diff --git a/scripts/taler-monitoring/check_auth401.sh b/scripts/taler-monitoring/check_auth401.sh
new file mode 100755
index 0000000..dfca606
--- /dev/null
+++ b/scripts/taler-monitoring/check_auth401.sh
@@ -0,0 +1,704 @@
+#!/usr/bin/env bash
+# auth401 — merchant HTTP 401 / case-sensitivity matrix (WebUI-shaped flows)
+#
+# Exercises the same APIs the merchant SPA uses for:
+#   • self-provision signup (POST /instances) — mixed-case id
+#   • login / createAccessToken (POST …/private/token) — Basic user case
+#   • password change (POST …/private/auth)
+#   • admin-create (POST /management/instances) when admin bearer available
+#   • access-token + private/ with Bearer
+#
+# Backend fact (#11340): Basic-auth *username* is case-sensitive; URL path is
+# usually not. SPA must always lowercase the username (createAccessToken, signup
+# id, admin-create, pw change re-login). These tests assert the *raw API*
+# behaviour so a missing SPA lowercasing shows up as 401 where 200 is wanted
+# only after lowercasing.
+#
+#   ./taler-monitoring.sh -d stage.monnaie.lefrancpaysan.ch auth401
+#   ./taler-monitoring.sh -d hacktivism.ch auth401
+#
+# Continue through all groups / collect every ERROR (optional):
+#   AUTH401_CONTINUE=1 ./taler-monitoring.sh -d stage… auth401
+#   CONTINUE_ON_ERROR=1 ./taler-monitoring.sh -d stage… auth401   # same
+#
+# Env: see secrets.env.example (AUTH401_*).
+#
+# NOTE: we intentionally do NOT use `set -e`. A single failed curl/grep under
+# set -e would abort with no ERROR summary — the opposite of what monitoring
+# needs. Optional CONTINUE_ON_ERROR still controls hard prereq early-exit.
+set -uo pipefail
+ROOT=$(cd "$(dirname "$0")" && pwd)
+# shellcheck source=lib.sh
+source "$ROOT/lib.sh"
+load_monitoring_secrets_env 2>/dev/null || true
+
+tmp=$(mktemp -d)
+AUTH401_FINISHED=0
+_auth401_finish() {
+  [ "${AUTH401_FINISHED}" = "1" ] && return 0
+  AUTH401_FINISHED=1
+  # summary() returns non-zero when FAIL_N>0 — never let that skip the print
+  summary || true
+  rm -rf "${tmp:-}"
+  if [ "${FAIL_N:-0}" -gt 0 ]; then
+    exit 1
+  fi
+  exit 0
+}
+trap '_auth401_finish' EXIT
+
+# ---------------------------------------------------------------------------
+# Parameters
+# ---------------------------------------------------------------------------
+: "${AUTH401_TIMEOUT:=${TIMEOUT:-20}}"
+: "${AUTH401_CREATE:=1}"
+: "${AUTH401_INSTANCE:=}"
+: "${AUTH401_PASSWORD:=${MERCHANT_INSTANCE_PASSWORD:-${AUTH401_PASS:-}}}"
+: "${AUTH401_ID_PREFIX:=mon401}"
+: "${AUTH401_SKIP_IF_MFA:=1}"
+: "${AUTH401_BEARER:=${E2E_MERCHANT_TOKEN:-${MERCHANT_TOKEN:-}}}"
+: "${AUTH401_CREATE_PASSWORD:=${AUTH401_PASSWORD:-Mon401-Test-Pass!}}"
+: "${AUTH401_DURABLE_ID:=mon401}"
+# Prefer durable alone (skip throwaway) — default 0 so full matrix always runs
+: "${AUTH401_PREFER_DURABLE:=0}"
+# Run expanded groups (signup/login/pwchange/admin/webui). Default 1.
