@vostride/agent-qa-dashboard 0.2.2 → 0.2.4

package/dist/server/index.js

@@ -1,9 +1,10 @@
 // src/server/server.ts
 import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
-import { readFile as readFile8, stat as stat7 } from "node:fs/promises";
-import { join as join5, extname, resolve as resolve4 } from "node:path";
+import { readFile as readFile8, stat as stat6 } from "node:fs/promises";
+import { join as join4, extname, resolve as resolve4 } from "node:path";
 import { cpus as cpus2 } from "node:os";
+import { format as format3 } from "node:util";
 
 // src/db/run-owner-host.ts
 import { spawnSync } from "node:child_process";
@@ -104,8 +105,8 @@ var ownedElsewhere = (pid) => `This run belongs to another agent-qa process (pid
 
 // src/server/routes.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { readFile as readFile6, writeFile as writeFile4, stat as stat5, readdir, rm as rm5 } from "node:fs/promises";
-import { join as join4, isAbsolute as isAbsolute2, basename as basename5, resolve as resolve3, dirname as dirname7 } from "node:path";
+import { readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, basename as basename5, resolve as resolve3, dirname as dirname7 } from "node:path";
 
 // src/db/run-status-class.ts
 var CLASS_OF = {
@@ -302,7 +303,7 @@ var TestFileManager = class {
   constructor(workspace) {
     this.workspace = workspace;
   }
-  // 2026-10-18 (444-33, D-65; 444-35, D-66): each list call reads the workspace itself; each file is written whole and one writer at a time.
+  // Each list call reads the workspace itself; each file is written whole, one writer at a time.
   underLock = createPathLock();
   async list() {
     const records = await discoverWorkspaceFiles({ workspace: this.workspace, kind: "test" });
@@ -479,8 +480,7 @@ var ConfigManager = class _ConfigManager {
     this.configPath = configPath;
     this.mask = mask;
   }
-  // 441 GAP3-D5: a whole document may keep a marker the file already holds, as often, but never
-  // add one. A missing file holds none.
+  // A whole document may keep a marker the file already holds, as often, but never add one.
   static addsShownMarker(current, next) {
     const held = shownMarkerCounts(current);
     for (const [marker, count] of shownMarkerCounts(next)) {
@@ -488,13 +488,13 @@ var ConfigManager = class _ConfigManager {
     }
     return false;
   }
-  // 429-05 Pitfall 3: a half-edited file is named, never served as the partial config yaml recovers.
+  // A half-edited file is named, never served as the partial config yaml recovers.
   async readWithRevision() {
     const read = await this.readParsed();
     if (read.kind !== "ok") return read;
     return { kind: "ok", config: read.config, raw: read.raw, revision: read.revision };
   }
-  // 441-21 D-29: the payload and the file view pass through the declared mask and nothing else.
+  // The payload and the file view pass through the declared mask and nothing else.
   async readMasked() {
     const read = await this.readParsed();
     if (read.kind === "absent") {
@@ -538,8 +538,7 @@ var ConfigManager = class _ConfigManager {
       revision
     };
   }
-  // 429-01 D-19/D-22: one transaction per request, serialised so overlapping autosaves never
-  // read the same bytes and drop each other's field.
+  // One transaction per request, serialised so overlapping autosaves never drop each other's field.
   async applyChanges(changes, options = {}) {
     const marked = changeWithShownMarker(changes);
     if (marked !== void 0) {
@@ -554,13 +553,11 @@ var ConfigManager = class _ConfigManager {
     }
     return this.serialized(() => this.applyChangesOnce(changes, options.capturePriors === true));
   }
-  // 429-11 D-24: an Undo is one more transaction on the same mutex, newest change first. A field
-  // that no longer holds what the change left there was written since, and is never overwritten.
+  // An Undo restores newest first; a field written after the change is never overwritten.
   async restorePriors(priors) {
     return this.serialized(() => this.restorePriorsOnce(priors));
   }
-  // 432-07 D-05: a generated whole-file change (a scaffold, a hooks file) publishes only over the
-  // bytes it was built from, read again in this path's turn. Anything else is somebody's edit.
+  // A generated whole-file change publishes only over the bytes it is built from, re-read in turn.
   async replaceDocument(expectedRevision, content) {
     return this.serialized(async () => {
       let current;
@@ -687,8 +684,7 @@ var ConfigManager = class _ConfigManager {
     await this.writeAtomic(next);
     return capturePriors ? { kind: "ok", revision: revisionOf(next), baseRevision, priors } : { kind: "ok", revision: revisionOf(next), baseRevision };
   }
-  // 429-05 Pitfall 8 / Pattern 1 step 6: the temp file sits beside the real file, keeps its mode
-  // (chmod, because writeFile's mode is filtered by the umask), and replaces it in one rename.
+  // The temp file sits beside the real one and is chmodded, as the umask filters `writeFile` modes.
   async writeAtomic(content) {
     const target = await this.writeTarget();
     const directory = dirname3(target);
@@ -1892,6 +1888,12 @@ var HookRegistryManager = class {
 
 // src/server/body-parser.ts
 var DEFAULT_MAX_BYTES = 1024 * 1024;
+function carriesNonJsonBody(req) {
+  const hasBody = req.headers["transfer-encoding"] !== void 0 || Number(req.headers["content-length"] ?? "0") > 0;
+  if (!hasBody) return false;
+  const type = req.headers["content-type"];
+  return type === void 0 || type.split(";", 1)[0].trim().toLowerCase() !== "application/json";
+}
 function readJsonBody(req, maxBytes = DEFAULT_MAX_BYTES) {
   return new Promise((resolve5, reject) => {
     const chunks = [];
@@ -1926,12 +1928,16 @@ function readJsonBody(req, maxBytes = DEFAULT_MAX_BYTES) {
 // src/live-editor/live-session.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { dirname as dirname6, resolve as resolvePath2 } from "node:path";
+import { format } from "node:util";
 import {
   AUTH_STATE_SCHEMA_VERSION,
   MobileSetupError as MobileSetupError2,
   PlannerConfigSchema,
   SuiteDefinitionSchema,
   TestDefinitionSchema,
+  TimeoutConfigSchema,
+  getAgentQaVersion,
+  printRunText,
   readAuthStateMetadata,
   resolveAuthStatePaths,
   writeAuthStateFiles
@@ -1960,7 +1966,7 @@ import {
   resolveVisionGate,
   visionFromConfig
 } from "@vostride/agent-qa-model";
-import { buildProductionRefusal, distinctInFirstOccurrenceOrder, resolvePlannerLimits } from "@vostride/agent-qa-schema";
+import { resolvePlannerLimits } from "@vostride/agent-qa-schema";
 import { parse as parseYaml5 } from "yaml";
 
 // src/llm-model-mapping.ts
@@ -2039,6 +2045,7 @@ import { dirname as dirname5, join as join3 } from "node:path";
 import { parse as parseYaml4 } from "yaml";
 import {
   MobileSetupError,
+  refuseRetiredLocalBindings,
   resolveMobileRunConfig
 } from "@vostride/agent-qa-core";
 async function loadLocalBindings(configPath) {
@@ -2046,12 +2053,10 @@ async function loadLocalBindings(configPath) {
   try {
     const content = await readFile5(filePath, "utf-8");
     const parsed = parseYaml4(content);
-    return parsed && typeof parsed === "object" ? {
-      devices: parsed.devices,
-      providers: parsed.providers,
-      apps: parsed.apps,
-      filePath
-    } : { filePath };
+    refuseRetiredLocalBindings(parsed, filePath);
+    if (!parsed || typeof parsed !== "object") return { filePath };
+    const bindings = parsed;
+    return { devices: bindings.devices, apps: bindings.apps, filePath };
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -2141,44 +2146,15 @@ async function prepareMobileLiveSession(input) {
       appActivity: resolved.app.appActivity,
       deepLinkAppId: resolved.app.deepLinkAppId,
       appPath: resolved.app.install?.path,
-      browserstackApp: resolved.app.install?.browserstack,
       appState: resolved.appState
     }
   };
 }
 
