Reader lane login, sibling-path denial, and KeyCape exchange checks. No sitting POST. Attended wrapper selects the exact OIDC reader role. Assistant: grok Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a