[jsibbison-square]

Why

• Builderlab permissions stayed at their sign-in values until another login.

Key changes

• The session keeps permissions fresh, so gates don't have to. Reading a signed-in session snapshot re-reads the capability flags from /v1/auth/me in the background once they are a minute old. Acting on a permission waits for that read through freshCredential(signal), which can be cancelled. This covers agent requests, agent creation and Decisions. Gates only read flags; they no longer refresh by hand.
• Each sign-in shares one in-flight request and a one-minute cache, including failed attempts. Previous permissions are kept on HTTP, network or parsing failures. Credential identity, app viewers and the profile read at sign-in are preserved.
• Builderlab stays registered as a Decisions provider while you are signed in. Without access it reports needs-setup, and its settings say decisions are unavailable for this account. While it re-reads a refusal it reports checking.
• Decisions default routing: the first default that can answer (ready or unconfirmed) answers. When none can, TypeSafe is the provider, since adding its key is something the user can do. The status is checking while another default is still finding out. A request waits for checking within its deadline, as Attention readiness already did. A checking Builderlab therefore never moves the selection or delays TypeSafe.
• Communities keeps its own account read, as on main.
• Development broker: reloads keep refreshed flags and their cache age. Capability reads are fenced to the expected revision and aborted with their session. Sign-in and capability checks share one flag parser.

Reviewer highlights

• Compared with this PR's earlier revision (gate-level refresh), there are about 2 refresh points instead of about 14. The registerProviderDiscovery/refreshProviders plugin API and its routing and readiness special cases are removed. The Decisions Settings refresh no longer depends on an unstable active prop.
• Behavior changes to review:
  • Signed-in users without Decisions access now see Builderlab in Settings → Decisions API, marked unavailable.
  • If Builderlab is explicitly chosen and access is lost, requests fail as unauthorized instead of falling back.
  • If another provider is explicitly chosen, a new Builderlab grant is noticed the next time Builderlab's status is read.
  • Reading the session can start a background /auth/me read, at most once a minute. There is no timer.
• Native and broker sessions fence late results to the original sign-in. Urgent Stop starts a refresh without waiting for it.

Validation

• pnpm typecheck and pnpm lint are clean.
• Full vitest run at a4fd6f57: 1,031 of 1,040 files pass and 8 are skipped. The one failure, MediaDownloadAction.test.tsx, passes when run alone, and this PR doesn't touch it. Pre-push hooks passed.
• Coverage includes:
  • The one-minute boundary, concurrent reads, cancellation during a re-read, failure retention, account switches and disposal.
  • The broker HTTP route and the reload cache.
  • New grants picked up through Settings, through a request, and with another provider chosen.
  • Attention classifying with a new grant and no TypeSafe key.
  • Routing: the first default that can answer, the TypeSafe fallback when none can, a checking default not moving the selection or holding a request when another can answer, and no dispatch after the deadline.
• No browser journeys added or removed; this change uses service tests and mounted React integration tests.

Deferred acceptance

• Native app exercise, human acceptance, and rendered checks of the Decisions Settings change (both themes, narrow/wide, enlarged text, keyboard/pointer) are still pending.

[kalvinnchau]

🤖 Three capability-refresh regressions need attention; details inline.

[kalvinnchau]

🤖 One reproduced sign-out regression and one maintenance finding remain; the three previously reported repair paths are addressed.

[baxen]

🤖 Reviewed at a4fd6f5. Permissions now stay fresh in the session, so gates just read flags and only acting paths (agent requests, agent creation, Decisions) wait for a re-check, cancellably. The provider-discovery API is gone; Decisions routing picks the first default that can answer and falls back to TypeSafe, so a re-check without access no longer flips the selected provider. Typecheck clean; builderlab, decisions, agents, attention and browser-host suites pass locally (2,307 tests). The CI failures on the first run were GitHub 504s fetching pnpm/hermit, not test failures.