the citation text
S2 patch 1d7bc8f on factory/tuna-ui-1027 (wyo+github, branch-only, no master push): POST /signup browser-tier lane through the SAME signup core (Api.signup_gate + Api.signup_core; 404s when TUNA_SIGNUP off, same law as /api/signup); welcome signup block carries the form; token page shows the bearer ONCE with copy-it-now + start-session button that POSTs /login with the token hidden - session minted by the existing login path, no paste. Handler lives in Api beside the core (Api -> Pages -> Public library order, Public cannot see Api). signup + agent added to the reserved-prefix list (routes.borg law 2 book change). PG-gated test drives the click-only path: form -> token page -> login POST -> session cookie, plus the 404 off-state (runs via scripts/test-store.sh, TUNA_TEST_PG=1). Receipt {command: dune build && dune runtest; env: poohstack switch, dune 3.24.2, ocaml 4.14.2}; build+runtest green. Acceptance S2 met. hollis review+merge+deploy.