Finding — Session-Resolution Test Failure, Not Yet Root-Caused

Version: 0.1
Status: Recorded finding. Not a CR. Surfaced during the engine test-suite schema-drift diagnosis, this session.

The problem

test_stele_router_mount.py::test_stele_router_mounts_and_begin_resolves_end_to_end fails. The Stele router mounts correctly (all 8 routes assert fine), and a session token is minted via stele.session.issue_session and set as a cookie using the engine's own COOKIE_NAME (correctly decoupled from Stele per CR-2026-120) — but the first authenticated call after that gets 401 Authentication required, as if no valid session exists.

What's confirmed so far

• Not related to CR-2026-149's TOTP bug.
• Not related to the Stele migration-chain collision (CR-2026-150) — the schema-drift fix was applied and re-verified before this failure was isolated as separate.
• Not introduced by this session's Stele changes, as far as investigated — but this has not been confirmed with the same rigor as the other two findings.

Not yet investigated

Where exactly the session-resolution breaks down — cookie handling, the engine's dependency-injection chain for resolving an authenticated principal, or something else. No root cause identified yet.

Status

Recorded. Not scheduled. Needs further investigation before it can become a properly scoped CR.