@uniweb/api 1.1.1 → 1.2.1

package/src/wire.js

@@ -40,6 +40,18 @@
  * | `acting_unit_id` was a membership signal | every signed-in member of a site acts in the same unit — it cannot tell an operator from a member; `roles` can |
  * | the viewer carried `actingUnitId` | it carries `workspace` — where the request landed: on a site's service, its home org (2026-09-23; `acting_unit_id` leaves the wire) |
  *
+ * ## ⭐ MEASURED 2026-10-14 — a Model's definition in full, and a Section's items
+ *
+ * Against a backend holding data schemas registered the way a site's are, and items
+ * written through `/entities`: what a definition carries for each field and section
+ * (`SCHEMA`), the route that lists a Section's items (`SECTION_ITEMS`), and the
+ * refusals a field's rules answer (`PROBLEM`). That pass corrected:
+ *
+ * | was | is |
+ * |---|---|
+ * | the mock's definition gave each field `{ key, kind }` and nothing else | a field's whole declaration is under `type.data`; an `enum` is a `one_of` rule in its section's `constraints`; a section's `label` and `description` are in `other_data`; a nested section is a row of its own naming its `parent_section_id` |
+ * | the list took `include_disabled` | the backend refuses it — `400 Unexpected parameters: include_disabled` — and lists a disabled entity like any other |
+ *
  * @module @uniweb/api/wire
  */
 
@@ -49,19 +61,22 @@
  * `/sites/*`. Those routes create sites, which is the app's job, not a
  * foundation's, and a site's own `backend` service has no site to address.
  *
- * Its routes are under `/entities`, `/models` and `/auth`, plus what a member does
- * with an invitation — claim an offer (`OFFERS`), answer an invitation
+ * Its routes are under `/entities`, `/models`, `/sections` and `/auth`, plus what a
+ * member does with an invitation — claim an offer (`OFFERS`), answer an invitation
  * (`INVITATIONS`) — the steps the backend's mail asks a member to finish on the site
  * (2026-10-11). ⛔ Never `/sites/*`, and nothing that administers: the backend's
  * administration is reached through the Admin link (`AUTH.memberHandoff`), never
  * wrapped. *(This said "no route that is not under `/entities`, `/models` or
- * `/auth`" until 2026-10-11.)*
+ * `/auth`" until 2026-10-11, and left out `/sections` until 2026-10-14.)*
  */
 export const ENTITIES = '/entities'
 
 /** The Models lane — read-only, one route: a Model's definition. MEASURED. */
 export const MODELS = '/models'
 
+/** The Sections lane — read-only, one route: a Section's items (`SECTION_ITEMS`). MEASURED. */
+export const SECTIONS = '/sections'
+
 /**
  * The base, and how a route joins it. **MEASURED.**
  *
@@ -121,6 +136,10 @@ export const AUTH = {
    * `detail`. **MEASURED** by backend, 2026-10-10.
    */
   memberHandoff: '/auth/member-handoff',
+  /**
+   * `POST /auth/elevate` elevates a site's session; `DELETE` lowers it (`ELEVATION`).
+   */
+  elevate: '/auth/elevate',
 }
 
