@@ -1079,7 +1079,7 @@ agent-device network dump 25 --include headers --platform web # Browser requests
 - `logs start` appends to `app.log` and rotates at 5 MB. Override with `AGENT_DEVICE_APP_LOG_MAX_BYTES` and `AGENT_DEVICE_APP_LOG_MAX_FILES`; set `AGENT_DEVICE_APP_LOG_REDACT_PATTERNS` to a comma-separated regex list for write-time redaction. On Apple simulators, `logs start` returns once the simulator log stream is running, so lines that the app logs after that are captured. If the stream does not start within 10 s, `logs start` fails with `details.reason: "simulator-log-stream-launch-timeout"`.
 - `open` prints `Session state: <path>`; see [Sessions](/docs/sessions#find-a-sessions-logs-and-artifacts) for the files it contains.
 - `events` reads the session timeline, which leaves out user-entered content; `--no-record` suppresses `action.recorded` entries. `events.ndjson` rotates at 5 MB (`AGENT_DEVICE_EVENT_LOG_MAX_BYTES`) and keeps one generation. Cursors stay valid across rotation; a cursor older than the retained window fails with `details.reason: "EVENT_LOG_CURSOR_EXPIRED"` and `details.earliestCursor`. If the retained files were edited or deleted, `events` fails with `details.reason: "EVENT_LOG_WINDOW_UNVERIFIED"`.
-- `network dump [limit] [summary|headers|body|all]` reads HTTP traffic for the session; `network log` is an alias. Prefer `--include` over the positional detail level. A React Native app session opened from its dev server answers from an in-app `fetch`/`XMLHttpRequest` capture (`source: "provider"`): method, full URL, status, and duration for every request it observes after arming, plus headers and bodies under `--include`. Traffic through other transports (WebSockets, native HTTP stacks) is outside this capture. The first dump installs the capture and reports it armed, so reproduce the requests and dump again; the app-side buffer holds 200 requests newest-first, drains as it is read, and resets on app reload. Other app/device sessions parse recent HTTP(s) entries from `app.log` (`source: "app-log"`), and web sessions from managed `agent-browser` request history. The log path scans up to 4000 log lines, returns up to 200 entries, and truncates fields at 2048 characters. Web does not expose bodies.
+- `network dump [limit] [summary|headers|body|all]` reads HTTP traffic for the session; `network log` is an alias. Prefer `--include` over the positional detail level. A React Native app session opened from its dev server answers from an in-app `fetch`/`XMLHttpRequest` capture (`source: "provider"`): method, full URL, status, and duration for every request it observes after arming, plus headers and bodies under `--include`. Traffic through other transports (WebSockets, native HTTP stacks) is outside this capture. The first dump installs the capture and reports it armed, so reproduce the requests and dump again; the app-side buffer holds 200 requests newest-first, drains as it is read, and resets when the app process restarts (a Metro reload keeps the capture armed). Other app/device sessions parse recent HTTP(s) entries from `app.log` (`source: "app-log"`), and web sessions from managed `agent-browser` request history. The log path scans up to 4000 log lines, returns up to 200 entries, and truncates fields at 2048 characters. Web does not expose bodies.
 - On iOS, `network dump` can miss requests the app does not log and cannot name every request on a reused connection, so treat a missing endpoint as unproven. The in-app React Native capture names every request it observed, which is why it takes precedence when it is available. See [Network inspection](/docs/debugging-profiling#network-inspection) for per-platform behavior.
 
 **Crash symbols:** `debug symbols` symbolicates an Apple crash artifact against local dSYMs, writes the symbolicated artifact to `--out`, and prints a compact crash report. See [Crash symbolication](/docs/debugging-profiling#crash-symbolication).
 
@@ -217,7 +217,7 @@ agent-device network dump 25 --include all
 ```
 
 - `network dump` reports where each answer came from in `source`. A React Native app session opened from its dev server answers from the in-app capture; every other app/device session parses recent HTTP(s) entries from the session app log, and web sessions from managed `agent-browser` request history.
-- On a React Native app session (a development build loading its bundle from Metro, which in practice means a simulator or emulator), `network dump` installs a `fetch`/`XMLHttpRequest` capture inside the app runtime over the debugger connection. It reports the method, full URL, status, and duration of every request it observes after arming, with headers and bodies under `--include headers` / `--include all`. Traffic through other transports (WebSockets, native HTTP stacks like axios's) is outside this capture. The first dump installs the capture and reports it armed; reproduce the requests, then dump again. The buffer is bounded (200 entries, newest first), drains as it is read, and resets when the app reloads. Header values and bodies are redacted and bounded; the URL is reported verbatim, including its query string, so a secret sent as a query parameter appears in the dump as the app sent it. The capture is installed only for a session that names its app, and only on the runtime that reports the session's own device.
+- On a React Native app session (a development build loading its bundle from Metro, which in practice means a simulator or emulator), `network dump` installs a `fetch`/`XMLHttpRequest` capture inside the app runtime over the debugger connection. It reports the method, full URL, status, and duration of every request it observes after arming, with headers and bodies under `--include headers` / `--include all`. Traffic through other transports (WebSockets, native HTTP stacks like axios's) is outside this capture. The first dump installs the capture and reports it armed; reproduce the requests, then dump again. The buffer is bounded (200 entries, newest first) and drains as it is read. A Metro reload keeps the capture armed; restarting the app process resets it and the next dump arms again. Header values and bodies are redacted and bounded; the URL is reported verbatim, including its query string, so a secret sent as a query parameter appears in the dump as the app sent it. The capture is installed only for a session that names its app, and only on the runtime that reports the session's own device.
 - If that in-app capture cannot answer (no runtime connected, or Metro not reachable), the dump falls back to the app log and its notes say why.
 - For app/device sessions, results depend on what the app writes to the platform log.
 - On Android, results include logcat timestamps, and status and duration can be filled in from adjacent GIBSDK packet lines when the URL is logged separately. Log streaming reattaches to the app's new process after a restart.