diff --git a/pytest.ini b/pytest.ini
index b84ad2f..9511b4a 100644
--- a/pytest.ini
+++ b/pytest.ini
@@ -15,3 +15,10 @@ addopts =
     --cov=lambdas/shared
     --cov-report=term-missing
     --cov-fail-under=80
+; The 80% floor is an aggregate whole-suite gate, enforced in CI by the
+; reusable ci-python-sam workflow's bare `pytest` run (which inherits these
+; addopts). Because the floor is inherited by every invocation, running a
+; single root or file for local iteration (e.g. `pytest tests/test_web_ui_auth.py`)
+; under-measures the fixed --cov set and red-exits even when the selected tests
+; pass. That is expected: append `--cov-fail-under=0` (or `-p no:cov`) to a
+; subset run to skip the floor while iterating. The full-suite run still gates.
diff --git a/tests/test_web_ui_auth.py b/tests/test_web_ui_auth.py
index 382cbf2..8602e96 100644
--- a/tests/test_web_ui_auth.py
+++ b/tests/test_web_ui_auth.py
@@ -105,11 +105,16 @@ def test_header_matrix(load_auth, monkeypatch, headers, expected):
     assert mod.is_authenticated(_evt(**headers)) is expected
 
 
-def test_non_ascii_token_raises_typeerror_documenting_pin(load_auth, monkeypatch):
-    """PIN (current behavior, fix deferred -- module frozen this phase): a
-    non-ASCII presented token makes hmac.compare_digest raise TypeError (surfaces
-    as a 500 today). Locked so a future fix is a deliberate, reviewed change."""
+@pytest.mark.xfail(
+    strict=True,
+    reason="web_ui_auth is frozen this phase: is_authenticated raises TypeError on "
+    "a non-ASCII presented token (hmac.compare_digest is ASCII-only) and surfaces "
+    "as a 500 instead of failing closed to False. Asserting the DESIRED behavior "
+    "under xfail(strict) documents the intended fix and auto-fails (xpass) the moment "
+    "the module is corrected, forcing the marker's removal. Tracked as a follow-up.",
+    raises=TypeError,
+)
+def test_non_ascii_token_should_fail_closed(load_auth, monkeypatch):
     mod = load_auth()
     monkeypatch.setattr(mod, "_get_auth_token", lambda: "SECRET")
-    with pytest.raises(TypeError):
-        mod.is_authenticated(_evt(**{"x-auth-token": "SÉCRET"}))
+    assert mod.is_authenticated(_evt(**{"x-auth-token": "SÉCRET"})) is False