+: "${AUTH401_FULL:=1}"
+# Admin bearer for POST /management/instances (optional)
+: "${AUTH401_ADMIN_TOKEN:=${MERCHANT_ADMIN_TOKEN:-}}"
+: "${AUTH401_ADMIN_PASSWORD:=}"
+: "${AUTH401_ADMIN_USER:=admin}"
+# 1 = do not abort on hard prereq fail; run remaining groups (default 0)
+# Alias: CONTINUE_ON_ERROR=1
+: "${AUTH401_CONTINUE:=${CONTINUE_ON_ERROR:-0}}"
+# Never rotate password on durable account (default 1 — keep mon401.password valid)
+: "${AUTH401_PWCHANGE_THROWAY_ONLY:=1}"
+
+TIMEOUT="$AUTH401_TIMEOUT"
+export TIMEOUT
+
+_auth401_abort_or_continue() {
+  local why="${1:-prereq failed}"
+  if [ "${AUTH401_CONTINUE}" = "1" ]; then
+    warn "continue" "${why} (AUTH401_CONTINUE=1 / CONTINUE_ON_ERROR=1)"
+    return 0
+  fi
+  # hard stop — EXIT trap prints summary + all ERRORS collected so far
+  exit 1
+}
+
+BASE="${MERCHANT_PUBLIC%/}"
+if [ -z "$BASE" ]; then
+  echo "MERCHANT_PUBLIC empty — set -d domain or --merchant" >&2
+  exit 2
+fi
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+expect_http() {
+  local label="$1" want="$2" got="$3" detail="${4:-}"
+  case ",$want," in
+    *",$got,"*) ok "$label" "HTTP $got${detail:+ · $detail}" ;;
+    *) fail "$label" "HTTP $got (want $want)${detail:+ · $detail}" ;;
+  esac
+}
+
+to_lower() { printf '%s' "$1" | tr '[:upper:]' '[:lower:]'; }
+to_upper() { printf '%s' "$1" | tr '[:lower:]' '[:upper:]'; }
+
+# First char upper, rest lower → synthetic MIX for Basic user (always ≠ low if len>0)
+synth_mix() {
+  python3 -c "s='''$1'''; print((s[:1].upper()+s[1:].lower()) if s else s)"
+}
+
+# First 3 upper (partial mix)
+synth_partmix() {
+  python3 -c "s='''$1'''; print(s[:3].upper()+s[3:] if len(s)>=3 else s.upper())"
+}
+
+# Normalize curl status: "200", "000", never "200000" / "000000"
+_http_norm() {
+  local raw="$1" dig
+  dig=$(printf '%s' "$raw" | tr -cd '0-9')
+  if [ -z "$dig" ]; then
+    printf '000'
+  else
+    # first 3 digits = real code (curl 200 then || echo 000 → 200000)
+    printf '%s' "$dig" | head -c 3
+  fi
+}
+
+token_http() {
+  local path_id="$1" user="$2" password="$3"
+  local b64 raw
+  b64=$(printf '%s' "${user}:${password}" | base64 -w0 2>/dev/null \
+    || printf '%s' "${user}:${password}" | base64)
+  raw=$(curl -skS --max-redirs 0 -m "${TIMEOUT}" \
+    -o "$tmp/last_token.json" -w '%{http_code}' \
+    -X POST "${BASE}/instances/${path_id}/private/token" \
+    -H "Authorization: Basic ${b64}" \
+    -H 'Content-Type: application/json' \
+    -d '{"scope":"write","duration":{"d_us":3600000000},"refreshable":true}' \
+    2>/dev/null || true)
+  _http_norm "${raw:-}"
+}
+
+json_code_hint() {
+  python3 - "$tmp/last_token.json" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    d = json.load(open(sys.argv[1]))
+except Exception:
+    print("")
+    raise SystemExit
+c = d.get("code", "")
+h = (d.get("hint") or d.get("detail") or "")[:70]
+print(f"code={c} {h}".strip())
+PY
+}
+
+extract_token() {
+  python3 - "$tmp/last_token.json" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    d = json.load(open(sys.argv[1]))
+except Exception:
+    print("")
+    raise SystemExit(0)
+print(d.get("access_token") or d.get("token") or "")
+PY
+}
+
+instance_body() {
+  local id="$1" pass="$2" name="${3:-auth401 probe}"
+  python3 - "$id" "$pass" "$name" <<'PY'
+import json, sys
+print(json.dumps({
+  "address": {},
+  "auth": {"method": "token", "password": sys.argv[2]},
+  "default_pay_delay": {"d_us": 60000000},
+  "default_wire_transfer_delay": {"d_us": 30000000},
+  "default_refund_delay": {"d_us": 30000000},
+  "id": sys.argv[1],
+  "jurisdiction": {},
+  "name": sys.argv[3],
+  "use_stefan": True,
+}))
+PY
+}
+
+auth_change_http() {
+  local path_id="$1" bearer="$2" new_pass="$3"
+  local tok="$bearer" body
+  case "$tok" in secret-token:*) ;; *) tok="secret-token:${tok}" ;; esac
