@vostride/agent-qa-dashboard 0.2.2 → 0.2.4

package/dist/index.cjs

@@ -98,7 +98,6 @@ __export(index_exports, {
   renderLiveEmbedPage: () => renderLiveEmbedPage,
   resolveDashboardDbPath: () => resolveDashboardDbPath,
   resolveRunOwnerHost: () => resolveRunOwnerHost,
-  runDenialOf: () => runDenialOf,
   runRowIdentity: () => runRowIdentity,
   serializeConfigWrite: () => serializeConfigWrite,
   servePostProcessingRead: () => servePostProcessingRead,
@@ -136,7 +135,6 @@ var MIGRATIONS = [
         llm_provider TEXT,
         parallel INTEGER DEFAULT 0,
         error_log TEXT,
-        memory_log TEXT,
         test_id TEXT,
         suite_id TEXT,
         owner_pid INTEGER,
@@ -159,9 +157,7 @@ var MIGRATIONS = [
         variables TEXT,
         created_at TEXT DEFAULT CURRENT_TIMESTAMP,
         hook_id TEXT,
-        -- 405 D-01: where in the run tree this hook ran. Sourced from HookFinishedPayload's own
-        -- optional testIndex/stepIndex; NULL means a run-scoped hook, which is a real state and
-        -- not a missing value.
+        -- Where in the run tree this hook ran; NULL means a run-scoped hook, not a missing value.
         test_index INTEGER,
         step_index INTEGER
       )`,
@@ -175,10 +171,7 @@ var MIGRATIONS = [
       )`,
       `CREATE TABLE IF NOT EXISTS run_artifacts (
         run_id TEXT PRIMARY KEY REFERENCES runs(id) ON DELETE CASCADE,
-        -- 2026-08-27 (405-07, RESEARCH Open Q4): TWO KINDS, because two is all anything mints.
-        -- The set used to admit two more, named for the parent/child run tree 402-09 retired; no
-        -- writer has produced either since, so admitting them was the schema agreeing to store a
-        -- distinction the product no longer makes.
+        -- Two kinds, because no writer mints any other.
         kind TEXT NOT NULL CHECK(kind IN ('test', 'unknown')),
         schema_version INTEGER NOT NULL,
         payload TEXT NOT NULL DEFAULT '{}',
@@ -186,17 +179,7 @@ var MIGRATIONS = [
         created_at TEXT DEFAULT CURRENT_TIMESTAMP,
         updated_at TEXT DEFAULT CURRENT_TIMESTAMP
       )`,
-      // ---- The v2 bus-shaped projection (405 D-01) ----------------------------------------
-      //
-      // THE COLUMNS ARE THE PAYLOAD'S OWN NAMES, snake_cased and nothing else. No field is
-      // re-derived, renamed or re-interpreted on the way in — that is D-01's whole claim, and
-      // it is what makes the read a mirror rather than a second opinion. Nested payload objects
-      // (`planned_action`, `grounding`, `result`, `artifact_refs`) are `JSON.stringify` of the
-      // field VERBATIM; the projection never reaches inside one.
-      //
-      // `test_index` IS THE HANDLE (RESEARCH D4). `handleId(runId, testIndex)` is how this
-      // product spells run-scoped member identity, so minting a second id here would be a
-      // second spelling of the same fact.
+      // Columns are the payload's names snake_cased; `test_index` is the handle, so no second id.
       `CREATE TABLE IF NOT EXISTS run_members (
         run_id TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
         test_index INTEGER NOT NULL,
@@ -211,15 +194,12 @@ var MIGRATIONS = [
         duration_ms INTEGER,
         failure_summary TEXT,
         retry_count INTEGER,
-        -- D-17 ordinal. Starts at 1 and rises on testRetryScheduled; never reset by an upsert.
+        -- Starts at 1 and rises on testRetryScheduled; never reset by an upsert.
         attempts INTEGER NOT NULL DEFAULT 1,
         recording_json TEXT,
         PRIMARY KEY (run_id, test_index)
       )`,
-      // The token columns are NULLABLE AND NEVER DEFAULT 0 (D-05/D-06). The retired v1 projection
-      // declared these `INTEGER DEFAULT 0`, and that zero was a measurement nobody made — the exact
-      // lie this shape refuses to be able to tell. 405-04 landed the producer, so a step the runner
-      // measured carries real counts and a step it did not carries NULL, which stays honest.
+      // Token columns are nullable with no default, so a step nobody measured carries NULL, not 0.
       `CREATE TABLE IF NOT EXISTS run_steps (
         run_id TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
         test_index INTEGER NOT NULL,
@@ -741,9 +721,7 @@ var DashboardDatabase = class {
     if (owner) this.ownStamps.set(id, owner);
     return id;
   }
-  // 2026-10-17 (443-02, D-07): one statement that inserts a fresh row or adopts this handle's own
-  // running row; any other row is refused and left untouched. An adopt that names no name or
-  // attributes keeps the row's own (443-04).
+  // Inserts a fresh row or adopts this handle's own running row; any other row is left untouched.
   claimRunningRow(id, fields) {
     const stamp = this.ownStamps.get(id) ?? this.readOwnStamp();
     const result = this.db.prepare(`
@@ -812,10 +790,6 @@ var DashboardDatabase = class {
       fields.push("error_log = ?");
       values.push(updates.errorLog);
     }
-    if (updates.memoryLog !== void 0) {
-      fields.push("memory_log = ?");
-      values.push(updates.memoryLog);
-    }
     if (updates.attributes !== void 0) {
       fields.push("attributes = ?");
       values.push(JSON.stringify(updates.attributes));
@@ -918,26 +892,8 @@ var DashboardDatabase = class {
     this.ownStamps.set(id, stamp);
     return true;
   }
-  // ---- The v2 bus-shaped projection (Phase 405 plan 01, D-01) ---------------------------------
-  //
-  // SIX MEMBERS, AND EVERY ONE OF THEM MIRRORS. The columns are the bus payload's own names; the
-  // nested objects are `JSON.stringify` of the field verbatim. Nothing in this block decides what
-  // a status means, re-derives a duration or fills a token count — a projection that interpreted
-  // would be a second opinion about a run the event log already settled.
-  /**
-   * Write or refresh ONE member row, keyed by the handle `(run_id, test_index)`.
-   *
-   * AN UPSERT AND NOT TWO WRITES, because the member row is fed by two events at two times:
-   * `testStarted` knows the identity fields and `testFinished` knows the outcome — and D-18
-   * requires a member whose stream begins with a terminal event to render anyway, so the second
-   * one alone has to be able to create the row.
-   *
-   * ONLY SUPPLIED FIELDS MOVE. `COALESCE(excluded.x, run_members.x)` on every optional column, so
-   * a `testFinished` that carries no name cannot blank the name `testStarted` wrote. `attempts` is
-   * excluded from the update entirely: it is the D-17 retry ordinal, owned by
-   * `incrementRunMemberAttempts`, and an upsert that reset it would erase the fact the header
-   * renders.
-   */
+  // The projection mirrors bus payload names verbatim and interprets nothing.
+  // An upsert because a member's first event may be terminal; `COALESCE` keeps unsupplied fields.
   upsertRunMember(member) {
     this.db.prepare(`
       INSERT INTO run_members (
@@ -975,26 +931,13 @@ var DashboardDatabase = class {
       member.recording === void 0 ? null : JSON.stringify(member.recording)
     );
   }
-  /**
-   * Raise ONE member's attempt ordinal (D-17). A no-op when the member row does not exist yet —
-   * a retry scheduled before any identity event is a real ordering, and inventing a row here
-   * would put a member on the page that nothing has said anything about.
-   */
+  // A no-op without a member row, so a retry before any identity event adds no member.
   incrementRunMemberAttempts(runId, testIndex) {
     this.db.prepare(
       "UPDATE run_members SET attempts = attempts + 1 WHERE run_id = ? AND test_index = ?"
     ).run(runId, testIndex);
   }
-  /**
-   * Drop ONE HANDLE's projected step and sub-action rows (D-17).
-   *
-   * SCOPED TO THE HANDLE, which was the whole change from the v1 run-wide step delete this
-   * replaced (deleted outright by 405-07's census): that member wiped every step of the RUN on any
-   * member's retry, so in a suite the abandoned attempt of test 3 deleted the completed history of
-   * tests 0-2. The member row itself survives — its outcome and its attempt count are facts about
-   * the member, not about the attempt. So do its setup and teardown hook rows, which run once per
-   * member outside the retry loop; only the attempt's `inline` hook rows go (433-41, CR-01).
-   */
+  // Scoped to the handle: the member row and its setup and teardown hooks survive a retry.
   deleteMemberProjection(runId, testIndex) {
     this.db.prepare("DELETE FROM run_steps WHERE run_id = ? AND test_index = ?").run(runId, testIndex);
     this.db.prepare("DELETE FROM run_sub_actions WHERE run_id = ? AND test_index = ?").run(runId, testIndex);
@@ -1002,12 +945,7 @@ var DashboardDatabase = class {
       "DELETE FROM execution_logs WHERE run_id = ? AND test_index = ? AND phase = 'inline'"
     ).run(runId, testIndex);
   }
-  /**
-   * Write ONE finalized step row. `INSERT OR REPLACE` because a re-run of the same handle re-emits
-   * the same `(test_index, step_index)` and the LAST attempt is the one the page renders (D-17).
-   *
-   * The three token columns stay NULL when `tokenUsage` is absent — never 0 (D-05).
-   */
+  // `INSERT OR REPLACE`, so a re-run's last attempt wins; tokens stay NULL when absent, never 0.
   insertRunStep(step) {
     this.db.prepare(`
       INSERT OR REPLACE INTO run_steps (
@@ -1067,14 +1005,7 @@ var DashboardDatabase = class {
       subAction.recordingOffsetMs ?? null
     );
   }
-  /**
-   * THE run-detail read (D-03). `undefined` when no `runs` row exists — absence is a RESULT here,
-   * and turning it into a typed refusal is the `runs.detail` op's job, so the "not found"
-   * vocabulary lives in the function layer rather than in this store.
-   *
-   * A run that exists and projected nothing answers three empty arrays, which is a DIFFERENT fact
-   * and stays a different answer.
-   */
+  // `undefined` when no run row exists; a run that projected nothing answers three empty arrays.
   readRunDetailRows(runId) {
     const run = this.db.prepare("SELECT id FROM runs WHERE id = ?").get(runId);
     if (run === void 0) return void 0;
@@ -1214,7 +1145,7 @@ var DashboardDatabase = class {
       offset: opts.offset
     }));
   }
-  // 2026-10-17 (444-05, D-09): one batched member read per 400 returned rows, after pagination.
+  // Members are read for the returned rows only, after pagination.
   withMemberSummaries(runs) {
     for (let offset = 0; offset < runs.length; offset += 400) {
       const batch = runs.slice(offset, offset + 400);
@@ -1257,7 +1188,7 @@ var DashboardDatabase = class {
       owner: { pid: row.owner_pid, incarnation: row.owner_incarnation, host: row.owner_host ?? "" }
     }));
   }
-  // 2026-10-16 (442-01, D-04): one compare-and-set on the stamped owner; never read-then-write.
+  // One compare-and-set on the stamped owner; never read-then-write.
   finalizeOwnRun(id, updates) {
     const fields = ["status = ?", "ended_at = ?"];
     const values = [updates.status, updates.endedAt];
@@ -1279,8 +1210,7 @@ var DashboardDatabase = class {
     this.ownStamps.delete(id);
     return true;
   }
-  // 2026-10-17 (443-13, GAP-D1; 444-04): no status condition, because the verdict may already have
-  // moved the row off running; the owner columns alone decide whose row it is.
+  // No status condition, as the verdict may have moved the row off running; owner columns decide.
   closeOwnRun(id, updates) {
     const stamp = this.ownStamps.get(id) ?? this.readOwnStamp();
     const result = this.db.prepare(`
@@ -1291,8 +1221,7 @@ var DashboardDatabase = class {
     this.ownStamps.delete(id);
     return true;
   }
-  // 2026-10-16 (442-15, GAP-D2): own is the stamp this handle wrote, so a NULL start time here is
-  // this handle's own write, never an inference about another process.
+  // Own is the stamp this handle wrote, so a NULL start time here is this handle's own write.
   isOwnStamp(id, owner) {
     const stamp = this.ownStamps.get(id);
     return stamp !== void 0 && stamp.pid === owner.pid && stamp.incarnation === owner.incarnation && stamp.host === owner.host;
@@ -1391,20 +1320,7 @@ var DashboardDatabase = class {
     `).all(...params);
     return rows.map((row) => ({ value: row.value, count: row.count }));
   }
-  /**
-   * Delete ONE run and everything the schema hangs off it (405-07, D-02/D-14 · T-405-27).
-   *
-   * ONE ID, AND THE CASCADE DOES THE REST. This used to open with a recursive `run_tree` CTE that
-   * walked the child rows of a suite parent, then hand-delete their step and trace rows in a
-   * transaction. Nothing has written a child row since 402-09 — one `runs` row per run, member
-   * identity on `run_members` — so the walk could only ever return the one row it was seeded with,
-   * and the hand-deletes named tables this schema no longer has. Every table that references a run
-   * declares `ON DELETE CASCADE`, so the single statement below is the whole deletion.
-   *
-   * AND IT TOUCHES NO FILE. The two path arrays it used to collect fed the router's artifact
-   * cleanup; both are gone. The run's directory under `.agent-qa/runs/` — its event log and its
-   * content-addressed blobs — is the run's own record and is not the dashboard's to remove.
-   */
+  // Every table referencing a run cascades on delete, and no file is touched.
   deleteRun(id) {
     const changes = this.db.prepare("DELETE FROM runs WHERE id = ?").run(id);
     const deleted = Number(changes.changes ?? 0) > 0;
@@ -1491,15 +1407,7 @@ var DashboardDatabase = class {
   getRunArtifactBundle(runId) {
     return { artifact: this.getRunArtifact(runId) };
   }
-  /**
-   * The runs a self-heal happened on (405-07, D-02).
-   *
-   * READ OFF `run_steps.self_heal_occurred`, WHICH IS THE SURVIVING HEALING FACT. This scanned the
-   * v1 wide step table for `status = 'healed'`; that table had no producer left and its readers
-   * went with it. `selfHealOccurred` is the bus payload's own boolean, projected verbatim by the
-   * subscriber — so the flake rate below is now computed from what the runner actually reported
-   * rather than from a status word a retired projection wrote.
-   */
+  // Read off `run_steps.self_heal_occurred`, the bus payload's own boolean.
   getHealedRunIds(runIds) {
     if (runIds.length === 0) return /* @__PURE__ */ new Set();
     const placeholders = runIds.map(() => "?").join(", ");
@@ -1522,7 +1430,7 @@ var DashboardDatabase = class {
       passed,
       failed,
       flaky,
-      // 2026-10-18 (444-24, D-59): a group's rate is passed ÷ (passed + failed); neither is no rate.
