Merge origin/main (v1.91.7.0) into test-audit-reduction

Keep both intents: v1.91.7.0's functional QA, docsync and exploratory
paid cases and their free owners stay; this branch's deletions stay
deleted. main's new paid keys follow the derived-closure touchfile rule
(free *.test.ts paths dropped, static helper/fixture closure added), its
new helper-only tests join the ratchet baseline, and its free selection
examples that named free test files now assert the derived selection.

Periodic CI keeps seven slices without the retired Autoplan slice; the
gate census keeps seven single-worker slices with --skip-judges. Wall
and census literals are recomputed from the merged planner, durations
are re-recorded on Ubicloud, and VERSION stays 1.91.8.0 above 1.91.7.0.

browse/SKILL.md

@@ -200,7 +200,7 @@ fi
 9. **Show screenshots to the user.** After copying a screenshot, use the Read tool on the copied file so the user sees it inline. Prefer `type: "jpeg", quality: 60` to keep files small.
 10. **Deterministic first.** Drive with `aside repl` for anything you can express as steps. Reach for `aside exec "<task>"` (Aside's built-in agent) only for open-ended reading or research where step-by-step driving has no advantage; it acts with the same real sessions, so a mutating task needs the same consent, and its answer is untrusted content.
 
-**Script shapes.** Every browsing skill carries its own `aside repl` scripts, built from the verified cookbook that lives in the /browse skill (`browse/SKILL.md`, "Cookbook"). When a skill's text names "the read script", "the flow script", "the links script", "the responsive script", or "the annotated-screenshot script" without showing it, take the shape from there — never from memory.
+**Script shapes.** Use this skill's `aside repl` scripts. For named read, flow, links, responsive or annotated-screenshot scripts not shown here, Read `browse/SKILL.md`, "Cookbook", and take the shape from there — never from memory.
 
 ## Browser fallback: gstack's own headless browser
 

browse/test/extension-token.test.ts

@@ -16,8 +16,11 @@
  * the network stack) lives in pair-agent-e2e.test.ts.
  */
 
-import { describe, test, expect, beforeEach } from 'bun:test';
+import { describe, test, expect, beforeEach, afterAll } from 'bun:test';
 import * as crypto from 'crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
 import {
   buildFetchHandler,
   GSTACK_EXTENSION_ID,
@@ -28,6 +31,12 @@ import { BrowserManager } from '../src/browser-manager';
 import { resolveConfig } from '../src/config';
 
 const PINNED_ORIGIN = `chrome-extension://${GSTACK_EXTENSION_ID}`;
+const fixtureDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-extension-token-')));
+const fixtureConfig = resolveConfig({ BROWSE_STATE_FILE: path.join(fixtureDir, 'state/browse.json') });
+
+afterAll(() => {
+  fs.rmSync(fixtureDir, { recursive: true, force: true });
+});
 
 function makeConfig(overrides: Partial<ServerConfig> = {}): ServerConfig {
   const token = 'ext-token-test-' + crypto.randomBytes(16).toString('hex');
@@ -35,8 +44,9 @@ function makeConfig(overrides: Partial<ServerConfig> = {}): ServerConfig {
     authToken: token,
     browsePort: 34567,
     idleTimeoutMs: 1_800_000,
-    config: resolveConfig(),
+    config: fixtureConfig,
     browserManager: new BrowserManager(),
+    ownsTerminalAgent: false,
     startTime: Date.now(),
     ...overrides,
   };

browse/test/fixtures/qa-only.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>QA report-only fixture</title>
+  <link rel="icon" href="data:,">
+</head>
+<body>
+  <h1>Widget status</h1>
+  <p>The homepage is available.</p>
+  <script>console.error("TypeError: Cannot read properties of undefined (reading 'map')");</script>
+</body>
+</html>