lead decisions: 98, the preview serves the credentials read as built (#1549, Dewey N2)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-09-26_lead-decisions.md

@@ -2126,3 +2126,20 @@ which stay with him. Each item names who decided it and what happened.
     - The tradeoff: on cutover day Jason sends from the browser and reads
       the answer in the CLI. In exchange no broker change lands before the
       cutover and row 76 needs no extra review round.
+
+98. **The preview serves the credentials read as built (2026-10-12).**
+    Dewey's N2 on row 60 (#1549, comment 27431): with row 74's preview
+    mode, `/api/bus/credentials` is readable from the edge by the one
+    signed-in user. It is the first bus read whose content is about
+    credentials.
+    - It ships unchanged. Each row carries service, bot account, role,
+      date kind, date and state. No token, file path or variable name
+      reaches the output, and row 60's tests pin that.
+    - Only the allowed user gets past the sign-in proxy, and that user is
+      Jason, who already reads the same business file locally. An expiring
+      or overdue token is what he should see from the browser.
+    - No README edit. Row 74's preview section already says the GET
+      routes, the bus views included, are unchanged.
+    - The tradeoff: the bot account names and token dates leave the host
+      on every signed-in page load. If the preview ever admits a second
+      user, this read goes back for review first.