/* ============================================================ APPENDED: the signed-out shell MEASURED DEFECT (Kazim, 2026-09-23): the login page could be CLOSED, and doing so revealed a signed-out console — a "broken version of the website" with no data in it. The Close button dismissed the overlay, which was only COVERING the desk; nothing hid the desk itself. Covering is a paint order, and a paint order is not a lock. `access.js` now refuses `close()` while the login is up, does not draw the Close control while signed out, and puts `signed-out` on . THESE rules are what make the class mean something: with no session the shell is not rendered at all, so there is nothing behind the login for any path to reveal — the Close button, Escape, the browser Back gesture, or a stray `access.close()` call from the console's own script. Everything hidden here is the signed-OUT state only; `signed-out` is removed on a successful sign-in, and `close()` removes it too, so nothing here can strand a signed-IN operator. `.st-overlay` (the login/settings overlay) is deliberately NOT hidden — it is the one thing that must stay reachable while signed out. */ body.signed-out > header, body.signed-out .desk, body.signed-out .wfbar, body.signed-out #stepper, body.signed-out .banner { display: none !important; } /* The overlay owns the whole screen while signed out, so there is no half-drawn page visible at its edges if the viewport is shorter than the shell — the defect this whole rule set exists for. */ body.signed-out .st-overlay { position: fixed; inset: 0; overflow-y: auto; background: var(--bg); }