- login guard: exact /login path, dashboard only, and not when /login itself is requested, so status-page password pages and the login screen can be shot - explicit --user or --token never fall back to a saved state; the chosen auth source is logged; --login is skipped once auth is resolved - deterministic session and workspace pick (user_id, created_at tiebreakers) - the non-dashboard probe detects a dashboard on --base up front - --width is validated; the header points at the skill instead of repeating it - turbo passes PORT through, so pnpm dev:dashboard honours it too; the skill says to use the --filter form when DATABASE_URL must differ - seed comment back to two lines