fix(auth): keep sign-ins another tab added when this tab writes its markers

[dawsontoth]

⊙ Problem

Each tab read the sign-in markers once at load and wrote that copy back on every sign-in and sign-out, erasing what other tabs had added since. An app sign-out from the older tab then sent those sign-ins no logout. Signing out an entity only another tab had marked, including at a Fabric cluster's termination, left its marker behind.

🤔 Should this be separate from #1966?

Yes, as agreed there: it changes how every tab stores its markers. It also covers #1966's deferred Fabric-termination finding, now tracked in #1968.

💡 Solution

• Each marker has its own localStorage key, so a sign-in or sign-out touches only its entity.
• Sign-out sweeps reach every stored marker, at each URL it is marked at.
• A check never undoes another tab's sign-out or newer URL.
• The old shared record is migrated once, and kept in step for one release.

🤔 What does a tab still on the previous release see?

This release's changes, at its next load: they are mirrored into the old record, and sweeps here read it, so an app sign-out here logs out that tab's sign-ins too. Only its sign-out of an entity misses the new key, which matters only if its logout failed. Without the mirror a rollback shows everyone signed out; #1970 drops it later.

Alternatives

• Per-entity edits to the one shared record (this PR's first version): two tabs writing at once could still lose a change.
• Migrate and delete the old record: previous-release tabs and a rollback would then see no sign-ins.
• A lock around the shared record: Web Locks are async, so every marker write would become async.

🔧 Changes

• signInMarkers.ts (new): the key layout, the one-time migration and the mirror into the old record.
• authStore.ts:
  • flagKeyAsSignedIn writes one key and no longer throws when storage refuses. flagKeyAsSignedOut removes one, and only the URL a failed check used.
  • Sweeps read this tab's markers, every stored key and the old record, once per URL.
  • A check's answer is dropped when this tab signed in again meanwhile, and a refused removal is retried.
  • Load falls back to the old record until migration lands, and the sign-out wipe keeps the migration flag.
• getCurrentUser.ts: the store's app check fetches without syncing, and a /User/current answer syncs only if no sign-in landed meanwhile, through syncAppUser, which counts as a check.
• Unit tests seed markers through signInMarkersTestHelpers.ts, and the e2e specs through e2e/tests/signInMarkers.ts.

The other 21 files: the new key's name, and seeds moved onto the helpers

• e2e/README.md names the new key.
• auth.setup.ts names the new key.
• cluster-form.anon.spec.ts seeds through rememberAppSignIn.
• clusters.anon.spec.ts seeds through rememberAppSignIn.
• global-search.anon.spec.ts seeds through rememberAppSignIn.
• new-org.anon.spec.ts seeds through rememberAppSignIn.
• organizations.anon.spec.ts seeds through rememberAppSignIn.
• profile.anon.spec.ts seeds through rememberAppSignIn.
• sidebar-help.anon.spec.ts seeds through rememberAppSignIn.
• clearAuthStateLocally.ts says the wipe keeps the migration flag.
• signOutHandlers.test.ts expects the flag after the wipe.
• appSignOutElsewhere.test.ts seeds and reads markers through the helper.
• entityAuthCheckScope.test.ts seeds and reads markers through the helper.
• isKnownSignedOut.test.ts seeds and reads markers through the helper.
• signOutEntities.test.ts seeds and reads markers through the helper.
• signOutRaces.test.ts seeds and reads markers through the helper.
• ClusterHome.signIns.test.tsx seeds and reads markers through the helper.
• crossTabSignOut.test.tsx seeds through the helper.
• endedSessionRouteFailures.test.tsx seeds and reads markers through the helper.
• rememberedClusterDeepLink.test.ts seeds and reads markers through the helper.
• terminatedClusterDeepLink.test.tsx seeds and reads markers through the helper.

• DESIGN.md records the layout and the mixed-release rules; AGENTS.md names the new key.

✅ Verification

End-to-end route: (a). I extended account-menu.anon.spec.ts and ran the anon Playwright suite in local Chrome against this branch: 60 passed, 1 skipped. Its two new cases fail without migration or the old-record sweep.

• 37 of the 70 tests in the four marker test files fail on fix(cluster): log a removed self-hosted cluster's sign-ins out of its servers, then forget them #1966's head.
• vitest (562 files, 5,762 passed), tsc -b, oxlint, dprint check and the e2e tsc exit 0 on Node 24.21.0.

