@vostride/agent-qa-dashboard 0.2.2 → 0.2.4

package/dist/server/index.cjs

@@ -45,6 +45,7 @@ var import_node_crypto8 = require("node:crypto");
 var import_promises9 = require("node:fs/promises");
 var import_node_path10 = require("node:path");
 var import_node_os3 = require("node:os");
+var import_node_util5 = require("node:util");
 
 // src/db/run-owner-host.ts
 var import_node_child_process = require("node:child_process");
@@ -340,7 +341,7 @@ var TestFileManager = class {
   constructor(workspace) {
     this.workspace = workspace;
   }
-  // 2026-10-18 (444-33, D-65; 444-35, D-66): each list call reads the workspace itself; each file is written whole and one writer at a time.
+  // Each list call reads the workspace itself; each file is written whole, one writer at a time.
   underLock = createPathLock();
   async list() {
     const records = await (0, import_agent_qa_core.discoverWorkspaceFiles)({ workspace: this.workspace, kind: "test" });
@@ -504,8 +505,7 @@ var ConfigManager = class _ConfigManager {
     this.configPath = configPath;
     this.mask = mask;
   }
-  // 441 GAP3-D5: a whole document may keep a marker the file already holds, as often, but never
-  // add one. A missing file holds none.
+  // A whole document may keep a marker the file already holds, as often, but never add one.
   static addsShownMarker(current, next) {
     const held = shownMarkerCounts(current);
     for (const [marker, count] of shownMarkerCounts(next)) {
@@ -513,13 +513,13 @@ var ConfigManager = class _ConfigManager {
     }
     return false;
   }
-  // 429-05 Pitfall 3: a half-edited file is named, never served as the partial config yaml recovers.
+  // A half-edited file is named, never served as the partial config yaml recovers.
   async readWithRevision() {
     const read = await this.readParsed();
     if (read.kind !== "ok") return read;
     return { kind: "ok", config: read.config, raw: read.raw, revision: read.revision };
   }
-  // 441-21 D-29: the payload and the file view pass through the declared mask and nothing else.
+  // The payload and the file view pass through the declared mask and nothing else.
   async readMasked() {
     const read = await this.readParsed();
     if (read.kind === "absent") {
@@ -563,8 +563,7 @@ var ConfigManager = class _ConfigManager {
       revision
     };
   }
-  // 429-01 D-19/D-22: one transaction per request, serialised so overlapping autosaves never
-  // read the same bytes and drop each other's field.
+  // One transaction per request, serialised so overlapping autosaves never drop each other's field.
   async applyChanges(changes, options = {}) {
     const marked = changeWithShownMarker(changes);
     if (marked !== void 0) {
@@ -579,13 +578,11 @@ var ConfigManager = class _ConfigManager {
     }
     return this.serialized(() => this.applyChangesOnce(changes, options.capturePriors === true));
   }
-  // 429-11 D-24: an Undo is one more transaction on the same mutex, newest change first. A field
-  // that no longer holds what the change left there was written since, and is never overwritten.
+  // An Undo restores newest first; a field written after the change is never overwritten.
   async restorePriors(priors) {
     return this.serialized(() => this.restorePriorsOnce(priors));
   }
-  // 432-07 D-05: a generated whole-file change (a scaffold, a hooks file) publishes only over the
-  // bytes it was built from, read again in this path's turn. Anything else is somebody's edit.
+  // A generated whole-file change publishes only over the bytes it is built from, re-read in turn.
   async replaceDocument(expectedRevision, content) {
     return this.serialized(async () => {
       let current;
@@ -712,8 +709,7 @@ var ConfigManager = class _ConfigManager {
     await this.writeAtomic(next);
     return capturePriors ? { kind: "ok", revision: revisionOf(next), baseRevision, priors } : { kind: "ok", revision: revisionOf(next), baseRevision };
   }
-  // 429-05 Pitfall 8 / Pattern 1 step 6: the temp file sits beside the real file, keeps its mode
-  // (chmod, because writeFile's mode is filtered by the umask), and replaces it in one rename.
+  // The temp file sits beside the real one and is chmodded, as the umask filters `writeFile` modes.
   async writeAtomic(content) {
     const target = await this.writeTarget();
     const directory = (0, import_node_path3.dirname)(target);
@@ -1913,6 +1909,12 @@ var HookRegistryManager = class {
 
 // src/server/body-parser.ts
 var DEFAULT_MAX_BYTES = 1024 * 1024;
+function carriesNonJsonBody(req) {
+  const hasBody = req.headers["transfer-encoding"] !== void 0 || Number(req.headers["content-length"] ?? "0") > 0;
+  if (!hasBody) return false;
+  const type = req.headers["content-type"];
+  return type === void 0 || type.split(";", 1)[0].trim().toLowerCase() !== "application/json";
+}
 function readJsonBody(req, maxBytes = DEFAULT_MAX_BYTES) {
   return new Promise((resolve5, reject) => {
     const chunks = [];
@@ -1947,6 +1949,7 @@ function readJsonBody(req, maxBytes = DEFAULT_MAX_BYTES) {
 // src/live-editor/live-session.ts
 var import_node_crypto5 = require("node:crypto");
 var import_node_path7 = require("node:path");
+var import_node_util3 = require("node:util");
 var import_agent_qa_core6 = require("@vostride/agent-qa-core");
 var import_agent_qa_runner = require("@vostride/agent-qa-runner");
 var import_agent_qa_runner_local = require("@vostride/agent-qa-runner-local");
@@ -2034,12 +2037,10 @@ async function loadLocalBindings(configPath) {
   try {
     const content = await (0, import_promises6.readFile)(filePath, "utf-8");
     const parsed = (0, import_yaml5.parse)(content);
-    return parsed && typeof parsed === "object" ? {
-      devices: parsed.devices,
-      providers: parsed.providers,
-      apps: parsed.apps,
-      filePath
-    } : { filePath };
+    (0, import_agent_qa_core5.refuseRetiredLocalBindings)(parsed, filePath);
+    if (!parsed || typeof parsed !== "object") return { filePath };
+    const bindings = parsed;
+    return { devices: bindings.devices, apps: bindings.apps, filePath };
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -2129,44 +2130,15 @@ async function prepareMobileLiveSession(input) {
       appActivity: resolved.app.appActivity,
       deepLinkAppId: resolved.app.deepLinkAppId,
       appPath: resolved.app.install?.path,
-      browserstackApp: resolved.app.install?.browserstack,
       appState: resolved.appState
     }
   };
 }
 
 // src/live-editor/live-session.ts
-var LiveProductionRefusedError = class extends Error {
-  productionTargetNames;
-  constructor(productionTargetNames) {
-    super((0, import_agent_qa_schema2.buildProductionRefusal)(productionTargetNames));
-    this.name = "LiveProductionRefusedError";
-    this.productionTargetNames = (0, import_agent_qa_schema2.distinctInFirstOccurrenceOrder)(productionTargetNames);
-  }
-};
 function isConfigRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function liveTargetName(targetName) {
-  if (typeof targetName !== "string") return void 0;
-  const trimmed = targetName.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-async function resolveLiveTargetProduction(configManager, targetName) {
-  const name = liveTargetName(targetName);
-  if (name === void 0 || configManager === void 0) {
-    return { productionTargetNames: [], allowProduction: false };
-  }
-  const config = await readConfigValues(configManager);
-  const registry = isConfigRecord(config.registry) ? config.registry : void 0;
-  const targets = registry !== void 0 && isConfigRecord(registry.targets) ? registry.targets : void 0;
-  const declared = targets !== void 0 && Object.hasOwn(targets, name) ? targets[name] : void 0;
-  const production = isConfigRecord(declared) && declared.environment === "production";
-  return {
-    productionTargetNames: production ? [name] : [],
-    allowProduction: config.allowProduction === true
-  };
-}
 async function readEntityUse(entity, readers) {
   if (entity === void 0) return void 0;
   const find = entity.type === "suite" ? readers.findSuite : readers.findTest;
@@ -2186,6 +2158,12 @@ var LivePlannerLimitsRefusedError = class extends Error {
     this.name = "LivePlannerLimitsRefusedError";
   }
 };
+var LiveNavigationTimeoutRefusedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "LiveNavigationTimeoutRefusedError";
+  }
+};
 var LIVE_LIMIT_LEAVES = ["maxActions", "maxPlanningTurns"];
 function shownLimitValue(value) {
   return typeof value === "number" ? String(value) : JSON.stringify(value) ?? String(value);
@@ -2234,9 +2212,30 @@ async function resolveLivePlannerLimits(configManager, entities, readers) {
   }
   return (0, import_agent_qa_schema2.resolvePlannerLimits)(config.use, ...uses);
 }
-function liveProductionRefusal(found) {
-  if (found.productionTargetNames.length === 0 || found.allowProduction) return void 0;
-  return new LiveProductionRefusedError(found.productionTargetNames);
+async function resolveLiveNavigationTimeoutMs(configManager, entities, readers) {
+  const config = configManager === void 0 ? {} : await readConfigValues(configManager);
+  const layers = [
+    { layer: "project config", use: config.use }
+  ];
+  for (const entity of [].concat(entities ?? [])) {
+    const use = await readEntityUse(entity, readers);
+    layers.push({ layer: `${entity.type} file ${entity.id}`, use });
+  }
+  let navigation;
+  for (const { layer, use } of layers) {
+    if (!isConfigRecord(use) || !isConfigRecord(use.timeout)) continue;
+    if (!Object.hasOwn(use.timeout, "navigation")) continue;
+    const value = use.timeout.navigation;
+    const parsed = import_agent_qa_core6.TimeoutConfigSchema.shape.navigation.safeParse(value);
+    if (!parsed.success) {
+      const issue = parsed.error.issues[0]?.message ?? "invalid value";
+      throw new LiveNavigationTimeoutRefusedError(
+        `${layer} sets use.timeout.navigation to ${shownLimitValue(value)}: ${issue}. The CLI refuses this file too.`
+      );
+    }
+    navigation = parsed.data;
+  }
+  return navigation;
 }
 var IDLE_TIMEOUT_MS = 5 * 60 * 1e3;
 var LIVE_HUB_CLOSE_LIMIT_MS = 2e3;
@@ -2372,8 +2371,7 @@ var LiveSession = class {
   planner = null;
   verifier = null;
   modelProfiles = null;
-  // D-14 (Phase 360): the run-scoped storage-state store, constructed lazily on first use and
-  // rooted at the session's `.agent-qa` runtime dir (the FsStorageStateStore rooting idiom).
+  // Built lazily on first use, rooted at the session's `.agent-qa` runtime dir.
   storageStateStore = null;
   model = null;
   variableStore = null;
@@ -2401,15 +2399,14 @@ var LiveSession = class {
   mobileAppiumLease = null;
   secretStore;
   secretRedactor;
-  // 428 D-07: one hub per session, handle 0, created once the adapter exists. A session whose
-  // setup hooks failed has no adapter and therefore no hub; its subject declares `none`.
+  // One hub per session at handle 0, created once the adapter exists; no adapter means no hub.
   liveHub = null;
   attachment = null;
   resolveEnded = () => {
   };
   ended;
   cleanupRun = null;
-  // RESEARCH P4: which control socket is the current one. Only its close may detach the session.
+  // Which control socket is the current one; only its close may detach the session.
   attachmentGeneration = 0;
   releaseAttachment = null;
   get modelName() {
@@ -2431,11 +2428,7 @@ var LiveSession = class {
     hub.register(0, registration?.capability, registration?.fallback);
     this.liveHub = hub;
   }
-  /**
-   * Make a control socket the current one. `release` is how the session lets go of it later: the
-   * previous attachment's is called with `superseded` here (428 WR-01), so one socket drives the
-   * session at a time.
-   */
+  // The previous attachment's `release` gets `superseded`, so one socket drives the session.
   beginAttachment(release) {
     const previous = this.releaseAttachment;
     this.attachmentGeneration += 1;
@@ -2454,11 +2447,7 @@ var LiveSession = class {
     }
     this.pendingMessages = [];
   }
-  /**
-   * A command's reply, for whichever control socket is attached now (428 CR-01). A command can
-   * outlive the socket that issued it, and its outcome belongs to the page, not to that socket:
-   * with none attached it is held and flushed to the next one.
