Agent rule
Hidden /owner + DTD_OWNER_PASSWORD env. Signed HttpOnly cookie on .differentthandefault.com. When owner: skip Umami + Vercel Analytics on that device; still ping Supabase for public /traffic. Reuse requireOwner() for future gated APIs.
Status: Accepted
Context: Owner browsing pollutes private analytics dashboards. Per-browser localStorage does not work across devices or subdomains. Public traffic signal should stay inflated for building-in-public.
Decision: One login per device at /owner; cookie shared across apex, www, and work. subdomains. First-party traffic counts always; private analytics layers respect owner session.
Consequences: Set DTD_OWNER_PASSWORD in Vercel before deploy. Umami dashboard can filter owner traffic via absence when signed in; no schema change to page_events.