{# Session-bound CSRF token (FR-10.6): control.js reads it here and attaches it
as X-CSRF-Token on cookie-authenticated POSTs. Empty for read-only pages /
header-authenticated calls. #}
{% block title %}Gauntlet Console{% endblock %}
{# `data-sse` names this page's live channel; live.js (P2) opens an EventSource
to it and, on each transition, re-fetches every [data-live-src] region. After
P7 the browser authenticates by the /login HttpOnly cookie (FR-10.4), so the
handshake URL is token-free (EventSource sends the cookie same-origin). A page
with no [data-live-src] region simply ignores the stream. #}
Gauntlet Console
{% block body %}{% endblock %}