fix: recover saved repositories without losing authenticated sessions

Author: antropos17

docs/CONTEXT.md

@@ -82,7 +82,7 @@ and external AI CLIs require a direct user request. Never merge old work implici
 - Existing Commons run 49092854-f9bd-4b7a-8d12-4ac5ea0e5f70 retains the approved,
   unmerged safe-timer change from job 811bdb98-bcbb-4b65-80b9-f19693aef6b4.
   Preserve it. 29 earlier lab experiments were verified before this release work.
-- Public source: antropos17/commit-zero at 5f9f88e; full CI passed, browser retry failed. Repair pending; preserve separate histories.
+- Public source: antropos17/commit-zero at ae6569b; all three CI jobs passed after Commons retry repair. Preserve separate histories.
   README GIF is a 15.8s condensed walkthrough of retained Sequence Kit work,
   not a continuous live recording. Static fallback included; desktop/mobile and all
   three CI jobs passed. Evidence: runtime/verification/github-readme-gif-2026-10-19.json.

docs/DEVELOPMENT.md

@@ -80,7 +80,7 @@ output under `.cache/tmp`. Child processes receive TEMP/TMP/TMPDIR explicitly.
   On Windows, a local Chrome installation can be used without downloading a
   Playwright browser by setting `CZ_BROWSER_EXECUTABLE` to its absolute executable
   path. `CZ_CAPTURE_BROWSER=1` saves catalog desktop/narrow captures under
-  `runtime/verification`. `npm run test:ui` runs three serial groups with fresh
+  `runtime/verification`. `npm run test:ui` runs four serial groups with fresh
   disposable in-memory services to preserve scenario independence and keep the
   normal 180-request/minute API limiter active. `scripts/test-ui.mjs`
   checks that each browser spec is listed exactly once. Playwright global setup
@@ -90,6 +90,10 @@ output under `.cache/tmp`. Child processes receive TEMP/TMP/TMPDIR explicitly.
   The initial Commons retry test pauses polling with Playwright's clock and holds
   the retry response until busy/disabled assertions pass. Resume its clock before
   axe analysis, which needs browser timers; do not add sleeps or automatic retries.
+  Account recovery uses held real GET responses to check bookmark writes and
+  session changes. Navigate by hash inside those fixtures so a page reload does
+  not cancel the stale response being tested. `CZ_CAPTURE_ACCOUNT_RECOVERY=1`
+  captures its actual desktop and full-page narrow failure states.
 
 Use `npm run dev` for React Fast Refresh while developing. `npm start` serves
 compiled `dist` and requires a rebuild after UI changes. They share port 4173:

docs/DISTRIBUTION.md

@@ -94,14 +94,14 @@ announcement posted elsewhere.
 Before publishing a release, replace the candidate version with an actual tag,
 link its exact commit and CI run, re-run the documented gates, and record real
 browser/model/sandbox coverage separately. No release was created by this note.
-Current implemented-code checkpoint: public `5f9f88e`, [CI run 39217991578](https://github.com/antropos17/commit-zero/actions/runs/39217991578)
-passed the full gate and runtime dependency audit but failed the initial Commons
-retry browser fixture. It is not a release candidate. Local frozen gate at
-`af403ac` passed 72/72 Node tests, DOM/axe 2/2, build and serving with source
-hash `ec03fa28c6c8fbdb5282f6de6913c94e61c7b489ab9e833d038d6ebdedb42871`;
-separate local Chrome coverage passed 12/12. A deterministic retry/busy-state
-repair is in progress. Verify the final candidate revision before creating a
-release. The checked capture set is already published at `98389bd`.
+Current implemented-code checkpoint: public `ae6569b`, [CI run 39220678511](https://github.com/antropos17/commit-zero/actions/runs/39220678511)
+passed the full gate, Chromium and runtime dependency audit after the Commons
+retry repair. Local frozen gate at `3bfcc8d` passed 72/72 Node tests, DOM/axe 2/2,
+build and serving with source hash
+`26cf7d425e0bc517e4e67b52aa530f315823736ffc268f940052dd7474f47c73`;
+separate local Chrome coverage passed 12/12. The account-recovery addition awaits
+its full gate. Verify the final candidate revision before creating a release.
+The checked capture set is already published at `98389bd`.
 