 // src/live-editor/live-session.ts
-var LiveProductionRefusedError = class extends Error {
-  productionTargetNames;
-  constructor(productionTargetNames) {
-    super(buildProductionRefusal(productionTargetNames));
-    this.name = "LiveProductionRefusedError";
-    this.productionTargetNames = distinctInFirstOccurrenceOrder(productionTargetNames);
-  }
-};
 function isConfigRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function liveTargetName(targetName) {
-  if (typeof targetName !== "string") return void 0;
-  const trimmed = targetName.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-async function resolveLiveTargetProduction(configManager, targetName) {
-  const name = liveTargetName(targetName);
-  if (name === void 0 || configManager === void 0) {
-    return { productionTargetNames: [], allowProduction: false };
-  }
-  const config = await readConfigValues(configManager);
-  const registry = isConfigRecord(config.registry) ? config.registry : void 0;
-  const targets = registry !== void 0 && isConfigRecord(registry.targets) ? registry.targets : void 0;
-  const declared = targets !== void 0 && Object.hasOwn(targets, name) ? targets[name] : void 0;
-  const production = isConfigRecord(declared) && declared.environment === "production";
-  return {
-    productionTargetNames: production ? [name] : [],
-    allowProduction: config.allowProduction === true
-  };
-}
 async function readEntityUse(entity, readers) {
   if (entity === void 0) return void 0;
   const find = entity.type === "suite" ? readers.findSuite : readers.findTest;
@@ -2198,6 +2174,12 @@ var LivePlannerLimitsRefusedError = class extends Error {
     this.name = "LivePlannerLimitsRefusedError";
   }
 };
+var LiveNavigationTimeoutRefusedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "LiveNavigationTimeoutRefusedError";
+  }
+};
 var LIVE_LIMIT_LEAVES = ["maxActions", "maxPlanningTurns"];
 function shownLimitValue(value) {
   return typeof value === "number" ? String(value) : JSON.stringify(value) ?? String(value);
@@ -2246,9 +2228,30 @@ async function resolveLivePlannerLimits(configManager, entities, readers) {
   }
   return resolvePlannerLimits(config.use, ...uses);
 }
-function liveProductionRefusal(found) {
-  if (found.productionTargetNames.length === 0 || found.allowProduction) return void 0;
-  return new LiveProductionRefusedError(found.productionTargetNames);
+async function resolveLiveNavigationTimeoutMs(configManager, entities, readers) {
+  const config = configManager === void 0 ? {} : await readConfigValues(configManager);
+  const layers = [
+    { layer: "project config", use: config.use }
+  ];
+  for (const entity of [].concat(entities ?? [])) {
+    const use = await readEntityUse(entity, readers);
+    layers.push({ layer: `${entity.type} file ${entity.id}`, use });
+  }
+  let navigation;
+  for (const { layer, use } of layers) {
+    if (!isConfigRecord(use) || !isConfigRecord(use.timeout)) continue;
+    if (!Object.hasOwn(use.timeout, "navigation")) continue;
+    const value = use.timeout.navigation;
+    const parsed = TimeoutConfigSchema.shape.navigation.safeParse(value);
+    if (!parsed.success) {
+      const issue = parsed.error.issues[0]?.message ?? "invalid value";
+      throw new LiveNavigationTimeoutRefusedError(
+        `${layer} sets use.timeout.navigation to ${shownLimitValue(value)}: ${issue}. The CLI refuses this file too.`
+      );
+    }
+    navigation = parsed.data;
+  }
+  return navigation;
 }
 var IDLE_TIMEOUT_MS = 5 * 60 * 1e3;
 var LIVE_HUB_CLOSE_LIMIT_MS = 2e3;
@@ -2384,8 +2387,7 @@ var LiveSession = class {
   planner = null;
   verifier = null;
   modelProfiles = null;
-  // D-14 (Phase 360): the run-scoped storage-state store, constructed lazily on first use and
-  // rooted at the session's `.agent-qa` runtime dir (the FsStorageStateStore rooting idiom).
+  // Built lazily on first use, rooted at the session's `.agent-qa` runtime dir.
   storageStateStore = null;
   model = null;
   variableStore = null;
@@ -2413,15 +2415,14 @@ var LiveSession = class {
   mobileAppiumLease = null;
   secretStore;
   secretRedactor;
-  // 428 D-07: one hub per session, handle 0, created once the adapter exists. A session whose
-  // setup hooks failed has no adapter and therefore no hub; its subject declares `none`.
+  // One hub per session at handle 0, created once the adapter exists; no adapter means no hub.
   liveHub = null;
   attachment = null;
   resolveEnded = () => {
   };
   ended;
   cleanupRun = null;
-  // RESEARCH P4: which control socket is the current one. Only its close may detach the session.
+  // Which control socket is the current one; only its close may detach the session.
   attachmentGeneration = 0;
   releaseAttachment = null;
   get modelName() {
@@ -2443,11 +2444,7 @@ var LiveSession = class {
     hub.register(0, registration?.capability, registration?.fallback);
     this.liveHub = hub;
   }
-  /**
-   * Make a control socket the current one. `release` is how the session lets go of it later: the
-   * previous attachment's is called with `superseded` here (428 WR-01), so one socket drives the
-   * session at a time.
-   */
+  // The previous attachment's `release` gets `superseded`, so one socket drives the session.
   beginAttachment(release) {
     const previous = this.releaseAttachment;
     this.attachmentGeneration += 1;
@@ -2466,11 +2463,7 @@ var LiveSession = class {
     }
     this.pendingMessages = [];
   }
-  /**
-   * A command's reply, for whichever control socket is attached now (428 CR-01). A command can
-   * outlive the socket that issued it, and its outcome belongs to the page, not to that socket:
-   * with none attached it is held and flushed to the next one.
-   */
+  // A reply can outlive its socket, so it goes to the current socket or waits for the next one.
   deliver(message) {
     if (this.messageSink) {
       this.messageSink(message);
@@ -2581,7 +2574,7 @@ var LiveSession = class {
         continue;
       }
       const result = await runHooks([hookDef], {
-        executor: new DockerHookExecutor(),
+        executor: new DockerHookExecutor({ version: getAgentQaVersion() }),
         env: this.getHookEnvVars(),
         secretStore: this.secretStore,
         secretRedactor: this.secretRedactor
@@ -2655,7 +2648,6 @@ var LiveSession = class {
       device: config.device ? {
         name: config.device.name,
         platform,
-        transport: "local",
         match: config.device
       } : void 0
     };
@@ -2720,15 +2712,6 @@ var LiveSession = class {
     }
   }
   async initialize(config) {
-    const found = await resolveLiveTargetProduction(this.deps.configManager, config.targetName);
-    const refusal = liveProductionRefusal({
-      productionTargetNames: distinctInFirstOccurrenceOrder([
-        ...config.production?.productionTargetNames ?? [],
-        ...found.productionTargetNames
-      ]),
-      allowProduction: found.allowProduction
-    });
-    if (refusal !== void 0) throw refusal;
     this.platform = config.platform;
     this.targetName = typeof config.targetName === "string" && config.targetName.trim().length > 0 ? config.targetName.trim() : null;
     this._modelName = config.llmConfig.model ?? "unknown";
@@ -2763,7 +2746,11 @@ var LiveSession = class {
     } else {
       const { WebPlatformAdapter } = await import("@vostride/agent-qa-web");
       const adapter = new WebPlatformAdapter();
-      await adapter.setup({ platform: "web", browser: { name: "chromium", headless: config.headless ?? true } });
+      await adapter.setup({
+        platform: "web",
+        browser: { name: "chromium", headless: config.headless ?? true },
+        ...config.navigationTimeoutMs === void 0 ? {} : { timeouts: { navigation: config.navigationTimeoutMs } }
+      });
       this.adapter = adapter;
       if (config.url) {
         const resolvedUrl = this.resolveSecrets(config.url);
@@ -2825,7 +2812,7 @@ var LiveSession = class {
         }
         const startedAt = performance.now();
         try {
-          const result = await new DockerHookExecutor().execute(hookDef, {
+          const result = await new DockerHookExecutor({ version: getAgentQaVersion() }).execute(hookDef, {
             env: this.getHookEnvVars(),
             secretEnv: resolveSecretEnv(this.secretStore),
             secretRedactor: this.secretRedactor
@@ -2992,12 +2979,7 @@ var LiveSession = class {
     };
     return this.redact(result);
   }
-  // Inner step execution — no gating. Callers must own the executing/status
-  // lifecycle (executeStepCommand for single steps, executeTestCommand for
-  // the per-test loop that runs many steps under one outer gate).
-  // D-14 (Phase 360): lazily construct the run-scoped storage-state store, rooted at the session's
-  // `.agent-qa` runtime dir. All fs writes live in runner-local (validate:arch storageNeutral);
-  // the loop records only { name, fingerprint }. Absent configPath falls back to the cwd root.
+  // Lazily built and rooted at the session's `.agent-qa` dir; fs writes stay in runner-local.
   async getStorageStateStore() {
     let store = this.storageStateStore;
     if (!store) {
@@ -3136,7 +3118,9 @@ ${errorLines.join("\n")}`;
         testLimits = this.plannerLimitsForTest !== void 0 && testDraft.testId.length > 0 ? await this.plannerLimitsForTest(testDraft.testId) : this.plannerLimits ?? resolvePlannerLimits();
       } catch (error) {
         if (!(error instanceof LivePlannerLimitsRefusedError)) throw error;
-        console.warn(`[live-session] executeTestCommand: ${error.message}`, { testName: testDraft.testName });
+        const line = `[live-session] executeTestCommand: ${error.message}`;
+        const detail = { testName: testDraft.testName };
+        printRunText(format(line, detail), () => console.warn(line, detail));
         return this.redact({
           status: "failed",
           duration: performance.now() - start,
@@ -3156,11 +3140,13 @@ ${errorLines.join("\n")}`;
       if (!setupResult.allPassed) {
         const failedHook = setupHookPayloads.find((h) => h.status === "failed");
         const detail = failedHook ? `Setup hook "${failedHook.hookName}" failed${failedHook.error ? `: ${failedHook.error}` : ""}${failedHook.stderr ? ` \u2014 ${failedHook.stderr.split("\n")[0].slice(0, 200)}` : ""}` : "Per-test setup hook failed";
-        console.warn(`[live-session] executeTestCommand: ${detail}`, {
+        const line = `[live-session] executeTestCommand: ${detail}`;
+        const context = {
           testName: testDraft.testName,
           setupHooks: testDraft.setup,
           failedHook: failedHook ? { name: failedHook.hookName, stderr: failedHook.stderr, error: failedHook.error } : null
-        });
+        };
+        printRunText(format(line, context), () => console.warn(line, context));
         return {
           status: "failed",
           duration: performance.now() - start,
@@ -3238,7 +3224,9 @@ ${errorLines.join("\n")}`;
         topLevelError = failedHook ? `Teardown hook "${failedHook.hookName}" failed${failedHook.error ? `: ${failedHook.error}` : ""}` : "Teardown hook failed";
       }
       if (topLevelError) {
-        console.warn(`[live-session] executeTestCommand: ${topLevelError}`, { testName: testDraft.testName });
+        const line = `[live-session] executeTestCommand: ${topLevelError}`;
+        const detail = { testName: testDraft.testName };
+        printRunText(format(line, detail), () => console.warn(line, detail));
       }
       return this.redact({
         status: finalStatus,
@@ -3254,10 +3242,7 @@ ${errorLines.join("\n")}`;
       this.status = "idle";
     }
   }
-  // Thin wrapper around runLifecycleHooks that also captures the dispatched
-  // hook payloads (hook-complete) for inclusion in the LiveTestResultPayload.
-  // The capture sits beside the message sink rather than wrapping it, so a
-  // control socket that reattaches mid-hook keeps its sink (428 CR-01).
+  // Captures dispatched hook payloads beside the message sink, so a reattached socket keeps it.
   async runLifecycleHooksCapturing(phase, hookIds, sink, owner = { scope: "suite" }) {
     this.hookCaptures.add(sink);
     try {
@@ -3501,6 +3486,21 @@ function refuseUnparseableRequest(res) {
   });
   res.end(body);
 }
+function refuseForeignHostPage(res, port) {
+  if (res.headersSent) {
+    res.destroy();
+    return;
+  }
+  const p = String(port);
+  const body = `The agent-qa dashboard answers only at localhost, 127.0.0.1 or [::1].
+Open http://localhost:${p}/ on the machine it runs on, or forward the port with ssh -L ${p}:localhost:${p} <host>.
+`;
+  res.writeHead(403, {
+    "Content-Type": "text/plain; charset=utf-8",
+    "Content-Length": Buffer.byteLength(body)
+  });
+  res.end(body);
+}
 function backstopServerError(res, req, error) {
   const kind = error instanceof Error ? error.constructor.name : typeof error;
   console.error(
@@ -3606,10 +3606,6 @@ function respondJson(res, status, data) {
   res.end(body);
 }
 function serveRunEvidenceRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req)) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   const query = new URL(req.url ?? "/", "http://localhost").searchParams;
   const entries = [["runId", deps.runId]];
   const seen = /* @__PURE__ */ new Set(["runId"]);
@@ -3651,10 +3647,6 @@ function respondFeedbackRead(res, deps, functionId, input, parse) {
   });
 }
 function serveRunMarksHistoryRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   if (new URL(req.url ?? "/", "http://localhost").search !== "") {
     respondJson(res, 400, { error: "invalid_marks_input" });
     return;
@@ -3673,10 +3665,6 @@ function serveRunMarksHistoryRead(req, res, deps) {
   );
 }
 function serveRunMarkPreviewRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then((body) => {
     const parsed = RunsMarkInputSchema.safeParse(body);
     if (!parsed.success) {
@@ -3699,10 +3687,6 @@ function serveRunMarkPreviewRead(req, res, deps) {
   });
 }
 function serveRunDetailRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readRunDetail(deps.host, deps.runId).then(
     (outcome) => {
       if (outcome.kind === "refused") {
@@ -3854,10 +3838,6 @@ async function readRunAnalysis(host, runId) {
   }
 }
 function serveRunAnalysisRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readRunAnalysis(deps.host, deps.runId).then(
     (outcome) => {
       if (outcome.kind === "refused") {
@@ -4081,10 +4061,7 @@ function serveRunEventStream(req, res, deps) {
     else pending.push(frame);
   };
   const frameOf = (event) => (
-    // D-13, all three parts: the id IS the seq, the event name IS the envelope type, and the
-    // data IS the envelope's own JSON. No projection, no rename, no second vocabulary. The filter
-    // DROPS envelopes; it never edits one, so a filtered stream's frames are byte-identical to the
-    // firehose's — with gaps in the ids, which is what seq-as-id means once a filter exists.
+    // The filter drops envelopes and never edits one, so filtered frames match the firehose bytes.
     `id: ${String(event.seq)}
 event: ${event.type}
 data: ${JSON.stringify(event)}
@@ -4146,12 +4123,6 @@ data: ${JSON.stringify(event)}
   deps.openStreams?.add(teardown);
   req.on("close", teardown);
 }
-function runDenialOf(error) {
-  if (typeof error !== "object" || error === null) return void 0;
-  const neutralReason = error.neutralReason;
-  if (typeof neutralReason !== "string" || neutralReason.trim().length === 0) return void 0;
-  return { error: "run_denied", neutralReason };
-}
 function createRunServiceRoutes(ports) {
   const openStreams = /* @__PURE__ */ new Set();
   function handleStart(req, res) {
@@ -4182,12 +4153,7 @@ function createRunServiceRoutes(ports) {
         ack = await ports.invokeRunStart(
           parsed.data.patterns === void 0 ? {} : { patterns: parsed.data.patterns }
         );
-      } catch (error) {
-        const denial = runDenialOf(error);
-        if (denial !== void 0) {
-          respondJson2(res, 403, denial);
-          return;
-        }
+      } catch {
         refuse(res, 500, "run_start_failed");
         return;
       }
@@ -4267,6 +4233,10 @@ function createRunServiceRoutes(ports) {
         refuse(res, 403, "cross_site_refused");
         return;
       }
+      if (carriesNonJsonBody(req)) {
+        refuse(res, 415, "unsupported_media_type");
+        return;
+      }
       const matched = matchRunServiceRoute(req.method, path);
       if (matched === void 0) {
         refuse(res, 404, "unknown_route");
@@ -4534,8 +4504,7 @@ data: ${JSON.stringify(again.body)}
         // A failed re-read is not a reason to close a live channel: the next envelope will trigger
         // another, and the page's own poll is the floor underneath both.
         () => void 0
-        // …but a throw from the arm ABOVE is not a failed re-read, it is a dead socket, and `.then`'s
-        // failure arm never sees its own fulfilment arm's throw (UF-01, on the nested chain).
+        // A throw from the arm above is a dead socket, and `.then`'s failure arm never sees it.
       ).catch(failStream);
     });
     heartbeat = setInterval(() => {
@@ -4574,10 +4543,6 @@ async function readRunKnowledge(host, runId) {
   }
 }
 function serveRunKnowledgeRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readRunKnowledge(deps.host, deps.runId).then(
     (outcome) => {
       if (outcome.kind === "refused") {
@@ -4620,10 +4585,6 @@ async function markRun(host, runId, body) {
   }
 }
 function registerRunMarkRoute(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const outcome = await markRun(deps.host, deps.runId, body);
     if (outcome.kind === "refused") {
@@ -4646,10 +4607,6 @@ import {
   isPageWritableConfigPath
 } from "@vostride/agent-qa-schema";
 function registerConfigWriteRoute(req, res, deps) {
-  if (refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const parsed = ConfigWriteRequestSchema.safeParse(body);
     if (!parsed.success) {
@@ -4707,10 +4664,6 @@ function registerConfigUndoRoute(req, res, deps) {
     respondJson(res, 405, { error: "method_not_allowed" });
     return;
   }
-  if (refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const parsed = ConfigUndoRequestSchema.safeParse(body);
     if (!parsed.success) {
@@ -4953,10 +4906,6 @@ async function connectName(request2, deps) {
   });
 }
 function registerLlmConnectRoute(req, res, deps) {
-  if (refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const answer = await connectLlm(body, deps);
     respondJson(res, answer.status, answer.body);
@@ -4968,9 +4917,9 @@ function registerLlmConnectRoute(req, res, deps) {
 }
 
