@teamscala/service-boot 0.23.503 → 0.23.506

package/package.json

@@ -1116,6 +1116,7 @@
     "#service-boot/*.ts": "./src/*.ts"
   },
   "name": "@teamscala/service-boot",
+  "capability": "Lower-tier boot stages composed by service-runtime — page-server SSR, asset proxy, hono pipeline, agreement gate (no-shadow-runtime-exports: only service-runtime composes them).",
   "peerDependencies": {
     "@teamscala/chat-completion": "*"
   },
@@ -1130,5 +1131,5 @@
   "repository": "https://github.com/teamgbg/service-boot",
   "sideEffects": false,
   "type": "module",
-  "version": "0.23.503"
+  "version": "0.23.506"
 }

package/src/agreement-gate/signing-shell.test.ts

@@ -1,18 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Behavioural pins for the agreement signing-shell units. The load-bearing
- * cases: the gate block carries the OTP switch as the STRING the renderer
- * validates against (a boolean is stripped before the block reaches the
- * component — the same coercion that bit the pre-placed gate), an empty
- * registry title falls back to the DB-driven default, the signing shell
- * ALWAYS renders (registry failure falls back to the hardcoded shell), the
- * shell is deep-cloned per call (injection mutates the tree in place), and
- * the pre-placed-gate probe recognises an agreement gate by its context
- * field — a PROPOSAL gate in the same region must not read as an agreement.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, mock, test } from "bun:test";
 
 let registryBlocks: unknown = undefined;

package/src/agreement-gate.test.ts

@@ -1,18 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Regression test for the new-flow agreement gate's body-region targeting.
- * The body region of the public sign shell IS resolved.page (composed by
- * register-registry-page-route.ts Branch 2 as extractPuckData(resolved.page)).
- * A prior version of getBodyContentArray scored every region by top-level
- * non-shell block count and picked the highest — which misruted to /header when
- * the body wrapped its clauses inside a Container (body top-level count ~1-2
- * vs nested clause count ~40). onUnauthorized then cleared the HEADER and
- * injected the gate there, leaving the entire agreement body visible past the
- * gate. This test pins the fix: the body is withheld, the header is untouched.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { agreementGateConfig } from "./agreement-gate.ts";

package/src/asset-proxy.test.ts

@@ -1,12 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Co-located tests for handleAssetProxy's early-return paths: a non-asset path
- * 404s, and an asset path with no resolvable S3 client 502s (getClient returns
- * null when creds/config are absent — the documented "no client" contract).
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, it } from "bun:test";
 import { handleAssetProxy } from "./asset-proxy.ts";
 

package/src/attach-portal-members.test.ts

@@ -1,16 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Behavioural pins for the portal member directory endpoint. The load-bearing
- * cases: org-scoped reads bind the orgId as a PARAMETER (never interpolated —
- * the orgId arrives from the query string), the all-orgs "View As" mode is
- * gated to admin/super_admin sessions (any other caller without an orgId is
- * a 400, and an unauthenticated caller never reaches the probe query at
- * all), and a database fault is reported as resolve-failed rather than a
- * 500 leaking driver detail.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, mock, test } from "bun:test";
 import { Hono } from "hono";
 

package/src/attach-transfers-upload.test.ts

@@ -1,13 +1,12 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Co-located test for attachTransfersUpload: it registers the POST
- * /api/transfers/upload route on the host app. Hono is a type-only import
- * (the real app is built by the runtime), so the host interface is mocked
- * here to exercise registration without the Hono dependency.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, it } from "bun:test";
 import { attachTransfersUpload } from "./attach-transfers-upload.ts";
 

package/src/auth-gate.test.ts

@@ -1,10 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The signed-out screen must be able to render its own branding.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { isStaticAssetPath } from "./auth-gate.ts";

package/src/bind-page-handler.ts

@@ -22,6 +22,10 @@
 		// wave-parallel loader, brotli) is the sanctioned path; re-adding shared-cache headers needs a fresh operator ruling.
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";
+import {
+	withGateEntryClears,
+	takeGateEntryClears,
+} from "./content-gate/gate-entry-clears.ts";
 import type { Context } from "hono";
 import { readHtmlTemplate } from "./read-html-template.ts";
 import {
@@ -123,15 +127,27 @@ export async function bindPageHandler(
 
 		const nonce = c.get("nonce") as string | undefined;
 
