fix(http): bind retries and expiry to the initiating session

[Chris0Jeky]

Closes #3317.

Repair

Each shared Axios request captures an in-memory credential generation. Explicit token writes/removals advance that generation even when the token string is unchanged; reading storage observes externally replaced credentials. Session metadata edits alone do not invalidate requests.

• A late 401 still rejects to its original caller but cannot clear credentials, purge caches, notify expiry or navigate a replacement session.
• Automatic GET/PUT/DELETE retries cannot migrate to another session. Ownership is checked before backoff, after backoff and again at dispatch.
• Retried/reused configs cannot retain an obsolete bearer when credentials are absent or expired.
• Same-session retry budgets, request IDs, explicit skipAuth401, demo behavior and current-session expiry remain intact.

No extra bearer copy is added to request metadata, no credentials or generation are sent as new headers, and no persistence/schema/dependency/workflow change is made.

Observed red-first evidence

Exact test-only head e9cde363abb650d64981ff4401ef1226c50a378f, CI run https://github.com/Chris0Jeky/Taskdeck/actions/runs/35591559570, Ubuntu frontend job 106307023863:

• Lint, typecheck, build and generated PWA-worker validation passed.
• The full JUnit artifact recorded 7,166 tests, 14 failures, 0 errors.
• All fourteen failures belong to the new HTTP ownership regressions. Both new current-session positive controls and all existing tests passed.
• Artifact 10634439569, frontend-unit-artifacts-ubuntu-latest, records the same exact source head.

The initial test-only commit failed typecheck in three header-inspection assertions. Those test-fixture errors were corrected before the behavioral red run; they are not represented as product regression evidence.

Implementation verification

Current implementation head: 4f38b1286ac2a6afe2e89442cafc0ae726b7a910.

Six additional credential-generation unit cases cover stable reads, same-token replacement, logout/re-login, rejected writes, metadata-only updates, external replacement/removal and malformed storage. Together with the sixteen real Axios adapter cases, the branch adds 22 tests. Exact-head hosted verification is pending inspection; no green result is claimed yet.

Local npm installation was blocked by registry DNS (EAI_AGAIN), and local Node 22 is below the repository's Node 24 contract. No dependency or engine workaround is used. Normal GitHub Actions provide locked-dependency runtime validation.

Boundaries and source integrity

This does not cancel an already-sent mutation, reject all late successful responses, solve session-store login/refresh settlement, or replace board-store epoch/loading work #3305/#3306. It does not alter localStorage's accepted local-first trust model #1644. External storage replacement is observed at token-read boundaries; no comprehensive cross-tab lifecycle protocol is claimed.

Parent source: authoritative main 307c3b8b50bec1cb0bfaea3e570a942bcb1d4451, matching the uploaded ZIP comment. Both production-file ZIP blobs were verified against GitHub before publication. Remote commits use real GitHub ancestry, not the synthetic local archive snapshot.

Keep draft pending inspected exact-head full CI and review. No merge, release, issue closure or canonical status-document update is authorized by this PR.

[Chris0Jeky]

@codex review

Please review exact implementation head 4f38b1286ac2a6afe2e89442cafc0ae726b7a910 against main 307c3b8b50bec1cb0bfaea3e570a942bcb1d4451. Focus on Axios config ownership surviving retries, stale/anonymous 401 behavior, same-token re-login, external storage observations, expired/missing bearer cleanup and preservation of demo/skipAuth401 behavior. Fourteen new regressions were observed failing on the preceding test-only head; implementation CI is running. No global late-success, cross-tab lifecycle or session-store settlement guarantee is claimed. Keep draft.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T11:17:08.671911Z	4f38b12	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 4f38b1286a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".