 // src/server/routes.ts
-import { AuthStateNameSchema, buildInternalRunAttributes, mergeRunAttributes, readAuth as readAuth2, writeAuth as writeAuth2, removeAuth as removeAuth2, getAgentQaVersion, getAgentQaUpdateStatus, getLLMAuthProviderPlugin as getLLMAuthProviderPlugin2, listAuthStateMetadata, listLLMAuthProviderPlugins, ModelConfigSchema as ModelConfigSchema2, NameSlugSchema as NameSlugSchema2, TimeoutConfigSchema, AgentQaConfigSchema as AgentQaConfigSchema3, TestDefinitionSchema as TestDefinitionSchema2, SuiteDefinitionSchema as SuiteDefinitionSchema2, parseEnvFile, serializeEnvFile, RUNTIME_IMAGE_MAP, validateUserRunAttributes, discoverWorkspaceFiles as discoverWorkspaceFiles3, isWorkspacePathMatch, resolveWorkspaceFileTarget as resolveWorkspaceFileTarget2, SizeString } from "@vostride/agent-qa-core";
+import { AuthStateNameSchema, buildInternalRunAttributes, DEFAULT_AGENT_QA_CACHE_DIR, mergeRunAttributes, readAuth as readAuth2, writeAuth as writeAuth2, removeAuth as removeAuth2, getAgentQaVersion as getAgentQaVersion2, getAgentQaUpdateStatus, getLLMAuthProviderPlugin as getLLMAuthProviderPlugin2, listAuthStateMetadata, listLLMAuthProviderPlugins, ModelConfigSchema as ModelConfigSchema2, NameSlugSchema as NameSlugSchema2, TimeoutConfigSchema as TimeoutConfigSchema2, AgentQaConfigSchema as AgentQaConfigSchema3, TestDefinitionSchema as TestDefinitionSchema2, SuiteDefinitionSchema as SuiteDefinitionSchema2, parseEnvFile, serializeEnvFile, hookRunnerImage, validateUserRunAttributes, discoverWorkspaceFiles as discoverWorkspaceFiles3, isWorkspacePathMatch, resolveWorkspaceFileTarget as resolveWorkspaceFileTarget2, SizeString } from "@vostride/agent-qa-core";
 import { SecretStore, SecretRedactor } from "@vostride/agent-qa-runner";
-import { DockerHookExecutor as DockerHookExecutor2 } from "@vostride/agent-qa-runner-local";
+import { DockerHookExecutor as DockerHookExecutor2, purgeActionCache } from "@vostride/agent-qa-runner-local";
 import { createModel as createModel3, fetchLiveModels, getModelCatalog, listProviders, mergeCatalog, resolveVisionConfig } from "@vostride/agent-qa-model";
 import { parse as parseYaml6 } from "yaml";
 var LLM_PROVIDER_MODES = /* @__PURE__ */ new Set([
@@ -5278,25 +5227,10 @@ function llmConnectionTestTimeoutMs(config) {
   return REMOTE_LLM_CONNECTION_TEST_TIMEOUT_MS;
 }
 function json(res, data, status = 200) {
-  const body = JSON.stringify(data);
-  res.writeHead(status, {
-    "Content-Type": "application/json",
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type"
-  });
-  res.end(body);
-}
-function jsonNoCors(res, data, status = 200) {
   const body = JSON.stringify(data);
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(body);
 }
-function refuseCrossSiteDisplayRead(req, res) {
-  if (refuseCrossSiteRequest(req) === void 0) return false;
-  jsonNoCors(res, { error: "cross_site_refused" }, 403);
-  return true;
-}
 var INSIGHTS_KNOWLEDGE_RUN_CAP = 200;
 var INSIGHTS_KNOWLEDGE_CONCURRENCY = 4;
 async function isPostProcessingSkipped(host, runId) {
@@ -5360,14 +5294,6 @@ async function readInsightsKnowledgeChanges(host, db, window) {
 function notFound(res, message = "Not found") {
   json(res, { error: message }, 404);
 }
-function cors(res) {
-  res.writeHead(204, {
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type"
-  });
-  res.end();
-}
 function isPlainRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -5420,7 +5346,7 @@ function normalizeRunFilterValue(value) {
 function buildRunRequestAttributes(input) {
   const internal = buildInternalRunAttributes({
     trigger: input.trigger,
-    runner: input.runner ?? "local"
+    runner: "local"
   });
   const user = validateUserRunAttributes(input.userAttributes, "run attributes");
   return mergeRunAttributes(internal, user);
@@ -5555,7 +5481,7 @@ function parseTimeoutConfigTestTimeoutMs(timeoutConfig) {
       return transformedTimeout;
     }
   }
-  const parsed = TimeoutConfigSchema.partial().safeParse(timeoutConfig);
+  const parsed = TimeoutConfigSchema2.partial().safeParse(timeoutConfig);
   if (!parsed.success) return void 0;
   const testTimeout = parsed.data.test;
   return typeof testTimeout === "number" && Number.isFinite(testTimeout) && testTimeout > 0 ? testTimeout : void 0;
@@ -5865,9 +5791,7 @@ var RESPONSE_SAFE_RUN_METADATA_KEYS = /* @__PURE__ */ new Set([
   "timeoutSource",
   "timeoutBaseMs",
   "timeoutBufferMs",
-  "suiteIndex",
-  "farmSessionUrl",
-  "runDevice"
+  "suiteIndex"
 ]);
 function sanitizeRunMetadataForResponse(metadata) {
   if (metadata === null || metadata === void 0) return metadata ?? null;
@@ -5897,17 +5821,7 @@ var RESPONSE_SAFE_RUN_READ_METHODS = [
   "getRunsByTest"
 ];
 var RUN_READS_WITHOUT_ROWS = /* @__PURE__ */ new Set([
-  // 2026-08-27 (405-01, D-01/D-03): the v2 projection's six members.
-  //
-  // The five WRITES return nothing; they are here for the same reason `insertRun` is.
-  //
-  // `readRunDetailRows` IS A READ AND IS STILL HERE, and that is the judgement this set exists to
-  // make explicit rather than to hide. It returns members, steps and sub-actions — the bus
-  // payloads as the subscriber MASKED them (T-363-05) — and NO `RunRow` and no
-  // `RunArtifactRow`. It therefore carries none of the run metadata the 401-23 scrub law exists
-  // to strip, so wrapping it would be wrapping a shape that has nothing to strip. This router
-  // does not call it either: the detail arm dispatches through the injected host, which is the
-  // whole of D-03.
+  // `readRunDetailRows` returns masked bus payloads and no run row, so it has no metadata to strip.
   "deleteMemberProjection",
   "incrementRunMemberAttempts",
   "insertRunStep",
@@ -5918,23 +5832,23 @@ var RUN_READS_WITHOUT_ROWS = /* @__PURE__ */ new Set([
   "finalizeRunArtifact",
   "getRunsBySuiteIdCount",
   "getRunsByTestCount",
-  // 433-30: run ids and a count, no row; each id is dispatched through the agent host.
+  // Run ids and a count, no row; each id is dispatched through the agent host.
   "listInsightsWindowRunIds",
   "insertPendingRun",
   "insertRun",
   "insertRunArtifact",
   "listRunAttributeKeys",
   "listRunAttributeValues",
-  // 2026-10-16 (442-01, D-01): an owner (pid, incarnation, host), no run metadata.
+  // An owner (pid, incarnation, host), no run metadata.
   "readRunOwner",
-  // 2026-10-16 (442-01, D-04): ids and owners only, no run metadata.
+  // Ids and owners only, no run metadata.
   "listRunningRunOwners",
-  // 2026-10-16 (442-01, D-04): compare-and-set writes that return a boolean.
+  // Compare-and-set writes that return a boolean.
   "finalizeOrphanRun",
   "finalizeOwnRun",
-  // 2026-10-17 (443-13, GAP-D1): a compare-and-set write that returns a boolean, no run metadata.
+  // A compare-and-set write that returns a boolean, no run metadata.
   "closeOwnRun",
-  // 2026-10-17 (443-02, D-07): a compare-and-set write that returns a boolean, no run metadata.
+  // A compare-and-set write that returns a boolean, no run metadata.
   "claimRunningRow",
   "stageRunArtifact",
   "updateRun",
@@ -6005,10 +5919,7 @@ function withResponseSafeRunReads(db) {
     // `sanitizeArtifactForResponse`; a caller reaching for the bare row has no such step, so the
     // projection is its only choke point. Same allowlist, so the two cannot drift.
     getRunArtifact: { value: (runId) => scrubArtifact(db.getRunArtifact(runId)) },
-    // 405-07 (D-02): the bundle is ONE artifact now. It used to carry the child runs of a suite
-    // parent, whose `run` rows this override scrubbed; nothing has written a child row since
-    // 402-09, and the shape went with the column. `getRunArtifact` above remains the choke point
-    // for the payload itself, and this wrapper delegates to it.
+    // One artifact; `getRunArtifact` is the choke point for its payload, and this delegates to it.
     getRunArtifactBundle: {
       value: (runId) => ({ artifact: scrubArtifact(db.getRunArtifactBundle(runId).artifact) })
     }
@@ -6156,10 +6067,18 @@ function createRouter(dbOrDeps) {
       json(res, { error: "Bad Request" }, 400);
       return;
     }
+    if (refuseCrossSiteRequest(req) !== void 0) {
+      json(res, { error: "cross_site_refused" }, 403);
+      return;
+    }
+    if (carriesNonJsonBody(req)) {
+      json(res, { error: "unsupported_media_type" }, 415);
+      return;
+    }
     const path = url.pathname;
     if (path === "/api/config" && req.method === "PATCH") {
       if (!configManager) {
-        jsonNoCors(res, { error: "config_unavailable" }, 503);
+        json(res, { error: "config_unavailable" }, 503);
         return;
       }
       registerConfigWriteRoute(req, res, { configManager, undoStore });
@@ -6179,7 +6098,7 @@ function createRouter(dbOrDeps) {
     }
     if (path === "/api/config/revision" && req.method === "GET") {
       if (!configManager) {
-        jsonNoCors(res, { error: "config_unavailable" }, 503);
+        json(res, { error: "config_unavailable" }, 503);
         return;
       }
       registerConfigRevisionRoute(req, res, { configManager });
@@ -6187,7 +6106,7 @@ function createRouter(dbOrDeps) {
     }
     if (path === "/api/llm/connect" && req.method === "POST") {
       if (!configManager) {
-        jsonNoCors(res, { error: "config_unavailable" }, 503);
+        json(res, { error: "config_unavailable" }, 503);
         return;
       }
       registerLlmConnectRoute(req, res, {
@@ -6199,16 +6118,6 @@ function createRouter(dbOrDeps) {
       });
       return;
     }
-    if (path === "/api/runs/trigger" || path === "/api/queue/enqueue") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
-    }
-    if (req.method === "OPTIONS") {
-      cors(res);
-      return;
-    }
     if (path === "/api/auth-states" && req.method === "GET") {
       if (!configManager || !deps.configPath) {
         json(res, { error: "Auth-state metadata not available" }, 503);
@@ -6232,11 +6141,10 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/runs" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const statuses = url.searchParams.getAll("status");
       const unknownStatus = statuses.find((word) => !isRunStatusWord(word));
       if (unknownStatus !== void 0) {
-        jsonNoCors(res, { error: `Unknown run status: ${unknownStatus}.` }, 400);
+        json(res, { error: `Unknown run status: ${unknownStatus}.` }, 400);
         return;
       }
       const name = url.searchParams.get("name") ?? void 0;
@@ -6268,12 +6176,12 @@ function createRouter(dbOrDeps) {
         )).sort((a, b) => a.localeCompare(b));
         const filtered = platformFilteredRuns.filter((run) => matchesTargetFilter(run, target));
         const runs = filtered.slice(offset, offset + limit);
-        jsonNoCors(res, {
+        json(res, {
           runs,
           total: filtered.length,
           targets: targetOptions
         });
-      }).catch(() => jsonNoCors(res, { error: "Failed to list runs" }, 500));
+      }).catch(() => json(res, { error: "Failed to list runs" }, 500));
       return;
     }
     if (path === "/api/runs/attributes/keys" && req.method === "GET") {
@@ -6311,7 +6219,6 @@ function createRouter(dbOrDeps) {
     }
     const runArtifactMatch = path.match(/^\/api\/runs\/([^/]+)\/artifact$/);
     if (runArtifactMatch && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const runId = decodeURIComponent(runArtifactMatch[1]);
       const run = db.getRun(runId);
       if (!run) {
@@ -6319,7 +6226,7 @@ function createRouter(dbOrDeps) {
         return;
       }
       const bundle = db.getRunArtifactBundle(runId);
-      jsonNoCors(res, {
+      json(res, {
         run,
         artifact: sanitizeArtifactForResponse(bundle.artifact),
         missingSections: getArtifactMissingSections(bundle.artifact)
@@ -6327,7 +6234,6 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/execution-logs") && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const segments = path.split("/");
       const id = segments[3];
       const run = db.getRun(id);
@@ -6338,37 +6244,37 @@ function createRouter(dbOrDeps) {
       const stepId = url.searchParams.get("stepId") ?? void 0;
       const type = url.searchParams.get("type") ?? void 0;
       const logs = db.getExecutionLogs({ runId: id, stepId, type });
-      jsonNoCors(res, { logs });
+      json(res, { logs });
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/mark") && req.method === "POST") {
       if (deps.agentHost === void 0) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/mark".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_mark_input" }, 400);
+        json(res, { error: "invalid_mark_input" }, 400);
         return;
       }
-      registerRunMarkRoute(req, res, { host: deps.agentHost, runId, boundary: "human" });
+      registerRunMarkRoute(req, res, { host: deps.agentHost, runId });
       return;
     }
     if (req.method === "POST" && /^\/api\/runs\/[^/]+\/mark-preview$/.test(path)) {
       if (deps.agentHost === void 0) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/mark-preview".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_run_id" }, 400);
+        json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunMarkPreviewRead(req, res, { runId, host: deps.agentHost, boundary: "human" });
+      serveRunMarkPreviewRead(req, res, { runId, host: deps.agentHost });
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/cancel") && req.method === "POST") {
@@ -6447,44 +6353,39 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/live-url$/.test(path)) {
-      const crossSite = refuseCrossSiteRequest(req);
-      if (crossSite !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       if (!deps.mintLiveUrl) {
-        jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+        json(res, { error: "live_view_unavailable" }, 503);
         return;
       }
       let liveUrlRunId;
       try {
         liveUrlRunId = decodeURIComponent(path.slice("/api/runs/".length, -"/live-url".length));
       } catch {
-        jsonNoCors(res, { error: "unknown_run" }, 404);
+        json(res, { error: "unknown_run" }, 404);
         return;
       }
       const rawHandle = handleParamOf(req);
       const parsedHandle = parseHandleParam2(rawHandle);
       if (parsedHandle.kind === "invalid") {
-        jsonNoCors(res, { error: "invalid_handle" }, 400);
+        json(res, { error: "invalid_handle" }, 400);
         return;
       }
       const handle = parsedHandle.kind === "absent" ? 0 : parsedHandle.index;
       void deps.mintLiveUrl(liveUrlRunId, handle).then(
         (result) => {
-          jsonNoCors(res, result);
+          json(res, result);
         },
         (error) => {
           const name = error instanceof Error ? error.name : "";
           if (name === "UnknownRunError") {
-            jsonNoCors(res, { error: "unknown_run" }, 404);
+            json(res, { error: "unknown_run" }, 404);
             return;
           }
           if (name === "LiveViewUnavailableError") {
-            jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+            json(res, { error: "live_view_unavailable" }, 503);
             return;
           }
-          jsonNoCors(res, { error: "live_url_mint_failed" }, 500);
+          json(res, { error: "live_url_mint_failed" }, 500);
         }
       );
       return;
@@ -6513,32 +6414,32 @@ function createRouter(dbOrDeps) {
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/evidence$/.test(path)) {
       if (!deps.agentHost) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/evidence".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_run_id" }, 400);
+        json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunEvidenceRead(req, res, { runId, host: deps.agentHost, boundary: "human" });
+      serveRunEvidenceRead(req, res, { runId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/marks$/.test(path)) {
       if (!deps.agentHost) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/marks".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_run_id" }, 400);
+        json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunMarksHistoryRead(req, res, { runId, host: deps.agentHost, boundary: "human" });
+      serveRunMarksHistoryRead(req, res, { runId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/detail$/.test(path)) {
@@ -6553,7 +6454,7 @@ function createRouter(dbOrDeps) {
         json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunDetailRead(req, res, { runId: detailRunId, host: deps.agentHost, boundary: "human" });
+      serveRunDetailRead(req, res, { runId: detailRunId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/analysis$/.test(path)) {
@@ -6568,7 +6469,7 @@ function createRouter(dbOrDeps) {
         json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunAnalysisRead(req, res, { runId: analysisRunId, host: deps.agentHost, boundary: "human" });
+      serveRunAnalysisRead(req, res, { runId: analysisRunId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/knowledge$/.test(path)) {
@@ -6585,8 +6486,7 @@ function createRouter(dbOrDeps) {
       }
       serveRunKnowledgeRead(req, res, {
         runId: knowledgeRunId,
-        host: deps.agentHost,
-        boundary: "human"
+        host: deps.agentHost
       });
       return;
     }
@@ -6636,14 +6536,13 @@ function createRouter(dbOrDeps) {
         notFound(res);
         return;
       }
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const id = segments[3];
       const run = db.getRun(id);
       if (!run) {
         notFound(res, "Run not found");
         return;
       }
-      jsonNoCors(res, { run });
+      json(res, { run });
       return;
     }
     if (path === "/api/stats/costs" && req.method === "GET") {
@@ -6654,19 +6553,18 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/insights/knowledge-changes" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!deps.agentHost) {
-        jsonNoCors(res, { status: "unavailable", reason: "agent_host_unavailable" }, 503);
+        json(res, { status: "unavailable", reason: "agent_host_unavailable" }, 503);
         return;
       }
       const from = url.searchParams.get("from") ?? void 0;
       const to = url.searchParams.get("to") ?? void 0;
       void readInsightsKnowledgeChanges(deps.agentHost, db, { from, to }).then(
         (body) => {
-          jsonNoCors(res, body);
+          json(res, body);
         },
         () => {
-          jsonNoCors(res, { status: "unavailable", reason: "read_failed" }, 500);
+          json(res, { status: "unavailable", reason: "read_failed" }, 500);
         }
       );
       return;
@@ -6732,10 +6630,7 @@ function createRouter(dbOrDeps) {
       serveRunEventStream(req, res, {
         runId,
         handleParam: handleParamOf(req),
