The signed-in nav finally reads the session cookie
The signed-in nav actually works now. The dashboard's current-portal-session
cookie is HttpOnly, so the pre-paint script's document.cookie read could never
see it. That is why #16 named the right cookie and still left every visitor on the
signed-out variant. The root layout reads the cookie with cookies() from
next/headers and stamps data-authed on <html> at render time, so a signed-in
visitor gets "Open Assembly" in the header, no Free tier on pricing, and
"Add app to workspace" on the CTAs. The client script is now only the ?authed=1|0
demo override, which still works on preview URLs where no cookie exists.
Known regression, shipping anyway: the whole site is server-rendered now.
Reading a cookie in the root layout opts every route out of static rendering,
because the root layout wraps all of them. The build table went from ~40 static
routes plus 785 prerendered pages to sitemaps and /llm-info alone. Pages no
longer come off the CDN, Ghost is fetched per request instead of per revalidate
window, and Vercel function invocations rise across the site. Nothing is broken
and nothing looks different; it is slower and costs more. The fix is to move the
cookie read somewhere narrower than the root layout, middleware that stamps a
header or a small dynamic component, so only the nav is uncached. Filed as
follow-up work.