What the tests cover, mutation checks, and a flaky unrelated file

• crossTabMarkers.test.ts: per-key isolation, sweeps over other tabs' markers and both URLs, checks that leave other tabs' changes, the app sign-in, and stale check answers.
• legacySignInMarkers.test.ts: migration once per storage (also across a full sign-out and a refused first copy), junk records, the mirror, and sweeps over previous-release sign-ins.
• localSignOutStorageFailure.test.ts: refused writes and removals, and their retries.
• terminateCluster.test.ts: Fabric termination forgets markers only another tab holds.
• getCurrentUser.test.ts: a /User/current answer a sign-in overtook leaves that sign-in.
• 42 mutations of the migration, mirror, sweeps, check, sync and retry logic each make a test fail.
• Some full runs report an unhandled Radix focus-scope timer after teardown in a modal test (cardLinksDuringPendingNavigation, AddOrganizationRoleModal, RenameFileModal). None runs this code, each passes alone, and the pre-commit runs were clean.

Closes #1968

🤖 Generated with Claude Code

Related PRs: #1966 overlaps (stacked on it)
Complexity: complicated

Deferred findings

• d861d82357ec0895 minor concurrency — src/features/auth/store/authStore.ts — non-atomic cross-tab read-modify-write of the shared marker record can lose a concurrent sign-in or sign-out — filed Sign-in markers: stop mirroring to the legacy shared record one release after #1969 #1970
• a947843f6d1dd466 nit correctness — src/features/auth/store/authStore.ts — constructor accepts an array or junk marker record; filtered junk survives sign-outs — filed Sign-in markers: stop mirroring to the legacy shared record one release after #1969 #1970
• 1282fb67a2760cbc nit data-integrity — src/features/auth/store/authStore.ts — a transient unreadable record replaces every other tab's marker with this sign-in — filed Sign-in markers: stop mirroring to the legacy shared record one release after #1969 #1970
• 3784139b4d036a24 nit maintainability — src/features/auth/store/crossTabMarkers.test.ts — new test imports omit file extensions required by the checklist — filed Decide whether relative imports should name their file extension #1972
• face1e3da4c920f7 nit security — src/features/auth/store/authStore.ts — both URLs' logout clients carry the single shared BasicAuth credential, so one logout can fail — filed Sign-out: a logout to each marked URL carries the one stored Basic Auth credential #1971
• 43cd604ec076ea0e nit concurrency — src/features/auth/store/signInMarkers.ts — migration's check-then-set can overwrite a newer per-entity sign-in — filed Sign-in markers: stop mirroring to the legacy shared record one release after #1969 #1970
• defde12cf7a0afc8 nit correctness — src/features/auth/store/signInMarkers.ts — a legacy record holding only filtered-out entries persists as {} — filed Sign-in markers: stop mirroring to the legacy shared record one release after #1969 #1970
• 58c8df7ce1fb2420 nit concurrency — src/features/auth/store/signInMarkers.ts — non-atomic cross-tab read-modify-write of the shared marker record can lose a concurrent sign-in or sign-out — filed Sign-in markers: stop mirroring to the legacy shared record one release after #1969 #1970
• a09380796d04a58f nit data-integrity — src/features/auth/store/authStore.ts — retryUnremovedSignInMarkers removes another tab's same-URL re-sign-in, or any replacement after an unreadable refusal — filed Sign-out: reach other tabs when storage refuses the sign-out's writes even after the wipe #1960
• 81c98bc4312a6a42 nit performance — src/features/auth/store/authStore.ts — rememberedSignIns deduplicates with findIndex inside filter, quadratic in remembered URLs — filed Sign-in markers: stop mirroring to the legacy shared record one release after #1969 #1970

_{Review-Coverage: authored=claude; ran=gemini,codex,cursor-grok,cursor-muse,cursor-composer; adjudicated=domain; declined=cursor-kimi,muse; rounds=10; full=2 @ ea84900}

_{Review-Attention: deep ~60m (sensitive: clearAuthStateLocally.ts, getCurrentUser.ts +3; decisions: unreadable-migration-fails-closed, check-specific-sync, same-value-retry-removes, legacy-mirror-one-release, do-less-alternative; raised: degraded review) @ ea84900}

[gemini-code-assist]

Code Review

This pull request improves cross-tab authentication state synchronization and robustness against storage write failures. It introduces tracking for unremoved markers when storage writes fail, updates local and remote sign-out flows to handle multiple URLs per entity, and adds comprehensive test suites for cross-tab marker behaviors and storage failures. The review feedback suggests enhancing TypeScript type safety by adding explicit type assertions to the return values of Object.fromEntries and Object.entries in readMarkers and rememberedSignIns respectively.