Address copilot pass 3 on #4

Three findings:

1. chooseFragmentAndBuildVm bug introduced in pass 2:
   `buildEs256kVerificationMethod` returns `{ vm, jwk, kid }` but
   I read `probe.publicKeyJwk` (always undefined). sameJwk() never
   matched, so idempotent re-runs would walk to a fresh fragment
   instead of reusing the existing same-key VM at lws-key-1. Fixed
   to read `probe.jwk`.

   (My pass-2 smoke test "passed" because it inlined the logic with
   a hand-built `{ publicKeyJwk: jwk }` probe — wasn't exercising
   the actual code. Real bug.)

2. revealLwsAuthSection() unconditionally set "no oidcIssuer" error
   status when lastIssuer was missing. If a session was already
   restored from IndexedDB the user's signed-in status got
   clobbered with a pre-login warning. Now gated on `!session.isActive`.

3. README roadmap line still said "PATCHed" for the B.3 entry —
   updated to match the implementation ("written into profile via
   GET → merge → PUT with If-Match").

Author: melvincarvalho

README.md

@@ -30,7 +30,7 @@ Read-only — no auth, no mutations, no server roundtrip beyond the GETs.
 
 - ~~**B.0**~~ — Read-only LWS-CID profile validator ✅
 - ~~**B.2**~~ — Read pubkey from NIP-07 signer; emit Multikey verificationMethod snippet ✅
-- ~~**B.3**~~ — Strict LWS10-CID auth: Solid-OIDC sign-in, ES256K `JsonWebKey` VM PATCHed into profile, sign real JWTs to authenticate ✅
+- ~~**B.3**~~ — Strict LWS10-CID auth: Solid-OIDC sign-in, ES256K `JsonWebKey` VM written into profile (GET → merge → PUT with `If-Match`), sign real JWTs to authenticate ✅
 - **B.1** — Bidirectional `alsoKnownAs` ↔ DID-doc check (resolve `did:nostr:…` and verify the DID points back at this WebID)
 - **B.4** — did:key + WebAuthn passkey verification methods
 - **B.5** — More diagnostics: ACL inheritance, type-index integrity, OIDC discovery, ActivityPub actor doc, …

doctor.js

@@ -386,7 +386,11 @@ function revealLwsAuthSection() {
   lwsAuthSection.hidden = false;
   // Only enable sign-in if we have an issuer to point at.
   oidcSignInBtn.disabled = !lastIssuer;
-  if (!lastIssuer) {
+  // If a session was restored from IndexedDB the user is already
+  // authenticated — don't clobber the signed-in status with a
+  // pre-login warning. The "no issuer" message only matters before
+  // we have a session.
+  if (!lastIssuer && !session.isActive) {
     setOidcStatus('error',
       'Profile declares no oidcIssuer — cannot start a Solid-OIDC sign-in.');
   }
@@ -558,9 +562,12 @@ function chooseFragmentAndBuildVm({ privKey, profile, webId, controller }) {
             : profile.verificationMethod ? [profile.verificationMethod]
             : [];
 
-  // Pre-build the VM once so we can compare its JWK against existing
+  // Pre-build a VM once so we can compare its JWK against existing
   // entries. The fragment will be re-stamped on the chosen one below.
+  // (buildEs256kVerificationMethod returns { vm, jwk, kid } — the JWK
+  // sits on .jwk, not .publicKeyJwk.)
   const probe = buildEs256kVerificationMethod({ privKey, webId, controller, fragment: 'probe' });
+  const probeJwk = probe.jwk;
 
   for (let n = 1; n <= 99; n++) {
     const candidateId = `${docUrl}#lws-key-${n}`;
@@ -575,7 +582,7 @@ function chooseFragmentAndBuildVm({ privKey, profile, webId, controller }) {
     // public-key material (idempotent re-run).
     if (typeof existing === 'object' && existing !== null) {
       const existingJwk = existing.publicKeyJwk;
-      if (existingJwk && sameJwk(existingJwk, probe.publicKeyJwk)) {
+      if (existingJwk && sameJwk(existingJwk, probeJwk)) {
         const result = buildEs256kVerificationMethod({
           privKey, webId, controller, fragment: `lws-key-${n}`,
         });