[mvalancy]

Reset links currently authenticate as login links, login links can change passwords, and older JWTs remain authorized after a password reset. This change binds each email link to a purpose and account revision, makes password/revision/link revocation one conditional SQLite write, and checks the current active account revision at all live human-session HTTP and WebSocket boundaries.

Depends on #195; this draft targets its branch so the token change is reviewable separately. Related to #184; provider verified-email and account-linking work remains open.

• Migrates legacy SQLite records safely: invalidates untyped email links, initializes account revisions, preserves signed legacy sessions only at revision zero, and repairs the existing status method’s missing deactivation column.
• Rejects cross-purpose use without consuming a valid link for its correct purpose. Concurrent reset, execution-time expiry, revocation rollback, stale refresh and login snapshots are covered.
• Applies revocation to GraphQL, share creation, human agent/operations API requests, WebSocket connection and outgoing results. Reactivation cannot revive old sessions. Separate scoped agent/operator credentials keep their existing expiry/revocation/owner contract.

Independent review of exact head 5aa307c3ac7946dfb2b700bb2aafa6c4a95891d7 found no outstanding findings. It incorporates reviewed CAPTCHA/LOD head 7b1ebad827f6fb6a3006921dba1b03d974358766. Review caught two previously missed REST consumers; four real-router negative controls showed HTTP201 credential issuance after reset/reactivation, and the corrected full 16-case boundary suite passes. Both initial cross-purpose failures are also retained.

Validation: actual production handlers and routers, real in-memory SQLite/Apollo/graphql-ws and real WebSocket clients; only the agent graph driver is a bounded adapter. Previous frozen token head passed 152 server tests, build/types/lint and harness. Fresh clean install/build/types/lint/full server/harness/native operations checks and exact-head CI are pending on this final composition; this draft is not merge-ready until they pass. No live email/provider/Cloud D1/deployment acceptance is claimed. Requests already authorized before reset are not rolled back; idle sockets are rejected on their next operation/result.

Canonical contract and dated failure evidence: docs/quality/AUTH_LINK_LIFECYCLE.md and .agents/inbox/2026-10-27-email-purpose-and-revision-are-auth-boundaries.md.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Frozen head 5aa307c3ac7946dfb2b700bb2aafa6c4a95891d7 now passes clean pinned install; all four builds, five type checks and four lint tasks; 162/162 server tests; 166/166 harness tests; and both native operations/admin-bootstrap smoke checks. Independent review found the REST revocation correction complete and no new findings.

A separate owned production API was started from this built head with a fresh SQLite directory and the disposable Neo4j fixture. Its built web assets were served through owned nginx. All four production CAPTCHA/password-login browser cases passed in15.6s, zero retries, including desktop and390px real proof, failed-password/new-proof recovery and blocked pending/expired/failed verification. This also exercises token-aware password login through the built app; it is not email/provider/hosted-D1 acceptance. The first nginx fixture setup failed because a file-path assertion incorrectly expected the web path inside the config; Docker created an empty bind directory. That owned failed container/directory was removed and the corrected file was mounted with --mount before the passing run. No production infrastructure was touched.

Current CI 40580018905 has passed static checks, package units, build, security and real Neo4j; browser gates remain pending. Node22.18/24 and installer checks in 40580019040 pass. Merge remains gated on final CI and the eventual dev composition after #195.

[mvalancy]

Final-head CI 40580018905 failed; Comprehensive 40580019040 passed. New-user exceeded the harness 900-second process limit, so its JSON report is incomplete and none of that sequence is credited as passing. Downstream mobile/effects/performance checks did not run.

The retained per-test trace also records the independently reproduced #200 focus race in TEAM-01: note fill at 752832ms, followed by disabled Add at 752866ms and a 12-second action timeout. This is the same failing interaction observed on CAPTCHA's LARGE-01; a separate focused correction is in progress. A later interrupted smoke trace is incomplete. I will compose the reviewed fix and rerun the full applicable gates; no timeout increase or rerun-only correction is being credited. Earlier local token lifecycle/REST/WebSocket and production CAPTCHA results remain scoped evidence, not a green integration claim.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Frozen composition 732009f3abeccb7734370c35b910e7e349e87f55 includes CAPTCHA 03b9ba8 and its reviewed focus/dependency changes. Independent review verified all 18 token-specific paths preserve reviewed 5aa307c content; inherited source matches the new base and indexes preserve all additions.

