@vostride/agent-qa-dashboard 0.2.2 → 0.2.4

package/dist/index.js

@@ -24,7 +24,6 @@ var MIGRATIONS = [
         llm_provider TEXT,
         parallel INTEGER DEFAULT 0,
         error_log TEXT,
-        memory_log TEXT,
         test_id TEXT,
         suite_id TEXT,
         owner_pid INTEGER,
@@ -47,9 +46,7 @@ var MIGRATIONS = [
         variables TEXT,
         created_at TEXT DEFAULT CURRENT_TIMESTAMP,
         hook_id TEXT,
-        -- 405 D-01: where in the run tree this hook ran. Sourced from HookFinishedPayload's own
-        -- optional testIndex/stepIndex; NULL means a run-scoped hook, which is a real state and
-        -- not a missing value.
+        -- Where in the run tree this hook ran; NULL means a run-scoped hook, not a missing value.
         test_index INTEGER,
         step_index INTEGER
       )`,
@@ -63,10 +60,7 @@ var MIGRATIONS = [
       )`,
       `CREATE TABLE IF NOT EXISTS run_artifacts (
         run_id TEXT PRIMARY KEY REFERENCES runs(id) ON DELETE CASCADE,
-        -- 2026-08-27 (405-07, RESEARCH Open Q4): TWO KINDS, because two is all anything mints.
-        -- The set used to admit two more, named for the parent/child run tree 402-09 retired; no
-        -- writer has produced either since, so admitting them was the schema agreeing to store a
-        -- distinction the product no longer makes.
+        -- Two kinds, because no writer mints any other.
         kind TEXT NOT NULL CHECK(kind IN ('test', 'unknown')),
         schema_version INTEGER NOT NULL,
         payload TEXT NOT NULL DEFAULT '{}',
@@ -74,17 +68,7 @@ var MIGRATIONS = [
         created_at TEXT DEFAULT CURRENT_TIMESTAMP,
         updated_at TEXT DEFAULT CURRENT_TIMESTAMP
       )`,
-      // ---- The v2 bus-shaped projection (405 D-01) ----------------------------------------
-      //
-      // THE COLUMNS ARE THE PAYLOAD'S OWN NAMES, snake_cased and nothing else. No field is
-      // re-derived, renamed or re-interpreted on the way in — that is D-01's whole claim, and
-      // it is what makes the read a mirror rather than a second opinion. Nested payload objects
-      // (`planned_action`, `grounding`, `result`, `artifact_refs`) are `JSON.stringify` of the
-      // field VERBATIM; the projection never reaches inside one.
-      //
-      // `test_index` IS THE HANDLE (RESEARCH D4). `handleId(runId, testIndex)` is how this
-      // product spells run-scoped member identity, so minting a second id here would be a
-      // second spelling of the same fact.
+      // Columns are the payload's names snake_cased; `test_index` is the handle, so no second id.
       `CREATE TABLE IF NOT EXISTS run_members (
         run_id TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
         test_index INTEGER NOT NULL,
@@ -99,15 +83,12 @@ var MIGRATIONS = [
         duration_ms INTEGER,
         failure_summary TEXT,
         retry_count INTEGER,
-        -- D-17 ordinal. Starts at 1 and rises on testRetryScheduled; never reset by an upsert.
+        -- Starts at 1 and rises on testRetryScheduled; never reset by an upsert.
         attempts INTEGER NOT NULL DEFAULT 1,
         recording_json TEXT,
         PRIMARY KEY (run_id, test_index)
       )`,
-      // The token columns are NULLABLE AND NEVER DEFAULT 0 (D-05/D-06). The retired v1 projection
-      // declared these `INTEGER DEFAULT 0`, and that zero was a measurement nobody made — the exact
-      // lie this shape refuses to be able to tell. 405-04 landed the producer, so a step the runner
-      // measured carries real counts and a step it did not carries NULL, which stays honest.
+      // Token columns are nullable with no default, so a step nobody measured carries NULL, not 0.
       `CREATE TABLE IF NOT EXISTS run_steps (
         run_id TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
         test_index INTEGER NOT NULL,
@@ -638,9 +619,7 @@ var DashboardDatabase = class {
     if (owner) this.ownStamps.set(id, owner);
     return id;
   }
-  // 2026-10-17 (443-02, D-07): one statement that inserts a fresh row or adopts this handle's own
-  // running row; any other row is refused and left untouched. An adopt that names no name or
-  // attributes keeps the row's own (443-04).
+  // Inserts a fresh row or adopts this handle's own running row; any other row is left untouched.
   claimRunningRow(id, fields) {
     const stamp = this.ownStamps.get(id) ?? this.readOwnStamp();
     const result = this.db.prepare(`
@@ -709,10 +688,6 @@ var DashboardDatabase = class {
       fields.push("error_log = ?");
       values.push(updates.errorLog);
     }
-    if (updates.memoryLog !== void 0) {
-      fields.push("memory_log = ?");
-      values.push(updates.memoryLog);
-    }
     if (updates.attributes !== void 0) {
       fields.push("attributes = ?");
       values.push(JSON.stringify(updates.attributes));
@@ -815,26 +790,8 @@ var DashboardDatabase = class {
     this.ownStamps.set(id, stamp);
     return true;
   }
-  // ---- The v2 bus-shaped projection (Phase 405 plan 01, D-01) ---------------------------------
-  //
-  // SIX MEMBERS, AND EVERY ONE OF THEM MIRRORS. The columns are the bus payload's own names; the
-  // nested objects are `JSON.stringify` of the field verbatim. Nothing in this block decides what
-  // a status means, re-derives a duration or fills a token count — a projection that interpreted
-  // would be a second opinion about a run the event log already settled.
-  /**
-   * Write or refresh ONE member row, keyed by the handle `(run_id, test_index)`.
-   *
-   * AN UPSERT AND NOT TWO WRITES, because the member row is fed by two events at two times:
-   * `testStarted` knows the identity fields and `testFinished` knows the outcome — and D-18
-   * requires a member whose stream begins with a terminal event to render anyway, so the second
-   * one alone has to be able to create the row.
-   *
-   * ONLY SUPPLIED FIELDS MOVE. `COALESCE(excluded.x, run_members.x)` on every optional column, so
-   * a `testFinished` that carries no name cannot blank the name `testStarted` wrote. `attempts` is
-   * excluded from the update entirely: it is the D-17 retry ordinal, owned by
-   * `incrementRunMemberAttempts`, and an upsert that reset it would erase the fact the header
-   * renders.
-   */
+  // The projection mirrors bus payload names verbatim and interprets nothing.
+  // An upsert because a member's first event may be terminal; `COALESCE` keeps unsupplied fields.
   upsertRunMember(member) {
     this.db.prepare(`
       INSERT INTO run_members (
@@ -872,26 +829,13 @@ var DashboardDatabase = class {
       member.recording === void 0 ? null : JSON.stringify(member.recording)
     );
   }
-  /**
-   * Raise ONE member's attempt ordinal (D-17). A no-op when the member row does not exist yet —
-   * a retry scheduled before any identity event is a real ordering, and inventing a row here
-   * would put a member on the page that nothing has said anything about.
-   */
+  // A no-op without a member row, so a retry before any identity event adds no member.
   incrementRunMemberAttempts(runId, testIndex) {
     this.db.prepare(
       "UPDATE run_members SET attempts = attempts + 1 WHERE run_id = ? AND test_index = ?"
     ).run(runId, testIndex);
   }
-  /**
-   * Drop ONE HANDLE's projected step and sub-action rows (D-17).
-   *
-   * SCOPED TO THE HANDLE, which was the whole change from the v1 run-wide step delete this
-   * replaced (deleted outright by 405-07's census): that member wiped every step of the RUN on any
-   * member's retry, so in a suite the abandoned attempt of test 3 deleted the completed history of
-   * tests 0-2. The member row itself survives — its outcome and its attempt count are facts about
-   * the member, not about the attempt. So do its setup and teardown hook rows, which run once per
-   * member outside the retry loop; only the attempt's `inline` hook rows go (433-41, CR-01).
-   */
+  // Scoped to the handle: the member row and its setup and teardown hooks survive a retry.
   deleteMemberProjection(runId, testIndex) {
     this.db.prepare("DELETE FROM run_steps WHERE run_id = ? AND test_index = ?").run(runId, testIndex);
     this.db.prepare("DELETE FROM run_sub_actions WHERE run_id = ? AND test_index = ?").run(runId, testIndex);
@@ -899,12 +843,7 @@ var DashboardDatabase = class {
       "DELETE FROM execution_logs WHERE run_id = ? AND test_index = ? AND phase = 'inline'"
     ).run(runId, testIndex);
   }
-  /**
-   * Write ONE finalized step row. `INSERT OR REPLACE` because a re-run of the same handle re-emits
-   * the same `(test_index, step_index)` and the LAST attempt is the one the page renders (D-17).
-   *
-   * The three token columns stay NULL when `tokenUsage` is absent — never 0 (D-05).
-   */
+  // `INSERT OR REPLACE`, so a re-run's last attempt wins; tokens stay NULL when absent, never 0.
   insertRunStep(step) {
     this.db.prepare(`
       INSERT OR REPLACE INTO run_steps (
@@ -964,14 +903,7 @@ var DashboardDatabase = class {
       subAction.recordingOffsetMs ?? null
     );
   }
-  /**
-   * THE run-detail read (D-03). `undefined` when no `runs` row exists — absence is a RESULT here,
-   * and turning it into a typed refusal is the `runs.detail` op's job, so the "not found"
-   * vocabulary lives in the function layer rather than in this store.
-   *
-   * A run that exists and projected nothing answers three empty arrays, which is a DIFFERENT fact
-   * and stays a different answer.
-   */
+  // `undefined` when no run row exists; a run that projected nothing answers three empty arrays.
   readRunDetailRows(runId) {
     const run = this.db.prepare("SELECT id FROM runs WHERE id = ?").get(runId);
     if (run === void 0) return void 0;
@@ -1111,7 +1043,7 @@ var DashboardDatabase = class {
       offset: opts.offset
     }));
   }
-  // 2026-10-17 (444-05, D-09): one batched member read per 400 returned rows, after pagination.
+  // Members are read for the returned rows only, after pagination.
   withMemberSummaries(runs) {
     for (let offset = 0; offset < runs.length; offset += 400) {
       const batch = runs.slice(offset, offset + 400);
@@ -1154,7 +1086,7 @@ var DashboardDatabase = class {
       owner: { pid: row.owner_pid, incarnation: row.owner_incarnation, host: row.owner_host ?? "" }
     }));
   }
-  // 2026-10-16 (442-01, D-04): one compare-and-set on the stamped owner; never read-then-write.
+  // One compare-and-set on the stamped owner; never read-then-write.
   finalizeOwnRun(id, updates) {
     const fields = ["status = ?", "ended_at = ?"];
     const values = [updates.status, updates.endedAt];
@@ -1176,8 +1108,7 @@ var DashboardDatabase = class {
     this.ownStamps.delete(id);
     return true;
   }
-  // 2026-10-17 (443-13, GAP-D1; 444-04): no status condition, because the verdict may already have
-  // moved the row off running; the owner columns alone decide whose row it is.
+  // No status condition, as the verdict may have moved the row off running; owner columns decide.
   closeOwnRun(id, updates) {
     const stamp = this.ownStamps.get(id) ?? this.readOwnStamp();
     const result = this.db.prepare(`
@@ -1188,8 +1119,7 @@ var DashboardDatabase = class {
     this.ownStamps.delete(id);
     return true;
   }
-  // 2026-10-16 (442-15, GAP-D2): own is the stamp this handle wrote, so a NULL start time here is
-  // this handle's own write, never an inference about another process.
+  // Own is the stamp this handle wrote, so a NULL start time here is this handle's own write.
   isOwnStamp(id, owner) {
     const stamp = this.ownStamps.get(id);
     return stamp !== void 0 && stamp.pid === owner.pid && stamp.incarnation === owner.incarnation && stamp.host === owner.host;
@@ -1288,20 +1218,7 @@ var DashboardDatabase = class {
     `).all(...params);
     return rows.map((row) => ({ value: row.value, count: row.count }));
   }
-  /**
-   * Delete ONE run and everything the schema hangs off it (405-07, D-02/D-14 · T-405-27).
-   *
-   * ONE ID, AND THE CASCADE DOES THE REST. This used to open with a recursive `run_tree` CTE that
-   * walked the child rows of a suite parent, then hand-delete their step and trace rows in a
-   * transaction. Nothing has written a child row since 402-09 — one `runs` row per run, member
-   * identity on `run_members` — so the walk could only ever return the one row it was seeded with,
-   * and the hand-deletes named tables this schema no longer has. Every table that references a run
-   * declares `ON DELETE CASCADE`, so the single statement below is the whole deletion.
-   *
-   * AND IT TOUCHES NO FILE. The two path arrays it used to collect fed the router's artifact
-   * cleanup; both are gone. The run's directory under `.agent-qa/runs/` — its event log and its
-   * content-addressed blobs — is the run's own record and is not the dashboard's to remove.
-   */
+  // Every table referencing a run cascades on delete, and no file is touched.
   deleteRun(id) {
     const changes = this.db.prepare("DELETE FROM runs WHERE id = ?").run(id);
     const deleted = Number(changes.changes ?? 0) > 0;
@@ -1388,15 +1305,7 @@ var DashboardDatabase = class {
   getRunArtifactBundle(runId) {
     return { artifact: this.getRunArtifact(runId) };
   }
-  /**
-   * The runs a self-heal happened on (405-07, D-02).
-   *
-   * READ OFF `run_steps.self_heal_occurred`, WHICH IS THE SURVIVING HEALING FACT. This scanned the
-   * v1 wide step table for `status = 'healed'`; that table had no producer left and its readers
-   * went with it. `selfHealOccurred` is the bus payload's own boolean, projected verbatim by the
-   * subscriber — so the flake rate below is now computed from what the runner actually reported
-   * rather than from a status word a retired projection wrote.
-   */
+  // Read off `run_steps.self_heal_occurred`, the bus payload's own boolean.
   getHealedRunIds(runIds) {
     if (runIds.length === 0) return /* @__PURE__ */ new Set();
     const placeholders = runIds.map(() => "?").join(", ");
@@ -1419,7 +1328,7 @@ var DashboardDatabase = class {
       passed,
       failed,
       flaky,
-      // 2026-10-18 (444-24, D-59): a group's rate is passed ÷ (passed + failed); neither is no rate.
