[ragnorc]

Follows #40, now merged; this is rebased onto main.

Keep the probe's 401 as its judgement

The connection kept the probe's 401 as a flag (refused_with_token) and worked out "token not received" from that flag plus whether a token was held at the time it was asked. A token kept or dropped since then could change the answer; #37's kept ended token already needed a patch for this. The connection now keeps the probe's Unauthorized judgement (Connection::refusal), judged the same way as every request's, and the Open dialog's line reads it in one arm. Challenge::refuses was left with one caller, so it folds into Unauthorized::judge.

A refusal of an ended token asks for its renewal

This was the last item #40 left. Suppose the token ends while its source can't answer, and the server comes back before the source does (after a wake, say). A request refused for that ended token asked the source as if the server had refused the account. Its answer was then a new credential, and every graph read everything again.

Now:

• A 401 to a token past its end asks for that token's renewal, once like any refusal, and never beside an ask already under way.
• A connection that's unauthorized with no probe 401 standing (the source gave nothing) takes the same holder's next token as a renewal.
• That renewal connects again, so the connection becomes ready.

Testing

• cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace (1,159 passed) and the repo checks pass locally.
• Weakening the "token not received" rule fails three tests. Removing any of the renewal fix's three parts fails the new connection::tests::a_refusal_of_an_ended_token_asks_for_its_renewal.

---

Note

Medium Risk
Changes OAuth connection state, 401 interpretation, and token renewal vs refusal retry paths; mistakes could mis-handle credentials or over-trigger full re-reads, though behavior is pinned by new and updated tests.

Overview
Replaces the connection’s refused_with_token boolean with refusal: Option<Unauthorized>, storing the connect/graph-list probe’s 401 outcome the same way as other requests. Challenge::refuses is removed; Unauthorized::judge is the single place that maps a Bearer challenge plus “was a token sent?” to TokenRefused, TokenNotReceived, or TokenNeeded. Status copy, token_not_received(), and the Open Graph dialog now read that enum instead of re-deriving “not received” from flags and whether a token is still held.

Behavior change: when a graph request is refused for a source-held token that is already past its end (e.g. server back before the CLI after wake), request_refused asks the source for a renewal (Ask::Renewal) rather than an account-style refusal retry. Renewals while unauthorized (including when there is no probe 401, only “source gave nothing”) can connect again so the connection returns to ready without treating the answer as a new credential that re-reads every graph.

^{Reviewed by Cursor Bugbot for commit 7916fc6. Bugbot is set up for automated code reviews on this repo. Configure here.}