mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
97174f470d
The demo allowlist had grown two entries it should not carry. The demo is one published account every visitor signs into, so `PUT /api/coach/about-me` was an anonymous write of arbitrary text into the Coach prompt, persisted for every later visitor until the next reseed; it is gone, and the baseline step's anamnesis card renders read-only under `DEMO_MODE` so no visitor meets the refusal as a failed confirm. `POST /api/managed-profiles` bought nothing: the route opens with a fresh-MFA requirement the demo account cannot satisfy, so the guardian arm was limited to finishing without the profile either way. The baseline profile write stays, and the block's preamble now describes what is actually admitted and why the two refusals are refusals.