says to run with --keep, or turn on Keep chain and people between starts. `defineSteps` is the name for declaring your product's steps (`defineIntegration` still works, marked deprecated). In lab.config.ts, an environment, live network, host or mode environment name that is not one of the lab's is a type error.
+- 6008a83: The `@negative-control` tag now decides whether a feature file is a negative control. Before, a file kept showing "expected to fail" after you removed the tag, because its `features/controls/` folder or its `negativeControls` entry in `lab.config.ts` was enough. Now a file without the tag runs as a normal scenario everywhere: in the lab window (its chip and the Negative controls filter), the terminal app, `product-lab test` and MCP `run_negative_controls`. The `lab.config.ts` entry only gives a tagged file the step and the reason it must fail with. When the tag and the entry disagree, the scenario's row shows a warning and its detail explains what to change. A tagged file without an entry gets the exact line to add.
+- 9c3f906: Negative controls are declared by their tags only. `negativeControls` in lab.config.ts is gone: it no longer typechecks, and a lab that still lists it is refused, naming the tags to write instead (`@negative-control`, `@fails-at-step-N`, `@fails-with:<reason>`). `product-lab test --expect-step`/`--expect-marker` and the `expectations` argument of MCP `run_negative_controls` are refused the same way, and the lab window no longer shows the "move to tags" warning.
+- 07225f0: A failed run never blocks the lab. When a failed step may have sent a transaction, the lab checks the chain by itself in the background. It adds the answer to the failed step and to the run's failure message: it did send, nothing was sent, or it cannot tell and why.
+  
+  The next scenario starts at once in the panel, the CLI and MCP. Reconcile is gone: the `reconcile_run` MCP tool, the Reconcile banner, step line, dock button and status row, and the "uncertain mutations" block.
+  
+  While the check is pending, a run that would act as the same identity, or use what the step still holds, is refused with the reason; it is never queued. A pool reading that a new block interrupted is read again before the lab says it cannot tell. Only the environment itself can still stop runs: setup or cleanup failed, or it lost its chain. Then the lab says so plainly and offers Reset.
+- 97234a0: A scenario that introduces several new actors in a row ("Given Ada is a new actor / And Grace is a new actor") now creates them all at once when its environment allows it, instead of one per step. Each step still waits only for its own actor, and a failure names the actor that failed.
+- e0f36c7: New identity's host menu shows each host as a card with its options as small switches inside it, lined up under the host's name; hovering an option shows why you would turn it on. The picked host's card is highlighted (the default one, until you touch another host's switch); the other hosts' options are greyed but still shown and usable. Each host's button has an id, `#new-identity-on-<host id>`, for tests. The menu fits the panel at its narrowest.
+- 4eb2f5a: New identity in the lab window lets you choose the host when your lab declares several: New identity creates on the default host, and its ▾ lists exactly the hosts your lab declares, with an unavailable one disabled and its reason. Each identity row shows its host (CLI, WASM), as its tile does. `snapshot().hosts` entries carry each host's short `label`.
+- 75647d5: In the lab window, a section is named once: the button on top of the tabs. Identities, Tools, Environments, Settings and the other sections no longer repeat their name in a heading under the tabs; the Lab menu on that button reaches every section, as the heading's own menu did.
+- 5c46fe4: The lab window no longer blinks while it updates. The steps, the chain picker, the bottom bar, the evidence, history,
+  timeline, Scenarios and Identities views change only what changed, in place: an open section, a scroll position or
+  the field you are typing in stays as it is, and creating an identity adds its row without redrawing the others.
+- 03b211d: The README and the setup skill no longer describe patched host releases as coming: none are planned. The host fixes the lab needs are proposed upstream, and the lab moves to the host releases that carry them; until then `bun run setup` builds the patched host locally.
+- debd1ef: The package no longer carries product-lab's `patches/` and `docs/` folders. What it read from them at run time now ships inside it: the truAPI CLI host's lock check and the names of the behaviours a release lacks, the Engine commit the lab tests, and the light fork's layout.
+  
+  A patched truAPI CLI host or a patched Engine can only be built from the product-lab repository, and an installed package now says so by name instead of failing on a missing file. Prepare a local copy of a network with stock Engine: `npx --no-install product-lab fetch --environment paseo-copy --no-engine-patch`. Without `--no-engine-patch`, `fetch` refuses and names that flag.
+  
+  The MCP server's `product-lab://docs/mcp` resource now serves a short guide of its own: the tools by group, the resources and the prompts. The design-section resources (`product-lab://docs/design/{section}`) are no longer listed outside product-lab's repository.
+- dfc20f4: The AI kit tells an assistant where runs happen: in the open lab window by default (`run_scenario`/`run_action` without `where`), asking "in the open lab or headless?" when the request does not say, headless when no window is open, with `lab_open` to start one. The Codex configuration `product-lab ai init` writes now gives the product-lab MCP server 60 s to start (`startup_timeout_sec`); Codex's default of 10 s dropped it without a word on a busy machine.
+- 03dd5cc: A scenario can now slow down or take offline an actor that it put on another host (`Grace is a new actor on the "…" host`, then `Grace goes offline`). The check before the run asks that actor's own host whether it can apply the condition, instead of the default host. An actor on a host that cannot apply it is refused by name before anything runs.
+- 1a0c514: In the lab window, a feature's `{actor} is a new actor` step now ends only once that person's tile shows the app ready (its declared `apps.<id>.ready` state; with the default, once its document has loaded), so a later step never conditions or acts on a tile that has not loaded. A check can read another actor's screen as the run shows it: `scenario.surface(role)` gives that actor's tile in the lab window (absent elsewhere, where the actor's own page is its screen).
+- fca048c: The Notes example has a scenario for the README's lab-window recording (`lab/features/media/`, tagged `@media`); its merge and nightly modes leave `@media` scenarios out.
+- 2469fa2: The Notes reference lab (`product-lab ai init`'s `notes-lab.md`) now reads a publish back: after the app reports a note announced, the publish step checks that Bulletin holds the text under that content id and that the author's index statement lists it with the signer the app named, and fails at the publish step naming the side that is missing. A saved Notes fork whose recorded port block differs from `NOTES_OWNED_FORK_PORT_BASE` now resumes on its own block when that block is free, with a notice; when it is busy, the start is refused naming both blocks, the ports in use, the saved folder and `--refresh`, and nothing saved is set aside or discarded.
+- 1b4ab49: The Notes example's app asks for room on Bulletin only when a publish says the person's allowance is used up. Before,
+  it asked once per page load, and each request takes one more slot by design. The host's own submit allocates the
+  allowance on first use. Records corrected after rechecking the upstream drafts: the host-lost-block and WASM-saved
+  records, backlog 190's lead, and the fork-speed record's withdrawn upstream item.
+- 72c24be: The AI kit's Notes reference names its launch in one word (`app: { launch }`) and lets the lab add what a launch needs, instead of working out its chains, requirements and dev server itself.
+- 4386c3a: The AI kit's Notes reference uses the lab's Chopsticks copy of the local dev chain (`environments: { chopsticks: { chains: ["people"], from: "fast" } }`) instead of its own, so its config brings no environment of its own. With an attached fork (`PRODUCT_LAB_FORK_ATTACH`), Notes' chopsticks now copies the local dev chain's People, as without one.
+- cebdb95: The AI kit's Notes reference uses the lab's own run folders and fixture source instead of declaring its own: `PRODUCT_LAB_OUTPUT_DIR` moves every run output (it replaces Notes' `NOTES_OUTPUT_DIR`, which a load through Notes' `lab.config.ts` still takes over once, with a warning), and the shared fixtures are `notes/` in `PRODUCT_LAB_SHARED_FIXTURES` (`NOTES_FIXTURE_SOURCE` is refused, naming it).
+- 8abbdb4: The AI kit's Notes reference reads this machine's inputs as the lab's own variables, and its copies of Paseo and Previewnet are the lab's. Notes' old names still work once, with a warning, and are refused beside a different value under the new name: `NOTES_OWNED_FORK_PORT_BASE` → `PRODUCT_LAB_FORK_PORT_BASE`, `NOTES_FORK_PORT_BASE` → `PRODUCT_LAB_FORK_ATTACH`, `NOTES_FORK_SNAPSHOT` → `PRODUCT_LAB_FORK_SNAPSHOT`, `NOTES_BASELINE` → `PRODUCT_LAB_BASELINE`, `NOTES_PEOPLE_NODE_LOG` → `PRODUCT_LAB_NODE_LOG` (now every node of the local dev chain), `NOTES_WORKER_CACHES` → `PRODUCT_LAB_WORKER_CACHES`, `NOTES_LIVE_ADA_ACCOUNT` → `PRODUCT_LAB_LIVE_ACCOUNTS` (`Ada=<SS58>`). While `PRODUCT_LAB_FORK_ATTACH` is set, `previewnet-copy` is refused instead of starting its own copy.
