[makeitfutureDev]

Administrators using a remote browser can be unable to create a device passkey. Add an off-by-default Settings → Admin access option for the shared dashboard password plus a private Slack code. Sign-in identifies the administrator by their Slack email address, resolves it through the configured gateway Slack app, and retains the existing stable Slack user ID internally. Existing passkey selection and authenticator labels remain unchanged.

The gateway verifies the password before directory lookup or account writes, requires an exact normalized provider email and current canonical Admin, and rejects bots, deactivated/non-admin users and mismatched profiles. It needs users:read.email on the gateway app; missing scope gives explicit reinstall guidance after password verification. The requester's personal Composio connection is not used for runtime authentication. Sensitive-action reauthentication uses the current account/session and cannot change users.

OTP protections include browser/session binding, single use, five-minute expiry, five guesses, failure limits, and revocation on role/version/password/settings changes. Linked initial setup can enable the alternative without creating a passkey. Disabling from an alternate session signs that browser out.

Validation of the email update:

• Real Chromium: 16 passed, zero skipped across passkeys, bootstrap, email+Slack-code login/reauth/sign-out and domain-policy browser fixtures. Slack lookup and delivery are simulated.
• Focused email security tests and the real configured Slack-client wiring fixture passed; independent backend review completed.
• Full coverage: 4,246 passed, 40 opt-in skipped, zero failed; coverage94.09/86.63/90.42% lines/branches/functions. Static994JavaScript files, security coverage, secret scan, DCO and root production audit at high threshold passed (four moderate advisories). Documentation build153pages/27,783internal links/130gateway controls passed. CI for this exact updated head is tracked separately.
• Private engine-independent acceptance definitions ADM-SLACK-EMAIL-01 and ADM-SLACK-EMAIL-02 recorded using the established personal QA connection. Deployed Slack delivery and human acceptance remain pending.

This branch refreshes the earlier pending feature against current beta and contains that prerequisite feature. Merge conflicts preserve newer beta functionality. Minimal control-reference additions restore documentation coverage without removing existing references. Stable main publication remains a separate promotion decision; no daemon restart or deployment has been performed here.