README.md

@@ -1,6 +1,6 @@
 # Nextcraft
 
-AI-native outcome school + marketplace — graduates prove what they can build, not what they can write.
+**TL;DR** — AI-native outcome school + marketplace — graduates prove what they can build, not what they can write. This file is the front door: three install channels, dev setup from a clone, and the CLI reference; the admin runbook for standing the stack up on a server lives in [deploy/README.md](deploy/README.md).
 
 ## Quickstart
 

apps/ai-service/tests/employers/test_auth.py

@@ -120,7 +120,9 @@ class TestSessionGate:
         T+8d → the session reads as absent → 401 (no sleeps)."""
         from .conftest import make_client
 
-        login_at = datetime(2026, 9, 30, 12, 0, 0, tzinfo=UTC)
+        # Wall-clock-relative mint: the 200 arm below must hold on ANY
+        # run date (the fixed 2026-09-30 mint turned red at 2026-10-07+).
+        login_at = datetime.now(UTC) - timedelta(days=1)
         employer_store.insert_account(
             email=TEST_EMAIL, password_hash="scrypt$16384$8$1$c2FsdA$aGFzaA"
         )
@@ -140,7 +142,7 @@ class TestSessionGate:
             )
             assert row is None  # expired — reads as absent
             resp = c.get("/v1/employers/auth/me", headers=bearer("expired-token"))
-            # Wall clock (2026-09-30) is INSIDE the 7-day TTL → 200.
+            # Wall clock (1d after mint) is INSIDE the 7-day TTL → 200.
             assert resp.status_code == 200
         # The lazy-TTL route 401 pin: a session whose expires_at is in
         # the WALL-CLOCK past reads as absent at the route.

deploy/README.md

@@ -1,5 +1,7 @@
 # Deploying Nextcraft — the admin runbook (v0.8)
 
+**TL;DR** — AI-native outcome school + marketplace — graduates prove what they can build, not what they can write. This file explains how to stand the stack up on any Debian-based server: pick one of three install channels, run `nextcraft deploy --service`, and verify with the checklist; troubleshooting tables and evidence sit lower in the file.
+
 Production topology since v0.3.6: **one port, one process**. The ai-service
 (uvicorn, `:8420`) serves **both** the API and the exported web UI, so the
 site works behind any proxy that can reach exactly one backend port — e.g.