diff --git a/scripts/taler-monitoring/README.md b/scripts/taler-monitoring/README.md
index eea5e12..578b683 100644
--- a/scripts/taler-monitoring/README.md
+++ b/scripts/taler-monitoring/README.md
@@ -109,6 +109,26 @@ Each check prints **global** and **grouped** ids:
 
 # Landing stats.json freshness (outside-in; age via generated_at_unix)
 STATS_STALE_SECS=900 STATS_FAIL_SECS=3600 ./taler-monitoring.sh -d stage.lefrancpaysan.ch urls
+
+# --- Full load (GOA / hacktivism) ---
+# all  = urls + inside + versions + sanity + e2e
+# full = all + server + ladder + auth401  (long; needs secrets.env)
+./taler-monitoring.sh -d hacktivism.ch full
+./taler-monitoring.sh -d hacktivism.ch urls inside versions sanity server e2e ladder auth401
+
+# SPA pin after selfbuild-webui.sh (container):
+EXPECT_WEBUI_VERSION=1.6.11 EXPECT_WEBUI_OVERLAY=selfbuild-v1.6.11 \
+  WEBUI_OVERLAY_DENY='c778af04|master-11340' \
+  ./taler-monitoring.sh -d hacktivism.ch urls
+
+# Only 401 matrix (may create throwaway instance):
+./taler-monitoring.sh -d hacktivism.ch auth401
+
+# Stage FrancPaysan — durable mon401 account (password in francpaysan-secrets):
+./taler-monitoring.sh -d stage.monnaie.lefrancpaysan.ch auth401
+# secrets: ~/francpaysan-secrets/stage/instances/mon401.password
+#           ~/francpaysan-secrets/stage/default-instance-token.txt
+# force throwaway create instead: AUTH401_PREFER_DURABLE=0 AUTH401_CREATE=1 …
 ```
 
 ### Landing `stats.json` (www.stats)
diff --git a/scripts/taler-monitoring/TESTS.md b/scripts/taler-monitoring/TESTS.md
index 4ad45e9..fb829d0 100644
--- a/scripts/taler-monitoring/TESTS.md
+++ b/scripts/taler-monitoring/TESTS.md
@@ -52,6 +52,7 @@ Numbering follows **executed** checks (early skip may shift later NN inside the
 | **www.stats-** | `/intro/stats.json` **reachable**; **timestamps** (`generated_at_unix` + human/ISO); **freshness** vs wall clock (`STATS_STALE_SECS` WARN, `STATS_FAIL_SECS` ERROR); **display fields** (bank-shape withdraws/accounts, or exchange-db / merchant-db keys); optional performance block; shared-feed equal `gen_unix` when bank collector is published to all three |
 | **www.bank-** | `/config`, currency, alt_unit_names; integration/webui/intro; **auto-account.json** (required GOA/local; skip/soft off-GOA e.g. TESTPAYSAN); `/terms`, `/privacy` |
 | **www.merchant-** | `/config` currency + currencies alt_unit_names; listed exchanges alt; webui/intro; **`/terms`**, **`/privacy`** |
+| **www.webui-** | SPA fingerprints: **`/webui/version.txt`**, **`/webui/version-overlay.txt`**, `index.html` / `index.js`; optional pin via `EXPECT_WEBUI_VERSION` / `EXPECT_WEBUI_OVERLAY` / `WEBUI_OVERLAY_DENY` |
 | **www.paivana-** | local GOA paywall front (redirect to template) |
 | **www.landing-** | own-stack intro links; static assets (`qrcode.min.js` hard; `og-goa-shop.png` hard only GOA/local); **demo-withdraw.json** GOA-only; shop-pay soft; stage merchant shop: `shop-ui.js` + `shops.css` + `qrcode.min.js`; cross-links local |
 | **www.qr-** | QR payloads: harvest `taler://` / `payto://` / app `data-qr-url` from landings + mint JSON; **form** check; **qrencode → zbarimg** exact roundtrip; optional static QR images. Needs `qrencode` + `zbar-tools`. Skip: `QR_CHECK=0` |
@@ -106,7 +107,7 @@ When filing an issue, quote the full id + label, e.g.
