features: retire the /features/app twin; the edge delivers identity at /features

/features/app existed because the edge's public block stripped identity
from /features and the only remedy to hand was the landing page's
cookie-redirect to a second address. The edge now passes session-cookie
holders through forward_auth at /features itself (markbot-server
37c83a4), so the twin forwards home permanently and the app header and
schedule links point at /features.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0121j6qgGwUSLGQ48jWZN98F

Author: uppertoe

internal/server/contact_submit_test.go

@@ -132,3 +132,16 @@ func TestContactFormOffWithoutSwitch(t *testing.T) {
 		t.Fatal("CONTACT_TO alone should keep the form on")
 	}
 }
+
+// TestFeaturesAppForwardsHome: the retired signed-in twin address forwards
+// permanently to /features, where the edge now delivers identity directly.
+func TestFeaturesAppForwardsHome(t *testing.T) {
+	s := newAuthzServer(t)
+	r := httptest.NewRequest("GET", "/features/app", nil)
+	r.Host = "app.example.com"
+	w := httptest.NewRecorder()
+	s.Handler().ServeHTTP(w, r)
+	if w.Code != 301 || w.Header().Get("Location") != "/features" {
+		t.Fatalf("/features/app = %d -> %q, want 301 -> /features", w.Code, w.Header().Get("Location"))
+	}
+}

internal/server/frontend_security_test.go

@@ -276,8 +276,8 @@ func TestNoInlineScriptInsideBoostedBody(t *testing.T) {
 // unstyled and inert until a manual refresh. The nav already opts out; the hazard is
 // that every future content link has to remember, so this enforces it centrally.
 func TestLinksIntoAssetPagesAreNotBoosted(t *testing.T) {
-	// Matches an <a> whose href is exactly "/", "/features" or "/features/app" and that lacks hx-boost.
-	link := regexp.MustCompile(`<a href="(/|/features|/features/app)"(?:\s[^>]*)?>`)
+	// Matches an <a> whose href is exactly "/" or "/features" and that lacks hx-boost.
+	link := regexp.MustCompile(`<a href="(/|/features)"(?:\s[^>]*)?>`)
 	err := fs.WalkDir(templateFS, ".", func(p string, d fs.DirEntry, err error) error {
 		if err != nil || d.IsDir() || !strings.HasSuffix(p, ".html") {
 			return err

internal/server/public.go

@@ -73,3 +73,8 @@ func (s *Server) features(w http.ResponseWriter, r *http.Request) {
 func (s *Server) howRedirect(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/features", http.StatusMovedPermanently)
 }
+
+// featuresAppRedirect retires the signed-in twin address (see the route).
+func (s *Server) featuresAppRedirect(w http.ResponseWriter, r *http.Request) {
+	http.Redirect(w, r, "/features", http.StatusMovedPermanently)
+}

internal/server/server.go

@@ -420,11 +420,12 @@ func (s *Server) Handler() http.Handler {
 	s.handle(mux, "/", guardPublic, s.notFound)
 	s.handle(mux, "GET /security", guardPublic, s.security) // public
 	s.handle(mux, "GET /features", guardPublic, s.features) // public
-	// The signed-in twin of /features. The edge's public block strips identity
-	// on purpose, so /features itself can never know who you are; Caddy
-	// redirects session-cookie holders here, where the protected catch-all
-	// delivers full identity and the same handler renders the app chrome.
-	s.handle(mux, "GET /features/app", guardPublic, s.features)
+	// /features/app was the signed-in twin of /features while the edge's public
+	// block stripped identity from /features itself (5–10 Sep 2026). The edge
+	// now passes session-cookie holders through forward_auth at /features, so
+	// the twin forwards home; it stays only for the app header and schedule
+	// links people have in their history.
+	s.handle(mux, "GET /features/app", guardPublic, s.featuresAppRedirect)
 	s.handle(mux, "GET /how", guardPublic, s.howRedirect)               // public; the page's old address
 	s.handle(mux, "GET /faq", guardPublic, s.faq)                       // public
 	s.handle(mux, "GET /guide/{slug}", guardPublic, s.guide)            // public question pages

