We are getting errors in our logs. Fix: first PR stops invalid WebSocket requests from appearing as server failures, and the other two replace Canvas’ broken runtime-request path with a secure Cloud-side route. - github.com/OpenHands/agent-canvas/pull/1836 — Returns 404, rather than 502, for WebSocket upgrades that do not match Canvas’ supported socket route. This mitigates the alert noise from malformed/stale client requests. - github.com/OpenHands/OpenHands/pull/15311 — Adds an authenticated, conversation-scoped Cloud endpoint for Canvas runtime operations. Cloud resolves the runtime and applies its session credential server-side; no caller-controlled upstream host is accepted. - github.com/OpenHands/agent-canvas/pull/1837 — Updates Canvas to use the new scoped Cloud endpoint instead of sending runtime proxy requests to its static host, which caused the production 503s. Deploy #15311 before this PR.