fix(notifications): serialize preference saves by intent

[Chris0Jeky]

Closes #3341.

Stack

Stacked on PR #3340 (audit/3339-notification-read-ownership) at parent head 49b903a61a744061f04511377a97f2807dfeed1b.

Retarget to main only after #3340 lands, verify the child-only diff, then requalify the resulting exact head.

Summary

Serializes notification preference saves in this client’s submission order:

• the first save starts transport immediately;
• later saves wait for their predecessor, whether it succeeds or fails;
• queued saves own loading from submission through final settlement;
• queued work rechecks fix(notifications): bind reads to confirmed writes and credentials #3340’s credential epoch before transport;
• token/session replacement drops old queued intent before it can use later credentials;
• error receipts carry their producing operation token;
• queued start clears only its own predecessor’s error, never an independent inbox failure;
• successful saves retain fix(notifications): bind reads to confirmed writes and credentials #3340’s preference-read invalidation.

This queue does not claim cross-device concurrency safety or add a backend revision precondition.

Test-first evidence

• Test-only child: 4f89c6f2969d5dbad923841b4984ef152daef824
• Corrective implementation: af8fde45f58f9dab0027ce11e7530ca03e2f2d2e
• Documented implementation head: 0d1ef8e21cc15f94f3bb86f3d86f21097432c0a9
• Current lint-corrected head: 9e6b675805e6b100952743d900b1458ae7888746

The committed Pinia/Vitest suite covers:

1. immediate first transport and serialized second intent;
2. failed-predecessor continuation;
3. queued old-credential intent after token rotation;
4. loading ownership while work waits;
5. preservation of an independent inbox failure when queued transport starts.

A supplemental runner transpiled and executed the actual stores:

• parent fix(notifications): bind reads to confirmed writes and credentials #3340: 1/5 passed; only the existing loading-token control passed;
• corrected child: 5/5 passed.

The production module and current test file transpile under TypeScript 5.8.3 with zero diagnostics.

Hosted qualification history

At 0d1ef8e21cc15f94f3bb86f3d86f21097432c0a9, Self-Test and Extended passed. Required CI failed before typecheck/tests because the new test file retained one unused local notification() factory. Ubuntu and Windows reported the same @typescript-eslint/no-unused-vars error; backend unit/API integration, architecture, migrations, security, governance and worktree lanes were green. Container frontend build failed downstream of the same frontend source gate.

Current head 9e6b675805e6b100952743d900b1458ae7888746 removes only that unused factory. Runtime source and behavioral assertions are unchanged. Its exact-head workflows are pending.

Keep draft until the complete current-head Self-Test, Extended, Required CI and independent review are inspected. After #3340 merges, retarget to current main, verify the child-only diff and rerun all qualification. Green CI will be evidence, not merge authorization.