Pup - the AI's own browser

@@ -449,6 +449,57 @@ the user. Every detection signal was shipped and every one false-fired (`GetLast    verb and the off-screen SELF-HEAL (which checks bounds first and never touches an on-screen    window). +## The browser demarcation line — the Aditya/Google-auth incident (2026-07-17, GOLD, do not forget)++**The principle: pup is the ANONYMOUS, SANDBOXED automation browser. The user's identity lives in+their branded browser (abe's domain) or a plain native OS launch. When pup runs on the user's+INSTALLED branded Chrome/Edge, that line blurs and the browser's own identity machinery interleaves+with pup's "anonymous" windows in ways pup cannot control. Chrome for Testing (CfT) IS the line of+demarcation: an automation-first binary with no profile/sync/sign-in machinery, visibly distinct+from the user's browser.**++**The incident, step by step (each step looked reasonable; the cascade was a mess):**+1. Aditya's AI thread set up adom-google, which needed a Google OAuth sign-in page. The thread asked+   pup to open it. pup opened it in a fresh anonymous profile — of the INSTALLED branded Chrome.+2. He signed into Google. Branded Chrome then offered to turn that anonymous profile into a full+   signed-in Google work profile. He said yes (it looks like the right thing to say).+3. Now he had TWO Chrome profiles for his work identity. Chrome detected the duplicate and prompted+   him to CONSOLIDATE profiles. Confusion begins.+4. The consolidation opened a new profile-colored ("green") window WITHOUT his original URL. He was+   now fully lost.+5. He asked his AI to open the page again → a NEW pup window (fresh anonymous profile) → not signed+   in anymore → he signed in again → the whole cascade repeated.++**The lessons, each of which is a rule:**+1. **Auth flows do not belong in pup.** pup's profiles are disposable and anonymous BY DESIGN; a+   user signing into a real account inside one either gets lost on the next fresh window or triggers+   the branded browser's profile machinery. When a caller opens a known auth/login URL+   (accounts.google.com, login.microsoftonline.com, okta, auth0, github.com/login, etc.), pup should+   answer with a HINT: "pup is the anonymous sandboxed browser — for signing into the USER's+   accounts use abe (nbrowser_*, their real signed-in browser) or a plain native OS launch+   (AD-core `desktop_open_url`), where their sessions and password manager already live."+2. **The plain native OS launch must stay a first-class option.** AD-core `desktop_open_url`+   (ShellExecute → default browser) is the ZERO-machinery path: the user's own browser, their own+   default profile, no bridge in the loop. John's words: "we're almost getting too fancy with+   browsers now" — when in doubt, the boring OS-level open is correct, especially for auth.+3. **Branded-browser fallback is where identity bleed happens.** Even a perfectly isolated+   `--user-data-dir` runs the USER'S branded binary: first-run/sign-in/default-browser promos,+   profile-creation offers after login, profile-consolidation prompts, sync nags. None of that+   exists in CfT. This incident is the concrete case for wiki issue #202 (prefer CfT): the pick+   order should converge to **cached CfT → installed Chrome → Edge → CfT-download-last-resort**,+   with a background `browser_prewarm` whenever a branded fallback was used, so every box reaches+   the deterministic CfT state by its second session without ever stalling a first open.+4. **Visual demarcation matters to the human.** Part of the confusion was that pup's window WAS+   branded Chrome — indistinguishable from his real browser (plus a surprise green profile window).+   With CfT the pup window is a distinct binary (plus the teal taskbar badge), so "this is the AI's+   sandbox, not my browser" is legible at a glance.++**Ecosystem map (who owns what):** pup = anonymous sandboxed automation (CfT ideally). abe+(nbrowser_*) = the user's REAL signed-in browser, for anything needing their sessions/identity.+`desktop_open_url` = plain native OS launch, no automation, the right tool for "just open this for+the user" and for auth when abe isn't warranted. Steering between these belongs in pup's hints and+the pup/abe skills — the calling AI can only pick the right surface if the surfaces say who they are.+ ## The foreground gate (v1.8.70) — abe-parity dual key, and the AD interception hole  Foregrounding (open `foreground:true`, `browser_raise_os_window`, `browser_focus_window`) requires a