- send_ok_raw: when SX wire format contains newlines (string literals),
fall back to (ok "...escaped...") instead of (ok-raw ...) to keep
the pipe single-line. Prevents multi-line responses from desyncing
subsequent requests.
- expand-components? flag set in kernel env (not just VM adapter globals)
so aser-list's env-has? check finds it during component expansion.
- SX_STANDALONE: restore no_oauth but generate CSRF via session cookie
so mutation handlers (DELETE etc.) still work without account service.
- Shell statics injection: only inject small values (hashes, URLs) as
kernel vars. Large blobs (CSS, component_defs) use placeholder tokens.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>