+  body=$(NEW_PASS="$new_pass" python3 -c 'import json,os; print(json.dumps({"method":"token","password":os.environ["NEW_PASS"]}))')
+  curl -skS --max-redirs 0 -m "${TIMEOUT}" \
+    -o "$tmp/auth_change.json" -w '%{http_code}' \
+    -X POST "${BASE}/instances/${path_id}/private/auth" \
+    -H "Authorization: Bearer ${tok}" \
+    -H 'Content-Type: application/json' \
+    -d "$body" \
+    2>/dev/null || echo 000
+}
+
+# ---------------------------------------------------------------------------
+# Stage secrets (quiet)
+# ---------------------------------------------------------------------------
+_auth401_stage_secret_roots() {
+  printf '%s\n' \
+    "${FRANCPAYSAN_SECRETS:-}" \
+    "${HOME}/francpaysan-secrets" \
+    "${HOME}/src/francpaysan-secrets" \
+    "${HOME}/taler/src/francpaysan-secrets"
+}
+
+_auth401_resolve_secrets_quiet() {
+  local root inst_id pass
+  for root in $(_auth401_stage_secret_roots); do
+    [ -n "$root" ] && [ -d "$root" ] || continue
+    # durable ids: prefer mon401fix when mon401 was rotated by old tests
+    if [ -z "${DURABLE_PASS:-}" ]; then
+      for inst_id in "${AUTH401_DURABLE_ID}" mon401fix mon401 "${MERCHANT_INSTANCE:-}"; do
+        [ -n "$inst_id" ] || continue
+        pass=""
+        if [ -f "$root/stage/instances/${inst_id}.password" ]; then
+          pass=$(tr -d '\n\r' <"$root/stage/instances/${inst_id}.password")
+        fi
+        # skip empty password files
+        if [ -n "$pass" ]; then
+          # verify file is for this id (mon401.password may be stale copy of mon401fix)
+          DURABLE_PASS="$pass"
+          DURABLE_ID=$(to_lower "$inst_id")
+          AUTH401_SECRET_NOTE="durable ${inst_id} from ${root}/stage/instances/"
+          # only set AUTH401_PASSWORD if caller did not pin an instance
+          if [ -z "${AUTH401_PASSWORD}" ] && [ -z "${AUTH401_INSTANCE}" ]; then
+            AUTH401_PASSWORD="$pass"
+          fi
+          break
+        fi
+      done
+    fi
+    if [ -z "${AUTH401_BEARER}" ] && [ -f "$root/stage/default-instance-token.txt" ]; then
+      AUTH401_BEARER=$(tr -d '\n\r' <"$root/stage/default-instance-token.txt")
+      AUTH401_BEARER_NOTE="default-instance-token.txt"
+    fi
+    if [ -z "${AUTH401_ADMIN_TOKEN}" ] && [ -f "$root/stage/admin-instance-token.txt" ]; then
+      AUTH401_ADMIN_TOKEN=$(tr -d '\n\r' <"$root/stage/admin-instance-token.txt")
+      AUTH401_ADMIN_NOTE="admin-instance-token.txt"
+    fi
+    [ -n "${DURABLE_PASS:-}" ] && break
+  done
+  # also keep AUTH401_INSTANCE for durable-only mode
+  if [ "${AUTH401_PREFER_DURABLE}" = "1" ] && [ -n "${DURABLE_ID:-}" ] && [ -n "${DURABLE_PASS:-}" ]; then
+    AUTH401_INSTANCE="${AUTH401_INSTANCE:-$DURABLE_ID}"
+    AUTH401_PASSWORD="${AUTH401_PASSWORD:-$DURABLE_PASS}"
+    AUTH401_CREATE=0
+    AUTH401_MODE_NOTE="PREFER_DURABLE=1 → only durable ${AUTH401_INSTANCE}"
+  fi
+}
+
+_auth401_resolve_secrets_quiet
+: "${AUTH401_CREATE_PASSWORD:=${AUTH401_PASSWORD:-Mon401-Test-Pass!}}"
+export AUTH401_INSTANCE AUTH401_PASSWORD AUTH401_BEARER AUTH401_CREATE AUTH401_ADMIN_TOKEN
+
+# ---------------------------------------------------------------------------
+set_area auth401
+section "auth401 · merchant 401 / case matrix (WebUI APIs) · ${BASE}"
+
+if [ -n "${AUTH401_SECRET_NOTE:-}" ]; then info "stage secret" "$AUTH401_SECRET_NOTE"; fi
+if [ -n "${AUTH401_BEARER_NOTE:-}" ]; then info "stage secret" "AUTH401_BEARER from ${AUTH401_BEARER_NOTE}"; fi
+if [ -n "${AUTH401_ADMIN_NOTE:-}" ]; then info "stage secret" "AUTH401_ADMIN_TOKEN from ${AUTH401_ADMIN_NOTE}"; fi
+if [ -n "${AUTH401_MODE_NOTE:-}" ]; then info "auth401 mode" "$AUTH401_MODE_NOTE"; fi
+info "auth401 scope" "FULL=${AUTH401_FULL} CREATE=${AUTH401_CREATE} PREFER_DURABLE=${AUTH401_PREFER_DURABLE} CONTINUE=${AUTH401_CONTINUE}"
+if [ "${AUTH401_CONTINUE}" = "1" ]; then
+  info "continue mode" "CONTINUE_ON_ERROR/AUTH401_CONTINUE=1 — hard prereqs soft; always full ERROR list via EXIT trap"
+fi
+
+# ===========================================================================
+set_group config
+# ===========================================================================
+cfg_code=$(http_body "$BASE/config" "$tmp/mer-config.json")
+expect_http "merchant /config" 200 "$cfg_code" "$BASE/config"
+
+HAVE_SP=0
+MANDATORY_TAN=0
+if [ "$cfg_code" = "200" ]; then
+  eval "$(python3 - "$tmp/mer-config.json" <<'PY'
+import json, sys
+d = json.load(open(sys.argv[1]))
+sp = 1 if d.get("have_self_provisioning") else 0
+tans = d.get("mandatory_tan_channels") or []
+print(f"HAVE_SP={sp}")
+print(f"MANDATORY_TAN={1 if tans else 0}")
+print(f"TAN_CH={','.join(tans) if tans else ''}")
+print(f"API_VER={d.get('version','')}")
+PY
+)"
+  info "self-provision" "have_self_provisioning=${HAVE_SP} mandatory_tan=${MANDATORY_TAN}${TAN_CH:+ ($TAN_CH)} api=${API_VER:-?}"
+else
+  fail "merchant config required for auth401" "HTTP $cfg_code"
+  _auth401_abort_or_continue "no /config"
+fi
+
+# ===========================================================================
+set_group webui
+# SPA surface: /webui/ loads + version stamp; optional toLowerCase in bundle
+# ===========================================================================
+if [ "${AUTH401_FULL}" = "1" ]; then
+  wcode=$(http_code "$BASE/webui/")
+  case "$wcode" in
+    200|301|302) ok "webui /" "HTTP $wcode" ;;
+    *) warn "webui /" "HTTP $wcode" ;;
+  esac
+  vcode=$(http_body "$BASE/webui/version.txt" "$tmp/spa-ver.txt" 2>/dev/null || echo 000)
+  if [ "$vcode" = "200" ] && [ -s "$tmp/spa-ver.txt" ]; then
+    ok "webui version.txt" "$(tr -d '\n\r' <"$tmp/spa-ver.txt")"
+  else
+    warn "webui version.txt" "HTTP ${vcode:-000}"
+  fi
+  # Download a slice of index.js — look for lowercasing mitigation (#11340)
+  jcode=$(curl -skS -m 60 -o "$tmp/spa-index.js" -w '%{http_code}' "$BASE/webui/index.js" 2>/dev/null || echo 000)
+  jcode=$(printf '%s' "$jcode" | tr -cd '0-9' | head -c 3)
+  if [ "$jcode" = "200" ] && [ -s "$tmp/spa-index.js" ]; then
+    ok "webui index.js" "HTTP 200 · $(wc -c <"$tmp/spa-index.js" | tr -d ' ') bytes"
+    if grep -q 'toLowerCase' "$tmp/spa-index.js" 2>/dev/null; then
+      ok "webui bundle toLowerCase" "present (SPA may mitigate #11340)"
+    else
+      warn "webui bundle toLowerCase" "not found in index.js — login MIX may 401 without lowercasing"
+    fi
+  else
+    warn "webui index.js" "HTTP ${jcode:-000}"
+  fi
+fi
+
+# ===========================================================================
+set_group signup
+# WebUI self-provision: POST /instances with mixed-case id (as typed)
+# ===========================================================================
+CREATED=0
+USE_ID=""
+USE_PASS=""
+ID_MIX=""
+ID_LOW=""
+CREATE_PASS="$AUTH401_CREATE_PASSWORD"
+stamp=$(date +%H%M%S)
+# Mixed-case id like the SPA would send before lowercasing (or if it forgot)
+ID_MIX="$(printf '%s' "${AUTH401_ID_PREFIX}" | awk '{print toupper(substr($0,1,1)) substr($0,2)}')X${stamp}"
+ID_LOW=$(to_lower "$ID_MIX")
+
+if [ "${AUTH401_FULL}" = "1" ] && [ "$AUTH401_CREATE" = "1" ] && [ "$HAVE_SP" = "1" ]; then
+  if [ "$MANDATORY_TAN" = "1" ] && [ "$AUTH401_SKIP_IF_MFA" = "1" ]; then
+    warn "signup skipped" "mandatory_tan_channels set — set AUTH401_INSTANCE+PASSWORD"
+  else
+    body=$(instance_body "$ID_MIX" "$CREATE_PASS" "auth401 signup MIX")
+    ccode=$(_http_norm "$(curl -skS --max-redirs 0 -m "${TIMEOUT}" \
+      -o "$tmp/create.json" -w '%{http_code}' \
+      -X POST "${BASE}/instances" \
+      -H 'Content-Type: application/json' \
+      -d "$body" 2>/dev/null || true)")
+    case "$ccode" in
+      200|204)
+        ok "signup POST /instances id=MIX" "HTTP $ccode id=$ID_MIX (SPA self-provision)"
+        CREATED=1
+        USE_ID="$ID_MIX"
+        USE_PASS="$CREATE_PASS"
+        # Immediate login as SPA after signup: must use *lowercase* Basic user
+        code=$(token_http "$ID_LOW" "$ID_LOW" "$CREATE_PASS")
+        expect_http "signup→login SPA-sim path=low user=low → 200" 200 "$code" "$(json_code_hint)"
+        # Bug path: SPA forgot toLowerCase on login after signup with MIX id typed
+        code=$(token_http "$ID_LOW" "$ID_MIX" "$CREATE_PASS")
+        expect_http "signup→login RAW user=MIX (no lower) → 401" 401 "$code" "$(json_code_hint)"
+        ;;
+      202)
+        warn "signup needs MFA" "HTTP 202 — use AUTH401_INSTANCE"
+        ;;
+      *)
+        fail "signup POST /instances" "HTTP $ccode $(head -c 120 "$tmp/create.json" 2>/dev/null | tr '\n' ' ')"
+        ;;
+    esac
+  fi
+elif [ -n "${AUTH401_INSTANCE:-}" ] && [ -n "${AUTH401_PASSWORD:-}" ]; then
+  USE_ID=$(to_lower "$AUTH401_INSTANCE")
+  USE_PASS="$AUTH401_PASSWORD"
+  ID_LOW=$(to_lower "$USE_ID")
+  ID_MIX=$(synth_mix "$ID_LOW")
+  info "signup" "using existing AUTH401_INSTANCE=$USE_ID (no POST /instances)"
+  ok "using existing instance" "$USE_ID"
+else
+  warn "signup skipped" "CREATE=${AUTH401_CREATE} HAVE_SP=${HAVE_SP} (need instance for matrix)"
+fi
+
+# Fallback durable
+if [ -z "$USE_ID" ] && [ -n "${DURABLE_ID:-}" ] && [ -n "${DURABLE_PASS:-}" ]; then
+  USE_ID="$DURABLE_ID"
+  USE_PASS="$DURABLE_PASS"
+  ID_LOW=$(to_lower "$USE_ID")
+  ID_MIX=$(synth_mix "$ID_LOW")
+  info "fallback durable" "$USE_ID"
+  ok "using durable instance" "$USE_ID"
+fi
+
+if [ -z "$USE_ID" ]; then
+  fail "no instance under test" "need signup OK or AUTH401_INSTANCE+PASSWORD or mon401.password"
+  _auth401_abort_or_continue "no instance under test"
+  # CONTINUE: synthesize dummy ids so later groups still run (expect many 404/401)
+  ID_LOW_USE="auth401-missing-instance"
+  ID_USER_MIX=$(synth_mix "$ID_LOW_USE")
+  ID_PATH_MIX="$ID_USER_MIX"
+  ID_UPPER=$(to_upper "$ID_LOW_USE")
+  ID_PARTMIX=$(synth_partmix "$ID_LOW_USE")
+  PASS_OK="invalid"
+  PASS_BAD='auth401-wrong-password-NOT-VALID'
+  USE_ID="$ID_LOW_USE"
+  USE_PASS="$PASS_OK"
+fi
+
+ID_LOW_USE=$(to_lower "$USE_ID")
+# Always synthetic case variants (even for mon401) so MIX ≠ low
+ID_USER_MIX=$(synth_mix "$ID_LOW_USE")
+ID_PATH_MIX="$ID_USER_MIX"
+ID_UPPER=$(to_upper "$ID_LOW_USE")
+ID_PARTMIX=$(synth_partmix "$ID_LOW_USE")
+PASS_OK="$USE_PASS"
+PASS_BAD='auth401-wrong-password-NOT-VALID'
+
+info "probe ids" "low=${ID_LOW_USE} MIX_user=${ID_USER_MIX} UPPER=${ID_UPPER} created=${CREATED} pass_len=${#PASS_OK}"
+
+# ===========================================================================
+set_group login
+# WebUI login = POST …/private/token with Basic (username, password)
+# ===========================================================================
+if [ "${AUTH401_FULL}" = "1" ]; then
+  code=$(token_http "$ID_LOW_USE" "$ID_LOW_USE" "$PASS_OK")
+  expect_http "login SPA-sim user=low pwd=OK → 200" 200 "$code" "$(json_code_hint)"
+  code=$(token_http "$ID_LOW_USE" "$ID_USER_MIX" "$PASS_OK")
+  expect_http "login RAW user=MIX pwd=OK → 401 (#11340)" 401 "$code" "$(json_code_hint)"
+  code=$(token_http "$ID_LOW_USE" "$ID_UPPER" "$PASS_OK")
+  expect_http "login RAW user=UPPER pwd=OK → 401" 401 "$code" "$(json_code_hint)"
+  code=$(token_http "$ID_PATH_MIX" "$ID_LOW_USE" "$PASS_OK")
+  expect_http "login path=MIX user=low pwd=OK → 200 (path tolerant)" 200 "$code" "$(json_code_hint)"
+  code=$(token_http "$ID_UPPER" "$ID_LOW_USE" "$PASS_OK")
+  expect_http "login path=UPPER user=low pwd=OK → 200" 200 "$code" "$(json_code_hint)"
+fi
+
+# ===========================================================================
+set_group case
+# Full Basic case matrix (always hard expects — synthetic MIX)
