README: the scripted account setup misses the first-sign-in password change, and the page has no screenshot of what the demo looks like #143

Filing class: ① user-visible defect (operator docs) + ③ the maintainer asked in the regression thread 「README需要更新吗？是否建议配图」 (2026-10-26) — reach: measured following the README on main f534eef (18.1.0). Reader: the hotclm lane (README only; not a governed file).

1. Scripted setup stops at the first sign-in

README › "Assigning a position from a script" gives the position and manager calls but not how the accounts are made. Made with POST /api/v1/auth/admin/create-user (the scripted twin of Setup → Users → New), every account answers mustChangePassword: true, and its first Console sign-in lands on 「您必须修改密码」 instead of the app — so a scripted persona setup (the one the PM lesson of #118→#124 asks dev agents to use) cannot reach 我的合同 until each account calls POST /api/v1/auth/change-password {currentPassword,newPassword} signed in as itself. Add the create call and that step to the section.

2. One screenshot set

The README describes the demo in prose only. Add 3–4 screenshots from a fresh pnpm demo (English, the README's language), committed under docs/images/ and referenced from "Quick start" / "The demo dataset": the launch wizard, a contract page (path + tabs), the Legal Workbench, the approvals inbox. Keep them few: each platform upgrade re-takes them, so the upgrade checklist in the next bump should name the step.

3. "No rung sends its approver a message" is no longer true

README › "Rung 1 of the approval ladder is a manager" says 「No rung sends its approver a message when it opens — nothing in their inbox, no email」 and calls the missing message the platform's. On 18.1.0 every rung that opened in this pass wrote an approval.requested notification to its approver ("Approval requested — A decision on Contract … is waiting on you."), 4 of 4 (sys_notification, read back as the dev admin), and the approver's bell counted it. Replace the paragraph with what an approver now gets.

Dedupe: hotclm issues (all states) grepped for create-user|mustChangePassword|change-password — the step is used in the evidence of #122, #126, #130, #131, #132 and noted on #37, but no card asks for it in the README; README … screenshot|image — 0 hits (the many screenshot hits are evidence attachments on other cards). Neighbour: #28 (should pnpm demo create the accounts itself — open decision); this card only documents the manual/scripted path that exists today.

Filed from the browser regression pass on main (2026-10-26).