## ADDED Requirements

### Requirement: Complete runtime authentication integration
The integration SHALL include the authentication foundation, session/CSRF correction, login experience, and refresh redirect fix as one feature branch based on current `master`. Historical source-branch OpenSpec records MUST NOT be present in the final integration diff.

#### Scenario: Integration branch is prepared
- **WHEN** maintainers inspect the integration branch
- **THEN** it contains the required runtime code and tests but excludes historical source-branch OpenSpec records

### Requirement: Safe initial routing
The frontend SHALL show an identity-neutral startup state until initial session validation completes. The router MUST own the initial current-user route decision. An unauthenticated visitor MUST NOT see a protected workspace before reaching login.

#### Scenario: Unauthenticated protected refresh
- **WHEN** an unauthenticated visitor refreshes a protected URL
- **THEN** the neutral boot state is shown before the login route, without a dashboard shell or dashboard-shaped placeholder

#### Scenario: Initial network failure
- **WHEN** initial current-user validation fails from a network error rather than a 401 response
- **THEN** the browser remains on the requested URL and provides a retry state

### Requirement: Protected asset compatibility
Permitted authenticated users SHALL retain their device, phone, WeCom, and system-user workflows. Unauthenticated or unauthorized protected writes MUST be rejected by the backend security policy.

#### Scenario: Permitted protected write
- **WHEN** a permitted signed-in user performs an allowed asset write with valid CSRF data
- **THEN** the backend accepts the operation

#### Scenario: Rejected protected write
- **WHEN** a visitor lacks a valid session or required permission for a protected write
- **THEN** the backend rejects the operation and the frontend does not report success