Fresh clean install/build/types/lint, 162 server cases and 176 harness cases passed. Restarted the owned production API on this built source; its built nginx-served SPA passed 4/4 CAPTCHA browser cases in 12.9s with zero retries. These production login results complement the real SQLite/HTTP/WebSocket token-boundary suite. Current CI 40586541239 remains pending; Node 22/24 + installer checks 40586541257 passed. Original timeout/focus evidence remains retained. OAuth is separately reviewed in #202.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Current CAPTCHA head a0fcaf882109a6b76d5f8f4278e4af2895629271 fixes a verification event-listener race exposed in token CI 40591509438. A visible widget could emit before its passive listener effect attached. Only the listener/reset block moves to layout timing; fetch/focus and authentication policy remain unchanged.

A deterministic React.Profiler regression emits at the first widget commit: old source fails 1/5, corrected source passes 5/5. Replacement, error, prior-action and unmount controls reject stale events. Independent review cleared exact source and downstream compositions. Local build/types/lint, 179 harness checks, and 353 web tests passed; the web run used bounded workers after retaining an unrelated unbounded 5-second test timeout and subsequent failure. No timeout/retry settings were relaxed. Rebuilt production SPA passed all four real CAPTCHA browser cases in 17.8s, one worker, zero retries.

Token current head 2b05ea00240d06d4e16ccbcce4d55ecd65476f8d and OAuth d83fd9ae627f4bebd1cbc30bab4ac6e3ad840c1b import exactly these four reviewed paths; their auth feature code is unchanged. Final current-head CI remains required. Earlier failed/cancelled runs remain evidence, not passes.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Imported reviewed LOD correction #207 without changing this feature's own implementation. The composition adds exactly four reviewed paths (renderer effect, regression, lesson and index); independent review verified complete tree/blob unions, parents and unchanged feature code. Source #207 passes LOD desktop/phone2/2, web346/346, harness175/175, smoke6/6, build/types/lint. Refreshed exact-head CI is active; earlier failures/cancelled superseded runs are retained and are not passes. The CSS acceptance failure is addressed by the isolated transition-ownership fix, not by retries or relaxed assertions.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Final correction composition is now 5a25338be79538f296d85bc97b2b667fa1004740. Independent review verified the complete six-path import from reviewed LOD/camera-readiness head 7cbf292: source renderer, both browser regressions and lessons match byte-for-byte; feature-specific code and dependencies remain unchanged. The symptom index retains every previous row and adds the motion lesson. No instruction or authority changes.

The combined local motion suite passes 3/3 in 2.1 minutes with zero retries; combined LOD validation and fresh exact-head CI remain pending. Previous green heads do not establish this composition's final acceptance. Earlier LOD/rotation failures and insufficient title-geometry evidence remain retained. Integration follows #207 → #210 → #199 → #195 → #197 → #202 → #206 → #211, with native dev merge verification and post-merge CI before issue closeout. Independent agent review is not a GitHub non-author approval.

[mvalancy]

Final native dev-only integration evidence for 5a25338be79538f296d85bc97b2b667fa1004740: email-link purpose, atomic consumption and authentication revision revocation. Independent exact-head implementation/composition reviews found no remaining findings. The reviewed camera corrections are included; feature-specific code is unchanged from its reviewed source.

CI40602593251 and Comprehensive40602593295 passed every applicable job. Downloaded strict artifacts verify smoke6, new-user42, LOD2, routes7, mobile27 and performance3, all with zero failed/warned/skipped cases, evidence errors, timeouts or nonzero executions. Effects, showcase, supported-Node coverage, installer and real-Neo4j gates also passed. The main/nightly-only production job is inapplicable to this dev PR.

The live base and complete merge result will be checked against the preceding reviewed stack tree immediately around the native operation. Expected resulting tree: c002bf0a4ba85a019ad499bbba37482d49d449a4. Retargeting a stacked PR to an equivalent dev tree changes no feature content. Earlier failures remain retained; no retry is substituted for a fix.

This uses the owner's standing dev administrator authority and does not claim a GitHub non-author approval. Issue closeout waits for successful validation of the integrated dev head; intermediate post-merge runs may be superseded by later reviewed stack integration and are not counted as passes. Main, release, deployment and protection remain unchanged.