When embedding a third-party job dashboard, protect its data and asset routes as well as its…

When embedding a third-party job dashboard, protect its data and asset routes as well as its visible page; read-only UI alone is not a mutation boundary. A React Router dashboard may load its home data from a sibling '.data' URL that is not covered by a '/*' route. Authenticate that sibling explicitly and reject mutation methods at the host boundary in addition to enabling upstream read-only mode. This is useful when general-purpose retry/cancel/delete controls would bypass application-specific external-effect recovery. It does not replace a later audited replay workflow.

Evidence/example — 2026-09-23: inspected @pg-boss/dashboard 1.9.0's published Fetch handler and official https://pgboss.io/dashboard documentation. Local Shield COR-4319 tests cover HTML, assets, home/nested data authentication and write rejection; a browser fixture navigated the real package's Queues/Schedules/Overview against a disposable local PostgreSQL schema at five viewport widths. Full deployment verification is separate. The package's read-only DB observer also creates its own pool (max 10 in this version), which must be counted separately from worker/API pools. No customer data or live provider calls were used.