-   */
+  // A reply can outlive its socket, so it goes to the current socket or waits for the next one.
   deliver(message) {
     if (this.messageSink) {
       this.messageSink(message);
@@ -2569,7 +2558,7 @@ var LiveSession = class {
         continue;
       }
       const result = await (0, import_agent_qa_runner.runHooks)([hookDef], {
-        executor: new import_agent_qa_runner_local.DockerHookExecutor(),
+        executor: new import_agent_qa_runner_local.DockerHookExecutor({ version: (0, import_agent_qa_core6.getAgentQaVersion)() }),
         env: this.getHookEnvVars(),
         secretStore: this.secretStore,
         secretRedactor: this.secretRedactor
@@ -2643,7 +2632,6 @@ var LiveSession = class {
       device: config.device ? {
         name: config.device.name,
         platform,
-        transport: "local",
         match: config.device
       } : void 0
     };
@@ -2708,15 +2696,6 @@ var LiveSession = class {
     }
   }
   async initialize(config) {
-    const found = await resolveLiveTargetProduction(this.deps.configManager, config.targetName);
-    const refusal = liveProductionRefusal({
-      productionTargetNames: (0, import_agent_qa_schema2.distinctInFirstOccurrenceOrder)([
-        ...config.production?.productionTargetNames ?? [],
-        ...found.productionTargetNames
-      ]),
-      allowProduction: found.allowProduction
-    });
-    if (refusal !== void 0) throw refusal;
     this.platform = config.platform;
     this.targetName = typeof config.targetName === "string" && config.targetName.trim().length > 0 ? config.targetName.trim() : null;
     this._modelName = config.llmConfig.model ?? "unknown";
@@ -2751,7 +2730,11 @@ var LiveSession = class {
     } else {
       const { WebPlatformAdapter } = await import("@vostride/agent-qa-web");
       const adapter = new WebPlatformAdapter();
-      await adapter.setup({ platform: "web", browser: { name: "chromium", headless: config.headless ?? true } });
+      await adapter.setup({
+        platform: "web",
+        browser: { name: "chromium", headless: config.headless ?? true },
+        ...config.navigationTimeoutMs === void 0 ? {} : { timeouts: { navigation: config.navigationTimeoutMs } }
+      });
       this.adapter = adapter;
       if (config.url) {
         const resolvedUrl = this.resolveSecrets(config.url);
@@ -2813,7 +2796,7 @@ var LiveSession = class {
         }
         const startedAt = performance.now();
         try {
-          const result = await new import_agent_qa_runner_local.DockerHookExecutor().execute(hookDef, {
+          const result = await new import_agent_qa_runner_local.DockerHookExecutor({ version: (0, import_agent_qa_core6.getAgentQaVersion)() }).execute(hookDef, {
             env: this.getHookEnvVars(),
             secretEnv: (0, import_agent_qa_runner.resolveSecretEnv)(this.secretStore),
             secretRedactor: this.secretRedactor
@@ -2980,12 +2963,7 @@ var LiveSession = class {
     };
     return this.redact(result);
   }
-  // Inner step execution — no gating. Callers must own the executing/status
-  // lifecycle (executeStepCommand for single steps, executeTestCommand for
-  // the per-test loop that runs many steps under one outer gate).
-  // D-14 (Phase 360): lazily construct the run-scoped storage-state store, rooted at the session's
-  // `.agent-qa` runtime dir. All fs writes live in runner-local (validate:arch storageNeutral);
-  // the loop records only { name, fingerprint }. Absent configPath falls back to the cwd root.
+  // Lazily built and rooted at the session's `.agent-qa` dir; fs writes stay in runner-local.
   async getStorageStateStore() {
     let store = this.storageStateStore;
     if (!store) {
@@ -3124,7 +3102,9 @@ ${errorLines.join("\n")}`;
         testLimits = this.plannerLimitsForTest !== void 0 && testDraft.testId.length > 0 ? await this.plannerLimitsForTest(testDraft.testId) : this.plannerLimits ?? (0, import_agent_qa_schema2.resolvePlannerLimits)();
       } catch (error) {
         if (!(error instanceof LivePlannerLimitsRefusedError)) throw error;
-        console.warn(`[live-session] executeTestCommand: ${error.message}`, { testName: testDraft.testName });
+        const line = `[live-session] executeTestCommand: ${error.message}`;
+        const detail = { testName: testDraft.testName };
+        (0, import_agent_qa_core6.printRunText)((0, import_node_util3.format)(line, detail), () => console.warn(line, detail));
         return this.redact({
           status: "failed",
           duration: performance.now() - start,
@@ -3144,11 +3124,13 @@ ${errorLines.join("\n")}`;
       if (!setupResult.allPassed) {
         const failedHook = setupHookPayloads.find((h) => h.status === "failed");
         const detail = failedHook ? `Setup hook "${failedHook.hookName}" failed${failedHook.error ? `: ${failedHook.error}` : ""}${failedHook.stderr ? ` \u2014 ${failedHook.stderr.split("\n")[0].slice(0, 200)}` : ""}` : "Per-test setup hook failed";
-        console.warn(`[live-session] executeTestCommand: ${detail}`, {
+        const line = `[live-session] executeTestCommand: ${detail}`;
+        const context = {
           testName: testDraft.testName,
           setupHooks: testDraft.setup,
           failedHook: failedHook ? { name: failedHook.hookName, stderr: failedHook.stderr, error: failedHook.error } : null
-        });
+        };
+        (0, import_agent_qa_core6.printRunText)((0, import_node_util3.format)(line, context), () => console.warn(line, context));
         return {
           status: "failed",
           duration: performance.now() - start,
@@ -3226,7 +3208,9 @@ ${errorLines.join("\n")}`;
         topLevelError = failedHook ? `Teardown hook "${failedHook.hookName}" failed${failedHook.error ? `: ${failedHook.error}` : ""}` : "Teardown hook failed";
       }
       if (topLevelError) {
-        console.warn(`[live-session] executeTestCommand: ${topLevelError}`, { testName: testDraft.testName });
+        const line = `[live-session] executeTestCommand: ${topLevelError}`;
+        const detail = { testName: testDraft.testName };
+        (0, import_agent_qa_core6.printRunText)((0, import_node_util3.format)(line, detail), () => console.warn(line, detail));
       }
       return this.redact({
         status: finalStatus,
@@ -3242,10 +3226,7 @@ ${errorLines.join("\n")}`;
       this.status = "idle";
     }
   }
-  // Thin wrapper around runLifecycleHooks that also captures the dispatched
-  // hook payloads (hook-complete) for inclusion in the LiveTestResultPayload.
-  // The capture sits beside the message sink rather than wrapping it, so a
-  // control socket that reattaches mid-hook keeps its sink (428 CR-01).
+  // Captures dispatched hook payloads beside the message sink, so a reattached socket keeps it.
   async runLifecycleHooksCapturing(phase, hookIds, sink, owner = { scope: "suite" }) {
     this.hookCaptures.add(sink);
     try {
@@ -3489,6 +3470,21 @@ function refuseUnparseableRequest(res) {
   });
   res.end(body);
 }
+function refuseForeignHostPage(res, port) {
+  if (res.headersSent) {
+    res.destroy();
+    return;
+  }
+  const p = String(port);
+  const body = `The agent-qa dashboard answers only at localhost, 127.0.0.1 or [::1].
+Open http://localhost:${p}/ on the machine it runs on, or forward the port with ssh -L ${p}:localhost:${p} <host>.
+`;
+  res.writeHead(403, {
+    "Content-Type": "text/plain; charset=utf-8",
+    "Content-Length": Buffer.byteLength(body)
+  });
+  res.end(body);
+}
 function backstopServerError(res, req, error) {
   const kind = error instanceof Error ? error.constructor.name : typeof error;
   console.error(
@@ -3568,10 +3564,6 @@ function respondJson(res, status, data) {
   res.end(body);
 }
 function serveRunEvidenceRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req)) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   const query = new URL(req.url ?? "/", "http://localhost").searchParams;
   const entries = [["runId", deps.runId]];
   const seen = /* @__PURE__ */ new Set(["runId"]);
@@ -3613,10 +3605,6 @@ function respondFeedbackRead(res, deps, functionId, input, parse) {
   });
 }
 function serveRunMarksHistoryRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   if (new URL(req.url ?? "/", "http://localhost").search !== "") {
     respondJson(res, 400, { error: "invalid_marks_input" });
     return;
@@ -3635,10 +3623,6 @@ function serveRunMarksHistoryRead(req, res, deps) {
   );
 }
 function serveRunMarkPreviewRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then((body) => {
     const parsed = import_agent_qa_schema3.RunsMarkInputSchema.safeParse(body);
     if (!parsed.success) {
@@ -3661,10 +3645,6 @@ function serveRunMarkPreviewRead(req, res, deps) {
   });
 }
 function serveRunDetailRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readRunDetail(deps.host, deps.runId).then(
     (outcome) => {
       if (outcome.kind === "refused") {
@@ -3814,10 +3794,6 @@ async function readRunAnalysis(host, runId) {
   }
 }
 function serveRunAnalysisRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readRunAnalysis(deps.host, deps.runId).then(
     (outcome) => {
       if (outcome.kind === "refused") {
@@ -4041,10 +4017,7 @@ function serveRunEventStream(req, res, deps) {
     else pending.push(frame);
   };
   const frameOf = (event) => (
-    // D-13, all three parts: the id IS the seq, the event name IS the envelope type, and the
-    // data IS the envelope's own JSON. No projection, no rename, no second vocabulary. The filter
-    // DROPS envelopes; it never edits one, so a filtered stream's frames are byte-identical to the
-    // firehose's — with gaps in the ids, which is what seq-as-id means once a filter exists.
+    // The filter drops envelopes and never edits one, so filtered frames match the firehose bytes.
     `id: ${String(event.seq)}
 event: ${event.type}
 data: ${JSON.stringify(event)}
@@ -4106,12 +4079,6 @@ data: ${JSON.stringify(event)}
   deps.openStreams?.add(teardown);
   req.on("close", teardown);
 }
-function runDenialOf(error) {
-  if (typeof error !== "object" || error === null) return void 0;
-  const neutralReason = error.neutralReason;
-  if (typeof neutralReason !== "string" || neutralReason.trim().length === 0) return void 0;
-  return { error: "run_denied", neutralReason };
-}
 function createRunServiceRoutes(ports) {
   const openStreams = /* @__PURE__ */ new Set();
   function handleStart(req, res) {
@@ -4142,12 +4109,7 @@ function createRunServiceRoutes(ports) {
         ack = await ports.invokeRunStart(
           parsed.data.patterns === void 0 ? {} : { patterns: parsed.data.patterns }
         );
-      } catch (error) {
-        const denial = runDenialOf(error);
-        if (denial !== void 0) {
-          respondJson2(res, 403, denial);
-          return;
-        }
+      } catch {
         refuse(res, 500, "run_start_failed");
         return;
       }
@@ -4227,6 +4189,10 @@ function createRunServiceRoutes(ports) {
         refuse(res, 403, "cross_site_refused");
         return;
       }
+      if (carriesNonJsonBody(req)) {
+        refuse(res, 415, "unsupported_media_type");
+        return;
+      }
       const matched = matchRunServiceRoute(req.method, path);
       if (matched === void 0) {
         refuse(res, 404, "unknown_route");
@@ -4492,8 +4458,7 @@ data: ${JSON.stringify(again.body)}
         // A failed re-read is not a reason to close a live channel: the next envelope will trigger
         // another, and the page's own poll is the floor underneath both.
         () => void 0
-        // …but a throw from the arm ABOVE is not a failed re-read, it is a dead socket, and `.then`'s
-        // failure arm never sees its own fulfilment arm's throw (UF-01, on the nested chain).
+        // A throw from the arm above is a dead socket, and `.then`'s failure arm never sees it.