-        // 403-03 (D-13 · INVK-05): the resume point, read from the SAME pair the authed door reads
-        // it from. `url.searchParams.get('lastEventId')` would resolve a repeated parameter to its
-        // first value — the one answer `lastEventIdParamOf` exists to refuse — and a second
-        // header/query precedence rule here would be a second contract for where a client resumes.
+        // Read from the same pair as the authed door; `searchParams.get` takes a repeated first.
         resume: resumePointOf(req.headers["last-event-id"], lastEventIdParamOf(req)),
         attach: deps.runServiceAttach
       });
@@ -6777,7 +6672,6 @@ function createRouter(dbOrDeps) {
         try {
           attributes = buildRunRequestAttributes({
             trigger: "api",
-            runner: "local",
             userAttributes: body.attributes
           });
         } catch (err) {
@@ -6785,25 +6679,10 @@ function createRouter(dbOrDeps) {
           return;
         }
         const args = normalizedFileTarget ? [normalizedFileTarget.executionPath] : [];
-        const source = isSuiteFile ? "suite" : "dashboard";
-        try {
-          await executionBackend?.preflight?.({ args, source });
-        } catch (error) {
-          const denial = runDenialOf(error);
-          if (denial !== void 0) {
-            json(res, denial, 403);
-            return;
-          }
-          json(res, { error: error instanceof Error ? error.message : String(error) }, 400);
-          return;
-        }
         const runId = jobQueue.enqueue({
           name: body.name,
           filePath: normalizedFileTarget?.storagePath,
-          // 2026-08-24 (402-09, D-11): NO PARENT KIND IS MINTED. A suite run is ONE run row
-          // with member handles, so a parent artifact kind would claim parenthood over rows
-          // nothing creates. `isSuiteFile` still travels in `metadata.isSuite` below, and the run's
-          // own `suite_id` plus the artifact's `source.kind` snapshot still say it is a suite.
+          // No parent kind is minted; `metadata.isSuite` and `suite_id` say it is a suite.
           kind: "test",
           attributes,
           priority: body.priority,
@@ -6886,17 +6765,6 @@ function createRouter(dbOrDeps) {
           args.push("--disable-cache");
         }
         const isSuite = Boolean(isSuiteFile);
-        try {
-          await executionBackend?.preflight?.({ args, source: isSuite ? "suite" : "dashboard" });
-        } catch (error) {
-          const denial = runDenialOf(error);
-          if (denial !== void 0) {
-            json(res, denial, 403);
-            return;
-          }
-          json(res, { error: error instanceof Error ? error.message : String(error) }, 400);
-          return;
-        }
         let testName = body.file ? basename5(normalizedFileTarget?.storagePath ?? body.file, ".yaml") : "unknown";
         let fileParallel;
         let platform;
@@ -6939,11 +6807,10 @@ function createRouter(dbOrDeps) {
         const runId = jobQueue.enqueue({
           name: testName,
           filePath: normalizedFileTarget?.storagePath ?? body.file,
-          // 2026-08-24 (402-09, D-11): no parent kind minted — see the enqueue route above.
+          // No parent kind is minted; see the enqueue route above.
           kind: "test",
           attributes: buildRunRequestAttributes({
-            trigger: triggerSource.trigger,
-            runner: body.local === false ? "browserstack" : "local"
+            trigger: triggerSource.trigger
           }),
           platform,
           parallel: effectiveParallel,
@@ -7452,7 +7319,7 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/app-metadata" && req.method === "GET") {
-      const version = getAgentQaVersion().trim() || "0.0.0";
+      const version = getAgentQaVersion2().trim() || "0.0.0";
       (async () => {
         try {
           const status = await getAgentQaUpdateStatus();
@@ -7496,9 +7363,8 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/config" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!configManager) {
-        jsonNoCors(res, { error: "Config management not available" }, 501);
+        json(res, { error: "Config management not available" }, 501);
         return;
       }
       ;
@@ -7506,7 +7372,7 @@ function createRouter(dbOrDeps) {
         try {
           const read = await configManager.readMasked();
           if (read.kind === "file_invalid") {
-            jsonNoCors(res, { error: "file_invalid", message: read.message }, 409);
+            json(res, { error: "file_invalid", message: read.message }, 409);
             return;
           }
           const { config, revision, lines, fileIssues } = read;
@@ -7516,7 +7382,7 @@ function createRouter(dbOrDeps) {
           const activeLlm = use?.llm ?? config.defaultLLM;
           const defaultCfg = Array.isArray(llms) ? llms.find((c) => c?.name === activeLlm) : void 0;
           const provider = defaultCfg?.provider ?? null;
-          jsonNoCors(res, {
+          json(res, {
             config,
             provider,
             revision,
@@ -7524,45 +7390,17 @@ function createRouter(dbOrDeps) {
             ...fileIssues.length > 0 ? { fileIssues } : {}
           });
         } catch (err) {
-          jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to read config" }, 500);
+          json(res, { error: err instanceof Error ? err.message : "Failed to read config" }, 500);
         }
       })();
       return;
     }
-    if (path === "/api/config/farm/test-connection" && req.method === "POST") {
-      readJsonBody(req).then(async (body) => {
-        if (body.provider !== "browserstack") {
-          json(res, { error: "Only BrowserStack is currently supported" }, 400);
-          return;
-        }
-        try {
-          const auth = Buffer.from(`${body.username}:${body.accessKey}`).toString("base64");
-          const response = await fetch("https://api-cloud.browserstack.com/app-automate/devices.json", {
-            headers: { Authorization: `Basic ${auth}` }
-          });
-          if (response.ok) {
-            json(res, { success: true });
-          } else if (response.status === 401) {
-            json(res, { success: false, error: "Invalid credentials" });
-          } else {
-            json(res, { success: false, error: `BrowserStack API returned ${response.status}` });
-          }
-        } catch (err) {
-          json(res, { success: false, error: err instanceof Error ? err.message : "Connection failed" });
-        }
-      }).catch(() => json(res, { error: "Invalid request body" }, 400));
-      return;
-    }
     if (path.startsWith("/api/auth/") && req.method === "DELETE") {
       const segments = path.split("/");
       if (segments.length === 4 && segments[2] === "auth") {
         const providerName = decodeURIComponent(segments[3]);
         if (providerName === "status" || providerName === "credential" || providerName === "oauth") {
         } else {
-          if (refuseCrossSiteRequest(req) !== void 0) {
-            jsonNoCors(res, { error: "cross_site_refused" }, 403);
-            return;
-          }
           ;
           (async () => {
             try {
@@ -7573,13 +7411,13 @@ function createRouter(dbOrDeps) {
                 return credential;
               });
               if (removed === void 0) {
-                jsonNoCors(res, { deleted: false });
+                json(res, { deleted: false });
                 return;
               }
               const undo = undoStore.put({ kind: "credential", name: providerName, credential: removed }, Date.now());
-              jsonNoCors(res, { deleted: true, undo });
+              json(res, { deleted: true, undo });
             } catch (err) {
-              jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to delete credential" }, 500);
+              json(res, { error: err instanceof Error ? err.message : "Failed to delete credential" }, 500);
             }
           })();
           return;
@@ -7689,27 +7527,21 @@ function createRouter(dbOrDeps) {
       const segments = path.split("/");
       const provider = segments.length >= 6 ? decodeURIComponent(segments[4] ?? "") : "";
       const action = segments.length >= 6 ? segments[5] : "";
-      const authDoor = req.method === "POST" && (action === "start" || action === "exchange");
-      if (authDoor && refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       const plugin = provider ? getLLMAuthProviderPlugin2(provider) : void 0;
       if (!plugin) {
-        ;
-        (authDoor ? jsonNoCors : json)(res, { error: `Auth plugin provider "${provider}" is not registered` }, 404);
+        json(res, { error: `Auth plugin provider "${provider}" is not registered` }, 404);
         return;
       }
       if (action === "start" && req.method === "POST") {
         readJsonBody(req).then(async (body) => {
           if (!plugin.startAuth) {
-            jsonNoCors(res, { error: `Provider "${provider}" does not support dashboard auth start` }, 400);
+            json(res, { error: `Provider "${provider}" does not support dashboard auth start` }, 400);
             return;
           }
           try {
             const target = await requirePluginAuthConfig(configManager, body.configName, plugin);
             if (!target.ok) {
-              jsonNoCors(res, credentialRefusalBody(target), target.status);
+              json(res, credentialRefusalBody(target), target.status);
               return;
             }
             const started = await plugin.startAuth({
@@ -7745,16 +7577,16 @@ function createRouter(dbOrDeps) {
                 session.error = err instanceof Error ? err.message : "Authentication failed";
               }).finally(() => cleanupPluginOAuthSession(session));
             }
-            jsonNoCors(res, {
+            json(res, {
               authorizeUrl: started.authorizeUrl,
               sessionId,
               mode: plugin.dashboardAuth.mode,
               created: target.created
             });
           } catch (err) {
-            jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to start auth plugin flow" }, 500);
+            json(res, { error: err instanceof Error ? err.message : "Failed to start auth plugin flow" }, 500);
           }
-        }).catch(() => jsonNoCors(res, { error: "Invalid request body" }, 400));
+        }).catch(() => json(res, { error: "Invalid request body" }, 400));
         return;
       }
       if (action === "result" && req.method === "GET") {
@@ -7782,22 +7614,22 @@ function createRouter(dbOrDeps) {
       if (action === "exchange" && req.method === "POST") {
         readJsonBody(req).then(async (body) => {
           if (!plugin.exchangeCode) {
-            jsonNoCors(res, { error: `Provider "${provider}" does not support code exchange` }, 400);
+            json(res, { error: `Provider "${provider}" does not support code exchange` }, 400);
             return;
           }
           const sessionId = typeof body.sessionId === "string" ? body.sessionId.trim() : "";
           const code = typeof body.code === "string" ? body.code.trim() : "";
           if (!sessionId || !code) {
-            jsonNoCors(res, { error: "sessionId and code are required" }, 400);
+            json(res, { error: "sessionId and code are required" }, 400);
             return;
           }
           const session = pluginOAuthSessions.get(sessionId);
           if (!session || session.providerId !== provider) {
-            jsonNoCors(res, { error: "Auth session not found" }, 404);
+            json(res, { error: "Auth session not found" }, 404);
             return;
           }
           if (session.status !== "pending") {
-            jsonNoCors(res, { error: "Auth session is no longer pending" }, 409);
+            json(res, { error: "Auth session is no longer pending" }, 409);
             return;
           }
           try {
@@ -7819,61 +7651,57 @@ function createRouter(dbOrDeps) {
               session.error = CREDENTIAL_PROVIDER_CONFLICT.message;
               cleanupPluginOAuthSession(session);
               pluginOAuthSessions.delete(sessionId);
-              jsonNoCors(res, credentialRefusalBody(CREDENTIAL_PROVIDER_CONFLICT), CREDENTIAL_PROVIDER_CONFLICT.status);
+              json(res, credentialRefusalBody(CREDENTIAL_PROVIDER_CONFLICT), CREDENTIAL_PROVIDER_CONFLICT.status);
               return;
             }
             session.status = "completed";
             cleanupPluginOAuthSession(session);
             pluginOAuthSessions.delete(sessionId);
-            jsonNoCors(res, { status: "completed", saved: true });
+            json(res, { status: "completed", saved: true });
           } catch (err) {
             session.status = "error";
             session.error = err instanceof Error ? err.message : "Token exchange failed";
             cleanupPluginOAuthSession(session);
             pluginOAuthSessions.delete(sessionId);
-            jsonNoCors(res, { error: session.error }, 500);
+            json(res, { error: session.error }, 500);
           }
-        }).catch(() => jsonNoCors(res, { error: "Invalid request body" }, 400));
+        }).catch(() => json(res, { error: "Invalid request body" }, 400));
         return;
       }
       json(res, { error: "Auth plugin route not found" }, 404);
       return;
     }
     if (path === "/api/auth/credential" && req.method === "POST") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       readJsonBody(req).then(async (body) => {
         const provider = typeof body.provider === "string" ? body.provider.trim() : "";
         const credentialType = typeof body.type === "string" ? body.type.trim() : "";
         const secret = typeof body.secret === "string" ? body.secret.trim() : "";
         if (typeof body.configName !== "string" || body.configName.trim() === "") {
-          jsonNoCors(res, { error: "configName is required" }, 400);
+          json(res, { error: "configName is required" }, 400);
           return;
         }
         if (!provider || !isKnownLLMProvider(provider)) {
-          jsonNoCors(res, { error: "valid provider is required" }, 400);
+          json(res, { error: "valid provider is required" }, 400);
           return;
         }
         if (credentialType !== "api-key" && credentialType !== "bearer-token") {
-          jsonNoCors(res, { error: "type must be api-key or bearer-token" }, 400);
+          json(res, { error: "type must be api-key or bearer-token" }, 400);
           return;
         }
         if (!secret) {
-          jsonNoCors(res, { error: "secret is required" }, 400);
+          json(res, { error: "secret is required" }, 400);
           return;
         }
         if (getLLMAuthProviderPlugin2(provider)) {
-          jsonNoCors(res, { error: "Subscription providers use OAuth login" }, 400);
+          json(res, { error: "Subscription providers use OAuth login" }, 400);
           return;
         }
         if (credentialType === "bearer-token" && provider !== "anthropic-compatible") {
-          jsonNoCors(res, { error: "bearer-token credentials are only supported for anthropic-compatible configs" }, 400);
+          json(res, { error: "bearer-token credentials are only supported for anthropic-compatible configs" }, 400);
           return;
         }
         if (credentialType === "api-key" && !API_KEY_CREDENTIAL_PROVIDERS.has(provider)) {
-          jsonNoCors(res, { error: "api-key credentials are not supported for this provider" }, 400);
+          json(res, { error: "api-key credentials are not supported for this provider" }, 400);
           return;
         }
         try {
@@ -7888,35 +7716,31 @@ function createRouter(dbOrDeps) {
             return checked;
           });
           if (!target.ok) {
-            jsonNoCors(res, credentialRefusalBody(target), target.status);
+            json(res, credentialRefusalBody(target), target.status);
             return;
           }
-          jsonNoCors(res, { saved: true, created: target.created });
+          json(res, { saved: true, created: target.created });
         } catch (err) {
-          jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to save credential" }, 500);
+          json(res, { error: err instanceof Error ? err.message : "Failed to save credential" }, 500);
         }
-      }).catch(() => jsonNoCors(res, { error: "Invalid request body" }, 400));
+      }).catch(() => json(res, { error: "Invalid request body" }, 400));
       return;
     }
     if (path === "/api/auth/credential/move" && req.method === "POST") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       readJsonBody(req).then(async (raw) => {
         const parsed = LlmCredentialMoveRequestSchema.safeParse(raw);
         if (!parsed.success) {
-          jsonNoCors(res, { error: "invalid_setup_input" }, 400);
+          json(res, { error: "invalid_setup_input" }, 400);
           return;
         }
         const from = checkCredentialName(parsed.data.from);
         const to = checkCredentialName(parsed.data.to);
         if (!from.ok || !to.ok) {
-          jsonNoCors(res, { error: "name_invalid" }, 400);
+          json(res, { error: "name_invalid" }, 400);
           return;
         }
         if (!configManager) {
-          jsonNoCors(res, { error: "Config manager is required to move credentials" }, 400);
+          json(res, { error: "Config manager is required to move credentials" }, 400);
           return;
         }
         try {
@@ -7934,25 +7758,21 @@ function createRouter(dbOrDeps) {
             return void 0;
           });
           if (refusal) {
-            jsonNoCors(res, credentialRefusalBody(refusal), refusal.status);
+            json(res, credentialRefusalBody(refusal), refusal.status);
             return;
           }
-          jsonNoCors(res, { moved: true });
+          json(res, { moved: true });
         } catch (err) {
-          jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to move credential" }, 500);
+          json(res, { error: err instanceof Error ? err.message : "Failed to move credential" }, 500);
         }
-      }).catch(() => jsonNoCors(res, { error: "invalid_setup_input" }, 400));
+      }).catch(() => json(res, { error: "invalid_setup_input" }, 400));
       return;
     }
     if (path === "/api/llm/test" && req.method === "POST") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       readJsonBody(req).then(async (body) => {
         const rawBody = body;
         if ("apiKey" in rawBody) {
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: "invalid_request",
             message: "apiKey is not accepted in LLM test requests. Save credentials for the named config instead."