 
 ---
 
-## versions / sanity / ladder / server
+## versions / sanity / ladder / server / auth401
 
 | Area.group | Meaning |
 |------------|---------|
@@ -116,6 +117,34 @@ When filing an issue, quote the full id + label, e.g.
 | **sanity.bank-** / **.exchange-** / **.merchant-** | public + optional server-side per component |
 | **ladder.plan-** / **.load-** / **.withdraw-** / **.pay-** / **.report-** | amount ladder (GOA ceiling or stage TESTPAYSAN `max_wire`) |
 | **server-** | SSH host ports / processes (flat unless grouped later) |
+| **auth401.*** | merchant 401 / case matrix (WebUI APIs): **signup** `POST /instances` MIX id, **login** Basic user low vs MIX/UPPER, full **case** matrix, **password** bad/empty, **pwchange** `POST private/auth` + re-login, **admin-create** `POST /management/instances` (if admin token), **bearer**, **durable mon401**, **webui** SPA `toLowerCase` probe (`check_auth401.sh`) |
+
+### SPA pin (after selfbuild-webui)
+
+```bash
+EXPECT_WEBUI_VERSION=1.6.11 \
+EXPECT_WEBUI_OVERLAY=selfbuild-v1.6.11 \
+WEBUI_OVERLAY_DENY='c778af04|master-11340' \
+  ./taler-monitoring.sh -d hacktivism.ch urls
+```
+
+Skip SPA block: `CHECK_WEBUI_SPA=0`.
+
+### Full load (maximum phases)
+
+| Alias | Expands to (local GOA) |
+|-------|-------------------------|
+| **`all`** | `urls inside versions sanity e2e` |
+| **`full`** | `urls inside versions sanity server e2e ladder auth401` |
+
+```bash
+cd ~/src/koopa/koopa-admin-log/scripts/taler-monitoring
+# secrets.env with bank admin + merchant tokens (see secrets.env.example)
+./taler-monitoring.sh -d hacktivism.ch full
+# same, explicit:
+./taler-monitoring.sh -d hacktivism.ch \
+  urls inside versions sanity server e2e ladder auth401
+```
 
 ---
 
diff --git a/scripts/taler-monitoring/secrets.env.example b/scripts/taler-monitoring/secrets.env.example
index 212a7f2..87ec88c 100644
--- a/scripts/taler-monitoring/secrets.env.example
+++ b/scripts/taler-monitoring/secrets.env.example
@@ -43,6 +43,32 @@
 # PROGRESS_SHOW_EVERY=8
 # PROGRESS_OFF=1
 
+# --- Merchant SPA /webui/ fingerprints (urls phase, group www.webui) ---
+# EXPECT_WEBUI_VERSION=1.6.11
+# EXPECT_WEBUI_OVERLAY=selfbuild-v1.6.11
+# WEBUI_OVERLAY_DENY=c778af04|master-11340
+# CHECK_WEBUI_SPA=0
+
+# --- auth401 phase (WebUI signup/login/pwchange/admin + case matrix) ---
+# Default FULL=1 creates throwaway MIX instance + runs all groups.
+# Stage also loads durable mon401 for extra durable.* checks:
+# AUTH401_FULL=1
+# AUTH401_CONTINUE=1         # optional: hard prereqs soft; full ERROR list always via EXIT trap
+# CONTINUE_ON_ERROR=1        # alias for AUTH401_CONTINUE
+# (auth401 no longer uses set -e — silent mid-run abort fixed)
+# AUTH401_CREATE=1
+# AUTH401_PREFER_DURABLE=0   # 1 = only mon401, skip throwaway signup
+# AUTH401_INSTANCE=mon401
+# AUTH401_PASSWORD=
+# AUTH401_DURABLE_ID=mon401
+# AUTH401_CREATE_PASSWORD=Mon401-Test-Pass!
+# AUTH401_SKIP_IF_MFA=1
+# AUTH401_BEARER=            # default-instance-token (not admin)
+# AUTH401_ADMIN_TOKEN=       # required for admin-create group
+# AUTH401_ADMIN_PASSWORD=    # or login as AUTH401_ADMIN_USER=admin
+# AUTH401_ADMIN_USER=admin
+# FRANCPAYSAN_SECRETS=$HOME/francpaysan-secrets
+
 # --- Ladder (GOA withdraw ladder · explorer pool) ---
 # Prefer SECRETS_ROOT / KOOPA_ADMIN_SECRETS (bank-explorer-password.txt).
 # Overrides only if needed: