diff --git a/README.md b/README.md
index b622f58..a055cf0 100644
--- a/README.md
+++ b/README.md
@@ -24,8 +24,10 @@ Install or reuse FixLab, register its MCP server, and onboard this repository
 with --runtime copilot. Follow FIXLAB-SETUP.md if supplied; otherwise use:
 https://github.com/MonaDevAI/FixLab/blob/main/docs/installation.md
 Review the real profile and setup plan with me before each change.
-Prepare only required Playwright/live authentication, run Doctor, and start
-or reuse the matching dashboard. I will complete sign-in/MFA myself.
+Ask me for missing setup details; do not guess paths or settings.
+Use Microsoft Edge by default for required browser validation. Review feed
+access, dedicated browser SSO and private-state protection; run Doctor.
+Ask before starting or reusing the matching dashboard. I will complete MFA.
 Preserve my code and running services. Do not start a job or publish changes.
 ```
 
@@ -38,33 +40,6 @@ use [installation.md](installation.md) and the
 Setup still requires reviewed approvals; installing FixLab alone does not
 establish application readiness or grant permissions.
 
-### Stop or replace an unused dashboard
-
-At `fixlab>`, `/stop` stops the job and leaves it resumable; `/exit` disconnects
-chat without stopping the dashboard. Press **Ctrl+C in the dashboard's
-terminal** to stop the server and release its port.
-
-If Copilot started it in the background, ask:
-
-> Shut down FixLab on port 4317 and only its owned processes. Leave other
-> applications running.
-
-Start a replacement using the available port:
-
-```powershell
-fixlab dashboard C:\source\application --port 4317 --runtime copilot
-```
-
-In another terminal, connect chat to that same port:
-
-```powershell
-fixlab chat C:\source\application --port 4317 --runtime copilot
-```
-
-Closing a browser tab or exiting Copilot does not stop a detached dashboard.
-No reinstall or file deletion is needed. Restarting preserves saved jobs;
-submit a new request for a fresh job.
-
 ## What you can do
 
 | Workflow | Outcome |
@@ -104,13 +79,57 @@ See [architecture and benefits](docs/architecture-overview.md) for components,
 benefits, deployment, recovery, and trust boundaries, or the
 [architecture reference](docs/architecture.md) for runtime and MCP contracts.
 
+## Work in the dashboard
+
+After setup, ask Copilot:
+
+> Start or reuse this repository's FixLab dashboard with `--runtime copilot`
+> and show me its local URL. Ask me if any setup details are missing.
+> Do not start a job.
+
+Or start it manually and open the printed local URL:
+
+```powershell
+fixlab dashboard C:\source\application --port 4317 --runtime copilot
+```
+
+Follow the [dashboard user guide](docs/getting-started.md) to submit a request,
+choose run options, handle approvals, review evidence, and resume saved work.
+
+### Stop or replace an unused dashboard
+
+At `fixlab>`, `/stop` stops the job and leaves it resumable; `/exit` disconnects
+chat without stopping the dashboard. Press **Ctrl+C in the dashboard's
+terminal** to stop the server and release its port.
+
+If Copilot started it in the background, ask:
+
+> Shut down FixLab on port 4317 and only its owned processes. Leave other
+> applications running.
+
+Start a replacement using the available port:
+
+```powershell
+fixlab dashboard C:\source\application --port 4317 --runtime copilot
+```
+
+Optionally, in another terminal, connect chat to that same port:
+
+```powershell
+fixlab chat C:\source\application --port 4317 --runtime copilot
+```
+
+Closing a browser tab or exiting Copilot does not stop a detached dashboard.
+No reinstall or file deletion is needed. Restarting preserves saved jobs;
+submit a new request for a fresh job.
+
 ## Documentation
 
 | Start here | Read next |
 | --- | --- |
 | [First installation](installation.md) | Prerequisites, machine changes, and reviewed setup |
 | [Detailed installation](docs/installation.md) | Copilot prompt, VS Code, updates, and optional integrations |
-| [Getting started](docs/getting-started.md) | First job, dashboard use, approvals, and recovery |
+| [Dashboard user guide](docs/getting-started.md) | Startup, requests, approvals, evidence, recovery, and shutdown |
 | [Architecture and benefits](docs/architecture-overview.md) | Component diagrams, job flow, deployment, and trust boundaries |
 | [Repository onboarding](docs/repository-onboarding.md) | Profiles, worktrees, API-only validation, and linked applications |
 | [Troubleshooting](docs/troubleshooting.md) | Installation, authentication, runtime, and validation blockers |
diff --git a/docs/FIXLAB-SETUP.md b/docs/FIXLAB-SETUP.md
index 69d395c..03d96f2 100644
--- a/docs/FIXLAB-SETUP.md
+++ b/docs/FIXLAB-SETUP.md
@@ -1,40 +1,44 @@
-# Easy FixLab setup with Copilot
+# FixLab setup with Copilot: feeds, Microsoft Edge, and corporate SSO
 
-Choose the one-prompt path for the fastest guided setup. Use this Markdown guide
-for reusable, reviewable repository instructions. In either path, review the
-proposed plan and approve each setup change before it is applied.
+Use this guide to set up a React and .NET repository with FixLab and the
+Copilot runtime. Inspect the actual checkout, show the plan, and ask before
+applying setup changes. Complete genuine sign-in/MFA yourself.
+
+This guide is not an installer or blanket permission grant. Do not start a
+bug-fixing job, commit, push, publish packages, or create a pull request.
 
 ## Option 1: paste one prompt
 
-Open Copilot in the repository you want to onboard and paste:
+Open Copilot in the target checkout and paste:
 
 ```text
-Install or reuse FixLab, register its MCP server, and onboard this repository
-with --runtime copilot. Review the real repository profile and setup plan
-with me before applying changes. Prepare Playwright and genuine live
-authentication when required by the profile, run Doctor, and start or reuse
-the matching dashboard. Ask before changes, preserve my application code,
-and do not start a job.
+Onboard the actual repository with --runtime copilot. Follow:
+https://github.com/MonaDevAI/FixLab/blob/main/docs/FIXLAB-SETUP.md
+If unavailable, use the manual installation guide:
+https://github.com/MonaDevAI/FixLab/blob/main/docs/installation.md
+Inspect first, show the plan, and ask before changes or when details are missing.
+Reuse compatible installed tools and preserve application code and edits.
+Resolve npm/Yarn and NuGet feed authentication separately using approved
+repository helpers and genuine human sign-in. Use Microsoft Edge by default
+for required browser validation, not bundled Chromium. For corporate SSO,
+use a dedicated persistent Edge profile, not a private context or my normal
+browser profile. Keep authentication state ignored, inside the browser
+working directory, excluded from development-server watching, and denied
+by its file server. Verify genuine authentication proof, Doctor, and the
+dashboard authentication-status endpoint. Ask before starting or reusing
+the matching idle dashboard and do not start a job.
 ```
 
-You still approve reviewed setup actions and complete sign-in/MFA yourself.
-
 ## Option 2: give Copilot this Markdown file
 
-1. Copy this file into the target repository's root. Do not overwrite an existing
-   setup guide without reviewing it.
-2. Open Copilot in that checkout.
-3. Enter:
+Copy this file into the target checkout root without overwriting an existing
+guide. Alternatively, attach it or provide its actual path, then say:
 
