[dawsontoth]

⊙ Problem

A sign-out bumps the API explorer's sign-out generation, then wipes localStorage, which deleted the bump. A tab that missed the sign-out (reloading or frozen) checks its stored explorer credential against that generation when it loads. After the wipe it read 0 again, so a credential stamped 0 stayed usable (#1946).

🤔 Should the sign-out's wipe keep anything at all?

Yes: the load-time check is the only one a tab that missed the sign-out gets, and every sign-out reset it. What is kept is a single count, with no user or instance in it.

💡 Solution

• A sign-out now leaves the explorer generation above every credential stamped before it. A tab that missed the sign-out drops its credential when it reloads.
• The kept record is one global count, written once per sign-out. No instance id carries over to the next account.
• This holds when a teardown step throws or the store is full. A full store still tells the other tabs once the wipe makes room.

⚖️ Alternatives

• Wipe before signOutAllLocally — the bump then starts from nothing, so every sign-out writes the same count and a credential stamped after one sign-out survives the next.
• Keep the per-instance counts — the kept record would then carry the previous account's instance ids.

🤔 Keep the key through the wipe, or write it back after localStorage.clear()?

Keeping it means the normal path never writes the key after the bump, so another tab's bump in between survives. Writing back a snapshot would overwrite that bump. A full store needs the retry either way.

🔧 Changes

• clearAuthStateLocally.ts hands the wipe to the store, and its doc comment says the generation is the one thing kept.
• authStore.ts:
  • wipeLocalStorageForSignOut keeps the generation key, then in a finally writes again what a full store refused: the generation, and the announcement, which it removes again once sent. A refused announcement gets this one more try only: sent later, it could end a session the user has signed back into in another tab.
  • A full sign-out skips the per-entity bumps while it runs, and writes one collapsed record in its finally: one '*' count above every instance's count. If storage refuses that and its retry, this tab's next entity bump writes it instead.
  • Subscribers hear only about a write that landed (reported back), and one that throws is caught and passed to console.error.
  • A refused generation and a refused announcement are remembered for the retry. The announcement write now reports whether it landed, and the sign-out keeps the user when it did not. clearLocalStorage is imported here, and one helper reads a count, for getExplorerAuthEpoch too.
  • fix(cluster): send a terminated cluster's in-cluster bookmarks to its overview #1954 (open) adds signOutEntitiesLocally just after signOutLocally in this file. No lines overlap; an entity sign-out there would also write an owed collapse.
• clearLocalStorage.ts removes every key but the ones it is told to keep, one at a time. It tries each removal even when one fails, then throws the first failure.
• DESIGN.md records the explorer rule and its one-write limit, the announcement retry, and fixes a stale line that put explorer settings in localStorage.

🤔 Should a store that refuses every write still reach the other tabs?

Not here: both signals are storage writes, so other tabs then learn from their next request, as before. A BroadcastChannel fallback would reach running tabs only. Both open deferrals are this limit.

✅ Verification

• Fails on stage: in signOutHandlers.test.ts, a credential stored before the 1st or 2nd sign-out is dropped when a tab that missed it reloads, through both clearAuthStateLocally and logoutOnSuccess. On stage (3e9e160) it is kept, with authGeneration: 0. One write per sign-out (4 on stage) and the announcement after a full store's wipe (never sent on stage) fail there too.
• Real browser, two tabs (Vite dev server, on a8596fdd9): one tab holding a credential stamped 0 sat on a static page while the other ran clearAuthStateLocally, then reloaded the app. On stage the credential survived; on the branch it came back as {"ins-a":{"method":"bearer"}}.
• Gates (Node 24.21.0, real exit codes, on 0282f21): vitest run --maxWorkers=4 0 on the second run (553 files, 5,509 passed); the first run's one error, a Radix timer in the unrelated AddOrganizationRoleModal.test.tsx, passes alone. tsc -b 0, oxlint 0, dprint check 0. The husky hook's full run passed on every commit.