+- b99eff1: The AI kit's Notes reference is shorter: its `lab.config.ts` no longer carries the lab's own self-tests (they are an overlay, `lab/self-test/overlay.ts`, applied in one line) or the `notesLab` helper the tests build a lab with (now `tests/helpers/notes-lab.ts`). Nothing changes for your own lab.
+- 865ba61: The Notes example's unit tests no longer read your shell's `PRODUCT_LAB_*` and `NOTES_*` variables, so they pass whatever port base you set (backlog 207). `NOTES_WRITE_BUILT` still applies.
+- c059571: Safer and quieter version notices.
+  - Every command the CLI, the MCP server, the lab window, the AI kit and the docs tell you to run is now `npx --no-install product-lab …`. The unscoped `product-lab` on npm is not this package: without `--no-install`, npx in a directory without `@parity/product-lab` would download and run whatever is published under that name.
+  - A finished command no longer waits for a slow or silent registry: the daily version check is abandoned when the command is done, and that day's check is not used up.
+  - CI is also recognised by `CONTINUOUS_INTEGRATION`, `BUILD_NUMBER` and `RUN_ID` (an explicit `CI=false` still wins): no check, no notices.
+  - `product-lab upgrade` recognises pnpm refusing a version younger than its `minimumReleaseAge`, says when the version can be installed, and prints the commands to finish by hand.
+  - The MCP server reports the package's version to clients instead of `0.0.0`.
+- d913dc2: A product config names how hosts get the app in one word: `app: { launch: "dev" | "deployed-local" | "deployed" }`. The lab adds what the launch needs to the app's chains and requirements, and `product-lab config`, the lab window and MCP show the launch. A launch the lab's own session cannot do yet (deployed-local) is shown greyed with the line that gives it, and a start that asks for it is refused by name instead of serving the dev server. The resolved config has a new source, `machine`: a value read from this machine's variables.
+- 2a2a860: `environments: { chopsticks: { chains: ["people"], from: "fast" } }` gives a Chopsticks copy of the local dev chain: the lab starts those chains from the locked releases and copies them through Chopsticks, so a test of a copy needs no public network. Its ports sit inside the lab's block, beside the local dev chain's. A chain the local dev chain does not make is refused by name.
+- 2a2c290: The lab reads this machine's inputs itself, so a lab.config.ts names none: `CHOPSTICKS_BIN`, `PRODUCT_LAB_WORKER_CACHES` (one cache per worker of `product-lab test --workers`), `PRODUCT_LAB_BASELINE` (the local dev chain's People runtime and node from a prepared fast baseline), `PRODUCT_LAB_NODE_LOG` (log targets for the local dev chain's nodes) and `PRODUCT_LAB_LIVE_ACCOUNTS` (`Ada=<SS58 address>`: the account the host gives the app for a live person). Each is optional, shows in `product-lab config` with source `machine`, and is refused by name when wrong; an account that is not an SS58 address is never echoed. The local copies of Paseo and Previewnet keep their saved folders under the lab's output folder (a worker's own), on `PRODUCT_LAB_FORK_PORT_BASE`, else 1000 after `PRODUCT_LAB_PORT_BASE`, else 42000, each worker 1000 further on. `PRODUCT_LAB_FORK_ATTACH=<port>` makes the Paseo copy attach a fork already running on this machine.
+- 11fb31d: A product config can state how many ports its lab window and sessions need: `ports: { size: 500 }`. The lab takes exactly that many, from the top of `PRODUCT_LAB_PORTS` or a block it claims, and `product-lab config` shows the block (`500 ports: 48100-48599`). A range that cannot hold them is refused, naming the range, the size asked and what is left; before, a lab silently got at most half of what was left. The function form's `claimPorts(size)` is exact the same way. A config that states no size gets the ports it got before.
+- ab046f8: Environments go by the lab's names only: `fast`, `paseo-copy`, `previewnet-copy`, `chopsticks` and `live-<network>`. The pre-redesign ids (`people-fast`, `paseo-fork`, `paseo-fork-light`, `previewnet-fork`, `people-chopsticks`, `live-next-v2-write`) no longer start anything: `--environment people-fast` is refused, naming the lab's environments. Choose Light with `--environment paseo-copy --option light`. A lab may still declare its own `environmentAliases`.
+- 98562c7: `lab.config.ts` no longer takes the imperative `defineLab({ name, start })` shape: write the product config
+  (`defineLab({ app })`) or a lab definition (`environments` and `apps`). A config in the old shape fails to load and
+  says what to write instead.
+- a2432c6: `product-lab test --race` and `product-lab test --mutate` now run the same loops as the lab window's Tools page, so a fix to race hunting or test the tests lands in both. Their seeds, waits, printed lines and record files are unchanged: a seed printed before this release replays the same runs.
+- d99c5f3: A run started outside the lab window, by an agent over MCP or from the terminal app, now looks in the window as the same scenario started from the window's own Run. While it runs as two or more people the view switches to Grid, so every person in the run has a tile on screen, and when it ends the view you had comes back. Before, the window stayed on one person's tile.
+- 27ee3aa: A scenario started outside the lab window (by an agent over MCP or from the terminal app) now shows everyone in it side by side as soon as it involves two people, even when the window cannot tell from its Scenarios list which scenario is running. That covers a run of several feature files, a run selected by tags alone, or a name pattern such as one ending in `$`. Before, the window could stay on one person, and a step that checks another person's screen failed because that person's tile was not shown.
+- 3b20065: A scenario that an agent starts over MCP, or that you start from the terminal app, now plays in the lab window's tiles while the window is open, just like a run from the window's own Run. Each person types and reads in their own tile, and a step's network condition (for example "Grace goes offline") applies in that person's tile. Before this, such runs acted on hidden pages, so most tiles stayed still. With no lab window open, runs work as before.
+- 1801cf8: The package carries only the upstream patches it reads at run time (the truAPI CLI host's and Engine's). It no longer includes a product app's page patch or this repository's own install patches.
+- ac2bd70: `LICENSE` now carries Parity's copyright line, and the package's manifest names the files it carries (`files`) and no
+  longer has `homepage` or `bugs`. The README starts with the experimental-code disclaimer, has a quick start from
+  `npm install`, a section on custom panels, and Security and contribution sections. The lab window's "How to add one"
+  link for panels opens that README section on npm, and `product-lab init` and the AI kit no longer say the package is
+  not on npm.
+- 8e94b8c: A Playwright page can now apply per-identity conditions (`PlaywrightPage.conditions`): offline and throttled networks by routing, so the app keeps its local link to its host, and a slower CPU on Chromium. Condition sentences stay refused until a host offers them.
+- 85313b8: A tile's address shows the app's host and path without the scheme (the whole origin is its tooltip), and the selected identity's avatar has a plain ring, no glow.
+- 0a7f3c8: With the lab in its own window, the people's window says so in its stage header ("Lab detached").
+- 7bf2dd9: The lab's bottom bar offers each run state's controls: Pause and Stop while a run runs; Continue, Step and Stop while it is paused; Replay, Rerun and the evidence after a failure; the previous step, Play and the next step in a replay. Its line starts with the state in bold ("Paused after step 3 · your turn").
+- 9ee1e93: The lab's Environment and Identities views say each fact once: the Environment header drops the "local" and "healthy" chips its title and status already say (and an "unknown" keep chip), and an identity that is running shows a green dot rather than a "running" chip; the selected identity no longer carries a "Viewing" chip beside its outline.
+- 172ae24: The lab's design page (`/gallery.html`) shows the bottom bar, the stage header and the tiles in each state, and its colours are named for the Polkadot pink design. With nothing running, the stage header names the scenario a Run would start ("Launch reminder · not running").
+- 0318a0c: The lab's scenario library rows are one line, as the design draws them: "file.feature · 2 people · 4 steps · passed 14:02", with a chip only for what is not the usual (unavailable, variants, expected to fail). The people, inputs and tags are in the scenario's detail.
+- 1380591: The lab no longer floats a step caption over the acting person's app: the step running now is in the Run tab's steps, and its place ("Running step 3 of 7") in the bottom bar.
+- 65a1519: A phone tile in the lab now shows the app inside a phone frame (bezel and notch), centred in the tile. Each person's avatar is a filled circle in that person's own colour, on their tile too.
+- f1e53b5: The bottom bar follows the new design: the Lab button, the environment (its live dot, name and what it runs), then the
+  run's state in words. Who is shown is chosen from "3 people" over the people; a scenario is chosen in the Scenarios tab
+  (Run runs the selected one, named in its tooltip).
+- 0ad4f1e: The lab's buttons, segmented controls and search fields are outlined pills, its chips are outlined, and its cards have
+  softer corners, as in the new design; no grey fills and no dividers inside disclosures.