+# ===========================================================================
+code=$(token_http "$ID_PATH_MIX" "$ID_USER_MIX" "$PASS_OK")
+expect_http "path=MIX user=MIX pwd=OK → 401 (case)" 401 "$code" "$(json_code_hint)"
+
+code=$(token_http "$ID_PATH_MIX" "$ID_LOW_USE" "$PASS_OK")
+expect_http "path=MIX user=low pwd=OK → 200" 200 "$code" "$(json_code_hint)"
+
+code=$(token_http "$ID_LOW_USE" "$ID_USER_MIX" "$PASS_OK")
+expect_http "path=low user=MIX pwd=OK → 401 (case)" 401 "$code" "$(json_code_hint)"
+
+code=$(token_http "$ID_LOW_USE" "$ID_LOW_USE" "$PASS_OK")
+expect_http "path=low user=low pwd=OK → 200" 200 "$code" "$(json_code_hint)"
+
+code=$(token_http "$ID_UPPER" "$ID_LOW_USE" "$PASS_OK")
+expect_http "path=UPPER user=low pwd=OK → 200" 200 "$code" "$(json_code_hint)"
+
+code=$(token_http "$ID_LOW_USE" "$ID_UPPER" "$PASS_OK")
+expect_http "path=low user=UPPER pwd=OK → 401 (case)" 401 "$code" "$(json_code_hint)"
+
+code=$(token_http "$ID_LOW_USE" "$ID_PARTMIX" "$PASS_OK")
+expect_http "path=low user=MiX pwd=OK → 401 (case)" 401 "$code" "$(json_code_hint)"
+
+# ===========================================================================
+set_group password
+# ===========================================================================
+code=$(token_http "$ID_LOW_USE" "$ID_LOW_USE" "$PASS_BAD")
+expect_http "pwd=BAD → 401" 401 "$code" "$(json_code_hint)"
+
+code=$(token_http "$ID_LOW_USE" "$ID_LOW_USE" "")
+expect_http "pwd=EMPTY → 401" 401 "$code" "$(json_code_hint)"
+
+code=$(token_http "$ID_PATH_MIX" "$ID_USER_MIX" "$PASS_BAD")
+expect_http "path=MIX user=MIX pwd=BAD → 401" 401 "$code" "$(json_code_hint)"
+
+# ===========================================================================
+set_group pwchange
+# WebUI password change: POST private/auth then re-login
+# Only on throwaway signup instances — never rotate durable mon401.password
+# ===========================================================================
+if [ "${AUTH401_FULL}" = "1" ]; then
+  if [ "${AUTH401_PWCHANGE_THROWAY_ONLY}" = "1" ] && [ "${CREATED:-0}" != "1" ]; then
+    info "pwchange skipped" "not a throwaway instance (CREATED=0) — refuse to rotate durable password"
+  else
+    code=$(token_http "$ID_LOW_USE" "$ID_LOW_USE" "$PASS_OK")
+    if [ "$code" != "200" ]; then
+      fail "pwchange: login for token" "HTTP $code — skip pwchange"
+    else
+      TOK=$(extract_token)
+      if [ -z "$TOK" ]; then
+        fail "pwchange: parse token" "empty access_token"
+      else
+        ok "pwchange: got bearer" "len=${#TOK}"
+        NEW_PASS="Auth401-New-${stamp}!"
+        ac=$(_http_norm "$(auth_change_http "$ID_LOW_USE" "$TOK" "$NEW_PASS")")
+        case "$ac" in
+          200|204)
+            ok "pwchange POST private/auth" "HTTP $ac (SPA password form)"
+            code=$(token_http "$ID_LOW_USE" "$ID_LOW_USE" "$PASS_OK")
+            expect_http "pwchange: old pwd → 401" 401 "$code" "$(json_code_hint)"
+            code=$(token_http "$ID_LOW_USE" "$ID_LOW_USE" "$NEW_PASS")
+            expect_http "pwchange: new pwd user=low → 200" 200 "$code" "$(json_code_hint)"
+            code=$(token_http "$ID_LOW_USE" "$ID_USER_MIX" "$NEW_PASS")
+            expect_http "pwchange: new pwd user=MIX → 401" 401 "$code" "$(json_code_hint)"
+            PASS_OK="$NEW_PASS"
+            USE_PASS="$NEW_PASS"
+            ;;
+          202)
+            warn "pwchange needs MFA" "HTTP 202"
+            ;;
+          *)
+            fail "pwchange POST private/auth" "HTTP $ac $(head -c 100 "$tmp/auth_change.json" 2>/dev/null | tr '\n' ' ')"
+            ;;
+        esac
+      fi
+    fi
+  fi
+fi
+
+# ===========================================================================
+set_group admin
+# Admin UI: POST /management/instances (needs admin bearer)
+# ===========================================================================
