The first run on starshipos-f18.org created the dashboards, then XWiki refused the group and rights objects: a form-encoded POST needs XWiki's form token (CSRF), an XML one does not. For about two minutes Admin.WebHome and Contributors.WebHome were readable by guests (links and the names of secrets, no values). Objects now go as XML, and the spaces' rights are made before the pages, so a failed run cannot leave a dashboard open. Installed: Main 200, Admin and Contributors 401 as a guest, 200 as rajames; a second run changes nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2