       ).catch(failStream);
     });
     heartbeat = setInterval(() => {
@@ -4530,10 +4495,6 @@ async function readRunKnowledge(host, runId) {
   }
 }
 function serveRunKnowledgeRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readRunKnowledge(deps.host, deps.runId).then(
     (outcome) => {
       if (outcome.kind === "refused") {
@@ -4574,10 +4535,6 @@ async function markRun(host, runId, body) {
   }
 }
 function registerRunMarkRoute(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const outcome = await markRun(deps.host, deps.runId, body);
     if (outcome.kind === "refused") {
@@ -4595,10 +4552,6 @@ function registerRunMarkRoute(req, res, deps) {
 // src/server/config-routes.ts
 var import_agent_qa_schema9 = require("@vostride/agent-qa-schema");
 function registerConfigWriteRoute(req, res, deps) {
-  if (refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const parsed = import_agent_qa_schema9.ConfigWriteRequestSchema.safeParse(body);
     if (!parsed.success) {
@@ -4656,10 +4609,6 @@ function registerConfigUndoRoute(req, res, deps) {
     respondJson(res, 405, { error: "method_not_allowed" });
     return;
   }
-  if (refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const parsed = import_agent_qa_schema9.ConfigUndoRequestSchema.safeParse(body);
     if (!parsed.success) {
@@ -4889,10 +4838,6 @@ async function connectName(request2, deps) {
   });
 }
 function registerLlmConnectRoute(req, res, deps) {
-  if (refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const answer = await connectLlm(body, deps);
     respondJson(res, answer.status, answer.body);
@@ -5214,25 +5159,10 @@ function llmConnectionTestTimeoutMs(config) {
   return REMOTE_LLM_CONNECTION_TEST_TIMEOUT_MS;
 }
 function json(res, data, status = 200) {
-  const body = JSON.stringify(data);
-  res.writeHead(status, {
-    "Content-Type": "application/json",
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type"
-  });
-  res.end(body);
-}
-function jsonNoCors(res, data, status = 200) {
   const body = JSON.stringify(data);
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(body);
 }
-function refuseCrossSiteDisplayRead(req, res) {
-  if (refuseCrossSiteRequest(req) === void 0) return false;
-  jsonNoCors(res, { error: "cross_site_refused" }, 403);
-  return true;
-}
 var INSIGHTS_KNOWLEDGE_RUN_CAP = 200;
 var INSIGHTS_KNOWLEDGE_CONCURRENCY = 4;
 async function isPostProcessingSkipped(host, runId) {
@@ -5296,14 +5226,6 @@ async function readInsightsKnowledgeChanges(host, db, window) {
 function notFound(res, message = "Not found") {
   json(res, { error: message }, 404);
 }
-function cors(res) {
-  res.writeHead(204, {
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type"
-  });
-  res.end();
-}
 function isPlainRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -5356,7 +5278,7 @@ function normalizeRunFilterValue(value) {
 function buildRunRequestAttributes(input) {
   const internal = (0, import_agent_qa_core9.buildInternalRunAttributes)({
     trigger: input.trigger,
-    runner: input.runner ?? "local"
+    runner: "local"
   });
   const user = (0, import_agent_qa_core9.validateUserRunAttributes)(input.userAttributes, "run attributes");
   return (0, import_agent_qa_core9.mergeRunAttributes)(internal, user);
@@ -5801,9 +5723,7 @@ var RESPONSE_SAFE_RUN_METADATA_KEYS = /* @__PURE__ */ new Set([
   "timeoutSource",
   "timeoutBaseMs",
   "timeoutBufferMs",
-  "suiteIndex",
-  "farmSessionUrl",
-  "runDevice"
+  "suiteIndex"
 ]);
 function sanitizeRunMetadataForResponse(metadata) {
   if (metadata === null || metadata === void 0) return metadata ?? null;
@@ -5833,17 +5753,7 @@ var RESPONSE_SAFE_RUN_READ_METHODS = [
   "getRunsByTest"
 ];
 var RUN_READS_WITHOUT_ROWS = /* @__PURE__ */ new Set([
-  // 2026-08-27 (405-01, D-01/D-03): the v2 projection's six members.
-  //
-  // The five WRITES return nothing; they are here for the same reason `insertRun` is.
-  //
-  // `readRunDetailRows` IS A READ AND IS STILL HERE, and that is the judgement this set exists to
-  // make explicit rather than to hide. It returns members, steps and sub-actions — the bus
-  // payloads as the subscriber MASKED them (T-363-05) — and NO `RunRow` and no
-  // `RunArtifactRow`. It therefore carries none of the run metadata the 401-23 scrub law exists
-  // to strip, so wrapping it would be wrapping a shape that has nothing to strip. This router
-  // does not call it either: the detail arm dispatches through the injected host, which is the
-  // whole of D-03.
+  // `readRunDetailRows` returns masked bus payloads and no run row, so it has no metadata to strip.
   "deleteMemberProjection",
   "incrementRunMemberAttempts",
   "insertRunStep",
@@ -5854,23 +5764,23 @@ var RUN_READS_WITHOUT_ROWS = /* @__PURE__ */ new Set([
   "finalizeRunArtifact",
   "getRunsBySuiteIdCount",
   "getRunsByTestCount",
-  // 433-30: run ids and a count, no row; each id is dispatched through the agent host.
+  // Run ids and a count, no row; each id is dispatched through the agent host.
   "listInsightsWindowRunIds",
   "insertPendingRun",
   "insertRun",
   "insertRunArtifact",
   "listRunAttributeKeys",
   "listRunAttributeValues",
-  // 2026-10-16 (442-01, D-01): an owner (pid, incarnation, host), no run metadata.
+  // An owner (pid, incarnation, host), no run metadata.
   "readRunOwner",
-  // 2026-10-16 (442-01, D-04): ids and owners only, no run metadata.
+  // Ids and owners only, no run metadata.
   "listRunningRunOwners",
-  // 2026-10-16 (442-01, D-04): compare-and-set writes that return a boolean.
+  // Compare-and-set writes that return a boolean.
   "finalizeOrphanRun",
   "finalizeOwnRun",
-  // 2026-10-17 (443-13, GAP-D1): a compare-and-set write that returns a boolean, no run metadata.
+  // A compare-and-set write that returns a boolean, no run metadata.
   "closeOwnRun",
-  // 2026-10-17 (443-02, D-07): a compare-and-set write that returns a boolean, no run metadata.
+  // A compare-and-set write that returns a boolean, no run metadata.
   "claimRunningRow",
   "stageRunArtifact",
   "updateRun",
@@ -5941,10 +5851,7 @@ function withResponseSafeRunReads(db) {
     // `sanitizeArtifactForResponse`; a caller reaching for the bare row has no such step, so the
     // projection is its only choke point. Same allowlist, so the two cannot drift.
     getRunArtifact: { value: (runId) => scrubArtifact(db.getRunArtifact(runId)) },
-    // 405-07 (D-02): the bundle is ONE artifact now. It used to carry the child runs of a suite
-    // parent, whose `run` rows this override scrubbed; nothing has written a child row since
-    // 402-09, and the shape went with the column. `getRunArtifact` above remains the choke point
-    // for the payload itself, and this wrapper delegates to it.
+    // One artifact; `getRunArtifact` is the choke point for its payload, and this delegates to it.
     getRunArtifactBundle: {
       value: (runId) => ({ artifact: scrubArtifact(db.getRunArtifactBundle(runId).artifact) })
     }
@@ -6092,10 +5999,18 @@ function createRouter(dbOrDeps) {
       json(res, { error: "Bad Request" }, 400);
       return;
     }
+    if (refuseCrossSiteRequest(req) !== void 0) {
+      json(res, { error: "cross_site_refused" }, 403);
+      return;
+    }
+    if (carriesNonJsonBody(req)) {
+      json(res, { error: "unsupported_media_type" }, 415);
+      return;
+    }
     const path = url.pathname;
     if (path === "/api/config" && req.method === "PATCH") {
       if (!configManager) {
-        jsonNoCors(res, { error: "config_unavailable" }, 503);
+        json(res, { error: "config_unavailable" }, 503);
         return;
       }
       registerConfigWriteRoute(req, res, { configManager, undoStore });
@@ -6115,7 +6030,7 @@ function createRouter(dbOrDeps) {
     }
     if (path === "/api/config/revision" && req.method === "GET") {
       if (!configManager) {
-        jsonNoCors(res, { error: "config_unavailable" }, 503);
+        json(res, { error: "config_unavailable" }, 503);
         return;
       }
       registerConfigRevisionRoute(req, res, { configManager });
@@ -6123,7 +6038,7 @@ function createRouter(dbOrDeps) {
     }
     if (path === "/api/llm/connect" && req.method === "POST") {
       if (!configManager) {
-        jsonNoCors(res, { error: "config_unavailable" }, 503);
+        json(res, { error: "config_unavailable" }, 503);
         return;
       }
       registerLlmConnectRoute(req, res, {
@@ -6135,16 +6050,6 @@ function createRouter(dbOrDeps) {
       });
       return;
     }
-    if (path === "/api/runs/trigger" || path === "/api/queue/enqueue") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
-    }
-    if (req.method === "OPTIONS") {
-      cors(res);
-      return;
-    }
     if (path === "/api/auth-states" && req.method === "GET") {
       if (!configManager || !deps.configPath) {
         json(res, { error: "Auth-state metadata not available" }, 503);
@@ -6168,11 +6073,10 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/runs" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const statuses = url.searchParams.getAll("status");
       const unknownStatus = statuses.find((word) => !isRunStatusWord(word));
       if (unknownStatus !== void 0) {
-        jsonNoCors(res, { error: `Unknown run status: ${unknownStatus}.` }, 400);
+        json(res, { error: `Unknown run status: ${unknownStatus}.` }, 400);
         return;
       }
       const name = url.searchParams.get("name") ?? void 0;
@@ -6204,12 +6108,12 @@ function createRouter(dbOrDeps) {
         )).sort((a, b) => a.localeCompare(b));
         const filtered = platformFilteredRuns.filter((run) => matchesTargetFilter(run, target));
         const runs = filtered.slice(offset, offset + limit);
-        jsonNoCors(res, {
+        json(res, {
           runs,
           total: filtered.length,
           targets: targetOptions
         });
-      }).catch(() => jsonNoCors(res, { error: "Failed to list runs" }, 500));
+      }).catch(() => json(res, { error: "Failed to list runs" }, 500));
       return;
     }
     if (path === "/api/runs/attributes/keys" && req.method === "GET") {
@@ -6247,7 +6151,6 @@ function createRouter(dbOrDeps) {
     }
     const runArtifactMatch = path.match(/^\/api\/runs\/([^/]+)\/artifact$/);
     if (runArtifactMatch && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const runId = decodeURIComponent(runArtifactMatch[1]);
       const run = db.getRun(runId);
       if (!run) {
@@ -6255,7 +6158,7 @@ function createRouter(dbOrDeps) {
         return;
       }
       const bundle = db.getRunArtifactBundle(runId);
-      jsonNoCors(res, {
+      json(res, {
         run,
         artifact: sanitizeArtifactForResponse(bundle.artifact),
         missingSections: getArtifactMissingSections(bundle.artifact)
@@ -6263,7 +6166,6 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/execution-logs") && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const segments = path.split("/");
       const id = segments[3];
       const run = db.getRun(id);
@@ -6274,37 +6176,37 @@ function createRouter(dbOrDeps) {
       const stepId = url.searchParams.get("stepId") ?? void 0;
       const type = url.searchParams.get("type") ?? void 0;
       const logs = db.getExecutionLogs({ runId: id, stepId, type });
-      jsonNoCors(res, { logs });
+      json(res, { logs });
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/mark") && req.method === "POST") {
       if (deps.agentHost === void 0) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/mark".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_mark_input" }, 400);
+        json(res, { error: "invalid_mark_input" }, 400);
         return;
       }
-      registerRunMarkRoute(req, res, { host: deps.agentHost, runId, boundary: "human" });
+      registerRunMarkRoute(req, res, { host: deps.agentHost, runId });
       return;
     }
     if (req.method === "POST" && /^\/api\/runs\/[^/]+\/mark-preview$/.test(path)) {
       if (deps.agentHost === void 0) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/mark-preview".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_run_id" }, 400);