+      // A group's rate is passed ÷ (passed + failed); neither is no rate.
       passRate: passed + failed > 0 ? passed / (passed + failed) : null,
       flakeRate: totalRuns > 0 ? flaky / totalRuns : 0,
       avgDuration: totalRuns > 0 ? totalDuration / totalRuns : 0
@@ -1584,28 +1492,6 @@ var DashboardDatabase = class {
           FROM run_steps
           WHERE run_id IN (${runIds.map(() => "?").join(",")})
         `).get(...runIds).total_tokens || 0 : 0;
-    const memorySummary = {
-      runs: 0,
-      added: 0,
-      confirmed: 0,
-      deprecated: 0,
-      deleted: 0,
-      curatorTokens: 0
-    };
-    for (const run of runs) {
-      if (!run.memoryLog) continue;
-      memorySummary.runs++;
-      try {
-        const parsed = JSON.parse(run.memoryLog);
-        memorySummary.added += Number(parsed.added ?? 0) || 0;
-        memorySummary.confirmed += Number(parsed.confirmed ?? 0) || 0;
-        memorySummary.deprecated += Number(parsed.deprecated ?? 0) || 0;
-        memorySummary.deleted += Number(parsed.deleted ?? 0) || 0;
-        const tokenUsage = parsed.tokenUsage && typeof parsed.tokenUsage === "object" ? parsed.tokenUsage : {};
-        memorySummary.curatorTokens += Number(tokenUsage.totalTokens ?? 0) || 0;
-      } catch {
-      }
-    }
     return {
       totalRuns: summary.totalRuns,
       passed: summary.passed,
@@ -1614,8 +1500,7 @@ var DashboardDatabase = class {
       flakeRate: summary.flakeRate,
       avgDuration: summary.avgDuration,
       totalTokens,
-      runs: daily,
-      memory: memorySummary
+      runs: daily
     };
   }
   getCostStats(opts = {}) {
@@ -1790,12 +1675,7 @@ var DashboardDatabase = class {
       testRunUnmeasuredSteps: unmeasuredSteps
     };
   }
-  /**
-   * The window's settled run ids, newest first, capped at `limit`, with their full count, and the
-   * count of the window's runs still in flight (433-30, 433-42). A settled run has started and is
-   * neither `pending` nor `running`; every other row in the window is in flight. Ids only: the
-   * Insights knowledge-change read dispatches each through the agent host.
-   */
+  // Settled run ids newest first, capped at `limit`, with the full and in-flight counts.
   listInsightsWindowRunIds(opts) {
     const conditions = [];
     const params = [];
@@ -1951,7 +1831,7 @@ var DashboardDatabase = class {
     const limit = opts.limit ?? 25;
     return rows.slice(0, limit);
   }
-  // 2026-10-17 (444-05, D-35): grouped by member file path; only pass- and fail-class outcomes count.
+  // Grouped by member file path; only pass- and fail-class outcomes count.
   getFlakyTests(opts) {
     const minRuns = opts?.minRuns ?? 3;
     const limit = opts?.limit ?? 50;
@@ -2076,7 +1956,6 @@ var DashboardDatabase = class {
       endedAt: r.ended_at,
       failureSummary: r.failure_summary ?? null,
       errorLog: r.error_log ?? null,
-      memoryLog: r.memory_log ?? null,
       testId: r.test_id ?? null,
       suiteId: r.suite_id ?? null,
       platform: r.platform ?? "web",
@@ -2400,11 +2279,7 @@ function createDashboardRunIngest(deps) {
         ...payload.status === void 0 ? {} : { status: payload.status },
         ...payload.durationMs === void 0 ? {} : { durationMs: payload.durationMs },
         ...payload.error === void 0 ? {} : { error: payload.error },
-        // 2026-08-27 (405 plan 04, D-05/D-06): the producer landed this plan, so the three token
-        // columns 405-01 declared stop being always-NULL. Spread-when-defined, like every other
-        // optional above it — the DB layer writes NULL for all three when the key is absent, and
-        // a NULL row is what makes `runs.detail` able to say "M of K steps unmeasured" instead of
-        // reporting a zero nobody measured.
+        // Spread when defined, so an unmeasured step stays NULL and `runs.detail` counts it so.
         ...payload.tokenUsage === void 0 ? {} : { tokenUsage: payload.tokenUsage },
         ...payload.modelUsage === void 0 ? {} : { modelUsage: payload.modelUsage },
         ...payload.evidence === void 0 ? {} : { evidence: payload.evidence },
@@ -2454,8 +2329,7 @@ function createDashboardRunIngest(deps) {
         stdout: readString(payload.stdout) ?? null,
         stderr: readString(payload.stderr) ?? null,
         variables: payload.variables ?? null,
-        // 405 D-01: where in the run tree this hook ran. Absent stays NULL — a run-scoped hook
-        // is a real state, and inventing handle 0 for it would put a setup hook inside a test.
+        // Absent stays NULL: a run-scoped hook is a real state, not handle 0.
         ...payload.testIndex === void 0 ? {} : { testIndex: payload.testIndex },
         ...payload.stepIndex === void 0 ? {} : { stepIndex: payload.stepIndex }
       });
@@ -2553,6 +2427,7 @@ var import_node_crypto9 = require("node:crypto");
 var import_promises9 = require("node:fs/promises");
 var import_node_path12 = require("node:path");
 var import_node_os3 = require("node:os");
+var import_node_util5 = require("node:util");
 
 // src/server/routes.ts
 var import_node_crypto7 = require("node:crypto");
@@ -2727,7 +2602,7 @@ var TestFileManager = class {
   constructor(workspace) {
     this.workspace = workspace;
   }
-  // 2026-10-18 (444-33, D-65; 444-35, D-66): each list call reads the workspace itself; each file is written whole and one writer at a time.
+  // Each list call reads the workspace itself; each file is written whole, one writer at a time.
   underLock = createPathLock();
   async list() {
     const records = await (0, import_agent_qa_core3.discoverWorkspaceFiles)({ workspace: this.workspace, kind: "test" });
@@ -2891,8 +2766,7 @@ var ConfigManager = class _ConfigManager {
     this.configPath = configPath;
     this.mask = mask;
   }
-  // 441 GAP3-D5: a whole document may keep a marker the file already holds, as often, but never
-  // add one. A missing file holds none.
+  // A whole document may keep a marker the file already holds, as often, but never add one.
   static addsShownMarker(current, next) {
     const held = shownMarkerCounts(current);
     for (const [marker, count] of shownMarkerCounts(next)) {
@@ -2900,13 +2774,13 @@ var ConfigManager = class _ConfigManager {
     }
     return false;
   }
-  // 429-05 Pitfall 3: a half-edited file is named, never served as the partial config yaml recovers.
+  // A half-edited file is named, never served as the partial config yaml recovers.
   async readWithRevision() {
     const read = await this.readParsed();
     if (read.kind !== "ok") return read;
     return { kind: "ok", config: read.config, raw: read.raw, revision: read.revision };
   }
-  // 441-21 D-29: the payload and the file view pass through the declared mask and nothing else.
+  // The payload and the file view pass through the declared mask and nothing else.
   async readMasked() {
     const read = await this.readParsed();
     if (read.kind === "absent") {
@@ -2950,8 +2824,7 @@ var ConfigManager = class _ConfigManager {
       revision
     };
   }
-  // 429-01 D-19/D-22: one transaction per request, serialised so overlapping autosaves never
-  // read the same bytes and drop each other's field.
+  // One transaction per request, serialised so overlapping autosaves never drop each other's field.
   async applyChanges(changes, options = {}) {
     const marked = changeWithShownMarker(changes);
     if (marked !== void 0) {
@@ -2966,13 +2839,11 @@ var ConfigManager = class _ConfigManager {
     }
     return this.serialized(() => this.applyChangesOnce(changes, options.capturePriors === true));
   }
-  // 429-11 D-24: an Undo is one more transaction on the same mutex, newest change first. A field
-  // that no longer holds what the change left there was written since, and is never overwritten.
+  // An Undo restores newest first; a field written after the change is never overwritten.
   async restorePriors(priors) {
     return this.serialized(() => this.restorePriorsOnce(priors));
   }
-  // 432-07 D-05: a generated whole-file change (a scaffold, a hooks file) publishes only over the
-  // bytes it was built from, read again in this path's turn. Anything else is somebody's edit.
+  // A generated whole-file change publishes only over the bytes it is built from, re-read in turn.
   async replaceDocument(expectedRevision, content) {
     return this.serialized(async () => {
       let current;
@@ -3099,8 +2970,7 @@ var ConfigManager = class _ConfigManager {
     await this.writeAtomic(next);
     return capturePriors ? { kind: "ok", revision: revisionOf(next), baseRevision, priors } : { kind: "ok", revision: revisionOf(next), baseRevision };
   }
-  // 429-05 Pitfall 8 / Pattern 1 step 6: the temp file sits beside the real file, keeps its mode
-  // (chmod, because writeFile's mode is filtered by the umask), and replaces it in one rename.
+  // The temp file sits beside the real one and is chmodded, as the umask filters `writeFile` modes.
   async writeAtomic(content) {
     const target = await this.writeTarget();
     const directory = (0, import_node_path5.dirname)(target);
@@ -4300,6 +4170,12 @@ var HookRegistryManager = class {
 
 // src/server/body-parser.ts
 var DEFAULT_MAX_BYTES = 1024 * 1024;
+function carriesNonJsonBody(req) {
+  const hasBody = req.headers["transfer-encoding"] !== void 0 || Number(req.headers["content-length"] ?? "0") > 0;
+  if (!hasBody) return false;
+  const type = req.headers["content-type"];
+  return type === void 0 || type.split(";", 1)[0].trim().toLowerCase() !== "application/json";
+}
 function readJsonBody(req, maxBytes = DEFAULT_MAX_BYTES) {
   return new Promise((resolve7, reject) => {
     const chunks = [];
@@ -4334,6 +4210,7 @@ function readJsonBody(req, maxBytes = DEFAULT_MAX_BYTES) {
 // src/live-editor/live-session.ts
 var import_node_crypto6 = require("node:crypto");
 var import_node_path9 = require("node:path");
+var import_node_util3 = require("node:util");
 var import_agent_qa_core8 = require("@vostride/agent-qa-core");
 var import_agent_qa_runner = require("@vostride/agent-qa-runner");
 var import_agent_qa_runner_local = require("@vostride/agent-qa-runner-local");
@@ -4421,12 +4298,10 @@ async function loadLocalBindings(configPath) {
   try {
     const content = await (0, import_promises6.readFile)(filePath, "utf-8");
     const parsed = (0, import_yaml5.parse)(content);
-    return parsed && typeof parsed === "object" ? {
-      devices: parsed.devices,
-      providers: parsed.providers,
-      apps: parsed.apps,
-      filePath
-    } : { filePath };
+    (0, import_agent_qa_core7.refuseRetiredLocalBindings)(parsed, filePath);
+    if (!parsed || typeof parsed !== "object") return { filePath };
+    const bindings = parsed;
+    return { devices: bindings.devices, apps: bindings.apps, filePath };
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -4516,44 +4391,15 @@ async function prepareMobileLiveSession(input) {
       appActivity: resolved.app.appActivity,
       deepLinkAppId: resolved.app.deepLinkAppId,
       appPath: resolved.app.install?.path,
-      browserstackApp: resolved.app.install?.browserstack,
       appState: resolved.appState
     }
   };
 }
 
 // src/live-editor/live-session.ts
-var LiveProductionRefusedError = class extends Error {
-  productionTargetNames;
-  constructor(productionTargetNames) {
-    super((0, import_agent_qa_schema3.buildProductionRefusal)(productionTargetNames));
-    this.name = "LiveProductionRefusedError";
-    this.productionTargetNames = (0, import_agent_qa_schema3.distinctInFirstOccurrenceOrder)(productionTargetNames);
-  }
-};
 function isConfigRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function liveTargetName(targetName) {
-  if (typeof targetName !== "string") return void 0;
-  const trimmed = targetName.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-async function resolveLiveTargetProduction(configManager, targetName) {
-  const name = liveTargetName(targetName);
-  if (name === void 0 || configManager === void 0) {
-    return { productionTargetNames: [], allowProduction: false };
-  }
-  const config = await readConfigValues(configManager);
-  const registry = isConfigRecord(config.registry) ? config.registry : void 0;
-  const targets = registry !== void 0 && isConfigRecord(registry.targets) ? registry.targets : void 0;
-  const declared = targets !== void 0 && Object.hasOwn(targets, name) ? targets[name] : void 0;
-  const production = isConfigRecord(declared) && declared.environment === "production";
-  return {
-    productionTargetNames: production ? [name] : [],
-    allowProduction: config.allowProduction === true
-  };
-}
 async function readEntityUse(entity, readers) {
   if (entity === void 0) return void 0;
   const find = entity.type === "suite" ? readers.findSuite : readers.findTest;
@@ -4573,6 +4419,12 @@ var LivePlannerLimitsRefusedError = class extends Error {
     this.name = "LivePlannerLimitsRefusedError";
   }
 };
+var LiveNavigationTimeoutRefusedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "LiveNavigationTimeoutRefusedError";
+  }
+};
 var LIVE_LIMIT_LEAVES = ["maxActions", "maxPlanningTurns"];
 function shownLimitValue(value) {
   return typeof value === "number" ? String(value) : JSON.stringify(value) ?? String(value);
@@ -4621,9 +4473,30 @@ async function resolveLivePlannerLimits(configManager, entities, readers) {
   }
   return (0, import_agent_qa_schema3.resolvePlannerLimits)(config.use, ...uses);
 }
-function liveProductionRefusal(found) {
-  if (found.productionTargetNames.length === 0 || found.allowProduction) return void 0;
-  return new LiveProductionRefusedError(found.productionTargetNames);
+async function resolveLiveNavigationTimeoutMs(configManager, entities, readers) {
+  const config = configManager === void 0 ? {} : await readConfigValues(configManager);
+  const layers = [
+    { layer: "project config", use: config.use }
+  ];
+  for (const entity of [].concat(entities ?? [])) {
+    const use = await readEntityUse(entity, readers);
+    layers.push({ layer: `${entity.type} file ${entity.id}`, use });
+  }
+  let navigation;
+  for (const { layer, use } of layers) {
+    if (!isConfigRecord(use) || !isConfigRecord(use.timeout)) continue;
+    if (!Object.hasOwn(use.timeout, "navigation")) continue;
+    const value = use.timeout.navigation;
+    const parsed = import_agent_qa_core8.TimeoutConfigSchema.shape.navigation.safeParse(value);
+    if (!parsed.success) {
+      const issue = parsed.error.issues[0]?.message ?? "invalid value";
+      throw new LiveNavigationTimeoutRefusedError(
+        `${layer} sets use.timeout.navigation to ${shownLimitValue(value)}: ${issue}. The CLI refuses this file too.`
+      );
+    }
+    navigation = parsed.data;
+  }
+  return navigation;
 }
 var IDLE_TIMEOUT_MS = 5 * 60 * 1e3;
 var LIVE_HUB_CLOSE_LIMIT_MS = 2e3;
@@ -4759,8 +4632,7 @@ var LiveSession = class {
   planner = null;
   verifier = null;
   modelProfiles = null;
-  // D-14 (Phase 360): the run-scoped storage-state store, constructed lazily on first use and
-  // rooted at the session's `.agent-qa` runtime dir (the FsStorageStateStore rooting idiom).