+- e1efb43: The lab window docks the lab beside the people on arrival, like DevTools: left by default, or bottom or right with the
+  buttons beside the logo; the choice is remembered. Docking never reloads the apps, so sessions and typed input are
+  kept. A header over the people says how many there are and has the grid and whole-stage buttons.
+- 8f22d41: The lab window's dotted grid covers the whole background, around the lab, the people and the bottom bar; the selected
+  person's tile has a plain 2 px pink border, with no glow.
+- d4f7fe4: The lab window's Environment view takes the new look: its title in the display font, flat outline cards and rows with no dividers or grey fills, and Start as the solid primary button.
+- f124a3a: The lab window's Identities view takes the new look: 12 px rows, the selected identity in a thin accent outline, a rounded row menu, and New identity as the solid primary button.
+- 9b449cd: The lab window's Lab menu takes the new look and gains one-key shortcuts: R for the current run, S for scenarios, P for recordings and replays, B for the builder, C for the chain console, E for environments and comma for Settings. Every other section stays under More. The new Settings view holds Show cursor, the cursor speed and the theme (dark, light, or following the system).
+- a45e56c: The lab window has no activity bar above the people any more. Each person's tile says in words what they are doing or
+  waiting for, the bottom bar shows "Running step 4 of 7 · 0:21" beside a spinner, and the chain heights are on the
+  environment button. The bottom right holds Watch, Background and Replay, then Run (or Pause), then Stop.
+- a6e026b: The lab can open in a window of its own, beside the window with the people (the fourth button beside the logo). Every
+  control works there and nothing reloads: the apps keep their sessions, and anything typed in the lab is kept. The choice
+  is remembered; closing that window, or choosing a docked position in it, docks the lab back where it was.
+- 72fb1f8: The lab window's replay takes the new look: a replay is marked by an info-coloured outline instead of dashed stripes, the recorded screen sits in a rounded tile, the step timeline uses pills with the selected step filled in pink, and a recorded step's evidence shows as flat cards whose colours follow the dark and light themes.
+- 0132c33: The lab window's run report (Evidence & reports) takes the new look: step rows and evidence on rounded outline rows with no dividers or grey fills, and a step's landing results outlined in their outcome's colour.
+- 96e8708: The lab panel is resized by dragging its edge toward the people, in every dock mode (or with the arrow keys once the
+  edge has focus); each mode's size is remembered, and a double-click gives the default back. The panel stays readable
+  and the people keep at least 40% of the window. Resizing never reloads the apps. The normal, wide and full sizes are in
+  the menu beside the dock buttons.
+- ec9583f: Running a scenario no longer closes the lab: Run opens the Run tab beside the people, with the run's steps.
+- c7cfa0a: The lab window's Run tab shows the run's steps in the new design: a status icon per step, who acted and how long it took on one line, and under the step being run (or the one you pick) what the actor's screen did and what the chain shows, each with its own status.
+- e3a2800: Each scenario in the library shows how its last run went: a coloured dot (green passed, red failed, yellow a negative
+  control) and "passed 14:02" after its details. Groups are headed by their folder; the play button is round, filled on
+  the selected scenario.
+- 4b6e37c: The selected row in the lab's lists (an environment, an identity) is a thin accent outline over a faint tint, as in
+  the new design.
+- 05b41b4: The lab's tables have no grey header fill, as in the new design.
+- 4345382: The lab panel has three tabs under its head: Run (the current run's steps, its timeline, past runs and evidence),
+  Scenarios (the library and the builder) and Recordings. Each tab remembers where you were in it; everything else is in
+  the Lab menu.
+- 23906f8: The lab window's tiles take the new design: the header shows the identity, the host it runs in (CLI or WASM) and its
+  device as pills; a condition strip under it shows the tile's network (online, offline with its seconds, or slow with
+  its delay and rate), the address bar and the pop-out. In dark and light; nothing went away.
+- 888dae1: The lab window takes the new design's colours (Polkadot pink for the main action and selection), fonts (Inter,
+  Unbounded, JetBrains Mono) and icons (Lucide), in dark and light. The fonts and icons are served by the lab itself,
+  so the window looks the same offline.
+- 44b7b0c: The scenario builder, the chain console and the Actions and Extensions tools take the lab window's new design: pill
+  controls, flat outlined cards with no grey fills, the scenario's name in the display face, and Lucide icons, in dark
+  and light. Nothing moved or went away.
+- af7c970: A replay's chain notes are compact: one line per chain ("people #161 → #173 · final", with when each block was observed in its tooltip) and one per transaction, long accounts and hashes shortened with the full text in a tooltip and a copy button; a transaction's block is no longer listed a second time.
+- 11d5134: A replay's chain observations wrap long account ids and hashes inside the panel instead of running past its edge.
+- f53f9c3: The replay says each thing once: one banner over the tiles carries "Read only" (with a lock), the step, the before/after switch, an (i) with when it was recorded and how it was captured, and the only Back to live. The panel lists the recorded steps without a second step-by-step block or explanatory paragraphs. A run blocked by uncertain mutations now shows one compact line, "Uncertain: step 1 may have changed the chain", with Reconcile and Reset; the full reason is its tooltip.
+- 98413cf: In a replay the lab's bottom bar shows Replay pressed and unfaded, with Watch and Background not pressed, as the design draws it.
+- aa3808d: The lab's Run tab heads a run with its scenario and where it is written ("team.feature:4"), as the design does, and says the run's state once: the steps and the bottom bar carry it (a run from History and a negative control's verdict keep their chip). The run's controls are the bottom bar's, except in the lab's own window. After a failure, the stage no longer repeats it in a chip.
+- 8030583: Step rows name who acts once: a step whose words already start with the actor's name shows the avatar alone, and the detail line under a step no longer repeats the name. The recorded runs list shows each run's status only, uses a 24-hour clock, and keeps where recordings are stored and for how long behind an (i) by its title.
+- 35fb12e: Settings picked in quick succession in the lab window (for example light, then system, then dark) are saved in the order they were picked, so the last pick is the one the lab keeps.
+- 9d0dece: The lab's stage header says what the apps are for right now: Watch while a watched run drives them, Hands on while a run is paused, the failed step after a failure, Read only in a replay.
+- f9fda10: The lab panel no longer repeats a run in its status lines: the busy notice shows outside the Run tab, and a failed run's own line is left to its steps and the bottom bar (the lab's own errors still show on every tab). The third person's colour is violet, as in the design, and the environment pill keeps its name whole.
+- 5bf1b13: A step row in the Run tab and in a replay shows a person's avatar only when the step is about that one person. A step about everyone or about the chain ("everyone sees …", "the chain advances") shows no avatar and no name before its words; the row's detail line still says who acted.
+- fe72e57: A tile's header in the lab is the person's name, avatar, host and device and one status dot; what the person is doing ("Acting · waiting for finality") is in the condition strip under it, in words. The run card drops its step, time and progress figures (the bottom bar has them), and the time waterfall has no grey fill.
+- 82eeef5: The lab's tiles keep their host and device names in the header down to 320 px wide, and the address shows the app's origin and path, as the design draws them. Watch | Background | Replay no longer fades while a run is on, and the bottom bar's words stay plain in every state.
+- 9ec9ee6: A visible fill no longer fails on a busy machine just because typing was slow. Each typed key now gets 300 ms beyond the typing delay (it was 50 ms), in a tile and in a detached window alike. Typing goes in runs of 16 keys, each with its own time, so a field whose page stops answering fails the fill within one run's time however long the text. When focus leaves the field, typing stops at the end of that run instead of sending the rest of the text elsewhere, and the fill refocuses the field once as before. A field inside a shadow root counts as focused, and a page that stops answering while the lab reads the field back fails the fill instead of holding it.
+- a961399: The scenario-writing skill (`product-lab ai init`'s `product-lab-scenario`) has a "Write steps in parallel" section: when to put independent people's steps `… at the same time`, when the order is the meaning (reads of another's writes, absence checks, shared state, conditions), that a part is one action or assertion with no table of its own, and an example.
+- 92cbbd0: The Paseo copy (`paseo-copy`, and any saved fork from `paseoCopy()`) can be reset while it keeps chain and people, so `product-lab fixture save <name> --fresh` and a `fixture refresh` rebuild start it from its first boot. Before, keeping its people turned Reset off: `--fresh` was always refused with "offers no reset", and a refresh rebuilt the fixture on the resumed chain. A reset makes a new generation with new people; the people kept with the old one stay in their folder and are never reopened on the new chain. An environment with no reset at all now says why when it refuses `--fresh`.
+- 9d2191c: When a run pauses, the Run tab shows the step it waits at with its details under it, instead of above the steps where they pushed the step out of view; scrolling a paused run no longer jumps back to the top.
+- 92e2dd5: A run refused because the same identity's earlier failed step is still being checked ("Run again in a few seconds") no longer stays on the lab window's status line after that check answers. The refusal is a typed `PendingCheckError` naming the identity, answered with 409 by the lab window's server.
