grim7/13/2026, 7:38:31 AM

end-to-end testing of dev:demo surfaced two issues:

- mintSession relied on signInEmail THROWING for a missing user, but
  with asResponse a missing user is a non-ok 401 — so the sign-up
  fallback never ran and the first persona login 500'd ("failed to
  establish dev session"). check res.ok before falling back. locked
  with a regression assertion (missing user ⇒ ok:false, not a throw).
- the demo's dev BETTER_AUTH_SECRET was < 32 chars, tripping better-auth's
  entropy warning on boot. lengthen it (local-only, never a real key).

verified live: active persona login → 200 + session cookie + landing;
authed dashboard renders home stats on pglite; unauthed / → auto-login
trampoline. checks: typecheck all, biome, boundaries, 216 tests.

Parent732e270