+  // Built lazily on first use, rooted at the session's `.agent-qa` runtime dir.
   storageStateStore = null;
   model = null;
   variableStore = null;
@@ -4788,15 +4660,14 @@ var LiveSession = class {
   mobileAppiumLease = null;
   secretStore;
   secretRedactor;
-  // 428 D-07: one hub per session, handle 0, created once the adapter exists. A session whose
-  // setup hooks failed has no adapter and therefore no hub; its subject declares `none`.
+  // One hub per session at handle 0, created once the adapter exists; no adapter means no hub.
   liveHub = null;
   attachment = null;
   resolveEnded = () => {
   };
   ended;
   cleanupRun = null;
-  // RESEARCH P4: which control socket is the current one. Only its close may detach the session.
+  // Which control socket is the current one; only its close may detach the session.
   attachmentGeneration = 0;
   releaseAttachment = null;
   get modelName() {
@@ -4818,11 +4689,7 @@ var LiveSession = class {
     hub.register(0, registration?.capability, registration?.fallback);
     this.liveHub = hub;
   }
-  /**
-   * Make a control socket the current one. `release` is how the session lets go of it later: the
-   * previous attachment's is called with `superseded` here (428 WR-01), so one socket drives the
-   * session at a time.
-   */
+  // The previous attachment's `release` gets `superseded`, so one socket drives the session.
   beginAttachment(release) {
     const previous = this.releaseAttachment;
     this.attachmentGeneration += 1;
@@ -4841,11 +4708,7 @@ var LiveSession = class {
     }
     this.pendingMessages = [];
   }
-  /**
-   * A command's reply, for whichever control socket is attached now (428 CR-01). A command can
-   * outlive the socket that issued it, and its outcome belongs to the page, not to that socket:
-   * with none attached it is held and flushed to the next one.
-   */
+  // A reply can outlive its socket, so it goes to the current socket or waits for the next one.
   deliver(message) {
     if (this.messageSink) {
       this.messageSink(message);
@@ -4956,7 +4819,7 @@ var LiveSession = class {
         continue;
       }
       const result = await (0, import_agent_qa_runner.runHooks)([hookDef], {
-        executor: new import_agent_qa_runner_local.DockerHookExecutor(),
+        executor: new import_agent_qa_runner_local.DockerHookExecutor({ version: (0, import_agent_qa_core8.getAgentQaVersion)() }),
         env: this.getHookEnvVars(),
         secretStore: this.secretStore,
         secretRedactor: this.secretRedactor
@@ -5030,7 +4893,6 @@ var LiveSession = class {
       device: config.device ? {
         name: config.device.name,
         platform,
-        transport: "local",
         match: config.device
       } : void 0
     };
@@ -5095,15 +4957,6 @@ var LiveSession = class {
     }
   }
   async initialize(config) {
-    const found = await resolveLiveTargetProduction(this.deps.configManager, config.targetName);
-    const refusal = liveProductionRefusal({
-      productionTargetNames: (0, import_agent_qa_schema3.distinctInFirstOccurrenceOrder)([
-        ...config.production?.productionTargetNames ?? [],
-        ...found.productionTargetNames
-      ]),
-      allowProduction: found.allowProduction
-    });
-    if (refusal !== void 0) throw refusal;
     this.platform = config.platform;
     this.targetName = typeof config.targetName === "string" && config.targetName.trim().length > 0 ? config.targetName.trim() : null;
     this._modelName = config.llmConfig.model ?? "unknown";
@@ -5138,7 +4991,11 @@ var LiveSession = class {
     } else {
       const { WebPlatformAdapter } = await import("@vostride/agent-qa-web");
       const adapter = new WebPlatformAdapter();
-      await adapter.setup({ platform: "web", browser: { name: "chromium", headless: config.headless ?? true } });
+      await adapter.setup({
+        platform: "web",
+        browser: { name: "chromium", headless: config.headless ?? true },
+        ...config.navigationTimeoutMs === void 0 ? {} : { timeouts: { navigation: config.navigationTimeoutMs } }
+      });
       this.adapter = adapter;
       if (config.url) {
         const resolvedUrl = this.resolveSecrets(config.url);
@@ -5200,7 +5057,7 @@ var LiveSession = class {
         }
         const startedAt = performance.now();
         try {
-          const result = await new import_agent_qa_runner_local.DockerHookExecutor().execute(hookDef, {
+          const result = await new import_agent_qa_runner_local.DockerHookExecutor({ version: (0, import_agent_qa_core8.getAgentQaVersion)() }).execute(hookDef, {
             env: this.getHookEnvVars(),
             secretEnv: (0, import_agent_qa_runner.resolveSecretEnv)(this.secretStore),
             secretRedactor: this.secretRedactor
@@ -5367,12 +5224,7 @@ var LiveSession = class {
     };
     return this.redact(result);
   }
-  // Inner step execution — no gating. Callers must own the executing/status
-  // lifecycle (executeStepCommand for single steps, executeTestCommand for
-  // the per-test loop that runs many steps under one outer gate).
-  // D-14 (Phase 360): lazily construct the run-scoped storage-state store, rooted at the session's
-  // `.agent-qa` runtime dir. All fs writes live in runner-local (validate:arch storageNeutral);
-  // the loop records only { name, fingerprint }. Absent configPath falls back to the cwd root.
+  // Lazily built and rooted at the session's `.agent-qa` dir; fs writes stay in runner-local.
   async getStorageStateStore() {
     let store = this.storageStateStore;
     if (!store) {
@@ -5511,7 +5363,9 @@ ${errorLines.join("\n")}`;
         testLimits = this.plannerLimitsForTest !== void 0 && testDraft.testId.length > 0 ? await this.plannerLimitsForTest(testDraft.testId) : this.plannerLimits ?? (0, import_agent_qa_schema3.resolvePlannerLimits)();
       } catch (error) {
         if (!(error instanceof LivePlannerLimitsRefusedError)) throw error;
-        console.warn(`[live-session] executeTestCommand: ${error.message}`, { testName: testDraft.testName });
+        const line = `[live-session] executeTestCommand: ${error.message}`;
+        const detail = { testName: testDraft.testName };
+        (0, import_agent_qa_core8.printRunText)((0, import_node_util3.format)(line, detail), () => console.warn(line, detail));
         return this.redact({
           status: "failed",
           duration: performance.now() - start,
@@ -5531,11 +5385,13 @@ ${errorLines.join("\n")}`;
       if (!setupResult.allPassed) {
         const failedHook = setupHookPayloads.find((h) => h.status === "failed");
         const detail = failedHook ? `Setup hook "${failedHook.hookName}" failed${failedHook.error ? `: ${failedHook.error}` : ""}${failedHook.stderr ? ` \u2014 ${failedHook.stderr.split("\n")[0].slice(0, 200)}` : ""}` : "Per-test setup hook failed";
-        console.warn(`[live-session] executeTestCommand: ${detail}`, {
+        const line = `[live-session] executeTestCommand: ${detail}`;
+        const context = {
           testName: testDraft.testName,
           setupHooks: testDraft.setup,
           failedHook: failedHook ? { name: failedHook.hookName, stderr: failedHook.stderr, error: failedHook.error } : null
-        });
+        };
+        (0, import_agent_qa_core8.printRunText)((0, import_node_util3.format)(line, context), () => console.warn(line, context));
         return {
           status: "failed",
           duration: performance.now() - start,
@@ -5613,7 +5469,9 @@ ${errorLines.join("\n")}`;
         topLevelError = failedHook ? `Teardown hook "${failedHook.hookName}" failed${failedHook.error ? `: ${failedHook.error}` : ""}` : "Teardown hook failed";
       }
       if (topLevelError) {
-        console.warn(`[live-session] executeTestCommand: ${topLevelError}`, { testName: testDraft.testName });
+        const line = `[live-session] executeTestCommand: ${topLevelError}`;
+        const detail = { testName: testDraft.testName };
+        (0, import_agent_qa_core8.printRunText)((0, import_node_util3.format)(line, detail), () => console.warn(line, detail));
       }
       return this.redact({
         status: finalStatus,
@@ -5629,10 +5487,7 @@ ${errorLines.join("\n")}`;
       this.status = "idle";
     }
   }
-  // Thin wrapper around runLifecycleHooks that also captures the dispatched
-  // hook payloads (hook-complete) for inclusion in the LiveTestResultPayload.
-  // The capture sits beside the message sink rather than wrapping it, so a
-  // control socket that reattaches mid-hook keeps its sink (428 CR-01).
+  // Captures dispatched hook payloads beside the message sink, so a reattached socket keeps it.
   async runLifecycleHooksCapturing(phase, hookIds, sink, owner = { scope: "suite" }) {
     this.hookCaptures.add(sink);
     try {
@@ -5876,6 +5731,21 @@ function refuseUnparseableRequest(res) {
   });
   res.end(body);
 }
+function refuseForeignHostPage(res, port) {
+  if (res.headersSent) {
+    res.destroy();
+    return;
+  }
+  const p = String(port);
+  const body = `The agent-qa dashboard answers only at localhost, 127.0.0.1 or [::1].
+Open http://localhost:${p}/ on the machine it runs on, or forward the port with ssh -L ${p}:localhost:${p} <host>.
+`;
+  res.writeHead(403, {
+    "Content-Type": "text/plain; charset=utf-8",
+    "Content-Length": Buffer.byteLength(body)
+  });
+  res.end(body);
+}
 function backstopServerError(res, req, error) {
   const kind = error instanceof Error ? error.constructor.name : typeof error;
   console.error(
@@ -5955,10 +5825,6 @@ function respondJson(res, status, data) {
   res.end(body);
 }
 function serveRunEvidenceRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req)) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   const query = new URL(req.url ?? "/", "http://localhost").searchParams;
   const entries = [["runId", deps.runId]];
   const seen = /* @__PURE__ */ new Set(["runId"]);
@@ -6000,10 +5866,6 @@ function respondFeedbackRead(res, deps, functionId, input, parse) {
   });
 }
 function serveRunMarksHistoryRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   if (new URL(req.url ?? "/", "http://localhost").search !== "") {
     respondJson(res, 400, { error: "invalid_marks_input" });
     return;
@@ -6022,10 +5884,6 @@ function serveRunMarksHistoryRead(req, res, deps) {
   );
 }
 function serveRunMarkPreviewRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then((body) => {
     const parsed = import_agent_qa_schema4.RunsMarkInputSchema.safeParse(body);
     if (!parsed.success) {
@@ -6048,10 +5906,6 @@ function serveRunMarkPreviewRead(req, res, deps) {
   });
 }
 function serveRunDetailRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readRunDetail(deps.host, deps.runId).then(
     (outcome) => {
       if (outcome.kind === "refused") {
@@ -6201,10 +6055,6 @@ async function readRunAnalysis(host, runId) {
   }
 }
 function serveRunAnalysisRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readRunAnalysis(deps.host, deps.runId).then(
     (outcome) => {
       if (outcome.kind === "refused") {
@@ -6428,10 +6278,7 @@ function serveRunEventStream(req, res, deps) {
     else pending.push(frame);
   };
   const frameOf = (event) => (
-    // D-13, all three parts: the id IS the seq, the event name IS the envelope type, and the
-    // data IS the envelope's own JSON. No projection, no rename, no second vocabulary. The filter
-    // DROPS envelopes; it never edits one, so a filtered stream's frames are byte-identical to the
-    // firehose's — with gaps in the ids, which is what seq-as-id means once a filter exists.
+    // The filter drops envelopes and never edits one, so filtered frames match the firehose bytes.
     `id: ${String(event.seq)}
 event: ${event.type}
 data: ${JSON.stringify(event)}
@@ -6493,12 +6340,6 @@ data: ${JSON.stringify(event)}
   deps.openStreams?.add(teardown);
   req.on("close", teardown);
 }
-function runDenialOf(error) {
-  if (typeof error !== "object" || error === null) return void 0;
-  const neutralReason = error.neutralReason;
-  if (typeof neutralReason !== "string" || neutralReason.trim().length === 0) return void 0;
-  return { error: "run_denied", neutralReason };
-}
 function createRunServiceRoutes(ports) {
   const openStreams = /* @__PURE__ */ new Set();
   function handleStart(req, res) {
@@ -6529,12 +6370,7 @@ function createRunServiceRoutes(ports) {
         ack = await ports.invokeRunStart(
           parsed.data.patterns === void 0 ? {} : { patterns: parsed.data.patterns }
         );
-      } catch (error) {
-        const denial = runDenialOf(error);
-        if (denial !== void 0) {
-          respondJson2(res, 403, denial);
-          return;
-        }
+      } catch {
         refuse(res, 500, "run_start_failed");
         return;
       }
@@ -6614,6 +6450,10 @@ function createRunServiceRoutes(ports) {
         refuse(res, 403, "cross_site_refused");
         return;
       }
+      if (carriesNonJsonBody(req)) {
+        refuse(res, 415, "unsupported_media_type");
+        return;
+      }
       const matched = matchRunServiceRoute(req.method, path);
       if (matched === void 0) {
         refuse(res, 404, "unknown_route");
@@ -6879,8 +6719,7 @@ data: ${JSON.stringify(again.body)}
         // A failed re-read is not a reason to close a live channel: the next envelope will trigger
         // another, and the page's own poll is the floor underneath both.
         () => void 0
-        // …but a throw from the arm ABOVE is not a failed re-read, it is a dead socket, and `.then`'s
-        // failure arm never sees its own fulfilment arm's throw (UF-01, on the nested chain).
+        // A throw from the arm above is a dead socket, and `.then`'s failure arm never sees it.