The other new tests, and mutation checks

• signOutHandlers.test.ts also keeps a credential stored after the sign-out, fills the store so the bump lands only after the wipe, fails one removal during the wipe, and announces once when there is room. Its wipe test now expects only the generation key left, and a tab reload is fresh modules over the shared localStorage.
• explorerAuthInvalidation.test.ts pins the collapse, an entity bump after a full sign-out that threw, the owed collapse, no callbacks after a refused write, a throwing subscriber and a throwing teardown step.
• clearLocalStorage.test.ts pins the kept keys, keys named like Storage members, which Object.keys(localStorage) leaves out, and that one failed removal does not stop the rest.
• appSignOutElsewhere.test.ts now makes the teardown throw from signOutLocally, since a subscriber's error no longer escapes, and checks a twice-refused announcement is not sent later.

I reverted each guard locally and confirmed a test goes red (17 mutations, all red):

mutation	fails
the wipe keeps nothing (the bug), or is localStorage.clear() again	the reload cases and the wipe test, both entry points
no retry after the wipe; the retry runs first; a failed removal skips it	the full-store and failed-removal cases
the retry never sees a refused generation	the full-store case
the collapse keeps the per-instance counts, or does not lift above them	the collapse and throwing-teardown tests
per-entity bumps are not skipped, or stay skipped after a teardown throws	the one-write test; the bump-after-throw test
an owed collapse is not written at the next entity bump	the owed-collapse test
a throwing subscriber aborts the bumps; subscribers are called back after a refused write	the throwing-subscriber test; the no-callback test
a refused announcement is not retried, is retried again later, is re-sent after it landed, or is left in storage	the announcement tests
the global bump runs only after a clean teardown	the throwing-teardown test
one failed removal stops the rest, or is swallowed; keys are listed with Object.keys	the clearLocalStorage tests

The collapse finds the highest count with a loop rather than spreading every slot into Math.max, which throws RangeError past about 150,000 slots on Node 24's main thread. No test pins that: a vitest worker accepted 450,000 arguments, and a record that large reaches jsdom's 5 MB storage quota.

🤖 Generated with Claude Code

Related PRs: #1948 overlaps (merged; this moves the explorer bump into its sign-out finally and changes its teardown test), #1954 overlaps (open; adds signOutEntitiesLocally to authStore.ts, no shared lines)

Complexity: complicated

Deferred findings

• 22601929e2fc387e nit security — src/features/auth/store/authStore.ts — Both epoch writes refused: kept record retains entity ids and pre-sign-out credentials stay current — filed Sign-out: reach other tabs when storage refuses the sign-out's writes even after the wipe #1960
• 6f2a8235a818a050 nit reliability — src/features/auth/store/authStore.ts — A twice-refused app sign-out announcement is never sent — filed Sign-out: reach other tabs when storage refuses the sign-out's writes even after the wipe #1960

_{Review-Coverage: authored=claude; ran=gemini,codex,cursor-composer; adjudicated=domain; blocked=cursor-muse(no-receipt),cursor-grok(no-receipt); declined=cursor-kimi,muse; rounds=10; full=4 @ 0282f21}

_{Review-Attention: deep ~30m (critical: clearLocalStorage.ts; sensitive: clearAuthStateLocally.ts, authStore.ts; decisions: wipe-owned-by-authstore, owed-collapse-overinvalidates, per-key-removal, do-less-alternative) @ 0282f21}

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	79.3%	14525 / 18316
🔵	Statements	79.24%	15415 / 19453
🔵	Functions	74.59%	3867 / 5184
🔵	Branches	73.89%	11298 / 15289

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/features/auth/handlers/clearAuthStateLocally.ts	100%	100%	100%	100%
src/features/auth/store/authStore.ts	94.1%	83.71%	96.51%	94.04%	122, 264-265, 274-277, 325, 346, 367-378, 386, 391-394, 496-499, 863, 868, 945, 969
src/lib/storage/clearLocalStorage.ts	100%	100%	100%	100%

Generated in workflow #2370 for commit 0282f21 by the Vitest Coverage Report Action