 /**
@@ -148,7 +167,8 @@ export const HANDOFF_REFUSAL = Object.freeze({
  * | reset request | `{ email }` | `202 { status: 'reset_requested' }` whether or not the address is known |
  * | reset confirm | `{ token, new_password, code? }` | `200 { reset: true }`, and every other session of the account ends; a bad token is `400 Validation`; `code` is required when a second factor is enrolled. A password the rule refuses is `400` with `reason: 'password_too_short'` and `min_length` — refused BEFORE the token is spent, so the same link works again (RULED by backend, 2026-10-11) |
  * | logout | none | `204`; with no session to end, `401` |
- * | me | none | `200 { account: { uuid, username, handle }, roles, workspace: { unit_uuid, handle }, capabilities: { admin_app } }` · `401` |
+ * | me | none | `200 { account: { uuid, username, handle }, roles, workspace: { unit_uuid, handle }, capabilities: { admin_app }, elevation? }` · `401` |
+ * | elevate | `{ password, code? }` | `200 { elevated_until }` · `401`, one answer for a wrong password or code (`ELEVATION`) |
  *
  * ⭐ **The session is the cookie, and only the cookie.** A site's backend answers a
  * sign-in with no `token` (since 2026-10-10, MEASURED by backend; `token` was in the
@@ -161,6 +181,54 @@ export const AUTH_BODY = {
   register: ['username', 'email', 'password'],
   resetRequest: ['email'],
   resetConfirm: ['token', 'new_password', 'code?'],
+  elevate: ['password', 'code?'],
+}
+
+/**
+ * Elevation. **Stated by the backend, 2026-10-14, and measured by its own end-to-end
+ * test; not yet measured here.**
+ *
+ * On a site's backend, a session signed in on the site holds each of the account's
+ * roles as `content_reader`, at the same scope, until it is ELEVATED: it reads wherever
+ * a role reached and changes nothing through one. Ownership and grants work as always —
+ * a member edits, deletes and shares their own. To act through a role — an
+ * administrator removing a member's post — the session elevates, for a while.
+ *
+ * | route | body | answer |
+ * |---|---|---|
+ * | `GET /auth/me` | none | carries `elevation: { available, until? }` on such a session — `available` when the account holds a role that answers more than `read`; `until`, an ISO time, while elevated. A backend no site reaches sends no `elevation`: its roles answer in full |
+ * | `POST /auth/elevate` | `{ password, code? }` — `code` when a second factor is live | `200 { elevated_until }`. A wrong password or code is `401`, one answer — and so is no session at all |
+ * | `DELETE /auth/elevate` | none | `200 { elevated_until: null }` |
+ * | `GET /auth/elevate/{provider}/authorize?redirect_uri=&state=` | — | ⛔ **a navigation**, for an account with no password: the provider's sign-in, then back to `redirect_uri` with `?elevate=ok`, or `?error=oauth_step_up_not_linked` when the identity that came back is not the account's |
+ *
+ * - **The window is the backend's** — 15 minutes on 2026-10-14 — and this package never
+ *   assumes it: it reads `until`. Elevating again starts it again; nothing extends it.
+ * - **`roles` on `/auth/me` is what the session holds now** — `content_reader` rows until
+ *   it is elevated, the account's roles while it is (`VIEWER`).
+ * - **Elevating is step-up's proof too** (`PROBLEM.stepUp`).
+ * - **It does not reach the backend's administration**, which takes a site's session as
+ *   a reader, elevated or not. The Admin link does (`AUTH.memberHandoff`).
+ * - **What an elevated session may do to an entity is still the entity's answer** —
+ *   `can_edit` on a read (`READ`), so a read made before elevating is read again.
+ */
+export const ELEVATION = {
+  /** `/auth/me`'s field, and its two keys. */
+  me: 'elevation',
+  available: 'available',
+  until: 'until',
+  /** The answer of `POST` and `DELETE /auth/elevate`: an ISO time, or `null`. */
+  answer: 'elevated_until',
+  password: 'password',
+  code: 'code',
+  /** The provider's elevation — a navigation, never a fetch. */
+  byProvider: (provider) => `/auth/elevate/${segment(provider)}/authorize`,
+  redirect: 'redirect_uri',
+  state: 'state',
+  /** What the provider's elevation returns with: `?elevate=ok`, or `?error=oauth_step_up_not_linked`. */
+  returned: 'elevate',
+  ok: 'ok',
+  error: 'error',
+  notLinked: 'oauth_step_up_not_linked',
 }
 
