Why: phase 4 runs after the RDM phase already forced the password change, so the initial-password attempt 401s and the sidebar never renders. Evidence: phase-4 failure log shows the login form still up at the 15s .tsb-tool timeout; rdm-audit spec already carries this branch. Impact: plain-base login helper mirrors rdm-audit's gate-aware login. Refs: 2026-10-12 diagnostic report, increment 2.