+- f3e9a7b: The local dev chain's people are the framework's (`@product-lab/composition`, people-dev): `peopleDevGenesis` creates People's collections at genesis, `peopleOnboarding` makes each new actor a person (the truAPI CLI provisioner where an identity backend runs, else the lab attester, which now checks that People's sudo key is //Alice before it sends anything), and `standInForXcm` answers the Bulletin allowances a relay-less People cannot send over XCM; `xcmStandIn(environment).skipNext()` is the self-test's hook. Notes uses them instead of its own copies.
+- a4a6598: Keeping chain and people between starts is the framework's (`@product-lab/composition`, people-keep): `keptPeople` gives a kept start the folder of its environment and chain generation, the people saved there with their wallets, the truAPI CLI host's state in that folder, and discards a replaced generation's people; `SavedPeople` and `PeopleLifecycle` (Stop and Start of a person) come from Notes, which now uses them.
+- 9e5a545: Notes' negative control for the XCM stand-in fails its publish in plain words on the step ("Bulletin allowance was not
+  allocated: People could not deliver it, and nothing stood in for XCM"); People's own event
+  (`Resources.LongTermStorageAllocationFailed` for the account, at its block) is on the error's next line, which the lab
+  window keeps in the run's Details. The control's marker is the event's name.
+- f42e5b6: Hosts have plain names in the lab window: "Desktop host" (was "CLI") and "In-browser host" (was "WASM"). A lab can name each declared host itself with `hosts.<id>.label`, so variants of one kind read apart ("Desktop host, network locked").
+- 0d7cef6: The readable output of `product-lab test` now covers every kind of run:
+  - each row of `--suite` opens with its own line and ends in a line per row;
+  - each worker of `--workers` has its lines after its number, with a line per worker at the end;
+  - each run of `--race` ends with its result in words;
+  - runs started from the lab window log the same grouped lines.
+  
+  A failed step's error is said once, under the step: the summary repeats it only when no step showed it. Every kind of
+  run ends with a `Look at:` line, which also names the hosts' logs its failed runs kept. `--verbose` still prints each run as before, and the lines scripts read (each run's
+  `product-lab test …` line, the suite, workers and race lines) are unchanged.
+- 88ccc4a: `product-lab test`'s "What the lab saw" line keeps the reasons a refusal lists under it (up to three, then how many more), so "Scenario … cannot run; nothing ran:" no longer reads as a refusal without a reason.
+- e351f75: `product-lab test` prints a readable run. It opens with the versions and the environment's start, with their times. Each
+  scenario follows as a group: one line per step with its time and what it checked on the person's screen and on chain,
+  in the lab window's words (`screen ✓ · chain ✓ Bulletin #28`, or `chain: none` when a step checked nothing there). A
+  failed step shows the lab's own message, with no stack trace and long ids shortened. The end gives the result with
+  where it failed, the lab's answer, the host check in the window's words, and a last line of what to look at: the
+  report, the scenario's recording, and the lab's own log lines. Setup chatter and raw hashes stay in the run's log
+  (`cucumber.log`); `--verbose` prints the run as before. With `GITHUB_ACTIONS=true`, the start, each scenario and the
+  end are collapsible groups, and a failed step is an error annotation on its line of the feature file. The run's
+  summary line (`product-lab test <id>: passed; …`) and a negative control's verdict line are unchanged.
+- 3996525: The lab window explains itself in plain words:
+  
+  - Each identity says where it came from and when: "Opened when the lab started", "New identity, made at …", "Made by a run of …", "Came with the saved state …". Its tooltip says how to make one. A username shows only when there is one; it no longer reads "no username".
+  - New identity's menu lists hosts your lab could add but does not declare, greyed. Each one says what it is and which config line turns it on.
+  - A lab names its environments with `nameEnvironment(entry, { label, description })`, for example "Fast local chain: People and Bulletin" instead of "Relay-less people, bulletin". The bottom bar reads "People + Bulletin · on this machine". The environment card says "a new chain each start" or "thrown away when stopped".
+  - The scenario library's filters read "Several people", "Can run here" and "Quick set". The group of scenarios written in code is "Scenarios in the lab's code".
+  - A setting that does nothing right now is greyed, with the reason on its row.
+  - Every (i) opens its explanation when clicked, including the one beside Focus, Compare and Follow acting.
+- e983290: Recording a run no longer slows the lab window's input: each step's frames are cut from the window's capture in a worker thread, so a highlight hold or a cursor glide is not held up while a frame is decoded and encoded.
+- 37c719d: Update the minimal starter reference to polkadot-api 3.2.1, including its host signer bridge, required dependencies and standalone SDK compatibility override. Host signing and finalized chain checks keep their existing behavior.
+- 2385804: The chain history port has an optional `poolAwareNonce(account)`: the next nonce as the node counts it, including transactions still in its pool from any sender (`system_accountNextIndex`). `PapiChainAccess` implements it, and answers `undefined` on a node without the method. Use it when a setup signs from an account another process may also be using.
+- 376c086: Port blocks stay clear of the ports your OS hands to outgoing connections:
+  
+  - When a lab's ports reach into the OS's ephemeral range (macOS from 49152, Linux from 32768 by default), starting an environment prints one warning naming the block, the range and a base below it, in `product-lab lab` and `product-lab test` alike. Any port in that range can be taken by a browser tab or a WebSocket while the lab runs.
+  - "Cannot bind port N", and a chain's "refuses occupied port N", now say what holds the port, for example "held by node (pid 97474, listening)".
+  - Every example lab reads `PRODUCT_LAB_PORT_BASE` when its own `<NAME>_PORT_BASE` is unset. The default blocks are now below the ephemeral range: minimal 15000, counter-contract 16000, latest-sdk 17000 (Notes stays at 13000).
+- c2d8215: When a local fork's start loses a service process, the error now says how each one ended (an exit code, or the signal that killed it) and shows the last lines of its log. Before, it named only the log file, and a killed process read as "Exited with code 1" (backlog 197).
+- 7d1bedb: - An app whose Vite dev server the lab detects now gets `VITE_PRODUCT_ID` and `VITE_<CHAIN>_GENESIS`, as the lab's own Vite default always gave them; `product-lab config` shows them as detected. Before, an app detected from the `package.json` at the lab's root never learned its chain's genesis.
+  - A product's fixtures: on a host that keeps no person's state (the truAPI WASM test host, a product's only host today), `product-lab config` and `check` say up front that a fixture whose setup makes people cannot be saved, and why. Such a setup is refused before its first person is made, not after it ran. A fixture whose setup makes no people still builds and saves. The keep line no longer suggests the truAPI CLI host in a product.
+  - A scenario the lab refuses before anything runs (a step needs a host or capability the run lacks) is explained as `unsupported-here` or `scenario-refused`, no longer as a failed hook with advice to read the logs.
+  - A transaction the host approved and the chain refused as `Invalid / UnknownOrigin` is explained by its likely cause: the app forces `VerifyMultiSignature: Disabled`, so the truAPI WASM test host adds no signature.
+- c8c73ed: In a product, making a person on a local environment (an app that writes to the Statement Store or Bulletin) is now refused by name. The lab reads a new person's People member key with the truAPI CLI host, and no release of that host takes local endpoints yet (host-rust-core#1166). The refusal no longer suggests changing host. In `product-lab test`, a scenario whose every step was skipped now prints "skipped: not run" instead of "passed".
+- 7e017f3: A product is never told to build or fetch a patched host. `product-lab init` makes the released truAPI WASM test host the default (`defaultHost: "truapi-wasm"`). `doctor` checks that host, needs no Bun, and suggests only `npx --no-install product-lab fetch`. A missing truAPI CLI host now says it is not supported in a product yet, links the upstream change it waits for (host-rust-core#1166), and names the WASM test host to run instead. `host build`, `host rebase-check` and `host fetch --patches` are refused in a product. The AI kit, its references and the product docs say the same. The kit's AGENTS.md section no longer lists `PRODUCT_LAB_HOST_BIN`, and `ai init` no longer adds it to the variables Codex passes to the MCP server. A product never runs the truAPI CLI host, even when a patched one is already cached on the machine or `PRODUCT_LAB_HOST_BIN` names one.
+- ddc48bf: A read-only public environment offers no integration action to run.
+- 72a9297: On a public network the lab window disables Reset ("nothing resets") and, when read only, New identity, each saying why.
+- c86a35b: Groundwork for race hunting: a seeded race jitter (`RaceSeed`, `RaceJitter`) and a scheduler hook (`stepDelay`) that waits before a step to interleave actors differently, without ever reordering one actor's steps.
+- e8f77c2: The package's README is now a short introduction: what product-lab is, its status, a quick start, how to use it in a product (install, a lab, a scenario, the main commands), how it works, the examples, CI, releases and channels, contributing, security and the licence. The package's own READMEs describe the framework without naming any product. The longer material moved into the repository's documentation (the concepts and the command line pages).
