Runs

A sandbox behind a default-deny wall: tap a host and a request walks from main.js to the wall — allowlisted passes through to a 200, denied bounces as EPERM — while the terminal accrues verdicts.