+      // A group's rate is passed ÷ (passed + failed); neither is no rate.
       passRate: passed + failed > 0 ? passed / (passed + failed) : null,
       flakeRate: totalRuns > 0 ? flaky / totalRuns : 0,
       avgDuration: totalRuns > 0 ? totalDuration / totalRuns : 0
@@ -1481,28 +1390,6 @@ var DashboardDatabase = class {
           FROM run_steps
           WHERE run_id IN (${runIds.map(() => "?").join(",")})
         `).get(...runIds).total_tokens || 0 : 0;
-    const memorySummary = {
-      runs: 0,
-      added: 0,
-      confirmed: 0,
-      deprecated: 0,
-      deleted: 0,
-      curatorTokens: 0
-    };
-    for (const run of runs) {
-      if (!run.memoryLog) continue;
-      memorySummary.runs++;
-      try {
-        const parsed = JSON.parse(run.memoryLog);
-        memorySummary.added += Number(parsed.added ?? 0) || 0;
-        memorySummary.confirmed += Number(parsed.confirmed ?? 0) || 0;
-        memorySummary.deprecated += Number(parsed.deprecated ?? 0) || 0;
-        memorySummary.deleted += Number(parsed.deleted ?? 0) || 0;
-        const tokenUsage = parsed.tokenUsage && typeof parsed.tokenUsage === "object" ? parsed.tokenUsage : {};
-        memorySummary.curatorTokens += Number(tokenUsage.totalTokens ?? 0) || 0;
-      } catch {
-      }
-    }
     return {
       totalRuns: summary.totalRuns,
       passed: summary.passed,
@@ -1511,8 +1398,7 @@ var DashboardDatabase = class {
       flakeRate: summary.flakeRate,
       avgDuration: summary.avgDuration,
       totalTokens,
-      runs: daily,
-      memory: memorySummary
+      runs: daily
     };
   }
   getCostStats(opts = {}) {
@@ -1687,12 +1573,7 @@ var DashboardDatabase = class {
       testRunUnmeasuredSteps: unmeasuredSteps
     };
   }
-  /**
-   * The window's settled run ids, newest first, capped at `limit`, with their full count, and the
-   * count of the window's runs still in flight (433-30, 433-42). A settled run has started and is
-   * neither `pending` nor `running`; every other row in the window is in flight. Ids only: the
-   * Insights knowledge-change read dispatches each through the agent host.
-   */
+  // Settled run ids newest first, capped at `limit`, with the full and in-flight counts.
   listInsightsWindowRunIds(opts) {
     const conditions = [];
     const params = [];
@@ -1848,7 +1729,7 @@ var DashboardDatabase = class {
     const limit = opts.limit ?? 25;
     return rows.slice(0, limit);
   }
-  // 2026-10-17 (444-05, D-35): grouped by member file path; only pass- and fail-class outcomes count.
+  // Grouped by member file path; only pass- and fail-class outcomes count.
   getFlakyTests(opts) {
     const minRuns = opts?.minRuns ?? 3;
     const limit = opts?.limit ?? 50;
@@ -1973,7 +1854,6 @@ var DashboardDatabase = class {
       endedAt: r.ended_at,
       failureSummary: r.failure_summary ?? null,
       errorLog: r.error_log ?? null,
-      memoryLog: r.memory_log ?? null,
       testId: r.test_id ?? null,
       suiteId: r.suite_id ?? null,
       platform: r.platform ?? "web",
@@ -2301,11 +2181,7 @@ function createDashboardRunIngest(deps) {
         ...payload.status === void 0 ? {} : { status: payload.status },
         ...payload.durationMs === void 0 ? {} : { durationMs: payload.durationMs },
         ...payload.error === void 0 ? {} : { error: payload.error },
-        // 2026-08-27 (405 plan 04, D-05/D-06): the producer landed this plan, so the three token
-        // columns 405-01 declared stop being always-NULL. Spread-when-defined, like every other
-        // optional above it — the DB layer writes NULL for all three when the key is absent, and
-        // a NULL row is what makes `runs.detail` able to say "M of K steps unmeasured" instead of
-        // reporting a zero nobody measured.
+        // Spread when defined, so an unmeasured step stays NULL and `runs.detail` counts it so.
         ...payload.tokenUsage === void 0 ? {} : { tokenUsage: payload.tokenUsage },
         ...payload.modelUsage === void 0 ? {} : { modelUsage: payload.modelUsage },
         ...payload.evidence === void 0 ? {} : { evidence: payload.evidence },
@@ -2355,8 +2231,7 @@ function createDashboardRunIngest(deps) {
         stdout: readString(payload.stdout) ?? null,
         stderr: readString(payload.stderr) ?? null,
         variables: payload.variables ?? null,
-        // 405 D-01: where in the run tree this hook ran. Absent stays NULL — a run-scoped hook
-        // is a real state, and inventing handle 0 for it would put a setup hook inside a test.
+        // Absent stays NULL: a run-scoped hook is a real state, not handle 0.
         ...payload.testIndex === void 0 ? {} : { testIndex: payload.testIndex },
         ...payload.stepIndex === void 0 ? {} : { stepIndex: payload.stepIndex }
       });
@@ -2451,14 +2326,15 @@ function createDashboardRunIngest(deps) {
 // src/server/server.ts
 import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
-import { readFile as readFile8, stat as stat7 } from "node:fs/promises";
-import { join as join5, extname, resolve as resolve6 } from "node:path";
+import { readFile as readFile8, stat as stat6 } from "node:fs/promises";
+import { join as join4, extname, resolve as resolve6 } from "node:path";
 import { cpus as cpus2 } from "node:os";
+import { format as format3 } from "node:util";
 
 // src/server/routes.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { readFile as readFile6, writeFile as writeFile4, stat as stat5, readdir, rm as rm5 } from "node:fs/promises";
-import { join as join4, isAbsolute as isAbsolute2, basename as basename5, resolve as resolve5, dirname as dirname9 } from "node:path";
+import { readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, basename as basename5, resolve as resolve5, dirname as dirname9 } from "node:path";
 
 // src/tests/test-file-manager.ts
 import { readFile, mkdir, rm as rm2, stat as stat2 } from "node:fs/promises";
@@ -2631,7 +2507,7 @@ var TestFileManager = class {
   constructor(workspace) {
     this.workspace = workspace;
   }
-  // 2026-10-18 (444-33, D-65; 444-35, D-66): each list call reads the workspace itself; each file is written whole and one writer at a time.
+  // Each list call reads the workspace itself; each file is written whole, one writer at a time.
   underLock = createPathLock();
   async list() {
     const records = await discoverWorkspaceFiles({ workspace: this.workspace, kind: "test" });
@@ -2808,8 +2684,7 @@ var ConfigManager = class _ConfigManager {
     this.configPath = configPath;
     this.mask = mask;
   }
-  // 441 GAP3-D5: a whole document may keep a marker the file already holds, as often, but never
-  // add one. A missing file holds none.
+  // A whole document may keep a marker the file already holds, as often, but never add one.
   static addsShownMarker(current, next) {
     const held = shownMarkerCounts(current);
     for (const [marker, count] of shownMarkerCounts(next)) {
@@ -2817,13 +2692,13 @@ var ConfigManager = class _ConfigManager {
     }
     return false;
   }
-  // 429-05 Pitfall 3: a half-edited file is named, never served as the partial config yaml recovers.
+  // A half-edited file is named, never served as the partial config yaml recovers.
   async readWithRevision() {
     const read = await this.readParsed();
     if (read.kind !== "ok") return read;
     return { kind: "ok", config: read.config, raw: read.raw, revision: read.revision };
   }
-  // 441-21 D-29: the payload and the file view pass through the declared mask and nothing else.
+  // The payload and the file view pass through the declared mask and nothing else.
   async readMasked() {
     const read = await this.readParsed();
     if (read.kind === "absent") {
@@ -2867,8 +2742,7 @@ var ConfigManager = class _ConfigManager {
       revision
     };
   }
-  // 429-01 D-19/D-22: one transaction per request, serialised so overlapping autosaves never
-  // read the same bytes and drop each other's field.
+  // One transaction per request, serialised so overlapping autosaves never drop each other's field.
   async applyChanges(changes, options = {}) {
     const marked = changeWithShownMarker(changes);
     if (marked !== void 0) {
@@ -2883,13 +2757,11 @@ var ConfigManager = class _ConfigManager {
     }
     return this.serialized(() => this.applyChangesOnce(changes, options.capturePriors === true));
   }
-  // 429-11 D-24: an Undo is one more transaction on the same mutex, newest change first. A field
-  // that no longer holds what the change left there was written since, and is never overwritten.
+  // An Undo restores newest first; a field written after the change is never overwritten.
   async restorePriors(priors) {
     return this.serialized(() => this.restorePriorsOnce(priors));
   }
-  // 432-07 D-05: a generated whole-file change (a scaffold, a hooks file) publishes only over the
-  // bytes it was built from, read again in this path's turn. Anything else is somebody's edit.
+  // A generated whole-file change publishes only over the bytes it is built from, re-read in turn.
   async replaceDocument(expectedRevision, content) {
     return this.serialized(async () => {
       let current;
@@ -3016,8 +2888,7 @@ var ConfigManager = class _ConfigManager {
     await this.writeAtomic(next);
     return capturePriors ? { kind: "ok", revision: revisionOf(next), baseRevision, priors } : { kind: "ok", revision: revisionOf(next), baseRevision };
   }
-  // 429-05 Pitfall 8 / Pattern 1 step 6: the temp file sits beside the real file, keeps its mode
-  // (chmod, because writeFile's mode is filtered by the umask), and replaces it in one rename.
+  // The temp file sits beside the real one and is chmodded, as the umask filters `writeFile` modes.
   async writeAtomic(content) {
     const target = await this.writeTarget();
     const directory = dirname5(target);
@@ -4221,6 +4092,12 @@ var HookRegistryManager = class {
 
 // src/server/body-parser.ts
 var DEFAULT_MAX_BYTES = 1024 * 1024;
+function carriesNonJsonBody(req) {
+  const hasBody = req.headers["transfer-encoding"] !== void 0 || Number(req.headers["content-length"] ?? "0") > 0;
+  if (!hasBody) return false;
+  const type = req.headers["content-type"];
+  return type === void 0 || type.split(";", 1)[0].trim().toLowerCase() !== "application/json";
+}
 function readJsonBody(req, maxBytes = DEFAULT_MAX_BYTES) {
   return new Promise((resolve7, reject) => {
     const chunks = [];
@@ -4255,12 +4132,16 @@ function readJsonBody(req, maxBytes = DEFAULT_MAX_BYTES) {
 // src/live-editor/live-session.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { dirname as dirname8, resolve as resolvePath2 } from "node:path";
+import { format } from "node:util";
 import {
   AUTH_STATE_SCHEMA_VERSION,
   MobileSetupError as MobileSetupError2,
   PlannerConfigSchema,
   SuiteDefinitionSchema,
   TestDefinitionSchema,
+  TimeoutConfigSchema,
+  getAgentQaVersion,
+  printRunText,
   readAuthStateMetadata,
   resolveAuthStatePaths,
   writeAuthStateFiles
@@ -4289,7 +4170,7 @@ import {
   resolveVisionGate,
   visionFromConfig
 } from "@vostride/agent-qa-model";
-import { buildProductionRefusal, distinctInFirstOccurrenceOrder, resolvePlannerLimits } from "@vostride/agent-qa-schema";
+import { resolvePlannerLimits } from "@vostride/agent-qa-schema";
 import { parse as parseYaml5 } from "yaml";
 
 // src/llm-model-mapping.ts
@@ -4368,6 +4249,7 @@ import { dirname as dirname7, join as join3 } from "node:path";
 import { parse as parseYaml4 } from "yaml";
 import {
   MobileSetupError,
+  refuseRetiredLocalBindings,
   resolveMobileRunConfig
 } from "@vostride/agent-qa-core";
 async function loadLocalBindings(configPath) {
@@ -4375,12 +4257,10 @@ async function loadLocalBindings(configPath) {
   try {
     const content = await readFile5(filePath, "utf-8");
     const parsed = parseYaml4(content);
-    return parsed && typeof parsed === "object" ? {
-      devices: parsed.devices,
-      providers: parsed.providers,
-      apps: parsed.apps,
-      filePath
-    } : { filePath };
+    refuseRetiredLocalBindings(parsed, filePath);
+    if (!parsed || typeof parsed !== "object") return { filePath };
+    const bindings = parsed;
+    return { devices: bindings.devices, apps: bindings.apps, filePath };
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -4470,44 +4350,15 @@ async function prepareMobileLiveSession(input) {
       appActivity: resolved.app.appActivity,
       deepLinkAppId: resolved.app.deepLinkAppId,
       appPath: resolved.app.install?.path,
-      browserstackApp: resolved.app.install?.browserstack,
       appState: resolved.appState
     }
   };
 }
 
 // src/live-editor/live-session.ts
-var LiveProductionRefusedError = class extends Error {
-  productionTargetNames;
-  constructor(productionTargetNames) {
-    super(buildProductionRefusal(productionTargetNames));
-    this.name = "LiveProductionRefusedError";
-    this.productionTargetNames = distinctInFirstOccurrenceOrder(productionTargetNames);
-  }
-};
 function isConfigRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function liveTargetName(targetName) {
-  if (typeof targetName !== "string") return void 0;
-  const trimmed = targetName.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-async function resolveLiveTargetProduction(configManager, targetName) {
-  const name = liveTargetName(targetName);
-  if (name === void 0 || configManager === void 0) {
-    return { productionTargetNames: [], allowProduction: false };
-  }
-  const config = await readConfigValues(configManager);
-  const registry = isConfigRecord(config.registry) ? config.registry : void 0;
-  const targets = registry !== void 0 && isConfigRecord(registry.targets) ? registry.targets : void 0;
-  const declared = targets !== void 0 && Object.hasOwn(targets, name) ? targets[name] : void 0;
-  const production = isConfigRecord(declared) && declared.environment === "production";
-  return {
-    productionTargetNames: production ? [name] : [],
-    allowProduction: config.allowProduction === true
-  };
-}
 async function readEntityUse(entity, readers) {
   if (entity === void 0) return void 0;
   const find = entity.type === "suite" ? readers.findSuite : readers.findTest;
@@ -4527,6 +4378,12 @@ var LivePlannerLimitsRefusedError = class extends Error {
     this.name = "LivePlannerLimitsRefusedError";
   }
 };
+var LiveNavigationTimeoutRefusedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "LiveNavigationTimeoutRefusedError";
+  }
+};
 var LIVE_LIMIT_LEAVES = ["maxActions", "maxPlanningTurns"];
 function shownLimitValue(value) {
   return typeof value === "number" ? String(value) : JSON.stringify(value) ?? String(value);
@@ -4575,9 +4432,30 @@ async function resolveLivePlannerLimits(configManager, entities, readers) {
   }
   return resolvePlannerLimits(config.use, ...uses);
 }
-function liveProductionRefusal(found) {
-  if (found.productionTargetNames.length === 0 || found.allowProduction) return void 0;
-  return new LiveProductionRefusedError(found.productionTargetNames);
+async function resolveLiveNavigationTimeoutMs(configManager, entities, readers) {
+  const config = configManager === void 0 ? {} : await readConfigValues(configManager);
+  const layers = [
+    { layer: "project config", use: config.use }
+  ];
+  for (const entity of [].concat(entities ?? [])) {
+    const use = await readEntityUse(entity, readers);
+    layers.push({ layer: `${entity.type} file ${entity.id}`, use });
+  }
+  let navigation;
+  for (const { layer, use } of layers) {
+    if (!isConfigRecord(use) || !isConfigRecord(use.timeout)) continue;
+    if (!Object.hasOwn(use.timeout, "navigation")) continue;
+    const value = use.timeout.navigation;
+    const parsed = TimeoutConfigSchema.shape.navigation.safeParse(value);
+    if (!parsed.success) {
+      const issue = parsed.error.issues[0]?.message ?? "invalid value";
+      throw new LiveNavigationTimeoutRefusedError(
+        `${layer} sets use.timeout.navigation to ${shownLimitValue(value)}: ${issue}. The CLI refuses this file too.`
+      );
+    }
+    navigation = parsed.data;
+  }
+  return navigation;
 }
 var IDLE_TIMEOUT_MS = 5 * 60 * 1e3;
 var LIVE_HUB_CLOSE_LIMIT_MS = 2e3;
@@ -4713,8 +4591,7 @@ var LiveSession = class {
   planner = null;
   verifier = null;
   modelProfiles = null;
-  // D-14 (Phase 360): the run-scoped storage-state store, constructed lazily on first use and
-  // rooted at the session's `.agent-qa` runtime dir (the FsStorageStateStore rooting idiom).