       ).catch(failStream);
     });
     heartbeat = setInterval(() => {
@@ -6917,10 +6756,6 @@ async function readRunKnowledge(host, runId) {
   }
 }
 function serveRunKnowledgeRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readRunKnowledge(deps.host, deps.runId).then(
     (outcome) => {
       if (outcome.kind === "refused") {
@@ -6961,10 +6796,6 @@ async function markRun(host, runId, body) {
   }
 }
 function registerRunMarkRoute(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const outcome = await markRun(deps.host, deps.runId, body);
     if (outcome.kind === "refused") {
@@ -6982,10 +6813,6 @@ function registerRunMarkRoute(req, res, deps) {
 // src/server/config-routes.ts
 var import_agent_qa_schema10 = require("@vostride/agent-qa-schema");
 function registerConfigWriteRoute(req, res, deps) {
-  if (refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const parsed = import_agent_qa_schema10.ConfigWriteRequestSchema.safeParse(body);
     if (!parsed.success) {
@@ -7043,10 +6870,6 @@ function registerConfigUndoRoute(req, res, deps) {
     respondJson(res, 405, { error: "method_not_allowed" });
     return;
   }
-  if (refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const parsed = import_agent_qa_schema10.ConfigUndoRequestSchema.safeParse(body);
     if (!parsed.success) {
@@ -7276,10 +7099,6 @@ async function connectName(request2, deps) {
   });
 }
 function registerLlmConnectRoute(req, res, deps) {
-  if (refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const answer = await connectLlm(body, deps);
     respondJson(res, answer.status, answer.body);
@@ -7601,25 +7420,10 @@ function llmConnectionTestTimeoutMs(config) {
   return REMOTE_LLM_CONNECTION_TEST_TIMEOUT_MS;
 }
 function json(res, data, status = 200) {
-  const body = JSON.stringify(data);
-  res.writeHead(status, {
-    "Content-Type": "application/json",
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type"
-  });
-  res.end(body);
-}
-function jsonNoCors(res, data, status = 200) {
   const body = JSON.stringify(data);
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(body);
 }
-function refuseCrossSiteDisplayRead(req, res) {
-  if (refuseCrossSiteRequest(req) === void 0) return false;
-  jsonNoCors(res, { error: "cross_site_refused" }, 403);
-  return true;
-}
 var INSIGHTS_KNOWLEDGE_RUN_CAP = 200;
 var INSIGHTS_KNOWLEDGE_CONCURRENCY = 4;
 async function isPostProcessingSkipped(host, runId) {
@@ -7683,14 +7487,6 @@ async function readInsightsKnowledgeChanges(host, db, window) {
 function notFound(res, message = "Not found") {
   json(res, { error: message }, 404);
 }
-function cors(res) {
-  res.writeHead(204, {
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type"
-  });
-  res.end();
-}
 function isPlainRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -7743,7 +7539,7 @@ function normalizeRunFilterValue(value) {
 function buildRunRequestAttributes(input) {
   const internal = (0, import_agent_qa_core11.buildInternalRunAttributes)({
     trigger: input.trigger,
-    runner: input.runner ?? "local"
+    runner: "local"
   });
   const user = (0, import_agent_qa_core11.validateUserRunAttributes)(input.userAttributes, "run attributes");
   return (0, import_agent_qa_core11.mergeRunAttributes)(internal, user);
@@ -8188,9 +7984,7 @@ var RESPONSE_SAFE_RUN_METADATA_KEYS = /* @__PURE__ */ new Set([
   "timeoutSource",
   "timeoutBaseMs",
   "timeoutBufferMs",
-  "suiteIndex",
-  "farmSessionUrl",
-  "runDevice"
+  "suiteIndex"
 ]);
 function sanitizeRunMetadataForResponse(metadata) {
   if (metadata === null || metadata === void 0) return metadata ?? null;
@@ -8220,17 +8014,7 @@ var RESPONSE_SAFE_RUN_READ_METHODS = [
   "getRunsByTest"
 ];
 var RUN_READS_WITHOUT_ROWS = /* @__PURE__ */ new Set([
-  // 2026-08-27 (405-01, D-01/D-03): the v2 projection's six members.
-  //
-  // The five WRITES return nothing; they are here for the same reason `insertRun` is.
-  //
-  // `readRunDetailRows` IS A READ AND IS STILL HERE, and that is the judgement this set exists to
-  // make explicit rather than to hide. It returns members, steps and sub-actions — the bus
-  // payloads as the subscriber MASKED them (T-363-05) — and NO `RunRow` and no
-  // `RunArtifactRow`. It therefore carries none of the run metadata the 401-23 scrub law exists
-  // to strip, so wrapping it would be wrapping a shape that has nothing to strip. This router
-  // does not call it either: the detail arm dispatches through the injected host, which is the
-  // whole of D-03.
+  // `readRunDetailRows` returns masked bus payloads and no run row, so it has no metadata to strip.
   "deleteMemberProjection",
   "incrementRunMemberAttempts",
   "insertRunStep",
@@ -8241,23 +8025,23 @@ var RUN_READS_WITHOUT_ROWS = /* @__PURE__ */ new Set([
   "finalizeRunArtifact",
   "getRunsBySuiteIdCount",
   "getRunsByTestCount",
-  // 433-30: run ids and a count, no row; each id is dispatched through the agent host.
+  // Run ids and a count, no row; each id is dispatched through the agent host.
   "listInsightsWindowRunIds",
   "insertPendingRun",
   "insertRun",
   "insertRunArtifact",
   "listRunAttributeKeys",
   "listRunAttributeValues",
-  // 2026-10-16 (442-01, D-01): an owner (pid, incarnation, host), no run metadata.
+  // An owner (pid, incarnation, host), no run metadata.
   "readRunOwner",
-  // 2026-10-16 (442-01, D-04): ids and owners only, no run metadata.
+  // Ids and owners only, no run metadata.
   "listRunningRunOwners",
-  // 2026-10-16 (442-01, D-04): compare-and-set writes that return a boolean.
+  // Compare-and-set writes that return a boolean.
   "finalizeOrphanRun",
   "finalizeOwnRun",
-  // 2026-10-17 (443-13, GAP-D1): a compare-and-set write that returns a boolean, no run metadata.
+  // A compare-and-set write that returns a boolean, no run metadata.
   "closeOwnRun",
-  // 2026-10-17 (443-02, D-07): a compare-and-set write that returns a boolean, no run metadata.
+  // A compare-and-set write that returns a boolean, no run metadata.
   "claimRunningRow",
   "stageRunArtifact",
   "updateRun",
@@ -8328,10 +8112,7 @@ function withResponseSafeRunReads(db) {
     // `sanitizeArtifactForResponse`; a caller reaching for the bare row has no such step, so the
     // projection is its only choke point. Same allowlist, so the two cannot drift.
     getRunArtifact: { value: (runId) => scrubArtifact(db.getRunArtifact(runId)) },
-    // 405-07 (D-02): the bundle is ONE artifact now. It used to carry the child runs of a suite
-    // parent, whose `run` rows this override scrubbed; nothing has written a child row since
-    // 402-09, and the shape went with the column. `getRunArtifact` above remains the choke point
-    // for the payload itself, and this wrapper delegates to it.
+    // One artifact; `getRunArtifact` is the choke point for its payload, and this delegates to it.
     getRunArtifactBundle: {
       value: (runId) => ({ artifact: scrubArtifact(db.getRunArtifactBundle(runId).artifact) })
     }
@@ -8479,10 +8260,18 @@ function createRouter(dbOrDeps) {
       json(res, { error: "Bad Request" }, 400);
       return;
     }
+    if (refuseCrossSiteRequest(req) !== void 0) {
+      json(res, { error: "cross_site_refused" }, 403);
+      return;
+    }
+    if (carriesNonJsonBody(req)) {
+      json(res, { error: "unsupported_media_type" }, 415);
+      return;
+    }
     const path = url.pathname;
     if (path === "/api/config" && req.method === "PATCH") {
       if (!configManager) {
-        jsonNoCors(res, { error: "config_unavailable" }, 503);
+        json(res, { error: "config_unavailable" }, 503);
         return;
       }
       registerConfigWriteRoute(req, res, { configManager, undoStore });
@@ -8502,7 +8291,7 @@ function createRouter(dbOrDeps) {
     }
     if (path === "/api/config/revision" && req.method === "GET") {
       if (!configManager) {
-        jsonNoCors(res, { error: "config_unavailable" }, 503);
+        json(res, { error: "config_unavailable" }, 503);
         return;
       }
       registerConfigRevisionRoute(req, res, { configManager });
@@ -8510,7 +8299,7 @@ function createRouter(dbOrDeps) {
     }
     if (path === "/api/llm/connect" && req.method === "POST") {
       if (!configManager) {
-        jsonNoCors(res, { error: "config_unavailable" }, 503);
+        json(res, { error: "config_unavailable" }, 503);
         return;
       }
       registerLlmConnectRoute(req, res, {
@@ -8522,16 +8311,6 @@ function createRouter(dbOrDeps) {
       });
       return;
     }
-    if (path === "/api/runs/trigger" || path === "/api/queue/enqueue") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
-    }
-    if (req.method === "OPTIONS") {
-      cors(res);
-      return;
-    }
     if (path === "/api/auth-states" && req.method === "GET") {
       if (!configManager || !deps.configPath) {
         json(res, { error: "Auth-state metadata not available" }, 503);
@@ -8555,11 +8334,10 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/runs" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const statuses = url.searchParams.getAll("status");
       const unknownStatus = statuses.find((word) => !isRunStatusWord(word));
       if (unknownStatus !== void 0) {
-        jsonNoCors(res, { error: `Unknown run status: ${unknownStatus}.` }, 400);
+        json(res, { error: `Unknown run status: ${unknownStatus}.` }, 400);
         return;
       }
       const name = url.searchParams.get("name") ?? void 0;
@@ -8591,12 +8369,12 @@ function createRouter(dbOrDeps) {
         )).sort((a, b) => a.localeCompare(b));
         const filtered = platformFilteredRuns.filter((run) => matchesTargetFilter(run, target));
         const runs = filtered.slice(offset, offset + limit);
-        jsonNoCors(res, {
+        json(res, {
           runs,
           total: filtered.length,
           targets: targetOptions
         });
-      }).catch(() => jsonNoCors(res, { error: "Failed to list runs" }, 500));
+      }).catch(() => json(res, { error: "Failed to list runs" }, 500));
       return;
     }
     if (path === "/api/runs/attributes/keys" && req.method === "GET") {
@@ -8634,7 +8412,6 @@ function createRouter(dbOrDeps) {
     }
     const runArtifactMatch = path.match(/^\/api\/runs\/([^/]+)\/artifact$/);
     if (runArtifactMatch && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const runId = decodeURIComponent(runArtifactMatch[1]);
       const run = db.getRun(runId);
       if (!run) {
@@ -8642,7 +8419,7 @@ function createRouter(dbOrDeps) {
         return;
       }
       const bundle = db.getRunArtifactBundle(runId);
-      jsonNoCors(res, {
+      json(res, {
         run,
         artifact: sanitizeArtifactForResponse(bundle.artifact),
         missingSections: getArtifactMissingSections(bundle.artifact)
@@ -8650,7 +8427,6 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/execution-logs") && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const segments = path.split("/");
       const id = segments[3];
       const run = db.getRun(id);
@@ -8661,37 +8437,37 @@ function createRouter(dbOrDeps) {
       const stepId = url.searchParams.get("stepId") ?? void 0;
       const type = url.searchParams.get("type") ?? void 0;
       const logs = db.getExecutionLogs({ runId: id, stepId, type });
-      jsonNoCors(res, { logs });
+      json(res, { logs });
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/mark") && req.method === "POST") {
       if (deps.agentHost === void 0) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/mark".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_mark_input" }, 400);
+        json(res, { error: "invalid_mark_input" }, 400);
         return;
       }
-      registerRunMarkRoute(req, res, { host: deps.agentHost, runId, boundary: "human" });
+      registerRunMarkRoute(req, res, { host: deps.agentHost, runId });
       return;
     }
     if (req.method === "POST" && /^\/api\/runs\/[^/]+\/mark-preview$/.test(path)) {
       if (deps.agentHost === void 0) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/mark-preview".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_run_id" }, 400);
+        json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunMarkPreviewRead(req, res, { runId, host: deps.agentHost, boundary: "human" });
+      serveRunMarkPreviewRead(req, res, { runId, host: deps.agentHost });
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/cancel") && req.method === "POST") {
@@ -8770,44 +8546,39 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/live-url$/.test(path)) {
-      const crossSite = refuseCrossSiteRequest(req);
-      if (crossSite !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       if (!deps.mintLiveUrl) {
-        jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+        json(res, { error: "live_view_unavailable" }, 503);
         return;
       }
       let liveUrlRunId;
       try {
         liveUrlRunId = decodeURIComponent(path.slice("/api/runs/".length, -"/live-url".length));
       } catch {
-        jsonNoCors(res, { error: "unknown_run" }, 404);
+        json(res, { error: "unknown_run" }, 404);
         return;
       }
       const rawHandle = handleParamOf(req);
       const parsedHandle = (0, import_agent_qa_schema12.parseHandleParam)(rawHandle);
       if (parsedHandle.kind === "invalid") {
-        jsonNoCors(res, { error: "invalid_handle" }, 400);
+        json(res, { error: "invalid_handle" }, 400);
         return;
       }
       const handle = parsedHandle.kind === "absent" ? 0 : parsedHandle.index;
       void deps.mintLiveUrl(liveUrlRunId, handle).then(
         (result) => {
-          jsonNoCors(res, result);
+          json(res, result);
         },
         (error) => {
           const name = error instanceof Error ? error.name : "";
           if (name === "UnknownRunError") {
-            jsonNoCors(res, { error: "unknown_run" }, 404);
+            json(res, { error: "unknown_run" }, 404);
             return;
           }
           if (name === "LiveViewUnavailableError") {
-            jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+            json(res, { error: "live_view_unavailable" }, 503);
             return;
           }
-          jsonNoCors(res, { error: "live_url_mint_failed" }, 500);
+          json(res, { error: "live_url_mint_failed" }, 500);
         }
       );
       return;
@@ -8836,32 +8607,32 @@ function createRouter(dbOrDeps) {
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/evidence$/.test(path)) {
       if (!deps.agentHost) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/evidence".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_run_id" }, 400);
+        json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunEvidenceRead(req, res, { runId, host: deps.agentHost, boundary: "human" });
+      serveRunEvidenceRead(req, res, { runId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/marks$/.test(path)) {
       if (!deps.agentHost) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/marks".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_run_id" }, 400);
+        json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunMarksHistoryRead(req, res, { runId, host: deps.agentHost, boundary: "human" });
+      serveRunMarksHistoryRead(req, res, { runId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/detail$/.test(path)) {
@@ -8876,7 +8647,7 @@ function createRouter(dbOrDeps) {
         json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunDetailRead(req, res, { runId: detailRunId, host: deps.agentHost, boundary: "human" });
+      serveRunDetailRead(req, res, { runId: detailRunId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/analysis$/.test(path)) {
@@ -8891,7 +8662,7 @@ function createRouter(dbOrDeps) {
         json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunAnalysisRead(req, res, { runId: analysisRunId, host: deps.agentHost, boundary: "human" });
+      serveRunAnalysisRead(req, res, { runId: analysisRunId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/knowledge$/.test(path)) {
@@ -8908,8 +8679,7 @@ function createRouter(dbOrDeps) {
       }
       serveRunKnowledgeRead(req, res, {
         runId: knowledgeRunId,
-        host: deps.agentHost,
-        boundary: "human"
+        host: deps.agentHost
       });
       return;
     }
@@ -8959,14 +8729,13 @@ function createRouter(dbOrDeps) {
         notFound(res);
         return;
       }
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const id = segments[3];
       const run = db.getRun(id);
       if (!run) {
         notFound(res, "Run not found");
         return;
       }
-      jsonNoCors(res, { run });
+      json(res, { run });
       return;
     }
     if (path === "/api/stats/costs" && req.method === "GET") {
@@ -8977,19 +8746,18 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/insights/knowledge-changes" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!deps.agentHost) {
-        jsonNoCors(res, { status: "unavailable", reason: "agent_host_unavailable" }, 503);
+        json(res, { status: "unavailable", reason: "agent_host_unavailable" }, 503);
         return;
       }
       const from = url.searchParams.get("from") ?? void 0;
       const to = url.searchParams.get("to") ?? void 0;
       void readInsightsKnowledgeChanges(deps.agentHost, db, { from, to }).then(
         (body) => {
-          jsonNoCors(res, body);
+          json(res, body);
         },
         () => {
-          jsonNoCors(res, { status: "unavailable", reason: "read_failed" }, 500);
+          json(res, { status: "unavailable", reason: "read_failed" }, 500);
         }
       );
       return;
@@ -9055,10 +8823,7 @@ function createRouter(dbOrDeps) {
       serveRunEventStream(req, res, {
         runId,
         handleParam: handleParamOf(req),
-        // 403-03 (D-13 · INVK-05): the resume point, read from the SAME pair the authed door reads
-        // it from. `url.searchParams.get('lastEventId')` would resolve a repeated parameter to its
-        // first value — the one answer `lastEventIdParamOf` exists to refuse — and a second
-        // header/query precedence rule here would be a second contract for where a client resumes.
