Why: backend U4 password gate returns 403 on business APIs until must_change clears; CLI-created load passwords are terminal. Evidence: dual smoke failed POST /api/projects 403 after login_keys pin. Impact: load suite works on schema v26+; EXIT trap disables re-entry and waits for serve. Refs: server enforcePasswordGate; CreateAccount must_change Co-authored-by: Cursor <cursoragent@cursor.com>