fix(permissions): serialize same-entry mutations

[Chris0Jeky]

Closes #3333.

Stack

Stacked on PR #3330 (audit/3328-permission-read-ownership). The current merge base is the corrected parent head 59debd4cbc0b32cc276e169e410207d06af29159; compare confirms the child is ahead with only its four mutation-ordering files.

Summary

Serializes update/revoke work per {boardId, accessId} while preserving independent-entry concurrency:

• the first same-entry mutation starts transport immediately;
• later intent waits for its predecessor, regardless of success or failure;
• queued operations retain loading ownership from submission through settlement;
• queued work rechecks the initiating credential epoch before transport;
• identity/token/session replacement clears queue registration, so old intent cannot run with later credentials;
• a failed predecessor does not cancel the next intent;
• queued start clears a receipt only when it is owned by its own predecessor, never an unrelated access row;
• successful writes retain fix(permissions): keep board-access reads behind confirmed writes #3330’s read invalidation and stable-ID grant deduplication.

This preserves one client’s submission order only. It does not solve cross-device concurrency; the backend exposes no revision precondition.

Test-first and review evidence

• Original parent: c43a5ace7f403f773153cf91a7d62e312aab1b9c
• Initial test-only child: 40cfd0b9fa485166ff55a5d1c7650a35195ebb85
• Initial serialization correction: c1fcc1e4dce6aa0147c3021774676c583c31e0e6
• Independent-error regression: 01af1833e8a71604c45fd977759d3233bbbe9753
• Parent reconciliation and review correction / current head: 664cdceb9e4392abb9c0989ae42d54a69fea0844

The original negative control produced four expected failures while the different-access concurrency control passed; all five ordering schedules passed after serialization.

Codex review found that a queued row-1 operation could erase a row-2 failure when transport began. The new deferred Pinia case makes row 2 fail while row 1's successor waits, then asserts row 2's receipt survives both queued start and success. Error receipts now carry the operation token that produced them, and a queued operation can retire only its predecessor's token.

Prior qualification

Initial head c1fcc1e4dce6aa0147c3021774676c583c31e0e6 passed Self-Test 35599606698, Extended 35599606903, and Required CI 35599607010. Those runs predate the review correction and corrected parent.

Exact-head CI and repeat independent review are required at 664cdceb9e4392abb9c0989ae42d54a69fea0844. Keep draft and stacked until inspected. After #3330 lands, retarget to current main, verify the child-only diff and rerun qualification.

Green CI is not merge authorization. No merge, release or deployment qualification is claimed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T14:11:59.317522Z	c1fcc1e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c1fcc1e4dc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Parent reconciliation required before any further qualification.

PR #3330 now ends at 72d71c8500f534c10e8bb70c025922f9381f0103, not the 59debd4 parent snapshot currently embedded in this branch. The parent now preserves settled access caches across same-user token refresh and retries only unresolved board reads, while never replaying mutations.

Keep this child draft and treat its current non-mergeable state and prior CI as superseded. After #3330's exact final head is green/reviewed, rebuild this child on 72d71c8, preserve the mutation-ordering/error-receipt delta, verify the child-only diff, then rerun Self-Test, Extended, Required CI, and review.

[Chris0Jeky]

Handoff: this child is fully saved at 664cdceb9e4392abb9c0989ae42d54a69fea0844. Parent #3330 has since advanced to 72d71c8500f534c10e8bb70c025922f9381f0103, so keep this PR draft. Reconcile/restack onto the final parent, verify the child-only diff, and rerun exact-head CI/review before changing readiness.