CST API v15.7.2 — HARDENED LIVE CONSUMERS

1. Back up the current cPanel application and data/state.json.
2. Upload and extract this package in the existing CST Node.js application root.
3. Preserve the existing CST_INGEST_KEY environment variable.
4. Restart the Node.js application.
5. Verify /api/health reports version 15.7.2.
6. Verify /api/watch contains no controlled test records or HTML markup.
7. Verify the same-origin temporary interfaces at /manage, /display and /app.

New in v15.7.2:
- Retires the two controlled API test records during the one-time state migration.
- Removes HTML tags and decodes common entities from incoming and stored titles and summaries.
- Requires CST_INGEST_KEY for approval and return actions.
- The management screen requests the key for the current browser session only; it is not persisted.
- Retains the live 4K display, mobile PWA and compact /api/watch feed.

The separate consumer subdomains still require the hosting provider to exempt /api/* from its browser-verification challenge. The same-origin /manage, /display and /app paths remain available in the interim.