4grayandClaude Opus 5.5 f9e5ee97d7 fix(server-storage): bind the token to its instance; adopted edits yield to newer changes ...

The access token is stored with the instance id it was given for, and a
page reads it only for its own instance: a tab still open on the old
backend after BACKEND_URL changed no longer sends the new server's
token there. The API client hands every 401 to reportAccessDenied(),
which now also sends a page without a token for its instance to sign-in,
while one that holds its token back until the instance is checked keeps
it.

A closed tab's adopted edits carry `yields`: replayed, they change only
what is still as that tab saw it, so they never replace progress this
tab or another device saved since. The flag survives the journal.

The sync spec's fake server and memory storage move to a test-helpers
file to keep the spec under its line limit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-13 21:13:52 +02:00

..

architecture

fix(server-storage): bind the token to its instance; adopted edits yield to newer changes

2026-10-13 21:13:52 +02:00

development

fix(portals): resolve cancelled and 401/403 portal requests instead of rejecting through IPC (#1861)

2026-10-10 11:28:59 +02:00

maintenance

perf(tooling): compositing probe, report command and route-wide clip-mask guard (#1858)

2026-10-09 21:34:57 +02:00

superpowers

fix(server-storage): refuse user state for deleted playlists

2026-10-12 23:43:43 +02:00