 ## Show HN fact sheet for a human author
 

docs/FIRST-RUN.md

@@ -55,6 +55,7 @@ do not establish runtime correctness. [Complete workflow](COMMONS.md).
 | Health request fails | Check gateway and provider terminals, then select **Check model** again. The draft remains in the form. |
 | Project address is already in use | The form retains its name and description; choose another address and submit again. No duplicate project is created. |
 | Saving a scenario repository is rate limited | The repository shows a persistent message beside **Save**. Wait briefly and select **Save** again; a failed request does not add a bookmark. |
+| Saved repositories are unavailable after sign-in | Your sign-in succeeded. Restore the service and select **Refresh saved repositories** on **My profile**. An unknown list is not shown as empty; a previously loaded list remains visible if refresh fails. |
 | Task fails or is cancelled | Inspect its retained timeline and raw receipt. Retry by explicitly starting a new task; a restarted server does not silently retry jobs. |
 | Provider setup is unavailable | Continue exploring the deterministic example and model-free Commons forms. Do not interpret these as actual model contributions. |
 
@@ -75,3 +76,10 @@ comes from an actual Chrome run with one routed HTTP 503 on the initial state
 read. The same test reaches the real local service with HTTP 200 after keyboard
 Retry, verifies focus returns to main and keeps all navigation visible. It uses
 disposable services and starts no model work.
+
+The [saved-list failure capture](media/account-unavailable-2026-10-19.png) shows
+an actual Chrome registration against disposable identity services, followed by
+one routed HTTP 503 for the optional list. Registration still succeeds; keyboard
+Refresh then receives HTTP 200. Separate held-response fixtures check that a
+completed bookmark write and a different user's list cannot be overwritten by
+an older read. No retained account data or model activity is used.

docs/HANDOFF-2026-10-19.md

@@ -8,18 +8,18 @@ tracks dated decisions and receipts; this file is the operational entry point.
 ## Repositories and state
 
 - Working repository: `X:\ai-github`, branch `codex/development-foundation`,
-  latest fully checked local commit `af403ac` at this checkpoint. The local data and model
+  latest fully checked local commit `3bfcc8d` at this checkpoint. The local data and model
   installation are here. Recheck status before acting; this file can age.
 - Public repository: [antropos17/commit-zero](https://github.com/antropos17/commit-zero),
-  `main` at `5f9f88e66d48f560e8099a39c5308999bd6b291e` after a normal push.
+  `main` at `ae6569ba672dfed53cefe8967aa516764473feae` after a normal push.
   Its separate checkout is `.cache/publication`. The histories are unrelated;
-  the public tree matches local `af403ac` (`f0e02e6c4249d91dc5bb9da9a8768a5cabadab59`).
-  A Commons retry/busy-state repair is in progress after the public browser failure.
+  the public tree matches local `3bfcc8d` (`46b22e1534ce4a2a2c520dc973e256e054f52f5e`).
+  An account saved-list recovery/session-race unit is currently awaiting final gates.
   Do not merge histories, reset the local branch or force push. Recheck remote
   before publishing anything else.
-- Public CI [run 39217991578](https://github.com/antropos17/commit-zero/actions/runs/39217991578)
-  passed the full gate and runtime dependency audit for `5f9f88e`, but Chromium
-  failed the initial Commons retry fixture. Do not treat this as a green candidate.
+- Public CI [run 39220678511](https://github.com/antropos17/commit-zero/actions/runs/39220678511)
+  passed full gate, Chromium and runtime dependency audit for `ae6569b`. The
+  preceding retry-fixture failure at `5f9f88e` is preserved in the mission log.
 - This mission has not run local or hosted model inference, spawned product
   agents, submitted promotional posts or created a new release. Prior retained
   real model activity is historical and must remain distinct from fixtures.
@@ -101,10 +101,19 @@ Timer proposal from job `811bdb98-bcbb-4b65-80b9-f19693aef6b4`. Preserve it.
 