+  // Built lazily on first use, rooted at the session's `.agent-qa` runtime dir.
   storageStateStore = null;
   model = null;
   variableStore = null;
@@ -4742,15 +4619,14 @@ var LiveSession = class {
   mobileAppiumLease = null;
   secretStore;
   secretRedactor;
-  // 428 D-07: one hub per session, handle 0, created once the adapter exists. A session whose
-  // setup hooks failed has no adapter and therefore no hub; its subject declares `none`.
+  // One hub per session at handle 0, created once the adapter exists; no adapter means no hub.
   liveHub = null;
   attachment = null;
   resolveEnded = () => {
   };
   ended;
   cleanupRun = null;
-  // RESEARCH P4: which control socket is the current one. Only its close may detach the session.
+  // Which control socket is the current one; only its close may detach the session.
   attachmentGeneration = 0;
   releaseAttachment = null;
   get modelName() {
@@ -4772,11 +4648,7 @@ var LiveSession = class {
     hub.register(0, registration?.capability, registration?.fallback);
     this.liveHub = hub;
   }
-  /**
-   * Make a control socket the current one. `release` is how the session lets go of it later: the
-   * previous attachment's is called with `superseded` here (428 WR-01), so one socket drives the
-   * session at a time.
-   */
+  // The previous attachment's `release` gets `superseded`, so one socket drives the session.
   beginAttachment(release) {
     const previous = this.releaseAttachment;
     this.attachmentGeneration += 1;
@@ -4795,11 +4667,7 @@ var LiveSession = class {
     }
     this.pendingMessages = [];
   }
-  /**
-   * A command's reply, for whichever control socket is attached now (428 CR-01). A command can
-   * outlive the socket that issued it, and its outcome belongs to the page, not to that socket:
-   * with none attached it is held and flushed to the next one.
-   */
+  // A reply can outlive its socket, so it goes to the current socket or waits for the next one.
   deliver(message) {
     if (this.messageSink) {
       this.messageSink(message);
@@ -4910,7 +4778,7 @@ var LiveSession = class {
         continue;
       }
       const result = await runHooks([hookDef], {
-        executor: new DockerHookExecutor(),
+        executor: new DockerHookExecutor({ version: getAgentQaVersion() }),
         env: this.getHookEnvVars(),
         secretStore: this.secretStore,
         secretRedactor: this.secretRedactor
@@ -4984,7 +4852,6 @@ var LiveSession = class {
       device: config.device ? {
         name: config.device.name,
         platform,
-        transport: "local",
         match: config.device
       } : void 0
     };
@@ -5049,15 +4916,6 @@ var LiveSession = class {
     }
   }
   async initialize(config) {
-    const found = await resolveLiveTargetProduction(this.deps.configManager, config.targetName);
-    const refusal = liveProductionRefusal({
-      productionTargetNames: distinctInFirstOccurrenceOrder([
-        ...config.production?.productionTargetNames ?? [],
-        ...found.productionTargetNames
-      ]),
-      allowProduction: found.allowProduction
-    });
-    if (refusal !== void 0) throw refusal;
     this.platform = config.platform;
     this.targetName = typeof config.targetName === "string" && config.targetName.trim().length > 0 ? config.targetName.trim() : null;
     this._modelName = config.llmConfig.model ?? "unknown";
@@ -5092,7 +4950,11 @@ var LiveSession = class {
     } else {
       const { WebPlatformAdapter } = await import("@vostride/agent-qa-web");
       const adapter = new WebPlatformAdapter();
-      await adapter.setup({ platform: "web", browser: { name: "chromium", headless: config.headless ?? true } });
+      await adapter.setup({
+        platform: "web",
+        browser: { name: "chromium", headless: config.headless ?? true },
+        ...config.navigationTimeoutMs === void 0 ? {} : { timeouts: { navigation: config.navigationTimeoutMs } }
+      });
       this.adapter = adapter;
       if (config.url) {
         const resolvedUrl = this.resolveSecrets(config.url);
@@ -5154,7 +5016,7 @@ var LiveSession = class {
         }
         const startedAt = performance.now();
         try {
-          const result = await new DockerHookExecutor().execute(hookDef, {
+          const result = await new DockerHookExecutor({ version: getAgentQaVersion() }).execute(hookDef, {
             env: this.getHookEnvVars(),
             secretEnv: resolveSecretEnv(this.secretStore),
             secretRedactor: this.secretRedactor
@@ -5321,12 +5183,7 @@ var LiveSession = class {
     };
     return this.redact(result);
   }
-  // Inner step execution — no gating. Callers must own the executing/status
-  // lifecycle (executeStepCommand for single steps, executeTestCommand for
-  // the per-test loop that runs many steps under one outer gate).
-  // D-14 (Phase 360): lazily construct the run-scoped storage-state store, rooted at the session's
-  // `.agent-qa` runtime dir. All fs writes live in runner-local (validate:arch storageNeutral);
-  // the loop records only { name, fingerprint }. Absent configPath falls back to the cwd root.
+  // Lazily built and rooted at the session's `.agent-qa` dir; fs writes stay in runner-local.
   async getStorageStateStore() {
     let store = this.storageStateStore;
     if (!store) {
@@ -5465,7 +5322,9 @@ ${errorLines.join("\n")}`;
         testLimits = this.plannerLimitsForTest !== void 0 && testDraft.testId.length > 0 ? await this.plannerLimitsForTest(testDraft.testId) : this.plannerLimits ?? resolvePlannerLimits();
       } catch (error) {
         if (!(error instanceof LivePlannerLimitsRefusedError)) throw error;
-        console.warn(`[live-session] executeTestCommand: ${error.message}`, { testName: testDraft.testName });
+        const line = `[live-session] executeTestCommand: ${error.message}`;
+        const detail = { testName: testDraft.testName };
+        printRunText(format(line, detail), () => console.warn(line, detail));
         return this.redact({
           status: "failed",
           duration: performance.now() - start,
@@ -5485,11 +5344,13 @@ ${errorLines.join("\n")}`;
       if (!setupResult.allPassed) {
         const failedHook = setupHookPayloads.find((h) => h.status === "failed");
         const detail = failedHook ? `Setup hook "${failedHook.hookName}" failed${failedHook.error ? `: ${failedHook.error}` : ""}${failedHook.stderr ? ` \u2014 ${failedHook.stderr.split("\n")[0].slice(0, 200)}` : ""}` : "Per-test setup hook failed";
-        console.warn(`[live-session] executeTestCommand: ${detail}`, {
+        const line = `[live-session] executeTestCommand: ${detail}`;
+        const context = {
           testName: testDraft.testName,
           setupHooks: testDraft.setup,
           failedHook: failedHook ? { name: failedHook.hookName, stderr: failedHook.stderr, error: failedHook.error } : null
-        });
+        };
+        printRunText(format(line, context), () => console.warn(line, context));
         return {
           status: "failed",
           duration: performance.now() - start,
@@ -5567,7 +5428,9 @@ ${errorLines.join("\n")}`;
         topLevelError = failedHook ? `Teardown hook "${failedHook.hookName}" failed${failedHook.error ? `: ${failedHook.error}` : ""}` : "Teardown hook failed";
       }
       if (topLevelError) {
-        console.warn(`[live-session] executeTestCommand: ${topLevelError}`, { testName: testDraft.testName });
+        const line = `[live-session] executeTestCommand: ${topLevelError}`;
+        const detail = { testName: testDraft.testName };
+        printRunText(format(line, detail), () => console.warn(line, detail));
       }
       return this.redact({
         status: finalStatus,
@@ -5583,10 +5446,7 @@ ${errorLines.join("\n")}`;
       this.status = "idle";
     }
   }
-  // Thin wrapper around runLifecycleHooks that also captures the dispatched
-  // hook payloads (hook-complete) for inclusion in the LiveTestResultPayload.
-  // The capture sits beside the message sink rather than wrapping it, so a
-  // control socket that reattaches mid-hook keeps its sink (428 CR-01).
+  // Captures dispatched hook payloads beside the message sink, so a reattached socket keeps it.
   async runLifecycleHooksCapturing(phase, hookIds, sink, owner = { scope: "suite" }) {
     this.hookCaptures.add(sink);
     try {
@@ -5830,6 +5690,21 @@ function refuseUnparseableRequest(res) {
   });
   res.end(body);
 }
+function refuseForeignHostPage(res, port) {
+  if (res.headersSent) {
+    res.destroy();
+    return;
+  }
+  const p = String(port);
+  const body = `The agent-qa dashboard answers only at localhost, 127.0.0.1 or [::1].
+Open http://localhost:${p}/ on the machine it runs on, or forward the port with ssh -L ${p}:localhost:${p} <host>.
+`;
+  res.writeHead(403, {
+    "Content-Type": "text/plain; charset=utf-8",
+    "Content-Length": Buffer.byteLength(body)
+  });
+  res.end(body);
+}
 function backstopServerError(res, req, error) {
   const kind = error instanceof Error ? error.constructor.name : typeof error;
   console.error(
@@ -5935,10 +5810,6 @@ function respondJson(res, status, data) {
   res.end(body);
 }
 function serveRunEvidenceRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req)) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   const query = new URL(req.url ?? "/", "http://localhost").searchParams;
   const entries = [["runId", deps.runId]];
   const seen = /* @__PURE__ */ new Set(["runId"]);
@@ -5980,10 +5851,6 @@ function respondFeedbackRead(res, deps, functionId, input, parse) {
   });
 }
 function serveRunMarksHistoryRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   if (new URL(req.url ?? "/", "http://localhost").search !== "") {
     respondJson(res, 400, { error: "invalid_marks_input" });
     return;
@@ -6002,10 +5869,6 @@ function serveRunMarksHistoryRead(req, res, deps) {
   );
 }
 function serveRunMarkPreviewRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then((body) => {
     const parsed = RunsMarkInputSchema.safeParse(body);
     if (!parsed.success) {
@@ -6028,10 +5891,6 @@ function serveRunMarkPreviewRead(req, res, deps) {
   });
 }
 function serveRunDetailRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readRunDetail(deps.host, deps.runId).then(
     (outcome) => {
       if (outcome.kind === "refused") {
@@ -6183,10 +6042,6 @@ async function readRunAnalysis(host, runId) {
   }
 }
 function serveRunAnalysisRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readRunAnalysis(deps.host, deps.runId).then(
     (outcome) => {
       if (outcome.kind === "refused") {
@@ -6410,10 +6265,7 @@ function serveRunEventStream(req, res, deps) {
     else pending.push(frame);
   };
   const frameOf = (event) => (
-    // D-13, all three parts: the id IS the seq, the event name IS the envelope type, and the
-    // data IS the envelope's own JSON. No projection, no rename, no second vocabulary. The filter
-    // DROPS envelopes; it never edits one, so a filtered stream's frames are byte-identical to the
-    // firehose's — with gaps in the ids, which is what seq-as-id means once a filter exists.
+    // The filter drops envelopes and never edits one, so filtered frames match the firehose bytes.
     `id: ${String(event.seq)}
 event: ${event.type}
 data: ${JSON.stringify(event)}
@@ -6475,12 +6327,6 @@ data: ${JSON.stringify(event)}
   deps.openStreams?.add(teardown);
   req.on("close", teardown);
 }
-function runDenialOf(error) {
-  if (typeof error !== "object" || error === null) return void 0;
-  const neutralReason = error.neutralReason;
-  if (typeof neutralReason !== "string" || neutralReason.trim().length === 0) return void 0;
-  return { error: "run_denied", neutralReason };
-}
 function createRunServiceRoutes(ports) {
   const openStreams = /* @__PURE__ */ new Set();
   function handleStart(req, res) {
@@ -6511,12 +6357,7 @@ function createRunServiceRoutes(ports) {
         ack = await ports.invokeRunStart(
           parsed.data.patterns === void 0 ? {} : { patterns: parsed.data.patterns }
         );
-      } catch (error) {
-        const denial = runDenialOf(error);
-        if (denial !== void 0) {
-          respondJson2(res, 403, denial);
-          return;
-        }
+      } catch {
         refuse(res, 500, "run_start_failed");
         return;
       }
@@ -6596,6 +6437,10 @@ function createRunServiceRoutes(ports) {
         refuse(res, 403, "cross_site_refused");
         return;
       }
+      if (carriesNonJsonBody(req)) {
+        refuse(res, 415, "unsupported_media_type");
+        return;
+      }
       const matched = matchRunServiceRoute(req.method, path);
       if (matched === void 0) {
         refuse(res, 404, "unknown_route");
@@ -6863,8 +6708,7 @@ data: ${JSON.stringify(again.body)}
         // A failed re-read is not a reason to close a live channel: the next envelope will trigger
         // another, and the page's own poll is the floor underneath both.
         () => void 0
-        // …but a throw from the arm ABOVE is not a failed re-read, it is a dead socket, and `.then`'s
-        // failure arm never sees its own fulfilment arm's throw (UF-01, on the nested chain).
+        // A throw from the arm above is a dead socket, and `.then`'s failure arm never sees it.