+        json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunMarkPreviewRead(req, res, { runId, host: deps.agentHost, boundary: "human" });
+      serveRunMarkPreviewRead(req, res, { runId, host: deps.agentHost });
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/cancel") && req.method === "POST") {
@@ -6383,44 +6285,39 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/live-url$/.test(path)) {
-      const crossSite = refuseCrossSiteRequest(req);
-      if (crossSite !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       if (!deps.mintLiveUrl) {
-        jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+        json(res, { error: "live_view_unavailable" }, 503);
         return;
       }
       let liveUrlRunId;
       try {
         liveUrlRunId = decodeURIComponent(path.slice("/api/runs/".length, -"/live-url".length));
       } catch {
-        jsonNoCors(res, { error: "unknown_run" }, 404);
+        json(res, { error: "unknown_run" }, 404);
         return;
       }
       const rawHandle = handleParamOf(req);
       const parsedHandle = (0, import_agent_qa_schema11.parseHandleParam)(rawHandle);
       if (parsedHandle.kind === "invalid") {
-        jsonNoCors(res, { error: "invalid_handle" }, 400);
+        json(res, { error: "invalid_handle" }, 400);
         return;
       }
       const handle = parsedHandle.kind === "absent" ? 0 : parsedHandle.index;
       void deps.mintLiveUrl(liveUrlRunId, handle).then(
         (result) => {
-          jsonNoCors(res, result);
+          json(res, result);
         },
         (error) => {
           const name = error instanceof Error ? error.name : "";
           if (name === "UnknownRunError") {
-            jsonNoCors(res, { error: "unknown_run" }, 404);
+            json(res, { error: "unknown_run" }, 404);
             return;
           }
           if (name === "LiveViewUnavailableError") {
-            jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+            json(res, { error: "live_view_unavailable" }, 503);
             return;
           }
-          jsonNoCors(res, { error: "live_url_mint_failed" }, 500);
+          json(res, { error: "live_url_mint_failed" }, 500);
         }
       );
       return;
@@ -6449,32 +6346,32 @@ function createRouter(dbOrDeps) {
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/evidence$/.test(path)) {
       if (!deps.agentHost) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/evidence".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_run_id" }, 400);
+        json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunEvidenceRead(req, res, { runId, host: deps.agentHost, boundary: "human" });
+      serveRunEvidenceRead(req, res, { runId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/marks$/.test(path)) {
       if (!deps.agentHost) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/marks".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_run_id" }, 400);
+        json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunMarksHistoryRead(req, res, { runId, host: deps.agentHost, boundary: "human" });
+      serveRunMarksHistoryRead(req, res, { runId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/detail$/.test(path)) {
@@ -6489,7 +6386,7 @@ function createRouter(dbOrDeps) {
         json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunDetailRead(req, res, { runId: detailRunId, host: deps.agentHost, boundary: "human" });
+      serveRunDetailRead(req, res, { runId: detailRunId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/analysis$/.test(path)) {
@@ -6504,7 +6401,7 @@ function createRouter(dbOrDeps) {
         json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunAnalysisRead(req, res, { runId: analysisRunId, host: deps.agentHost, boundary: "human" });
+      serveRunAnalysisRead(req, res, { runId: analysisRunId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/knowledge$/.test(path)) {
@@ -6521,8 +6418,7 @@ function createRouter(dbOrDeps) {
       }
       serveRunKnowledgeRead(req, res, {
         runId: knowledgeRunId,
-        host: deps.agentHost,
-        boundary: "human"
+        host: deps.agentHost
       });
       return;
     }
@@ -6572,14 +6468,13 @@ function createRouter(dbOrDeps) {
         notFound(res);
         return;
       }
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const id = segments[3];
       const run = db.getRun(id);
       if (!run) {
         notFound(res, "Run not found");
         return;
       }
-      jsonNoCors(res, { run });
+      json(res, { run });
       return;
     }
     if (path === "/api/stats/costs" && req.method === "GET") {
@@ -6590,19 +6485,18 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/insights/knowledge-changes" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!deps.agentHost) {
-        jsonNoCors(res, { status: "unavailable", reason: "agent_host_unavailable" }, 503);
+        json(res, { status: "unavailable", reason: "agent_host_unavailable" }, 503);
         return;
       }
       const from = url.searchParams.get("from") ?? void 0;
       const to = url.searchParams.get("to") ?? void 0;
       void readInsightsKnowledgeChanges(deps.agentHost, db, { from, to }).then(
         (body) => {
-          jsonNoCors(res, body);
+          json(res, body);
         },
         () => {
-          jsonNoCors(res, { status: "unavailable", reason: "read_failed" }, 500);
+          json(res, { status: "unavailable", reason: "read_failed" }, 500);
         }
       );
       return;
@@ -6668,10 +6562,7 @@ function createRouter(dbOrDeps) {
       serveRunEventStream(req, res, {
         runId,
         handleParam: handleParamOf(req),
-        // 403-03 (D-13 · INVK-05): the resume point, read from the SAME pair the authed door reads
-        // it from. `url.searchParams.get('lastEventId')` would resolve a repeated parameter to its
-        // first value — the one answer `lastEventIdParamOf` exists to refuse — and a second
-        // header/query precedence rule here would be a second contract for where a client resumes.
+        // Read from the same pair as the authed door; `searchParams.get` takes a repeated first.
         resume: resumePointOf(req.headers["last-event-id"], lastEventIdParamOf(req)),
         attach: deps.runServiceAttach
       });
@@ -6713,7 +6604,6 @@ function createRouter(dbOrDeps) {
         try {
           attributes = buildRunRequestAttributes({
             trigger: "api",
-            runner: "local",
             userAttributes: body.attributes
           });
         } catch (err) {
@@ -6721,25 +6611,10 @@ function createRouter(dbOrDeps) {
           return;
         }
         const args = normalizedFileTarget ? [normalizedFileTarget.executionPath] : [];
-        const source = isSuiteFile ? "suite" : "dashboard";
-        try {
-          await executionBackend?.preflight?.({ args, source });
-        } catch (error) {
-          const denial = runDenialOf(error);
-          if (denial !== void 0) {
-            json(res, denial, 403);
-            return;
-          }
-          json(res, { error: error instanceof Error ? error.message : String(error) }, 400);
-          return;
-        }
         const runId = jobQueue.enqueue({
           name: body.name,
           filePath: normalizedFileTarget?.storagePath,
-          // 2026-08-24 (402-09, D-11): NO PARENT KIND IS MINTED. A suite run is ONE run row
-          // with member handles, so a parent artifact kind would claim parenthood over rows
-          // nothing creates. `isSuiteFile` still travels in `metadata.isSuite` below, and the run's
-          // own `suite_id` plus the artifact's `source.kind` snapshot still say it is a suite.
+          // No parent kind is minted; `metadata.isSuite` and `suite_id` say it is a suite.
           kind: "test",
           attributes,
           priority: body.priority,
@@ -6822,17 +6697,6 @@ function createRouter(dbOrDeps) {
           args.push("--disable-cache");
         }
         const isSuite = Boolean(isSuiteFile);
-        try {
-          await executionBackend?.preflight?.({ args, source: isSuite ? "suite" : "dashboard" });
-        } catch (error) {
-          const denial = runDenialOf(error);
-          if (denial !== void 0) {
-            json(res, denial, 403);
-            return;
-          }
-          json(res, { error: error instanceof Error ? error.message : String(error) }, 400);
-          return;
-        }
         let testName = body.file ? (0, import_node_path8.basename)(normalizedFileTarget?.storagePath ?? body.file, ".yaml") : "unknown";
         let fileParallel;
         let platform;
@@ -6875,11 +6739,10 @@ function createRouter(dbOrDeps) {
         const runId = jobQueue.enqueue({
           name: testName,
           filePath: normalizedFileTarget?.storagePath ?? body.file,
-          // 2026-08-24 (402-09, D-11): no parent kind minted — see the enqueue route above.
+          // No parent kind is minted; see the enqueue route above.
           kind: "test",
           attributes: buildRunRequestAttributes({
-            trigger: triggerSource.trigger,
-            runner: body.local === false ? "browserstack" : "local"
+            trigger: triggerSource.trigger
           }),
           platform,
           parallel: effectiveParallel,
@@ -7432,9 +7295,8 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/config" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!configManager) {
-        jsonNoCors(res, { error: "Config management not available" }, 501);
+        json(res, { error: "Config management not available" }, 501);
         return;
       }
       ;
@@ -7442,7 +7304,7 @@ function createRouter(dbOrDeps) {
         try {
           const read = await configManager.readMasked();
           if (read.kind === "file_invalid") {
-            jsonNoCors(res, { error: "file_invalid", message: read.message }, 409);
+            json(res, { error: "file_invalid", message: read.message }, 409);
             return;
           }
           const { config, revision, lines, fileIssues } = read;
@@ -7452,7 +7314,7 @@ function createRouter(dbOrDeps) {
           const activeLlm = use?.llm ?? config.defaultLLM;
           const defaultCfg = Array.isArray(llms) ? llms.find((c) => c?.name === activeLlm) : void 0;
           const provider = defaultCfg?.provider ?? null;
-          jsonNoCors(res, {
+          json(res, {
             config,
             provider,
             revision,
@@ -7460,45 +7322,17 @@ function createRouter(dbOrDeps) {
             ...fileIssues.length > 0 ? { fileIssues } : {}
           });
         } catch (err) {
-          jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to read config" }, 500);
+          json(res, { error: err instanceof Error ? err.message : "Failed to read config" }, 500);
         }
       })();
       return;
     }
-    if (path === "/api/config/farm/test-connection" && req.method === "POST") {
-      readJsonBody(req).then(async (body) => {
-        if (body.provider !== "browserstack") {
-          json(res, { error: "Only BrowserStack is currently supported" }, 400);
-          return;
-        }
-        try {
-          const auth = Buffer.from(`${body.username}:${body.accessKey}`).toString("base64");
-          const response = await fetch("https://api-cloud.browserstack.com/app-automate/devices.json", {
-            headers: { Authorization: `Basic ${auth}` }
-          });
-          if (response.ok) {
-            json(res, { success: true });
-          } else if (response.status === 401) {
-            json(res, { success: false, error: "Invalid credentials" });
-          } else {
-            json(res, { success: false, error: `BrowserStack API returned ${response.status}` });
-          }
-        } catch (err) {
-          json(res, { success: false, error: err instanceof Error ? err.message : "Connection failed" });
-        }
-      }).catch(() => json(res, { error: "Invalid request body" }, 400));
-      return;
-    }
     if (path.startsWith("/api/auth/") && req.method === "DELETE") {