 ## Evidence and limits
 
-- Latest local frozen full gate at `af403ac`: 72/72 Node tests, compiled DOM/axe
+The pending account unit separates successful authentication from saved-list
+loading. `AccountProvider` scopes reads to the active identity and invalidates
+older reads after a bookmark write. `MyProfile` has known/loading/error states
+and explicit Refresh, with keyboard focus restored only if the user has not
+chosen another control. Three focused Chrome tests passed, including a held
+prior-account response. [Actual failure capture](media/account-unavailable-2026-10-19.png).
+Grouped Chrome passed 15/15 and `check:identity` passed 10/10; the frozen full
+gate remains before this unit is committed.
+
+- Latest local frozen full gate at `3bfcc8d`: 72/72 Node tests, compiled DOM/axe
   2/2, build and static serving passed. Stable source hash
-  `ec03fa28c6c8fbdb5282f6de6913c94e61c7b489ab9e833d038d6ebdedb42871`;
-  receipt `runtime/verification/model-identity-full-2026-10-19.json` (ignored by Git).
+  `26cf7d425e0bc517e4e67b52aa530f315823736ffc268f940052dd7474f47c73`;
+  receipt `runtime/verification/commons-retry-full-2026-10-19.json` (ignored by Git).
 - Installed Chrome browser suite passed 12/12 at desktop and 390px. Real captures
   are `runtime/verification/commons-first-run-{desktop,narrow}-2026-10-19.png`,
   `commons-provider-offline-desktop-2026-10-19.png` and catalog captures. Tests
@@ -172,7 +181,7 @@ Timer proposal from job `811bdb98-bcbb-4b65-80b9-f19693aef6b4`. Preserve it.
 
 ## Next work, in order
 
-1. Complete the Commons retry repair: run focused UI, grouped Chrome and `npm run check` on frozen source,
+1. Complete account recovery: run grouped Chrome and `npm run check` on frozen source,
    commit it, copy the unpublished local commit into the separate public
    checkout, compare Git trees, push without force and inspect public CI.
    Record exact SHA and receipt.
@@ -205,7 +214,7 @@ Timer proposal from job `811bdb98-bcbb-4b65-80b9-f19693aef6b4`. Preserve it.
 > `docs/HANDOFF-2026-10-19.md`, and `docs/MISSION-2026-10-19.md`. Recheck Git
 > state and `npm run doctor`; use `npm run map -- <area>`. Preserve all runtime
 > data, credentials, earlier model receipts, and separate Git histories.
-> First inspect public CI for `5f9f88e` and complete any dirty Commons retry or
+> First confirm public CI for `ae6569b` and complete any dirty account recovery or
 > handoff unit. Then reproduce and improve one
 > concrete browser or transaction journey, using focused checks and the full
 > `npm run check` on frozen source. Keep model-backed catalog roles disabled;

docs/MISSION-2026-10-19.md

@@ -12,7 +12,7 @@ Start: 03:46:17 UTC. Deadline: 15:46:17 UTC. Final integration reserve begins 14
 
 ## Current action
 
-Repair the published Commons retry browser failure and its observed settled-busy defect. Then reproduce saved-list failure after registration and delayed account reads. Keep all new profiles disabled. The final integration reserve still begins at 14:16:17 UTC.
+Finish account saved-list recovery and stale-response guards. Registration, keyboard refresh and two held-response races pass in Chrome; run grouped browser and frozen full gates, then publish through the existing separate checkout. Keep all new profiles disabled. The final integration reserve still begins at 14:16:17 UTC.
 
 ## Decisions and limits
 
@@ -76,6 +76,9 @@ Repair the published Commons retry browser failure and its observed settled-busy
 - 07:59 UTC: read the failed public browser log and downloaded its trace under runtime/verification/ci-39217991578-browser-failures. The fixture removed its route before waiting for the initial failed request to settle, allowing polling/load to remove Retry before clicking. A deterministic clock-controlled reproduction also exposed Commons' aria-busy remaining true after failure; its actual failing trace is under runtime/verification/commons-retry-baseline-2026-10-19. A focused correction passed once; stronger pending-request coverage is in progress. No model inference or retained-store write.
 - 08:05 UTC: focused UI passed DOM/axe 2/2, build and serving. An intermediate DOM run failed while selecting a PR; loading state is now limited to initial reads rather than re-rendering the room on every background poll, and the next focused run passed. The initial retry fixture now holds its second request and checks disabled/busy state before HTTP 200. A paused browser clock cannot run axe timers; that fixture now resumes the clock before its recovered-state axe check. Full grouped browser and frozen gate remain.
 