@@ -7962,7 +7782,7 @@ function createRouter(dbOrDeps) {
         const providerName = typeof body.provider === "string" ? body.provider.trim() : "";
         const modelName = typeof body.model === "string" ? body.model.trim() : "";
         if (!providerName || !modelName) {
-          jsonNoCors(res, { success: false, error: "invalid_request", message: "provider and model are required" }, 400);
+          json(res, { success: false, error: "invalid_request", message: "provider and model are required" }, 400);
           return;
         }
         const configName = typeof body.configName === "string" ? body.configName.trim() : "";
@@ -7987,7 +7807,7 @@ function createRouter(dbOrDeps) {
         }
         const parsedConfig = ModelConfigSchema2.safeParse(llmCandidate);
         if (!parsedConfig.success) {
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: "invalid_request",
             message: parsedConfig.error.issues.map((issue) => `${issue.path.map(String).join(".") || "config"}: ${issue.message}`).join("; ")
@@ -7999,7 +7819,7 @@ function createRouter(dbOrDeps) {
         const coreAuth = await import("@vostride/agent-qa-core");
         const resolvedAuth = await coreAuth.resolveLLMAuth(configName, llmConfig2);
         if (resolvedAuth.kind === "missing") {
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: "missing_credential",
             message: resolvedAuth.message
@@ -8028,7 +7848,7 @@ function createRouter(dbOrDeps) {
           } finally {
             clearTimeout(timeout);
           }
-          jsonNoCors(res, {
+          json(res, {
             success: true,
             model: modelName,
             provider: providerName,
@@ -8043,7 +7863,7 @@ function createRouter(dbOrDeps) {
           const providerMessage = withDeclaredMask(declaredMask, (mask) => mask(unsavedMessage));
           const errorClass = classifyProviderError2(providerMessage ?? unsavedMessage, statusCode);
           const message = providerMessage === void 0 ? providerErrorSentence2(errorClass, "").trimEnd() : providerErrorSentence2(errorClass, providerMessage);
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: errorClass,
             message,
@@ -8053,7 +7873,7 @@ function createRouter(dbOrDeps) {
             ...unauthenticated ? { unauthenticated: true, authMessage } : {}
           });
         }
-      }).catch(() => jsonNoCors(res, { success: false, error: "invalid_request", message: "Invalid request body" }, 400));
+      }).catch(() => json(res, { success: false, error: "invalid_request", message: "Invalid request body" }, 400));
       return;
     }
     if (path === "/api/cache/purge" && req.method === "POST") {
@@ -8062,56 +7882,15 @@ function createRouter(dbOrDeps) {
         return;
       }
       readJsonBody(req).then(async (body) => {
-        if (!body.file && !body.all) {
-          json(res, { error: "Either file or all is required" }, 400);
+        if (body.all !== true) {
+          json(res, { error: "all is required" }, 400);
           return;
         }
         try {
           const cfg = await readConfigValues(configManager);
-          const cacheDir = cfg.services?.cache?.dir ?? cfg.cache?.dir;
-          if (!cacheDir) {
-            json(res, { error: "Cache directory not configured" }, 400);
-            return;
-          }
           const configDir = deps.configPath ? dirname7(resolve3(deps.configPath)) : process.cwd();
-          const resolvedCacheDir = resolve3(configDir, cacheDir);
-          let branchDirs;
-          try {
-            branchDirs = await readdir(resolvedCacheDir);
-          } catch (err) {
-            if (err.code === "ENOENT") {
-              json(res, { purged: 0 });
-              return;
-            }
-            throw err;
-          }
-          let purged = 0;
-          for (const branch of branchDirs) {
-            const branchPath = join4(resolvedCacheDir, branch);
-            let entryStat;
-            try {
-              entryStat = await stat5(branchPath);
-            } catch {
-              continue;
-            }
-            if (!entryStat.isDirectory()) {
-              await rm5(branchPath, { force: true });
-              continue;
-            }
-            let files;
-            try {
-              files = await readdir(branchPath);
-            } catch {
-              continue;
-            }
-            for (const file of files) {
-              if (!file.endsWith(".json")) continue;
-              await rm5(join4(branchPath, file), { force: true });
-              purged++;
-            }
-            await rm5(branchPath, { recursive: true, force: true }).catch(() => {
-            });
-          }
+          const cacheDir = cfg.services?.cache?.dir ?? DEFAULT_AGENT_QA_CACHE_DIR;
+          const purged = await purgeActionCache(resolve3(configDir, cacheDir));
           json(res, { purged });
         } catch (err) {
           json(res, { error: err instanceof Error ? err.message : "Cache purge failed" }, 500);
@@ -8195,7 +7974,7 @@ function createRouter(dbOrDeps) {
             return;
           }
           const workspaceEnv = await readWorkspaceEnvVars(workspacePaths);
-          const result = await new DockerHookExecutor2().execute(resolvedHook, {
+          const result = await new DockerHookExecutor2({ version: getAgentQaVersion2() }).execute(resolvedHook, {
             env: {
               ...workspaceEnv,
               ...validation.overrides
@@ -8231,7 +8010,7 @@ function createRouter(dbOrDeps) {
             variables: shown.variables,
             sandbox: {
               runtime: resolvedHook.runtime,
-              image: RUNTIME_IMAGE_MAP[resolvedHook.runtime],
+              image: hookRunnerImage(resolvedHook.runtime, getAgentQaVersion2()),
               networkMode: resolvedHook.network ? "enabled" : "disabled",
               dockerVersion: null,
               networkLogsAvailable: shown.networkLogs.length > 0,
@@ -8435,12 +8214,8 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (req.method === "GET" && /^\/api\/live-editor\/sessions\/[^/]+\/live-url$/.test(path)) {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       if (!deps.mintEditorLiveUrl) {
-        jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+        json(res, { error: "live_view_unavailable" }, 503);
         return;
       }
       let editorSessionId;
@@ -8449,33 +8224,32 @@ function createRouter(dbOrDeps) {
           path.slice("/api/live-editor/sessions/".length, -"/live-url".length)
         );
       } catch {
-        jsonNoCors(res, { error: "unknown_session" }, 404);
+        json(res, { error: "unknown_session" }, 404);
         return;
       }
       void deps.mintEditorLiveUrl(editorSessionId).then(
         (result) => {
-          jsonNoCors(res, result);
+          json(res, result);
         },
         (error) => {
           const name = error instanceof Error ? error.name : "";
           if (name === "UnknownLiveEditorSessionError") {
-            jsonNoCors(res, { error: "unknown_session" }, 404);
+            json(res, { error: "unknown_session" }, 404);
             return;
           }
           if (name === "LiveViewUnavailableError") {
-            jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+            json(res, { error: "live_view_unavailable" }, 503);
             return;
           }
-          jsonNoCors(res, { error: "live_url_mint_failed" }, 500);
+          json(res, { error: "live_url_mint_failed" }, 500);
         }
       );
       return;
     }
     const liveEditorAuthStateMatch = path.match(/^\/api\/live-editor\/sessions\/([^/]+)\/auth-state$/);
     if (liveEditorAuthStateMatch && req.method === "POST") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
       ;
@@ -8486,35 +8260,34 @@ function createRouter(dbOrDeps) {
           const body = await readJsonBody(req);
           const parsedName = AuthStateNameSchema.safeParse(typeof body?.name === "string" ? body.name : "");
           if (!parsedName.success) {
-            jsonNoCors(res, { error: "Auth state name must be a lowercase slug." }, 400);
+            json(res, { error: "Auth state name must be a lowercase slug." }, 400);
             return;
           }
           stateName = parsedName.data;
           session = sessionManager.getSession(decodeURIComponent(liveEditorAuthStateMatch[1]));
           if (!session) {
-            jsonNoCors(res, { error: "Session not found" }, 404);
+            json(res, { error: "Session not found" }, 404);
             return;
           }
           if (typeof session.captureWebAuthState !== "function") {
-            jsonNoCors(res, {
+            json(res, {
               error: `Could not save auth state "${stateName}" for target "${getSessionTargetNameForAuthState(session)}".`
             }, 500);
             return;
           }
           const authState = await session.captureWebAuthState(stateName, { replace: body?.replace === true });
-          jsonNoCors(res, { authState });
+          json(res, { authState });
         } catch (err) {
           const targetName = getSessionTargetNameForAuthState(session);
           const response = buildAuthStateSaveErrorMessage(stateName || "unknown", targetName, err);
-          jsonNoCors(res, { error: response.message }, response.status);
+          json(res, { error: response.message }, response.status);
         }
       })();
       return;
     }
     if (path === "/api/live-editor/sessions" && req.method === "POST") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
       ;
@@ -8522,16 +8295,10 @@ function createRouter(dbOrDeps) {
         try {
           const body = await readJsonBody(req);
           const targetName = typeof body?.targetName === "string" ? body.targetName : void 0;
-          const production = await resolveLiveTargetProduction(configManager, targetName);
-          const productionRefusal = liveProductionRefusal(production);
-          if (productionRefusal !== void 0) {
-            jsonNoCors(res, { error: productionRefusal.message }, 403);
-            return;
-          }
           const platform = body?.platform ?? "web";
           const runtimeLLM = await resolveDashboardRuntimeLLM(configManager, llmConfig, authFetch);
           if (!runtimeLLM.ok) {
-            jsonNoCors(res, { error: runtimeLLM.error }, 400);
+            json(res, { error: runtimeLLM.error }, 400);
             return;
           }
           const setupHooks = Array.isArray(body?.setupHooks) ? body.setupHooks.filter((value) => typeof value === "string" && value.trim().length > 0) : [];
@@ -8550,14 +8317,14 @@ function createRouter(dbOrDeps) {
           let resolvedHooks = /* @__PURE__ */ new Map();
           let hookRegistryError;
           if (!workspacePaths) {
-            jsonNoCors(res, { error: "Workspace path resolution not available" }, 500);
+            json(res, { error: "Workspace path resolution not available" }, 500);
             return;
           }
           try {
             const envContent = await readFile6(workspacePaths.envFile.absolutePath, "utf-8");
             envVars = parseEnvFile(envContent);
           } catch {
-            jsonNoCors(res, { error: `workspace.envFile file could not be loaded: ${workspacePaths.envFile.workspaceRelativePath}` }, 400);
+            json(res, { error: `workspace.envFile file could not be loaded: ${workspacePaths.envFile.workspaceRelativePath}` }, 400);
             return;
           }
           try {
@@ -8565,7 +8332,7 @@ function createRouter(dbOrDeps) {
             secretStore = SecretStore.fromEnvContent(secretsContent);
             secretRedactor = new SecretRedactor(secretStore);
           } catch {
-            jsonNoCors(res, { error: `workspace.secretsFile file could not be loaded: ${workspacePaths.secretsFile.workspaceRelativePath}` }, 400);
+            json(res, { error: `workspace.secretsFile file could not be loaded: ${workspacePaths.secretsFile.workspaceRelativePath}` }, 400);
             return;
           }
           const hookCatalog = await readWorkspaceHooks(configManager, deps.configPath);
@@ -8576,6 +8343,11 @@ function createRouter(dbOrDeps) {
             ...suiteFileManager === void 0 ? {} : { findSuite: (id) => suiteFileManager.findBySuiteId(id) }
           };
           const plannerLimits = await resolveLivePlannerLimits(configManager, entityRef, entityReaders);
+          const navigationTimeoutMs = await resolveLiveNavigationTimeoutMs(
+            configManager,
+            entityRef,
+            entityReaders
+          );
           const sessionSuiteRef = entityRef?.type === "suite" ? entityRef : void 0;
           const plannerLimitsForTest = (testId) => resolveLivePlannerLimits(
             configManager,
@@ -8586,7 +8358,6 @@ function createRouter(dbOrDeps) {
             {
               platform,
               targetName,
-              production: { productionTargetNames: production.productionTargetNames },
               plannerLimits,
               plannerLimitsForTest,
               llmConfig: runtimeLLM.llmConfig,
@@ -8600,6 +8371,7 @@ function createRouter(dbOrDeps) {
               hookRegistryError,
               url: body?.url,
               headless: body?.headless ?? false,
+              navigationTimeoutMs,
               useDeviceName: typeof body?.useDeviceName === "string" ? body.useDeviceName : void 0,
               appState: body?.appState === "preserve" || body?.appState === "reset" ? body.appState : void 0,
               bundleId: typeof body?.bundleId === "string" ? body.bundleId : void 0,
@@ -8609,38 +8381,37 @@ function createRouter(dbOrDeps) {
             },
             entityRef
           );
-          jsonNoCors(res, { sessionId, sessionNumber }, 201);
+          json(res, { sessionId, sessionNumber }, 201);
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          const status = err instanceof LiveProductionRefusedError ? 403 : err instanceof LivePlannerLimitsRefusedError ? 400 : 500;
-          jsonNoCors(res, { error: message }, status);
+          const refused = err instanceof LivePlannerLimitsRefusedError || err instanceof LiveNavigationTimeoutRefusedError;
+          const status = refused ? 400 : 500;
+          json(res, { error: message }, status);
         }
       })();
       return;
     }
     if (path === "/api/live-editor/sessions" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
-      jsonNoCors(res, { sessions: sessionManager.listSessions() });
+      json(res, { sessions: sessionManager.listSessions() });
       return;
     }
     const liveEditorSessionMatch = path.match(/^\/api\/live-editor\/sessions\/([^/]+)$/);
     if (liveEditorSessionMatch && req.method === "DELETE") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
       const sessionId = liveEditorSessionMatch[1];
       (async () => {
         const terminated = await sessionManager.terminateSession(sessionId);
         if (terminated) {
-          jsonNoCors(res, { ok: true });
+          json(res, { ok: true });
         } else {
-          jsonNoCors(res, { error: "Session not found" }, 404);
+          json(res, { error: "Session not found" }, 404);
         }
       })();
       return;
@@ -8689,6 +8460,7 @@ function createRouter(dbOrDeps) {
 // src/queue/job-queue.ts
 import { EventEmitter } from "node:events";
 import { cpus } from "node:os";
+import { printRunText as printRunText2 } from "@vostride/agent-qa-core";
 var NOT_CANCELLABLE = { kind: "not-cancellable" };
 var JobQueue = class extends EventEmitter {
   db;
@@ -8711,8 +8483,7 @@ var JobQueue = class extends EventEmitter {
     this.pollInterval = setInterval(() => this.dispatchReported("a poll"), intervalMs);
     this.on("enqueued", () => this.dispatchReported("an enqueue"));
   }
-  // 2026-10-17 (444-16, D-50): the server closes the database after this; a run that settles later
-  // still frees its slot, and nothing reads the closed database.
+  // The server closes the database after this; a run settling later still frees its slot.
   stop() {
     this.stopped = true;
     if (this.pollInterval) {
@@ -8798,7 +8569,10 @@ var JobQueue = class extends EventEmitter {
       this.processNext();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      console.error(`Queue could not dispatch the next run after ${trigger}: ${message}`);
+      printRunText2(
+        `Queue could not dispatch the next run after ${trigger}: ${message}`,
+        (text) => console.error(text)
+      );
     }
   }
   getActiveCount() {
@@ -8807,9 +8581,7 @@ var JobQueue = class extends EventEmitter {
   getConcurrency() {
     return this.concurrency;
   }
-  // 2026-10-16 (442-05, D-06 to D-08): only the owner cancels a running row; gone is an orphan.
-  // 442-15 (GAP-D2): own is the stamp this handle wrote, or equal non-null start times.
-  // 2026-10-17 (444-06, D-11): a running row is never written here; the run answers with its verdict.
+  // Only the owner stops its running row, never written here; a gone owner's row is an orphan.
   cancel(runId) {
     const run = this.db.getRun(runId);
     if (!run) return NOT_CANCELLABLE;
@@ -8839,21 +8611,7 @@ var JobQueue = class extends EventEmitter {
     const run = this.db.getRun(runId);
     return run && run.status !== "running" && run.status !== "pending" ? { kind: "finished", status: run.status } : NOT_CANCELLABLE;
   }
-  // 2026-08-24 (Phase 402 plan 09, D-11): THE CHILD-RUN CANCELLATION FAN-OUT IS DELETED WITH THE
-  // MODEL THAT MINTED ITS CHILDREN.
-  //
-  // ~19 lines stood here walking the run's child rows and cancelling each member row. Under
-  // the one-run model a parallel suite is ONE run row with member handles (402-04) — nothing writes
-  // the run row's parent-link column any more (405-07 then deleted the column outright), so the
-  // walk could only ever have read an empty list while reading as live cancellation policy.
-  // Cancelling the run cancels the run.
-  //
-  // WHAT THIS DOES NOT TOUCH: `parallel` below. D-11 keeps the queue's parallel flag as CROSS-RUN
-  // concurrency of INDEPENDENT jobs, which is what `findNextEligible` has always used it for. What
-  // was deleted is parallel-SUITE semantics, not the queue's ability to run two unrelated jobs.
-  //
-  // HISTORICAL ROWS: a pre-402 suite run still lists its members on the read side; cancelling
-  // such a run now leaves those member rows in whatever state their own process left them.
+  // `parallel` is cross-run concurrency of independent jobs; a suite is one run row.
   findNextEligible() {
     if (this.activeCount >= this.concurrency) return void 0;
     const pending = this.db.getPendingRuns();
@@ -8876,7 +8634,7 @@ var JobQueue = class extends EventEmitter {
 };
 