       const segments = path.split("/");
       if (segments.length === 4 && segments[2] === "auth") {
         const providerName = decodeURIComponent(segments[3]);
         if (providerName === "status" || providerName === "credential" || providerName === "oauth") {
         } else {
-          if (refuseCrossSiteRequest(req) !== void 0) {
-            jsonNoCors(res, { error: "cross_site_refused" }, 403);
-            return;
-          }
           ;
           (async () => {
             try {
@@ -7509,13 +7343,13 @@ function createRouter(dbOrDeps) {
                 return credential;
               });
               if (removed === void 0) {
-                jsonNoCors(res, { deleted: false });
+                json(res, { deleted: false });
                 return;
               }
               const undo = undoStore.put({ kind: "credential", name: providerName, credential: removed }, Date.now());
-              jsonNoCors(res, { deleted: true, undo });
+              json(res, { deleted: true, undo });
             } catch (err) {
-              jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to delete credential" }, 500);
+              json(res, { error: err instanceof Error ? err.message : "Failed to delete credential" }, 500);
             }
           })();
           return;
@@ -7625,27 +7459,21 @@ function createRouter(dbOrDeps) {
       const segments = path.split("/");
       const provider = segments.length >= 6 ? decodeURIComponent(segments[4] ?? "") : "";
       const action = segments.length >= 6 ? segments[5] : "";
-      const authDoor = req.method === "POST" && (action === "start" || action === "exchange");
-      if (authDoor && refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       const plugin = provider ? (0, import_agent_qa_core9.getLLMAuthProviderPlugin)(provider) : void 0;
       if (!plugin) {
-        ;
-        (authDoor ? jsonNoCors : json)(res, { error: `Auth plugin provider "${provider}" is not registered` }, 404);
+        json(res, { error: `Auth plugin provider "${provider}" is not registered` }, 404);
         return;
       }
       if (action === "start" && req.method === "POST") {
         readJsonBody(req).then(async (body) => {
           if (!plugin.startAuth) {
-            jsonNoCors(res, { error: `Provider "${provider}" does not support dashboard auth start` }, 400);
+            json(res, { error: `Provider "${provider}" does not support dashboard auth start` }, 400);
             return;
           }
           try {
             const target = await requirePluginAuthConfig(configManager, body.configName, plugin);
             if (!target.ok) {
-              jsonNoCors(res, credentialRefusalBody(target), target.status);
+              json(res, credentialRefusalBody(target), target.status);
               return;
             }
             const started = await plugin.startAuth({
@@ -7681,16 +7509,16 @@ function createRouter(dbOrDeps) {
                 session.error = err instanceof Error ? err.message : "Authentication failed";
               }).finally(() => cleanupPluginOAuthSession(session));
             }
-            jsonNoCors(res, {
+            json(res, {
               authorizeUrl: started.authorizeUrl,
               sessionId,
               mode: plugin.dashboardAuth.mode,
               created: target.created
             });
           } catch (err) {
-            jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to start auth plugin flow" }, 500);
+            json(res, { error: err instanceof Error ? err.message : "Failed to start auth plugin flow" }, 500);
           }
-        }).catch(() => jsonNoCors(res, { error: "Invalid request body" }, 400));
+        }).catch(() => json(res, { error: "Invalid request body" }, 400));
         return;
       }
       if (action === "result" && req.method === "GET") {
@@ -7718,22 +7546,22 @@ function createRouter(dbOrDeps) {
       if (action === "exchange" && req.method === "POST") {
         readJsonBody(req).then(async (body) => {
           if (!plugin.exchangeCode) {
-            jsonNoCors(res, { error: `Provider "${provider}" does not support code exchange` }, 400);
+            json(res, { error: `Provider "${provider}" does not support code exchange` }, 400);
             return;
           }
           const sessionId = typeof body.sessionId === "string" ? body.sessionId.trim() : "";
           const code = typeof body.code === "string" ? body.code.trim() : "";
           if (!sessionId || !code) {
-            jsonNoCors(res, { error: "sessionId and code are required" }, 400);
+            json(res, { error: "sessionId and code are required" }, 400);
             return;
           }
           const session = pluginOAuthSessions.get(sessionId);
           if (!session || session.providerId !== provider) {
-            jsonNoCors(res, { error: "Auth session not found" }, 404);
+            json(res, { error: "Auth session not found" }, 404);
             return;
           }
           if (session.status !== "pending") {
-            jsonNoCors(res, { error: "Auth session is no longer pending" }, 409);
+            json(res, { error: "Auth session is no longer pending" }, 409);
             return;
           }
           try {
@@ -7755,61 +7583,57 @@ function createRouter(dbOrDeps) {
               session.error = CREDENTIAL_PROVIDER_CONFLICT.message;
               cleanupPluginOAuthSession(session);
               pluginOAuthSessions.delete(sessionId);
-              jsonNoCors(res, credentialRefusalBody(CREDENTIAL_PROVIDER_CONFLICT), CREDENTIAL_PROVIDER_CONFLICT.status);
+              json(res, credentialRefusalBody(CREDENTIAL_PROVIDER_CONFLICT), CREDENTIAL_PROVIDER_CONFLICT.status);
               return;
             }
             session.status = "completed";
             cleanupPluginOAuthSession(session);
             pluginOAuthSessions.delete(sessionId);
-            jsonNoCors(res, { status: "completed", saved: true });
+            json(res, { status: "completed", saved: true });
           } catch (err) {
             session.status = "error";
             session.error = err instanceof Error ? err.message : "Token exchange failed";
             cleanupPluginOAuthSession(session);
             pluginOAuthSessions.delete(sessionId);
-            jsonNoCors(res, { error: session.error }, 500);
+            json(res, { error: session.error }, 500);
           }
-        }).catch(() => jsonNoCors(res, { error: "Invalid request body" }, 400));
+        }).catch(() => json(res, { error: "Invalid request body" }, 400));
         return;
       }
       json(res, { error: "Auth plugin route not found" }, 404);
       return;
     }
     if (path === "/api/auth/credential" && req.method === "POST") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       readJsonBody(req).then(async (body) => {
         const provider = typeof body.provider === "string" ? body.provider.trim() : "";
         const credentialType = typeof body.type === "string" ? body.type.trim() : "";
         const secret = typeof body.secret === "string" ? body.secret.trim() : "";
         if (typeof body.configName !== "string" || body.configName.trim() === "") {
-          jsonNoCors(res, { error: "configName is required" }, 400);
+          json(res, { error: "configName is required" }, 400);
           return;
         }
         if (!provider || !isKnownLLMProvider(provider)) {
-          jsonNoCors(res, { error: "valid provider is required" }, 400);
+          json(res, { error: "valid provider is required" }, 400);
           return;
         }
         if (credentialType !== "api-key" && credentialType !== "bearer-token") {
-          jsonNoCors(res, { error: "type must be api-key or bearer-token" }, 400);
+          json(res, { error: "type must be api-key or bearer-token" }, 400);
           return;
         }
         if (!secret) {
-          jsonNoCors(res, { error: "secret is required" }, 400);
+          json(res, { error: "secret is required" }, 400);
           return;
         }
         if ((0, import_agent_qa_core9.getLLMAuthProviderPlugin)(provider)) {
-          jsonNoCors(res, { error: "Subscription providers use OAuth login" }, 400);
+          json(res, { error: "Subscription providers use OAuth login" }, 400);
           return;
         }
         if (credentialType === "bearer-token" && provider !== "anthropic-compatible") {
-          jsonNoCors(res, { error: "bearer-token credentials are only supported for anthropic-compatible configs" }, 400);
+          json(res, { error: "bearer-token credentials are only supported for anthropic-compatible configs" }, 400);
           return;
         }
         if (credentialType === "api-key" && !API_KEY_CREDENTIAL_PROVIDERS.has(provider)) {
-          jsonNoCors(res, { error: "api-key credentials are not supported for this provider" }, 400);
+          json(res, { error: "api-key credentials are not supported for this provider" }, 400);
           return;
         }
         try {
@@ -7824,35 +7648,31 @@ function createRouter(dbOrDeps) {
             return checked;
           });
           if (!target.ok) {
-            jsonNoCors(res, credentialRefusalBody(target), target.status);
+            json(res, credentialRefusalBody(target), target.status);
             return;
           }
-          jsonNoCors(res, { saved: true, created: target.created });
+          json(res, { saved: true, created: target.created });
         } catch (err) {
-          jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to save credential" }, 500);
+          json(res, { error: err instanceof Error ? err.message : "Failed to save credential" }, 500);
         }
-      }).catch(() => jsonNoCors(res, { error: "Invalid request body" }, 400));
+      }).catch(() => json(res, { error: "Invalid request body" }, 400));
       return;
     }
     if (path === "/api/auth/credential/move" && req.method === "POST") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       readJsonBody(req).then(async (raw) => {
         const parsed = import_agent_qa_schema11.LlmCredentialMoveRequestSchema.safeParse(raw);
         if (!parsed.success) {
-          jsonNoCors(res, { error: "invalid_setup_input" }, 400);
+          json(res, { error: "invalid_setup_input" }, 400);
           return;
         }
         const from = checkCredentialName(parsed.data.from);
         const to = checkCredentialName(parsed.data.to);
         if (!from.ok || !to.ok) {
-          jsonNoCors(res, { error: "name_invalid" }, 400);
+          json(res, { error: "name_invalid" }, 400);
           return;
         }
         if (!configManager) {
-          jsonNoCors(res, { error: "Config manager is required to move credentials" }, 400);
+          json(res, { error: "Config manager is required to move credentials" }, 400);
           return;
         }
         try {
@@ -7870,25 +7690,21 @@ function createRouter(dbOrDeps) {
             return void 0;
           });
           if (refusal) {
-            jsonNoCors(res, credentialRefusalBody(refusal), refusal.status);
+            json(res, credentialRefusalBody(refusal), refusal.status);
             return;
           }
-          jsonNoCors(res, { moved: true });
+          json(res, { moved: true });
         } catch (err) {
-          jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to move credential" }, 500);
+          json(res, { error: err instanceof Error ? err.message : "Failed to move credential" }, 500);
         }
-      }).catch(() => jsonNoCors(res, { error: "invalid_setup_input" }, 400));
+      }).catch(() => json(res, { error: "invalid_setup_input" }, 400));
       return;
     }
     if (path === "/api/llm/test" && req.method === "POST") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       readJsonBody(req).then(async (body) => {
         const rawBody = body;
         if ("apiKey" in rawBody) {
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: "invalid_request",
             message: "apiKey is not accepted in LLM test requests. Save credentials for the named config instead."
