phase: 85_mobile_menu_gate_overlap

All verification complete. Final report:

**Phase 85 final verification pass — all green** (tasks 01–03 already complete; independently re-verified from scratch)
- Verified fix in tree: `styles.css` `.auth-gate` z-index 500→15 + rewritten stacking comment (no `z-index: 500` left); `index.html`/`document.html` comment-only; `token-gate.js` docstring-only (logic byte-identical); `test_mobile_hamburger_nav.py` real-click conversion + new `test_anonymous_toggle_tappable_with_gate_up`; new `tests/unit/test_gate_header_stacking.py` (3 pins); `test_api_tokens.py` untouched
- `uv run pytest` → 1717 passed, 1 warning (exit 0)
- `uv run pytest --cov=app --cov-report=term-missing` → TOTAL **99%** (>90%)
- E2E in isolation: `test_mobile_hamburger_nav.py` **8 passed**; `test_api_tokens.py` **9 passed** (unchanged); `test_smoke.py` **3 passed**; `test_document_viewer.py` **7 passed**
- `uv run ruff check . && uv run pyright` → clean / 0 errors
- Live probe (375×812, anonymous, fresh server): on `/` and `/history.html` `elementFromPoint` at toggle → SVG `path`, never `#auth-gate`; real click opens menu (`aria-expanded=true`); exactly one visible nav link (Chat) + sign-in copy; Chat link topmost over gate; `#main` inert — criteria 1, 2, 3 confirmed directly
- Criteria: (1) real-click menu on / + /history ✅ (2) dropdown above gate ✅ (3) anonymous contents + #main inert ✅ (4) admin byte-identical (phase-46 tests green) ✅ (5) doc-viewer gate under bar (CSS pin + doc-viewer suite) ✅ (6) full gate green ✅ (7) diff scoped to the 5 code files + new unit test + phase files, nothing in `app/` ✅ (8) commit + todo→complete move left to harness per executor rules (task files already in `complete/`)
- Note: `.agents/remediation_plan.md` (untracked) is a pre-existing artifact of the earlier security audit — left untouched; a missing "N passed" line seen mid-pass was my own `-q`+addopts `-q` = `-qq` quirk, not a defect
- Next pending phase: `86_history_page_width`

frontend/index.html

@@ -896,9 +896,13 @@
 
   <!-- Phase 79 (task 05): the in-app token gate — a body-level
        position:fixed; inset:0 overlay (the body-level doc-modal
-       precedent) that is the ONLY interactive surface while visible:
-       assets/token-gate.js locks #main (inert) so focus and keyboard
-       traversal stay in the gate (WCAG, the inert-pair contract). It
+       precedent) that is the only CONTENT-level interactive surface
+       while visible: assets/token-gate.js locks #main (inert) so
+       focus and keyboard traversal stay in the gate (WCAG, the
+       inert-pair contract). Phase 85 (TODO.md L3): the overlay sits
+       BELOW the sticky header (z-index 15 < 20) — it covers #main's
+       content region visually, but the header (hamburger + menu)
+       stays reachable for the unauthenticated visitor. It
        SHIPS hidden + inert (the phase-16 ship-hidden pattern) — an
        authenticated boot (admin, or a valid cached token re-authed
        silently at mount) never shows it for a frame. The gate is the