Root AGENTS.md becomes the stable contract layer and gains the missing
piece both recent agent sessions fumbled: a definition of done for
user-visible work. Done is something the user can open — (1) an e2e
scenario with direct links to the runs that prove the change, (2) the
session's dev server left up and reachable over the tailnet so the user
can take over, (3) an honest list of what to try by hand. The same
machinery runs in reverse: seed an environment into a state (live bug
repro, staged data) and hand across the link.

Mechanics move to a new RUNNING.md that opens by declaring itself
possibly stale — trust it as a starting point, verify against the code,
update on drift. It carries setup, the boot recipes (pointing at the
e2e globalsetup files as source of truth), run/viewer/sharing
operations, the leave-an-instance-up recipe with the Secure-cookie/
HTTPS constraint, and the hard-won environment gotchas.

e2e/AGENTS.md points at both. Docs deliberately avoid pinning URL
formats and flags that churn — agents discover those.

cd e2e && bun run cli — boot a target and keep it up (up [--share]),
mint identities, make typed API calls, drive MCP sessions, read the
emulator request ledger, and tear down (down). The point: develop
against a live instance with the exact machinery the tests use, then
crystallize the journey into a scenario — and the booted instance IS
the handoff demo (AGENTS.md evidence contract) and the seeding vehicle
(drive a bug repro or staged state, hand across the URL).

The boot recipes move out of the vitest globalsetups into shared
setup/<target>.boot.ts modules — one boot path for suites (ephemeral)
and the CLI (persistent, detached runner owning cloud's in-process
WorkOS/Autumn emulators). up --share binds the tailnet: plain http for
selfhost; for cloud it fronts both the app and the WorkOS emulator
with tailscale-serve HTTPS (Secure cookies) and threads the public
origins through WORKOS_API_URL / emulator baseUrl / Vite allowed
hosts. Instances are tracked in e2e/.dev/<target>.json so a deliberate
long-lived instance is distinguishable from a leak; logs land next to
the state file (boot.ts gains logFile + pids for that).

Verified: both targets up/down cleanly through the CLI, identity/api/
mcp/ledger all answer, a scenario attaches to a CLI-booted instance
via E2E_SELFHOST_URL, both refactored globalsetups boot standalone
(api-tools green on cloud + selfhost), full suite run — the two cloud
failures (sources-api envelope, auth-methods mixed-source) reproduce
identically on the clean baseline, so they predate this change.

0.7.0 ships EmulatorClient + connectEmulator: one typed handle over the
/_emulate control plane (credentials.mint, ledger.list/clear, seed,
reset, manifest, ...) wherever the emulator runs — locally spawned or
hosted. Every hand-rolled fetch + response cast goes away:

- connect-handoff: mints via credentials.mint and asserts against
  LedgerEntry[] (match on request.body) instead of substring-searching
  the raw ledger text.
- targets/cloud setAccessTokenTtl: client.seed() instead of a raw POST.
- CLI ledger command: typed entries, JSON output.
- emulate skill: the client table replaces the raw-endpoint table as
  the primary interface; raw /_emulate stays documented for curl use.

Also folds the CLI onto src/ports.ts claimPorts (from the worktree-env
PR this branch now stacks on) — the CLI's ad-hoc probe-and-walk is
gone; a held block lock marks the instance and releases on down.

Verified: connect-handoff green on selfhost + cloud (the ledger
assertion exercises the hosted resend emulator's typed client), the
token-expiry mcp-execute scenario green on cloud (exercises seed).