@@ -7898,7 +7714,7 @@ function createRouter(dbOrDeps) {
         const providerName = typeof body.provider === "string" ? body.provider.trim() : "";
         const modelName = typeof body.model === "string" ? body.model.trim() : "";
         if (!providerName || !modelName) {
-          jsonNoCors(res, { success: false, error: "invalid_request", message: "provider and model are required" }, 400);
+          json(res, { success: false, error: "invalid_request", message: "provider and model are required" }, 400);
           return;
         }
         const configName = typeof body.configName === "string" ? body.configName.trim() : "";
@@ -7923,7 +7739,7 @@ function createRouter(dbOrDeps) {
         }
         const parsedConfig = import_agent_qa_core9.ModelConfigSchema.safeParse(llmCandidate);
         if (!parsedConfig.success) {
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: "invalid_request",
             message: parsedConfig.error.issues.map((issue) => `${issue.path.map(String).join(".") || "config"}: ${issue.message}`).join("; ")
@@ -7935,7 +7751,7 @@ function createRouter(dbOrDeps) {
         const coreAuth = await import("@vostride/agent-qa-core");
         const resolvedAuth = await coreAuth.resolveLLMAuth(configName, llmConfig2);
         if (resolvedAuth.kind === "missing") {
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: "missing_credential",
             message: resolvedAuth.message
@@ -7964,7 +7780,7 @@ function createRouter(dbOrDeps) {
           } finally {
             clearTimeout(timeout);
           }
-          jsonNoCors(res, {
+          json(res, {
             success: true,
             model: modelName,
             provider: providerName,
@@ -7979,7 +7795,7 @@ function createRouter(dbOrDeps) {
           const providerMessage = withDeclaredMask(declaredMask, (mask) => mask(unsavedMessage));
           const errorClass = (0, import_agent_qa_schema11.classifyProviderError)(providerMessage ?? unsavedMessage, statusCode);
           const message = providerMessage === void 0 ? (0, import_agent_qa_schema11.providerErrorSentence)(errorClass, "").trimEnd() : (0, import_agent_qa_schema11.providerErrorSentence)(errorClass, providerMessage);
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: errorClass,
             message,
@@ -7989,7 +7805,7 @@ function createRouter(dbOrDeps) {
             ...unauthenticated ? { unauthenticated: true, authMessage } : {}
           });
         }
-      }).catch(() => jsonNoCors(res, { success: false, error: "invalid_request", message: "Invalid request body" }, 400));
+      }).catch(() => json(res, { success: false, error: "invalid_request", message: "Invalid request body" }, 400));
       return;
     }
     if (path === "/api/cache/purge" && req.method === "POST") {
@@ -7998,56 +7814,15 @@ function createRouter(dbOrDeps) {
         return;
       }
       readJsonBody(req).then(async (body) => {
-        if (!body.file && !body.all) {
-          json(res, { error: "Either file or all is required" }, 400);
+        if (body.all !== true) {
+          json(res, { error: "all is required" }, 400);
           return;
         }
         try {
           const cfg = await readConfigValues(configManager);
-          const cacheDir = cfg.services?.cache?.dir ?? cfg.cache?.dir;
-          if (!cacheDir) {
-            json(res, { error: "Cache directory not configured" }, 400);
-            return;
-          }
           const configDir = deps.configPath ? (0, import_node_path8.dirname)((0, import_node_path8.resolve)(deps.configPath)) : process.cwd();
-          const resolvedCacheDir = (0, import_node_path8.resolve)(configDir, cacheDir);
-          let branchDirs;
-          try {
-            branchDirs = await (0, import_promises7.readdir)(resolvedCacheDir);
-          } catch (err) {
-            if (err.code === "ENOENT") {
-              json(res, { purged: 0 });
-              return;
-            }
-            throw err;
-          }
-          let purged = 0;
-          for (const branch of branchDirs) {
-            const branchPath = (0, import_node_path8.join)(resolvedCacheDir, branch);
-            let entryStat;
-            try {
-              entryStat = await (0, import_promises7.stat)(branchPath);
-            } catch {
-              continue;
-            }
-            if (!entryStat.isDirectory()) {
-              await (0, import_promises7.rm)(branchPath, { force: true });
-              continue;
-            }
-            let files;
-            try {
-              files = await (0, import_promises7.readdir)(branchPath);
-            } catch {
-              continue;
-            }
-            for (const file of files) {
-              if (!file.endsWith(".json")) continue;
-              await (0, import_promises7.rm)((0, import_node_path8.join)(branchPath, file), { force: true });
-              purged++;
-            }
-            await (0, import_promises7.rm)(branchPath, { recursive: true, force: true }).catch(() => {
-            });
-          }
+          const cacheDir = cfg.services?.cache?.dir ?? import_agent_qa_core9.DEFAULT_AGENT_QA_CACHE_DIR;
+          const purged = await (0, import_agent_qa_runner_local2.purgeActionCache)((0, import_node_path8.resolve)(configDir, cacheDir));
           json(res, { purged });
         } catch (err) {
           json(res, { error: err instanceof Error ? err.message : "Cache purge failed" }, 500);
@@ -8131,7 +7906,7 @@ function createRouter(dbOrDeps) {
             return;
           }
           const workspaceEnv = await readWorkspaceEnvVars(workspacePaths);
-          const result = await new import_agent_qa_runner_local2.DockerHookExecutor().execute(resolvedHook, {
+          const result = await new import_agent_qa_runner_local2.DockerHookExecutor({ version: (0, import_agent_qa_core9.getAgentQaVersion)() }).execute(resolvedHook, {
             env: {
               ...workspaceEnv,
               ...validation.overrides
@@ -8167,7 +7942,7 @@ function createRouter(dbOrDeps) {
             variables: shown.variables,
             sandbox: {
               runtime: resolvedHook.runtime,
-              image: import_agent_qa_core9.RUNTIME_IMAGE_MAP[resolvedHook.runtime],
+              image: (0, import_agent_qa_core9.hookRunnerImage)(resolvedHook.runtime, (0, import_agent_qa_core9.getAgentQaVersion)()),
               networkMode: resolvedHook.network ? "enabled" : "disabled",
               dockerVersion: null,
               networkLogsAvailable: shown.networkLogs.length > 0,
@@ -8371,12 +8146,8 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (req.method === "GET" && /^\/api\/live-editor\/sessions\/[^/]+\/live-url$/.test(path)) {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       if (!deps.mintEditorLiveUrl) {
-        jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+        json(res, { error: "live_view_unavailable" }, 503);
         return;
       }
       let editorSessionId;
@@ -8385,33 +8156,32 @@ function createRouter(dbOrDeps) {
           path.slice("/api/live-editor/sessions/".length, -"/live-url".length)
         );
       } catch {
-        jsonNoCors(res, { error: "unknown_session" }, 404);
+        json(res, { error: "unknown_session" }, 404);
         return;
       }
       void deps.mintEditorLiveUrl(editorSessionId).then(
         (result) => {
-          jsonNoCors(res, result);
+          json(res, result);
         },
         (error) => {
           const name = error instanceof Error ? error.name : "";
           if (name === "UnknownLiveEditorSessionError") {
-            jsonNoCors(res, { error: "unknown_session" }, 404);
+            json(res, { error: "unknown_session" }, 404);
             return;
           }
           if (name === "LiveViewUnavailableError") {
-            jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+            json(res, { error: "live_view_unavailable" }, 503);
             return;
           }
-          jsonNoCors(res, { error: "live_url_mint_failed" }, 500);
+          json(res, { error: "live_url_mint_failed" }, 500);
         }
       );
       return;
     }
     const liveEditorAuthStateMatch = path.match(/^\/api\/live-editor\/sessions\/([^/]+)\/auth-state$/);
     if (liveEditorAuthStateMatch && req.method === "POST") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
       ;
@@ -8422,35 +8192,34 @@ function createRouter(dbOrDeps) {
           const body = await readJsonBody(req);
           const parsedName = import_agent_qa_core9.AuthStateNameSchema.safeParse(typeof body?.name === "string" ? body.name : "");
           if (!parsedName.success) {
-            jsonNoCors(res, { error: "Auth state name must be a lowercase slug." }, 400);
+            json(res, { error: "Auth state name must be a lowercase slug." }, 400);
             return;
           }
           stateName = parsedName.data;
           session = sessionManager.getSession(decodeURIComponent(liveEditorAuthStateMatch[1]));
           if (!session) {
-            jsonNoCors(res, { error: "Session not found" }, 404);
+            json(res, { error: "Session not found" }, 404);
             return;
           }
           if (typeof session.captureWebAuthState !== "function") {
-            jsonNoCors(res, {
+            json(res, {
               error: `Could not save auth state "${stateName}" for target "${getSessionTargetNameForAuthState(session)}".`
             }, 500);
             return;
           }
           const authState = await session.captureWebAuthState(stateName, { replace: body?.replace === true });
-          jsonNoCors(res, { authState });
+          json(res, { authState });
         } catch (err) {
           const targetName = getSessionTargetNameForAuthState(session);
           const response = buildAuthStateSaveErrorMessage(stateName || "unknown", targetName, err);
-          jsonNoCors(res, { error: response.message }, response.status);
+          json(res, { error: response.message }, response.status);
         }
       })();
       return;
     }
     if (path === "/api/live-editor/sessions" && req.method === "POST") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
       ;
@@ -8458,16 +8227,10 @@ function createRouter(dbOrDeps) {
         try {
           const body = await readJsonBody(req);
           const targetName = typeof body?.targetName === "string" ? body.targetName : void 0;
-          const production = await resolveLiveTargetProduction(configManager, targetName);
-          const productionRefusal = liveProductionRefusal(production);
-          if (productionRefusal !== void 0) {
-            jsonNoCors(res, { error: productionRefusal.message }, 403);
-            return;
-          }
           const platform = body?.platform ?? "web";
           const runtimeLLM = await resolveDashboardRuntimeLLM(configManager, llmConfig, authFetch);
           if (!runtimeLLM.ok) {
-            jsonNoCors(res, { error: runtimeLLM.error }, 400);
+            json(res, { error: runtimeLLM.error }, 400);
             return;
           }
           const setupHooks = Array.isArray(body?.setupHooks) ? body.setupHooks.filter((value) => typeof value === "string" && value.trim().length > 0) : [];
@@ -8486,14 +8249,14 @@ function createRouter(dbOrDeps) {
           let resolvedHooks = /* @__PURE__ */ new Map();
           let hookRegistryError;
           if (!workspacePaths) {
-            jsonNoCors(res, { error: "Workspace path resolution not available" }, 500);
+            json(res, { error: "Workspace path resolution not available" }, 500);
             return;
           }
           try {
             const envContent = await (0, import_promises7.readFile)(workspacePaths.envFile.absolutePath, "utf-8");
             envVars = (0, import_agent_qa_core9.parseEnvFile)(envContent);
           } catch {
-            jsonNoCors(res, { error: `workspace.envFile file could not be loaded: ${workspacePaths.envFile.workspaceRelativePath}` }, 400);
+            json(res, { error: `workspace.envFile file could not be loaded: ${workspacePaths.envFile.workspaceRelativePath}` }, 400);
             return;
           }
           try {
@@ -8501,7 +8264,7 @@ function createRouter(dbOrDeps) {
             secretStore = import_agent_qa_runner2.SecretStore.fromEnvContent(secretsContent);
             secretRedactor = new import_agent_qa_runner2.SecretRedactor(secretStore);
           } catch {
-            jsonNoCors(res, { error: `workspace.secretsFile file could not be loaded: ${workspacePaths.secretsFile.workspaceRelativePath}` }, 400);
+            json(res, { error: `workspace.secretsFile file could not be loaded: ${workspacePaths.secretsFile.workspaceRelativePath}` }, 400);
             return;
           }
           const hookCatalog = await readWorkspaceHooks(configManager, deps.configPath);
@@ -8512,6 +8275,11 @@ function createRouter(dbOrDeps) {
             ...suiteFileManager === void 0 ? {} : { findSuite: (id) => suiteFileManager.findBySuiteId(id) }
           };
           const plannerLimits = await resolveLivePlannerLimits(configManager, entityRef, entityReaders);
+          const navigationTimeoutMs = await resolveLiveNavigationTimeoutMs(
+            configManager,
+            entityRef,
+            entityReaders
+          );
           const sessionSuiteRef = entityRef?.type === "suite" ? entityRef : void 0;
           const plannerLimitsForTest = (testId) => resolveLivePlannerLimits(
             configManager,
@@ -8522,7 +8290,6 @@ function createRouter(dbOrDeps) {
             {
               platform,
               targetName,
-              production: { productionTargetNames: production.productionTargetNames },
               plannerLimits,
               plannerLimitsForTest,
               llmConfig: runtimeLLM.llmConfig,
@@ -8536,6 +8303,7 @@ function createRouter(dbOrDeps) {
               hookRegistryError,
               url: body?.url,
               headless: body?.headless ?? false,
+              navigationTimeoutMs,
               useDeviceName: typeof body?.useDeviceName === "string" ? body.useDeviceName : void 0,
               appState: body?.appState === "preserve" || body?.appState === "reset" ? body.appState : void 0,
               bundleId: typeof body?.bundleId === "string" ? body.bundleId : void 0,
@@ -8545,38 +8313,37 @@ function createRouter(dbOrDeps) {
             },
             entityRef
           );
-          jsonNoCors(res, { sessionId, sessionNumber }, 201);
+          json(res, { sessionId, sessionNumber }, 201);
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          const status = err instanceof LiveProductionRefusedError ? 403 : err instanceof LivePlannerLimitsRefusedError ? 400 : 500;
-          jsonNoCors(res, { error: message }, status);
+          const refused = err instanceof LivePlannerLimitsRefusedError || err instanceof LiveNavigationTimeoutRefusedError;
+          const status = refused ? 400 : 500;
+          json(res, { error: message }, status);
         }
       })();
       return;
     }
     if (path === "/api/live-editor/sessions" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
-      jsonNoCors(res, { sessions: sessionManager.listSessions() });
+      json(res, { sessions: sessionManager.listSessions() });
       return;
     }
     const liveEditorSessionMatch = path.match(/^\/api\/live-editor\/sessions\/([^/]+)$/);
     if (liveEditorSessionMatch && req.method === "DELETE") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
       const sessionId = liveEditorSessionMatch[1];
       (async () => {
         const terminated = await sessionManager.terminateSession(sessionId);
         if (terminated) {
-          jsonNoCors(res, { ok: true });
+          json(res, { ok: true });
         } else {
-          jsonNoCors(res, { error: "Session not found" }, 404);
+          json(res, { error: "Session not found" }, 404);
         }
       })();
       return;
@@ -8625,6 +8392,7 @@ function createRouter(dbOrDeps) {
 // src/queue/job-queue.ts
 var import_node_events = require("node:events");
 var import_node_os2 = require("node:os");
+var import_agent_qa_core10 = require("@vostride/agent-qa-core");
 var NOT_CANCELLABLE = { kind: "not-cancellable" };
 var JobQueue = class extends import_node_events.EventEmitter {
   db;
@@ -8647,8 +8415,7 @@ var JobQueue = class extends import_node_events.EventEmitter {
     this.pollInterval = setInterval(() => this.dispatchReported("a poll"), intervalMs);
     this.on("enqueued", () => this.dispatchReported("an enqueue"));
   }
-  // 2026-10-17 (444-16, D-50): the server closes the database after this; a run that settles later
-  // still frees its slot, and nothing reads the closed database.