 ```text
 Read @FIXLAB-SETUP.md and set up FixLab for this repository.
 Show the plan and ask before applying changes.
 ```
 
-If the file is elsewhere, attach it or give Copilot its actual path instead.
-This document is an instruction guide, not an automatic installer or permission
-grant. The steps below are for Copilot to follow after the user's setup request.
-
 ## If the guide is unavailable
 
 The file is optional. Follow FixLab's
@@ -45,34 +49,49 @@ request a missing attachment. Keep the same review and authentication safeguards
 
 ## Instructions for Copilot
 
-### 1. Inspect before changing anything
-
-- Read the checkout's contributor instructions and inspect `git status --short`.
-- Confirm the repository path, runtime, application ports, and dashboard port.
-- Preserve existing edits, branches, dependency junctions, and running services.
-- Check Git, supported Node.js/npm, PowerShell on Windows, and the authenticated
-  Copilot runtime. Explain missing prerequisites before installing anything.
-- Reuse a compatible Node installation and respect the application's version
-  pin; do not replace a working global runtime merely to match FixLab's test pin.
-
-### 2. Install or reuse FixLab
-
-Check `Get-Command fixlab` and `fixlab --help`. Reuse an approved installed version.
-If installation is needed, show and request approval for:
+### 1. Inspect and agree on the plan
+
+- Read contributor instructions and inspect `git status --short`.
+- Confirm the repository root, actual frontend/backend/test directories,
+  application commands, environment, health URLs, and ports.
+- Agree on a free dashboard port. Reuse a verified matching instance when
+  appropriate; do not stop unrelated services.
+- Inspect version pins, package manifests, lockfiles, dependency junctions,
+  existing FixLab files, and installed tools.
+- Check Git, supported Node/npm, PowerShell on Windows, the authenticated
+  Copilot runtime, and the SDK selected by `global.json` when applicable.
+- Run `dotnet --version` from the checkout when .NET is required; listing
+  installed SDKs alone does not prove that the repository's SDK can resolve.
+- Install a missing compatible SDK alongside existing SDKs after approval.
+  Do not rewrite `global.json` or replace a working Node installation merely
+  to match a tool's test environment.
+- Match the repository's package manager. A Yarn Classic lockfile is not
+  permission to switch to npm, drop resolutions, or generate another lockfile.
+
+Use confirmed values for `$Repo`, `$Frontend`, `$BackendProject`, and
+`$DashboardPort`. They are not example directories to create.
+
+Review separate scopes before applying them: machine tools/MCP, repository
+scaffolding/profile, dependency restores, feed credential refresh, Playwright,
+authentication helpers/private state, development-server exclusions, and
+dashboard startup.
+
+### 2. Install or reuse FixLab and connect MCP
+
+Inspect `Get-Command fixlab` and `fixlab --help`. Reuse a compatible approved
+installation. If absent, request approval before:
 
 ```powershell
 npm install --global github:MonaDevAI/FixLab
 fixlab --help
 ```
 
-Do not disable TLS verification or change private-feed credentials. If enterprise
-policy restricts public GitHub access, use only an organization-approved source
-as described in the detailed installation guide.
-
-### 3. Connect Copilot through MCP
+Use an organization-approved distribution when public GitHub access is
+restricted. Never disable TLS verification or change feed endpoints to get
+around an installation failure.
 
-Inspect an existing registration with `copilot mcp get fixlab`; reuse it if it
-points to the correct installation. Otherwise show and review:
+Inspect `copilot mcp get fixlab`. Reuse a correct registration; otherwise,
+review and approve:
 
 ```powershell
 $FixLabMcp = Join-Path (npm root --global) '@fixlab\cli\mcp\server.js'
@@ -83,79 +102,427 @@ copilot mcp add fixlab -- node $FixLabMcp
 copilot mcp get fixlab
 ```
 
-Check the connection through `/mcp` in Copilot; reopen the session if necessary.
-Registration does not start a dashboard, grant tool permissions, or establish
-application authentication.
+Check `/mcp`; reopen the Copilot session if needed. Registration does not
+grant tool permissions, start the dashboard, or authenticate the application.
+If npm reports a blocked package install script, verify the affected feature.
+Do not globally enable all scripts; review a narrowly scoped remedy only if
+a required operation actually fails.
+
+### 3. Approve scaffolding before first-run onboarding
 
-### 4. Onboard the actual checkout
+**Important:** first-run `onboard` can create the profile, agent, and prompts
+even without `--yes`. Do not describe that first run as read-only.
 
-Set `$Repo` to the confirmed repository path, then run:
+Before running it, inspect existing files and show the proposed scaffolding
+under `.github\fixlab`, `.github\agents`, and `.github\prompts`. Get approval
+for creating missing files, then run:
 
 ```powershell
 fixlab onboard $Repo --runtime copilot
 ```
 
-Review `.github\fixlab\repository-profile.json` using the real component paths,
-startup commands, health URLs, tests, validation gates, browser tooling, and
-authentication helpers. Show proposed changes and the onboarding plan.
+Inspect the generated profile before proceeding. Replace example paths,
+commands, branch names, ports, and authentication defaults with verified
+repository values. Do not create empty `frontend` or `backend` directories.
+
+Default to Microsoft Edge for a new browser UI setup. Before approving a
+restore/browser-install plan, merge `"browser": "chromium"` and
+`"channel": "msedge"` into `browserAutomation`. The first value selects the
+Playwright engine; the channel launches installed Edge, not bundled Chromium.
+Do not overwrite a repository's explicitly approved alternative without review.
+API-only and explicitly unit-only profiles do not need a browser.
+
+Preserve required tests and validation gates. Check the actual test script
+before adding arguments: do not combine Jest's `--runInBand` with an existing
+`--maxWorkers` option. Do not invent a `type-check` or `test:e2e` script.
 
-After review and explicit approval, apply only that plan:
+Review restore commands and their working directories. After approving the
+actual restore and browser-install plan:
 
