The plug's :live half (spec-0025 §4): inert for visitors, on only for an editor who arrived with a launch link.

Per request, after Plug.Session:

1. Start. A GET with ?dialecto_edit=<token> is verified (DialectoInContext.LaunchToken: signature, start_by, origin). A good token becomes the dialecto_edit cookie (HttpOnly; Secure; SameSite=Lax; Path=/, Max-Age to exp) and a copy in the session, so LiveView can see it. Either way the answer is 303 to the request's own path and query without the parameter.
2. Each request. A valid cookie marks the response: a document GET or HEAD gets the codec's markers, the overlay loader, Cache-Control: private, no-store, Vary: Cookie, X-Robots-Tag: noindex and, when the app sends a CSP, frame-src widened to Dialecto. An invalid cookie is cleared along with the session copy; a missing one changes nothing.
3. Stop. POST /__dialecto/stop clears both.

A visitor's request is passed on untouched. /__dialecto/context, /overrides and /marking do not exist here: they answer 404.