+  // The server closes the database after this; a run settling later still frees its slot.
   stop() {
     this.stopped = true;
     if (this.pollInterval) {
@@ -8734,7 +8501,10 @@ var JobQueue = class extends import_node_events.EventEmitter {
       this.processNext();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      console.error(`Queue could not dispatch the next run after ${trigger}: ${message}`);
+      (0, import_agent_qa_core10.printRunText)(
+        `Queue could not dispatch the next run after ${trigger}: ${message}`,
+        (text) => console.error(text)
+      );
     }
   }
   getActiveCount() {
@@ -8743,9 +8513,7 @@ var JobQueue = class extends import_node_events.EventEmitter {
   getConcurrency() {
     return this.concurrency;
   }
-  // 2026-10-16 (442-05, D-06 to D-08): only the owner cancels a running row; gone is an orphan.
-  // 442-15 (GAP-D2): own is the stamp this handle wrote, or equal non-null start times.
-  // 2026-10-17 (444-06, D-11): a running row is never written here; the run answers with its verdict.
+  // Only the owner stops its running row, never written here; a gone owner's row is an orphan.
   cancel(runId) {
     const run = this.db.getRun(runId);
     if (!run) return NOT_CANCELLABLE;
@@ -8775,21 +8543,7 @@ var JobQueue = class extends import_node_events.EventEmitter {
     const run = this.db.getRun(runId);
     return run && run.status !== "running" && run.status !== "pending" ? { kind: "finished", status: run.status } : NOT_CANCELLABLE;
   }
-  // 2026-08-24 (Phase 402 plan 09, D-11): THE CHILD-RUN CANCELLATION FAN-OUT IS DELETED WITH THE
-  // MODEL THAT MINTED ITS CHILDREN.
-  //
-  // ~19 lines stood here walking the run's child rows and cancelling each member row. Under
-  // the one-run model a parallel suite is ONE run row with member handles (402-04) — nothing writes
-  // the run row's parent-link column any more (405-07 then deleted the column outright), so the
-  // walk could only ever have read an empty list while reading as live cancellation policy.
-  // Cancelling the run cancels the run.
-  //
-  // WHAT THIS DOES NOT TOUCH: `parallel` below. D-11 keeps the queue's parallel flag as CROSS-RUN
-  // concurrency of INDEPENDENT jobs, which is what `findNextEligible` has always used it for. What
-  // was deleted is parallel-SUITE semantics, not the queue's ability to run two unrelated jobs.
-  //
-  // HISTORICAL ROWS: a pre-402 suite run still lists its members on the read side; cancelling
-  // such a run now leaves those member rows in whatever state their own process left them.
+  // `parallel` is cross-run concurrency of independent jobs; a suite is one run row.
   findNextEligible() {
     if (this.activeCount >= this.concurrency) return void 0;
     const pending = this.db.getPendingRuns();
@@ -8816,17 +8570,17 @@ var import_promises8 = require("node:fs/promises");
 var import_node_path9 = require("node:path");
 var import_agent_qa_ids3 = require("@vostride/agent-qa-ids");
 var import_yaml8 = require("yaml");
-var import_agent_qa_core10 = require("@vostride/agent-qa-core");
+var import_agent_qa_core11 = require("@vostride/agent-qa-core");
 var SuiteFileManager = class {
   constructor(workspace, testFileManager) {
     this.workspace = workspace;
     this.testFileManager = testFileManager;
   }
   testFileManager;
-  // 2026-10-18 (444-33, D-65; 444-35, D-66): each list call reads the workspace itself; each file is written whole and one writer at a time.
+  // Each list call reads the workspace itself; each file is written whole, one writer at a time.
   underLock = createPathLock();
   async list() {
-    const records = await (0, import_agent_qa_core10.discoverWorkspaceFiles)({ workspace: this.workspace, kind: "suite" });
+    const records = await (0, import_agent_qa_core11.discoverWorkspaceFiles)({ workspace: this.workspace, kind: "suite" });
     const files = [];
     for (const record of records) {
       try {
@@ -8888,7 +8642,7 @@ var SuiteFileManager = class {
     if (!trimmedPath) {
       throw new Error("Suite path is required");
     }
-    const target = await (0, import_agent_qa_core10.resolveWorkspaceFileTarget)({
+    const target = await (0, import_agent_qa_core11.resolveWorkspaceFileTarget)({
       workspace: this.workspace,
       kind: "suite",
       filePath: trimmedPath,
@@ -8912,7 +8666,7 @@ var SuiteFileManager = class {
   async validate(content) {
     try {
       const parsed = (0, import_yaml8.parse)(content);
-      const result = import_agent_qa_core10.SuiteDefinitionSchema.safeParse(parsed);
+      const result = import_agent_qa_core11.SuiteDefinitionSchema.safeParse(parsed);
       if (!result.success) {
         return {
           valid: false,
@@ -8950,7 +8704,7 @@ var SuiteFileManager = class {
     }
   }
   async resolveTarget(relativePath, requireExisting) {
-    return (0, import_agent_qa_core10.resolveWorkspaceFileTarget)({
+    return (0, import_agent_qa_core11.resolveWorkspaceFileTarget)({
       workspace: this.workspace,
       kind: "suite",
       filePath: relativePath,
@@ -8962,7 +8716,7 @@ var SuiteFileManager = class {
 // src/execution/appium-manager.ts
 var import_node_http = require("node:http");
 var import_node_child_process2 = require("node:child_process");
-var import_agent_qa_core11 = require("@vostride/agent-qa-core");
+var import_agent_qa_core12 = require("@vostride/agent-qa-core");
 var import_tree_kill = __toESM(require("tree-kill"), 1);
 var import_picocolors = __toESM(require("picocolors"), 1);
 var APPIUM_PREFIX = import_picocolors.default.magenta("[appium]");
@@ -8983,7 +8737,7 @@ var AppiumManager = class {
     this.startupTimeoutMs = opts?.startupTimeoutMs ?? 3e4;
     this.pollIntervalMs = opts?.pollIntervalMs ?? 500;
     this.logLevel = opts?.logLevel ?? "normal";
-    this.appiumResolver = opts?.appiumResolver ?? import_agent_qa_core11.resolveAppiumExecutable;
+    this.appiumResolver = opts?.appiumResolver ?? import_agent_qa_core12.resolveAppiumExecutable;
   }
   async acquire() {
     await this.ensureRunning();
@@ -9086,23 +8840,23 @@ var AppiumManager = class {
     this.managed = true;
     child.on("error", (err) => {
       if (err.code === "ENOENT") {
-        console.error(`${APPIUM_PREFIX} Appium not found. ${(0, import_agent_qa_core11.formatAppiumInstallGuidance)()}`);
+        console.error(`${APPIUM_PREFIX} Appium not found. ${(0, import_agent_qa_core12.formatAppiumInstallGuidance)()}`);
       } else {
-        console.error(`${APPIUM_PREFIX} Error: ${err.message}`);
+        (0, import_agent_qa_core12.printRunText)(`${APPIUM_PREFIX} Error: ${err.message}`, (text) => console.error(text));
       }
     });
     child.stdout?.on("data", (chunk) => {
       if (this.logLevel !== "debug") return;
       const lines = chunk.toString().split("\n").filter(Boolean);
       for (const line of lines) {
-        console.log(`${APPIUM_PREFIX} ${import_picocolors.default.dim(line)}`);
+        (0, import_agent_qa_core12.printRunText)(`${APPIUM_PREFIX} ${import_picocolors.default.dim(line)}`, (text) => console.log(text));
       }
     });
     child.stderr?.on("data", (chunk) => {
       if (this.logLevel !== "debug") return;
       const lines = chunk.toString().split("\n").filter(Boolean);
       for (const line of lines) {
-        console.error(`${APPIUM_PREFIX} ${import_picocolors.default.dim(line)}`);
+        (0, import_agent_qa_core12.printRunText)(`${APPIUM_PREFIX} ${import_picocolors.default.dim(line)}`, (text) => console.error(text));
       }
     });
     const start = Date.now();
@@ -9184,10 +8938,7 @@ var SessionManager = class {
     this.deps = deps;
   }
   sessions = /* @__PURE__ */ new Map();
-  // Per-entity counter keyed by `${entityType}:${entityId}`.
-  // Monotonic and ephemeral: resets on server restart per CONTEXT D-30.
-  // Never decremented on terminate — a re-open of a terminated entity yields
-  // the next number so "Session #3" after "#2" ends does not confuse users.
+  // Monotonic per entity and reset on restart, so a reopened entity gets the next number.
   counters = /* @__PURE__ */ new Map();
   async createSession(config, entity) {
     if (!config.llmConfig) {
@@ -9244,7 +8995,8 @@ var SessionManager = class {
 };
 
 // src/live-editor/ws-handler.ts
-var import_agent_qa_core12 = require("@vostride/agent-qa-core");
+var import_node_util4 = require("node:util");
+var import_agent_qa_core13 = require("@vostride/agent-qa-core");
 
 // src/live-editor/types.ts
 var LIVE_EDITOR_UNKNOWN_SESSION_CLOSE_CODE = 4404;
@@ -9431,12 +9183,14 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
             try {
               raw = await testFileManager.read(msg.path);
             } catch (readErr) {
-              console.error(`[ws-handler] execute-test: read failed for path=${msg.path}`, readErr);
+              const line = `[ws-handler] execute-test: read failed for path=${msg.path}`;
+              (0, import_agent_qa_core13.printRunText)((0, import_node_util4.format)(line, readErr), () => console.error(line, readErr));
               throw new Error(`Cannot read test file "${msg.path}": ${readErr?.message ?? String(readErr)}`);
             }
-            const parsed = (0, import_agent_qa_core12.parseTestFile)(raw, msg.path);
+            const parsed = (0, import_agent_qa_core13.parseTestFile)(raw, msg.path);
             if (parsed.errors.length > 0) {
-              console.error(`[ws-handler] execute-test: parse errors for ${msg.path}`, parsed.errors);
+              const line = `[ws-handler] execute-test: parse errors for ${msg.path}`;
+              (0, import_agent_qa_core13.printRunText)((0, import_node_util4.format)(line, parsed.errors), () => console.error(line, parsed.errors));
               throw new Error(`Parse error in ${msg.path}: ${parsed.errors[0].message}`);
             }
             const testDef = parsed.tests[0];
@@ -9446,7 +9200,13 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
             const stepInstructions = testDef.steps.map(
               (s) => typeof s === "string" ? s : s.step
             );
-            console.log(`[ws-handler] execute-test: starting "${testDef.name}" (${stepInstructions.length} steps, setup=${(testDef.setup ?? []).length}, teardown=${(testDef.teardown ?? []).length})`);
+            const stepCount = stepInstructions.length;
+            const setupCount = (testDef.setup ?? []).length;
+            const teardownCount = (testDef.teardown ?? []).length;
+            (0, import_agent_qa_core13.printRunText)(
+              `[ws-handler] execute-test: starting "${testDef.name}" (${stepCount} steps, setup=${setupCount}, teardown=${teardownCount})`,
+              (text) => console.log(text)
+            );
             reply({
               type: "test-start",
               test: {
@@ -9468,7 +9228,11 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
                 teardown: testDef.teardown ?? []
               }
             );
-            console.log(`[ws-handler] execute-test: finished "${testDef.name}" status=${result.status} duration=${result.duration}ms${result.error ? ` error=${result.error}` : ""}`);
+            const errorPart = result.error ? ` error=${result.error}` : "";
+            (0, import_agent_qa_core13.printRunText)(
+              `[ws-handler] execute-test: finished "${testDef.name}" status=${result.status} duration=${result.duration}ms${errorPart}`,
+              (text) => console.log(text)
+            );
             reply({
               type: "test-complete",
               test: {
@@ -9481,11 +9245,9 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
             });
             reply({ type: "session-state", state: session.getState() });
           } catch (err) {
-            console.error(`[ws-handler] execute-test: caught error for path=${msg.path}`, {
-              message: err?.message,
-              stack: err?.stack,
-              code: err?.code
-            });
+            const line = `[ws-handler] execute-test: caught error for path=${msg.path}`;
+            const detail = { message: err?.message, stack: err?.stack, code: err?.code };
+            (0, import_agent_qa_core13.printRunText)((0, import_node_util4.format)(line, detail), () => console.error(line, detail));
             reply({
               type: "test-error",
               test: {
@@ -9742,8 +9504,7 @@ function renderLiveEmbedPage(input) {
       if (pending === null) return;
       var header = pending;
       pending = null;
-      // NO MIME TYPE: the decoder sniffs the bytes, so a JPEG screencast frame and a PNG snapshot
-      // both paint in every host, not only in Chromium (428 RESEARCH A2).
