2026-10-03 18:42:41 +00:00
1 changed files with 7 additions and 4 deletions
@@ -181,10 +181,13 @@ host-only session cookie.
 Because those are browser behaviors, the split run also drives a **real browser**: a headless
 Chromium from an image pinned by digest, controlled over the Chrome DevTools Protocol by the
 smoke-test client with no added dependency. In it, a person signs in through the real form on the
-Dashboard hostname, the Dashboard loads a module's UI and contribution from the API hostname, the
+Dashboard hostname, the session cookie is present only for the API hostname, the Dashboard imports a
-session cookie is present only for the API hostname, the module's display page mounts on the API
+module's UI from the API hostname and the module's own credentialed requests succeed under CORS, no
-hostname, and sign-out ends the session. The split run installs the repository's module template as
+request is refused, the module's display page mounts on the API hostname with its service worker, and
-a test-only module so these paths exist; installations' own smoke tests cover their real modules.
+sign-out ends the session. The split run installs the repository's module template as a test-only
 module so these paths exist; installations' own smoke tests cover their real modules. Contribution
 artifacts are imported exactly as UI artifacts are, and the API's tests cover their CORS headers and
 those of realtime streams.
 ## Consequences