-		const resp = await handler(c.req.raw, {
-			userId,
-			orgId,
-			visitor,
-			searchParams: c.req.query(),
-			htmlTemplate: await readHtmlTemplate(),
-			nonce,
-		});
+		const resp = await withGateEntryClears(async () =>
+			handler(c.req.raw, {
+				userId,
+				orgId,
+				visitor,
+				searchParams: c.req.query(),
+				htmlTemplate: await readHtmlTemplate(),
+				nonce,
+			}),
+		);
 		const headers = new Headers(resp.headers as HeadersInit);
+		// Gate-entry markers are ONE-VIEW state: the render that consumed one
+		// clears it here, so the next load (a refresh) is unauthorized and shows
+		// the gate again. Without this the marker would outlive the view that
+		// used it and every load would skip the gate.
+		for (const name of takeGateEntryClears()) {
+			headers.append(
+				"Set-Cookie",
+				`${name}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,
+			);
+		}
 		headers.set(
 			"Cache-Control",
 			"no-store, no-cache, no-transform, must-revalidate, max-age=0",

package/src/build-client-assets/manifest.test.ts

@@ -1,17 +1,11 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * verifyClientBuildAssets is the capability probe the readiness flip gates on
- * (`a-component-may-not-report-a-state-it-has-not-verified`): a manifest is
- * servable only when BOTH assets it names exist on disk. Measured 2026-09-01
- * (the unstyled-proposal incident): a manifest that never ran — or a first-boot
- * tombstone carrying the unhashed FALLBACK_MANIFEST paths — read as a
- * legitimate bundle and the service served pages whose stylesheet 404'd while
- * every health surface reported ok. These tests pin the refusal for all three
- * unbuilt shapes and the pass for a real build.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";

package/src/build-client-assets/source-candidates.test.ts

@@ -1,14 +1,12 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * Fixtures for the @source candidate scan. The load-bearing case is the
- * DIRECTORY probe: sources are directories, and a Bun.file(dir).exists()
- * probe answers false for them — which silently skipped every source,
- * zeroed the candidate set, and stripped all Tailwind utilities from every
- * kind:ui service's stylesheet (2026-09-01, operator-visible).
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { mkdir, rm } from "node:fs/promises";
 import { join } from "node:path";

package/src/build-client-assets/sourcemaps-upload.test.ts

@@ -1,18 +1,11 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * Behaviour tests for the source-map upload unit. Two measured defects are
- * regression-locked here: (1) the pre-2026-09 flow deleted the maps after an
- * upload whose responses were never checked, and (2) the direct release-files
- * POST it used returns HTTP 405 on GlitchTip, so NOTHING had ever uploaded.
- * The CLI integration is verified live on the dev host (57/57 of the
- * scala-roadmap release 3b940e0030 uploaded clean); in-test subprocess
- * verification is deferred (spawnSync blocks the bun event loop, which would
- * deadlock a same-process mock server). These tests cover the pure
- * boundaries the verification layer depends on.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { mkdtemp, mkdir, readdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";

package/src/build-client-assets/styles-build.test.ts

@@ -1,18 +1,12 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * Behavioural pins for the stylesheet resolver (operator ruling 2026-09-03:
- * the fallback chain IS the drift — a bare id resolved via Bun.resolve
- * returned whatever the package's main was (a .js for a normal package),
- * the resolve(base, id) tail invented nonexistent paths whose ENOENT
- * surfaced as misleading downstream CSS errors, and inlineCssImports
- * SWALLOWED unresolved imports, leaving literals that failed downstream
- * instead of at the build. Every case below pins the ruled contract:
- * resolve or THROW naming the specifier; remote https imports are skipped
- * explicitly, never resolved and never thrown on.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { mkdir, rm } from "node:fs/promises";
 import { join } from "node:path";

package/src/build-client-assets.test.ts

@@ -1,15 +1,11 @@
-/**
- * @system server-handlers
- * @status handwritten
- * @edit edit directly
- *
- * Regression guard for stripRemoteImports. Third-party package CSS must not
- * inject a remote @import (the dropped/CSP-blocked Inter-font class, scala-docs
- * 2026-06-13): @puckeditor/core/dist/index.css leads with `@import
- * "https://rsms.me/inter/inter.css"`, a CDN our CSP forbids. The compiled
- * bundle must carry zero remote @imports; the app loads its font from the
- * CSP-allowlisted Google Fonts <link> in index.html instead.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { mkdtemp, mkdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";

package/src/capability-slug.test.ts

@@ -1,3 +1,12 @@
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
+
 import { describe, expect, test } from "bun:test";
 import { toCapabilitySlug } from "./capability-slug.ts";
 

package/src/compose-page-title.test.ts

@@ -1,12 +1,11 @@
-/**
- * @system ui-service-boot
- * @status handwritten
- * @edit edit directly
- *
- * Pins composePageTitle: the single canonical title composer. The title is
- * derived from website + page/entity name with meta_title as an explicit
- * per-page OVERRIDE only, and it NEVER degrades to a bare org name.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { composePageTitle } from "./compose-page-title.ts";