       ).catch(failStream);
     });
     heartbeat = setInterval(() => {
@@ -6903,10 +6747,6 @@ async function readRunKnowledge(host, runId) {
   }
 }
 function serveRunKnowledgeRead(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readRunKnowledge(deps.host, deps.runId).then(
     (outcome) => {
       if (outcome.kind === "refused") {
@@ -6949,10 +6789,6 @@ async function markRun(host, runId, body) {
   }
 }
 function registerRunMarkRoute(req, res, deps) {
-  if (deps.boundary === "human" && refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const outcome = await markRun(deps.host, deps.runId, body);
     if (outcome.kind === "refused") {
@@ -6975,10 +6811,6 @@ import {
   isPageWritableConfigPath
 } from "@vostride/agent-qa-schema";
 function registerConfigWriteRoute(req, res, deps) {
-  if (refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const parsed = ConfigWriteRequestSchema.safeParse(body);
     if (!parsed.success) {
@@ -7036,10 +6868,6 @@ function registerConfigUndoRoute(req, res, deps) {
     respondJson(res, 405, { error: "method_not_allowed" });
     return;
   }
-  if (refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const parsed = ConfigUndoRequestSchema.safeParse(body);
     if (!parsed.success) {
@@ -7282,10 +7110,6 @@ async function connectName(request2, deps) {
   });
 }
 function registerLlmConnectRoute(req, res, deps) {
-  if (refuseCrossSiteRequest(req) !== void 0) {
-    respondJson(res, 403, { error: "cross_site_refused" });
-    return;
-  }
   void readJsonBody(req).then(async (body) => {
     const answer = await connectLlm(body, deps);
     respondJson(res, answer.status, answer.body);
@@ -7297,9 +7121,9 @@ function registerLlmConnectRoute(req, res, deps) {
 }
 
 // src/server/routes.ts
-import { AuthStateNameSchema, buildInternalRunAttributes, mergeRunAttributes, readAuth as readAuth2, writeAuth as writeAuth2, removeAuth as removeAuth2, getAgentQaVersion, getAgentQaUpdateStatus, getLLMAuthProviderPlugin as getLLMAuthProviderPlugin2, listAuthStateMetadata, listLLMAuthProviderPlugins, ModelConfigSchema as ModelConfigSchema2, NameSlugSchema as NameSlugSchema2, TimeoutConfigSchema, AgentQaConfigSchema as AgentQaConfigSchema3, TestDefinitionSchema as TestDefinitionSchema2, SuiteDefinitionSchema as SuiteDefinitionSchema2, parseEnvFile, serializeEnvFile, RUNTIME_IMAGE_MAP, validateUserRunAttributes, discoverWorkspaceFiles as discoverWorkspaceFiles3, isWorkspacePathMatch, resolveWorkspaceFileTarget as resolveWorkspaceFileTarget2, SizeString } from "@vostride/agent-qa-core";
+import { AuthStateNameSchema, buildInternalRunAttributes, DEFAULT_AGENT_QA_CACHE_DIR, mergeRunAttributes, readAuth as readAuth2, writeAuth as writeAuth2, removeAuth as removeAuth2, getAgentQaVersion as getAgentQaVersion2, getAgentQaUpdateStatus, getLLMAuthProviderPlugin as getLLMAuthProviderPlugin2, listAuthStateMetadata, listLLMAuthProviderPlugins, ModelConfigSchema as ModelConfigSchema2, NameSlugSchema as NameSlugSchema2, TimeoutConfigSchema as TimeoutConfigSchema2, AgentQaConfigSchema as AgentQaConfigSchema3, TestDefinitionSchema as TestDefinitionSchema2, SuiteDefinitionSchema as SuiteDefinitionSchema2, parseEnvFile, serializeEnvFile, hookRunnerImage, validateUserRunAttributes, discoverWorkspaceFiles as discoverWorkspaceFiles3, isWorkspacePathMatch, resolveWorkspaceFileTarget as resolveWorkspaceFileTarget2, SizeString } from "@vostride/agent-qa-core";
 import { SecretStore, SecretRedactor } from "@vostride/agent-qa-runner";
-import { DockerHookExecutor as DockerHookExecutor2 } from "@vostride/agent-qa-runner-local";
+import { DockerHookExecutor as DockerHookExecutor2, purgeActionCache } from "@vostride/agent-qa-runner-local";
 import { createModel as createModel3, fetchLiveModels, getModelCatalog, listProviders, mergeCatalog, resolveVisionConfig } from "@vostride/agent-qa-model";
 import { parse as parseYaml6 } from "yaml";
 var LLM_PROVIDER_MODES = /* @__PURE__ */ new Set([
@@ -7607,25 +7431,10 @@ function llmConnectionTestTimeoutMs(config) {
   return REMOTE_LLM_CONNECTION_TEST_TIMEOUT_MS;
 }
 function json(res, data, status = 200) {
-  const body = JSON.stringify(data);
-  res.writeHead(status, {
-    "Content-Type": "application/json",
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type"
-  });
-  res.end(body);
-}
-function jsonNoCors(res, data, status = 200) {
   const body = JSON.stringify(data);
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(body);
 }
-function refuseCrossSiteDisplayRead(req, res) {
-  if (refuseCrossSiteRequest(req) === void 0) return false;
-  jsonNoCors(res, { error: "cross_site_refused" }, 403);
-  return true;
-}
 var INSIGHTS_KNOWLEDGE_RUN_CAP = 200;
 var INSIGHTS_KNOWLEDGE_CONCURRENCY = 4;
 async function isPostProcessingSkipped(host, runId) {
@@ -7689,14 +7498,6 @@ async function readInsightsKnowledgeChanges(host, db, window) {
 function notFound(res, message = "Not found") {
   json(res, { error: message }, 404);
 }
-function cors(res) {
-  res.writeHead(204, {
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type"
-  });
-  res.end();
-}
 function isPlainRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -7749,7 +7550,7 @@ function normalizeRunFilterValue(value) {
 function buildRunRequestAttributes(input) {
   const internal = buildInternalRunAttributes({
     trigger: input.trigger,
-    runner: input.runner ?? "local"
+    runner: "local"
   });
   const user = validateUserRunAttributes(input.userAttributes, "run attributes");
   return mergeRunAttributes(internal, user);
@@ -7884,7 +7685,7 @@ function parseTimeoutConfigTestTimeoutMs(timeoutConfig) {
       return transformedTimeout;
     }
   }
-  const parsed = TimeoutConfigSchema.partial().safeParse(timeoutConfig);
+  const parsed = TimeoutConfigSchema2.partial().safeParse(timeoutConfig);
   if (!parsed.success) return void 0;
   const testTimeout = parsed.data.test;
   return typeof testTimeout === "number" && Number.isFinite(testTimeout) && testTimeout > 0 ? testTimeout : void 0;
@@ -8194,9 +7995,7 @@ var RESPONSE_SAFE_RUN_METADATA_KEYS = /* @__PURE__ */ new Set([
   "timeoutSource",
   "timeoutBaseMs",
   "timeoutBufferMs",
-  "suiteIndex",
-  "farmSessionUrl",
-  "runDevice"
+  "suiteIndex"
 ]);
 function sanitizeRunMetadataForResponse(metadata) {
   if (metadata === null || metadata === void 0) return metadata ?? null;
@@ -8226,17 +8025,7 @@ var RESPONSE_SAFE_RUN_READ_METHODS = [
   "getRunsByTest"
 ];
 var RUN_READS_WITHOUT_ROWS = /* @__PURE__ */ new Set([
-  // 2026-08-27 (405-01, D-01/D-03): the v2 projection's six members.
-  //
-  // The five WRITES return nothing; they are here for the same reason `insertRun` is.
-  //
-  // `readRunDetailRows` IS A READ AND IS STILL HERE, and that is the judgement this set exists to
-  // make explicit rather than to hide. It returns members, steps and sub-actions — the bus
-  // payloads as the subscriber MASKED them (T-363-05) — and NO `RunRow` and no
-  // `RunArtifactRow`. It therefore carries none of the run metadata the 401-23 scrub law exists
-  // to strip, so wrapping it would be wrapping a shape that has nothing to strip. This router
-  // does not call it either: the detail arm dispatches through the injected host, which is the
-  // whole of D-03.
+  // `readRunDetailRows` returns masked bus payloads and no run row, so it has no metadata to strip.
   "deleteMemberProjection",
   "incrementRunMemberAttempts",
   "insertRunStep",
@@ -8247,23 +8036,23 @@ var RUN_READS_WITHOUT_ROWS = /* @__PURE__ */ new Set([
   "finalizeRunArtifact",
   "getRunsBySuiteIdCount",
   "getRunsByTestCount",
-  // 433-30: run ids and a count, no row; each id is dispatched through the agent host.
+  // Run ids and a count, no row; each id is dispatched through the agent host.
   "listInsightsWindowRunIds",
   "insertPendingRun",
   "insertRun",
   "insertRunArtifact",
   "listRunAttributeKeys",
   "listRunAttributeValues",
-  // 2026-10-16 (442-01, D-01): an owner (pid, incarnation, host), no run metadata.
+  // An owner (pid, incarnation, host), no run metadata.
   "readRunOwner",
-  // 2026-10-16 (442-01, D-04): ids and owners only, no run metadata.
+  // Ids and owners only, no run metadata.
   "listRunningRunOwners",
-  // 2026-10-16 (442-01, D-04): compare-and-set writes that return a boolean.
+  // Compare-and-set writes that return a boolean.
   "finalizeOrphanRun",
   "finalizeOwnRun",
-  // 2026-10-17 (443-13, GAP-D1): a compare-and-set write that returns a boolean, no run metadata.
+  // A compare-and-set write that returns a boolean, no run metadata.
   "closeOwnRun",
-  // 2026-10-17 (443-02, D-07): a compare-and-set write that returns a boolean, no run metadata.
+  // A compare-and-set write that returns a boolean, no run metadata.
   "claimRunningRow",
   "stageRunArtifact",
   "updateRun",
@@ -8334,10 +8123,7 @@ function withResponseSafeRunReads(db) {
     // `sanitizeArtifactForResponse`; a caller reaching for the bare row has no such step, so the
     // projection is its only choke point. Same allowlist, so the two cannot drift.
     getRunArtifact: { value: (runId) => scrubArtifact(db.getRunArtifact(runId)) },
-    // 405-07 (D-02): the bundle is ONE artifact now. It used to carry the child runs of a suite
-    // parent, whose `run` rows this override scrubbed; nothing has written a child row since
-    // 402-09, and the shape went with the column. `getRunArtifact` above remains the choke point
-    // for the payload itself, and this wrapper delegates to it.
+    // One artifact; `getRunArtifact` is the choke point for its payload, and this delegates to it.
     getRunArtifactBundle: {
       value: (runId) => ({ artifact: scrubArtifact(db.getRunArtifactBundle(runId).artifact) })
     }
@@ -8485,10 +8271,18 @@ function createRouter(dbOrDeps) {
       json(res, { error: "Bad Request" }, 400);
       return;
     }
+    if (refuseCrossSiteRequest(req) !== void 0) {
+      json(res, { error: "cross_site_refused" }, 403);
+      return;
+    }
+    if (carriesNonJsonBody(req)) {
+      json(res, { error: "unsupported_media_type" }, 415);
+      return;
+    }
     const path = url.pathname;
     if (path === "/api/config" && req.method === "PATCH") {
       if (!configManager) {
-        jsonNoCors(res, { error: "config_unavailable" }, 503);
+        json(res, { error: "config_unavailable" }, 503);
         return;
       }
       registerConfigWriteRoute(req, res, { configManager, undoStore });
@@ -8508,7 +8302,7 @@ function createRouter(dbOrDeps) {
     }
     if (path === "/api/config/revision" && req.method === "GET") {
       if (!configManager) {
-        jsonNoCors(res, { error: "config_unavailable" }, 503);
+        json(res, { error: "config_unavailable" }, 503);
         return;
       }
       registerConfigRevisionRoute(req, res, { configManager });
@@ -8516,7 +8310,7 @@ function createRouter(dbOrDeps) {
     }
     if (path === "/api/llm/connect" && req.method === "POST") {
       if (!configManager) {
-        jsonNoCors(res, { error: "config_unavailable" }, 503);
+        json(res, { error: "config_unavailable" }, 503);
         return;
       }
       registerLlmConnectRoute(req, res, {
@@ -8528,16 +8322,6 @@ function createRouter(dbOrDeps) {
       });
       return;
     }
-    if (path === "/api/runs/trigger" || path === "/api/queue/enqueue") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
-    }
-    if (req.method === "OPTIONS") {
-      cors(res);
-      return;
-    }
     if (path === "/api/auth-states" && req.method === "GET") {
       if (!configManager || !deps.configPath) {
         json(res, { error: "Auth-state metadata not available" }, 503);
@@ -8561,11 +8345,10 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/runs" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const statuses = url.searchParams.getAll("status");
       const unknownStatus = statuses.find((word) => !isRunStatusWord(word));
       if (unknownStatus !== void 0) {
-        jsonNoCors(res, { error: `Unknown run status: ${unknownStatus}.` }, 400);
+        json(res, { error: `Unknown run status: ${unknownStatus}.` }, 400);
         return;
       }
       const name = url.searchParams.get("name") ?? void 0;
@@ -8597,12 +8380,12 @@ function createRouter(dbOrDeps) {
         )).sort((a, b) => a.localeCompare(b));
         const filtered = platformFilteredRuns.filter((run) => matchesTargetFilter(run, target));
         const runs = filtered.slice(offset, offset + limit);
-        jsonNoCors(res, {
+        json(res, {
           runs,
           total: filtered.length,
           targets: targetOptions
         });
-      }).catch(() => jsonNoCors(res, { error: "Failed to list runs" }, 500));
+      }).catch(() => json(res, { error: "Failed to list runs" }, 500));
       return;
     }
     if (path === "/api/runs/attributes/keys" && req.method === "GET") {
@@ -8640,7 +8423,6 @@ function createRouter(dbOrDeps) {
     }
     const runArtifactMatch = path.match(/^\/api\/runs\/([^/]+)\/artifact$/);
     if (runArtifactMatch && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const runId = decodeURIComponent(runArtifactMatch[1]);
       const run = db.getRun(runId);
       if (!run) {
@@ -8648,7 +8430,7 @@ function createRouter(dbOrDeps) {
         return;
       }
       const bundle = db.getRunArtifactBundle(runId);
-      jsonNoCors(res, {
+      json(res, {
         run,
         artifact: sanitizeArtifactForResponse(bundle.artifact),
         missingSections: getArtifactMissingSections(bundle.artifact)
@@ -8656,7 +8438,6 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/execution-logs") && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const segments = path.split("/");
       const id = segments[3];
       const run = db.getRun(id);
@@ -8667,37 +8448,37 @@ function createRouter(dbOrDeps) {
       const stepId = url.searchParams.get("stepId") ?? void 0;
       const type = url.searchParams.get("type") ?? void 0;
       const logs = db.getExecutionLogs({ runId: id, stepId, type });
-      jsonNoCors(res, { logs });
+      json(res, { logs });
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/mark") && req.method === "POST") {
       if (deps.agentHost === void 0) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/mark".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_mark_input" }, 400);
+        json(res, { error: "invalid_mark_input" }, 400);
         return;
       }
-      registerRunMarkRoute(req, res, { host: deps.agentHost, runId, boundary: "human" });
+      registerRunMarkRoute(req, res, { host: deps.agentHost, runId });
       return;
     }
     if (req.method === "POST" && /^\/api\/runs\/[^/]+\/mark-preview$/.test(path)) {
       if (deps.agentHost === void 0) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/mark-preview".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_run_id" }, 400);
+        json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunMarkPreviewRead(req, res, { runId, host: deps.agentHost, boundary: "human" });
+      serveRunMarkPreviewRead(req, res, { runId, host: deps.agentHost });
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/cancel") && req.method === "POST") {
@@ -8776,44 +8557,39 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/live-url$/.test(path)) {
-      const crossSite = refuseCrossSiteRequest(req);
-      if (crossSite !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       if (!deps.mintLiveUrl) {
-        jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+        json(res, { error: "live_view_unavailable" }, 503);
         return;
       }
       let liveUrlRunId;
       try {
         liveUrlRunId = decodeURIComponent(path.slice("/api/runs/".length, -"/live-url".length));
       } catch {
-        jsonNoCors(res, { error: "unknown_run" }, 404);
+        json(res, { error: "unknown_run" }, 404);
         return;
       }
       const rawHandle = handleParamOf(req);
       const parsedHandle = parseHandleParam2(rawHandle);
       if (parsedHandle.kind === "invalid") {
-        jsonNoCors(res, { error: "invalid_handle" }, 400);
+        json(res, { error: "invalid_handle" }, 400);
         return;
       }
       const handle = parsedHandle.kind === "absent" ? 0 : parsedHandle.index;
       void deps.mintLiveUrl(liveUrlRunId, handle).then(
         (result) => {
-          jsonNoCors(res, result);
+          json(res, result);
         },
         (error) => {
           const name = error instanceof Error ? error.name : "";
           if (name === "UnknownRunError") {
-            jsonNoCors(res, { error: "unknown_run" }, 404);
+            json(res, { error: "unknown_run" }, 404);
             return;
           }