+        // Read from the same pair as the authed door; `searchParams.get` takes a repeated first.
         resume: resumePointOf(req.headers["last-event-id"], lastEventIdParamOf(req)),
         attach: deps.runServiceAttach
       });
@@ -9100,7 +8865,6 @@ function createRouter(dbOrDeps) {
         try {
           attributes = buildRunRequestAttributes({
             trigger: "api",
-            runner: "local",
             userAttributes: body.attributes
           });
         } catch (err) {
@@ -9108,25 +8872,10 @@ function createRouter(dbOrDeps) {
           return;
         }
         const args = normalizedFileTarget ? [normalizedFileTarget.executionPath] : [];
-        const source = isSuiteFile ? "suite" : "dashboard";
-        try {
-          await executionBackend?.preflight?.({ args, source });
-        } catch (error) {
-          const denial = runDenialOf(error);
-          if (denial !== void 0) {
-            json(res, denial, 403);
-            return;
-          }
-          json(res, { error: error instanceof Error ? error.message : String(error) }, 400);
-          return;
-        }
         const runId = jobQueue.enqueue({
           name: body.name,
           filePath: normalizedFileTarget?.storagePath,
-          // 2026-08-24 (402-09, D-11): NO PARENT KIND IS MINTED. A suite run is ONE run row
-          // with member handles, so a parent artifact kind would claim parenthood over rows
-          // nothing creates. `isSuiteFile` still travels in `metadata.isSuite` below, and the run's
-          // own `suite_id` plus the artifact's `source.kind` snapshot still say it is a suite.
+          // No parent kind is minted; `metadata.isSuite` and `suite_id` say it is a suite.
           kind: "test",
           attributes,
           priority: body.priority,
@@ -9209,17 +8958,6 @@ function createRouter(dbOrDeps) {
           args.push("--disable-cache");
         }
         const isSuite = Boolean(isSuiteFile);
-        try {
-          await executionBackend?.preflight?.({ args, source: isSuite ? "suite" : "dashboard" });
-        } catch (error) {
-          const denial = runDenialOf(error);
-          if (denial !== void 0) {
-            json(res, denial, 403);
-            return;
-          }
-          json(res, { error: error instanceof Error ? error.message : String(error) }, 400);
-          return;
-        }
         let testName = body.file ? (0, import_node_path10.basename)(normalizedFileTarget?.storagePath ?? body.file, ".yaml") : "unknown";
         let fileParallel;
         let platform;
@@ -9262,11 +9000,10 @@ function createRouter(dbOrDeps) {
         const runId = jobQueue.enqueue({
           name: testName,
           filePath: normalizedFileTarget?.storagePath ?? body.file,
-          // 2026-08-24 (402-09, D-11): no parent kind minted — see the enqueue route above.
+          // No parent kind is minted; see the enqueue route above.
           kind: "test",
           attributes: buildRunRequestAttributes({
-            trigger: triggerSource.trigger,
-            runner: body.local === false ? "browserstack" : "local"
+            trigger: triggerSource.trigger
           }),
           platform,
           parallel: effectiveParallel,
@@ -9819,9 +9556,8 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/config" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!configManager) {
-        jsonNoCors(res, { error: "Config management not available" }, 501);
+        json(res, { error: "Config management not available" }, 501);
         return;
       }
       ;
@@ -9829,7 +9565,7 @@ function createRouter(dbOrDeps) {
         try {
           const read = await configManager.readMasked();
           if (read.kind === "file_invalid") {
-            jsonNoCors(res, { error: "file_invalid", message: read.message }, 409);
+            json(res, { error: "file_invalid", message: read.message }, 409);
             return;
           }
           const { config, revision, lines, fileIssues } = read;
@@ -9839,7 +9575,7 @@ function createRouter(dbOrDeps) {
           const activeLlm = use?.llm ?? config.defaultLLM;
           const defaultCfg = Array.isArray(llms) ? llms.find((c) => c?.name === activeLlm) : void 0;
           const provider = defaultCfg?.provider ?? null;
-          jsonNoCors(res, {
+          json(res, {
             config,
             provider,
             revision,
@@ -9847,45 +9583,17 @@ function createRouter(dbOrDeps) {
             ...fileIssues.length > 0 ? { fileIssues } : {}
           });
         } catch (err) {
-          jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to read config" }, 500);
+          json(res, { error: err instanceof Error ? err.message : "Failed to read config" }, 500);
         }
       })();
       return;
     }
-    if (path === "/api/config/farm/test-connection" && req.method === "POST") {
-      readJsonBody(req).then(async (body) => {
-        if (body.provider !== "browserstack") {
-          json(res, { error: "Only BrowserStack is currently supported" }, 400);
-          return;
-        }
-        try {
-          const auth = Buffer.from(`${body.username}:${body.accessKey}`).toString("base64");
-          const response = await fetch("https://api-cloud.browserstack.com/app-automate/devices.json", {
-            headers: { Authorization: `Basic ${auth}` }
-          });
-          if (response.ok) {
-            json(res, { success: true });
-          } else if (response.status === 401) {
-            json(res, { success: false, error: "Invalid credentials" });
-          } else {
-            json(res, { success: false, error: `BrowserStack API returned ${response.status}` });
-          }
-        } catch (err) {
-          json(res, { success: false, error: err instanceof Error ? err.message : "Connection failed" });
-        }
-      }).catch(() => json(res, { error: "Invalid request body" }, 400));
-      return;
-    }
     if (path.startsWith("/api/auth/") && req.method === "DELETE") {
       const segments = path.split("/");
       if (segments.length === 4 && segments[2] === "auth") {
         const providerName = decodeURIComponent(segments[3]);
         if (providerName === "status" || providerName === "credential" || providerName === "oauth") {
         } else {
-          if (refuseCrossSiteRequest(req) !== void 0) {
-            jsonNoCors(res, { error: "cross_site_refused" }, 403);
-            return;
-          }
           ;
           (async () => {
             try {
@@ -9896,13 +9604,13 @@ function createRouter(dbOrDeps) {
                 return credential;
               });
               if (removed === void 0) {
-                jsonNoCors(res, { deleted: false });
+                json(res, { deleted: false });
                 return;
               }
               const undo = undoStore.put({ kind: "credential", name: providerName, credential: removed }, Date.now());
-              jsonNoCors(res, { deleted: true, undo });
+              json(res, { deleted: true, undo });
             } catch (err) {
-              jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to delete credential" }, 500);
+              json(res, { error: err instanceof Error ? err.message : "Failed to delete credential" }, 500);
             }
           })();
           return;
@@ -10012,27 +9720,21 @@ function createRouter(dbOrDeps) {
       const segments = path.split("/");
       const provider = segments.length >= 6 ? decodeURIComponent(segments[4] ?? "") : "";
       const action = segments.length >= 6 ? segments[5] : "";
-      const authDoor = req.method === "POST" && (action === "start" || action === "exchange");
-      if (authDoor && refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       const plugin = provider ? (0, import_agent_qa_core11.getLLMAuthProviderPlugin)(provider) : void 0;
       if (!plugin) {
-        ;
-        (authDoor ? jsonNoCors : json)(res, { error: `Auth plugin provider "${provider}" is not registered` }, 404);
+        json(res, { error: `Auth plugin provider "${provider}" is not registered` }, 404);
         return;
       }
       if (action === "start" && req.method === "POST") {
         readJsonBody(req).then(async (body) => {
           if (!plugin.startAuth) {
-            jsonNoCors(res, { error: `Provider "${provider}" does not support dashboard auth start` }, 400);
+            json(res, { error: `Provider "${provider}" does not support dashboard auth start` }, 400);
             return;
           }
           try {
             const target = await requirePluginAuthConfig(configManager, body.configName, plugin);
             if (!target.ok) {
-              jsonNoCors(res, credentialRefusalBody(target), target.status);
+              json(res, credentialRefusalBody(target), target.status);
               return;
             }
             const started = await plugin.startAuth({
@@ -10068,16 +9770,16 @@ function createRouter(dbOrDeps) {
                 session.error = err instanceof Error ? err.message : "Authentication failed";
               }).finally(() => cleanupPluginOAuthSession(session));
             }
-            jsonNoCors(res, {
+            json(res, {
               authorizeUrl: started.authorizeUrl,
               sessionId,
               mode: plugin.dashboardAuth.mode,
               created: target.created
             });
           } catch (err) {
-            jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to start auth plugin flow" }, 500);
+            json(res, { error: err instanceof Error ? err.message : "Failed to start auth plugin flow" }, 500);
           }
-        }).catch(() => jsonNoCors(res, { error: "Invalid request body" }, 400));
+        }).catch(() => json(res, { error: "Invalid request body" }, 400));
         return;
       }
       if (action === "result" && req.method === "GET") {
@@ -10105,22 +9807,22 @@ function createRouter(dbOrDeps) {
       if (action === "exchange" && req.method === "POST") {
         readJsonBody(req).then(async (body) => {
           if (!plugin.exchangeCode) {
-            jsonNoCors(res, { error: `Provider "${provider}" does not support code exchange` }, 400);
+            json(res, { error: `Provider "${provider}" does not support code exchange` }, 400);
             return;
           }
           const sessionId = typeof body.sessionId === "string" ? body.sessionId.trim() : "";
           const code = typeof body.code === "string" ? body.code.trim() : "";
           if (!sessionId || !code) {
-            jsonNoCors(res, { error: "sessionId and code are required" }, 400);
+            json(res, { error: "sessionId and code are required" }, 400);
             return;
           }
           const session = pluginOAuthSessions.get(sessionId);
           if (!session || session.providerId !== provider) {
-            jsonNoCors(res, { error: "Auth session not found" }, 404);
+            json(res, { error: "Auth session not found" }, 404);
             return;
           }
           if (session.status !== "pending") {
-            jsonNoCors(res, { error: "Auth session is no longer pending" }, 409);
+            json(res, { error: "Auth session is no longer pending" }, 409);
             return;
           }
           try {
@@ -10142,61 +9844,57 @@ function createRouter(dbOrDeps) {
               session.error = CREDENTIAL_PROVIDER_CONFLICT.message;
               cleanupPluginOAuthSession(session);
               pluginOAuthSessions.delete(sessionId);
-              jsonNoCors(res, credentialRefusalBody(CREDENTIAL_PROVIDER_CONFLICT), CREDENTIAL_PROVIDER_CONFLICT.status);
+              json(res, credentialRefusalBody(CREDENTIAL_PROVIDER_CONFLICT), CREDENTIAL_PROVIDER_CONFLICT.status);
               return;
             }
             session.status = "completed";
             cleanupPluginOAuthSession(session);
             pluginOAuthSessions.delete(sessionId);
-            jsonNoCors(res, { status: "completed", saved: true });
+            json(res, { status: "completed", saved: true });
           } catch (err) {
             session.status = "error";
             session.error = err instanceof Error ? err.message : "Token exchange failed";
             cleanupPluginOAuthSession(session);
             pluginOAuthSessions.delete(sessionId);
-            jsonNoCors(res, { error: session.error }, 500);
+            json(res, { error: session.error }, 500);
           }
-        }).catch(() => jsonNoCors(res, { error: "Invalid request body" }, 400));
+        }).catch(() => json(res, { error: "Invalid request body" }, 400));
         return;
       }
       json(res, { error: "Auth plugin route not found" }, 404);
       return;
     }
     if (path === "/api/auth/credential" && req.method === "POST") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       readJsonBody(req).then(async (body) => {
         const provider = typeof body.provider === "string" ? body.provider.trim() : "";
         const credentialType = typeof body.type === "string" ? body.type.trim() : "";
         const secret = typeof body.secret === "string" ? body.secret.trim() : "";
         if (typeof body.configName !== "string" || body.configName.trim() === "") {
-          jsonNoCors(res, { error: "configName is required" }, 400);
+          json(res, { error: "configName is required" }, 400);
           return;
         }
         if (!provider || !isKnownLLMProvider(provider)) {
-          jsonNoCors(res, { error: "valid provider is required" }, 400);
+          json(res, { error: "valid provider is required" }, 400);
           return;
         }
         if (credentialType !== "api-key" && credentialType !== "bearer-token") {
-          jsonNoCors(res, { error: "type must be api-key or bearer-token" }, 400);
+          json(res, { error: "type must be api-key or bearer-token" }, 400);
           return;
         }
         if (!secret) {
-          jsonNoCors(res, { error: "secret is required" }, 400);
+          json(res, { error: "secret is required" }, 400);
           return;
         }
         if ((0, import_agent_qa_core11.getLLMAuthProviderPlugin)(provider)) {
-          jsonNoCors(res, { error: "Subscription providers use OAuth login" }, 400);
+          json(res, { error: "Subscription providers use OAuth login" }, 400);
           return;
         }
         if (credentialType === "bearer-token" && provider !== "anthropic-compatible") {
-          jsonNoCors(res, { error: "bearer-token credentials are only supported for anthropic-compatible configs" }, 400);
+          json(res, { error: "bearer-token credentials are only supported for anthropic-compatible configs" }, 400);
           return;
         }
         if (credentialType === "api-key" && !API_KEY_CREDENTIAL_PROVIDERS.has(provider)) {
-          jsonNoCors(res, { error: "api-key credentials are not supported for this provider" }, 400);
+          json(res, { error: "api-key credentials are not supported for this provider" }, 400);
           return;
         }
         try {
@@ -10211,35 +9909,31 @@ function createRouter(dbOrDeps) {
             return checked;
           });
           if (!target.ok) {
-            jsonNoCors(res, credentialRefusalBody(target), target.status);
+            json(res, credentialRefusalBody(target), target.status);
             return;
           }
-          jsonNoCors(res, { saved: true, created: target.created });
+          json(res, { saved: true, created: target.created });
         } catch (err) {
-          jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to save credential" }, 500);
+          json(res, { error: err instanceof Error ? err.message : "Failed to save credential" }, 500);
         }
-      }).catch(() => jsonNoCors(res, { error: "Invalid request body" }, 400));
+      }).catch(() => json(res, { error: "Invalid request body" }, 400));
       return;
     }
     if (path === "/api/auth/credential/move" && req.method === "POST") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       readJsonBody(req).then(async (raw) => {
         const parsed = import_agent_qa_schema12.LlmCredentialMoveRequestSchema.safeParse(raw);
         if (!parsed.success) {
-          jsonNoCors(res, { error: "invalid_setup_input" }, 400);
+          json(res, { error: "invalid_setup_input" }, 400);
           return;
         }
         const from = checkCredentialName(parsed.data.from);
         const to = checkCredentialName(parsed.data.to);
         if (!from.ok || !to.ok) {
-          jsonNoCors(res, { error: "name_invalid" }, 400);
+          json(res, { error: "name_invalid" }, 400);
           return;
         }
         if (!configManager) {
-          jsonNoCors(res, { error: "Config manager is required to move credentials" }, 400);
+          json(res, { error: "Config manager is required to move credentials" }, 400);
           return;
         }
         try {
@@ -10257,25 +9951,21 @@ function createRouter(dbOrDeps) {
             return void 0;
           });
           if (refusal) {
-            jsonNoCors(res, credentialRefusalBody(refusal), refusal.status);
+            json(res, credentialRefusalBody(refusal), refusal.status);
             return;
           }
-          jsonNoCors(res, { moved: true });
+          json(res, { moved: true });
         } catch (err) {
-          jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to move credential" }, 500);
+          json(res, { error: err instanceof Error ? err.message : "Failed to move credential" }, 500);
         }
-      }).catch(() => jsonNoCors(res, { error: "invalid_setup_input" }, 400));
+      }).catch(() => json(res, { error: "invalid_setup_input" }, 400));
       return;
     }
     if (path === "/api/llm/test" && req.method === "POST") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       readJsonBody(req).then(async (body) => {
         const rawBody = body;
         if ("apiKey" in rawBody) {
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: "invalid_request",
             message: "apiKey is not accepted in LLM test requests. Save credentials for the named config instead."
