- server: emit X-Auth-Failure (jwt_expired / jwt_signature / user_inactive / no_token ...) next to X-Auth-Required on session UNAUTHORIZED responses
- desktop: log every 401/403 through the backend proxy at info level with hadToken, authRequired, authFailure and locally decoded JWT claims (sub / exp / expiredBy)
- desktop: add scripts/analyzeAuthLog.mjs (bun run log:auth) that turns a user's main.log into verdict codes with next steps
Claude-Session: https://claude.ai/code/session_01XjdtgxABquDMKeLZxu8q64