 ```powershell
 fixlab onboard $Repo --yes --runtime copilot
 ```
 
-Do not treat example profile paths as real or remove required validation gates.
+`--yes` can execute setup commands; it is not just approval to save a profile.
+If the plan includes an unapproved action, do not run it.
+
+### 4. Restore dependencies and handle feed authentication
+
+Treat these as three independent authentication surfaces:
+
+| Surface | What successful authentication proves |
+| --- | --- |
+| npm/Yarn private feed | Access to frontend packages |
+| NuGet private feed | Access to .NET packages |
+| Application/browser SSO | Access to the signed-in application |
+
+Neither feed authentication nor `az login` proves browser sign-in.
+
+#### npm or Yarn: 401 Unauthorized
+
+Identify the failing feed from the package-manager error, `.npmrc` source
+settings, and lockfile URLs. Report only a sanitized feed description; redact
+private organization, project, feed identifiers, credentials, and URL parameters.
+Do not print `.npmrc` credentials or tokens.
+
+Search package scripts and repository instructions for an existing approved
+authentication helper. If it uses `vsts-npm-auth` and that command is missing,
+review and request approval before:
+
+```powershell
+npm install --global vsts-npm-auth
+```
+
+For a repository that actually defines `refresh:pat`, run its reviewed helper
+from the frontend directory after approving credential refresh:
+
+```powershell
+Set-Location -LiteralPath $Frontend
+npm run refresh:pat
+```
+
+The user completes any required sign-in. Do not invent that script for other
+repositories or replace their approved authentication mechanism.
+
+Verify access by retrying the original lockfile-respecting restore, for example
+`yarn install --frozen-lockfile` for an applicable Yarn Classic repository.
+A helper exit code alone is not proof of package access.
+
+Do not change private URLs to public npm, delete lockfiles, use
+`--ignore-engines` to hide incompatibility, or run destructive clean/refresh
+scripts as an authentication workaround.
+
+#### NuGet: 401, NU1301, or interactive authentication required
+
+`NU1301` can also mean connectivity or TLS failure. Check the underlying
+response before treating it as a credential problem.
+
+Inspect the actual NuGet source configuration without displaying credentials.
+Reuse the existing approved Azure Artifacts Credential Provider when present.
+After approving interactive feed authentication:
+
+```powershell
+dotnet restore $BackendProject --interactive
+```
+
+The user completes the provider's normal sign-in. Retry the ordinary approved
+restore afterward to verify access.
+
+If the credential provider is missing, review its
+[official installation instructions](https://github.com/microsoft/artifacts-credprovider)
+and ask before installing:
+
+- The documented `dotnet tool` installation method requires SDK 9.0.200 or later.
+- For a .NET 8 setup, use the documented compatible NuGet plugin installation
+  path instead of upgrading the application's SDK just to install the tool.
+- Review downloaded installation scripts before execution; do not blindly pipe
+  internet content into a shell.
+
+Keep tokens in the approved user credential store/cache, not committed
+`NuGet.Config`, scripts, profiles, or logs. Never turn off TLS checks, remove
+private sources, clear all caches, or repeatedly retry unchanged credentials.
+If access is denied after valid sign-in, report the permission requirement.
+
+### 5. Prepare Playwright with Microsoft Edge by default
+
+Follow the profile: browser UI, API-only, and explicitly unit-only validation
+have different requirements. Do not disable required live coverage to pass
+Doctor, or add a browser to an API-only setup.
 
-### 5. Prepare required Playwright and live authentication
+For browser UI validation, confirm the reviewed profile selects Edge:
 
-Follow the profile's actual browser/API/unit-only requirements. Do not add a
-browser to an API-only job or disable required live coverage to pass readiness.
+```json
+{
+  "browser": "chromium",
+  "channel": "msedge"
+}
+```
+
+These are fields inside `browserAutomation`, not a complete profile.
+Prefer a compatible installed Edge channel. If Edge is unavailable, report the
+missing prerequisite and ask before installing it or choosing an approved
+alternative. Do not silently fall back to bundled Chromium.
 
-Review the browser-tool installation plan when applicable:
+Review:
 
 ```powershell
 fixlab setup-playwright $Repo
 ```
 
-If tools are missing, apply with `--yes` only after approval. Reuse compatible
-installed tools and do not install through unreviewed shared dependency junctions.
+For a browser profile, this may propose adding `@playwright/test` to the actual
+project and installing the configured channel. Explain manifest/lockfile and
+machine changes. After approval:
+
+```powershell
+fixlab setup-playwright $Repo --yes
+```
+
+Verify an actual Edge launch, not merely the package version or executable
+path. Do not install through an unreviewed shared `node_modules` junction.
+
+### 6. Put private browser state in a valid, protected location
+
+FixLab dashboard authentication `statusPaths` must resolve **inside**
+`browserAutomation.workingDirectory`. A path that escapes that directory with
+`..` can pass CLI checks yet fail the dashboard's authentication-status check.
+Do not bypass containment with symlinks.
+
+For a browser working directory equal to the frontend directory, a suitable
+layout is:
+
+```text
+ACTUAL_FRONTEND_DIRECTORY\
+  .fixlab-local\
+    auth-local.json
+    edge-profile\
+```
+
+`ACTUAL_FRONTEND_DIRECTORY` means the existing application directory.
+Keep repository-owned helper code under `.github\fixlab` if desired; the
+helper's code location does not determine where credentials belong.
+
+Before writing or moving any state:
+
+- Add a repository ignore rule for the actual frontend's `.fixlab-local`
+  directory and verify both file and profile paths with `git check-ignore`.
+- Exclude this directory from development-server watching. Edge databases are
+  locked while the browser is running; watching them can crash Vite with
+  `EBUSY`.
+- Explicitly deny serving the directory over HTTP. Git ignore alone is not a
+  web-server access control.
+- Keep state outside the public directory and every other static-asset or
+  build-output directory. Vite's `server.fs.deny` does not protect `publicDir`.
+- Preserve existing development-server settings and default deny patterns.
+
+For Vite, review and approve merging this into the existing `server` options:
+
+```typescript
+watch: {
+  ignored: ['**/.fixlab-local/**']
+},
+fs: {
+  deny: [
+    '.env', '.env.*', '*.{crt,pem,key,p12,pfx,cer,der}',
+    '.npmrc', '.yarnrc.yml', '**/.git/**', '**/.fixlab-local/**'
+  ]
+}
+```
+
+These are example patterns, not a replacement for the installed version's
+defaults or additional custom rules. Preserve all required defaults and review
+equivalent exclusions for a different development server. Check alternate
+asset/plugin paths too; a deny rule for one URL is not proof that another route
+cannot expose the same file.
+
+Verify that requests for the auth state and profile files return HTTP 403
+without printing their contents, and that Vite remains responsive while the
+browser profile is in use.
+
+Merge real authentication commands and these relative paths into the profile:
+
+```json
+{
+  "required": true,
+  "statusPaths": [
+    ".fixlab-local\\auth-local.json",
+    ".fixlab-local\\edge-profile"
+  ]
+}
+```
 
-Review `browserAutomation.workingDirectory` and
-`browserAutomation.authentication`, including its authentication command, proof
-command, and tracked status paths. Use repository-owned helpers.
+This is the `browserAutomation.authentication` fragment, not a complete
+configuration. Real repository-owned `command` and `proofCommand` are also
+required, along with a real `browserAutomation.testCommand`.
+
+If relocating state within the same checkout, get approval, close its owned
+browser, verify source and destination ignore rules before moving, update
+helper paths, and rerun fresh proof. Do not read or print state contents.
+Never copy another checkout's state or a user's normal browser profile.
+
+### 7. Use genuine corporate Edge SSO, not a private context
+
+A normal signed-in Edge window loading the application does not establish
+authentication in a separate automation context.
+
+For organization-managed Edge SSO, a fresh `browser.newContext()` is private
+and may not carry the browser/device identity needed by the organization.
+Use an approved, dedicated persistent profile for this checkout instead.
+Let the user sign into that browser profile and application normally.
+
+Repository-owned helper code can use this launch pattern:
+
+```javascript
+const context = await chromium.launchPersistentContext(profileDirectory, {
+  channel: 'msedge',
+  headless: false,
+  args: ['--enable-automation'],
+  ignoreDefaultArgs: [
+    '--disable-extensions',
+    '--disable-component-extensions-with-background-pages'
+  ],
+  viewport: { width: 1440, height: 900 },
+  serviceWorkers: 'block'
+});
+```
+
+`profileDirectory` must be the approved dedicated path described above.
+Resolve Playwright from the configured browser project's dependencies, not
+from an unrelated global installation. Integrate this into a real helper;
+the snippet is not a complete authentication implementation.
+
+Keep the automation indicator visible. Explicit `--enable-automation` also
+allows a launch-settings check through CDP `Browser.getBrowserCommandLine`;
+do not assume every Playwright version adds the flag automatically.
+Removing the two extension-disabling flags makes normal managed authentication
+components available; it does not guarantee tenant-policy compatibility.
+Do not weaken security policy, hide automation, or disable tenant controls.
+
+Keep proof headed too when required by the organization's browser SSO flow.
+Only one process may own the dedicated profile at a time. Close it in `finally`
+and track its directory in `statusPaths` for ownership checks.
+
+#### ERR_BLOCKED_BY_CLIENT on Microsoft certificate authentication
+
+If the helper has a request guard, check whether it blocked a legitimate
+Microsoft identity endpoint before blaming browser installation.
+
+Certificate authentication can use `certauth.login.microsoftonline.com` and
+tenant subdomains beneath it. After reviewing the required authentication
+flow, permit those endpoints over HTTPS narrowly. Match the exact hostname or
+a hostname ending in `.certauth.login.microsoftonline.com`, not any string
+containing that text. Do not allow arbitrary Microsoft domains or business
+POST requests.
+
+Retain request guards, mutation controls, and production restrictions. Test
+both the required identity endpoint and lookalike domains that must remain
+blocked.
+
+#### "No certificate detected"
+
+After the identity endpoint is reachable, this is a genuine sign-in requirement,
+not proof that Playwright is missing. A dedicated persistent, normally signed-in
+Edge profile may satisfy the required browser/device identity.
+
+If Microsoft offers another organization-permitted sign-in method, the user
+may choose it. If a certificate is mandatory and unavailable, stop and report
+the requirement. Do not export certificates/private keys, copy a personal
+profile, change Conditional Access, or manufacture a successful result.
+
+Microsoft documents Edge browser sign-in and private-mode limitations in its
+[Conditional Access browser guidance](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions#supported-browsers).
+
+### 8. Prove real authentication and distinguish its coverage
+
+Review the actual helper, selected environment, state paths, sign-in command,
+and proof command before:
 
 ```powershell
 fixlab authenticate $Repo
-# Only after reviewing and approving the authentication plan:
+# Only after approval of the real authentication plan:
 fixlab authenticate $Repo --yes
 ```
 
-The user completes genuine application sign-in/MFA themselves. Keep tokens and
-browser state local and ignored by Git. Never fabricate a readiness marker,
-copy another checkout's authentication state, or treat `az login` as frontend
-sign-in. Report readiness only when the required genuine live proof succeeds.
+The helper must:
+
+- Use the exact approved origin and environment; reject an unconfigured SIT
+  target instead of silently falling back to local.
+- Let the user complete genuine browser sign-in/MFA. Identify and foreground
+  only the helper-owned window when needed, never another Edge window.
+- Capture genuine state locally without logging credentials.
+- Handle the application's real cache. Playwright `storageState` alone does
+  not preserve MSAL `sessionStorage`; save and restore that state locally for
+  the exact approved origin when needed.
+- Reopen the dedicated browser and assert an actual signed-in condition plus
+  fresh legitimate identity proof using the application's existing scopes.
+- Fail for missing/invalid state or an unsuccessful live identity check.
+- Close owned browser resources and remove temporary diagnostics.
+
+Run the reviewed `proofCommand` and focused browser test from the configured
+working directory with the selected environment.
 
-### 6. Check readiness and open the dashboard
+A helper exit, state-file existence, Doctor PASS, or normal Edge SSO is not a
+substitute for fresh proof. A signed-in app-shell check with business APIs
+blocked proves identity/shell behavior only, not backend integration or a
+business scenario. Keep any required integration gates unresolved until
+actually validated.
+
+Do not retain generated validation-only authenticated spec files in product
+changes unless permanent coverage was explicitly requested.
+
+### 9. Verify Doctor and a stable, matching dashboard
 
 ```powershell
 fixlab doctor $Repo --runtime copilot
 ```
 
-Explain remaining requirements. When readiness and approvals permit, start or
-reuse the exact checkout's dashboard with the agreed `$DashboardPort`:
+Inspect real startup commands and health URLs independently. Doctor does not
+prove that a blank/unverified backend startup, missing health endpoint, or
+unconfigured SIT target is ready.
+
+Request approval before starting the idle dashboard. Stop temporary
+setup-owned servers if the dashboard should manage their lifecycle; leave
+unrelated services alone.
 
