Auth / Auth and Guard

Failures, end to end

What happens	Auth	Guard	The client sees
No cookie	a visitor (`Option.none()`)	rules decide for a visitor	guarded rows absent; `Me.signedIn` false
A cookie from another site, or without the CSRF header	401	never asked	`denied`: `Unauthenticated`
A session that ended (signed out, expired, revoked)	401, `Your session ended.`	never asked	`denied`: `Unauthenticated`
Another tab switched account	401, `SUBJECT_CHANGED` (with `believing`)	never asked	forget and read again
Signed in, reading a row a Read rule refuses	the user	the row is filtered out	the row is absent, as if it did not exist
Signed in, a write a Write rule refuses	the user	403 before the write runs	`denied`: `Forbidden`
A server Source that skips its Read rules	—	`GuardServer.validate` throws at startup	the server does not start

Using one without the other

Guard without auth. Any resolvePrincipal that returns the guard set's principal works: a bearer token, a header in a test, a service binding. The guard README's examples provide one directly, as G.Principal.
Auth without guard. AuthServer.resolver returns whatever your principal builds; your Sources may read it directly. You lose enforcement on every seam from one declaration, and Me.