 /**
@@ -274,13 +342,20 @@ export const TOTP = {
  * The viewer, as `/auth/me` answers. **MEASURED.**
  *
  * `roles` is a list of `{ role, scope_unit_id }` — `role` one of `system_admin`,
- * `unit_admin`, `content_editor`, `user`. ⭐ **They describe the session, not the
- * account.** On a site's `backend` service a session signed in on the site holds no
- * `system_admin` and no `unit_admin` of the home org — the operator's neither — so
- * `roles` never name an administrator there: a site runs third-party code with its
- * member's session, and a bug in that code must not act as one. An ordinary member
- * holds none: `[]`. *(Since 2026-10-10, MEASURED by backend; until then the operator's
- * session on a site held `system_admin`.)*
+ * `unit_admin`, `content_editor`, `content_reader`, `user`; the operator's is
+ * `{ role: 'system_admin', scope_unit_id: null }` (MEASURED 2026-09-18). ⭐ **They
+ * describe the session, not the account.** On a site's `backend` service a session
+ * signed in on the site holds each of the account's roles as `content_reader`, at the
+ * same scope, until it is elevated — so `roles` name an administrator there only while
+ * the session is (`ELEVATION`): a site runs third-party code with its member's session,
+ * and a bug in that code acts with whatever the session holds. An ordinary member holds
+ * none: `[]`. *(Since 2026-10-14, stated by backend. From 2026-10-10 such a session held
+ * no `system_admin` and no `unit_admin` of the home org and every other role whole, and
+ * before that the operator's session on a site held `system_admin`.)*
+ *
+ * `elevation` is `{ available, until? }` on a site's session (`ELEVATION`), absent on a
+ * backend no site reaches. The viewer carries it as `{ available, until }` — `until`
+ * `null` when not elevated — or `null` when absent.
  *
  * `workspace` is `{ unit_uuid, handle }` — **the workspace the request works in**. This
  * package's requests name none, and on a site's `backend` service such a request lands in
@@ -293,16 +368,16 @@ export const TOTP = {
  *
  * ⛔ **Neither is an operator signal.** Every member of a site's service works in the
  * same home org, so `workspace` reads the same for the operator and for someone who
- * signed up a minute ago, and on a site `roles` name no administrator. Ask about the
- * thing instead — a single-entity read carries `can_edit`, the write gate's own answer
- * for this session.
+ * signed up a minute ago, and on a site `roles` name an administrator only while the
+ * session is elevated. Ask about the thing instead — a single-entity read carries
+ * `can_edit`, the write gate's own answer for this session.
  *
  * `capabilities.admin_app` is the one fact here about the ACCOUNT rather than the
  * session: `true` when the backend's administration admits it — the operator, and
  * whoever else administers the service. The viewer carries it as `adminApp`, and the
  * package then offers the Admin link (`AUTH.memberHandoff`). It decides what to OFFER,
- * never what is allowed on the site, where the session acts as a member whatever the
- * account holds. `true` or `false` for every signed-in caller, at the same path as on
+ * never what is allowed on the site, where the session acts through its roles only
+ * while elevated. `true` or `false` for every signed-in caller, at the same path as on
  * `/session/bootstrap` (MEASURED by backend, 2026-10-10); anything else reads as
  * `false`.
  */
@@ -312,6 +387,7 @@ export const VIEWER = {
   workspace: 'workspace',
   capabilities: 'capabilities',
   adminApp: 'admin_app',
+  elevation: ELEVATION.me,
 }
 
 /**
@@ -336,6 +412,8 @@ export const ROUTES = {
   removeBatch: () => `${ENTITIES}/delete`,
   /** `GET /models/@scope/name` — the Model's definition, its sections among it. */
   schema: (model) => `${MODELS}/${modelPath(model)}`,
+  /** `GET /sections/{uuid}/items` — one page of a Section's items (`SECTION_ITEMS`). */
+  sectionItems: (uuid) => `${SECTIONS}/${segment(uuid)}/items`,
 }
 
 /**
@@ -346,13 +424,18 @@ export const ROUTES = {
  *
  * | route | takes |
  * |---|---|
- * | list | `model` (required) · `scope` · `limit` · `offset` · `paginate` · `locale` · `include_disabled` |
+ * | list | `model` (required) · `scope` · `limit` · `offset` · `paginate` · `locale` |
  * | read | `model` (required) · `via` · `depth` · `max_depth` · `locale` |
  * | items | `model` (required) · `readback` |
  * | create | `model` (required) |
  * | remove | `rev_ref_policy` |
+ * | section items | `entity` · `parent` · `field` · `q` · `locale` · `cursor` · `limit` |
  * | verify (`AUTH.verify`) | `token` (required) |
  *
+ * ⛔ **The list takes no `include_disabled`** — `400 Unexpected parameters:
+ * include_disabled` (MEASURED 2026-10-14). A disabled entity lists like any other,
+ * and its row says `disabled`; the flag only keeps it off a site's public reads.
+ *
  * ✅ **`via` and `depth` compose** (an assumption retired 2026-09-18): both are
  * parameters of the same read and answer different questions — `via` *who may
  * read* (through a container the viewer is entitled to), `depth` *how much is
@@ -370,6 +453,7 @@ export const PARAM = {
   offset: 'offset',
   locale: 'locale',
   paginate: 'paginate',
+  /** ⛔ Refused by the backend (see above) and never sent. Kept so an import of it does not break. */
   includeDisabled: 'include_disabled',
   via: 'via',
   depth: 'depth',
@@ -377,18 +461,31 @@ export const PARAM = {
   readback: 'readback',
   revRefPolicy: 'rev_ref_policy',
   token: 'token',
+  /** Section items: only the items this entity holds. */
+  entity: 'entity',
+  /** Section items: the items under this item — the level below it. */
+  parent: 'parent',
+  /** Section items: the field `q` searches. */
+  field: 'field',
+  /** Section items: the search term. */
+  q: 'q',
+  /** Section items: the previous page's `next_cursor`. */
+  cursor: 'cursor',
 }
 