package/src/content-gate/access.ts

@@ -101,6 +101,17 @@ export async function attachContentGateAccess(
 				"Set-Cookie",
 				`${config.cookieName}=${encodeURIComponent(token)}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`,
 			);
+			if (config.entryCookieName) {
+				// The ENTRY MARKER: it authorizes exactly the redirect this sets it
+				// on — the gate requires it and the render it consumed clears it.
+				// Max-Age matches the token only as a safety net; consumption is
+				// what ends its life, never the clock.
+				c.header(
+					"Set-Cookie",
+					`${config.entryCookieName}=1; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`,
+					{ append: true },
+				);
+			}
 		}
 		return c.redirect(back, 302);
 	});

package/src/content-gate/catalog.test.ts

@@ -1,11 +1,11 @@
-/**
- * @system service-boot
- * @status handwritten
- * @edit edit directly
- *
- * The catalog's invariants — the ones that were unenforceable while the gate
- * list lived as two hand-written arrays in two files.
- */
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import {

package/src/content-gate/config-types.ts

@@ -70,6 +70,15 @@ export interface ContentGateConfig {
 	 *  capable so a gate can load its display/behaviour settings from a registry
 	 *  row (DB-driven, not hardcoded); sync implementations remain valid. */
 	onUnauthorized(resolved: Resolved, resourceId: string): void | Promise<void>;
+	/**
+	 * OPT-IN REQUIRED-GATE-ENTRY. When set, a valid token authorizes ONLY on a
+	 * request that also carries this marker cookie — set by the access endpoint
+	 * alongside the token and consumed (cleared) by the render it authorizes, so
+	 * the marker lives exactly one view: the submit's own redirect releases the
+	 * content, and every later load (a refresh) is unauthorized, showing the
+	 * gate again. Omit for gates whose token is session-scoped by design.
+	 */
+	entryCookieName?: string;
 }
 
 /** Drives the public access endpoint (access.ts / attachContentGateAccess). */
@@ -80,6 +89,12 @@ export interface AccessConfig {
 	cookieName: string;
 	/** Cookie lifetime in ms (Max-Age). */
 	ttlMs: number;
+	/**
+	 * Marker cookie set alongside the token on a match. The gate requires it
+	 * (ContentGateConfig.entryCookieName) and the render it authorizes clears
+	 * it, so it authorizes exactly the submit's own redirect.
+	 */
+	entryCookieName?: string;
 	/** Form field carrying the resource id, e.g. "proposalId". */
 	recordIdField: string;
 	/**

package/src/content-gate/gate-entry-clears.ts

@@ -0,0 +1,38 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * REQUEST-SCOPED channel for gate-entry marker clears. A gate that declares an
+ * entry marker (config.entryCookieName) consumes it on the render that the
+ * access endpoint's own redirect produces; that render's response must clear
+ * the marker, or the next load (a refresh) would still carry it and skip the
+ * gate. The gate writes the name here; bindPageHandler — which owns the page
+ * Response — drains it into Set-Cookie, so the marker lives exactly one view.
+ *
+ * AsyncLocalStorage rather than a module-level map: request-scoped by
+ * construction, no accumulated process state that a restart would silently
+ * reset (in-memory-state-is-not-durable).
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+
+const clears = new AsyncLocalStorage<string[]>();
+
+export async function withGateEntryClears<T>(fn: () => Promise<T>): Promise<T> {
+	return clears.run([], fn);
+}
+
+export function recordGateEntryClear(cookieName: string): void {
+	const list = clears.getStore();
+	// Outside a bound request there is no response to write to (a direct gate
+	// run, a unit test). Dropping the record is the only correct answer —
+	// throwing would make an otherwise valid direct invocation a failure.
+	if (list && !list.includes(cookieName)) list.push(cookieName);
+}
+
+export function takeGateEntryClears(): string[] {
+	const list = clears.getStore() ?? [];
+	const out = [...list];
+	list.length = 0;
+	return out;
+}

