- M1: E2E_REQUIRE_SEEDED_AUTH=1 in the CI e2e step makes login failures hard
failures (loginAs throws, guards disabled, globalSetup refuses a pre-populated
DB); auth.spec redirect test asserts outright under the flag; non-admin
/admin test is now a real authorization assertion
- M2: ci.yml build step depends_on test — never two concurrent turbo builds
on the shared workspace
- M3: unknown /assets/* paths 404 from the SPA catch-all instead of serving
index.html with an immutable cache header; spec arm added
- minors: e2e step gets when: *image_build_when, health poll uses
GATEWAY_PORT + AbortSignal.timeout, BETTER_AUTH_SECRET generated per run
(no literal in tree), failure echoes artifact path, dev-guide documents the
gate, stale verify-release comment fixed
fred
jason.woltje