 ```powershell
 fixlab dashboard $Repo --port $DashboardPort --no-open --runtime copilot
-# Alternatively:
-fixlab chat $Repo --port $DashboardPort --runtime copilot
 ```
 
-Verify repository, port, instance, and current job through
-`fixlab_dashboard_status` when the MCP bridge is connected. Ask the user for
-missing decisions or required approvals instead of guessing.
-
-Do not start a bug-fixing job, change application UI, commit, push, create a pull
-request, approve unsafe data access, or stop unrelated resources as part of setup.
-Finish with actual installation, profile, browser-tool, authentication, and
-dashboard status, including unresolved requirements.
+Reuse a verified matching dashboard instead of starting a duplicate. If a
+job already exists, preserve it and do not assume the dashboard is idle.
+
+If the dashboard must remain available after the Copilot turn, start it using
+the host's supported persistent/background mechanism. A launcher printing a URL
+is not proof that the server remained running.
+
+Verify all of these:
+
+- Dashboard UI returns HTTP 200.
+- `fixlab_dashboard_status` reports the exact repository and expected port.
+- Record its actual instance ID and confirm no job was started by setup.
+- Read `fixlab_dashboard_control` operation `authentication-status`, bound to
+  that instance ID and current job ID (`null` when idle).
+- Check status again after that request to catch a crash. A basic status
+  endpoint alone does not exercise authentication-path containment.
+
+An idle dashboard can report authentication `configured: true` and
+`ready: false` despite successful external CLI proof. Dashboard proof is
+memory-only and tied to the owning job, environment, configuration, and state
+identities. Obtain its own fresh proof when that operation/job is authorized.
+Do not start a job just to make the status green.
+
+### 10. Finish with actual status
+
+Report installation/MCP, profile, dependency restores, npm/NuGet feed access,
+Playwright/Edge launch, genuine authentication proof and its scope,
+Doctor, dashboard repository/port/instance, and unresolved prerequisites.
+
+Do not call the whole setup complete if backend startup/health, selected
+environment configuration, required live coverage, or job-bound proof remains
+unverified. Do not commit credentials, start jobs, change application UI,
+publish, or stop unrelated resources as part of setup.
+
+## Troubleshooting summary
+
+| Symptom | Focused recovery |
+| --- | --- |
+| First onboarding run created files without `--yes` | Approve scaffolding before running; preserve existing files |
+| npm/Yarn 401 | Refresh the actual feed through its approved helper, then retry the original restore |
+| NuGet 401 / NU1301 | Distinguish auth from network/TLS; use the compatible credential provider and approved interactive restore |
+| Playwright package absent | Review the actual project's setup plan; install only after approval |
+| Edge unavailable | Report the prerequisite; ask before installation or choosing another browser |
+| Normal Edge works but automation does not | Use a dedicated persistent, managed-sign-in-capable Edge profile |
+| Certificate-auth endpoint blocked by client | Correct the identity-only request guard narrowly |
+| No certificate detected | Complete permitted browser/device sign-in or report the certificate requirement |
+| Dashboard authentication path-containment error | Keep ignored state inside the browser working directory |
+| Vite EBUSY on Edge Cookies | Exclude private state from watching and deny serving it |
+| Dashboard printed a URL then exited | Inspect its error; verify UI and authentication-status, then recheck the same instance |
+| Doctor passes but dashboard auth is not ready | Distinguish configuration, external proof, and fresh dashboard/job-bound proof |
+
+## References
+
+- [FixLab installation](https://github.com/MonaDevAI/FixLab/blob/main/installation.md)
+- [FixLab detailed setup](https://github.com/MonaDevAI/FixLab/blob/main/docs/installation.md)
+- [Azure Artifacts Credential Provider](https://github.com/microsoft/artifacts-credprovider)
+- [Playwright persistent contexts](https://playwright.dev/docs/api/class-browsertype#browser-type-launch-persistent-context)
+- [Microsoft Entra supported browsers](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions#supported-browsers)
+- [Vite filesystem deny rules](https://vite.dev/config/server-options#server-fs-deny)
diff --git a/docs/FixLab-Installation-Guide-Quickstart.docx b/docs/FixLab-Installation-Guide-Quickstart.docx
index 2ce4173..4dc3eaa 100644
Binary files a/docs/FixLab-Installation-Guide-Quickstart.docx and b/docs/FixLab-Installation-Guide-Quickstart.docx differ
diff --git a/docs/README.md b/docs/README.md
index 129823d..1ee6103 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -8,13 +8,13 @@ installation quickstart is a convenience copy; use the online guides for updates
 
 | Guide | What it covers |
 | --- | --- |
-| [Copilot-first setup](FIXLAB-SETUP.md) | First installation with a reviewed Copilot request; manual fallback if the guide is unavailable |
+| [Copilot-first setup](FIXLAB-SETUP.md) | Reviewed setup, feed access, Edge by default, protected SSO state, and manual fallback |
 | [First installation](../installation.md) | Prerequisites, machine changes, and reviewed setup |
 | [Detailed installation](installation.md) | Guided/manual setup, updates, and uninstall |
-| [Word installation quickstart](FixLab-Installation-Guide-Quickstart.docx) | Downloadable fresh Windows setup and installation troubleshooting |
+| [Word installation quickstart](FixLab-Installation-Guide-Quickstart.docx) | Downloadable reviewed setup, Edge SSO, feed access, and installation troubleshooting |
 | [Copilot installation prompt](installation.md#copy-paste-installation-prompt) | One reviewed setup request to paste into Copilot |
 | [Visual Studio Code](installation.md#install-and-use-in-visual-studio-code) | CLI setup and discovery of the repository custom agent |
-| [Getting started](getting-started.md) | First validation request, dashboard controls, evidence, and recovery |
+| [Dashboard user guide](getting-started.md) | Startup, requests, run options, approvals, evidence, recovery, and shutdown |
 | [Repository onboarding](repository-onboarding.md) | Application profiles, worktrees, API-only validation, and linked applications |
 | [Troubleshooting](troubleshooting.md) | Known installation, feed, browser, runtime, and readiness failures |
 
diff --git a/docs/getting-started.md b/docs/getting-started.md
index c49def1..90dd03c 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -1,187 +1,102 @@
-# Getting started
+# Dashboard user guide
 
-This guide covers the first job and day-to-day operation. Use
-[Installation](installation.md) for tool setup and
-[Repository onboarding](repository-onboarding.md) for profile configuration.
+## 1. Ask Copilot to set up FixLab
 
-## Prerequisites
+Open your application checkout in a signed-in Copilot session and paste:
 
-Complete the [installation prerequisites](installation.md#prerequisites),
-configure the application's `.github/fixlab/repository-profile.json`, and
-resolve the required readiness checks. Install only what that profile needs.
-The CLI, optional plugin/MCP connection, browser setup, and application
-authentication are separate.
-
-## Simplified chat-first workflow
-
-With FixLab and the selected runtime installed:
-
-```powershell
-fixlab chat C:\source\application --runtime copilot
+```text
+Install or reuse FixLab and onboard this repository with --runtime copilot.
+Follow https://github.com/MonaDevAI/FixLab/blob/main/docs/FIXLAB-SETUP.md
+Ask me for missing setup details; do not guess paths, commands or environments.
+Review the profile and changes with me, then run Doctor.
+Ask before starting or reusing the matching dashboard and show its local URL.
+I will complete sign-in/MFA. Do not start a job or publish changes.
 ```
 
-Use `--runtime agency` for Agency. Omitting the path lets chat use the current
-ready repository or ask for one. An incomplete repository opens guided
-onboarding before the dashboard starts.
-
-Review the connected repository before submitting a request. Terminal chat
-and the browser dashboard share the job, runtime session, branch, evidence,
-and pull-request state. Closing terminal chat does not stop the job.
-Open the printed loopback dashboard URL, request `open dashboard`, or opt in
-with `fixlab dashboard --open`; onboarding does not automatically open a tab.
+Open the dashboard URL Copilot provides. Resolve required readiness failures
+before submitting work. Already set up? Ask Copilot to start or reuse the
+matching dashboard instead of reinstalling.
 
