- resolve account capabilities before protected page queries mount\n- leave public routes outside the record loading gate