The key rotated on every server restart, stranding every phone that held the previous cookie — during active development that guaranteed a wall of refusals from stale polling tabs after each restart. The key now lives in data/.lan_key (gitignored, 0600 — the Playwright-state treatment for credential-adjacent files) and is reused across restarts; delete the file to rotate. A keyless browser navigation now gets a one-line HTML page saying what to do instead of raw JSON. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g