Authenticate accepts an imported §6.3 credential once and upgrades the account to argon2, dropping the imported secret; a wrong guess never consumes it. quarry users pull without --url now reads the store's own table (zit#124/#125) — no credential needed for a repo we already serve. Proven end to end against a real fossil: a user who existed only there signed into quarry with their original password. check-in: 41b085ae25 user: dmestas tags: trunk