+      // No MIME type: the decoder sniffs, so JPEG and PNG frames paint in every host.
       var blob = new Blob([event.data]);
       createImageBitmap(blob).then(function (bitmap) {
         if (canvas.width !== header.width || canvas.height !== header.height) {
@@ -9767,8 +9528,7 @@ function renderLiveEmbedPage(input) {
     try { msg = JSON.parse(event.data); } catch (e) { return; }
 
     if (msg.type === 'ready') {
-      // THE PAINTER IS CHOSEN BY THE DECLARED KIND \u2014 never by a browser name, an adapter class or
-      // a transport guess (LIVE-04's prohibition). A snapshot paints on the same canvas (428 D-11).
+      // The declared kind picks the painter, never a browser name, adapter or transport guess.
       var kind = msg.stream ? msg.stream.kind : undefined;
       if (kind === 'cdp-screencast' || kind === 'snapshot') {
         setState('connecting', 'waiting for the first frame\u2026');
@@ -9815,8 +9575,7 @@ function renderLiveEmbedPage(input) {
     report({ event: 'lost' });
   });
 
-  // A HOST THAT RE-MINTS replaces the fragment; the socket renews in place rather than reloading,
-  // so a renewal never costs the viewer the stream it is watching (D-02).
+  // A re-minting host replaces the fragment; the socket renews in place and the stream continues.
   window.addEventListener('hashchange', function () {
     var next = location.hash.slice(1);
     if (next === '' || socket.readyState !== 1) return;
@@ -10025,7 +9784,7 @@ function createFrameProxy(deps) {
 }
 
 // src/server/server.ts
-var import_agent_qa_core13 = require("@vostride/agent-qa-core");
+var import_agent_qa_core14 = require("@vostride/agent-qa-core");
 var MIME_TYPES = {
   ".html": "text/html; charset=utf-8",
   ".js": "application/javascript",
@@ -10044,9 +9803,10 @@ var MIME_TYPES = {
   ".webp": "image/webp"
 };
 var DashboardRemoteBindRefusedError = class extends Error {
-  constructor(host) {
+  constructor(host, port) {
+    const p = String(port === 0 ? 3470 : port);
     super(
-      `The dashboard was asked to bind ${host}, which is not a loopback interface. Nothing this server serves \u2014 the run trigger, the queue enqueue, the run service, the artifact serving, the config reads \u2014 asks for a credential, so a non-loopback bind would publish an anonymous run trigger to the network. Leave services.dashboard.host unset (it defaults to ${DEFAULT_DASHBOARD_HOST}), and reach a remote dashboard through an authenticating proxy or a tunnel you control.`
+      `The dashboard was asked to bind ${host}, which is not a loopback interface. Nothing this server serves \u2014 the run trigger, the queue enqueue, the run service, the artifact serving, the config reads \u2014 asks for a credential, so a non-loopback bind would publish an anonymous run trigger to the network. Leave services.dashboard.host unset (it defaults to ${DEFAULT_DASHBOARD_HOST}). To use the dashboard from another machine, forward its port with ssh -L ${p}:localhost:${p} <host> and open http://localhost:${p}/.`
     );
     this.host = host;
     this.name = "DashboardRemoteBindRefusedError";
@@ -10057,8 +9817,8 @@ async function startServer(opts) {
   const { db, port = 3470, uiDir, workspacePaths, configPath, llmConfig, authFetch, agentHost, executionBackend, runService, runServiceReadiness, liveView, liveEditorSubjects, postProcessingRelay } = opts;
   const runServiceAttach = opts.runServiceAttach ?? runService?.attach;
   const host = opts.host?.trim() || DEFAULT_DASHBOARD_HOST;
-  if (!(0, import_agent_qa_core13.isLoopbackHost)(host)) {
-    throw new DashboardRemoteBindRefusedError(host);
+  if (!(0, import_agent_qa_core14.isLoopbackHost)(host)) {
+    throw new DashboardRemoteBindRefusedError(host, port);
   }
   const resolvedConfigPath = configPath ?? (0, import_node_path10.resolve)("agent-qa.config.yaml");
   const configManager = new ConfigManager(resolvedConfigPath, opts.declaredSecretMask);
@@ -10093,7 +9853,7 @@ async function startServer(opts) {
           failureSummary = "Test timed out -- process was killed";
         } else if (details.refusedBeforeStart) {
           dbStatus = "failed";
-          refusalProse = details.neutralReason ?? details.reason;
+          refusalProse = details.reason;
           failureSummary = refusalProse ? `Refused before the run started: ${refusalProse}`.slice(0, 300) : "Refused before the run started";
         } else if (status === "completed") {
           dbStatus = "failed";
@@ -10174,7 +9934,10 @@ async function startServer(opts) {
         mobileRuns.set(run.id, platform);
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        console.error(`Failed to start Appium for run ${run.id}: ${message}`);
+        (0, import_agent_qa_core14.printRunText)(
+          `Failed to start Appium for run ${run.id}: ${message}`,
+          (text) => console.error(text)
+        );
         db.updateRun(run.id, {
           status: "failed",
           failureSummary: `Appium server failed to start: ${message}`,
@@ -10194,19 +9957,9 @@ async function startServer(opts) {
       runId: run.id,
       args,
       source: meta.isSuite ? "suite" : "dashboard",
-      // 2026-10-01 (432-14, D-14): no confirm scope is read off the row any more. The browser that
-      // triggered a run is not asked anything, so nothing about it has to survive the wait.
       attributes: run.attributes,
-      // T-401-G26 (401-23): a persisted row's timeout is VALIDATED at the seam that consumes it.
-      // `in-process-backend.ts:211` reads `opts.timeout ?? defaultTimeout` and validates AFTER, so
-      // any non-nullish nonsense here skips the default and leaves the run with no reclamation
-      // timer at all. An unusable value falls back to the backend's default rather than a number
-      // this call invented.
+      // The backend takes `opts.timeout ?? defaultTimeout`, so an unusable value falls back here.
       timeout: sanitizeQueuedExecutionTimeout(meta.timeout),
-      // THE LEASE ABOVE IS UNCHANGED; ONLY ITS DELIVERY IS. `acquireLease` still runs where it ran,
-      // still keys on this run id and still owns the bundled Appium's lifecycle (design-of-record).
-      // What used to ride `AGENT_QA_APPIUM_URL` in a child's environment now travels as an
-      // argument, because there is no child to carry an environment.
       ...isMobile ? { appiumUrl: appiumManager.getUrl() } : {}
     });
   });
@@ -10217,16 +9970,14 @@ async function startServer(opts) {
     appiumManager,
     configManager,
     configPath: resolvedConfigPath,
-    // 428 D-07: each created session registers here, which is what the frame socket attaches.
+    // Each created session registers here, which is what the frame socket attaches.
     ...liveEditorSubjects === void 0 ? {} : { liveEditorSubjects }
   });
   const servesLiveView = liveView !== void 0 && (runServiceAttach !== void 0 || liveEditorSubjects !== void 0);
   const apiRouter = createRouter({
     db,
     workspacePaths,
-    // 401-07: conditionally spread on the same house rule `agentHost` follows — an absent
-    // dependency is an ABSENT field, never a present `undefined`, so the router's own 503 arm is
-    // what decides, in one place.
+    // Absent dependencies are absent fields, so the router's own 503 arm decides in one place.
     ...executionBackend === void 0 ? {} : { executionBackend },
     jobQueue,
     testFileManager,
@@ -10237,27 +9988,13 @@ async function startServer(opts) {
     llmConfig,
     authFetch,
     sessionManager,
-    // 400-01: conditionally spread on the house rule an absent dependency is an ABSENT field and
-    // never a present `undefined` — the router's own 501 arm is what decides, in one place.
+    // Absent dependencies are absent fields, so the router's own 501 arm decides in one place.
     ...agentHost === void 0 ? {} : { agentHost },
-    // 402-05 (D-15): the same conditional-spread house rule. Absent means a legacy mount rather
-    // than an unconfigured service, and the router's own 503 arm is what decides, in one place.
     ...runServiceReadiness === void 0 ? {} : { runServiceReadiness },
-    // 402-08 (D-01): the LOCAL run-stream door's attach port, READ OFF `runService` rather than
-    // composed again. That derivation is the "one session registry serves both doors" claim in its
-    // structural form — there is no second wiring a composition root could forget or point
-    // somewhere else, and the two doors cannot end up attached to different registries. Absent
-    // `runService` means no registry exists at all, so the same conditional-spread house rule
-    // applies and the router's own 503 arm decides.
+    // Read off `runService` by default, so both doors attach to one session registry.
     ...runServiceAttach === void 0 ? {} : { runServiceAttach },
-    // 403 D-03: the mint route's port, on the same conditional-spread house rule — absent means
-    // this host serves no live view and the route's own 503 arm decides, in one place.
     ...liveView === void 0 ? {} : { mintLiveUrl: liveView.mintLiveUrl },
-    // 428 D-07: the editor mint, on the same house rule — absent means the editor mint route's own
-    // 503 decides.
     ...liveView?.mintEditorLiveUrl === void 0 ? {} : { mintEditorLiveUrl: liveView.mintEditorLiveUrl },
-    // 404-05 (D-16): the same conditional-spread house rule — absent means this host serves no
-    // post-processing push channel and the stream arm's own 503 decides, in one place.
     ...postProcessingRelay === void 0 ? {} : { postProcessingRelay }
   });
   const runServiceRouter = runService === void 0 ? void 0 : createRunServiceRoutes(runService);
@@ -10277,13 +10014,15 @@ async function startServer(opts) {
         apiRouter(req, res);
         return;
       }
+      if (refuseNonLoopbackHost(req) !== void 0) {
+        const address = server.address();
+        const boundPort = typeof address === "object" && address !== null ? address.port : port;
+        refuseForeignHostPage(res, boundPort);
+        return;
+      }
       if (req.method === "OPTIONS") {
-        res.writeHead(204, {
-          "Access-Control-Allow-Origin": "*",
-          "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-          "Access-Control-Allow-Headers": "Content-Type"
-        });
-        res.end();
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("Not Found");
         return;
       }
       if (req.method === "GET" && path.startsWith(LIVE_EMBED_PATH_PREFIX)) {
@@ -10327,8 +10066,7 @@ async function startServer(opts) {
             const contentType = MIME_TYPES[ext] || "application/octet-stream";
             res.writeHead(200, {
               "Content-Type": contentType,
-              "Content-Length": content.length,
-              "Access-Control-Allow-Origin": "*"
+              "Content-Length": content.length
             });
             res.end(content);
             return;
@@ -10340,8 +10078,7 @@ async function startServer(opts) {
           const content = await (0, import_promises9.readFile)(indexPath);
           res.writeHead(200, {
             "Content-Type": "text/html",
-            "Content-Length": content.length,
-            "Access-Control-Allow-Origin": "*"
+            "Content-Length": content.length
           });
           res.end(content);
           return;
@@ -10426,7 +10163,8 @@ async function startServer(opts) {
         session.clearIdleTimer();
         const handler = createSessionHandler(session, () => {
           void sessionManager.terminateSession(sessionId).catch((error) => {
-            console.error(`[live-editor] could not end session ${sessionId}`, error);
+            const line = `[live-editor] could not end session ${sessionId}`;
+            (0, import_agent_qa_core14.printRunText)((0, import_node_util5.format)(line, error), () => console.error(line, error));
           });
         }, (event) => {
           db.insertTokenEvent(event);
@@ -10459,7 +10197,7 @@ async function startServer(opts) {
     server.listen(port, host, () => {
       server.off("error", onError);
       console.log(
-        (0, import_agent_qa_core13.isLoopbackHost)(host) ? `Dashboard running at http://localhost:${port}` : `Dashboard running at http://${host.includes(":") ? `[${host}]` : host}:${port}`
+        (0, import_agent_qa_core14.isLoopbackHost)(host) ? `Dashboard running at http://localhost:${port}` : `Dashboard running at http://${host.includes(":") ? `[${host}]` : host}:${port}`
       );
       resolve5({
         server,