PXIL Runtime: Sessions, Tokens and Regression Diagram

After setup login and manual CAPTCHA: session-only runs create_session; token-only runs run_token_setup; combined runs create_session then run_token_setup for each product code.
Both setup modules use the shared Selenium driver and StepActions through Automation flows. The dashed session-to-token arrow denotes controller ordering, not a direct module call (tests/setup/test_combined_setup.py:21-37).
Session creation opens Trading Session, selects the ME instance, fills start/end times, then clicks Save (tests/setup/sessions/test_session.py:24-40).
These are trading sessions and trading tokens, distinct from browser authentication/session backups.

IDAS/default branch: create token, set delivery dates and expiry, Save, edit ORDER_NOR / ORDER_EXCH / TRADE times, then Save and Activate (tests/setup/tokens/test_trading_token.py:150-180, 264-325).
RTM branch fills delivery and session times and saves the token; activation is not called (lines 212-225, 254-261).
UPC branch fills configured order/trade times, saves, then resets the generator (lines 228-258).
config.json selects enabled products and run_session/run_token flags. Disabled products and both-false products are omitted; UPC variants have additional routing rules (tests/config_reader.py:36-83).

pytest runs selected tests; flow code controls Selenium and Chrome, which interacts with the remote Pratyay UI.
Pratyay login fills credentials and pauses for manual CAPTCHA entry before submission (tests/regression/auth.py:46-122).
Arrows describe control and I/O; results return to pytest. No direct backend API or database integration is asserted.

Root config.json selects setup products and session/token actions; config/runtime.json selects regression environment, role, product and flow.
Bidding supports Excel/JSON grids, files and folders. Optional parallel folder workers create their own browsers (bidding flow:551-587).
Matching requires the exchange role; rejected or unsupported bid-transfer status stops matching (matching flow:28-44, 123-135).

Boundaries show host/process and remote ownership, not verified network isolation or firewall policy.
Credentials come from local JSON and are entered into remote login forms. Values and endpoint addresses are omitted.
Chrome/WebDriver is an external runtime dependency. Pratyay and MCO server internals and transport guarantees are outside the observed source.
MCO is an independent, enabled-only dashboard login test; no Pratyay-to-MCO backend connection is inferred.

StepActions requests browser screenshots; pytest hooks attach evidence and configure pytest-html. Reports live under reports/.
Matching configures browser downloads separately; setup can save session backups. These details are kept off the main path.
Source snapshot: 5ab89ce0059525b31558a1fa82251a2a6f610dd7; tracked code unchanged. Only generated .archify/ artifacts are untracked. Sources use local-only links.
Registered reports/order-book/trade-book markers are placeholders, not implemented runtime services (RUN_COMMANDS.md).