The /stop route used browser-only authSession(), so the desktop's vibn_sk_ key got a 401. The desktop treats any 401 as session-expired and signs the user out (kicking them to the login page on Stop). Use requireWorkspacePrincipal like the sibling create/get routes.