Credential-page sign-in continuation

Status: bounded draft, independent highest-model review pending; base651e5b3. No deployment approval.

Authority: Home design §4 credential-origin separation, §5.1 sign-in, §5.2 optional second factor/recovery and existing freshness-protected routes. No auth protocol, factor or freshness rule changes.

RequireFresh already redirects stale enrol/codes GETs to /signin?return_to=... . The form discards that navigation intent and completeSignIn always redirects /. Carry only the exact compiled destinations /passkey/enrol and /passkey/codes in a host-only Secure HttpOnly SameSite=Lax cookie, Path=/, browser MaxAge ten minutes. This bounds ordinary browser navigation retention, not a server-validated authentication lifetime. Replaying an allowed navigation target grants no authority; existing session and freshness validation remain authoritative. No address, identity, authority or content is stored. A hostile allowed target grants nothing: its existing RequireFresh still applies. No custom signing/encryption/session protocol.

GET /signin accepts one query returnto only when it matches the allowlist. Plain sign-in clears previous intent; the existing force=1 Keymail fallback preserves a validated existing intent. Invalid/duplicate query input clears it. POST body/query returnto never supplies intent. Verified magic-link or Keymail completion validates the cookie again and clears it. Missing/cross-browser cookie returns /. Failed first-factor completion never mints a session; ordinary Keymail failure preserves navigation through its force fallback.

Pass the validated target through a cloned request to existing passkey.Gate, replacing both Form and PostForm for its SafeReturn read. Do not let posted or query fields override it. Existing Gate stores that navigation target in its normal pending row; its real assertion/recovery completion consumes it. Without a factor, only the existing completeSignIn session mint redirects to the target. No additional mint, freshness update or gate bypass.

Regressions: stale enrol/codes → form → magic link or Keymail → exact destination; failed Keymail → forced magic link; missing/invalid/duplicate intent returns /; external/protocol-relative/encoded/CRLF targets refused; body/query smuggling cannot change pending target; enrolled users remain pending without full session until real passkey or recovery; failed factor cannot navigate with authorization; intent cookie alone never opens credential pages. Check short-lived host-only cookie attributes and clearing. Preserve sealed-at-rest/no-address gates. Local checks and exact-head CI precede queued independent review, then parent-controlled canary.