+if [ "${AUTH401_FULL}" = "1" ]; then
+  ADMIN_TOK="${AUTH401_ADMIN_TOKEN:-}"
+  # Optional: login as admin user with password
+  if [ -z "$ADMIN_TOK" ] && [ -n "${AUTH401_ADMIN_PASSWORD}" ]; then
+    code=$(token_http "$AUTH401_ADMIN_USER" "$AUTH401_ADMIN_USER" "$AUTH401_ADMIN_PASSWORD")
+    if [ "$code" = "200" ]; then
+      ADMIN_TOK=$(extract_token)
+      ok "admin login user=${AUTH401_ADMIN_USER}" "got token"
+    else
+      # try lower only
+      au=$(to_lower "$AUTH401_ADMIN_USER")
+      code=$(token_http "$au" "$au" "$AUTH401_ADMIN_PASSWORD")
+      if [ "$code" = "200" ]; then
+        ADMIN_TOK=$(extract_token)
+        ok "admin login user=${au}" "got token"
+      else
+        warn "admin login" "HTTP $code — set AUTH401_ADMIN_TOKEN"
+      fi
+    fi
+  fi
+
+  if [ -z "$ADMIN_TOK" ]; then
+    info "admin-create skipped" "no AUTH401_ADMIN_TOKEN / AUTH401_ADMIN_PASSWORD (stage default is not admin)"
+  else
+    case "$ADMIN_TOK" in secret-token:*) ;; *) ADMIN_TOK="secret-token:${ADMIN_TOK}" ;; esac
+    AID_MIX="Adm401X${stamp}"
+    AID_LOW=$(to_lower "$AID_MIX")
+    APASS="Adm401-Pass-${stamp}!"
+    body=$(instance_body "$AID_MIX" "$APASS" "auth401 admin-create MIX")
+    acode=$(curl -skS --max-redirs 0 -m "${TIMEOUT}" \
+      -o "$tmp/admin_create.json" -w '%{http_code}' \
+      -X POST "${BASE}/management/instances" \
+      -H "Authorization: Bearer ${ADMIN_TOK}" \
+      -H 'Content-Type: application/json' \
+      -d "$body" 2>/dev/null || echo 000)
+    case "$acode" in
+      200|204)
+        ok "admin-create POST /management/instances id=MIX" "HTTP $acode id=$AID_MIX"
+        code=$(token_http "$AID_LOW" "$AID_LOW" "$APASS")
+        expect_http "admin-create→login user=low → 200" 200 "$code" "$(json_code_hint)"
+        code=$(token_http "$AID_LOW" "$AID_MIX" "$APASS")
+        expect_http "admin-create→login user=MIX → 401" 401 "$code" "$(json_code_hint)"
+        # admin-set auth on new instance
+        code=$(token_http "$AID_LOW" "$AID_LOW" "$APASS")
+        if [ "$code" = "200" ]; then
+          AT=$(extract_token)
+          NEW_A="Adm401-New-${stamp}!"
+          ch=$(auth_change_http "$AID_LOW" "$AT" "$NEW_A")
+          case "$ch" in
+            200|204)
+              ok "admin-created instance pwchange" "HTTP $ch"
+              code=$(token_http "$AID_LOW" "$AID_LOW" "$NEW_A")
+              expect_http "admin-created re-login new pwd → 200" 200 "$code" "$(json_code_hint)"
+              ;;
+            *) warn "admin-created pwchange" "HTTP $ch" ;;
+          esac
+        fi
+        ;;
+      401|403)
+        warn "admin-create unauthorized" "HTTP $acode — token not admin (expected on stage default)"
+        ;;
+      202)
+        warn "admin-create MFA" "HTTP 202"
+        ;;
+      *)
+        fail "admin-create" "HTTP $acode $(head -c 120 "$tmp/admin_create.json" 2>/dev/null | tr '\n' ' ')"
+        ;;
+    esac
+  fi
+fi
+
+# ===========================================================================
+set_group missing
+# ===========================================================================
+code=$(curl -skS --max-redirs 0 -m "${TIMEOUT}" \
+  -o "$tmp/last_token.json" -w '%{http_code}' \
+  -X POST "${BASE}/instances/${ID_LOW_USE}/private/token" \
+  -H 'Content-Type: application/json' \
+  -d '{"scope":"write","duration":{"d_us":3600000000},"refreshable":true}' \
+  2>/dev/null || echo 000)
+expect_http "private/token NO_AUTH → 401" 401 "$code" "$(json_code_hint)"
+
+code=$(token_http "$ID_LOW_USE" "auth401-not-a-real-user" "$PASS_OK")
+expect_http "user=OTHER pwd=OK → 401" 401 "$code" "$(json_code_hint)"
+
+code=$(token_http "auth401-does-not-exist-${stamp}" "$ID_LOW_USE" "$PASS_OK")
+# Must not look like auth failure (401). Prefer 404; 502 from proxy is soft.
