[botinc-agent]

Problem

QA of the React Authentication adapter found three ways its session state could disagree with the browser's real session:

• Two <DiditAuth> scopes on one page: the scope that completed a returning sign-in showed signed in, while the other stayed signed out, because nothing told it the shared session had been established.
• A token refresh reported before the first session read (TOKEN_REFRESHED with no cached session) was treated as a sign-out, so signed-in UI could flash to its guest state.
• A client whose load() rejects left every consumer in loading forever: neither <SignedIn> nor <SignedOut> rendered, and no error state existed.
• The default locale read navigator.language during render, so server-rendered English HTML hydrated as another language.

Solution

• core.ts: page-scoped peers re-read the shared session when one scope restores, signs in or signs out; a stale "no session" read never undoes a session a peer established; TOKEN_REFRESHED without a session keeps the current one.
• context.tsx: a failed load reads as signed out instead of loading forever, and the browser language is read after mount so SSR and hydration agree.

Verification

• New regression tests for all four behaviours; each fails on the previous code and passes now.
• npm run test:auth (48 auth-react, 103 auth-nextjs), root npm test (188), npm run lint, npm run typecheck:auth, npm run build, npm run test:packages.
• Browser QA against a local mock auth runtime: sign-in, protected rendering, sign-out, reload restore without a second code exchange, consumer remount, and two scopes converging after one exchange.
• Not verified: the real staging runtime, because staging credentials were not present in this checkout; core protocol behaviour is out of scope.