+- 81dfffe: The Notes reference in the AI kit (`product-lab ai init`) now declares its negative controls so that they pass whoever plays the actor. Before, a control run in the lab window with the actor bound to an existing identity, such as "Person 1", was judged "failed for another reason" rather than "failed as intended", because its expected message named the actor ("Ada"). The two markers that named the actor now start after the name. The same applies to your own lab: a negative-control marker that should hold for any identity must not contain the identity's name.
+  
+  The lab window's control helpers (`@parity/product-lab/shell/controls`, used by scripts that drive the window) open a recording's replay by waiting for the replay banner over the tiles, where the redesigned window shows it.
+- eff1dc0: The lab window offers Reconcile wherever it says a failed run may have changed the chain: a banner over the run's steps says which steps, why the lab waits and what Reconcile does, and the failed step and the bottom bar carry the button too. While it reads the chain it says so; afterwards it says per step whether the transaction landed (with its block), did not land, or is still unknown and why, and whether the lab is free again. A step whose action already knows what it sent says that instead of offering Reconcile. Any status message that asks you to reconcile, reset or restart now has that button, a list that failed to load has Try again, and Restart confirms, then stops and starts the environment. The Shared activity lane names whose account a step held instead of its address, and each of its pills stays on one line with the full text on hover.
+- d94f771: Recordings of `product-lab test` runs now name their feature file, line, tags and fixture too, so a failing test run,
+  in CI or locally, can be bundled with `product-lab bundle <recording>` and rerun with `product-lab reproduce`.
+- 4ff35ac: A recording of a feature scenario now names its feature file, line, tags and the fixture it started from; recordings made before still open as before.
+- 3c989b3: A `product-lab test` scenario that fails in a custom `step()` or a hook is now recorded as failed, with the step and
+  its error, instead of passed, so it can be bundled and rerun like any other failure.
+- c3a221f: Recorded runs open while the environment is stopped, even when the last run ended just before the stop: the lab window no longer asks you to "Finish the active run" when nothing can be running.
+- 3285486: The lab stays responsive while it starts and stops processes: starting a tree, stopping one and waiting for it to exit no longer freeze the lab, its window or the MCP server for up to five seconds while the process table is read.
+- 368d9d4: The package names no private product or branch: a Chopsticks adapter comment and the core README say what they mean in general terms. Before a release, `tools/release/src/main.ts check` now refuses a package that names a private product, repository, branch or commit, ships a `docs/`, `patches/`, `examples/` or `test-support/` folder, holds an absolute path from the packing machine or a token, or whose files differ from the signed-off list in `tools/release/baseline/files.txt`. Each refusal names the file and the rule. Nothing is published.
+- 2b65a9d: A product that never installs `bulletin-deploy` now type-checks against the package without `skipLibCheck`. The
+  Bulletin deploy adapter's `BulletinDeployLibrary` is declared by what the adapter uses (the DotNS client and the
+  environment resolution) instead of as bulletin-deploy's module type, so the package's declarations no longer import
+  that optional peer. The release check refuses a package whose declarations import an optional peer.
+- f3e0a0d: The published `package.json` declares public access (`publishConfig.access` is `public`), so installing it needs no npm login. Nothing changes in how it installs or runs.
+- 3d2d4cf: Use the released truAPI CLI host 0.26.0 on local networks and follow its navigation requests. New labs now default to the CLI host. Backend onboarding uses the released host whenever it supplies local routing, including in the repository. Repository builds use the same base with request decisions, native signature evidence and bounded socket shutdown.
+- dd60420: A saved copy of Paseo or Previewnet, a kept local dev chain, kept people and a remembered Full/Light choice stored under an environment's old name (`paseo-fork`, `people-fast`, …) move to the new name (`paseo-copy`, `fast`, …) the first time the lab loads, with one line saying so, so nothing is rebuilt. A kept local dev chain takes the new name in its folder and its record, and one kept under `.product-lab/environments/relayless/` moves to `.product-lab/environments/`, where every lab now keeps it. When both names exist, nothing moves and the line says which one is used.
+- bb1102b: A recording's replay steps, plays, pauses and closes without redrawing its frames, evidence and scrubber; the builder's
+  run progress and state, a run's steps and the workspace's processes update in place.
+- d9451ef: A replay says once, behind its (i), that the apps had a synthetic camera and microphone, instead of a chip on every tile and another in the panel.
+- 7eef755: `report.html` reads in about one screen per scenario: each step's attachments are closed under a one-line summary
+  ("call trace: 1 call, 4 readings, 24 KB"), its screen and chain checks stay visible as one line each ("✓ chain,
+  Bulletin #24 (finalized): holds exactly that text"), errors and images stay visible, and passed hooks fold into one
+  line. The raw data is still in the report, one click away.
+- db08f0a: Reset stays available on a chain kept between starts: it asks first, says what it discards (the kept chain and each person by name), and starts a new chain. When Reset is off, its hover says the real reason (a public network, a running scenario or operation, or the environment's own reason) instead of "no reset owner".
+- eae2acf: A resource reads the lab's chains: `defineResource({ read({ services, actor, chains }) })` (and `watch`) get the same opened connection per chain that steps get, so a panel can show a balance or the finalized block with no connection of its own. Notes' account panel uses it under the default session.
+- 7432d30: The lab's check after a failed step now counts a People resource claim its host made for the identity's app (`AsResources`, no signer by design) as the step's transaction. On Notes a failed Publish is no longer answered "cannot tell" for that reason alone. When the lab cannot read whose a transaction is, it says in words how many it read and why the others could not be read.
+- 1de5c0d: When a lab run is killed before it can stop what it started (a forced exit, a crash), the next run now stops the chain node, host and app servers it left behind and says so ("Stopped people-node in …: left running by lab process 14816, which exited without stopping them"). Before, they kept running and the next run failed on their ports ("people node refuses occupied port 60060", "No free port in 60070-60070") until they were stopped by hand. Each started process records the lab process that started it; what a lab process still running started is left alone.
+- f0c5bc3: In the lab window, a lab panel opened just before a watched run now stays docked beside the people instead of sometimes closing when the run starts; in a phone-width window, where it covers the people, it still closes.
+- 9b0607f: The lab window no longer opens a `chrome://webrtc-internals` window beside it. The page the lab uses to watch WebRTC peers is now hidden. A visible browser that cannot hide it does not track WebRTC peers, and the host check says so.
+- 8f1a655: The lab window's run card counts every write a run caused, by who wrote it ("Writes: 5 · Ada's host 2 · Grace's host 2 · the lab 1"), not only the lab's own transactions; a lab transaction's row names the person it was for, and the Notes stand-in for XCM says "the person's host" with the account shortened.
+- 9cb431f: A test run's Cucumber process is told which fixtures its selected scenarios start from (`PRODUCT_LAB_RUN_FIXTURES`, each as `<fixture>@<environment>`) and how many scenarios name none (`PRODUCT_LAB_RUN_UNFIXTURED`). A lab's own Cucumber run can then restore them, or refuse them before its environment starts. The lab's product integration example uses this: its `product-lab test` now runs scenarios that start from a fixture on its own lab, each restoring its fixture, and refuses a run that mixes them with acceptance scenarios (backlogs 213, 193).
+- e4c5ae8: While a scenario runs, the lab window's Compare (Grid) view shows only the people in that run, so the lab's own idle identity (Person 1) no longer takes a tile beside them. It comes back when the run ends. This holds whether the run was started from the window, from the terminal app or by an agent over MCP.
+- 3b8663c: A local fast chain whose clock runs onto the next day while the lab is open (its blocks move the clock much faster than the wall clock) now stops the lab with a plain message naming both clocks, instead of later failing claims and new people with "NotAvailable" or "UnableToSign". Reset gives a new chain.
+- a9c1fc6: A lab's window now records itself per configuration file, not per folder. Two configurations in one folder (`lab.config.ts` and `lab.live.config.ts`) start side by side: the second prints "Another lab (<name>, <window>) is also running from this folder" instead of being refused. A second window of the same configuration is still refused, naming the first. The MCP server and `product-lab test` attach to the window of their own configuration.
+- cbbd4dd: Looking for a running lab window creates nothing. A start with refused flags, or with a configuration that does not exist, now says so instead of failing to create `.product-lab/running` in a folder that is not there.
+- a6b1b91: The lab window's Tools page can save an exploration's smallest failing scenario as one of the lab's feature files: "Save as a feature" writes it into the lab's features folder as `explored-seed-<seed>.feature` (never over a file already there), shows the saved file's first lines and opens it in Scenarios. It refuses, saying why, when the lab's features glob names a folder outside the lab's directory.