-On the dashboard, enter the request and select **Start job**. **Run options**
-contains mode, environment, and evidence settings. The sidebar exposes saved
-work, connections, settings, and run details. On small screens, select **Menu**;
-**Back to chat** restores the unsent draft without starting work.
+## 2. Submit a request
 
-Keep the request about behavior and expected results, not profile-owned paths
-and commands. For example:
+Check the repository shown in the header. Open **Run options** and choose:
 
-```text
-The search results contain duplicate rows after filtering.
-Reproduce the issue, make the smallest fix, run the configured affected tests
-and browser journey, capture non-sensitive evidence, and create a draft PR.
-```
+| Mode | Purpose |
+| --- | --- |
+| Validate only | Check an existing change or PR without edits or publication |
+| Fix and validate | Fix a bug or make a small enhancement |
+| Playwright validation only | Check a browser/API result without implementation or PR work |
 
-For an API-only repository:
+Select a profile-approved environment. For a first run, try **Validate only**:
 
 ```text
-The create-request API returns the wrong status for invalid input.
-Reproduce it with a focused API test, make the smallest fix, and verify the
-HTTP behavior using this repository's configured validation policy.
+Validate PR 123 against its actual source commit. Do not edit source or update
+the PR. Report evidence and any failed, blocked, skipped or pending checks.
 ```
 
-## Onboard a repository
+Replace `123` with your PR number. For a bug, describe what happens, what
+should happen, and how to reproduce it. Enter it manually or load an authorized
+Azure DevOps work item, then select **Start job**.
 
-Use the [guided installation](installation.md#recommended-path-install-then-run)
-or request an explicit setup plan:
-
-```powershell
-fixlab onboard C:\source\application --runtime copilot
-```
+## 3. Respond when needed
 
-Review the profile, real component directories, test/startup commands, allowed
-environments, authentication, and pull-request settings before approving setup.
-`fixlab init` preserves existing files; it does not make example paths correct
-for an application. Run `fixlab doctor --runtime copilot` after configuration.
+Follow the conversation and **Run details**. When **Action needed** appears,
+read the blocker, supply the missing information, and use **Resume FixLab**
+when offered. Review runtime permission requests separately.
 
-See the [onboarding reference](repository-onboarding.md) for new worktrees,
-shared-checkout policy, API-only validation, and linked repositories. Linked
-applications keep their own profiles, ownership, changes, and pull requests;
-opening a linked workspace is not end-to-end integration evidence.
+For browser sign-in, open **Connections**, use **Check status** or
+**Connect Playwright**, and complete sign-in/MFA in the browser. Never paste
+credentials into chat. Backend-only jobs use their configured authentication.
 
-## Choose an intake path
+## 4. Review the result
 
-**Enter manually** is the default. Describe a bug or choose **Small enhancement**
-for bounded new behavior. Add screenshots only when they help explain it.
-Up to five PNG, JPEG, or WebP images are allowed: 2 MiB each and 8 MiB total.
-File selection, pasted images, and Azure DevOps images share these limits.
+In **Run details**, check the changed source/branch, tests, browser/API evidence,
+and any PR link. Failed, blocked, skipped, or pending checks are not passes.
+Synthetic checks do not prove the real backend works.
 
-For Azure DevOps intake, enter up to 20 unique work-item IDs or URLs:
+Fix-and-validate may produce an authorized draft PR while validation continues.
+Validate-only produces findings and evidence, not a new PR.
 
-```text
-https://dev.azure.com/your-organization/your-project/_workitems/edit/123
-456
-```
+## 5. Continue or start separate work
 
-ID-only intake requires the profile's `azureDevOps.organization` and
-`azureDevOps.project`. Sign in with `az login` using an authorized identity.
-FixLab loads supported fields, recent comments, and bounded images; loading
-items does not update their status or expand a Feature into its children.
-See [intake contracts](architecture.md#intake-sources) for limits and retention.
+Select the saved conversation to continue the same job and existing PR.
+Use **Hold selected job** / **Resume held job** to pause or continue work.
+**Restart selected job** creates a fresh job and keeps the original result.
 
-## Recommended first workflow
+Use **New conversation** for a separate request. **Queue** shows waiting jobs;
+a blocked or failed job needs resolution or explicit dismissal before the queue
+advances. On small screens, use **Menu** to reach these controls.
 
-Start with an existing change or PR in **Validate only** mode:
+## 6. Stop or replace the dashboard
 
-```text
-Validate pull request 123 against its actual source commit using this
-repository's required checks. Do not edit source, commit, push, or update the PR.
-Report the evidence and every failed, blocked, skipped, or pending check.
-```
+Closing the browser tab does not stop the dashboard. Press **Ctrl+C in the
+dashboard terminal** to stop its server and release the port.
+If Copilot started it in the background, ask:
 
-Verify the checkout and required authentication, run the relevant configured
-checks, and inspect the resulting evidence before enabling fix-and-validate.
+> Shut down FixLab on port 4317 and only its owned processes. Leave other
+> applications running.
 
