Steward Historical Registry
Private archive metadata requires an authenticated steward session.
Steward Boundary
Private history stays private until the steward boundary is satisfied.
The public registry never enumerates protected records. This route unlocks private catalog metadata only after server-side verification of ADMIN_EMAIL and the steward access key; raw historical conversation bodies are still not rendered here.
Steward Access
Sessions are scoped to this archive role, signed server-side, bound to the configured ADMIN_EMAIL, stored in an HttpOnly cookie, and expire after one hour.