Room shell disclosure and anonymous API check
Sep20,2026
Anonymous curl reads: root and room shell200; context/sessions/progress/queue/decisions401 with sign-in error only. Public Hub roster/history intentionally published; private session data not returned.22 local room tests passed. Disclosure added to initialHTML and sign-in template; no access-policy change.