package/src/content-gate/gate-entry-marker.test.ts

@@ -0,0 +1,102 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Locks the OPT-IN gate-entry marker. A gate that does NOT declare
+ * entryCookieName must behave exactly as before — a valid token authorizes on
+ * any load and nothing is recorded for clearing (condition 1: every non-opting
+ * service unchanged). An opting gate authorizes ONLY the request that carries
+ * the marker (the identity submit's own redirect) and records the marker so the
+ * page Response clears it — one view, then the gate is presented again.
+ *
+ * Operator ruling 2026-09-14 (refresh must return to the identity gate),
+ * mechanism measured live: the quiz_token cookie alone was the carrier that
+ * skipped the gate on reload.
+ */
+import { describe, expect, test } from "bun:test";
+import type { ContentGateConfig } from "./config-types.ts";
+import { runContentGate } from "./gate.ts";
+import {
+	takeGateEntryClears,
+	withGateEntryClears,
+} from "./gate-entry-clears.ts";
+
+function makeConfig(entryCookieName?: string) {
+	const calls = { authorized: 0, unauthorized: 0 };
+	const cfg: ContentGateConfig = {
+		cookieName: "quiz_token",
+		entryCookieName,
+		getResourceId: () => "res-1",
+		verifyToken: (token) =>
+			token === "good" ? { email: "v@example.com", name: "V" } : null,
+		onAuthorized: () => {
+			calls.authorized++;
+		},
+		onUnauthorized: () => {
+			calls.unauthorized++;
+		},
+	};
+	return { cfg, calls };
+}
+
+describe("gate entry marker is opt-in and one-view", () => {
+	test("non-opting gate: a valid token authorizes on any load, nothing recorded — behaviour unchanged", async () => {
+		const { cfg, calls } = makeConfig();
+		await withGateEntryClears(async () => {
+			const out = await runContentGate({}, "quiz_token=good", Date.now(), cfg);
+			expect(out.authorized).toBe(true);
+			expect(calls.authorized).toBe(1);
+			expect(takeGateEntryClears()).toEqual([]);
+		});
+	});
+
+	test("opting gate: token WITHOUT the marker is unauthorized — a refresh shows the gate", async () => {
+		const { cfg, calls } = makeConfig("quiz_token_entered");
+		await withGateEntryClears(async () => {
+			const out = await runContentGate({}, "quiz_token=good", Date.now(), cfg);
+			expect(out.authorized).toBe(false);
+			expect(calls.unauthorized).toBe(1);
+			expect(calls.authorized).toBe(0);
+			expect(takeGateEntryClears()).toEqual([]);
+		});
+	});
+
+	test("opting gate: token + marker authorizes and records the marker for clearing, exactly once", async () => {
+		const { cfg, calls } = makeConfig("quiz_token_entered");
+		await withGateEntryClears(async () => {
+			const out = await runContentGate(
+				{},
+				"quiz_token=good; quiz_token_entered=1",
+				Date.now(),
+				cfg,
+			);
+			expect(out.authorized).toBe(true);
+			expect(calls.authorized).toBe(1);
+			expect(takeGateEntryClears()).toEqual(["quiz_token_entered"]);
+			// drained: the next load must not re-clear
+			expect(takeGateEntryClears()).toEqual([]);
+		});
+	});
+
+	test("opting gate: marker present but token invalid stays unauthorized and records nothing", async () => {
+		const { cfg, calls } = makeConfig("quiz_token_entered");
+		await withGateEntryClears(async () => {
+			const out = await runContentGate(
+				{},
+				"quiz_token=bad; quiz_token_entered=1",
+				Date.now(),
+				cfg,
+			);
+			expect(out.authorized).toBe(false);
+			expect(calls.unauthorized).toBe(1);
+			expect(takeGateEntryClears()).toEqual([]);
+		});
+	});
+
+	test("the quiz gate and its access endpoint both opt in on the same marker name", async () => {
+		const { quizAccessConfig, quizGateConfig } = await import("../quiz-gate.ts");
+		expect(quizGateConfig.entryCookieName).toBe("quiz_token_entered");
+		expect(quizAccessConfig.entryCookieName).toBe("quiz_token_entered");
+	});
+});

package/src/content-gate/gate.ts

@@ -27,6 +27,7 @@
 
 import type { ContentGateConfig } from "./config-types.ts";
 import { parseCookie } from "./parse-cookie.ts";
+import { recordGateEntryClear } from "./gate-entry-clears.ts";
 
 export interface ContentGateOutcome {
 	applies: boolean;
@@ -44,9 +45,24 @@ export async function runContentGate(
 	if (!resourceId) return { applies: false, authorized: false };
 
 	const token = parseCookie(cookieHeader, config.cookieName);
+
+	// A gate that declares an ENTRY MARKER authorizes only on the request that
+	// carries it — the one the access endpoint's own redirect produces. The
+	// marker is cleared on that render's response (bindPageHandler drains
+	// gate-entry-clears), so a refresh afterwards is unauthorized and the gate
+	// is presented again: that is the whole point of the marker.
+	if (config.entryCookieName) {
+		const entry = parseCookie(cookieHeader, config.entryCookieName);
+		if (entry === undefined) {
+			await config.onUnauthorized(resolved, resourceId);
+			return { applies: true, authorized: false };
+		}
+	}
+
 	const identity = config.verifyToken(token, resourceId, nowMs);
 
 	if (identity) {
+		if (config.entryCookieName) recordGateEntryClear(config.entryCookieName);
 		await config.onAuthorized(resolved, resourceId, identity);
 		return { applies: true, authorized: true, email: identity.email };
 	}