Finding (operator + R1-BE, CONFIRMED live). Commit 31dbe87 fail-closed gate is SOLID (do_GET :1582 if not authed; no-token -> flag). But its own comment documents ?token= URL param (persisted to sessionStorage) as the rotation mechanism, while open P1-02 flags ?token= distribution (history/logs/referer leak). Fix and finding contradict silently.
Fix: disposition P1-02 in the open (accept-with-mitigations: same-origin only, no external links, short TTL - or replace with header/paste flow) - never silent coexistence.
Source: Muse EGV review 2026-09-02 (BHK muse-lane lesson 6).
Finding (operator + R1-BE, CONFIRMED live). Commit 31dbe87 fail-closed gate is SOLID (do_GET :1582
if not authed; no-token -> flag). But its own comment documents?token=URL param (persisted to sessionStorage) as the rotation mechanism, while open P1-02 flags?token=distribution (history/logs/referer leak). Fix and finding contradict silently.Fix: disposition P1-02 in the open (accept-with-mitigations: same-origin only, no external links, short TTL - or replace with header/paste flow) - never silent coexistence.
Source: Muse EGV review 2026-09-02 (BHK muse-lane lesson 6).