fix(permissions): preserve same-entry mutation intent order

[Chris0Jeky]

Summary

Serialize board-access updates and revokes per access entry in submission order. A queued operation keeps loading owned from submission, rechecks its session before transport, and proceeds after a failed predecessor. An independent entry remains concurrent and its error receipt is not erased when another entry's queued operation starts.

Closes #3333.

Integration and scope

This integrates source draft #3335 after #3361 landed. The source head 664cdceb9e4392abb9c0989ae42d54a69fea0844 remains an ancestor of this branch, preserving its commits. The diff against current main contains only the permission mutation queue, error ownership, its regressions, the analysis note and the bounded STATUS update. It retains #3361's read, token rotation and stale mutation reconciliation behavior.

The queue orders one client's intents only. Cross-device changes still need a server revision contract; this PR does not claim one.

Verification

• Focused permission store tests at the fix head: 47 passed across five files. Revoke followed by a queued update cannot resurrect the removed row, and a new same-entry intent after token rotation waits for the old in-flight write.
• Full frontend Vitest before the scoped review fix: 520 files passed, 7,387 tests passed, three existing skips, using npx vitest --run --maxWorkers=2 --silent.
• npm run typecheck and changed-file lint passed after the fix. npm run build and full npm run lint passed before the fix, with 11 existing warnings outside the changed files.
• node scripts/check-docs-governance.mjs and node scripts/check-doc-links.mjs: passed, zero broken links and three existing masking warnings.
• The new rotation race regression failed before the fix (two transports started) and passes afterward. Docs checks were rerun after the STATUS update and review fix.

Hosted exact-head CI and a scoped fresh-context review of the logic fix remain merge gates. No browser journey directly exercises same-entry permission mutation races; deferred real-Pinia tests cover that seam.

Documentation and follow-up

docs/STATUS.md records the client behavior and cross-device limit. docs/analysis/2026-09-21-permission-mutation-order.md records the schedules and evidence. A never-settling request can still hold its lane; the lower-severity follow-up is #3364. Existing human actions in OUTSTANDING_TASKS.md remain open.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T20:58:38.499261Z	a918d5a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Chris0Jeky]

Review round 1 found a HIGH same-entry race: clearing mutation tails at session/token replacement let a new intent start while an old in-flight write could still commit. The final fix at e99bba80208867869ff7909d0b175d5a4b36e945 retains those tails until settlement. The new deferred token-rotation regression failed before the fix (two transports started) and passes afterward. All 47 focused permission-store tests pass, as do typecheck, changed-file lint, docs governance and links. Exact-head hosted CI and fresh-context fix review remain pending.

The separate lower-severity never-settling request risk is tracked in #3364; an arbitrary client timeout cannot prove that the first server write will not later commit.

[Chris0Jeky]

Fresh-context fix review completed at e99bba80208867869ff7909d0b175d5a4b36e945: no HIGH/CRITICAL or new lower finding. The reviewer checked cross-token and cross-account ordering, old queued intent suppression, stale-token reconciliation, loading/error ownership and tail cleanup. Five focused permission-store files pass all 47 tests; typecheck and changed-file lint pass. The known never-settling lane risk is tracked in #3364. Exact-head hosted CI remains the merge gate.

[Chris0Jeky]

Exact-head CI qualification at e99bba8: full CI run 35784114426 succeeded, including Windows API integration and E2E; Smart CI run 35784116988 succeeded with Plan and Required Gate. Earlier same-head Smart CI run 35784110750 was cancelled before assertions while the successful duplicate started three seconds later. gh pr checks --required exits 0; no failed assertion or unresolved review thread remains. The independent fix review found no HIGH/CRITICAL defect, and the pushed head has aged over three minutes.