@@ -10285,7 +9975,7 @@ function createRouter(dbOrDeps) {
         const providerName = typeof body.provider === "string" ? body.provider.trim() : "";
         const modelName = typeof body.model === "string" ? body.model.trim() : "";
         if (!providerName || !modelName) {
-          jsonNoCors(res, { success: false, error: "invalid_request", message: "provider and model are required" }, 400);
+          json(res, { success: false, error: "invalid_request", message: "provider and model are required" }, 400);
           return;
         }
         const configName = typeof body.configName === "string" ? body.configName.trim() : "";
@@ -10310,7 +10000,7 @@ function createRouter(dbOrDeps) {
         }
         const parsedConfig = import_agent_qa_core11.ModelConfigSchema.safeParse(llmCandidate);
         if (!parsedConfig.success) {
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: "invalid_request",
             message: parsedConfig.error.issues.map((issue) => `${issue.path.map(String).join(".") || "config"}: ${issue.message}`).join("; ")
@@ -10322,7 +10012,7 @@ function createRouter(dbOrDeps) {
         const coreAuth = await import("@vostride/agent-qa-core");
         const resolvedAuth = await coreAuth.resolveLLMAuth(configName, llmConfig2);
         if (resolvedAuth.kind === "missing") {
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: "missing_credential",
             message: resolvedAuth.message
@@ -10351,7 +10041,7 @@ function createRouter(dbOrDeps) {
           } finally {
             clearTimeout(timeout);
           }
-          jsonNoCors(res, {
+          json(res, {
             success: true,
             model: modelName,
             provider: providerName,
@@ -10366,7 +10056,7 @@ function createRouter(dbOrDeps) {
           const providerMessage = withDeclaredMask(declaredMask, (mask) => mask(unsavedMessage));
           const errorClass = (0, import_agent_qa_schema12.classifyProviderError)(providerMessage ?? unsavedMessage, statusCode);
           const message = providerMessage === void 0 ? (0, import_agent_qa_schema12.providerErrorSentence)(errorClass, "").trimEnd() : (0, import_agent_qa_schema12.providerErrorSentence)(errorClass, providerMessage);
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: errorClass,
             message,
@@ -10376,7 +10066,7 @@ function createRouter(dbOrDeps) {
             ...unauthenticated ? { unauthenticated: true, authMessage } : {}
           });
         }
-      }).catch(() => jsonNoCors(res, { success: false, error: "invalid_request", message: "Invalid request body" }, 400));
+      }).catch(() => json(res, { success: false, error: "invalid_request", message: "Invalid request body" }, 400));
       return;
     }
     if (path === "/api/cache/purge" && req.method === "POST") {
@@ -10385,56 +10075,15 @@ function createRouter(dbOrDeps) {
         return;
       }
       readJsonBody(req).then(async (body) => {
-        if (!body.file && !body.all) {
-          json(res, { error: "Either file or all is required" }, 400);
+        if (body.all !== true) {
+          json(res, { error: "all is required" }, 400);
           return;
         }
         try {
           const cfg = await readConfigValues(configManager);
-          const cacheDir = cfg.services?.cache?.dir ?? cfg.cache?.dir;
-          if (!cacheDir) {
-            json(res, { error: "Cache directory not configured" }, 400);
-            return;
-          }
           const configDir = deps.configPath ? (0, import_node_path10.dirname)((0, import_node_path10.resolve)(deps.configPath)) : process.cwd();
-          const resolvedCacheDir = (0, import_node_path10.resolve)(configDir, cacheDir);
-          let branchDirs;
-          try {
-            branchDirs = await (0, import_promises7.readdir)(resolvedCacheDir);
-          } catch (err) {
-            if (err.code === "ENOENT") {
-              json(res, { purged: 0 });
-              return;
-            }
-            throw err;
-          }
-          let purged = 0;
-          for (const branch of branchDirs) {
-            const branchPath = (0, import_node_path10.join)(resolvedCacheDir, branch);
-            let entryStat;
-            try {
-              entryStat = await (0, import_promises7.stat)(branchPath);
-            } catch {
-              continue;
-            }
-            if (!entryStat.isDirectory()) {
-              await (0, import_promises7.rm)(branchPath, { force: true });
-              continue;
-            }
-            let files;
-            try {
-              files = await (0, import_promises7.readdir)(branchPath);
-            } catch {
-              continue;
-            }
-            for (const file of files) {
-              if (!file.endsWith(".json")) continue;
-              await (0, import_promises7.rm)((0, import_node_path10.join)(branchPath, file), { force: true });
-              purged++;
-            }
-            await (0, import_promises7.rm)(branchPath, { recursive: true, force: true }).catch(() => {
-            });
-          }
+          const cacheDir = cfg.services?.cache?.dir ?? import_agent_qa_core11.DEFAULT_AGENT_QA_CACHE_DIR;
+          const purged = await (0, import_agent_qa_runner_local2.purgeActionCache)((0, import_node_path10.resolve)(configDir, cacheDir));
           json(res, { purged });
         } catch (err) {
           json(res, { error: err instanceof Error ? err.message : "Cache purge failed" }, 500);
@@ -10518,7 +10167,7 @@ function createRouter(dbOrDeps) {
             return;
           }
           const workspaceEnv = await readWorkspaceEnvVars(workspacePaths);
-          const result = await new import_agent_qa_runner_local2.DockerHookExecutor().execute(resolvedHook, {
+          const result = await new import_agent_qa_runner_local2.DockerHookExecutor({ version: (0, import_agent_qa_core11.getAgentQaVersion)() }).execute(resolvedHook, {
             env: {
               ...workspaceEnv,
               ...validation.overrides
@@ -10554,7 +10203,7 @@ function createRouter(dbOrDeps) {
             variables: shown.variables,
             sandbox: {
               runtime: resolvedHook.runtime,
-              image: import_agent_qa_core11.RUNTIME_IMAGE_MAP[resolvedHook.runtime],
+              image: (0, import_agent_qa_core11.hookRunnerImage)(resolvedHook.runtime, (0, import_agent_qa_core11.getAgentQaVersion)()),
               networkMode: resolvedHook.network ? "enabled" : "disabled",
               dockerVersion: null,
               networkLogsAvailable: shown.networkLogs.length > 0,
@@ -10758,12 +10407,8 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (req.method === "GET" && /^\/api\/live-editor\/sessions\/[^/]+\/live-url$/.test(path)) {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       if (!deps.mintEditorLiveUrl) {
-        jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+        json(res, { error: "live_view_unavailable" }, 503);
         return;
       }
       let editorSessionId;
@@ -10772,33 +10417,32 @@ function createRouter(dbOrDeps) {
           path.slice("/api/live-editor/sessions/".length, -"/live-url".length)
         );
       } catch {
-        jsonNoCors(res, { error: "unknown_session" }, 404);
+        json(res, { error: "unknown_session" }, 404);
         return;
       }
       void deps.mintEditorLiveUrl(editorSessionId).then(
         (result) => {
-          jsonNoCors(res, result);
+          json(res, result);
         },
         (error) => {
           const name = error instanceof Error ? error.name : "";
           if (name === "UnknownLiveEditorSessionError") {
-            jsonNoCors(res, { error: "unknown_session" }, 404);
+            json(res, { error: "unknown_session" }, 404);
             return;
           }
           if (name === "LiveViewUnavailableError") {
-            jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+            json(res, { error: "live_view_unavailable" }, 503);
             return;
           }
-          jsonNoCors(res, { error: "live_url_mint_failed" }, 500);
+          json(res, { error: "live_url_mint_failed" }, 500);
         }
       );
       return;
     }
     const liveEditorAuthStateMatch = path.match(/^\/api\/live-editor\/sessions\/([^/]+)\/auth-state$/);
     if (liveEditorAuthStateMatch && req.method === "POST") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
       ;
@@ -10809,35 +10453,34 @@ function createRouter(dbOrDeps) {
           const body = await readJsonBody(req);
           const parsedName = import_agent_qa_core11.AuthStateNameSchema.safeParse(typeof body?.name === "string" ? body.name : "");
           if (!parsedName.success) {
-            jsonNoCors(res, { error: "Auth state name must be a lowercase slug." }, 400);
+            json(res, { error: "Auth state name must be a lowercase slug." }, 400);
             return;
           }
           stateName = parsedName.data;
           session = sessionManager.getSession(decodeURIComponent(liveEditorAuthStateMatch[1]));
           if (!session) {
-            jsonNoCors(res, { error: "Session not found" }, 404);
+            json(res, { error: "Session not found" }, 404);
             return;
           }
           if (typeof session.captureWebAuthState !== "function") {
-            jsonNoCors(res, {
+            json(res, {
               error: `Could not save auth state "${stateName}" for target "${getSessionTargetNameForAuthState(session)}".`
             }, 500);
             return;
           }
           const authState = await session.captureWebAuthState(stateName, { replace: body?.replace === true });
-          jsonNoCors(res, { authState });
+          json(res, { authState });
         } catch (err) {
           const targetName = getSessionTargetNameForAuthState(session);
           const response = buildAuthStateSaveErrorMessage(stateName || "unknown", targetName, err);
-          jsonNoCors(res, { error: response.message }, response.status);
+          json(res, { error: response.message }, response.status);
         }
       })();
       return;
     }
     if (path === "/api/live-editor/sessions" && req.method === "POST") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
       ;
@@ -10845,16 +10488,10 @@ function createRouter(dbOrDeps) {
         try {
           const body = await readJsonBody(req);
           const targetName = typeof body?.targetName === "string" ? body.targetName : void 0;
-          const production = await resolveLiveTargetProduction(configManager, targetName);
-          const productionRefusal = liveProductionRefusal(production);
-          if (productionRefusal !== void 0) {
-            jsonNoCors(res, { error: productionRefusal.message }, 403);
-            return;
-          }
           const platform = body?.platform ?? "web";
           const runtimeLLM = await resolveDashboardRuntimeLLM(configManager, llmConfig, authFetch);
           if (!runtimeLLM.ok) {
-            jsonNoCors(res, { error: runtimeLLM.error }, 400);
+            json(res, { error: runtimeLLM.error }, 400);
             return;
           }
           const setupHooks = Array.isArray(body?.setupHooks) ? body.setupHooks.filter((value) => typeof value === "string" && value.trim().length > 0) : [];
@@ -10873,14 +10510,14 @@ function createRouter(dbOrDeps) {
           let resolvedHooks = /* @__PURE__ */ new Map();
           let hookRegistryError;
           if (!workspacePaths) {
-            jsonNoCors(res, { error: "Workspace path resolution not available" }, 500);
+            json(res, { error: "Workspace path resolution not available" }, 500);
             return;
           }
           try {
             const envContent = await (0, import_promises7.readFile)(workspacePaths.envFile.absolutePath, "utf-8");
             envVars = (0, import_agent_qa_core11.parseEnvFile)(envContent);
           } catch {
-            jsonNoCors(res, { error: `workspace.envFile file could not be loaded: ${workspacePaths.envFile.workspaceRelativePath}` }, 400);
+            json(res, { error: `workspace.envFile file could not be loaded: ${workspacePaths.envFile.workspaceRelativePath}` }, 400);
             return;
           }
           try {
@@ -10888,7 +10525,7 @@ function createRouter(dbOrDeps) {
             secretStore = import_agent_qa_runner2.SecretStore.fromEnvContent(secretsContent);
             secretRedactor = new import_agent_qa_runner2.SecretRedactor(secretStore);
           } catch {
-            jsonNoCors(res, { error: `workspace.secretsFile file could not be loaded: ${workspacePaths.secretsFile.workspaceRelativePath}` }, 400);
+            json(res, { error: `workspace.secretsFile file could not be loaded: ${workspacePaths.secretsFile.workspaceRelativePath}` }, 400);
             return;
           }
           const hookCatalog = await readWorkspaceHooks(configManager, deps.configPath);
@@ -10899,6 +10536,11 @@ function createRouter(dbOrDeps) {
             ...suiteFileManager === void 0 ? {} : { findSuite: (id) => suiteFileManager.findBySuiteId(id) }
           };
           const plannerLimits = await resolveLivePlannerLimits(configManager, entityRef, entityReaders);
+          const navigationTimeoutMs = await resolveLiveNavigationTimeoutMs(
+            configManager,
+            entityRef,
+            entityReaders
+          );
           const sessionSuiteRef = entityRef?.type === "suite" ? entityRef : void 0;
           const plannerLimitsForTest = (testId) => resolveLivePlannerLimits(
             configManager,
@@ -10909,7 +10551,6 @@ function createRouter(dbOrDeps) {
             {
               platform,
               targetName,
-              production: { productionTargetNames: production.productionTargetNames },
               plannerLimits,
               plannerLimitsForTest,
               llmConfig: runtimeLLM.llmConfig,
@@ -10923,6 +10564,7 @@ function createRouter(dbOrDeps) {
               hookRegistryError,
               url: body?.url,
               headless: body?.headless ?? false,
+              navigationTimeoutMs,
               useDeviceName: typeof body?.useDeviceName === "string" ? body.useDeviceName : void 0,
               appState: body?.appState === "preserve" || body?.appState === "reset" ? body.appState : void 0,
               bundleId: typeof body?.bundleId === "string" ? body.bundleId : void 0,
@@ -10932,38 +10574,37 @@ function createRouter(dbOrDeps) {
             },
             entityRef
           );
-          jsonNoCors(res, { sessionId, sessionNumber }, 201);
+          json(res, { sessionId, sessionNumber }, 201);
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          const status = err instanceof LiveProductionRefusedError ? 403 : err instanceof LivePlannerLimitsRefusedError ? 400 : 500;
-          jsonNoCors(res, { error: message }, status);
+          const refused = err instanceof LivePlannerLimitsRefusedError || err instanceof LiveNavigationTimeoutRefusedError;
+          const status = refused ? 400 : 500;
+          json(res, { error: message }, status);
         }
       })();
       return;
     }
     if (path === "/api/live-editor/sessions" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
-      jsonNoCors(res, { sessions: sessionManager.listSessions() });
+      json(res, { sessions: sessionManager.listSessions() });
       return;
     }
     const liveEditorSessionMatch = path.match(/^\/api\/live-editor\/sessions\/([^/]+)$/);
     if (liveEditorSessionMatch && req.method === "DELETE") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
       const sessionId = liveEditorSessionMatch[1];
       (async () => {
         const terminated = await sessionManager.terminateSession(sessionId);
         if (terminated) {
-          jsonNoCors(res, { ok: true });
+          json(res, { ok: true });
         } else {
-          jsonNoCors(res, { error: "Session not found" }, 404);
+          json(res, { error: "Session not found" }, 404);
         }
       })();
       return;
@@ -11012,6 +10653,7 @@ function createRouter(dbOrDeps) {
 // src/queue/job-queue.ts
 var import_node_events = require("node:events");
 var import_node_os2 = require("node:os");
+var import_agent_qa_core12 = require("@vostride/agent-qa-core");
 var NOT_CANCELLABLE = { kind: "not-cancellable" };
 var JobQueue = class extends import_node_events.EventEmitter {
   db;
@@ -11034,8 +10676,7 @@ var JobQueue = class extends import_node_events.EventEmitter {
     this.pollInterval = setInterval(() => this.dispatchReported("a poll"), intervalMs);
     this.on("enqueued", () => this.dispatchReported("an enqueue"));
   }
-  // 2026-10-17 (444-16, D-50): the server closes the database after this; a run that settles later
-  // still frees its slot, and nothing reads the closed database.
