v0.25.2

docs/API_ACCESS.md

@@ -1,4 +1,4 @@
-# Administration API access - 0.25.1
+# Administration API access - 0.25.2
 
 ## Sign-in boundary
 
@@ -41,7 +41,10 @@ Exact anonymous methods/paths:
 The document allowlist above is intentionally session-aware: a browser refresh on a protected
 panel path first validates the cookie server-side instead of rendering a false logged-out state.
 The login document also rechecks `/api/auth/session` when restored from browser history, preventing
-a stale back/forward-cache copy from contradicting a still-valid session. Every other admin
+a stale back/forward-cache copy from contradicting a still-valid session. The authenticated shell
+also treats `auth.invalid_origin` during startup/session revalidation as a stale restored-page signal
+and performs at most one reload of the current same-origin URL. A repeated failure is shown normally;
+server Host/Origin, request-marker and CSRF validation is unchanged. Every other admin
 path/method, including full assets, `/api/metrics`, `/metrics`, unknown endpoints and the OpenAPI
 schema, requires an active database session.
 Missing/invalid/expired cookies return `401 {"error":"auth.required"}` before