Keep a newer sign-in when the restored stored account turns out dead

Follow-up review of 074c9fe (Low): the guard that keeps an account signed
in during the stored session's check ran only for a live stored account.
It now runs before the dead branch's drop as well.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Programcode

src/lib/supabase/AuthProvider.tsx

@@ -227,15 +227,15 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
       if (!mounted) return;
       const { data, error } = getSessionResult;
       if (error) console.warn('[Auth] getSession error:', error.message);
-      if (data.session?.access_token && !(await confirmRestoredSession(data.session.access_token))) {
-        if (!mounted) return;
-        dropRestoredSession();
-        return;
-      }
+      const alive = data.session?.access_token ? await confirmRestoredSession(data.session.access_token) : true;
       if (!mounted) return;
-      // Someone else signed in while this was checked: theirs stands.
+      // Someone else signed in while this was checked: theirs stands, alive or not.
       const current = currentUserIdRef.current;
       if (current && current !== data.session?.user.id) return;
+      if (!alive) {
+        dropRestoredSession();
+        return;
+      }
       if (data.session) {
         applySession(data.session);
       } else {

src/test/auth/AuthProvider.behavior.test.tsx

@@ -954,6 +954,29 @@ describe('AuthProvider behavior', () => {
     expect(screen.getByTestId('user')).toHaveTextContent('new-user');
   });
 
+  it('does not drop an account signed in while a dead stored account was being checked', async () => {
+    getSessionMock.mockResolvedValue({ data: { session: { user: { id: 'stored-user' }, access_token: 'stored' } }, error: null });
+    let answerLookup!: (value: unknown) => void;
+    getUserMock.mockImplementationOnce(() => new Promise((resolve) => { answerLookup = resolve; }));
+
+    render(
+      <AuthProvider>
+        <AuthConsumer />
+      </AuthProvider>
+    );
+
+    await waitFor(() => expect(getUserMock).toHaveBeenCalled());
+    await act(async () => {
+      callbackRef.current?.('SIGNED_IN', { user: { id: 'new-user' }, access_token: 'new-token' });
+    });
+    await act(async () => {
+      answerLookup({ data: { user: null }, error: { status: 401, message: 'revoked' } });
+    });
+
+    await waitFor(() => expect(screen.getByTestId('loading')).toHaveTextContent('false'));
+    expect(screen.getByTestId('user')).toHaveTextContent('new-user');
+  });
+
   it('does not hold startup on a sign-out of a dead stored session that never answers', async () => {
     vi.useFakeTimers();
     try {