 // src/tests/suite-file-manager.ts
-import { readFile as readFile7, mkdir as mkdir4, stat as stat6, rm as rm6 } from "node:fs/promises";
+import { readFile as readFile7, mkdir as mkdir4, stat as stat5, rm as rm5 } from "node:fs/promises";
 import { dirname as dirname8, basename as basename6 } from "node:path";
 import { generateSuiteId } from "@vostride/agent-qa-ids";
 import { parse as parseYaml7 } from "yaml";
@@ -8887,14 +8645,14 @@ var SuiteFileManager = class {
     this.testFileManager = testFileManager;
   }
   testFileManager;
-  // 2026-10-18 (444-33, D-65; 444-35, D-66): each list call reads the workspace itself; each file is written whole and one writer at a time.
+  // Each list call reads the workspace itself; each file is written whole, one writer at a time.
   underLock = createPathLock();
   async list() {
     const records = await discoverWorkspaceFiles4({ workspace: this.workspace, kind: "suite" });
     const files = [];
     for (const record of records) {
       try {
-        const s = await stat6(record.absolutePath);
+        const s = await stat5(record.absolutePath);
         if (s.isFile()) {
           let suiteName = basename6(record.workspaceRelativePath);
           let testCount = 0;
@@ -8971,7 +8729,7 @@ var SuiteFileManager = class {
   }
   async delete(relativePath) {
     const target = await this.resolveTarget(relativePath, true);
-    await this.underLock(target.absolutePath, () => rm6(target.absolutePath));
+    await this.underLock(target.absolutePath, () => rm5(target.absolutePath));
   }
   async validate(content) {
     try {
@@ -9028,6 +8786,7 @@ import { request } from "node:http";
 import { spawn } from "node:child_process";
 import {
   formatAppiumInstallGuidance,
+  printRunText as printRunText3,
   resolveAppiumExecutable
 } from "@vostride/agent-qa-core";
 import treeKill from "tree-kill";
@@ -9155,21 +8914,21 @@ var AppiumManager = class {
       if (err.code === "ENOENT") {
         console.error(`${APPIUM_PREFIX} Appium not found. ${formatAppiumInstallGuidance()}`);
       } else {
-        console.error(`${APPIUM_PREFIX} Error: ${err.message}`);
+        printRunText3(`${APPIUM_PREFIX} Error: ${err.message}`, (text) => console.error(text));
       }
     });
     child.stdout?.on("data", (chunk) => {
       if (this.logLevel !== "debug") return;
       const lines = chunk.toString().split("\n").filter(Boolean);
       for (const line of lines) {
-        console.log(`${APPIUM_PREFIX} ${pc.dim(line)}`);
+        printRunText3(`${APPIUM_PREFIX} ${pc.dim(line)}`, (text) => console.log(text));
       }
     });
     child.stderr?.on("data", (chunk) => {
       if (this.logLevel !== "debug") return;
       const lines = chunk.toString().split("\n").filter(Boolean);
       for (const line of lines) {
-        console.error(`${APPIUM_PREFIX} ${pc.dim(line)}`);
+        printRunText3(`${APPIUM_PREFIX} ${pc.dim(line)}`, (text) => console.error(text));
       }
     });
     const start = Date.now();
@@ -9251,10 +9010,7 @@ var SessionManager = class {
     this.deps = deps;
   }
   sessions = /* @__PURE__ */ new Map();
-  // Per-entity counter keyed by `${entityType}:${entityId}`.
-  // Monotonic and ephemeral: resets on server restart per CONTEXT D-30.
-  // Never decremented on terminate — a re-open of a terminated entity yields
-  // the next number so "Session #3" after "#2" ends does not confuse users.
+  // Monotonic per entity and reset on restart, so a reopened entity gets the next number.
   counters = /* @__PURE__ */ new Map();
   async createSession(config, entity) {
     if (!config.llmConfig) {
@@ -9311,7 +9067,8 @@ var SessionManager = class {
 };
 
