adr-014 makes a service declared readonly a reader: it knows no one, declares no authority, mirror or channel, and may answer beyond the loopback; whoever the network lets in reads every SOW of its levels, which adr-014 justified against «a guest sees nothing of the project but the part put to them» by leaving access to the network.
The principal asked, 2026-10-08, for a main menu with the person logged in, and for SOWs marked by each person (bookmarks) to filter the list by. The faces already render for a person (adr-015's session, sow-every-face-is-a-template's served pages); signatio's person client already proves who someone is, in the browser by passkey (adr-004).
A READER MAY DECLARE AN AUTHORITY, TO KNOW WHO READS. A readonly service may declare the authorities it is a client of; it then mounts login and logout, and its pages show the person and the hats the authority answers. It still mounts no act: no round, no remark, no revision, no intent, no landing (adr-014's a-reader-mounts-no-act stands). Without an authority a reader is as adr-014 decided.
WHAT A READER WITH AN AUTHORITY SHOWS MAY FOLLOW WHO READS. It may require a session to read at all; that choice is the deployment's, declared.
A PERSON'S MARKS ON SOWS ARE THEIRS. Until a person is known the marks stay in their browser; with an authority, a mark is kept by the service under the principal the authority answers, holding the SOW's id and nothing else of the person — no table of people, no profile — and shown only to them.
WHAT THIS AMENDS: adr-014's decision — a reader may declare an authority, for identity only; its constraint a-reader-mounts-no-act is unchanged, the refusal of an authority in a reader's configuration is lifted.
A readonly service with an authority mounts login, logout and the person's marks, and no act on a round, a remark, a revision, an intent or a landing
A mark kept by the service holds the principal the authority answers and a SOW's id, and is shown only to that principal
Keep readers anonymous; marks only in the browser
Rejected: No login in the menu and marks bound to a browser, not a person — what the principal asked.
Turn a reader with an authority into a writer
Rejected: A reader is safe beyond the loopback because nothing in it acts; identity does not need acts.