internal/server/templates/nav.html

@@ -34,7 +34,7 @@
          the menu — the visitor features go undiscovered, and a control nobody
          sees teaches nothing. Full navigation: /how's demo assets are head-only
          (see publicheader), so a boosted arrival would render a dead gallery. */}}
-    <a href="/features/app" hx-boost="false" class="howlink{{if eq .State "how"}} active{{end}}" {{if eq .State "how"}}aria-current="page" {{end}}aria-label="Features">{{template "ic-help"}}<span class="howlink-txt">Features</span></a>
+    <a href="/features" hx-boost="false" class="howlink{{if eq .State "how"}} active{{end}}" {{if eq .State "how"}}aria-current="page" {{end}}aria-label="Features">{{template "ic-help"}}<span class="howlink-txt">Features</span></a>
     <button class="icon-btn" type="button" data-theme-toggle title="Toggle light / dark" aria-label="Toggle theme">
       <span class="th-moon">{{template "ic-moon"}}</span><span class="th-sun">{{template "ic-sun"}}</span>
     </button>

internal/server/templates/schedule.html

@@ -112,7 +112,7 @@ <h2 class="exp-h2">{{template "ic-clock"}} Permits no longer active</h2>
        demo assets are head-only (see publicheader). */}}
   <p class="share-hint" style="--hue:var(--sec-guests)" x-data="{hide: localStorage.getItem('pstonn-how-hint')==='1'}" x-show="!hide" x-cloak>
     {{template "ic-qr"}}
-    <span>There&rsquo;s more than the roster: visitor QRs, a printed QR that asks first, guest passes. <a href="/features/app" hx-boost="false">See how they work</a>.</span>
+    <span>There&rsquo;s more than the roster: visitor QRs, a printed QR that asks first, guest passes. <a href="/features" hx-boost="false">See how they work</a>.</span>
     <button type="button" class="ghost icon sm" aria-label="Dismiss" title="Dismiss"
             @click="hide=true; localStorage.setItem('pstonn-how-hint','1')">{{template "ic-x"}}</button>
   </p>

internal/server/testdata/golden/pages/activity-booking-fab.html

@@ -293,7 +293,7 @@
   <a href="/" hx-boost="false" class="brand brand-link"><span class="mark"><svg viewBox="0 0 24 24"><path d="M8.5 18.5V5.5h4.6a4 4 0 0 1 0 8H8.5" stroke-width="2.2"/></svg></span> <span class="brand-text"><span class="word">p<span class="dot">.</span>stonn</span> <span class="brand-tag">Visitor Permit Scheduler</span></span></a>
   <div class="appbar-r">
 
-    <a href="/features/app" hx-boost="false" class="howlink" aria-label="Features"><svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="9"/><path d="M9.6 9.2a2.5 2.5 0 0 1 4.9.7c0 1.6-2.4 2-2.4 3.4"/><path d="M12 17h.01"/></svg><span class="howlink-txt">Features</span></a>
+    <a href="/features" hx-boost="false" class="howlink" aria-label="Features"><svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="9"/><path d="M9.6 9.2a2.5 2.5 0 0 1 4.9.7c0 1.6-2.4 2-2.4 3.4"/><path d="M12 17h.01"/></svg><span class="howlink-txt">Features</span></a>
     <button class="icon-btn" type="button" data-theme-toggle title="Toggle light / dark" aria-label="Toggle theme">
       <span class="th-moon"><svg viewBox="0 0 24 24"><path d="M21 12.8A8 8 0 1 1 11.2 3a6 6 0 0 0 9.8 9.8z"/></svg></span><span class="th-sun"><svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="4"/><path d="M12 2v2M12 20v2M2 12h2M20 12h2M5 5l1.5 1.5M17.5 17.5L19 19M19 5l-1.5 1.5M6.5 17.5L5 19"/></svg></span>
     </button>

internal/server/testdata/golden/pages/activity-removal.html

@@ -293,7 +293,7 @@
   <a href="/" hx-boost="false" class="brand brand-link"><span class="mark"><svg viewBox="0 0 24 24"><path d="M8.5 18.5V5.5h4.6a4 4 0 0 1 0 8H8.5" stroke-width="2.2"/></svg></span> <span class="brand-text"><span class="word">p<span class="dot">.</span>stonn</span> <span class="brand-tag">Visitor Permit Scheduler</span></span></a>
   <div class="appbar-r">
 