           if (name === "LiveViewUnavailableError") {
-            jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+            json(res, { error: "live_view_unavailable" }, 503);
             return;
           }
-          jsonNoCors(res, { error: "live_url_mint_failed" }, 500);
+          json(res, { error: "live_url_mint_failed" }, 500);
         }
       );
       return;
@@ -8842,32 +8618,32 @@ function createRouter(dbOrDeps) {
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/evidence$/.test(path)) {
       if (!deps.agentHost) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/evidence".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_run_id" }, 400);
+        json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunEvidenceRead(req, res, { runId, host: deps.agentHost, boundary: "human" });
+      serveRunEvidenceRead(req, res, { runId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/marks$/.test(path)) {
       if (!deps.agentHost) {
-        jsonNoCors(res, { error: "agent_host_unavailable" }, 503);
+        json(res, { error: "agent_host_unavailable" }, 503);
         return;
       }
       let runId;
       try {
         runId = decodeURIComponent(path.slice("/api/runs/".length, -"/marks".length));
       } catch {
-        jsonNoCors(res, { error: "invalid_run_id" }, 400);
+        json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunMarksHistoryRead(req, res, { runId, host: deps.agentHost, boundary: "human" });
+      serveRunMarksHistoryRead(req, res, { runId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/detail$/.test(path)) {
@@ -8882,7 +8658,7 @@ function createRouter(dbOrDeps) {
         json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunDetailRead(req, res, { runId: detailRunId, host: deps.agentHost, boundary: "human" });
+      serveRunDetailRead(req, res, { runId: detailRunId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/analysis$/.test(path)) {
@@ -8897,7 +8673,7 @@ function createRouter(dbOrDeps) {
         json(res, { error: "invalid_run_id" }, 400);
         return;
       }
-      serveRunAnalysisRead(req, res, { runId: analysisRunId, host: deps.agentHost, boundary: "human" });
+      serveRunAnalysisRead(req, res, { runId: analysisRunId, host: deps.agentHost });
       return;
     }
     if (req.method === "GET" && /^\/api\/runs\/[^/]+\/knowledge$/.test(path)) {
@@ -8914,8 +8690,7 @@ function createRouter(dbOrDeps) {
       }
       serveRunKnowledgeRead(req, res, {
         runId: knowledgeRunId,
-        host: deps.agentHost,
-        boundary: "human"
+        host: deps.agentHost
       });
       return;
     }
@@ -8965,14 +8740,13 @@ function createRouter(dbOrDeps) {
         notFound(res);
         return;
       }
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       const id = segments[3];
       const run = db.getRun(id);
       if (!run) {
         notFound(res, "Run not found");
         return;
       }
-      jsonNoCors(res, { run });
+      json(res, { run });
       return;
     }
     if (path === "/api/stats/costs" && req.method === "GET") {
@@ -8983,19 +8757,18 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/insights/knowledge-changes" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!deps.agentHost) {
-        jsonNoCors(res, { status: "unavailable", reason: "agent_host_unavailable" }, 503);
+        json(res, { status: "unavailable", reason: "agent_host_unavailable" }, 503);
         return;
       }
       const from = url.searchParams.get("from") ?? void 0;
       const to = url.searchParams.get("to") ?? void 0;
       void readInsightsKnowledgeChanges(deps.agentHost, db, { from, to }).then(
         (body) => {
-          jsonNoCors(res, body);
+          json(res, body);
         },
         () => {
-          jsonNoCors(res, { status: "unavailable", reason: "read_failed" }, 500);
+          json(res, { status: "unavailable", reason: "read_failed" }, 500);
         }
       );
       return;
@@ -9061,10 +8834,7 @@ function createRouter(dbOrDeps) {
       serveRunEventStream(req, res, {
         runId,
         handleParam: handleParamOf(req),
-        // 403-03 (D-13 · INVK-05): the resume point, read from the SAME pair the authed door reads
-        // it from. `url.searchParams.get('lastEventId')` would resolve a repeated parameter to its
-        // first value — the one answer `lastEventIdParamOf` exists to refuse — and a second
-        // header/query precedence rule here would be a second contract for where a client resumes.
+        // Read from the same pair as the authed door; `searchParams.get` takes a repeated first.
         resume: resumePointOf(req.headers["last-event-id"], lastEventIdParamOf(req)),
         attach: deps.runServiceAttach
       });
@@ -9106,7 +8876,6 @@ function createRouter(dbOrDeps) {
         try {
           attributes = buildRunRequestAttributes({
             trigger: "api",
-            runner: "local",
             userAttributes: body.attributes
           });
         } catch (err) {
@@ -9114,25 +8883,10 @@ function createRouter(dbOrDeps) {
           return;
         }
         const args = normalizedFileTarget ? [normalizedFileTarget.executionPath] : [];
-        const source = isSuiteFile ? "suite" : "dashboard";
-        try {
-          await executionBackend?.preflight?.({ args, source });
-        } catch (error) {
-          const denial = runDenialOf(error);
-          if (denial !== void 0) {
-            json(res, denial, 403);
-            return;
-          }
-          json(res, { error: error instanceof Error ? error.message : String(error) }, 400);
-          return;
-        }
         const runId = jobQueue.enqueue({
           name: body.name,
           filePath: normalizedFileTarget?.storagePath,
-          // 2026-08-24 (402-09, D-11): NO PARENT KIND IS MINTED. A suite run is ONE run row
-          // with member handles, so a parent artifact kind would claim parenthood over rows
-          // nothing creates. `isSuiteFile` still travels in `metadata.isSuite` below, and the run's
-          // own `suite_id` plus the artifact's `source.kind` snapshot still say it is a suite.
+          // No parent kind is minted; `metadata.isSuite` and `suite_id` say it is a suite.
           kind: "test",
           attributes,
           priority: body.priority,
@@ -9215,17 +8969,6 @@ function createRouter(dbOrDeps) {
           args.push("--disable-cache");
         }
         const isSuite = Boolean(isSuiteFile);
-        try {
-          await executionBackend?.preflight?.({ args, source: isSuite ? "suite" : "dashboard" });
-        } catch (error) {
-          const denial = runDenialOf(error);
-          if (denial !== void 0) {
-            json(res, denial, 403);
-            return;
-          }
-          json(res, { error: error instanceof Error ? error.message : String(error) }, 400);
-          return;
-        }
         let testName = body.file ? basename5(normalizedFileTarget?.storagePath ?? body.file, ".yaml") : "unknown";
         let fileParallel;
         let platform;
@@ -9268,11 +9011,10 @@ function createRouter(dbOrDeps) {
         const runId = jobQueue.enqueue({
           name: testName,
           filePath: normalizedFileTarget?.storagePath ?? body.file,
-          // 2026-08-24 (402-09, D-11): no parent kind minted — see the enqueue route above.
+          // No parent kind is minted; see the enqueue route above.
           kind: "test",
           attributes: buildRunRequestAttributes({
-            trigger: triggerSource.trigger,
-            runner: body.local === false ? "browserstack" : "local"
+            trigger: triggerSource.trigger
           }),
           platform,
           parallel: effectiveParallel,
@@ -9781,7 +9523,7 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/app-metadata" && req.method === "GET") {
-      const version = getAgentQaVersion().trim() || "0.0.0";
+      const version = getAgentQaVersion2().trim() || "0.0.0";
       (async () => {
         try {
           const status = await getAgentQaUpdateStatus();
@@ -9825,9 +9567,8 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (path === "/api/config" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!configManager) {
-        jsonNoCors(res, { error: "Config management not available" }, 501);
+        json(res, { error: "Config management not available" }, 501);
         return;
       }
       ;
@@ -9835,7 +9576,7 @@ function createRouter(dbOrDeps) {
         try {
           const read = await configManager.readMasked();
           if (read.kind === "file_invalid") {
-            jsonNoCors(res, { error: "file_invalid", message: read.message }, 409);
+            json(res, { error: "file_invalid", message: read.message }, 409);
             return;
           }
           const { config, revision, lines, fileIssues } = read;
@@ -9845,7 +9586,7 @@ function createRouter(dbOrDeps) {
           const activeLlm = use?.llm ?? config.defaultLLM;
           const defaultCfg = Array.isArray(llms) ? llms.find((c) => c?.name === activeLlm) : void 0;
           const provider = defaultCfg?.provider ?? null;
-          jsonNoCors(res, {
+          json(res, {
             config,
             provider,
             revision,
@@ -9853,45 +9594,17 @@ function createRouter(dbOrDeps) {
             ...fileIssues.length > 0 ? { fileIssues } : {}
           });
         } catch (err) {
-          jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to read config" }, 500);
+          json(res, { error: err instanceof Error ? err.message : "Failed to read config" }, 500);
         }
       })();
       return;
     }
-    if (path === "/api/config/farm/test-connection" && req.method === "POST") {
-      readJsonBody(req).then(async (body) => {
-        if (body.provider !== "browserstack") {
-          json(res, { error: "Only BrowserStack is currently supported" }, 400);
-          return;
-        }
-        try {
-          const auth = Buffer.from(`${body.username}:${body.accessKey}`).toString("base64");
-          const response = await fetch("https://api-cloud.browserstack.com/app-automate/devices.json", {
-            headers: { Authorization: `Basic ${auth}` }
-          });
-          if (response.ok) {
-            json(res, { success: true });
-          } else if (response.status === 401) {
-            json(res, { success: false, error: "Invalid credentials" });
-          } else {
-            json(res, { success: false, error: `BrowserStack API returned ${response.status}` });
-          }
-        } catch (err) {
-          json(res, { success: false, error: err instanceof Error ? err.message : "Connection failed" });
-        }
-      }).catch(() => json(res, { error: "Invalid request body" }, 400));
-      return;
-    }
     if (path.startsWith("/api/auth/") && req.method === "DELETE") {
       const segments = path.split("/");
       if (segments.length === 4 && segments[2] === "auth") {
         const providerName = decodeURIComponent(segments[3]);
         if (providerName === "status" || providerName === "credential" || providerName === "oauth") {
         } else {
-          if (refuseCrossSiteRequest(req) !== void 0) {
-            jsonNoCors(res, { error: "cross_site_refused" }, 403);
-            return;
-          }
           ;
           (async () => {
             try {
@@ -9902,13 +9615,13 @@ function createRouter(dbOrDeps) {
                 return credential;
               });
               if (removed === void 0) {
-                jsonNoCors(res, { deleted: false });
+                json(res, { deleted: false });
                 return;
               }
               const undo = undoStore.put({ kind: "credential", name: providerName, credential: removed }, Date.now());
-              jsonNoCors(res, { deleted: true, undo });
+              json(res, { deleted: true, undo });
             } catch (err) {
-              jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to delete credential" }, 500);
+              json(res, { error: err instanceof Error ? err.message : "Failed to delete credential" }, 500);
             }
           })();
           return;
@@ -10018,27 +9731,21 @@ function createRouter(dbOrDeps) {
       const segments = path.split("/");
       const provider = segments.length >= 6 ? decodeURIComponent(segments[4] ?? "") : "";
       const action = segments.length >= 6 ? segments[5] : "";
-      const authDoor = req.method === "POST" && (action === "start" || action === "exchange");
-      if (authDoor && refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       const plugin = provider ? getLLMAuthProviderPlugin2(provider) : void 0;
       if (!plugin) {
-        ;
-        (authDoor ? jsonNoCors : json)(res, { error: `Auth plugin provider "${provider}" is not registered` }, 404);
+        json(res, { error: `Auth plugin provider "${provider}" is not registered` }, 404);
         return;
       }
       if (action === "start" && req.method === "POST") {
         readJsonBody(req).then(async (body) => {
           if (!plugin.startAuth) {
-            jsonNoCors(res, { error: `Provider "${provider}" does not support dashboard auth start` }, 400);
+            json(res, { error: `Provider "${provider}" does not support dashboard auth start` }, 400);
             return;
           }
           try {
             const target = await requirePluginAuthConfig(configManager, body.configName, plugin);
             if (!target.ok) {
-              jsonNoCors(res, credentialRefusalBody(target), target.status);
+              json(res, credentialRefusalBody(target), target.status);
               return;
             }
             const started = await plugin.startAuth({
@@ -10074,16 +9781,16 @@ function createRouter(dbOrDeps) {
                 session.error = err instanceof Error ? err.message : "Authentication failed";
               }).finally(() => cleanupPluginOAuthSession(session));
             }
-            jsonNoCors(res, {
+            json(res, {
               authorizeUrl: started.authorizeUrl,
               sessionId,
               mode: plugin.dashboardAuth.mode,
               created: target.created
             });
           } catch (err) {
-            jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to start auth plugin flow" }, 500);
+            json(res, { error: err instanceof Error ? err.message : "Failed to start auth plugin flow" }, 500);
           }
-        }).catch(() => jsonNoCors(res, { error: "Invalid request body" }, 400));
+        }).catch(() => json(res, { error: "Invalid request body" }, 400));
         return;
       }
       if (action === "result" && req.method === "GET") {
@@ -10111,22 +9818,22 @@ function createRouter(dbOrDeps) {
       if (action === "exchange" && req.method === "POST") {
         readJsonBody(req).then(async (body) => {
           if (!plugin.exchangeCode) {
-            jsonNoCors(res, { error: `Provider "${provider}" does not support code exchange` }, 400);
+            json(res, { error: `Provider "${provider}" does not support code exchange` }, 400);
             return;
           }
           const sessionId = typeof body.sessionId === "string" ? body.sessionId.trim() : "";
           const code = typeof body.code === "string" ? body.code.trim() : "";
           if (!sessionId || !code) {
-            jsonNoCors(res, { error: "sessionId and code are required" }, 400);
+            json(res, { error: "sessionId and code are required" }, 400);
             return;
           }
           const session = pluginOAuthSessions.get(sessionId);
           if (!session || session.providerId !== provider) {
-            jsonNoCors(res, { error: "Auth session not found" }, 404);
+            json(res, { error: "Auth session not found" }, 404);
             return;
           }
           if (session.status !== "pending") {
-            jsonNoCors(res, { error: "Auth session is no longer pending" }, 409);
+            json(res, { error: "Auth session is no longer pending" }, 409);
             return;
           }
           try {
@@ -10148,61 +9855,57 @@ function createRouter(dbOrDeps) {
               session.error = CREDENTIAL_PROVIDER_CONFLICT.message;
               cleanupPluginOAuthSession(session);
               pluginOAuthSessions.delete(sessionId);
-              jsonNoCors(res, credentialRefusalBody(CREDENTIAL_PROVIDER_CONFLICT), CREDENTIAL_PROVIDER_CONFLICT.status);
+              json(res, credentialRefusalBody(CREDENTIAL_PROVIDER_CONFLICT), CREDENTIAL_PROVIDER_CONFLICT.status);
               return;
             }
             session.status = "completed";
