diff --git a/AGENTS.md b/AGENTS.md
index db45596..2824cf7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -368,6 +368,15 @@ planned phone app lives at `/repairs-app`, not built yet.
   delivery note. Repairs do not flow through the customer-DN pipeline.
 - `createCustomerQuoteFromRepair` refuses to overwrite an existing
   `customer_quote` link unless `replace: true` is passed.
+- **The browser token is NOT on the auth context.** `useAuth()` exposes
+  `user`, `loading` and the auth actions, and **no `token` field** —
+  `useAuth().token` is `undefined`, so a fetch built from it sends NO
+  session and every route answers 401 silently. The token lives in the
+  PocketBase client auth store: `getPocketBase().authStore.token` (see
+  `delivery-pool/page.tsx` and `search/page.tsx`). Any route that
+  calls `assertBrowserSession(req)` needs it in the `Authorization`
+  header — the `x-wfdash-auth` header the global fetch wrapper adds is
+  audit attribution only, and no route treats it as auth.
 - **MERGE GATE — four PocketBase fields must exist before this code
   runs:** `repairs.supplier_scope`, `repairs.signed_request`,
   `orders.repair`, `giellie_chats.mode`. **PB drops unknown fields