+- 08:08 UTC: Commons retry committed locally as `3bfcc8d` after full gate 72/72, stable source hash `26cf7d425e0bc517e4e67b52aa530f315823736ffc268f940052dd7474f47c73`; receipt `runtime/verification/commons-retry-full-2026-10-19.json`. Normal publication produced `ae6569b` with identical tree `46b22e1534ce4a2a2c520dc973e256e054f52f5e`. [CI run 39220678511](https://github.com/antropos17/commit-zero/actions/runs/39220678511) passed all three jobs, including the formerly failing retry browser fixture.
+- 08:13 UTC: real Chrome reproduced registration HTTP 200 followed by saved-list HTTP 503 leaving the signup page without a visible error; baseline trace is under `runtime/verification/account-recovery-baseline-2026-10-19`. Authentication now completes independently of the optional list. The profile distinguishes unknown/loading/failed/known lists and has explicit Refresh. Generation and owner guards reject delayed reads after a bookmark write or session change. Three focused Chrome tests passed, including keyboard focus recovery and preserving a different focus choice while pending. Focused UI passed DOM/axe 2/2, build and serving. Final grouped/browser and full gates remain; retained account stores are untouched.
+
 ## Next checkpoint
 
-Grouped Chrome passed 12/12 including the controlled Commons retry. Run the frozen full gate, then publish with tree comparison and inspect CI. Continue the account-recovery journey after this repair. Keep the final 90-minute reserve from 14:16:17 UTC.
+Account recovery passed identity 10/10 and all 15 grouped Chrome tests. Run the frozen full gate, commit and publish, then measure and address workspace temporary-output handling in browser tools. Keep the final 90-minute reserve from 14:16:17 UTC.

docs/media/account-unavailable-2026-10-19.png

@@ -1,4 +1,4 @@
-import React, { useState } from "react";
+import React, { useLayoutEffect, useRef, useState } from "react";
 import { useAccount, useWorkspace, useResource } from "../hooks.mjs";
 import { request } from "../api.mjs";
 import { PageHeading, Repositories } from "../components/ui.jsx";
@@ -261,6 +261,19 @@ export function MyProfile({ notify }) {
     { data } = useWorkspace();
   const [tab, setTab] = useState("saved"),
     [signingOut, setSigningOut] = useState(false);
+  const refreshTrigger = useRef(null);
+  useLayoutEffect(() => {
+    if (account.bookmarksLoading) return;
+    const pending = refreshTrigger.current;
+    refreshTrigger.current = null;
+    if (
+      pending &&
+      pending.owner === account.user?.id &&
+      pending.node.isConnected &&
+      document.activeElement === document.body
+    )
+      pending.node.focus({ preventScroll: true });
+  }, [account.bookmarksLoading, account.user?.id]);
   if (!account.checked)
     return (
       <>
@@ -321,7 +334,9 @@ export function MyProfile({ notify }) {
               onClick={() => setTab("saved")}
             >
               Saved repositories{" "}
-              <span className="count">{account.bookmarks.length}</span>
+              {account.bookmarksKnown && (
+                <span className="count">{account.bookmarks.length}</span>
+              )}
             </button>
             <button
               className="btn"
@@ -339,7 +354,28 @@ export function MyProfile({ notify }) {
               <p className="page-intro">
                 Save a repository from its code page to find it here.
               </p>
-              {data && (
+              <button
+                className="btn"
+                disabled={account.bookmarksLoading}
+                onClick={(event) => {
+                  refreshTrigger.current = {
+                    node: event.currentTarget,
+                    owner: account.user.id,
+                  };
+                  void account.refreshBookmarks();
+                }}
+              >
+                Refresh saved repositories
+              </button>
+              {account.bookmarksLoading && (
+                <p role="status">Loading saved repositories…</p>
+              )}
+              {account.bookmarksError && (
+                <p className="inline-error" role="alert">
+                  Saved repositories are unavailable. {account.bookmarksError}
+                </p>
+              )}
+              {data && account.bookmarksKnown && (
                 <Repositories
                   repos={data.repos.filter((r) =>
                     account.bookmarks.includes(r.id),
@@ -353,6 +389,7 @@ export function MyProfile({ notify }) {
                 </p>
               )}
               {data &&
+                account.bookmarksKnown &&
                 account.bookmarks.some(
                   (id) => !data.repos.some((r) => r.id === id),
                 ) && (