+  // The server closes the database after this; a run settling later still frees its slot.
   stop() {
     this.stopped = true;
     if (this.pollInterval) {
@@ -11121,7 +10762,10 @@ var JobQueue = class extends import_node_events.EventEmitter {
       this.processNext();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      console.error(`Queue could not dispatch the next run after ${trigger}: ${message}`);
+      (0, import_agent_qa_core12.printRunText)(
+        `Queue could not dispatch the next run after ${trigger}: ${message}`,
+        (text) => console.error(text)
+      );
     }
   }
   getActiveCount() {
@@ -11130,9 +10774,7 @@ var JobQueue = class extends import_node_events.EventEmitter {
   getConcurrency() {
     return this.concurrency;
   }
-  // 2026-10-16 (442-05, D-06 to D-08): only the owner cancels a running row; gone is an orphan.
-  // 442-15 (GAP-D2): own is the stamp this handle wrote, or equal non-null start times.
-  // 2026-10-17 (444-06, D-11): a running row is never written here; the run answers with its verdict.
+  // Only the owner stops its running row, never written here; a gone owner's row is an orphan.
   cancel(runId) {
     const run = this.db.getRun(runId);
     if (!run) return NOT_CANCELLABLE;
@@ -11162,21 +10804,7 @@ var JobQueue = class extends import_node_events.EventEmitter {
     const run = this.db.getRun(runId);
     return run && run.status !== "running" && run.status !== "pending" ? { kind: "finished", status: run.status } : NOT_CANCELLABLE;
   }
-  // 2026-08-24 (Phase 402 plan 09, D-11): THE CHILD-RUN CANCELLATION FAN-OUT IS DELETED WITH THE
-  // MODEL THAT MINTED ITS CHILDREN.
-  //
-  // ~19 lines stood here walking the run's child rows and cancelling each member row. Under
-  // the one-run model a parallel suite is ONE run row with member handles (402-04) — nothing writes
-  // the run row's parent-link column any more (405-07 then deleted the column outright), so the
-  // walk could only ever have read an empty list while reading as live cancellation policy.
-  // Cancelling the run cancels the run.
-  //
-  // WHAT THIS DOES NOT TOUCH: `parallel` below. D-11 keeps the queue's parallel flag as CROSS-RUN
-  // concurrency of INDEPENDENT jobs, which is what `findNextEligible` has always used it for. What
-  // was deleted is parallel-SUITE semantics, not the queue's ability to run two unrelated jobs.
-  //
-  // HISTORICAL ROWS: a pre-402 suite run still lists its members on the read side; cancelling
-  // such a run now leaves those member rows in whatever state their own process left them.
+  // `parallel` is cross-run concurrency of independent jobs; a suite is one run row.
   findNextEligible() {
     if (this.activeCount >= this.concurrency) return void 0;
     const pending = this.db.getPendingRuns();
@@ -11203,17 +10831,17 @@ var import_promises8 = require("node:fs/promises");
 var import_node_path11 = require("node:path");
 var import_agent_qa_ids3 = require("@vostride/agent-qa-ids");
 var import_yaml8 = require("yaml");
-var import_agent_qa_core12 = require("@vostride/agent-qa-core");
+var import_agent_qa_core13 = require("@vostride/agent-qa-core");
 var SuiteFileManager = class {
   constructor(workspace, testFileManager) {
     this.workspace = workspace;
     this.testFileManager = testFileManager;
   }
   testFileManager;
-  // 2026-10-18 (444-33, D-65; 444-35, D-66): each list call reads the workspace itself; each file is written whole and one writer at a time.
+  // Each list call reads the workspace itself; each file is written whole, one writer at a time.
   underLock = createPathLock();
   async list() {
-    const records = await (0, import_agent_qa_core12.discoverWorkspaceFiles)({ workspace: this.workspace, kind: "suite" });
+    const records = await (0, import_agent_qa_core13.discoverWorkspaceFiles)({ workspace: this.workspace, kind: "suite" });
     const files = [];
     for (const record of records) {
       try {
@@ -11275,7 +10903,7 @@ var SuiteFileManager = class {
     if (!trimmedPath) {
       throw new Error("Suite path is required");
     }
-    const target = await (0, import_agent_qa_core12.resolveWorkspaceFileTarget)({
+    const target = await (0, import_agent_qa_core13.resolveWorkspaceFileTarget)({
       workspace: this.workspace,
       kind: "suite",
       filePath: trimmedPath,
@@ -11299,7 +10927,7 @@ var SuiteFileManager = class {
   async validate(content) {
     try {
       const parsed = (0, import_yaml8.parse)(content);
-      const result = import_agent_qa_core12.SuiteDefinitionSchema.safeParse(parsed);
+      const result = import_agent_qa_core13.SuiteDefinitionSchema.safeParse(parsed);
       if (!result.success) {
         return {
           valid: false,
@@ -11337,7 +10965,7 @@ var SuiteFileManager = class {
     }
   }
   async resolveTarget(relativePath, requireExisting) {
-    return (0, import_agent_qa_core12.resolveWorkspaceFileTarget)({
+    return (0, import_agent_qa_core13.resolveWorkspaceFileTarget)({
       workspace: this.workspace,
       kind: "suite",
       filePath: relativePath,
@@ -11349,7 +10977,7 @@ var SuiteFileManager = class {
 // src/execution/appium-manager.ts
 var import_node_http = require("node:http");
 var import_node_child_process2 = require("node:child_process");
-var import_agent_qa_core13 = require("@vostride/agent-qa-core");
+var import_agent_qa_core14 = require("@vostride/agent-qa-core");
 var import_tree_kill = __toESM(require("tree-kill"), 1);
 var import_picocolors = __toESM(require("picocolors"), 1);
 var APPIUM_PREFIX = import_picocolors.default.magenta("[appium]");
@@ -11370,7 +10998,7 @@ var AppiumManager = class {
     this.startupTimeoutMs = opts?.startupTimeoutMs ?? 3e4;
     this.pollIntervalMs = opts?.pollIntervalMs ?? 500;
     this.logLevel = opts?.logLevel ?? "normal";
-    this.appiumResolver = opts?.appiumResolver ?? import_agent_qa_core13.resolveAppiumExecutable;
+    this.appiumResolver = opts?.appiumResolver ?? import_agent_qa_core14.resolveAppiumExecutable;
   }
   async acquire() {
     await this.ensureRunning();
@@ -11473,23 +11101,23 @@ var AppiumManager = class {
     this.managed = true;
     child.on("error", (err) => {
       if (err.code === "ENOENT") {
-        console.error(`${APPIUM_PREFIX} Appium not found. ${(0, import_agent_qa_core13.formatAppiumInstallGuidance)()}`);
+        console.error(`${APPIUM_PREFIX} Appium not found. ${(0, import_agent_qa_core14.formatAppiumInstallGuidance)()}`);
       } else {
-        console.error(`${APPIUM_PREFIX} Error: ${err.message}`);
+        (0, import_agent_qa_core14.printRunText)(`${APPIUM_PREFIX} Error: ${err.message}`, (text) => console.error(text));
       }
     });
     child.stdout?.on("data", (chunk) => {
       if (this.logLevel !== "debug") return;
       const lines = chunk.toString().split("\n").filter(Boolean);
       for (const line of lines) {
-        console.log(`${APPIUM_PREFIX} ${import_picocolors.default.dim(line)}`);
+        (0, import_agent_qa_core14.printRunText)(`${APPIUM_PREFIX} ${import_picocolors.default.dim(line)}`, (text) => console.log(text));
       }
     });
     child.stderr?.on("data", (chunk) => {
       if (this.logLevel !== "debug") return;
       const lines = chunk.toString().split("\n").filter(Boolean);
       for (const line of lines) {
-        console.error(`${APPIUM_PREFIX} ${import_picocolors.default.dim(line)}`);
+        (0, import_agent_qa_core14.printRunText)(`${APPIUM_PREFIX} ${import_picocolors.default.dim(line)}`, (text) => console.error(text));
       }
     });
     const start = Date.now();
@@ -11571,10 +11199,7 @@ var SessionManager = class {
     this.deps = deps;
   }
   sessions = /* @__PURE__ */ new Map();
-  // Per-entity counter keyed by `${entityType}:${entityId}`.
-  // Monotonic and ephemeral: resets on server restart per CONTEXT D-30.
-  // Never decremented on terminate — a re-open of a terminated entity yields
-  // the next number so "Session #3" after "#2" ends does not confuse users.
+  // Monotonic per entity and reset on restart, so a reopened entity gets the next number.
   counters = /* @__PURE__ */ new Map();
   async createSession(config, entity) {
     if (!config.llmConfig) {
@@ -11631,7 +11256,8 @@ var SessionManager = class {
 };
 
 // src/live-editor/ws-handler.ts
-var import_agent_qa_core14 = require("@vostride/agent-qa-core");
+var import_node_util4 = require("node:util");
+var import_agent_qa_core15 = require("@vostride/agent-qa-core");
 
 // src/live-editor/types.ts
 var LIVE_EDITOR_UNKNOWN_SESSION_CLOSE_CODE = 4404;
@@ -11818,12 +11444,14 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
             try {
               raw = await testFileManager.read(msg.path);
             } catch (readErr) {
-              console.error(`[ws-handler] execute-test: read failed for path=${msg.path}`, readErr);
+              const line = `[ws-handler] execute-test: read failed for path=${msg.path}`;
+              (0, import_agent_qa_core15.printRunText)((0, import_node_util4.format)(line, readErr), () => console.error(line, readErr));
               throw new Error(`Cannot read test file "${msg.path}": ${readErr?.message ?? String(readErr)}`);
             }
-            const parsed = (0, import_agent_qa_core14.parseTestFile)(raw, msg.path);
+            const parsed = (0, import_agent_qa_core15.parseTestFile)(raw, msg.path);
             if (parsed.errors.length > 0) {
-              console.error(`[ws-handler] execute-test: parse errors for ${msg.path}`, parsed.errors);
+              const line = `[ws-handler] execute-test: parse errors for ${msg.path}`;
+              (0, import_agent_qa_core15.printRunText)((0, import_node_util4.format)(line, parsed.errors), () => console.error(line, parsed.errors));
               throw new Error(`Parse error in ${msg.path}: ${parsed.errors[0].message}`);
             }
             const testDef = parsed.tests[0];
@@ -11833,7 +11461,13 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
             const stepInstructions = testDef.steps.map(
               (s) => typeof s === "string" ? s : s.step
             );
-            console.log(`[ws-handler] execute-test: starting "${testDef.name}" (${stepInstructions.length} steps, setup=${(testDef.setup ?? []).length}, teardown=${(testDef.teardown ?? []).length})`);
+            const stepCount = stepInstructions.length;
+            const setupCount = (testDef.setup ?? []).length;
+            const teardownCount = (testDef.teardown ?? []).length;
+            (0, import_agent_qa_core15.printRunText)(
+              `[ws-handler] execute-test: starting "${testDef.name}" (${stepCount} steps, setup=${setupCount}, teardown=${teardownCount})`,
+              (text) => console.log(text)
+            );
             reply({
               type: "test-start",
               test: {
@@ -11855,7 +11489,11 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
                 teardown: testDef.teardown ?? []
               }
             );
-            console.log(`[ws-handler] execute-test: finished "${testDef.name}" status=${result.status} duration=${result.duration}ms${result.error ? ` error=${result.error}` : ""}`);
+            const errorPart = result.error ? ` error=${result.error}` : "";
+            (0, import_agent_qa_core15.printRunText)(
+              `[ws-handler] execute-test: finished "${testDef.name}" status=${result.status} duration=${result.duration}ms${errorPart}`,
+              (text) => console.log(text)
+            );
             reply({
               type: "test-complete",
               test: {
@@ -11868,11 +11506,9 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
             });
             reply({ type: "session-state", state: session.getState() });
           } catch (err) {
-            console.error(`[ws-handler] execute-test: caught error for path=${msg.path}`, {
-              message: err?.message,
-              stack: err?.stack,
-              code: err?.code
-            });
+            const line = `[ws-handler] execute-test: caught error for path=${msg.path}`;
+            const detail = { message: err?.message, stack: err?.stack, code: err?.code };
+            (0, import_agent_qa_core15.printRunText)((0, import_node_util4.format)(line, detail), () => console.error(line, detail));
             reply({
               type: "test-error",
               test: {
@@ -12023,11 +11659,9 @@ var LIVE_EMBED_STATES = [
   "no-stream",
   "expired",
   "refused",
-  // THIS MEMBER'S STREAM ENDED WHILE THE RUN CONTINUES (403 CR-03). Separate the whole run's end,
-  // because a person watching one member of a suite needs to know which of the two happened — and
-  // neither may be shown as `live` over whichever frame happened to be last.