             cleanupPluginOAuthSession(session);
             pluginOAuthSessions.delete(sessionId);
-            jsonNoCors(res, { status: "completed", saved: true });
+            json(res, { status: "completed", saved: true });
           } catch (err) {
             session.status = "error";
             session.error = err instanceof Error ? err.message : "Token exchange failed";
             cleanupPluginOAuthSession(session);
             pluginOAuthSessions.delete(sessionId);
-            jsonNoCors(res, { error: session.error }, 500);
+            json(res, { error: session.error }, 500);
           }
-        }).catch(() => jsonNoCors(res, { error: "Invalid request body" }, 400));
+        }).catch(() => json(res, { error: "Invalid request body" }, 400));
         return;
       }
       json(res, { error: "Auth plugin route not found" }, 404);
       return;
     }
     if (path === "/api/auth/credential" && req.method === "POST") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       readJsonBody(req).then(async (body) => {
         const provider = typeof body.provider === "string" ? body.provider.trim() : "";
         const credentialType = typeof body.type === "string" ? body.type.trim() : "";
         const secret = typeof body.secret === "string" ? body.secret.trim() : "";
         if (typeof body.configName !== "string" || body.configName.trim() === "") {
-          jsonNoCors(res, { error: "configName is required" }, 400);
+          json(res, { error: "configName is required" }, 400);
           return;
         }
         if (!provider || !isKnownLLMProvider(provider)) {
-          jsonNoCors(res, { error: "valid provider is required" }, 400);
+          json(res, { error: "valid provider is required" }, 400);
           return;
         }
         if (credentialType !== "api-key" && credentialType !== "bearer-token") {
-          jsonNoCors(res, { error: "type must be api-key or bearer-token" }, 400);
+          json(res, { error: "type must be api-key or bearer-token" }, 400);
           return;
         }
         if (!secret) {
-          jsonNoCors(res, { error: "secret is required" }, 400);
+          json(res, { error: "secret is required" }, 400);
           return;
         }
         if (getLLMAuthProviderPlugin2(provider)) {
-          jsonNoCors(res, { error: "Subscription providers use OAuth login" }, 400);
+          json(res, { error: "Subscription providers use OAuth login" }, 400);
           return;
         }
         if (credentialType === "bearer-token" && provider !== "anthropic-compatible") {
-          jsonNoCors(res, { error: "bearer-token credentials are only supported for anthropic-compatible configs" }, 400);
+          json(res, { error: "bearer-token credentials are only supported for anthropic-compatible configs" }, 400);
           return;
         }
         if (credentialType === "api-key" && !API_KEY_CREDENTIAL_PROVIDERS.has(provider)) {
-          jsonNoCors(res, { error: "api-key credentials are not supported for this provider" }, 400);
+          json(res, { error: "api-key credentials are not supported for this provider" }, 400);
           return;
         }
         try {
@@ -10217,35 +9920,31 @@ function createRouter(dbOrDeps) {
             return checked;
           });
           if (!target.ok) {
-            jsonNoCors(res, credentialRefusalBody(target), target.status);
+            json(res, credentialRefusalBody(target), target.status);
             return;
           }
-          jsonNoCors(res, { saved: true, created: target.created });
+          json(res, { saved: true, created: target.created });
         } catch (err) {
-          jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to save credential" }, 500);
+          json(res, { error: err instanceof Error ? err.message : "Failed to save credential" }, 500);
         }
-      }).catch(() => jsonNoCors(res, { error: "Invalid request body" }, 400));
+      }).catch(() => json(res, { error: "Invalid request body" }, 400));
       return;
     }
     if (path === "/api/auth/credential/move" && req.method === "POST") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       readJsonBody(req).then(async (raw) => {
         const parsed = LlmCredentialMoveRequestSchema.safeParse(raw);
         if (!parsed.success) {
-          jsonNoCors(res, { error: "invalid_setup_input" }, 400);
+          json(res, { error: "invalid_setup_input" }, 400);
           return;
         }
         const from = checkCredentialName(parsed.data.from);
         const to = checkCredentialName(parsed.data.to);
         if (!from.ok || !to.ok) {
-          jsonNoCors(res, { error: "name_invalid" }, 400);
+          json(res, { error: "name_invalid" }, 400);
           return;
         }
         if (!configManager) {
-          jsonNoCors(res, { error: "Config manager is required to move credentials" }, 400);
+          json(res, { error: "Config manager is required to move credentials" }, 400);
           return;
         }
         try {
@@ -10263,25 +9962,21 @@ function createRouter(dbOrDeps) {
             return void 0;
           });
           if (refusal) {
-            jsonNoCors(res, credentialRefusalBody(refusal), refusal.status);
+            json(res, credentialRefusalBody(refusal), refusal.status);
             return;
           }
-          jsonNoCors(res, { moved: true });
+          json(res, { moved: true });
         } catch (err) {
-          jsonNoCors(res, { error: err instanceof Error ? err.message : "Failed to move credential" }, 500);
+          json(res, { error: err instanceof Error ? err.message : "Failed to move credential" }, 500);
         }
-      }).catch(() => jsonNoCors(res, { error: "invalid_setup_input" }, 400));
+      }).catch(() => json(res, { error: "invalid_setup_input" }, 400));
       return;
     }
     if (path === "/api/llm/test" && req.method === "POST") {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       readJsonBody(req).then(async (body) => {
         const rawBody = body;
         if ("apiKey" in rawBody) {
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: "invalid_request",
             message: "apiKey is not accepted in LLM test requests. Save credentials for the named config instead."
@@ -10291,7 +9986,7 @@ function createRouter(dbOrDeps) {
         const providerName = typeof body.provider === "string" ? body.provider.trim() : "";
         const modelName = typeof body.model === "string" ? body.model.trim() : "";
         if (!providerName || !modelName) {
-          jsonNoCors(res, { success: false, error: "invalid_request", message: "provider and model are required" }, 400);
+          json(res, { success: false, error: "invalid_request", message: "provider and model are required" }, 400);
           return;
         }
         const configName = typeof body.configName === "string" ? body.configName.trim() : "";
@@ -10316,7 +10011,7 @@ function createRouter(dbOrDeps) {
         }
         const parsedConfig = ModelConfigSchema2.safeParse(llmCandidate);
         if (!parsedConfig.success) {
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: "invalid_request",
             message: parsedConfig.error.issues.map((issue) => `${issue.path.map(String).join(".") || "config"}: ${issue.message}`).join("; ")
@@ -10328,7 +10023,7 @@ function createRouter(dbOrDeps) {
         const coreAuth = await import("@vostride/agent-qa-core");
         const resolvedAuth = await coreAuth.resolveLLMAuth(configName, llmConfig2);
         if (resolvedAuth.kind === "missing") {
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: "missing_credential",
             message: resolvedAuth.message
@@ -10357,7 +10052,7 @@ function createRouter(dbOrDeps) {
           } finally {
             clearTimeout(timeout);
           }
-          jsonNoCors(res, {
+          json(res, {
             success: true,
             model: modelName,
             provider: providerName,
@@ -10372,7 +10067,7 @@ function createRouter(dbOrDeps) {
           const providerMessage = withDeclaredMask(declaredMask, (mask) => mask(unsavedMessage));
           const errorClass = classifyProviderError2(providerMessage ?? unsavedMessage, statusCode);
           const message = providerMessage === void 0 ? providerErrorSentence2(errorClass, "").trimEnd() : providerErrorSentence2(errorClass, providerMessage);
-          jsonNoCors(res, {
+          json(res, {
             success: false,
             error: errorClass,
             message,
@@ -10382,7 +10077,7 @@ function createRouter(dbOrDeps) {
             ...unauthenticated ? { unauthenticated: true, authMessage } : {}
           });
         }
-      }).catch(() => jsonNoCors(res, { success: false, error: "invalid_request", message: "Invalid request body" }, 400));
+      }).catch(() => json(res, { success: false, error: "invalid_request", message: "Invalid request body" }, 400));
       return;
     }
     if (path === "/api/cache/purge" && req.method === "POST") {
@@ -10391,56 +10086,15 @@ function createRouter(dbOrDeps) {
         return;
       }
       readJsonBody(req).then(async (body) => {
-        if (!body.file && !body.all) {
-          json(res, { error: "Either file or all is required" }, 400);
+        if (body.all !== true) {
+          json(res, { error: "all is required" }, 400);
           return;
         }
         try {
           const cfg = await readConfigValues(configManager);
-          const cacheDir = cfg.services?.cache?.dir ?? cfg.cache?.dir;
-          if (!cacheDir) {
-            json(res, { error: "Cache directory not configured" }, 400);
-            return;
-          }
           const configDir = deps.configPath ? dirname9(resolve5(deps.configPath)) : process.cwd();
-          const resolvedCacheDir = resolve5(configDir, cacheDir);
-          let branchDirs;
-          try {
-            branchDirs = await readdir(resolvedCacheDir);
-          } catch (err) {
-            if (err.code === "ENOENT") {
-              json(res, { purged: 0 });
-              return;
-            }
-            throw err;
-          }
-          let purged = 0;
-          for (const branch of branchDirs) {
-            const branchPath = join4(resolvedCacheDir, branch);
-            let entryStat;
-            try {
-              entryStat = await stat5(branchPath);
-            } catch {
-              continue;
-            }
-            if (!entryStat.isDirectory()) {
-              await rm5(branchPath, { force: true });
-              continue;
-            }
-            let files;
-            try {
-              files = await readdir(branchPath);
-            } catch {
-              continue;
-            }
-            for (const file of files) {
-              if (!file.endsWith(".json")) continue;
-              await rm5(join4(branchPath, file), { force: true });
-              purged++;
-            }
-            await rm5(branchPath, { recursive: true, force: true }).catch(() => {
-            });
-          }
+          const cacheDir = cfg.services?.cache?.dir ?? DEFAULT_AGENT_QA_CACHE_DIR;
+          const purged = await purgeActionCache(resolve5(configDir, cacheDir));
           json(res, { purged });
         } catch (err) {
           json(res, { error: err instanceof Error ? err.message : "Cache purge failed" }, 500);
@@ -10524,7 +10178,7 @@ function createRouter(dbOrDeps) {
             return;
           }
           const workspaceEnv = await readWorkspaceEnvVars(workspacePaths);
-          const result = await new DockerHookExecutor2().execute(resolvedHook, {
+          const result = await new DockerHookExecutor2({ version: getAgentQaVersion2() }).execute(resolvedHook, {
             env: {
               ...workspaceEnv,
               ...validation.overrides
@@ -10560,7 +10214,7 @@ function createRouter(dbOrDeps) {
             variables: shown.variables,
             sandbox: {
               runtime: resolvedHook.runtime,
-              image: RUNTIME_IMAGE_MAP[resolvedHook.runtime],
+              image: hookRunnerImage(resolvedHook.runtime, getAgentQaVersion2()),
               networkMode: resolvedHook.network ? "enabled" : "disabled",
               dockerVersion: null,
               networkLogsAvailable: shown.networkLogs.length > 0,
@@ -10764,12 +10418,8 @@ function createRouter(dbOrDeps) {
       return;
     }
     if (req.method === "GET" && /^\/api\/live-editor\/sessions\/[^/]+\/live-url$/.test(path)) {
-      if (refuseCrossSiteRequest(req) !== void 0) {
-        jsonNoCors(res, { error: "cross_site_refused" }, 403);
-        return;
-      }
       if (!deps.mintEditorLiveUrl) {
-        jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+        json(res, { error: "live_view_unavailable" }, 503);
         return;
       }
       let editorSessionId;
@@ -10778,33 +10428,32 @@ function createRouter(dbOrDeps) {
           path.slice("/api/live-editor/sessions/".length, -"/live-url".length)
         );
       } catch {
-        jsonNoCors(res, { error: "unknown_session" }, 404);
+        json(res, { error: "unknown_session" }, 404);
         return;
       }
       void deps.mintEditorLiveUrl(editorSessionId).then(
         (result) => {
-          jsonNoCors(res, result);
+          json(res, result);
         },
         (error) => {
           const name = error instanceof Error ? error.name : "";
           if (name === "UnknownLiveEditorSessionError") {
-            jsonNoCors(res, { error: "unknown_session" }, 404);
+            json(res, { error: "unknown_session" }, 404);
             return;
           }
           if (name === "LiveViewUnavailableError") {
-            jsonNoCors(res, { error: "live_view_unavailable" }, 503);
+            json(res, { error: "live_view_unavailable" }, 503);
             return;
           }
-          jsonNoCors(res, { error: "live_url_mint_failed" }, 500);
+          json(res, { error: "live_url_mint_failed" }, 500);
         }
       );
       return;
     }
     const liveEditorAuthStateMatch = path.match(/^\/api\/live-editor\/sessions\/([^/]+)\/auth-state$/);
     if (liveEditorAuthStateMatch && req.method === "POST") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
       ;
@@ -10815,35 +10464,34 @@ function createRouter(dbOrDeps) {
           const body = await readJsonBody(req);
           const parsedName = AuthStateNameSchema.safeParse(typeof body?.name === "string" ? body.name : "");
           if (!parsedName.success) {
-            jsonNoCors(res, { error: "Auth state name must be a lowercase slug." }, 400);
+            json(res, { error: "Auth state name must be a lowercase slug." }, 400);
             return;
           }
           stateName = parsedName.data;
           session = sessionManager.getSession(decodeURIComponent(liveEditorAuthStateMatch[1]));
           if (!session) {
-            jsonNoCors(res, { error: "Session not found" }, 404);
+            json(res, { error: "Session not found" }, 404);
             return;
           }
           if (typeof session.captureWebAuthState !== "function") {
-            jsonNoCors(res, {
+            json(res, {
               error: `Could not save auth state "${stateName}" for target "${getSessionTargetNameForAuthState(session)}".`
             }, 500);
             return;
           }
           const authState = await session.captureWebAuthState(stateName, { replace: body?.replace === true });
-          jsonNoCors(res, { authState });
+          json(res, { authState });
         } catch (err) {
           const targetName = getSessionTargetNameForAuthState(session);
           const response = buildAuthStateSaveErrorMessage(stateName || "unknown", targetName, err);
-          jsonNoCors(res, { error: response.message }, response.status);
+          json(res, { error: response.message }, response.status);
         }
       })();
       return;
     }
     if (path === "/api/live-editor/sessions" && req.method === "POST") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
       ;
@@ -10851,16 +10499,10 @@ function createRouter(dbOrDeps) {
         try {
           const body = await readJsonBody(req);
           const targetName = typeof body?.targetName === "string" ? body.targetName : void 0;
-          const production = await resolveLiveTargetProduction(configManager, targetName);
-          const productionRefusal = liveProductionRefusal(production);
-          if (productionRefusal !== void 0) {
-            jsonNoCors(res, { error: productionRefusal.message }, 403);
-            return;
-          }
           const platform = body?.platform ?? "web";
           const runtimeLLM = await resolveDashboardRuntimeLLM(configManager, llmConfig, authFetch);