 // src/live-editor/ws-handler.ts
-import { parseTestFile } from "@vostride/agent-qa-core";
+import { format as format2 } from "node:util";
+import { parseTestFile, printRunText as printRunText4 } from "@vostride/agent-qa-core";
 
 // src/live-editor/types.ts
 var LIVE_EDITOR_UNKNOWN_SESSION_CLOSE_CODE = 4404;
@@ -9498,12 +9255,14 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
             try {
               raw = await testFileManager.read(msg.path);
             } catch (readErr) {
-              console.error(`[ws-handler] execute-test: read failed for path=${msg.path}`, readErr);
+              const line = `[ws-handler] execute-test: read failed for path=${msg.path}`;
+              printRunText4(format2(line, readErr), () => console.error(line, readErr));
               throw new Error(`Cannot read test file "${msg.path}": ${readErr?.message ?? String(readErr)}`);
             }
             const parsed = parseTestFile(raw, msg.path);
             if (parsed.errors.length > 0) {
-              console.error(`[ws-handler] execute-test: parse errors for ${msg.path}`, parsed.errors);
+              const line = `[ws-handler] execute-test: parse errors for ${msg.path}`;
+              printRunText4(format2(line, parsed.errors), () => console.error(line, parsed.errors));
               throw new Error(`Parse error in ${msg.path}: ${parsed.errors[0].message}`);
             }
             const testDef = parsed.tests[0];
@@ -9513,7 +9272,13 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
             const stepInstructions = testDef.steps.map(
               (s) => typeof s === "string" ? s : s.step
             );
-            console.log(`[ws-handler] execute-test: starting "${testDef.name}" (${stepInstructions.length} steps, setup=${(testDef.setup ?? []).length}, teardown=${(testDef.teardown ?? []).length})`);
+            const stepCount = stepInstructions.length;
+            const setupCount = (testDef.setup ?? []).length;
+            const teardownCount = (testDef.teardown ?? []).length;
+            printRunText4(
+              `[ws-handler] execute-test: starting "${testDef.name}" (${stepCount} steps, setup=${setupCount}, teardown=${teardownCount})`,
+              (text) => console.log(text)
+            );
             reply({
               type: "test-start",
               test: {
@@ -9535,7 +9300,11 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
                 teardown: testDef.teardown ?? []
               }
             );
-            console.log(`[ws-handler] execute-test: finished "${testDef.name}" status=${result.status} duration=${result.duration}ms${result.error ? ` error=${result.error}` : ""}`);
+            const errorPart = result.error ? ` error=${result.error}` : "";
+            printRunText4(
+              `[ws-handler] execute-test: finished "${testDef.name}" status=${result.status} duration=${result.duration}ms${errorPart}`,
+              (text) => console.log(text)
+            );
             reply({
               type: "test-complete",
               test: {
@@ -9548,11 +9317,9 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
             });
             reply({ type: "session-state", state: session.getState() });
           } catch (err) {
-            console.error(`[ws-handler] execute-test: caught error for path=${msg.path}`, {
-              message: err?.message,
-              stack: err?.stack,
-              code: err?.code
-            });
+            const line = `[ws-handler] execute-test: caught error for path=${msg.path}`;
+            const detail = { message: err?.message, stack: err?.stack, code: err?.code };
+            printRunText4(format2(line, detail), () => console.error(line, detail));
             reply({
               type: "test-error",
               test: {
@@ -9809,8 +9576,7 @@ function renderLiveEmbedPage(input) {
       if (pending === null) return;
       var header = pending;
       pending = null;
-      // NO MIME TYPE: the decoder sniffs the bytes, so a JPEG screencast frame and a PNG snapshot
-      // both paint in every host, not only in Chromium (428 RESEARCH A2).
+      // No MIME type: the decoder sniffs, so JPEG and PNG frames paint in every host.
       var blob = new Blob([event.data]);
       createImageBitmap(blob).then(function (bitmap) {
         if (canvas.width !== header.width || canvas.height !== header.height) {
@@ -9834,8 +9600,7 @@ function renderLiveEmbedPage(input) {
     try { msg = JSON.parse(event.data); } catch (e) { return; }
 