+  // This member's stream ended while the run continues, so the viewer knows which one ended.
   "stream-ended",
-  // AN EDITOR SESSION ENDED (428 D-07/D-09). An editor subject has no run to end.
+  // An editor session ended; an editor subject has no run to end.
   "session-ended",
   "ended",
   "lost"
@@ -12156,8 +11790,7 @@ function renderLiveEmbedPage(input) {
       if (pending === null) return;
       var header = pending;
       pending = null;
-      // NO MIME TYPE: the decoder sniffs the bytes, so a JPEG screencast frame and a PNG snapshot
-      // both paint in every host, not only in Chromium (428 RESEARCH A2).
+      // No MIME type: the decoder sniffs, so JPEG and PNG frames paint in every host.
       var blob = new Blob([event.data]);
       createImageBitmap(blob).then(function (bitmap) {
         if (canvas.width !== header.width || canvas.height !== header.height) {
@@ -12181,8 +11814,7 @@ function renderLiveEmbedPage(input) {
     try { msg = JSON.parse(event.data); } catch (e) { return; }
 
     if (msg.type === 'ready') {
-      // THE PAINTER IS CHOSEN BY THE DECLARED KIND \u2014 never by a browser name, an adapter class or
-      // a transport guess (LIVE-04's prohibition). A snapshot paints on the same canvas (428 D-11).
+      // The declared kind picks the painter, never a browser name, adapter or transport guess.
       var kind = msg.stream ? msg.stream.kind : undefined;
       if (kind === 'cdp-screencast' || kind === 'snapshot') {
         setState('connecting', 'waiting for the first frame\u2026');
@@ -12229,8 +11861,7 @@ function renderLiveEmbedPage(input) {
     report({ event: 'lost' });
   });
 
-  // A HOST THAT RE-MINTS replaces the fragment; the socket renews in place rather than reloading,
-  // so a renewal never costs the viewer the stream it is watching (D-02).
+  // A re-minting host replaces the fragment; the socket renews in place and the stream continues.
   window.addEventListener('hashchange', function () {
     var next = location.hash.slice(1);
     if (next === '' || socket.readyState !== 1) return;
@@ -12439,7 +12070,7 @@ function createFrameProxy(deps) {
 }
 
 // src/server/server.ts
-var import_agent_qa_core15 = require("@vostride/agent-qa-core");
+var import_agent_qa_core16 = require("@vostride/agent-qa-core");
 var MIME_TYPES = {
   ".html": "text/html; charset=utf-8",
   ".js": "application/javascript",
@@ -12458,9 +12089,10 @@ var MIME_TYPES = {
   ".webp": "image/webp"
 };
 var DashboardRemoteBindRefusedError = class extends Error {
-  constructor(host) {
+  constructor(host, port) {
+    const p = String(port === 0 ? 3470 : port);
     super(
-      `The dashboard was asked to bind ${host}, which is not a loopback interface. Nothing this server serves \u2014 the run trigger, the queue enqueue, the run service, the artifact serving, the config reads \u2014 asks for a credential, so a non-loopback bind would publish an anonymous run trigger to the network. Leave services.dashboard.host unset (it defaults to ${DEFAULT_DASHBOARD_HOST}), and reach a remote dashboard through an authenticating proxy or a tunnel you control.`
+      `The dashboard was asked to bind ${host}, which is not a loopback interface. Nothing this server serves \u2014 the run trigger, the queue enqueue, the run service, the artifact serving, the config reads \u2014 asks for a credential, so a non-loopback bind would publish an anonymous run trigger to the network. Leave services.dashboard.host unset (it defaults to ${DEFAULT_DASHBOARD_HOST}). To use the dashboard from another machine, forward its port with ssh -L ${p}:localhost:${p} <host> and open http://localhost:${p}/.`
     );
     this.host = host;
     this.name = "DashboardRemoteBindRefusedError";
@@ -12471,8 +12103,8 @@ async function startServer(opts) {
   const { db, port = 3470, uiDir, workspacePaths, configPath, llmConfig, authFetch, agentHost, executionBackend, runService, runServiceReadiness, liveView, liveEditorSubjects, postProcessingRelay } = opts;
   const runServiceAttach = opts.runServiceAttach ?? runService?.attach;
   const host = opts.host?.trim() || DEFAULT_DASHBOARD_HOST;
-  if (!(0, import_agent_qa_core15.isLoopbackHost)(host)) {
-    throw new DashboardRemoteBindRefusedError(host);
+  if (!(0, import_agent_qa_core16.isLoopbackHost)(host)) {
+    throw new DashboardRemoteBindRefusedError(host, port);
   }
   const resolvedConfigPath = configPath ?? (0, import_node_path12.resolve)("agent-qa.config.yaml");
   const configManager = new ConfigManager(resolvedConfigPath, opts.declaredSecretMask);
@@ -12507,7 +12139,7 @@ async function startServer(opts) {
           failureSummary = "Test timed out -- process was killed";
         } else if (details.refusedBeforeStart) {
           dbStatus = "failed";
-          refusalProse = details.neutralReason ?? details.reason;
+          refusalProse = details.reason;
           failureSummary = refusalProse ? `Refused before the run started: ${refusalProse}`.slice(0, 300) : "Refused before the run started";
         } else if (status === "completed") {
           dbStatus = "failed";
@@ -12588,7 +12220,10 @@ async function startServer(opts) {
         mobileRuns.set(run.id, platform);
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        console.error(`Failed to start Appium for run ${run.id}: ${message}`);
+        (0, import_agent_qa_core16.printRunText)(
+          `Failed to start Appium for run ${run.id}: ${message}`,
+          (text) => console.error(text)
+        );
         db.updateRun(run.id, {
           status: "failed",
           failureSummary: `Appium server failed to start: ${message}`,
@@ -12608,19 +12243,9 @@ async function startServer(opts) {
       runId: run.id,
       args,
       source: meta.isSuite ? "suite" : "dashboard",
-      // 2026-10-01 (432-14, D-14): no confirm scope is read off the row any more. The browser that
-      // triggered a run is not asked anything, so nothing about it has to survive the wait.
       attributes: run.attributes,
-      // T-401-G26 (401-23): a persisted row's timeout is VALIDATED at the seam that consumes it.
-      // `in-process-backend.ts:211` reads `opts.timeout ?? defaultTimeout` and validates AFTER, so
-      // any non-nullish nonsense here skips the default and leaves the run with no reclamation
-      // timer at all. An unusable value falls back to the backend's default rather than a number
-      // this call invented.
+      // The backend takes `opts.timeout ?? defaultTimeout`, so an unusable value falls back here.
       timeout: sanitizeQueuedExecutionTimeout(meta.timeout),
-      // THE LEASE ABOVE IS UNCHANGED; ONLY ITS DELIVERY IS. `acquireLease` still runs where it ran,
-      // still keys on this run id and still owns the bundled Appium's lifecycle (design-of-record).
-      // What used to ride `AGENT_QA_APPIUM_URL` in a child's environment now travels as an
-      // argument, because there is no child to carry an environment.
       ...isMobile ? { appiumUrl: appiumManager.getUrl() } : {}
     });
   });
@@ -12631,16 +12256,14 @@ async function startServer(opts) {
     appiumManager,
     configManager,
     configPath: resolvedConfigPath,
-    // 428 D-07: each created session registers here, which is what the frame socket attaches.
+    // Each created session registers here, which is what the frame socket attaches.
     ...liveEditorSubjects === void 0 ? {} : { liveEditorSubjects }
   });
   const servesLiveView = liveView !== void 0 && (runServiceAttach !== void 0 || liveEditorSubjects !== void 0);
   const apiRouter = createRouter({
     db,
     workspacePaths,
-    // 401-07: conditionally spread on the same house rule `agentHost` follows — an absent
-    // dependency is an ABSENT field, never a present `undefined`, so the router's own 503 arm is
-    // what decides, in one place.
+    // Absent dependencies are absent fields, so the router's own 503 arm decides in one place.
     ...executionBackend === void 0 ? {} : { executionBackend },
     jobQueue,
     testFileManager,
@@ -12651,27 +12274,13 @@ async function startServer(opts) {
     llmConfig,
     authFetch,
     sessionManager,
-    // 400-01: conditionally spread on the house rule an absent dependency is an ABSENT field and
-    // never a present `undefined` — the router's own 501 arm is what decides, in one place.
+    // Absent dependencies are absent fields, so the router's own 501 arm decides in one place.
     ...agentHost === void 0 ? {} : { agentHost },
-    // 402-05 (D-15): the same conditional-spread house rule. Absent means a legacy mount rather
-    // than an unconfigured service, and the router's own 503 arm is what decides, in one place.
     ...runServiceReadiness === void 0 ? {} : { runServiceReadiness },
-    // 402-08 (D-01): the LOCAL run-stream door's attach port, READ OFF `runService` rather than
-    // composed again. That derivation is the "one session registry serves both doors" claim in its
-    // structural form — there is no second wiring a composition root could forget or point
-    // somewhere else, and the two doors cannot end up attached to different registries. Absent
-    // `runService` means no registry exists at all, so the same conditional-spread house rule
-    // applies and the router's own 503 arm decides.
+    // Read off `runService` by default, so both doors attach to one session registry.
     ...runServiceAttach === void 0 ? {} : { runServiceAttach },
-    // 403 D-03: the mint route's port, on the same conditional-spread house rule — absent means
-    // this host serves no live view and the route's own 503 arm decides, in one place.
     ...liveView === void 0 ? {} : { mintLiveUrl: liveView.mintLiveUrl },
-    // 428 D-07: the editor mint, on the same house rule — absent means the editor mint route's own
-    // 503 decides.
     ...liveView?.mintEditorLiveUrl === void 0 ? {} : { mintEditorLiveUrl: liveView.mintEditorLiveUrl },
-    // 404-05 (D-16): the same conditional-spread house rule — absent means this host serves no
-    // post-processing push channel and the stream arm's own 503 decides, in one place.
     ...postProcessingRelay === void 0 ? {} : { postProcessingRelay }
   });
   const runServiceRouter = runService === void 0 ? void 0 : createRunServiceRoutes(runService);
@@ -12691,13 +12300,15 @@ async function startServer(opts) {
         apiRouter(req, res);
         return;
       }
+      if (refuseNonLoopbackHost(req) !== void 0) {
+        const address = server.address();
+        const boundPort = typeof address === "object" && address !== null ? address.port : port;
+        refuseForeignHostPage(res, boundPort);
+        return;
+      }
       if (req.method === "OPTIONS") {
-        res.writeHead(204, {
-          "Access-Control-Allow-Origin": "*",
-          "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-          "Access-Control-Allow-Headers": "Content-Type"
-        });
-        res.end();
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("Not Found");
         return;
       }
       if (req.method === "GET" && path.startsWith(LIVE_EMBED_PATH_PREFIX)) {
@@ -12741,8 +12352,7 @@ async function startServer(opts) {
             const contentType = MIME_TYPES[ext] || "application/octet-stream";
             res.writeHead(200, {
               "Content-Type": contentType,
-              "Content-Length": content.length,
-              "Access-Control-Allow-Origin": "*"
+              "Content-Length": content.length
             });
             res.end(content);
             return;
@@ -12754,8 +12364,7 @@ async function startServer(opts) {
           const content = await (0, import_promises9.readFile)(indexPath);
           res.writeHead(200, {
             "Content-Type": "text/html",
-            "Content-Length": content.length,
-            "Access-Control-Allow-Origin": "*"
+            "Content-Length": content.length
           });
           res.end(content);
           return;
@@ -12840,7 +12449,8 @@ async function startServer(opts) {
         session.clearIdleTimer();
         const handler = createSessionHandler(session, () => {
           void sessionManager.terminateSession(sessionId).catch((error) => {
-            console.error(`[live-editor] could not end session ${sessionId}`, error);
+            const line = `[live-editor] could not end session ${sessionId}`;
+            (0, import_agent_qa_core16.printRunText)((0, import_node_util5.format)(line, error), () => console.error(line, error));
           });
         }, (event) => {
           db.insertTokenEvent(event);
@@ -12873,7 +12483,7 @@ async function startServer(opts) {
     server.listen(port, host, () => {
       server.off("error", onError);
       console.log(
-        (0, import_agent_qa_core15.isLoopbackHost)(host) ? `Dashboard running at http://localhost:${port}` : `Dashboard running at http://${host.includes(":") ? `[${host}]` : host}:${port}`
+        (0, import_agent_qa_core16.isLoopbackHost)(host) ? `Dashboard running at http://localhost:${port}` : `Dashboard running at http://${host.includes(":") ? `[${host}]` : host}:${port}`
       );
       resolve7({
         server,
@@ -12930,9 +12540,6 @@ var InProcessExecutionBackend = class extends import_node_events2.EventEmitter {
     this.options = options;
     this.retentionMs = options.retentionMs ?? DEFAULT_HANDLE_RETENTION_MS;
   }
-  async preflight(opts) {
-    await this.options.preflightRun?.(opts);
-  }
   execute(opts) {
     const handle = {
       runId: opts.runId,
@@ -13008,9 +12615,7 @@ var InProcessExecutionBackend = class extends import_node_events2.EventEmitter {
   settle(handle, error) {
     if (handle.timeoutTimer) clearTimeout(handle.timeoutTimer);
     let refusedBeforeStart = false;
-    let neutralReason;
     if (error !== void 0) {
-      neutralReason = dashboardNeutralReasonOf(error);
       const message = error instanceof Error ? error.message : String(error);
       for (const line of message.split("\n")) handle.output.push(line);
       refusedBeforeStart = handle.session === void 0;
@@ -13024,7 +12629,6 @@ var InProcessExecutionBackend = class extends import_node_events2.EventEmitter {
     const details = {
       ...handle.completionReason === void 0 ? {} : { reason: handle.completionReason },
       ...refusedBeforeStart ? { refusedBeforeStart: true } : {},
-      ...neutralReason === void 0 ? {} : { neutralReason },
       output: [...handle.output]
     };
     this.emit("run-settled", handle.runId, handle.status, details);
@@ -13034,12 +12638,6 @@ var InProcessExecutionBackend = class extends import_node_events2.EventEmitter {
     cleanup.unref();
   }
 };
-function dashboardNeutralReasonOf(error) {
-  if (typeof error !== "object" || error === null) return void 0;
-  const carried = error.neutralReason;
-  if (typeof carried !== "string" || carried.trim().length === 0) return void 0;
-  return carried;
-}
 function createInProcessExecutionBackend(options) {
   return new InProcessExecutionBackend(options);
 }
@@ -13175,7 +12773,6 @@ function createLiveEditorSubjects() {
   renderLiveEmbedPage,
   resolveDashboardDbPath,
   resolveRunOwnerHost,
-  runDenialOf,
   runRowIdentity,
   serializeConfigWrite,
   servePostProcessingRead,