Guard session establishment and restore against logout or newer identity operations

[Chris0Jeky]

Finding

At main 307c3b8b50bec1cb0bfaea3e570a942bcb1d4451, sessionStore.ts has unowned asynchronous identity settlement:

• refreshSession awaits the server and then calls setSession unconditionally.
• setSession awaits purgeLegacyApiCaches and then writes all reactive identity fields plus token/session persistence, without rechecking the initiating identity operation.
• restoreSession captures token/session storage, awaits cache purge and then restores those old values to reactive state without rechecking logout or a newer login.
• login, register and OAuth/OIDC exchange also have a pre-send cache-purge await and a post-response establishment await. Both boundaries need ownership, not just token-string comparison at the response.

Executed supplementary reproductions

A local Node 22 VM probe executed the real sessionStore.ts, tokenStorage.ts and jwt.ts using minimal Pinia/Vue stand-ins and a controlled API/cache-purge boundary. A valid-token current-refresh positive control passed. Three assertions failed against main:

1. Begin refresh, logout, resolve old refresh: the old token is persisted and the user becomes signed in again.
2. Resolve refresh but hold its cache purge, logout, finish purge: old session establishment writes after logout.
3. Begin restore from valid persisted credentials, hold cache purge, logout, finish purge: reactive state resurrects the removed identity.

This is control-flow evidence, not a full Vitest run, Vue reactivity proof, browser/server acceptance or Node-24 qualification. Preserve these schedules as real deferred-promise store tests before repairing.

Required contract

Introduce an explicit identity-operation generation/owner. Define latest-intent semantics across login, register, OAuth/OIDC exchange, silent refresh, restore, demo entry, clearSession and logout. Check ownership before transport after any pre-send purge and after every post-response/purge await. Old operations may not persist identity, reset current display-name caches, overwrite a newer error/loading state or issue a stale success toast. A current refresh/restore must still work; registration and consumed-auth-code messages must retain the distinction between server commit and browser establishment failure.

Accept tests for all three schedules above, A→B reverse responses, same-token re-login, failed newer operations, demo entry and stale finally/loading settlement. No mutation rollback, token revocation or cross-tab lifecycle guarantee should be inferred merely from refusing a stale local commit.

Scope and relationship

PR #3318 / issue #3317 owns shared HTTP 401 side effects and automatic retries, not successful session establishment. #3306 owns board-store session invalidation, not the canonical identity store. Keep this as a focused sibling repair rather than declaring either issue solved by the other.

Status: reproduced residual from the 2026-09-21 audit; not implemented or claimed complete. No new ownership lease is taken for sessionStore.ts by this issue.

[Chris0Jeky]

[Codex lane claim v2]
Lane: beta-platform-integrity. Issue #3324 identity-operation ownership.
Base: a62d1ec.
Owned paths: frontend/taskdeck-web/src/store/sessionStore.ts; focused session ownership tests; bounded docs/STATUS.md entry owned by this coordinator.
Shared-path leases: sessionStore.ts only; no tokenStorage/http/board-store changes planned.
Parallel-safe work: MCP authorization, quota proof, board mutation ordering, other stores.
Status: implementing latest-intent ownership around credential-send, response, cache purge, restore, refresh, demo and logout; deferred tests first. Existing user changes preserved in primary checkout.

[Chris0Jeky]

Continuation claim released: #3324 is implemented and merged through #3355 at 308434f. GitHub confirms source PR #3354 merged. Exact-head Required CI passed, independent source/cache/integration reviews found no blockers, and final backend tests passed 10,249 with one existing skip. Frontend source qualification passed 7,336 with three existing skips. No cross-tab synchronization, server rollback, or token-revocation guarantee is implied. Local evidence is preserved under .runtime-codex/2026-09-22-hard-impact/.