+- 78b1180: An identity your lab brought back from its workspace says so in Identities: "Saved, made 23:40; back at 06:12 · kept in .product-lab/…". Before, it read "Opened when the lab started", as if it were new. Its tooltip says how the lab keeps identities between starts.
+  
+  A saved chain state in the environment picker says what made it (its setup, on which fixture, or the running state saved as it was), when (a clock time and an age), how many identities it holds and where it is kept. In a narrow panel, an identity row puts its actions under its name, so the name, where it came from and its host are read whole.
+- 54cbdf4: The lab window's Scenarios library no longer redraws itself every second and a half: hovering, focusing or selecting a scenario now stays put while the lab is running.
+- 1fdd67f: A scenario that starts from a fixture (or is `@isolated`) gets up to 31 minutes to restore its start state, not 5. If a run still gives up on it, the run waits for the restore to finish before stopping its environment, so the network no longer comes back up after the run ends and the command exits (backlogs 216, 206).
+- 0077380: A screen check passes only on what a person can see: headless reads and waits now scroll their target into view and fail naming it off screen when it cannot be seen, as the lab window's do.
+- cccc93d: The lab reads a product's account from the truAPI CLI host with `signing-host --script` and no longer needs the product-account-read patch.
+- e2e742e: Use the released native PAPI 3 transaction creator and upstream transport retries without a local SDK patch. Use SDK host 0.29 and truAPI 0.26 for current examples, host probes and the generated minimal kit. The lab's product integration example follows SDK 0.40. Remove the global truAPI 0.23 downgrade; each upstream application keeps its own dependency lock.
+- 4a82e00: A second `bun run lab` (`product-lab dev`) of a lab that is already running in another terminal now stops before it
+  starts anything, in the same words as MCP `env_start`: "The lab window at http://127.0.0.1:13250 is already running
+  this lab (Notes, process 1234): starting here would start a second lab on the same kept chain and ports. Use that
+  window, or stop it (Ctrl-C in its terminal) and start again."
+- f667559: In the lab window, a switch (Focus / Compare / Follow acting, Watch / Background, the theme, cursor speed…) never wraps onto a second row: where its row does not fit, its buttons show their icons only, each named by its tooltip and for screen readers.
+- 1b153b6: The minimal lab reference (`minimal-lab.md`) now reads its remark back inside the send step. After the app reports `finalized`, the step waits until People's finalized chain shows `System.Remarked` from the actor with the text's hash, in a block after the click. If the chain does not hold the remark, the send step fails and names the chain, instead of a later check failing.
+- 2738947: Host sessions can open in a place the lab gives them, such as a lab-window tile: `HostSessionRequest.placement`, `HostCapabilities.placement`, and `placeSessions` on the lab runtime and environment. Without a placement nothing changes.
+- 74cba0c: Preparing a Paseo copy on a Mac without eturnal no longer fails at Engine's download step: the copy runs with the TURN relay off, as `bun run setup` and the first start already said.
+- 48110ff: Add an opt-in shared WASM browser shell that keeps one wallet and persistent host storage across canonical product frames. Existing WASM host sessions and defaults are unchanged.
+- fab4ef4: The Markdown the package carries no longer links files it does not carry, and one README written for the repository's contributors, `adapters/lab/module/README.md`, leaves the package (the client-bundle rule it states is in the package README's "Custom panels" and the panel README). In the 33 READMEs that change, the 562 links to files the package does not carry (the repository's `docs/`, layer READMEs and TypeScript sources) are rewritten. 32 now point at what the package carries (15 ports' `.d.ts`, the domain README's "Folders and exports", the MCP README's "Tools", the package README's "With an AI assistant", "When a check fails", "Commands" and "Custom panels", the scenario skill's "Negative controls" and the app skill's dev-server section). Citations of design and verification records are removed with their brackets and separators, as are the sentences and References items that only pointed at one. A sentence that also stated a fact keeps the fact in its own words, and the remaining links keep their words. The MCP README names the guide the running server serves, the resource `product-lab://docs/mcp`. The AI kit's minimal and Notes references no longer mention product-lab's repository. A release now refuses a shipped `.md` whose relative link the package does not carry or whose anchor matches no heading (rule `markdown-link`), and a kept README that is missing, lost a heading, or lost words of its own text (rule `markdown-keep`).
+- d406ff6: Forward only the selected runtime transaction-extension pipeline to legacy signers, preventing malformed transactions on runtimes with multiple pipelines. Refuse nonzero pipeline versions that the legacy signer interface cannot convey.
+- 38b3d63: `product-lab ai init` and `product-lab ai doctor` read Codex's `config.toml` with smol-toml 1.7.1 (was 1.6.1), which fixes GHSA-7w5x-hrqm-74c2: a malformed TOML document (a value in an array or inline table followed by a comment that ends the file, such as `a=[1 #`) made the parser loop forever, so the command hung. Valid files are read as before.
+- d78a017: `smol-toml` 1.9.0 (was 1.7.1), which `product-lab ai init` and `ai doctor` read Codex's TOML config with: it fixes a
+  quadratic-time parse on documents with many keys (GHSA-r4xh-jqrq-34v2, moderate) and a denial of service on malformed
+  documents (GHSA-7w5x-hrqm-74c2, high).
+- 099b4c3: The host check no longer sees a WebSocket without its handshake Origin when it reads the network evidence right after the socket opened: a socket the host opened could then be reported as unattributed.
+- 02c3321: A negative control's run now carries `PRODUCT_LAB_CONTROL_RUN=1`, so a lab can bound the checks its controls are written to fail more tightly where its positive runs are measured to be fast, and say which bound it used.
+- 872a3e1: `product-lab test --negative-control --tags <expression>` (or `--name`) runs only the controls the selection picks. The others are listed as not selected instead of each being refused for an empty selection and failing the run; a selection that picks no control exits 1.
+- 425509e: `product-lab dev --fixture <name>` starts the lab from a saved fixture, its chain and people restored as the environment starts. A scenario that names that fixture then needs no restore, and an `@isolated` one saves no copy. A fixture that does not fit is refused, saying why.
+- e7cc546: An `@isolated` scenario that starts on a state that is exactly a saved fixture (just restored or saved, nothing run since) no longer saves a copy of it first: the fixture gives the state back after the scenario. On a full local fork this saves a drain, a stop, a copy and a resume (about 110 s) per scenario.
+- 5169c75: An `@isolated` scenario run in the lab window, by `product-lab fixture run` or through MCP now says how its start state was kept (saved, kept from a fixture, or recovered), as a `product-lab test` run already did.
+- 8b95b75: Restoring a fixture or an isolated scenario's start state on a local fork no longer drains the network before it stops: the restored data replaces it, so the drain (about 30 s) settled nothing anyone reads.
+- a5b8fdf: `product-lab test --negative-control` with no feature path starts the environment once for all the controls instead of once per control. Each control still starts from a fresh state: the environment restarts after a control that changed it, and a control that cannot run on the chain no longer pays a start and a stop.
+- 4fe2e4a: A Chopsticks environment now refuses to start, by name, when the sqlite3 package it needs for its databases has no native build: "sqlite3 has no native build (…), so Chopsticks cannot open its database". The message gives the fix: `npm rebuild sqlite3` in a product. Before, Chopsticks exited before it was ready, with typeorm's `DriverPackageNotInstalledError`. In product-lab's checkout, `bun run setup` now builds sqlite3 when Bun installed it without running its install script.
+- 8f33684: A command that ends very quickly no longer fails to start with "The command's start was not acknowledged and its group anchor has exited" when the machine is busy: once the command has been seen to start, it counts as started.
+- 5204378: `PRODUCT_LAB_STATE_DIR` tells the lab where to keep the lab window's remembered choices: the RPC per chain and each environment's option. It is optional; unset, they stay in the lab folder's `.product-lab/state`. A test that loads your lab can set it so it never reads or changes what a person chose in their running lab.
+- 9d2191c: The Run tab says where a step was verified ("Verified on Grace's screen and on the chain") instead of "Checked twice", and names what each action touched ("clicked Publish", "typed "Grace was here" into Note"); the technical locator stays under Evidence.
+- 7cc6751: A network condition a scenario step sets (for example "Linus's network is "slow-3g"") now shows in that person's tile in the lab, named by its profile ("slow 3G"), also when the run is in the background; it goes back to "online" when the scenario ends. The lab snapshot carries each identity's conditions (`actorConditions`).
+- 19c28d4: A step held at a pause or a breakpoint no longer keeps its process alive by itself. The day-long limit on how long a person may hold a step now runs on a timer of its own. That timer never keeps Node running, and it is cleared as soon as the step goes on. Before, Cucumber's own hook timer stayed referenced, so a run whose gate was never released kept its process open for a day.
+- 6d16849: The lab window no longer flashes at every step: a run recording's frames are cut from one capture of the whole window, taken once per step boundary for every person, instead of a clipped capture per person (a clipped capture made the headed window show only that part for a moment).