     if (msg.type === 'ready') {
-      // THE PAINTER IS CHOSEN BY THE DECLARED KIND \u2014 never by a browser name, an adapter class or
-      // a transport guess (LIVE-04's prohibition). A snapshot paints on the same canvas (428 D-11).
+      // The declared kind picks the painter, never a browser name, adapter or transport guess.
       var kind = msg.stream ? msg.stream.kind : undefined;
       if (kind === 'cdp-screencast' || kind === 'snapshot') {
         setState('connecting', 'waiting for the first frame\u2026');
@@ -9882,8 +9647,7 @@ function renderLiveEmbedPage(input) {
     report({ event: 'lost' });
   });
 
-  // A HOST THAT RE-MINTS replaces the fragment; the socket renews in place rather than reloading,
-  // so a renewal never costs the viewer the stream it is watching (D-02).
+  // A re-minting host replaces the fragment; the socket renews in place and the stream continues.
   window.addEventListener('hashchange', function () {
     var next = location.hash.slice(1);
     if (next === '' || socket.readyState !== 1) return;
@@ -10093,7 +9857,8 @@ function createFrameProxy(deps) {
 
 // src/server/server.ts
 import {
-  isLoopbackHost as isLoopbackHost2
+  isLoopbackHost as isLoopbackHost2,
+  printRunText as printRunText5
 } from "@vostride/agent-qa-core";
 var MIME_TYPES = {
   ".html": "text/html; charset=utf-8",
@@ -10113,9 +9878,10 @@ var MIME_TYPES = {
   ".webp": "image/webp"
 };
 var DashboardRemoteBindRefusedError = class extends Error {
-  constructor(host) {
+  constructor(host, port) {
+    const p = String(port === 0 ? 3470 : port);
     super(
-      `The dashboard was asked to bind ${host}, which is not a loopback interface. Nothing this server serves \u2014 the run trigger, the queue enqueue, the run service, the artifact serving, the config reads \u2014 asks for a credential, so a non-loopback bind would publish an anonymous run trigger to the network. Leave services.dashboard.host unset (it defaults to ${DEFAULT_DASHBOARD_HOST}), and reach a remote dashboard through an authenticating proxy or a tunnel you control.`
+      `The dashboard was asked to bind ${host}, which is not a loopback interface. Nothing this server serves \u2014 the run trigger, the queue enqueue, the run service, the artifact serving, the config reads \u2014 asks for a credential, so a non-loopback bind would publish an anonymous run trigger to the network. Leave services.dashboard.host unset (it defaults to ${DEFAULT_DASHBOARD_HOST}). To use the dashboard from another machine, forward its port with ssh -L ${p}:localhost:${p} <host> and open http://localhost:${p}/.`
     );
     this.host = host;
     this.name = "DashboardRemoteBindRefusedError";
@@ -10127,7 +9893,7 @@ async function startServer(opts) {
   const runServiceAttach = opts.runServiceAttach ?? runService?.attach;
   const host = opts.host?.trim() || DEFAULT_DASHBOARD_HOST;
   if (!isLoopbackHost2(host)) {
-    throw new DashboardRemoteBindRefusedError(host);
+    throw new DashboardRemoteBindRefusedError(host, port);
   }
   const resolvedConfigPath = configPath ?? resolve4("agent-qa.config.yaml");
   const configManager = new ConfigManager(resolvedConfigPath, opts.declaredSecretMask);
@@ -10162,7 +9928,7 @@ async function startServer(opts) {
           failureSummary = "Test timed out -- process was killed";
         } else if (details.refusedBeforeStart) {
           dbStatus = "failed";
-          refusalProse = details.neutralReason ?? details.reason;
+          refusalProse = details.reason;
           failureSummary = refusalProse ? `Refused before the run started: ${refusalProse}`.slice(0, 300) : "Refused before the run started";
         } else if (status === "completed") {
           dbStatus = "failed";
@@ -10243,7 +10009,10 @@ async function startServer(opts) {
         mobileRuns.set(run.id, platform);
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        console.error(`Failed to start Appium for run ${run.id}: ${message}`);
+        printRunText5(
+          `Failed to start Appium for run ${run.id}: ${message}`,
+          (text) => console.error(text)
+        );
         db.updateRun(run.id, {
           status: "failed",
           failureSummary: `Appium server failed to start: ${message}`,
@@ -10263,19 +10032,9 @@ async function startServer(opts) {
       runId: run.id,
       args,
       source: meta.isSuite ? "suite" : "dashboard",
-      // 2026-10-01 (432-14, D-14): no confirm scope is read off the row any more. The browser that
-      // triggered a run is not asked anything, so nothing about it has to survive the wait.
       attributes: run.attributes,
-      // T-401-G26 (401-23): a persisted row's timeout is VALIDATED at the seam that consumes it.
-      // `in-process-backend.ts:211` reads `opts.timeout ?? defaultTimeout` and validates AFTER, so
-      // any non-nullish nonsense here skips the default and leaves the run with no reclamation
-      // timer at all. An unusable value falls back to the backend's default rather than a number
-      // this call invented.
+      // The backend takes `opts.timeout ?? defaultTimeout`, so an unusable value falls back here.
       timeout: sanitizeQueuedExecutionTimeout(meta.timeout),
-      // THE LEASE ABOVE IS UNCHANGED; ONLY ITS DELIVERY IS. `acquireLease` still runs where it ran,
-      // still keys on this run id and still owns the bundled Appium's lifecycle (design-of-record).
-      // What used to ride `AGENT_QA_APPIUM_URL` in a child's environment now travels as an
-      // argument, because there is no child to carry an environment.
       ...isMobile ? { appiumUrl: appiumManager.getUrl() } : {}
     });
   });
@@ -10286,16 +10045,14 @@ async function startServer(opts) {
     appiumManager,
     configManager,
     configPath: resolvedConfigPath,
-    // 428 D-07: each created session registers here, which is what the frame socket attaches.
+    // Each created session registers here, which is what the frame socket attaches.
     ...liveEditorSubjects === void 0 ? {} : { liveEditorSubjects }
   });
   const servesLiveView = liveView !== void 0 && (runServiceAttach !== void 0 || liveEditorSubjects !== void 0);
   const apiRouter = createRouter({
     db,
     workspacePaths,
-    // 401-07: conditionally spread on the same house rule `agentHost` follows — an absent
-    // dependency is an ABSENT field, never a present `undefined`, so the router's own 503 arm is
-    // what decides, in one place.
+    // Absent dependencies are absent fields, so the router's own 503 arm decides in one place.
     ...executionBackend === void 0 ? {} : { executionBackend },
     jobQueue,
     testFileManager,
@@ -10306,27 +10063,13 @@ async function startServer(opts) {
     llmConfig,
     authFetch,
     sessionManager,
-    // 400-01: conditionally spread on the house rule an absent dependency is an ABSENT field and
-    // never a present `undefined` — the router's own 501 arm is what decides, in one place.
+    // Absent dependencies are absent fields, so the router's own 501 arm decides in one place.
     ...agentHost === void 0 ? {} : { agentHost },
-    // 402-05 (D-15): the same conditional-spread house rule. Absent means a legacy mount rather
-    // than an unconfigured service, and the router's own 503 arm is what decides, in one place.
     ...runServiceReadiness === void 0 ? {} : { runServiceReadiness },
-    // 402-08 (D-01): the LOCAL run-stream door's attach port, READ OFF `runService` rather than
-    // composed again. That derivation is the "one session registry serves both doors" claim in its
-    // structural form — there is no second wiring a composition root could forget or point
-    // somewhere else, and the two doors cannot end up attached to different registries. Absent
-    // `runService` means no registry exists at all, so the same conditional-spread house rule
-    // applies and the router's own 503 arm decides.
+    // Read off `runService` by default, so both doors attach to one session registry.
     ...runServiceAttach === void 0 ? {} : { runServiceAttach },
-    // 403 D-03: the mint route's port, on the same conditional-spread house rule — absent means
-    // this host serves no live view and the route's own 503 arm decides, in one place.
     ...liveView === void 0 ? {} : { mintLiveUrl: liveView.mintLiveUrl },
-    // 428 D-07: the editor mint, on the same house rule — absent means the editor mint route's own
-    // 503 decides.
     ...liveView?.mintEditorLiveUrl === void 0 ? {} : { mintEditorLiveUrl: liveView.mintEditorLiveUrl },
-    // 404-05 (D-16): the same conditional-spread house rule — absent means this host serves no
-    // post-processing push channel and the stream arm's own 503 decides, in one place.
     ...postProcessingRelay === void 0 ? {} : { postProcessingRelay }
   });
   const runServiceRouter = runService === void 0 ? void 0 : createRunServiceRoutes(runService);
@@ -10346,13 +10089,15 @@ async function startServer(opts) {
         apiRouter(req, res);
         return;
       }
+      if (refuseNonLoopbackHost(req) !== void 0) {
+        const address = server.address();
+        const boundPort = typeof address === "object" && address !== null ? address.port : port;
+        refuseForeignHostPage(res, boundPort);
+        return;
+      }
       if (req.method === "OPTIONS") {
-        res.writeHead(204, {
-          "Access-Control-Allow-Origin": "*",
-          "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-          "Access-Control-Allow-Headers": "Content-Type"
-        });
-        res.end();
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("Not Found");
         return;
       }
       if (req.method === "GET" && path.startsWith(LIVE_EMBED_PATH_PREFIX)) {
@@ -10387,17 +10132,16 @@ async function startServer(opts) {
         return;
       }
       if (uiDir) {
-        const filePath = path === "/" ? join5(uiDir, "index.html") : join5(uiDir, path);
+        const filePath = path === "/" ? join4(uiDir, "index.html") : join4(uiDir, path);
         try {
-          const fileStat = await stat7(filePath);
+          const fileStat = await stat6(filePath);
           if (fileStat.isFile()) {
             const content = await readFile8(filePath);
             const ext = extname(filePath);
             const contentType = MIME_TYPES[ext] || "application/octet-stream";
             res.writeHead(200, {
               "Content-Type": contentType,
-              "Content-Length": content.length,
-              "Access-Control-Allow-Origin": "*"
+              "Content-Length": content.length
             });
             res.end(content);
             return;
@@ -10405,12 +10149,11 @@ async function startServer(opts) {
         } catch {
         }
         try {
-          const indexPath = join5(uiDir, "index.html");
+          const indexPath = join4(uiDir, "index.html");
           const content = await readFile8(indexPath);
           res.writeHead(200, {
             "Content-Type": "text/html",
-            "Content-Length": content.length,
-            "Access-Control-Allow-Origin": "*"
+            "Content-Length": content.length
           });
           res.end(content);
           return;
@@ -10495,7 +10238,8 @@ async function startServer(opts) {
         session.clearIdleTimer();
         const handler = createSessionHandler(session, () => {
           void sessionManager.terminateSession(sessionId).catch((error) => {
-            console.error(`[live-editor] could not end session ${sessionId}`, error);
+            const line = `[live-editor] could not end session ${sessionId}`;
+            printRunText5(format3(line, error), () => console.error(line, error));
           });
         }, (event) => {
           db.insertTokenEvent(event);