e2e: crawl reset survives app navigation; dragoon docs carry the cut ledger

Two faces of the same verification round.

12-crawl returned to the homepage between links with a bare page.goto, and Plex
Web (signed out, so it renders its own sign-in iframe for its Plex-account flow)
keeps redirecting the top frame: Chromium cancelled our goto with
net::ERR_ABORTED, outside the try, so the whole crawl died — once as a 420 s
timeout in the deploy gate, once at 5.4 s on the same link. backHome() tolerates
that one error class and re-issues; any other error still propagates, and the
per-app verdict (guard settled, hostname, no authentik uidField, status < 500)
is unchanged. Plex was healthy throughout (container up 2 days, 32400 answering
HTTPS 401 / plain-HTTP empty reply), so this was app behaviour, not a fault —
recorded as gotcha 6 on the E2E page.

The 200,704 boot printed 5.5 GiB reserved and 74.1 GiB in all (not the ~5.4/~74
my arithmetic predicted), so every prose figure is re-keyed to the ledger, and
the runbook gains the second production-boot section: marker revision, pool
reservation, shape line, prompt-cache entry size, and the refusal contract at the
new ceiling (400 in 0.86 s naming 200704 and the 96,405-token overage, before any
prefill). Cost stated (two maximum-length conversations never coexist; the 180k
compaction target is unreachable inside a 155,648 window) and purchase stated
(1.7 GiB of page cache, 9.1 GiB against the 2026-10-06 shape).

tests/e2e/specs/12-crawl.spec.ts

@@ -20,6 +20,25 @@ async function settleThroughGuard(page: Page, targetHost: string): Promise<void>
   expect(await page.locator('input[name="uidField"]').count()).toBe(0);
 }
 
+async function backHome(page: Page): Promise<void> {
+  // The homepage is the loop's only anchor, and some apps keep issuing their
+  // OWN navigation after load — Plex Web's "would like to sign in to your
+  // Plex account" iframe redirects the top frame, which cancels our goto with
+  // net::ERR_ABORTED. That abort is the app's behaviour, not a guard-chain
+  // failure (the app itself was already judged above), so tolerate it and
+  // re-issue rather than letting one host abort the whole crawl.
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try {
+      await page.goto("/", { waitUntil: "domcontentloaded" });
+      return;
+    } catch (err) {
+      if (!String(err).includes("ERR_ABORTED")) throw err;
+      await page.waitForTimeout(1_000);
+    }
+  }
+  await page.goto("/");
+}
+
 test("every user open link reaches its app", async ({ page }) => {
   test.setTimeout(420_000);
   // Expected link count comes from the live registry, mirroring the
@@ -47,7 +66,7 @@ test("every user open link reaches its app", async ({ page }) => {
     } catch (err) {
       failures.push(`${link.label}: ${err instanceof Error ? err.message : String(err)}`);
     }
-    await page.goto("/");
+    await backHome(page);
   await expect(page.locator("#grid a.open")).toHaveCount(expectedUserLinks);
   }
   expect(failures, failures.join("\n")).toEqual([]);