-| Mode | Use it for |
-| --- | --- |
-| Fix and validate | A scoped bug fix or small enhancement, with publication only when authorized |
-| Validate only | Existing changes or PRs, without edits or publication |
-| Playwright validation only | A focused browser/API result check without implementation or PR work |
-
-Efficient delivery defaults to an authorized draft PR after focused regression
-checks, diff review, and required pre-publication gates. Optional broad
-tests/builds follow saved preferences. Strict delivery and explicitly required
-checks retain their requirements. A draft PR, successful startup, or HTTP 200
-is not proof that all validation passed.
-
-### Review evidence and approvals
-
-Inspect stages, configured gate results, scenario assertions, screenshots or
-API proof, and any PR link. Synthetic/intercepted browser checks must be labeled;
-they do not prove the real backend works. Temporary generated browser tests
-are removed before publication unless permanent coverage is explicitly required.
-
-Keep credentials and MFA in the normal authentication flow, not chat.
-**Connect Playwright** runs the configured sign-in command; **Check status**
-does not expose browser-state contents. If the persistent test browser is busy,
-preserve unsaved work and close it yourself before retrying. Do not kill another
-browser or copy its authentication state.
-
-Runtime permissions and workflow approvals are distinct. Review the actual
-command, path, or diff. An **Action needed** response is not a blanket grant,
-and a workflow reply cannot approve an unrelated native permission request.
-See [runtime permissions](commands.md#background-runtime-permissions).
-
-Local jobs can warm the configured React frontend alongside diagnosis. Reuse
-it only when it is healthy and serves the checkout being validated; a warm
-baseline server does not validate an isolated fix. Startup is not a passed
-live-test gate.
-
-### Queue and recover work
-
-| Action | Behavior |
-| --- | --- |
-| `new bug <details>` | Create a separate job; queue it when another job is active |
-| Add comment to current job | Retain guidance for the same session and existing PR |
-| Remove from queue | Cancel a waiting job without interrupting the executor |
-| Hold / resume | Retain job context and release/resume execution through owned lifecycle controls |
-| Restart | Create a new job/session while retaining the original result |
-| `show status`, `show logs`, `show evidence`, `show pull request` | Inspect the connected job from terminal chat |
-| `switch repository` | Select another repository without silently reassigning the current job |
+Ask Copilot to start it again when needed. No reinstall or file deletion is
+required; saved jobs remain available.
 
-There is one active executor and at most 20 pending jobs. Blocked or failed
-jobs pause queue advancement; resolve the blocker, resume the same job, or
-explicitly dismiss the failed job. History cleanup excludes active, waiting,
-and held jobs.
+## Manual fallback and optional terminal chat
 
-For an interrupted task, ask:
+If Copilot setup is unavailable, follow [installation](installation.md).
+Once ready, start the dashboard and open its printed local URL:
 
-```text
-Continue the same job. Preserve the branch, changes, existing PR, and completed
-evidence. Explain the current blocker and finish only the remaining required work.
+```powershell
+fixlab dashboard C:\source\application --port 4317 --runtime copilot
 ```
 
-Use session controls to reconnect to a verified owner. Stop/shutdown affects
-only that owner's tracked processes. An unreachable dashboard or stale-looking
-PID is not permission to clear an executor lease or take over another session.
-
-For multiple bugs, the default is one combined PR; select separate PRs when
-isolation is required. Optional manual localhost validation keeps the owned
-frontend available until you record Passed or Failed. It remains separate from
-Playwright evidence.
+Replace the example path with your checkout. Keep that terminal open.
+If the port is occupied by another application, choose a free port.
 
-## Environment policy
+The browser is enough. Optionally connect terminal chat from another terminal,
+using the same repository, runtime, and port:
 
-Prefer local validation and select only profile-approved environments. Never
-silently fall back to another environment or select production automatically.
-Keep environment addresses, credentials, and sensitive test data out of public
-documentation.
-
-Use approved test data and intercept mutations where required. A synthetic
-fallback must state what it could not verify. Missing authentication, unsafe
-data access, or unavailable required validation remains a blocker.
+```powershell
+fixlab chat C:\source\application --port 4317 --runtime copilot
+```
 
-For operational details, use the [command reference](commands.md),
-[architecture reference](architecture.md), and [troubleshooting guide](troubleshooting.md).
+At `fixlab>`, `/stop` stops the job and leaves it resumable; `/exit` disconnects
+chat without stopping the dashboard.
diff --git a/docs/installation.md b/docs/installation.md
index 56c7ea0..a99bdba 100644
--- a/docs/installation.md
+++ b/docs/installation.md
@@ -36,10 +36,10 @@ checkout, then paste:
 ```text
 Install or reuse FixLab, register its MCP server, and onboard this repository
 with --runtime copilot. Review the real repository profile and setup plan
-with me before applying changes. Prepare Playwright and genuine live
-authentication when required by the profile, run Doctor, and start or reuse
-the matching dashboard. Ask before changes, preserve my application code,
-and do not start a job.
+with me before applying changes. Use Microsoft Edge by default for required
+browser validation. Review package-feed authentication separately from
+browser SSO and protect private state. Run Doctor, then ask before starting
+or reusing the matching dashboard. Preserve my code and do not start a job.
 ```
 
 **Option 2: give Copilot a Markdown file.** For reusable, reviewable instructions,
@@ -58,10 +58,17 @@ or a permission grant. The [Word quickstart](FixLab-Installation-Guide-Quickstar
 is also available. If Copilot or the file is unavailable, use the detailed
 installation steps and command reference below.
 
+For approved scaffolding, separate npm/Yarn and NuGet feed authentication,
+dedicated Edge SSO, protected private state, and dashboard proof checks, follow
+the [reviewed setup instructions](FIXLAB-SETUP.md#instructions-for-copilot).
+The setup guide defaults browser UI profiles to Microsoft Edge, not bundled
+Chromium; this does not change standalone CLI or existing profile defaults.
+
 ## Recommended path: install, then run
 
 This is the manual fallback when Copilot or the setup guide is unavailable.
-Once your supported runtime is installed and signed in:
+First-run onboarding may create scaffolding without `--yes`; review and approve
+those files first. Once your supported runtime is installed and signed in:
 
 ```powershell
 npm install --global github:MonaDevAI/FixLab
@@ -69,8 +76,10 @@ fixlab onboard C:\source\application --runtime copilot
 ```
 
 If a new example profile is created, configure the actual application paths and
-commands, then rerun `onboard` to inspect its setup plans. After reviewing and
-approving those plans:
+commands, then rerun `onboard` to inspect its setup plans. For browser UI setup,
+select `"browser": "chromium"` with `"channel": "msedge"` before approving the
+browser plan; this launches Microsoft Edge. Preserve an explicitly reviewed
+repository alternative. After reviewing and approving the actual plans:
 
 ```powershell
 fixlab onboard C:\source\application --runtime copilot --yes
@@ -198,8 +207,10 @@ paths are corrected, review `fixlab setup-playwright` before approving
 not globally. Restore existing dependencies with the reviewed `fixlab prepare`
 plan and complete any required private-feed sign-in first.
 
