The native-apps change removed SessionAuthGate from the whole mobile render path, but that path also serves the plain mobile browser: against a --ui-password server it never authenticated and dead-ended on the unreachable-server screen with no way to enter the password. The gate is back for the browser shell; the Capacitor app keeps its own instance-connect flow ungated.