+- 1c1abc9: Prepare stock Previewnet Engine v0.11.0 by default for local network copies, and refuse stale Engine build records before starting a fork.
+  
+  Enforce one live network per prepared Engine checkout, including shutdown. A second start is refused immediately because stock Engine cleanup sweeps service commands by checkout path. Use a separate cache or checkout for concurrent networks. A checkout lock whose lab exited is recovered, with a warning, only when every Engine process that lab recorded has stopped too; otherwise the start is refused. For a saved workspace it names the workspace: starting it again stops what its interrupted run left, while holding the lock. For a one-off Engine network it names the processes to stop, since no later start stops them. A lock that records no process list to check is never recovered by itself. Live locks are never broken.
+  
+  A shared fixture bundle's provenance records the Engine build prepared in the cache, and flags a build at another commit than the tested one.
+  
+  For parallel Engine runs, set PRODUCT_LAB_WORKER_CACHES to a separate cache for every worker, including workers that resume saved forks.
+- 5e3e098: A Statement Store reader can now read an account's statement allowance at the best or the finalized block (`allowanceAt`). A node accepts a statement against the best block, but it removes the statements of an account that has no allowance at the finalized block. The Notes reference lab (`notes-lab.md`) now uses this: a publish waits until the author's allowance is finalized and reads the note once more. If the note is gone by then, the publish fails with "accepted at best and evicted at finalized", naming both blocks, instead of a later check failing with no clear reason.
+- 356ecd3: The agent kit's Notes reference now shows the example app waiting until the author's statement allowance is finalized before it submits its first statement, and the publish step recording the finalized block that wait ended on (`allowance`). A store removes the statements of an account with no allowance at its finalized block, so on a chain whose finality lags, a statement submitted at once was accepted and then removed.
+- 48110ff: Expose bounded read-only permission-status inspection for registered products in the opt-in shared WASM shell.
+- 48110ff: Add an optional fail-closed byte admission bridge to the shared WASM host shell. It preserves the registered product and provider channel for original requests and responses and waits for explicit admission before forwarding either direction. Existing sessions without a bridge retain their synchronous forwarding behavior.
+- ac2bd70: Strip comments from compiled JavaScript while retaining copyright and SPDX notices and declaration documentation.
+- 1f5e850: A tile's strip in the lab window says what its person is doing in words, as the step cards do ("Acting · clicking Publish", "Acting · typing into Note", "Acting · waiting for the Publish button"), instead of a call's name ("Acting · click…"); the hover keeps the full text, and no locator shows.
+- 65e2bb4: A kept relay-less start now lists every chain generation its environment still keeps (`provenance.workspace.kept`), so
+  a lab can remove the people of chains no longer kept. The Notes example does so at each kept start and says whom
+  ("Notes removed people of chains no longer kept: …"); identities the lab did not make stay.
+- eca83c1: The lab window's switch warning names where it goes the same short way on both buttons: "Switch to Local copy of Paseo (Light) and run", and "Discard Fast local chain, switch to Local copy of Paseo (Light) and run".
+- cb60d75: A switch between environments names them by their labels: the warning before a run on another environment ("Run on
+  Local copy of Paseo?", "Stay in Fast local chain: People and Bulletin", "Switch to Local copy of Paseo and run"), the
+  environment switch dialog, the switch plan's consequences, and the run's first step ("Switch to Local copy of Paseo").
+  An environment's id comes first only when another environment shares its label.
+- da0d77c: A switch to an environment with more than one way to run says which way it starts and why. The switch plan carries
+  `option: { id, label, why }`, taken from the environment's pick: the person's last choice, else what fits this
+  machine. Its consequences add "<environment> starts as <why>", and before a run on it the lab window's warning reads
+  "Switch to <environment>, <option> and run".
+  A switch that discards the environment it leaves now names where it goes on its button too, in short labels: "Discard
+  Fast local chain, switch to Local copy of Paseo (Light) and run" (it read "Discard …, switch and run").
+- ec72153: The lab window: after a switch, while the run waits for you to allow its root calls, the Run tab keeps the switch as the run's entry and says what it waits for, instead of "No run yet"; declined, the switch leaves the Run tab.
+- 92137ba: The terminal app (`product-lab dev` in a terminal) now takes the mouse while it shows: the wheel scrolls the app's screen (Logs, lists, Run, Help) instead of the terminal's history behind it, where macOS Terminal showed old shell lines above the app. Mouse reporting is turned off again when the app closes, crashes or hands the terminal to an agent. To select text while the app shows, hold Option while you drag in macOS Terminal (Shift in most other terminals).
+- ae5decc: A lab started inside `node --test` no longer writes to the test runner's standard output. That output carries the runner's own messages, and a line written into it could end the run with "Unable to deserialize cloned data due to invalid or unsupported version". `startDev`'s progress now goes to standard error in a test file. The `@product-lab/cli/own-running-record` preload also sends `console.log`, `console.info` and `console.debug` there. A lab started outside a test prints as before.
+- 310fcd8: Text in the lab window wraps instead of running past the panel's edge: content ids, addresses and errors break where
+  they must, at the panel's default width and at its narrowest. A run's title gets the card's width, with where it is
+  written on its own line below it; a scenario's description shows up to three lines (its tooltip has the rest), and its
+  title is never cut. A person's tile now shows their host as soon as the lab knows it (a saved identity reopened showed
+  none). The Run setup's identity choices, the Environment section's chains, processes and notices, a feature run's
+  progress and the recordings list update in place instead of redrawing.
+- 382d9f9: In a narrow lab-window tile the device menu is an icon that opens the same list, so the address bar keeps its room.
+- ce27165: Fixed: in the lab window's grid, the selected identity's name no longer runs over the address bar's reload button and address. The "Selected" label is now its own chip beside the name, which is shortened with an ellipsis when the tile is narrow.
+- cff5c29: The host pill on a person's tile now shows what that host cannot do yet, as the person's row does: a warning mark that gives each limit and its reason on hover, for example "can't read Bulletin" on truAPI WASM.
+- 1dbc74d: In the lab window, a tile whose identity plays a scenario actor under another name says so: "Person 1 · as Ada", in a quieter style after the name. Before, the tile said only "Person 1" while the steps said Ada.
+- 5307acf: In the lab window a tile's strip keeps the app's whole origin in its address: the acting words beside it wrap to a second line, and only then end in an ellipsis.
+- 3ee8937: During a switch or a reset, the lab window closes each identity's app as the operation begins ("Ada's app is closed"),
+  so no app is left calling a host that stopped; the apps open again once the environment runs. The snapshot's running
+  operation says so (`operation.leaving`).
+- 8d8f5cb: On a tool's page in the lab window, the command shown under "The same from a terminal" (and what Copy the command copies) now always matches the form. Before, when you changed fields quickly, an older answer could arrive last and leave a command the form no longer held.
+- 547f4a7: The lab window's Tools page no longer opens blank. Find problems used to show an empty list for about five seconds on the first visit and after every return. Switching between Find problems and Characters looked like the only way to make the tools appear. The page now says "Reading the lab's tools…" until the list comes, and the list comes in well under a second: the lab reads the suites a lab declares from its config instead of planning each suite on every read.
+- c3010ca: In the lab window, the button on top of the panel's tabs names what the panel shows (Environments, Identities, Current run, Chain console, …) with that section's icon, instead of the logo and "Lab"; it still opens the Lab menu. The bottom bar's Lab button is unchanged.
+- 07ef089: In a terminal, the lab's title no longer shows "esbuild" while the lab runs: tsx's esbuild service runs in a session of its own, outside the terminal's foreground process group, so a terminal that names its foreground process (macOS Terminal) shows the lab. Starting in a terminal takes about 0.2 s longer; without a terminal nothing changes.
+- 03957ed: The lab's terminal app fits the terminal: it no longer draws the header twice or leaves old lines behind in macOS Terminal. It uses the whole screen and gives the terminal's lines back when it closes, cuts long lines instead of wrapping them, and draws again when the window changes size.
+- 7da49fc: `product-lab dev` checks the terminal app's packages before it starts anything: when one is not installed it says so at once with `bun install` and runs with plain lines, instead of stopping after the chain, the people and the window had started.
+- e6925e6: The terminal app's People screen says whether people are kept between starts the way the lab window says it: what this start did and why, what keeping keeps of the people (or why it keeps none), and where. It no longer points to a lab.workspace.config.ts that labs no longer have; Config names `keepBetweenStarts` in lab.config.ts instead.
+- b681298: In a terminal, `product-lab dev` (and every example's `bun run lab`) takes the whole terminal from the first moment, as Claude Code and Codex do: the start's checklist shows inside the terminal app instead of as lines under your shell's history. A kept chain whose day ended asks inside the app whether to replace it (y or n). A start that fails shows inside the app with its words; `q` leaves, and the failure is then printed once so it is not lost. Without a terminal, with `CI` or with `--plain`, the plain lines stay.