           if (!runtimeLLM.ok) {
-            jsonNoCors(res, { error: runtimeLLM.error }, 400);
+            json(res, { error: runtimeLLM.error }, 400);
             return;
           }
           const setupHooks = Array.isArray(body?.setupHooks) ? body.setupHooks.filter((value) => typeof value === "string" && value.trim().length > 0) : [];
@@ -10879,14 +10521,14 @@ function createRouter(dbOrDeps) {
           let resolvedHooks = /* @__PURE__ */ new Map();
           let hookRegistryError;
           if (!workspacePaths) {
-            jsonNoCors(res, { error: "Workspace path resolution not available" }, 500);
+            json(res, { error: "Workspace path resolution not available" }, 500);
             return;
           }
           try {
             const envContent = await readFile6(workspacePaths.envFile.absolutePath, "utf-8");
             envVars = parseEnvFile(envContent);
           } catch {
-            jsonNoCors(res, { error: `workspace.envFile file could not be loaded: ${workspacePaths.envFile.workspaceRelativePath}` }, 400);
+            json(res, { error: `workspace.envFile file could not be loaded: ${workspacePaths.envFile.workspaceRelativePath}` }, 400);
             return;
           }
           try {
@@ -10894,7 +10536,7 @@ function createRouter(dbOrDeps) {
             secretStore = SecretStore.fromEnvContent(secretsContent);
             secretRedactor = new SecretRedactor(secretStore);
           } catch {
-            jsonNoCors(res, { error: `workspace.secretsFile file could not be loaded: ${workspacePaths.secretsFile.workspaceRelativePath}` }, 400);
+            json(res, { error: `workspace.secretsFile file could not be loaded: ${workspacePaths.secretsFile.workspaceRelativePath}` }, 400);
             return;
           }
           const hookCatalog = await readWorkspaceHooks(configManager, deps.configPath);
@@ -10905,6 +10547,11 @@ function createRouter(dbOrDeps) {
             ...suiteFileManager === void 0 ? {} : { findSuite: (id) => suiteFileManager.findBySuiteId(id) }
           };
           const plannerLimits = await resolveLivePlannerLimits(configManager, entityRef, entityReaders);
+          const navigationTimeoutMs = await resolveLiveNavigationTimeoutMs(
+            configManager,
+            entityRef,
+            entityReaders
+          );
           const sessionSuiteRef = entityRef?.type === "suite" ? entityRef : void 0;
           const plannerLimitsForTest = (testId) => resolveLivePlannerLimits(
             configManager,
@@ -10915,7 +10562,6 @@ function createRouter(dbOrDeps) {
             {
               platform,
               targetName,
-              production: { productionTargetNames: production.productionTargetNames },
               plannerLimits,
               plannerLimitsForTest,
               llmConfig: runtimeLLM.llmConfig,
@@ -10929,6 +10575,7 @@ function createRouter(dbOrDeps) {
               hookRegistryError,
               url: body?.url,
               headless: body?.headless ?? false,
+              navigationTimeoutMs,
               useDeviceName: typeof body?.useDeviceName === "string" ? body.useDeviceName : void 0,
               appState: body?.appState === "preserve" || body?.appState === "reset" ? body.appState : void 0,
               bundleId: typeof body?.bundleId === "string" ? body.bundleId : void 0,
@@ -10938,38 +10585,37 @@ function createRouter(dbOrDeps) {
             },
             entityRef
           );
-          jsonNoCors(res, { sessionId, sessionNumber }, 201);
+          json(res, { sessionId, sessionNumber }, 201);
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          const status = err instanceof LiveProductionRefusedError ? 403 : err instanceof LivePlannerLimitsRefusedError ? 400 : 500;
-          jsonNoCors(res, { error: message }, status);
+          const refused = err instanceof LivePlannerLimitsRefusedError || err instanceof LiveNavigationTimeoutRefusedError;
+          const status = refused ? 400 : 500;
+          json(res, { error: message }, status);
         }
       })();
       return;
     }
     if (path === "/api/live-editor/sessions" && req.method === "GET") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
-      jsonNoCors(res, { sessions: sessionManager.listSessions() });
+      json(res, { sessions: sessionManager.listSessions() });
       return;
     }
     const liveEditorSessionMatch = path.match(/^\/api\/live-editor\/sessions\/([^/]+)$/);
     if (liveEditorSessionMatch && req.method === "DELETE") {
-      if (refuseCrossSiteDisplayRead(req, res)) return;
       if (!sessionManager) {
-        jsonNoCors(res, { error: "Live editor not available" }, 503);
+        json(res, { error: "Live editor not available" }, 503);
         return;
       }
       const sessionId = liveEditorSessionMatch[1];
       (async () => {
         const terminated = await sessionManager.terminateSession(sessionId);
         if (terminated) {
-          jsonNoCors(res, { ok: true });
+          json(res, { ok: true });
         } else {
-          jsonNoCors(res, { error: "Session not found" }, 404);
+          json(res, { error: "Session not found" }, 404);
         }
       })();
       return;
@@ -11018,6 +10664,7 @@ function createRouter(dbOrDeps) {
 // src/queue/job-queue.ts
 import { EventEmitter } from "node:events";
 import { cpus } from "node:os";
+import { printRunText as printRunText2 } from "@vostride/agent-qa-core";
 var NOT_CANCELLABLE = { kind: "not-cancellable" };
 var JobQueue = class extends EventEmitter {
   db;
@@ -11040,8 +10687,7 @@ var JobQueue = class extends EventEmitter {
     this.pollInterval = setInterval(() => this.dispatchReported("a poll"), intervalMs);
     this.on("enqueued", () => this.dispatchReported("an enqueue"));
   }
-  // 2026-10-17 (444-16, D-50): the server closes the database after this; a run that settles later
-  // still frees its slot, and nothing reads the closed database.
+  // The server closes the database after this; a run settling later still frees its slot.
   stop() {
     this.stopped = true;
     if (this.pollInterval) {
@@ -11127,7 +10773,10 @@ var JobQueue = class extends EventEmitter {
       this.processNext();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      console.error(`Queue could not dispatch the next run after ${trigger}: ${message}`);
+      printRunText2(
+        `Queue could not dispatch the next run after ${trigger}: ${message}`,
+        (text) => console.error(text)
+      );
     }
   }
   getActiveCount() {
@@ -11136,9 +10785,7 @@ var JobQueue = class extends EventEmitter {
   getConcurrency() {
     return this.concurrency;
   }
-  // 2026-10-16 (442-05, D-06 to D-08): only the owner cancels a running row; gone is an orphan.
-  // 442-15 (GAP-D2): own is the stamp this handle wrote, or equal non-null start times.
-  // 2026-10-17 (444-06, D-11): a running row is never written here; the run answers with its verdict.
+  // Only the owner stops its running row, never written here; a gone owner's row is an orphan.
   cancel(runId) {
     const run = this.db.getRun(runId);
     if (!run) return NOT_CANCELLABLE;
@@ -11168,21 +10815,7 @@ var JobQueue = class extends EventEmitter {
     const run = this.db.getRun(runId);
     return run && run.status !== "running" && run.status !== "pending" ? { kind: "finished", status: run.status } : NOT_CANCELLABLE;
   }
-  // 2026-08-24 (Phase 402 plan 09, D-11): THE CHILD-RUN CANCELLATION FAN-OUT IS DELETED WITH THE
-  // MODEL THAT MINTED ITS CHILDREN.
-  //
-  // ~19 lines stood here walking the run's child rows and cancelling each member row. Under
-  // the one-run model a parallel suite is ONE run row with member handles (402-04) — nothing writes
-  // the run row's parent-link column any more (405-07 then deleted the column outright), so the
-  // walk could only ever have read an empty list while reading as live cancellation policy.
-  // Cancelling the run cancels the run.
-  //
-  // WHAT THIS DOES NOT TOUCH: `parallel` below. D-11 keeps the queue's parallel flag as CROSS-RUN
-  // concurrency of INDEPENDENT jobs, which is what `findNextEligible` has always used it for. What
-  // was deleted is parallel-SUITE semantics, not the queue's ability to run two unrelated jobs.
-  //
-  // HISTORICAL ROWS: a pre-402 suite run still lists its members on the read side; cancelling
-  // such a run now leaves those member rows in whatever state their own process left them.
+  // `parallel` is cross-run concurrency of independent jobs; a suite is one run row.
   findNextEligible() {
     if (this.activeCount >= this.concurrency) return void 0;
     const pending = this.db.getPendingRuns();
@@ -11205,7 +10838,7 @@ var JobQueue = class extends EventEmitter {
 };
 
 // src/tests/suite-file-manager.ts
-import { readFile as readFile7, mkdir as mkdir4, stat as stat6, rm as rm6 } from "node:fs/promises";
+import { readFile as readFile7, mkdir as mkdir4, stat as stat5, rm as rm5 } from "node:fs/promises";
 import { dirname as dirname10, basename as basename6 } from "node:path";
 import { generateSuiteId } from "@vostride/agent-qa-ids";
 import { parse as parseYaml7 } from "yaml";
@@ -11216,14 +10849,14 @@ var SuiteFileManager = class {
     this.testFileManager = testFileManager;
   }
   testFileManager;
-  // 2026-10-18 (444-33, D-65; 444-35, D-66): each list call reads the workspace itself; each file is written whole and one writer at a time.
+  // Each list call reads the workspace itself; each file is written whole, one writer at a time.
   underLock = createPathLock();
   async list() {
     const records = await discoverWorkspaceFiles4({ workspace: this.workspace, kind: "suite" });
     const files = [];
     for (const record of records) {
       try {
-        const s = await stat6(record.absolutePath);
+        const s = await stat5(record.absolutePath);
         if (s.isFile()) {
           let suiteName = basename6(record.workspaceRelativePath);
           let testCount = 0;
@@ -11300,7 +10933,7 @@ var SuiteFileManager = class {
   }
   async delete(relativePath) {
     const target = await this.resolveTarget(relativePath, true);
-    await this.underLock(target.absolutePath, () => rm6(target.absolutePath));
+    await this.underLock(target.absolutePath, () => rm5(target.absolutePath));
   }
   async validate(content) {
     try {
@@ -11357,6 +10990,7 @@ import { request } from "node:http";
 import { spawn } from "node:child_process";
 import {
   formatAppiumInstallGuidance,
+  printRunText as printRunText3,
   resolveAppiumExecutable
 } from "@vostride/agent-qa-core";
 import treeKill from "tree-kill";
@@ -11484,21 +11118,21 @@ var AppiumManager = class {
       if (err.code === "ENOENT") {
         console.error(`${APPIUM_PREFIX} Appium not found. ${formatAppiumInstallGuidance()}`);
       } else {
-        console.error(`${APPIUM_PREFIX} Error: ${err.message}`);
+        printRunText3(`${APPIUM_PREFIX} Error: ${err.message}`, (text) => console.error(text));
       }
     });
     child.stdout?.on("data", (chunk) => {
       if (this.logLevel !== "debug") return;
       const lines = chunk.toString().split("\n").filter(Boolean);
       for (const line of lines) {
-        console.log(`${APPIUM_PREFIX} ${pc.dim(line)}`);
+        printRunText3(`${APPIUM_PREFIX} ${pc.dim(line)}`, (text) => console.log(text));
       }
     });
     child.stderr?.on("data", (chunk) => {
       if (this.logLevel !== "debug") return;
       const lines = chunk.toString().split("\n").filter(Boolean);
       for (const line of lines) {
-        console.error(`${APPIUM_PREFIX} ${pc.dim(line)}`);
+        printRunText3(`${APPIUM_PREFIX} ${pc.dim(line)}`, (text) => console.error(text));
       }
     });
     const start = Date.now();
@@ -11580,10 +11214,7 @@ var SessionManager = class {
     this.deps = deps;
   }
   sessions = /* @__PURE__ */ new Map();
-  // Per-entity counter keyed by `${entityType}:${entityId}`.
-  // Monotonic and ephemeral: resets on server restart per CONTEXT D-30.
-  // Never decremented on terminate — a re-open of a terminated entity yields
-  // the next number so "Session #3" after "#2" ends does not confuse users.
+  // Monotonic per entity and reset on restart, so a reopened entity gets the next number.
   counters = /* @__PURE__ */ new Map();
   async createSession(config, entity) {
     if (!config.llmConfig) {
@@ -11640,7 +11271,8 @@ var SessionManager = class {
 };
 
 // src/live-editor/ws-handler.ts
-import { parseTestFile } from "@vostride/agent-qa-core";
+import { format as format2 } from "node:util";
+import { parseTestFile, printRunText as printRunText4 } from "@vostride/agent-qa-core";
 
 // src/live-editor/types.ts
 var LIVE_EDITOR_UNKNOWN_SESSION_CLOSE_CODE = 4404;
@@ -11827,12 +11459,14 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
             try {
               raw = await testFileManager.read(msg.path);
             } catch (readErr) {
-              console.error(`[ws-handler] execute-test: read failed for path=${msg.path}`, readErr);
+              const line = `[ws-handler] execute-test: read failed for path=${msg.path}`;
+              printRunText4(format2(line, readErr), () => console.error(line, readErr));
               throw new Error(`Cannot read test file "${msg.path}": ${readErr?.message ?? String(readErr)}`);
             }
             const parsed = parseTestFile(raw, msg.path);
             if (parsed.errors.length > 0) {
-              console.error(`[ws-handler] execute-test: parse errors for ${msg.path}`, parsed.errors);
+              const line = `[ws-handler] execute-test: parse errors for ${msg.path}`;
+              printRunText4(format2(line, parsed.errors), () => console.error(line, parsed.errors));
               throw new Error(`Parse error in ${msg.path}: ${parsed.errors[0].message}`);
             }
             const testDef = parsed.tests[0];
@@ -11842,7 +11476,13 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
             const stepInstructions = testDef.steps.map(
               (s) => typeof s === "string" ? s : s.step
             );
-            console.log(`[ws-handler] execute-test: starting "${testDef.name}" (${stepInstructions.length} steps, setup=${(testDef.setup ?? []).length}, teardown=${(testDef.teardown ?? []).length})`);
+            const stepCount = stepInstructions.length;
+            const setupCount = (testDef.setup ?? []).length;
+            const teardownCount = (testDef.teardown ?? []).length;
+            printRunText4(
+              `[ws-handler] execute-test: starting "${testDef.name}" (${stepCount} steps, setup=${setupCount}, teardown=${teardownCount})`,
+              (text) => console.log(text)
+            );
             reply({
               type: "test-start",
               test: {
@@ -11864,7 +11504,11 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
                 teardown: testDef.teardown ?? []
               }
             );
-            console.log(`[ws-handler] execute-test: finished "${testDef.name}" status=${result.status} duration=${result.duration}ms${result.error ? ` error=${result.error}` : ""}`);
+            const errorPart = result.error ? ` error=${result.error}` : "";
+            printRunText4(
+              `[ws-handler] execute-test: finished "${testDef.name}" status=${result.status} duration=${result.duration}ms${errorPart}`,
+              (text) => console.log(text)
+            );
             reply({
               type: "test-complete",
               test: {
@@ -11877,11 +11521,9 @@ function createSessionHandler(session, onTerminate, onTokenUsage, testFileManage
             });
             reply({ type: "session-state", state: session.getState() });
           } catch (err) {
-            console.error(`[ws-handler] execute-test: caught error for path=${msg.path}`, {
-              message: err?.message,
-              stack: err?.stack,
-              code: err?.code
-            });
+            const line = `[ws-handler] execute-test: caught error for path=${msg.path}`;
+            const detail = { message: err?.message, stack: err?.stack, code: err?.code };
+            printRunText4(format2(line, detail), () => console.error(line, detail));
             reply({
               type: "test-error",
               test: {
@@ -12032,11 +11674,9 @@ var LIVE_EMBED_STATES = [
   "no-stream",
   "expired",
   "refused",
-  // THIS MEMBER'S STREAM ENDED WHILE THE RUN CONTINUES (403 CR-03). Separate the whole run's end,
-  // because a person watching one member of a suite needs to know which of the two happened — and
-  // neither may be shown as `live` over whichever frame happened to be last.