-Browser-mode tests need the configured Playwright browser or approved channel
-(for example, Edge), not an arbitrary extra Chromium installation. API-only
+Default this guided browser-mode setup to Microsoft Edge with
+`browserAutomation.browser: "chromium"` and `browserAutomation.channel: "msedge"`;
+do not silently install or fall back to bundled Chromium. Review an alternative
+only when required by the repository. API-only
 profiles use `browserAutomation.mode: "api"` and do not install or launch a
 browser. An explicit unit-test-only profile skips Playwright; do not disable
 required live coverage merely to get a green Doctor result.
@@ -300,16 +311,21 @@ fallback steps below without requesting the file again.
 5. After approval, create missing workspace files with fixlab init.
    Verify .github\agents\fixlab-autofix.agent.md exists. Configure actual
    paths, commands, ports, safe environments, and authentication intent.
+   For required browser UI coverage, default to Microsoft Edge using
+   browser: chromium and channel: msedge before approving browser setup.
 6. Ask before restoring dependencies, installing Playwright, accessing
    private feeds, authenticating, or starting services. I will complete
-   genuine sign-in and MFA myself.
+   genuine sign-in and MFA myself. Keep npm/Yarn and NuGet feed access
+   separate from application authentication. Review a dedicated persistent
+   Edge profile, contained ignored state, and development-server exclusions.
 7. Run fixlab doctor --runtime copilot. Report every remaining blocker.
    Register MCP only when dashboard coordination is requested and its
    configuration has been reviewed.
 8. Start or reuse the matching dashboard only after readiness and my
-   approval. Verify the exact repository and dashboard identity.
+   approval. Verify the exact repository, dashboard identity and
+   authentication-status; do not start a job to make readiness green.
 
-Do not modify application code, start a bug job, copy browser state,
+Do not modify application UI or business logic, start a bug job, copy browser state,
 disable TLS, publish a PR, or grant blanket permissions.
 ```
 
@@ -867,9 +883,10 @@ The repository profile controls the Playwright check:
 }
 ```
 
-`browser` selects the Playwright browser API. The optional `channel` selects an
-installed branded browser such as Microsoft Edge. Omit `channel` when the
-repository uses Playwright's bundled Chromium.
+`browser` selects the Playwright browser API; `"chromium"` does not by itself
+mean Microsoft Edge. Set `"channel": "msedge"` to launch Edge, the default for
+this reviewed setup guide. Omit the channel only for an explicitly reviewed
+repository requirement to use bundled Chromium, not as a silent fallback.
 
 The optional `authentication` block enables the dashboard's **Check status**
 and **Connect Playwright** controls. `statusPaths` are checked for existence
diff --git a/installation.md b/installation.md
index 805cd00..e98bb4a 100644
--- a/installation.md
+++ b/installation.md
@@ -8,10 +8,10 @@ checkout, then paste:
 ```text
 Install or reuse FixLab, register its MCP server, and onboard this repository
 with --runtime copilot. Review the real repository profile and setup plan
-with me before applying changes. Prepare Playwright and genuine live
-authentication when required by the profile, run Doctor, and start or reuse
-the matching dashboard. Ask before changes, preserve my application code,
-and do not start a job.
+with me before applying changes. Use Microsoft Edge by default for required
+browser validation. Review package-feed authentication separately from
+browser SSO and protect private state. Run Doctor, then ask before starting
+or reusing the matching dashboard. Preserve my code and do not start a job.
 ```
 
 **Option 2: use a Markdown file.** Copy
@@ -32,6 +32,9 @@ available as a download.
 If Copilot or the file is unavailable, continue with the complete manual steps
 below. Use the [detailed installation guide](docs/installation.md) for enterprise
 distribution, additional setup paths, updates, and troubleshooting.
+The [reviewed setup guide](docs/FIXLAB-SETUP.md#instructions-for-copilot)
+includes separate npm/Yarn and NuGet authentication, dedicated Edge SSO,
+private-state protection, and dashboard authentication-status checks.
 
 ## 1. Prerequisites: install separately
 
@@ -75,13 +78,21 @@ Agency, start a service/dashboard, register MCP, or change application files.
 
 ## 3. Set up an application
 
+The first onboarding run can create scaffolding even without `--yes`.
+Review and approve missing profile, agent, and prompt files before running:
+
 ```powershell
 fixlab onboard C:\source\application --runtime copilot
 ```
 
 Replace the path with the actual checkout; use `--runtime agency` for Agency.
 Set any new example profile to the real application paths and commands, then
-rerun `onboard` to review the setup plans. After approving those plans:
+rerun `onboard` to review the setup plans. For browser UI setup, default to
+Microsoft Edge by setting `browserAutomation.browser` to `"chromium"` and
+`browserAutomation.channel` to `"msedge"` before approving browser installation.
+The browser field selects Playwright's engine; the channel launches Edge,
+not bundled Chromium. Preserve an explicitly approved repository alternative.
+After approving the actual restore and browser plans:
 
 ```powershell
 fixlab onboard C:\source\application --runtime copilot --yes
diff --git a/test/documentation-policy.test.js b/test/documentation-policy.test.js
index 1de4496..cd1002c 100644
--- a/test/documentation-policy.test.js
+++ b/test/documentation-policy.test.js
@@ -63,6 +63,36 @@ test("first installation is linked, packaged and separates prerequisites from se
   }
 });
 
+test("reviewed setup defaults to Edge and protects private authentication state", () => {
+  const read = (file) => readFileSync(new URL(`../${file}`, import.meta.url), "utf8");
+  for (const file of ["README.md", "installation.md", "docs/installation.md", "docs/FIXLAB-SETUP.md"]) {
+    assert.ok(read(file).includes("Microsoft Edge"), file);
+  }
+  const guide = read("docs/FIXLAB-SETUP.md");
+  const pasteOnlyPrompt = guide.match(/## Option 1: paste one prompt[\s\S]*?```text\r?\n([\s\S]*?)```/u)?.[1];
+  assert.ok(pasteOnlyPrompt, "the paste-only setup prompt must be available");
+  assert.ok(pasteOnlyPrompt.includes("https://github.com/MonaDevAI/FixLab/blob/main/docs/FIXLAB-SETUP.md"),
+    "the prompt must locate its guide without an attachment");
+  assert.ok(pasteOnlyPrompt.includes("https://github.com/MonaDevAI/FixLab/blob/main/docs/installation.md"),
+    "the prompt must include a manual fallback");
+  for (const instruction of [
+    "Default to Microsoft Edge",
+    '"browser": "chromium"',
+    '"channel": "msedge"',
+    "dotnet restore $BackendProject --interactive",
+    "yarn install --frozen-lockfile",
+    "launchPersistentContext",
+    "public directory",
+    "authentication-status",
+    "confirm no job was started"
+  ]) {
+    assert.ok(guide.includes(instruction), instruction);
+  }
+  const approval = guide.indexOf("Approve scaffolding before first-run onboarding");
+  const onboard = guide.indexOf("fixlab onboard $Repo --runtime copilot");
+  assert.ok(approval >= 0 && approval < onboard);
+});
+
 test("documentation policy accepts complete internal links", () => {
   const root = createDocumentationTree();
   try {