-    <a href="/features/app" hx-boost="false" class="howlink" aria-label="Features"><svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="9"/><path d="M9.6 9.2a2.5 2.5 0 0 1 4.9.7c0 1.6-2.4 2-2.4 3.4"/><path d="M12 17h.01"/></svg><span class="howlink-txt">Features</span></a>
+    <a href="/features" hx-boost="false" class="howlink" aria-label="Features"><svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="9"/><path d="M9.6 9.2a2.5 2.5 0 0 1 4.9.7c0 1.6-2.4 2-2.4 3.4"/><path d="M12 17h.01"/></svg><span class="howlink-txt">Features</span></a>
     <button class="icon-btn" type="button" data-theme-toggle title="Toggle light / dark" aria-label="Toggle theme">
       <span class="th-moon"><svg viewBox="0 0 24 24"><path d="M21 12.8A8 8 0 1 1 11.2 3a6 6 0 0 0 9.8 9.8z"/></svg></span><span class="th-sun"><svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="4"/><path d="M12 2v2M12 20v2M2 12h2M20 12h2M5 5l1.5 1.5M17.5 17.5L19 19M19 5l-1.5 1.5M6.5 17.5L5 19"/></svg></span>
     </button>

internal/server/testdata/golden/pages/activity-showing-all.html

@@ -293,7 +293,7 @@
   <a href="/" hx-boost="false" class="brand brand-link"><span class="mark"><svg viewBox="0 0 24 24"><path d="M8.5 18.5V5.5h4.6a4 4 0 0 1 0 8H8.5" stroke-width="2.2"/></svg></span> <span class="brand-text"><span class="word">p<span class="dot">.</span>stonn</span> <span class="brand-tag">Visitor Permit Scheduler</span></span></a>
   <div class="appbar-r">
 
-    <a href="/features/app" hx-boost="false" class="howlink" aria-label="Features"><svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="9"/><path d="M9.6 9.2a2.5 2.5 0 0 1 4.9.7c0 1.6-2.4 2-2.4 3.4"/><path d="M12 17h.01"/></svg><span class="howlink-txt">Features</span></a>
+    <a href="/features" hx-boost="false" class="howlink" aria-label="Features"><svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="9"/><path d="M9.6 9.2a2.5 2.5 0 0 1 4.9.7c0 1.6-2.4 2-2.4 3.4"/><path d="M12 17h.01"/></svg><span class="howlink-txt">Features</span></a>
     <button class="icon-btn" type="button" data-theme-toggle title="Toggle light / dark" aria-label="Toggle theme">
       <span class="th-moon"><svg viewBox="0 0 24 24"><path d="M21 12.8A8 8 0 1 1 11.2 3a6 6 0 0 0 9.8 9.8z"/></svg></span><span class="th-sun"><svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="4"/><path d="M12 2v2M12 20v2M2 12h2M20 12h2M5 5l1.5 1.5M17.5 17.5L19 19M19 5l-1.5 1.5M6.5 17.5L5 19"/></svg></span>
     </button>

internal/server/testdata/golden/pages/activity-source-label.html

@@ -293,7 +293,7 @@
   <a href="/" hx-boost="false" class="brand brand-link"><span class="mark"><svg viewBox="0 0 24 24"><path d="M8.5 18.5V5.5h4.6a4 4 0 0 1 0 8H8.5" stroke-width="2.2"/></svg></span> <span class="brand-text"><span class="word">p<span class="dot">.</span>stonn</span> <span class="brand-tag">Visitor Permit Scheduler</span></span></a>
   <div class="appbar-r">
 
-    <a href="/features/app" hx-boost="false" class="howlink" aria-label="Features"><svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="9"/><path d="M9.6 9.2a2.5 2.5 0 0 1 4.9.7c0 1.6-2.4 2-2.4 3.4"/><path d="M12 17h.01"/></svg><span class="howlink-txt">Features</span></a>
+    <a href="/features" hx-boost="false" class="howlink" aria-label="Features"><svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="9"/><path d="M9.6 9.2a2.5 2.5 0 0 1 4.9.7c0 1.6-2.4 2-2.4 3.4"/><path d="M12 17h.01"/></svg><span class="howlink-txt">Features</span></a>
     <button class="icon-btn" type="button" data-theme-toggle title="Toggle light / dark" aria-label="Toggle theme">
       <span class="th-moon"><svg viewBox="0 0 24 24"><path d="M21 12.8A8 8 0 1 1 11.2 3a6 6 0 0 0 9.8 9.8z"/></svg></span><span class="th-sun"><svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="4"/><path d="M12 2v2M12 20v2M2 12h2M20 12h2M5 5l1.5 1.5M17.5 17.5L19 19M19 5l-1.5 1.5M6.5 17.5L5 19"/></svg></span>
     </button>