 /**
  * The list's `scope`. Default `accessible` — everything the viewer may read; `mine`
  * — only what the viewer owns.
  *
- * What a session signed in on a site may read — any member's, the operator's
- * included (`VIEWER`): its own entities, and what was shared with it. Other members'
- * entities are private to their owners unless the site's service was set up to let
- * members read each other's. *(A site's service let every member read every other
- * member's entities until 2026-09-18, and the operator's session read everything until
- * 2026-10-10 — both measured, and changed on the backend.)*
+ * What a session signed in on a site may read: its own entities, what was shared with
+ * it, and — for an account that holds a role — whatever that role reaches, elevated or
+ * not (`ELEVATION`): the operator's session reads every member's. An ordinary member's
+ * holds no role, and other members' entities are private to their owners unless the
+ * site's service was set up to let members read each other's. *(A site's service let
+ * every member read every other member's entities until 2026-09-18 — measured, and
+ * changed on the backend. The operator's session read everything until 2026-10-10,
+ * nothing of a member's from then, and since 2026-10-14 reads everything again and
+ * changes it only while elevated — stated by the backend.)*
  */
 export const SCOPE = {
   mine: 'mine',
@@ -503,9 +600,14 @@ export const CREATE = {
  *
  * `via` names why the viewer can read the row — `owner`, `grant`, `rbac`,
  * `unit_member`, `entitlement`; treat an unknown value as "no opinion". A session's
- * own rows are `owner` — the operator's too. *(Until 2026-10-10 the operator's session
- * on a site read the rest as `rbac`, through `system_admin`.)* ⚠️ An empty list means
- * empty: a lapsed session is a `401`, never `200 []`.
+ * own rows are `owner` — the operator's too — and the rest the operator's session reads
+ * are `rbac`, through its role, elevated or not. *(From 2026-10-10 to 2026-10-14 the
+ * operator's session on a site read nothing of a member's.)* `rbac` is any
+ * administrative path — a role, and since 2026-10-14 a reader held at a unit over its
+ * people's content, and a reference whose field declares `readable_with` and whose
+ * target the viewer holds at that level *[backend, 2026-10-14; not measured here]* —
+ * while `grant` stays "shared with you". ⚠️ An empty list means empty: a lapsed session
+ * is a `401`, never `200 []`.
  */
 export const LIST = {
   records: 'entities',
@@ -539,11 +641,37 @@ export const READ = {
 }
 
