Same-user token refresh can strand empty first-load store surfaces

[Chris0Jeky]

Summary

A same-user token refresh can occur while an unchanged route's initial store read is still pending. Several ownership corrections correctly invalidate the old-token request and preserve already settled cache data, but an empty first-load surface has nothing to preserve. If the view only fetches on mount or route/filter changes, the old result is ignored and no new-token read is issued, leaving a false empty or blank route.

This residual was confirmed by Codex review on PR #3338 at corrected head c48346128982366c0abdf4f1f766246f5cc351dc. AgentsView, AgentRunsView, and AgentRunDetailView do not refetch merely because session.token changes. The current regression seeds existing data before rotation, so it proves cache preservation but not unresolved initial load recovery.

Potentially affected active ownership work

• fix(agents): bind reads to route and session lifetimes #3338 / Agent reads can repopulate cleared or replacement-session state #3337: agent profiles, runs, and run detail
• fix(metrics): bind reads to lane and credential lifetimes #3347 / Metrics and forecast reads lack request and credential ownership #3346: metrics and forecast
• fix(audit): bind history to query and credential lifetimes #3345 / Activity history reads lack latest-query and credential ownership #3344: Activity history
• fix(notifications): bind reads to confirmed writes and credentials #3340 / Notification reads can overwrite confirmed or replacement-session state #3339: notification inbox and preferences
• fix(permissions): keep board-access reads behind confirmed writes #3330 / Stale board-access reads can undo confirmed permission mutations #3328: board access
• fix(integrations): invalidate mutations on session replacement #3332 / Integration mutations and cached connector state outlive session replacement #3331: integration list and detail
• fix(queue): bind cache operations to request and credential lifetimes #3349 / Queue cache reads and mutations lack operation and credential ownership #3348: queue request list and stats

Feature-flag persistence PR #3351 is not part of this request lifecycle pattern.

Required contract

For a token-only rotation where user identity/auth/demo state is unchanged:

1. Already settled data remains visible.
2. An active latest read for an unresolved/empty surface is either preserved as authoritative for the same user or restarted under the new token.
3. If restarted, the old request still settles to its original caller but cannot patch state, error, toast, or loading.
4. Retry ownership belongs to the new token/lifecycle; its success and failure behave like an ordinary current request.
5. Route-clear helpers and full identity/auth/demo replacement must invalidate work without restarting it.
6. A newer route/filter read must still supersede both the original and any refresh retry.
7. No refresh loop, duplicate settled-cache refetch, or unhandled retry rejection.

Acceptance

• Deferred real-Pinia regressions for an empty initial surface with a read in flight when the token rotates.
• The API is called again only where restart is required; loading remains truthful until the new-token owner settles.
• Old-token success and failure are suppressed after restart.
• New-token success populates the unchanged route; new-token failure produces current error/toast state.
• Existing loaded-data preservation, reverse-settlement, route-clear, mutation-generation, logout/login, demo, and independent-lane tests remain green.
• Each affected PR keeps its own test and exact-head qualification so stacked ownership remains reviewable.

Boundaries

This is client read-lifecycle recovery. It does not require transport cancellation, automatic mutation replay, token revocation, or cross-tab synchronization. Mutations already sent before refresh must not be silently retried by this issue.

Audit provenance

Seeded from the repeat Codex review on #3338 after the 2026-09-21 asynchronous ownership pass distinguished full identity replacement from same-user credential rotation.

[Chris0Jeky]

Test-first coverage is now published on every affected ownership branch:

• agents fix(agents): bind reads to route and session lifetimes #3338: 11ab874 retries empty profiles/runs/detail;
• metrics fix(metrics): bind reads to lane and credential lifetimes #3347: b742556 retries empty metrics/forecast;
• Activity fix(audit): bind history to query and credential lifetimes #3345: 85cf369 retries empty history;
• notifications fix(notifications): bind reads to confirmed writes and credentials #3340: 660362c retries empty inbox/preferences;
• permissions fix(permissions): keep board-access reads behind confirmed writes #3330: d28697e retries unresolved board access;
• integrations fix(integrations): invalidate mutations on session replacement #3332: 03f4677 retries empty list/detail;
• queue fix(queue): bind cache operations to request and credential lifetimes #3349: 9d67a15 retries empty request-list/stats while preserving the active status query.