+- 4dc2a79: The terminal's title no longer flips to "ps" every second while the lab runs: the lab reads the process table outside the terminal's foreground process group. The terminal app sets the title to "product-lab · <lab>" while it shows and puts the old one back when it closes.
+- ef7b7df: A runtime upgrade the chain rejects before the lab first looks is told as rejected at once, instead of waiting for the upgrade tool to time out.
+- dd260f2: The CLI's usage now names `upgrade --force`, the option `upgrade` reads; it said `--allow-dirty`, which `upgrade` never accepted.
+- b6c9c56: Visual checks can wait for your app's screen to settle before each screenshot: `defineLab({ checks: { visual: { settled: ['[data-testid="publish"]:enabled'] } } })`
+  names your app's own elements whose presence means it is at rest (`settleTimeoutMs`, default 120 s). A step that
+  returns before the app settles, such as a publish that moves on at inclusion while the app waits for finality, no
+  longer gives a different screenshot on a chain whose finality lags. A screen that never settles fails the step,
+  naming the selector and the time waited.
+- 4dcb5af: The host check credits a truAPI WASM host's own Bulletin stores to its app, as it does for the truAPI CLI host: the WASM session reports its Bulletin account as one it signs with (`session.resourceAccounts()`, `signs: true`). A clean Notes run on the WASM host no longer warns about a Bulletin store it signed itself.
+- 4539211: A person on the in-browser (truAPI WASM) host shows up front that the host cannot read Bulletin yet (upstream): a
+  "can't read Bulletin" chip on their row, with what that means for the app. A host adapter can declare such limits
+  (`HostProvider.limits`), and the lab's own description of the host follows them.
+- 7ac2ff8: The WASM test host now runs `@parity/truapi-host` 0.23.0, the truAPI the apps' Product SDK speaks: on 0.20.0 every publish failed with `MalformedFrame: Input buffer has still data left after decoding!`. A WASM host of another truAPI release than the `@parity/truapi` installed beside it is now refused by name before a session starts.
+- 485d19d: On the in-browser host (truAPI WASM), the host check no longer reports the host's own storage and Statement Store claims as "sent around the host". It credits them to the person, as it already does on the desktop host. The host page's sockets to the chain now count as that person's tile's own when they come from scripts that only that page loaded. A headless lab window runs full Chromium, as the hosts' browsers do, so it observes WebRTC too.
+- 0e02225: The WASM test host can open a person's session in a place the lab gives, such as their lab-window tile. Each placed session signs in only its own tagged host page. Where its network cannot be routed alone, the session records why in its evidence and reports no blocked requests.
+- 6d97b98: On truAPI WASM with the network locked, the host check no longer says it cannot tell whose the host's chain connections are. The browser sets each connection's origin, and a page cannot change it, so a connection from the host page's own origin counts as the host's. A connection from the app's origin, or with no origin, still counts as the app's.
+- de69f2a: A person on the in-browser (WASM) host now shows one scrollbar, the app's: the test host page no longer scrolls by a
+  few pixels around the app.
+- 1822795: A lab with `sessions()` of its own can declare `defineLab({ sessionPorts: { from, to } })`, a range inside its own port block for the origin gates of its deny-by-default hosts. Without it, those gates take the framework's fallback block 40000-40999, which every such lab on the machine shares, and the run's output now says so when a gate first takes a port there. `PRODUCT_LAB_SESSION_PORTS` still wins.
+- 12091ee: In the lab window, a person on the in-browser host made after a chain reset or a restored fixture now runs in their tile like everyone else. Before, their tile showed the app without its host, and the app waited 120 s for an account ("getProductAccount timed out after 120000ms"). A Watch run that meets a person whose tile shows the app without its host now stops at once and says what to do, instead of waiting.
+- 525bd3b: The host check no longer says "Signing evidence failed: page.evaluate: Target page, context or browser has been closed" for a truAPI WASM person moved into their lab-window tile: a stopped truAPI WASM session keeps the signing log it had when it stopped.
+- 14e4c22: In the lab window with two or more people on the truAPI WASM host, the host check and `@deny-by-default` scenarios now tell each person's chain connections apart, instead of saying "Chromium named no frame for this websocket traffic" for every one of them.
+- 4539211: In the lab window, a person on the in-browser (truAPI WASM) host with "network locked" now has their lock applied
+  to every request their tile makes. Requests the lock refuses are blocked and listed, still after the window is
+  refreshed. Only sockets stay open in the tile, and the person's row and tile both say so: "network partly locked:
+  sockets open", with why. Before, the tile applied no lock at all while the row said "network locked".
+- fffb983: The host check can see a person on the in-browser (truAPI WASM) host in the lab window. The window's traffic is
+  observed from the moment it opens, and each tile's traffic, its workers' included, is read by frame. The host's own
+  traffic is told apart from the app's, so "host and app share a context" is said only where the browser named no
+  frame. In a locked tile, sockets are observed and listed in the host check, not blocked, and the tile says so. A
+  browser cannot block one tile's sockets, and in headless runs a worker's sockets are not blocked either; the lock's
+  words now say that.
+- 6776ffa: The host check no longer misses what a worker sends on its first line. On a local environment where every identity is one the lab made, the lab's browsers and the lab window pause each new worker until the lab watches its traffic. To do that they open a debugging port on 127.0.0.1, at a port the system chooses, and never log it. Every local process of every user on the machine can reach that port while it is open. So it stays off on a public network, when the lab declares pre-onboarded identities, and for a dot.li host. `workerHold: false` in lab.config.ts turns it off everywhere. When it is off, the host check says why a worker's start was not held.
+  
+  Switching the lab window to a public network asks first, in the switch's confirm: the window reopens without its debugging port, keeping your runs and recordings and the tab you had open, then switches. Settings shows "Hold worker starts", and when it is off, greys it out and says why.
+- ce27165: Fixed: a negative control run in Watch mode in the lab window is now judged at the step and for the reason `defineLab({ negativeControls })` declares, as it already was in the background. Before, a Watch run of a declared control finished without a verdict.
+- 62c0b81: Fixed: a scenario that changes an identity's network (`Grace goes offline`, `Grace's network is "slow-3g"`) now runs in Watch mode in the lab window. Before, Watch refused it before anything ran, while the same scenario ran in the background. The identity's tile is conditioned (its app's requests fail or slow down; its link to its host is kept), and so are its host's own connections. A slower device (`Grace's device is 4 times slower`) is refused in a tile with the reason, since every tile shares the lab window's renderer; open the identity in its own window for that. A tile's own WebSockets are not conditioned.
+- 880db89: The lab window's Settings shows "Hold worker starts" as on from the moment the window opens. Before, the window could answer the page before it had finished opening, and Settings then showed the hold as unavailable until something else redrew it.
+- cbf4f36: A run in the lab window (or any in-process run) removes its isolated scenarios' saved start state when it ends, passed or failed, so the next run no longer restores it first.
+- 9e51512: The lab window says an environment whose chain is forked is "a copy of another chain's state" (it may copy the lab's own local chain, not a live network), and a Chopsticks environment the lab declares under `advanced` shows as on in Config, never greyed as "off unless listed".
+- 4127327: A feature step refused because the environment lacks a capability now says why, as app availability already did: for example `missing capability devAuthority (withheld by the lab: rehearsing a public network)`, in `product-lab lint` and in the plan before a scenario runs.
+- `product-lab test` refuses `--workers` together with `--rerun-failures` instead of ignoring the reruns.
+- 7733849: A run's Transactions tab now opens with the count of everything the run wrote ("Writes in this run: 4"), then the lab's own transactions, which say "none" when only the hosts wrote (a publish on a local Paseo fork). It used to open with "The lab submitted no transaction" above the hosts' writes, which read as if nothing was written.
+- 7a1c481: The Notes reference lab in the AI kit reads each People block's events as soon as the block is finalized, so its XCM stand-in no longer misses a Bulletin allowance claim when the lab is busy (a missed claim made the next publish fail).
+- Opening a run bundle (`product-lab bundle open`, `reproduce`, the lab window's bundle routes) or unpacking a fixture bundle (`fixture import`, `fixture download`) can no longer write or point outside the folder it unpacks into. Before, a crafted bundle could chain two links that each looked inside the folder and write a file through them outside it, for example a Git hook in your lab. Links are now created after every file and folder, nothing is written through a link, and a link that passes through another link or leaves the folder is refused. A run bundle holds files only, so one that carries a link or a folder entry is refused. A refused bundle leaves nothing behind.
+- Updated dependencies [1de5c0d]
+- Updated dependencies [d417fc4]
+  - @product-lab/ports@0.0.1
+  - @product-lab/system-node@0.0.1
+  - @product-lab/domain@0.0.1
+  - @product-lab/cli@0.0.1