The app DO receives binding stubs. The runner owns env injection and outbound host policy.
Click a button.