The cluster-internal name keeps working when runs move to sandbox pods (option C), where loopback would not reach the server. The name is added to PAPERCLIP_ALLOWED_HOSTNAMES because the private-hostname guard otherwise returns 403 for it. Same-namespace traffic is already allowed by the baseline CNP in both directions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>