+  // This member's stream ended while the run continues, so the viewer knows which one ended.
   "stream-ended",
-  // AN EDITOR SESSION ENDED (428 D-07/D-09). An editor subject has no run to end.
+  // An editor session ended; an editor subject has no run to end.
   "session-ended",
   "ended",
   "lost"
@@ -12165,8 +11805,7 @@ function renderLiveEmbedPage(input) {
       if (pending === null) return;
       var header = pending;
       pending = null;
-      // NO MIME TYPE: the decoder sniffs the bytes, so a JPEG screencast frame and a PNG snapshot
-      // both paint in every host, not only in Chromium (428 RESEARCH A2).
+      // No MIME type: the decoder sniffs, so JPEG and PNG frames paint in every host.
       var blob = new Blob([event.data]);
       createImageBitmap(blob).then(function (bitmap) {
         if (canvas.width !== header.width || canvas.height !== header.height) {
@@ -12190,8 +11829,7 @@ function renderLiveEmbedPage(input) {
     try { msg = JSON.parse(event.data); } catch (e) { return; }
 
     if (msg.type === 'ready') {
-      // THE PAINTER IS CHOSEN BY THE DECLARED KIND \u2014 never by a browser name, an adapter class or
-      // a transport guess (LIVE-04's prohibition). A snapshot paints on the same canvas (428 D-11).
+      // The declared kind picks the painter, never a browser name, adapter or transport guess.
       var kind = msg.stream ? msg.stream.kind : undefined;
       if (kind === 'cdp-screencast' || kind === 'snapshot') {
         setState('connecting', 'waiting for the first frame\u2026');
@@ -12238,8 +11876,7 @@ function renderLiveEmbedPage(input) {
     report({ event: 'lost' });
   });
 
-  // A HOST THAT RE-MINTS replaces the fragment; the socket renews in place rather than reloading,
-  // so a renewal never costs the viewer the stream it is watching (D-02).
+  // A re-minting host replaces the fragment; the socket renews in place and the stream continues.
   window.addEventListener('hashchange', function () {
     var next = location.hash.slice(1);
     if (next === '' || socket.readyState !== 1) return;
@@ -12449,7 +12086,8 @@ function createFrameProxy(deps) {
 
 // src/server/server.ts
 import {
-  isLoopbackHost as isLoopbackHost2
+  isLoopbackHost as isLoopbackHost2,
+  printRunText as printRunText5
 } from "@vostride/agent-qa-core";
 var MIME_TYPES = {
   ".html": "text/html; charset=utf-8",
@@ -12469,9 +12107,10 @@ var MIME_TYPES = {
   ".webp": "image/webp"
 };
 var DashboardRemoteBindRefusedError = class extends Error {
-  constructor(host) {
+  constructor(host, port) {
+    const p = String(port === 0 ? 3470 : port);
     super(
-      `The dashboard was asked to bind ${host}, which is not a loopback interface. Nothing this server serves \u2014 the run trigger, the queue enqueue, the run service, the artifact serving, the config reads \u2014 asks for a credential, so a non-loopback bind would publish an anonymous run trigger to the network. Leave services.dashboard.host unset (it defaults to ${DEFAULT_DASHBOARD_HOST}), and reach a remote dashboard through an authenticating proxy or a tunnel you control.`
+      `The dashboard was asked to bind ${host}, which is not a loopback interface. Nothing this server serves \u2014 the run trigger, the queue enqueue, the run service, the artifact serving, the config reads \u2014 asks for a credential, so a non-loopback bind would publish an anonymous run trigger to the network. Leave services.dashboard.host unset (it defaults to ${DEFAULT_DASHBOARD_HOST}). To use the dashboard from another machine, forward its port with ssh -L ${p}:localhost:${p} <host> and open http://localhost:${p}/.`
     );
     this.host = host;
     this.name = "DashboardRemoteBindRefusedError";
@@ -12483,7 +12122,7 @@ async function startServer(opts) {
   const runServiceAttach = opts.runServiceAttach ?? runService?.attach;
   const host = opts.host?.trim() || DEFAULT_DASHBOARD_HOST;
   if (!isLoopbackHost2(host)) {
-    throw new DashboardRemoteBindRefusedError(host);
+    throw new DashboardRemoteBindRefusedError(host, port);
   }
   const resolvedConfigPath = configPath ?? resolve6("agent-qa.config.yaml");
   const configManager = new ConfigManager(resolvedConfigPath, opts.declaredSecretMask);
@@ -12518,7 +12157,7 @@ async function startServer(opts) {
           failureSummary = "Test timed out -- process was killed";
         } else if (details.refusedBeforeStart) {
           dbStatus = "failed";
-          refusalProse = details.neutralReason ?? details.reason;
+          refusalProse = details.reason;
           failureSummary = refusalProse ? `Refused before the run started: ${refusalProse}`.slice(0, 300) : "Refused before the run started";
         } else if (status === "completed") {
           dbStatus = "failed";
@@ -12599,7 +12238,10 @@ async function startServer(opts) {
         mobileRuns.set(run.id, platform);
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        console.error(`Failed to start Appium for run ${run.id}: ${message}`);
+        printRunText5(
+          `Failed to start Appium for run ${run.id}: ${message}`,
+          (text) => console.error(text)
+        );
         db.updateRun(run.id, {
           status: "failed",
           failureSummary: `Appium server failed to start: ${message}`,
@@ -12619,19 +12261,9 @@ async function startServer(opts) {
       runId: run.id,
       args,
       source: meta.isSuite ? "suite" : "dashboard",
-      // 2026-10-01 (432-14, D-14): no confirm scope is read off the row any more. The browser that
-      // triggered a run is not asked anything, so nothing about it has to survive the wait.
       attributes: run.attributes,
-      // T-401-G26 (401-23): a persisted row's timeout is VALIDATED at the seam that consumes it.
-      // `in-process-backend.ts:211` reads `opts.timeout ?? defaultTimeout` and validates AFTER, so
-      // any non-nullish nonsense here skips the default and leaves the run with no reclamation
-      // timer at all. An unusable value falls back to the backend's default rather than a number
-      // this call invented.
+      // The backend takes `opts.timeout ?? defaultTimeout`, so an unusable value falls back here.
       timeout: sanitizeQueuedExecutionTimeout(meta.timeout),
-      // THE LEASE ABOVE IS UNCHANGED; ONLY ITS DELIVERY IS. `acquireLease` still runs where it ran,
-      // still keys on this run id and still owns the bundled Appium's lifecycle (design-of-record).
-      // What used to ride `AGENT_QA_APPIUM_URL` in a child's environment now travels as an
-      // argument, because there is no child to carry an environment.
       ...isMobile ? { appiumUrl: appiumManager.getUrl() } : {}
     });
   });
@@ -12642,16 +12274,14 @@ async function startServer(opts) {
     appiumManager,
     configManager,
     configPath: resolvedConfigPath,
-    // 428 D-07: each created session registers here, which is what the frame socket attaches.
+    // Each created session registers here, which is what the frame socket attaches.
     ...liveEditorSubjects === void 0 ? {} : { liveEditorSubjects }
   });
   const servesLiveView = liveView !== void 0 && (runServiceAttach !== void 0 || liveEditorSubjects !== void 0);
   const apiRouter = createRouter({
     db,
     workspacePaths,
-    // 401-07: conditionally spread on the same house rule `agentHost` follows — an absent
-    // dependency is an ABSENT field, never a present `undefined`, so the router's own 503 arm is
-    // what decides, in one place.
+    // Absent dependencies are absent fields, so the router's own 503 arm decides in one place.
     ...executionBackend === void 0 ? {} : { executionBackend },
     jobQueue,
     testFileManager,
@@ -12662,27 +12292,13 @@ async function startServer(opts) {
     llmConfig,
     authFetch,
     sessionManager,
-    // 400-01: conditionally spread on the house rule an absent dependency is an ABSENT field and
-    // never a present `undefined` — the router's own 501 arm is what decides, in one place.
+    // Absent dependencies are absent fields, so the router's own 501 arm decides in one place.
     ...agentHost === void 0 ? {} : { agentHost },
-    // 402-05 (D-15): the same conditional-spread house rule. Absent means a legacy mount rather
-    // than an unconfigured service, and the router's own 503 arm is what decides, in one place.
     ...runServiceReadiness === void 0 ? {} : { runServiceReadiness },
-    // 402-08 (D-01): the LOCAL run-stream door's attach port, READ OFF `runService` rather than
-    // composed again. That derivation is the "one session registry serves both doors" claim in its
-    // structural form — there is no second wiring a composition root could forget or point
-    // somewhere else, and the two doors cannot end up attached to different registries. Absent
-    // `runService` means no registry exists at all, so the same conditional-spread house rule
-    // applies and the router's own 503 arm decides.
+    // Read off `runService` by default, so both doors attach to one session registry.
     ...runServiceAttach === void 0 ? {} : { runServiceAttach },
-    // 403 D-03: the mint route's port, on the same conditional-spread house rule — absent means
-    // this host serves no live view and the route's own 503 arm decides, in one place.
     ...liveView === void 0 ? {} : { mintLiveUrl: liveView.mintLiveUrl },
-    // 428 D-07: the editor mint, on the same house rule — absent means the editor mint route's own
-    // 503 decides.
     ...liveView?.mintEditorLiveUrl === void 0 ? {} : { mintEditorLiveUrl: liveView.mintEditorLiveUrl },
-    // 404-05 (D-16): the same conditional-spread house rule — absent means this host serves no
-    // post-processing push channel and the stream arm's own 503 decides, in one place.
     ...postProcessingRelay === void 0 ? {} : { postProcessingRelay }
   });
   const runServiceRouter = runService === void 0 ? void 0 : createRunServiceRoutes(runService);
@@ -12702,13 +12318,15 @@ async function startServer(opts) {
         apiRouter(req, res);
         return;
       }
+      if (refuseNonLoopbackHost(req) !== void 0) {
+        const address = server.address();
+        const boundPort = typeof address === "object" && address !== null ? address.port : port;
+        refuseForeignHostPage(res, boundPort);
+        return;
+      }
       if (req.method === "OPTIONS") {
-        res.writeHead(204, {
-          "Access-Control-Allow-Origin": "*",
-          "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-          "Access-Control-Allow-Headers": "Content-Type"
-        });
-        res.end();
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("Not Found");
         return;
       }
       if (req.method === "GET" && path.startsWith(LIVE_EMBED_PATH_PREFIX)) {
@@ -12743,17 +12361,16 @@ async function startServer(opts) {
         return;
       }
       if (uiDir) {
-        const filePath = path === "/" ? join5(uiDir, "index.html") : join5(uiDir, path);
+        const filePath = path === "/" ? join4(uiDir, "index.html") : join4(uiDir, path);
         try {
-          const fileStat = await stat7(filePath);
+          const fileStat = await stat6(filePath);
           if (fileStat.isFile()) {
             const content = await readFile8(filePath);
             const ext = extname(filePath);
             const contentType = MIME_TYPES[ext] || "application/octet-stream";
             res.writeHead(200, {
               "Content-Type": contentType,
-              "Content-Length": content.length,
-              "Access-Control-Allow-Origin": "*"
+              "Content-Length": content.length
             });
             res.end(content);
             return;
@@ -12761,12 +12378,11 @@ async function startServer(opts) {
         } catch {
         }
         try {
-          const indexPath = join5(uiDir, "index.html");
+          const indexPath = join4(uiDir, "index.html");
           const content = await readFile8(indexPath);
           res.writeHead(200, {
             "Content-Type": "text/html",
-            "Content-Length": content.length,
-            "Access-Control-Allow-Origin": "*"
+            "Content-Length": content.length
           });
           res.end(content);
           return;
@@ -12851,7 +12467,8 @@ async function startServer(opts) {
         session.clearIdleTimer();
         const handler = createSessionHandler(session, () => {
           void sessionManager.terminateSession(sessionId).catch((error) => {
-            console.error(`[live-editor] could not end session ${sessionId}`, error);
+            const line = `[live-editor] could not end session ${sessionId}`;
+            printRunText5(format3(line, error), () => console.error(line, error));
           });
         }, (event) => {
           db.insertTokenEvent(event);
@@ -12941,9 +12558,6 @@ var InProcessExecutionBackend = class extends EventEmitter2 {
     this.options = options;
     this.retentionMs = options.retentionMs ?? DEFAULT_HANDLE_RETENTION_MS;
   }
-  async preflight(opts) {
-    await this.options.preflightRun?.(opts);
-  }
   execute(opts) {
     const handle = {
       runId: opts.runId,
@@ -13019,9 +12633,7 @@ var InProcessExecutionBackend = class extends EventEmitter2 {
   settle(handle, error) {
     if (handle.timeoutTimer) clearTimeout(handle.timeoutTimer);
     let refusedBeforeStart = false;
-    let neutralReason;
     if (error !== void 0) {
-      neutralReason = dashboardNeutralReasonOf(error);
       const message = error instanceof Error ? error.message : String(error);
       for (const line of message.split("\n")) handle.output.push(line);
       refusedBeforeStart = handle.session === void 0;
@@ -13035,7 +12647,6 @@ var InProcessExecutionBackend = class extends EventEmitter2 {
     const details = {
       ...handle.completionReason === void 0 ? {} : { reason: handle.completionReason },
       ...refusedBeforeStart ? { refusedBeforeStart: true } : {},
-      ...neutralReason === void 0 ? {} : { neutralReason },
       output: [...handle.output]
     };
     this.emit("run-settled", handle.runId, handle.status, details);
@@ -13045,12 +12656,6 @@ var InProcessExecutionBackend = class extends EventEmitter2 {
     cleanup.unref();
   }
 };
-function dashboardNeutralReasonOf(error) {
-  if (typeof error !== "object" || error === null) return void 0;
-  const carried = error.neutralReason;
-  if (typeof carried !== "string" || carried.trim().length === 0) return void 0;
-  return carried;
-}
 function createInProcessExecutionBackend(options) {
   return new InProcessExecutionBackend(options);
 }
@@ -13185,7 +12790,6 @@ export {
   renderLiveEmbedPage,
   resolveDashboardDbPath,
   resolveRunOwnerHost,
-  runDenialOf,
   runRowIdentity,
   serializeConfigWrite,
   servePostProcessingRead,