 /**
- * A Model's definition — `GET /models/@scope/name`. **MEASURED.**
- *
- * `{ model: {…}, sections: [{ id, name, kind, is_brief, parent_section_id,
- * fields, other_data, constraints }] }` — `kind` is `single` or `multi`;
- * `other_data.append_only` marks an insert-only section.
+ * A Model's definition — `GET /models/@scope/name`. **MEASURED** 2026-10-14, on data
+ * schemas registered the way a site's are.
+ *
+ * `{ model, sections }`:
+ *
+ * - **`model`** — `{ id, uuid, name, data, version, owner_id, unit_id, owned,
+ *   owner_cardinality, unit_cardinality, role, created_at, updated_at }`. `data` holds
+ *   what the schema declares of the Model — `label`, `description`, `icon`, `plural`
+ *   among them — and `grantable`.
+ * - **each section** — `{ id, model_id, name, kind, is_brief, parent_section_id, fields,
+ *   other_data, constraints }`. `kind` is `single`, `multi`, or `binder`: a section that
+ *   holds only sections. A nested section is a row of its own, `parent_section_id`
+ *   naming its parent; top-level rows come first, and each group by name. ⛔ **A
+ *   section's uuid is not in the definition** — a field whose choices are a section's
+ *   items names that section's uuid itself (below).
+ * - **`other_data`** — what the schema declares of the section: `label`, `description`,
+ *   `append_only` (insert-only), `allow_self_nesting` (its items nest — `self_nesting:
+ *   true` in a schema), `date_field`.
+ * - **`constraints`** — `{ rules: [...] }`, or `{}` with none: the section's own rules
+ *   first, then `{ kind: 'one_of', field, values }` for each field that declares an
+ *   `enum`. ⛔ **An `enum` is not on its field** — it is that rule.
+ * - **each field** — `{ key, required, multi, type: { id: -1, name, kind, data } }`. ⭐
+ *   **`type.data` is the field's whole declaration**: `key`, `kind`, and what the field
+ *   declares — `required`, `multi`, `label`, `description`, `localized`, `format`,
+ *   `max_length`, `min`, `max` among them. `type` is a wrapper kept from an older
+ *   shape: its `id` is always `-1`, and its `name` is the kind.
+ * - **a field of kind `item_ref`** — a choice from a list — carries `section_uuid`, the
+ *   section whose items are its choices (a schema's `options:` path becomes it), and
+ *   `entity_uuid` when it pins the entry that holds them. Its choices are
+ *   `ROUTES.sectionItems(section_uuid)`. A field of kind `entity_ref` carries the
+ *   `model_uuid` it pins (read in the backend's source).
  *
  * ⭐ **Readable by every signed-in account, whatever it may create** — closing a
  * Model gates creating its entries, never reading its definition (ruled 2026-10-14;
@@ -559,6 +687,67 @@ export const SCHEMA = {
   name: 'name',
   kind: 'kind',
   parent: 'parent_section_id',
+  isBrief: 'is_brief',
+  fields: 'fields',
+  otherData: 'other_data',
+  constraints: 'constraints',
+  rules: 'rules',
+  /** A field's declaration is `field[fieldType][fieldDecl]` — `field.type.data`. */
+  fieldType: 'type',
+  fieldDecl: 'data',
+  /** The rule an `enum` becomes, and the keys it names its field and values by. */
+  oneOf: 'one_of',
+  ruleField: 'field',
+  ruleValues: 'values',
+  /** On an `item_ref` field: the section its choices are in, and the entry it pins. */
+  choicesSection: 'section_uuid',
+  choicesEntity: 'entity_uuid',
+}
+
+/**
+ * A Section's items — `GET /sections/{uuid}/items`. **MEASURED** 2026-10-14.
+ *
+ * The choices of an `item_ref` field: the field declares the section by uuid
+ * (`SCHEMA.choicesSection`), and that uuid is all the route needs — never the Model,
+ * which the section determines.
+ *
+ * `{ items: [{ uuid, entity, parent?, data, has_children? }], next_cursor }`:
+ *
+ * - **`uuid`** is what an `item_ref` field stores — its value is that string. `entity`
+ *   is the entry that holds the item; `parent`, the item it sits under (absent at a
+ *   root); `has_children`, whether items of the same section sit under it — only for a
+ *   section whose items nest. `data` is projected to `locale` as every read is.
+ * - **Whose items:** those of every entry of the section's Model the viewer may read —
+ *   the list's rule (`SCOPE`'s `accessible`) — or, with `entity`, that entry's alone:
+ *   `404` when the viewer may not read it, and when it is of another Model.
+ * - **One level at a time.** Without `parent`: the section's top level — every item of a
+ *   list that does not nest, the roots of one that does, and all the items of a section
+ *   nested in another. With `parent`: the items under that item — the next level of a
+ *   nesting list, or a **dependent list's** choices under the item chosen in the field
+ *   it depends on. A parent the viewer cannot read, or that does not exist, gives an
+ *   empty page.
+ * - **In the section's own order** — an author's arrangement, by entry.
+ * - **`field` + `q`** — the items whose `field` (a single `string` or `text` field of
+ *   the section) holds `q`, ignoring case, anywhere in it; a localized field is matched
+ *   in the `locale` asked for, and in any language without one. ⚠️ **Such a page may be
+ *   short while more follow**: only `next_cursor: null` ends the list.
+ * - **Paging** — `limit` 50 by default, at most 1000; `cursor` is the opaque
+ *   `next_cursor` of the page before, and `null` on the last page.
+ *
+ * Refused: signed out `401`; a section uuid that is not one `400 "invalid section
+ * uuid: …"`, an unknown one `404 { kind: 'section' }`; a stale cursor `400 "cursor
+ * expired, restart pagination"`; a `binder`, which holds no items, `400 Validation`; a
+ * `q` with no `field` `400 Validation`; a `field` the section does not declare, or that
+ * is not a single `string` or `text`, `400 Validation` naming it in `field`.
+ */
+export const SECTION_ITEMS = {
+  items: 'items',
+  next: 'next_cursor',
+  uuid: 'uuid',
+  entity: 'entity',
+  parent: 'parent',
+  data: 'data',
+  hasChildren: 'has_children',
 }
 
