cad_http was listed for the agent so it could flip telemetry; now it is app-only, and a call without the page's capability header is refused before routing, while the agent keeps cad_open/show/view/screenshot and export tools. The tunnel shared between page and agent was the wrong trust boundary.
From the Grok pain-radar digests, Oct 28-29 2026 (Oct 28 8:41 AM ET through Oct 29 early-morning Haitch editions). Verified live 2026-10-29: issue/PR read; title and state confirmed.