docs(handoff): the auth change silently invalidated every curl in How to verify

[ZacxDev]

Session close-out for the tmux-webapp arc. Docs-only.

The load-bearing bit

0.8.29 put a login in front of every browser route — which means every curl in the doc's How to verify section now fetches the login page. Those are grep -c '<marker>' feature checks, so they all return 0, and a reader would conclude the features were reverted rather than you are not signed in. That is a doc that actively misleads, produced by my own change.

Rewritten to sign in first. All eight prior markers carried forward — verified with fixed-string comparison, with a control proving the extraction was real (my first check reported two as LOST when the pattern simply matched neither arm).

Also added, as Gotchas (append — nothing overwritten)

• The UI needs a login now. Where the credential lives; that sops resolves creation rules from the CWD; why it must not be pasted into a transcript — since #738 the session page renders tool inputs, so a password echoed in a shell command lands in the web UI it protects. Rotation is the only revocation (the cookie key is derived from the password), and the tier is fail-closed so a missing secret means 503, not open.
• Two e2e shapes escape the signIn fixture — node's fetch() has no cookie jar (use server.uiFetch), and specs that build their own browser.newContext(). Both shipped as CI reds. Includes the sweep that finds the class rather than one instance.
• Tailwind exits 0 on a content path that does not exist, so config and Dockerfile css stage must agree or a page ships unstyled with nothing failing. Includes why the package-wide glob was rejected on measurement.
• app.css is a gitignored build artifact — three tests fail in a fresh worktree and it is not your change.

Index

cairn append landed one bullet on homelab-talos/clawgate (the two-wrapper auth finding). The devrc window was a real no-match — all three devrc PRs touched only the handoff doc, which --exclude drops.

Also re-checked the entry's 10-day-old OPEN: bullet against trunk: windows_measured is still discarded at ingest (hostReport decodes Reachable/Windows/TmuxServerID only), so it stays open.

🤖 Generated with Claude Code