`/enroll`: a stale approval's completion clears a newer link's code

[nedtwigg]

Code: approve and clearEnrollment in hosted/src/App.tsx; the hashchange handler takeLink in the same file.

Failure path: the user clicks Approve for code A, and approveEnrollment(A) is in flight. A second enrollment link opens in the same tab, and hashchange sets enrolling to code B. A's request resolves, and approve calls clearEnrollment(), which sets enrolling to null and replaces the URL. Code B is gone from memory and from the URL, and the notice reads "Approved A". The user has to open link B again. hosted.md -> "Burrow enrollment" says "A fragment change on /enroll takes the new code without reloading". Here a completion that is already in flight undoes that take.

Suggested fix: in approve, clear only if the enrollment still being shown is the one approved (if (enrollingRef.current?.code === code) clearEnrollment()). Otherwise leave B in place and show the A notice. Add an App test: start an approval, fire a hashchange to a new code, resolve the approval, then assert that the new code is still shown.

Found while trimming #904, which had parked this as a spec "Known gap".

🤖 Generated with Claude Code

[dormouse-bot]

The race holds as described, but I haven't opened a fix: Hosted has no frontend test harness to hold the App test, and this runner couldn't reach the npm registry to add one.

The code at d33cee4 matches the report. approve calls clearEnrollment() unconditionally after await approveEnrollment(code). Meanwhile takeLink can replace enrollingRef.current during that await. The suggested enrollingRef.current?.code === code guard fits: refresh() already reads enrollingRef, so it would keep the URL on /enroll while B is held.

The blocker is the test. hosted/vitest.config.ts includes only server/tests/**/*.test.ts, and hosted has no jsdom (or any DOM environment) among its devDependencies. The lockfile has jsdom@30.1.1 only under standalone/sidecar. An App test therefore needs jsdom added to hosted and a src/**/*.test.tsx include, which also re-resolves hosted's vitest peer snapshot in pnpm-lock.yaml. I couldn't regenerate that lockfile offline, and a hand-edited one would likely fail --frozen-lockfile. With network access, it's the fix, a test that mocks ../src/api (approval held on a deferred promise, then a hashchange to #B, then the resolve, then an assert that B is still shown), and those two config lines.