The Hub launcher used an ephemeral /tmp profile deleted on exit, which wiped the hub_manual_logout marker cookie. On reopen, /auto-login minted a new session and logged the user straight back in without a password. Use a persistent per-user profile under XDG_STATE_HOME and drop the deletion trap so the logout marker survives close/reopen. Keep --skip-origin-startup-dialog. Adds regression tests.