- js/web: /overlay/ joins POPOUT_PREFIXES, so an overlay renders without the site's sidebar/header chrome (and the opaque wrapper that comes with it). - Both reload hooks poll the page's own origin instead of the configured API node: this page's code is whatever that origin served, and that is what a reload replaces. - The Vite route's validateSearch keeps numeric and boolean search values as strings, so ?versionPollMs= actually reaches the hook. - Both hosts check Object.hasOwn(OVERLAYS, name), so a name like __proto__ renders the diagnostic rather than resolving to something inherited from Object.prototype and reaching React as a component. - Tests: the overlay flows assert that nothing between the widget and the page paints a background, cover ?versionPollMs on the Vite frontend, and cover a prototype name.