 /**
@@ -570,12 +759,26 @@ export const SCHEMA = {
  * | `409 Conflict` + `item_id`, `current_updated_at` | that item changed since this viewer's token — the ONLY stale-token answer. `item_id` since 2026-09-18; an older backend sends the token alone |
  * | `409 Conflict`, no token | an invitation that no longer waits — answered, or withdrawn (`INVITATIONS`, 2026-10-12) |
  * | `409 Append-Only Section` + `section` | an insert-only section: its items can be added and moved, not edited or deleted |
- * | `409 Schema Rule Violation` | a rule of the Model: a second item in a one-item section, a section of another Model, a reference that still points here |
+ * | `409 Schema Rule Violation` | a rule of the Model: a second item in a one-item section, a section of another Model, a reference that still points here, an item of a nested section without a parent of its parent section |
+ * | `409 Bad Reference` | a reference the field does not accept — for an `item_ref`, an item of another section than the one it pins (MEASURED 2026-10-14) |
  * | `403 Forbidden` + `op`, `target` | may read it, may not do this to it — `edit`, `delete`, `use_model` (create) |
  * | `403 Email Not Verified` | right password, unverified address |
  * | `403 CSRF Header Required` | a cookie-authenticated mutation without `X-Uniweb-Csrf` |
- * | `400 Validation` + `field` | content that does not fit the Model (`field: 'data.minutes'`) |
+ * | `400 Validation` + `field` | content that does not fit the Model (`field: 'data.minutes'`) — see below |
  * | `404 Not Found` + `kind`, `key` | nothing here for you — not found or not permitted |
+ *
+ * ⭐ **A field's rule, refused** — `400 Validation`, `reason: 'invalid_field'`, `rule`
+ * naming the declaration the value broke, and the declaration's bound beside it
+ * (MEASURED 2026-10-14):
+ *
+ * | rule | the problem's own keys |
+ * |---|---|
+ * | `required` | `field: 'data.title'` |
+ * | `max_length` — in characters, per language for a localized value | `field: 'data.title'` (`'data.label.en'`), `max_length` |
+ * | `min` · `max` | `field`, and `min` or `max` |
+ * | `format` — a `date` that is not `YYYY-MM-DD`, a calendar day; `2024-05` is refused | `field`, `format: 'date'` |
+ * | `type` | `field` |
+ * | `one_of` — a value outside a field's `enum` | ⚠️ **no `field`**: the field is named only in `detail` (`item.level = "x" is not one of the allowed values …`) |
  */
 export const PROBLEM = {
   csrf: 'CSRF Header Required',
@@ -603,4 +806,14 @@ export const PROBLEM = {
  * `op-field-names` — see `FIELD` and `OP`.)* A new entry needs `we`, `from` and
  * `breaks`; `tests/wire.test.js` pins the set, so adding one is deliberate.
  */
-export const ASSUMPTIONS = []
+export const ASSUMPTIONS = [
+  {
+    id: 'elevation-by-provider',
+    we:
+      "send the page's address without its query or fragment as `redirect_uri`, and a fresh `state` of our own per attempt, which we never read back — the session's own `elevation.until` says whether it worked; we then take `?elevate=ok`, `?error=oauth_step_up_not_linked` and our `state` off the address bar",
+    from:
+      'the backend names the route, its two parameters and the two answers (2026-10-14), and says it works as step-up\'s provider flow does; what `state` must be, and how an answer joins a `redirect_uri` that has a query of its own, it does not say — a sign-in through a provider sends a fresh `state` per attempt and gets it back',
+    breaks:
+      "a backend that refuses a `state` it did not mint, or this site's origin as a `redirect_uri`, answers the navigation with a page of its own: the viewer is not elevated, and nothing else changes",
+  },
+]