Each remains test-only until its canonical Node 24 suite reaches the intended RED. Mutations are not replayed. Feature flags are tracked separately under #3350/#3351.

[Chris0Jeky]

Production corrections and supplemental actual-module red/green are now published:

• agents fix(agents): bind reads to route and session lifetimes #3338: source c6a88e7, documented final head a2c9b57;
• metrics fix(metrics): bind reads to lane and credential lifetimes #3347: source 8566adb, documented final head e57375e;
• Activity fix(audit): bind history to query and credential lifetimes #3345: source 110edf3, documented final head 99bd34e;
• notifications fix(notifications): bind reads to confirmed writes and credentials #3340: source 2192edf, documented final head 4f8134d;
• permissions fix(permissions): keep board-access reads behind confirmed writes #3330: source 3c7746e, documented final head 72d71c8;
• integrations fix(integrations): invalidate mutations on session replacement #3332: source 0dbf40b, documented final head 636953f;
• queue fix(queue): bind cache operations to request and credential lifetimes #3349: final source head 89da656.

Each actual production module now retries only active read lanes whose surface is unresolved/empty, preserves settled cache data, captures exact query/route arguments, suppresses old-token settlement, and never replays mutations. Bounded runners pass; all PRs remain draft until their exact final heads pass hosted Self-Test, Extended, Required CI, and review.

[Chris0Jeky]

End-of-session handoff snapshot

All work from this pass is committed and pushed to GitHub. No unpushed local patch or unpublished branch is being relied upon.

Independently reviewable / already fully qualified heads

• fix(auth): reject unusable JWT payloads before session admission #3325 JWT admission hardening: a37539a42427e1b1fa8d0e63205b00a23fc6434b
• fix(devtools): isolate replay execution lifetimes #3326 replay lifecycle hardening: b51fd55fbcc477b15503f428f3cbab64a93b4414
• fix(integrations): bind connector reads to request lifetimes #3329 integration read ownership parent: 4e232e22778489681b9db5746e5c221ada7a088a

Saved draft implementation heads

• fix(permissions): keep board-access reads behind confirmed writes #3330 permissions ownership and token-refresh recovery: 72d71c8500f534c10e8bb70c025922f9381f0103
• fix(integrations): invalidate mutations on session replacement #3332 integration lifecycle and first-load recovery: 636953f3592e972743df8d1ec3577b76e63545a9
• fix(agents): bind reads to route and session lifetimes #3338 agent read/session ownership: a2c9b57f46c72e1d22512f33563d77dfd4eb4dcf
• fix(notifications): bind reads to confirmed writes and credentials #3340 notification read/write ownership: 4f8134d6c6ecd840041c0127371798e0c412f06a
• fix(audit): bind history to query and credential lifetimes #3345 Activity history ownership: 99bd34e749e995104032e9b4a5c54df875845d46
• fix(metrics): bind reads to lane and credential lifetimes #3347 metrics/forecast ownership: e57375ebcc7a1528e6f01018ec30a4e9a992b729
• fix(queue): bind cache operations to request and credential lifetimes #3349 queue operation ownership: 89da656b592e4e2c1c8f6065c36e55647b8ae168
• fix(flags): validate persisted route-gate values #3351 feature-flag persistence hardening: faac2a9ab22470b136197f8b3259a3e6f73e0fd4

Each draft body records its red-first evidence, exact current head, remaining CI/review gates, and scope boundaries. They should remain draft until their own final-head qualification completes.

Preserved stacked children

• fix(permissions): serialize same-entry mutations #3335 permission mutation ordering: 664cdceb9e4392abb9c0989ae42d54a69fea0844
• fix(integrations): serialize same-connector mutations #3336 integration mutation ordering: 26973971495bf19d55328a2daaf7b46499e507e6
• fix(notifications): serialize preference saves by intent #3343 notification preference ordering: 9e6b675805e6b100952743d900b1458ae7888746

These children are intentionally saved as drafts. Their parents advanced after the child heads, so they require parent reconciliation/restacking and fresh exact-head qualification before review.

main remained 307c3b8b50bec1cb0bfaea3e570a942bcb1d4451 throughout this pass. Nothing was merged, released, or marked complete without the stated evidence.