+case "$code" in
+  404) ok "path=missing → 404 (not 401)" "HTTP 404 · $(json_code_hint)" ;;
+  401) fail "path=missing must not be 401" "HTTP 401 · $(json_code_hint)" ;;
+  502|503) warn "path=missing" "HTTP $code (want 404; proxy flake, not auth)" ;;
+  *) fail "path=missing → 404 (not 401)" "HTTP $code (want 404) · $(json_code_hint)" ;;
+esac
+
+# ===========================================================================
+set_group bearer
+# ===========================================================================
+code=$(token_http "$ID_LOW_USE" "$ID_LOW_USE" "$PASS_OK")
+if [ "$code" = "200" ]; then
+  TOKEN=$(extract_token)
+  if [ -n "$TOKEN" ]; then
+    ok "got access_token" "len=${#TOKEN}"
+    code=$(curl -skS --max-redirs 0 -m "${TIMEOUT}" \
+      -o "$tmp/priv.json" -w '%{http_code}' \
+      "${BASE}/instances/${ID_LOW_USE}/private/" \
+      -H "Authorization: Bearer ${TOKEN}" 2>/dev/null || echo 000)
+    expect_http "GET private/ Bearer OK → 200" 200 "$code"
+
+    code=$(curl -skS --max-redirs 0 -m "${TIMEOUT}" \
+      -o "$tmp/priv.json" -w '%{http_code}' \
+      "${BASE}/instances/${ID_LOW_USE}/private/" \
+      -H "Authorization: Bearer secret-token:AUTH401INVALID000" 2>/dev/null || echo 000)
+    expect_http "GET private/ Bearer BAD → 401" 401 "$code"
+
+    code=$(curl -skS --max-redirs 0 -m "${TIMEOUT}" \
+      -o "$tmp/priv.json" -w '%{http_code}' \
+      "${BASE}/instances/${ID_LOW_USE}/private/" 2>/dev/null || echo 000)
+    expect_http "GET private/ NO_AUTH → 401" 401 "$code"
+  else
+    fail "parse access_token" "HTTP $code but no token field"
+  fi
+else
+  fail "token for bearer tests" "HTTP $code"
+fi
+
+code=$(curl -skS --max-redirs 0 -m "${TIMEOUT}" \
+  -o "$tmp/mgmt.json" -w '%{http_code}' \
+  "${BASE}/management/instances" 2>/dev/null || echo 000)
+expect_http "GET /management/instances NO_AUTH → 401" 401 "$code"
+
+if [ -n "${AUTH401_BEARER:-}" ]; then
+  if [ -z "${AUTH401_BEARER_INSTANCE:-}" ]; then
+    case "${AUTH401_BEARER_NOTE:-}" in
+      *default-instance-token*) AUTH401_BEARER_INSTANCE=default ;;
+      *) AUTH401_BEARER_INSTANCE="${DURABLE_ID:-default}" ;;
+    esac
+  fi
+  inst=$(to_lower "$AUTH401_BEARER_INSTANCE")
+  tok="$AUTH401_BEARER"
+  case "$tok" in secret-token:*) ;; *) tok="secret-token:${tok}" ;; esac
+  code=$(curl -skS --max-redirs 0 -m "${TIMEOUT}" \
+    -o "$tmp/priv2.json" -w '%{http_code}' \
+    "${BASE}/instances/${inst}/private/" \
+    -H "Authorization: Bearer ${tok}" 2>/dev/null || echo 000)
+  case "$code" in
+    200) ok "GET private/ secrets Bearer" "HTTP 200 instance=$inst" ;;
+    401) warn "secrets Bearer rejected" "HTTP 401 on $inst" ;;
+    *) warn "secrets Bearer" "HTTP $code on $inst" ;;
+  esac
+fi
+
+# ===========================================================================
+set_group durable
+# Extra: durable mon401 still works after throwaway tests (if present)
+# ===========================================================================
+if [ -n "${DURABLE_ID:-}" ] && [ -n "${DURABLE_PASS:-}" ]; then
+  dlow=$(to_lower "$DURABLE_ID")
+  dmix=$(synth_mix "$dlow")
+  code=$(token_http "$dlow" "$dlow" "$DURABLE_PASS")
+  expect_http "durable ${dlow} login user=low → 200" 200 "$code" "$(json_code_hint)"
+  code=$(token_http "$dlow" "$dmix" "$DURABLE_PASS")
+  expect_http "durable ${dlow} login user=MIX → 401" 401 "$code" "$(json_code_hint)"
+else
+  info "durable" "no mon401.password — skipped"
+fi
+
+# ===========================================================================
+set_group report
+# ===========================================================================
+info "summary matrix" "401: Basic user case≠low | bad/empty pwd | no auth | bad bearer | wrong user · 200: user=low + path any case · 404: missing instance · SPA must toLowerCase username on login/signup/admin/pw-relogin"
+if [ "$CREATED" = "1" ]; then
+  info "throwaway left" "id=${ID_MIX:-?} low=${ID_LOW_USE} (password rotated if pwchange ran)"
+fi
+
+# fall through → EXIT trap runs _auth401_finish (summary + full ERROR list)
+: