@internetarchive/ia-book-actions 1.4.4-alpha13 → 1.4.4-alpha15

package/index.html

@@ -360,7 +360,33 @@
       });
     });
 
-    
+    // WEBDEV-8322 repro: fail only create_token (via ?failAction=create_token),
+    // leaving renew_loan (and every other action) succeeding normally —
+    // see actions-handler-service.js's shouldReturnError.
+    document.querySelectorAll('.failCreateToken input[type=checkbox]').forEach((item) => {
+      if (window.location.href.indexOf('?failAction=create_token') !== -1) {
+        item.checked = true;
+      }
+      item.addEventListener('click', (e) => {
+        console.log(`[Demo] fail-create_token-only mode ${e.target.checked ? 'enabled' : 'disabled'}`);
+
+        var searchParams = new URLSearchParams(window.location.search);
+        var separate = '';
+        if (e.target.checked) {
+          separate = '?';
+          searchParams.set('failAction', 'create_token');
+        } else {
+          separate = '';
+          searchParams.delete('failAction');
+        }
+
+        if (history.pushState) {
+          var newurl = window.location.protocol + "//" + window.location.host + window.location.pathname + separate + searchParams;
+          window.history.pushState({path:newurl},'',newurl);
+        }
+      });
+    });
+
     document.querySelectorAll('.userState input[type=checkbox]').forEach((item) => {
       item.addEventListener('click', (e) => {
         if (e.target.checked) {
@@ -726,6 +752,17 @@
                 </span>
               </td>
             </tr>
+            <tr colspan='5'>
+              <td class="failCreateToken">
+                <label><input type="checkbox" name="failCreateToken" value="failCreateToken" />Fail create_token only (renew_loan still succeeds)</label>
+                <span style="color: #666; font-size: 11px; display: block; padding: 0 10px 10px;">
+                  WEBDEV-8322 repro: unlike the checkbox above, this leaves renew_loan
+                  succeeding and fails only the create_token call right after it — turn
+                  this on, then run scenario 2 → 3 (or 2 → 4) below. Expect the error
+                  modal, and the bar/timer resetting to Borrow/0 (no retry).
+                </span>
+              </td>
+            </tr>
             <tr>
               <td class="userState">
                 <label><input type="checkbox" name="user" value="isAdmin" />isAdmin</label>

package/package.json

@@ -7,7 +7,7 @@
   },
   "author": "Internet Archive",
   "license": "AGPL-3.0-only",
-  "version": "1.4.4-alpha13",
+  "version": "1.4.4-alpha15",
   "main": "index.js",
   "module": "index.js",
   "publishConfig": {

package/src/core/services/actions-handler/actions-handler-service.js

@@ -18,7 +18,6 @@ export default async function ActionsHandlerService(options) {
   let baseHost = '/services/loans/loan';
   const location = window?.location;
 
-  // return error reponse when not production and has ?error=true param...
   const tokenError = 'loan token not found. please try again later.';
   const borrowError =
     'This book is not available to borrow at this time. Please try again later.';
@@ -29,9 +28,18 @@ export default async function ActionsHandlerService(options) {
     'renew_loan',
     'return_loan',
   ];
+  const searchParams = new URLSearchParams(location?.search);
+  // ?error=true fails every erroneous action (e.g. simulates the book
+  // already being borrowed by someone else). ?failAction=create_token (or
+  // any action name) fails ONLY that action, so a renew_loan can succeed
+  // and the immediately-following create_token can be made to fail —
+  // reproducing WEBDEV-8322's "renewed, but create_token failed" bug
+  // without needing a real book.
   const shouldReturnError =
-    new URLSearchParams(location?.search).get('error') === 'true' &&
-    location?.hostname !== 'archive.org';
+    location?.hostname !== 'archive.org' &&
+    erroneousActions.includes(option?.action) &&
+    (searchParams.get('error') === 'true' ||
+      searchParams.get('failAction') === option?.action);
 
   const testHostname = ['localhost', 'internetarchive.github.io'];
   let isTest = false;
@@ -51,7 +59,7 @@ export default async function ActionsHandlerService(options) {
     })
       .then(async response => {
         // intentional error on localhost
-        if (shouldReturnError && erroneousActions.includes(option?.action)) {
+        if (shouldReturnError) {
           return {
             success: false,
             error: option?.action === 'create_token' ? tokenError : borrowError,

package/src/core/services/loan-token-poller.js

@@ -19,26 +19,6 @@ export class LoanTokenPoller {
 
     this.loanTokenInterval = undefined;
 
-    /**
-     * Lending::do_renew() (backend) deletes the old loan record and
-     * writes a brand-new one on every renewal — this poller's initial
-     * create_token call (fired right after a renewal re-establishes the
-     * reading session) can race that write's propagation and come back
-     * with "you do not currently have this book borrowed" even though
-     * the loan is genuinely valid. Retry a few times with backoff instead
-     * of giving up on the first attempt.
-     */
-    this.maxTokenRetries = 3;
-    this.tokenRetryDelay = 1000; // ms, multiplied by attempt number
-
-    /**
-     * Handle for a pending retry, so teardown can cancel it. It's a bare
-     * setTimeout rather than an IALendingIntervals entry, so without this
-     * a retry scheduled just before the loan is returned would still fire
-     * its create_token afterwards.
-     */
-    this.retryTimeout = undefined;
-
     /**
      * loan analytics instance
      * @see loan-analytics.js
@@ -50,8 +30,6 @@ export class LoanTokenPoller {
 
   disconnectedCallback() {
     window?.IALendingIntervals?.clearTokenPoller();
-    clearTimeout(this.retryTimeout);
-    this.retryTimeout = undefined;
   }
 
   async bookAccessed() {
@@ -84,24 +62,21 @@ export class LoanTokenPoller {
   /**
    * @param {boolean} isInitial - the first create_token call right after
    *   bookAccessed()/a renewal, as opposed to a routine interval tick.
-   * @param {number} retryCount - internal, counts retries of the initial call.
    */
-  async handleLoanTokenPoller(isInitial = false, retryCount = 0) {
+  async handleLoanTokenPoller(isInitial = false) {
     const action = 'create_token';
     log('[LoanTokenPoller] create_token requested', {
       identifier: this.identifier,
       isInitial,
-      retryCount,
     });
     ActionsHandlerService({
       identifier: this.identifier,
       action,
-      error: data => this.handleTokenError(data, isInitial, retryCount),
+      error: data => this.handleTokenError(data, isInitial),
       success: () => {
         log('[LoanTokenPoller] create_token succeeded', {
           identifier: this.identifier,
           isInitial,
-          retryCount,
         });
         if (isInitial) this.successCallback();
       },
@@ -109,58 +84,23 @@ export class LoanTokenPoller {
   }
 
   /**
-   * Decide whether a create_token failure should be retried (a stale
-   * read of the loan record right after a renewal, see the constructor
-   * comment) or reported via errorCallback. Split out from
+   * Reports a create_token failure via errorCallback — no retry, it's
+   * treated as terminal on the first failure. Split out from
    * handleLoanTokenPoller so it's directly testable without needing to
    * mock the network call.
    *
    * @param {Object} data - the error payload from ActionsHandlerService.
    * @param {boolean} isInitial
-   * @param {number} retryCount
    */
-  handleTokenError(data, isInitial, retryCount) {
+  handleTokenError(data, isInitial) {
     const action = 'create_token';
-    const isStaleLoanReadError =
-      typeof data?.error === 'string' &&
-      /do not currently have this book borrowed/i.test(data.error);
 
     log('[LoanTokenPoller] create_token failed', {
       identifier: this.identifier,
       isInitial,
-      retryCount,
-      isStaleLoanReadError,
       error: data?.error,
     });
 
-    // The renewal write can be mid-propagation for an interval refresh too,
-    // not just the initial call — a routine tick landing moments after a
-    // renewal hits the same race. Retry both; isInitial only decides how a
-    // final failure is reported, not whether it's worth retrying.
-    if (isStaleLoanReadError && retryCount < this.maxTokenRetries) {
-      const delay = this.tokenRetryDelay * (retryCount + 1);
-      log(
-        '[LoanTokenPoller] retrying create_token after stale-loan-read error',
-        {
-          identifier: this.identifier,
-          nextRetryCount: retryCount + 1,
-          delay,
-        }
-      );
-      clearTimeout(this.retryTimeout);
-      this.retryTimeout = setTimeout(() => {
-        this.retryTimeout = undefined;
-        this.handleLoanTokenPoller(isInitial, retryCount + 1);
-      }, delay);
-      return;
-    }
-
-    log('[LoanTokenPoller] giving up on create_token, reporting error', {
-      identifier: this.identifier,
-      isInitial,
-      retryCount,
-    });
-
     // isInitial rides along so the consumer can distinguish "the book won't
     // open at all" from "a mid-read refresh blipped" — see
     // IABookActions.handleLendingActionError.

package/src/ia-book-actions.js

@@ -97,24 +97,17 @@ export default class IABookActions extends LitElement {
     this.loanRenewInProgress = false;
 
     /**
-     * True while a renewal in flight is recovering from a loan that
-     * genuinely lapsed (set by autoRenewExpiredLoan), as opposed to a
-     * routine pre-expiry top-up. Only the recovery case needs BookReader
-     * re-initialized once the renewal is confirmed — see
+     * True while recovering from a loan that genuinely lapsed (set by
+     * autoRenewExpiredLoan), as opposed to a routine pre-expiry top-up.
+     * Only the recovery case needs BookReader re-initialized — see
      * handleLoanAutoRenewed.
      */
     this.recoveringFromLoanExpiry = false;
 
     this.warningModalOpen = false;
 
-    /**
-     * Once the patron has seen & dismissed the informational warning modal,
-     * don't nag them again with the same modal every timer tick — only a
-     * real renewal (via interacting with the book) clears this, giving the
-     * next pre-expiry window its own single warning.
-     * @see loanRenewAttempt
-     * @see handleLoanAutoRenewed
-     */
+    /** Once dismissed, don't re-show the warning modal every tick — only
+     * a real renewal (handleLoanAutoRenewed) re-arms it. */
     this.warningModalDismissed = false;
 
     /**
@@ -148,9 +141,9 @@ export default class IABookActions extends LitElement {
   }
 
   disconnectedCallback() {
-    // clear all intervals for lending system
+    super.disconnectedCallback();
     window?.IALendingIntervals?.clearAll();
-
+    this.tokenPoller?.disconnectedCallback();
     this.sentryCaptureMsg(sentryLogs.disconnectedCallback);
     this.disconnectResizeObserver();
   }
@@ -189,12 +182,8 @@ export default class IABookActions extends LitElement {
     }
 
     if (changed.has('loanRenewResult') && this.loanRenewResult.renewNow) {
-      // Any renewal — not just the auto-return recovery path — pauses the
-      // countdown for the renew_loan round-trip. Flag it here, centrally,
-      // so every path (interaction during active reading, periodic
-      // checker, auto-return recovery) gets the same "renewing" signal
-      // instead of just looking frozen until handleLoanAutoRenewed() clears
-      // this and restarts the timer.
+      // Pause the countdown for the renew_loan round-trip, for every
+      // renewal path — cleared by handleLoanAutoRenewed().
       this.loanRenewInProgress = true;
       window.IALendingIntervals.clearAll();
     }
@@ -269,13 +258,8 @@ export default class IABookActions extends LitElement {
       'browsingExpired' in this.lendingStatus &&
       this.lendingStatus?.browsingExpired;
     if (hasExpired) {
-      // Per the ticket, auto-return must not visibly change anything — the
-      // action bar stays exactly as it looked while reading. But that only
-      // applies when there IS a rendered bar to preserve. On a fresh page
-      // load of an already-expired loan nothing has been computed yet, so
-      // skipping this would leave the patron staring at a blank bar with no
-      // way to re-borrow. In that case compute the normal (Borrow) actions
-      // before short-circuiting the rest of the lifecycle below.
+      // Auto-return must not visibly change the bar — unless nothing's
+      // rendered yet (fresh load of an already-expired loan).
       if (this.primaryActions?.length) {
         log('[IABookActions] browsing expired — leaving action bar untouched');
       } else {
@@ -305,18 +289,18 @@ export default class IABookActions extends LitElement {
 
     if (!this.applyLendingActions()) return;
 
-    // Don't (re)start the countdown while a renewal is in flight — the
-    // optimistic browsingExpired flip in autoRenewExpiredLoan() (which
-    // triggers this same setupLendingToolbarActions() call) happens before
-    // renewal is confirmed, so secondsLeftOnLoan could still be a stale
-    // value from before the renewal. Wait for handleLoanAutoRenewed() to
-    // confirm the real value and clear loanRenewInProgress before showing
-    // a countdown again.
+    // primaryActions/borrowType/etc are plain fields, not reactive
+    // properties, so nothing pushes them to the rendered template (and
+    // from there to <collapsible-action-group>) on its own. Do that now,
+    // unconditionally — the early returns below (not borrowed, title bar)
+    // must not skip it, or the action bar visibly goes stale (e.g. a
+    // create_token failure resetting to Borrow never actually shows it).
+    this.requestUpdate();
+
+    // Don't (re)start the countdown mid-renewal — secondsLeftOnLoan could
+    // still be stale until handleLoanAutoRenewed() confirms it.
     if (this.borrowType === 'browsed' && !this.loanRenewInProgress) {
-      // start timer for loan-renew
       await this.startTimerCountdown();
-
-      // start timer for browsed.
       await this.startBrowseTimer();
     }
 
@@ -326,15 +310,8 @@ export default class IABookActions extends LitElement {
       return;
     }
 
-    /**
-     * tokenPoller determines if user has loan token for this book
-     * - if book is going to renew, need to wait until renew is completed:
-     *   loanRenewInProgress is set before renew_loan is even dispatched
-     *   (including the optimistic pre-confirmation window) and only
-     *   clears once the renewal is confirmed, so starting the poller here
-     *   mid-renewal would call create_token against the loan record
-     *   before it's actually renewed.
-     */
+    // Wait until any in-flight renewal is confirmed before (re)starting the
+    // poller, so create_token isn't called against a not-yet-renewed loan.
     setTimeout(() => {
       if (
         !hasExpired &&
@@ -345,29 +322,12 @@ export default class IABookActions extends LitElement {
         this.startLoanTokenPoller();
       }
     }, 100);
-
-    this.requestUpdate();
   }
 
   /**
-   * Is this `BookReader:userAction` BookReader's own init-time jump to the
-   * patron's last-read page, rather than something the patron just did?
-   *
-   * BookReader.updateFirstIndex() fires `userAction` unconditionally, and
-   * init() reaches it via updateFromParams() — so a plain page refresh
-   * looks identical to a page turn. Auto-renewing off that would silently
-   * re-borrow a lapsed book with no patron input at all.
-   *
-   * BookReader.trigger() passes the BookReader instance as
-   * `event.detail.props`, and init() holds `init.initComplete === false`
-   * for exactly the span that contains that init-time jump, setting it to
-   * true immediately before firing PostInit. So the flag is an exact,
-   * timing-independent marker of "this came from init".
-   *
-   * Only an explicit `false` suppresses the event: a BookReader too old to
-   * expose the flag, or a synthetic event with no detail, must still be
-   * treated as a genuine interaction.
-   *
+   * Is this BookReader's own init-time jump to the last-read page, rather
+   * than a real patron interaction (which fires the identical event)? Only
+   * an explicit `false` counts; a missing flag must be treated as real.
    * @param {Event} event - the BookReader:userAction event
    * @returns {boolean}
    */
@@ -393,14 +353,9 @@ export default class IABookActions extends LitElement {
         return;
       }
 
-      // Capture before autoRenewExpiredLoan() runs — it synchronously flips
-      // lendingStatus.browsingExpired to false as an optimistic UI update,
-      // so checking the live property afterward would always see it as
-      // false and wrongly let autoLoanRenewChecker() run too. That second
-      // call would then overwrite loanRenewResult.renewNow (set true by
-      // autoRenewExpiredLoan) back to false, since the loanTime cache entry
-      // was already deleted by browseHasExpired() — silently killing the
-      // in-flight renewal and leaving the countdown stuck.
+      // Capture before autoRenewExpiredLoan() runs — it optimistically
+      // flips browsingExpired to false, which would otherwise also let
+      // autoLoanRenewChecker() run and clobber the in-flight renewal.
       const wasExpired = this.lendingStatus.browsingExpired;
 
       log('[IABookActions] BookReader:userAction received', {
@@ -408,7 +363,6 @@ export default class IABookActions extends LitElement {
         browsingExpired: wasExpired,
       });
 
-      // If the loan expired while the tab stayed visible, auto-renew on page turn
       if (wasExpired) {
         this.autoRenewExpiredLoan();
       }
@@ -418,11 +372,8 @@ export default class IABookActions extends LitElement {
       }
     });
 
-    /**
-     * auto-renew interval may stale when tab is in background,
-     * so when user open that tab again,
-     * the [visibilitychange] event can trigger timer to show relavent messages
-     */
+    // A tab in the background can have its intervals throttled/paused, so
+    // re-check status when the patron comes back to it.
     document.addEventListener('visibilitychange', async () => {
       if (document.hidden) {
         log('[IABookActions] visibilitychange: tab backgrounded');
@@ -454,14 +405,9 @@ export default class IABookActions extends LitElement {
           if (secondsLeft >= this.timerExecutionSeconds) {
             this.loanStatusCheckInterval(Number(secondsLeft));
           } else {
-            // Loan expired while user was away — try to silently renew.
-            // Only stop the stale intervals here; this used to call
-            // disconnectedCallback(), which was harmless back when the
-            // following modal navigated away, but the reading session now
-            // continues. Tearing down would drop the resize observer for
-            // good (it's only re-added on firstUpdated / sharedObserver
-            // change), leaving the bar unable to respond to viewport
-            // changes, and would report a bogus disconnect to Sentry.
+            // Loan expired while away — silently renew. Only clear
+            // intervals; disconnectedCallback() would drop the resize
+            // observer for a session that's still continuing.
             window?.IALendingIntervals?.clearAll();
             this.autoRenewExpiredLoan();
           }
@@ -481,14 +427,8 @@ export default class IABookActions extends LitElement {
    * @param {Boolean} hasPageChanged
    */
   async autoLoanRenewChecker(hasPageChanged = false) {
-    // Guards against re-entrancy the same way autoRenewExpiredLoan() does.
-    // BookReader:userAction can fire several times in quick succession
-    // (e.g. a single scroll gesture), and this method has no debouncing of
-    // its own — without this guard, each event would spin up its own
-    // LoanRenewHelper concurrently, and whichever's async localCache reads
-    // resolve last would clobber this.loanRenewResult, potentially
-    // re-triggering the whole renew_loan/create_token flow while a
-    // renewal from an earlier event is already in flight or just landed.
+    // Re-entrancy guard against rapid BookReader:userAction events (e.g. a
+    // single scroll firing several in quick succession).
     if (this.loanRenewInProgress) return;
 
     this.loanRenewHelper = new LoanRenewHelper(
@@ -503,21 +443,15 @@ export default class IABookActions extends LitElement {
   }
 
   /**
-   * Attempt to automatically renew a browse loan that has expired.
-   * Called on visibilitychange (user returns to tab) or on page turn when
-   * the loan has expired but the book may still be available.
-   *
-   * Reuses the same renew_loan path as the automatic loan-renew checker.
-   * On success: handleLoanAutoRenewed() resets the timer seamlessly.
-   * On error: handleLendingActionError() shows showLoanUnavailableModal().
+   * Silently attempt to renew a browse loan that has expired, on
+   * visibilitychange or a page turn. handleLoanAutoRenewed()/
+   * handleLendingActionError() handle the outcome either way.
    */
   autoRenewExpiredLoan() {
     if (this.loanRenewInProgress) {
       log(
         '[IABookActions] autoRenewExpiredLoan: skipped, renewal already in progress',
-        {
-          identifier: this.identifier,
-        }
+        { identifier: this.identifier }
       );
       return;
     }
@@ -529,16 +463,8 @@ export default class IABookActions extends LitElement {
 
     this.modal?.closeModal();
 
-    // Optimistically flip browsingExpired back to false so the action bar
-    // stays red (patronIsReadingAction) while the renew_loan request is in
-    // flight, instead of showing the blue "Borrow" state. Deliberately NOT
-    // resetting secondsLeftOnLoan here — the renewal hasn't been confirmed
-    // yet (it can take several seconds, or genuinely fail), so showing a
-    // full hour before we know the outcome would be misleading. The real
-    // value is set once handleLoanAutoRenewed() confirms success;
-    // loanRenewInProgress (already true above) is the signal consumers
-    // should use to show a "renewing" state instead of trusting the
-    // countdown during this window.
+    // Optimistically flip browsingExpired so the bar stays in the reading
+    // state during the renew_loan round-trip, instead of showing "Borrow".
     this.lendingStatus = {
       ...this.lendingStatus,
       browsingExpired: false,
@@ -572,7 +498,6 @@ export default class IABookActions extends LitElement {
 
     log('[IABookActions] showWarningModal');
 
-    // Capture texts and secondsLeft before resetting loanRenewResult
     const {
       texts: warningTexts,
       secondsLeft: rawSecondsLeft,
@@ -584,7 +509,6 @@ export default class IABookActions extends LitElement {
       secondsLeft = secondsLeft > 60 ? secondsLeft : 60;
     }
 
-    // clear modal and reset renew state
     this.modal.customModalContent = nothing;
     this.modal?.closeModal();
     this.loanRenewResult = { texts: '', renewNow: false };
@@ -666,9 +590,8 @@ export default class IABookActions extends LitElement {
       'This book has been returned due to inactivity.';
 
     this.modal?.closeModal();
-    // We just closed whatever was on screen, including the warning modal —
-    // release the re-entrancy guard so a later pre-expiry window can show
-    // it again. Otherwise it stays latched for the life of the component.
+    // Release the warning-modal re-entrancy guard, or it stays latched for
+    // the life of the component.
     this.warningModalOpen = false;
 
     this.sentryCaptureMsg(sentryLogs.browseHasExpired);
@@ -776,31 +699,16 @@ export default class IABookActions extends LitElement {
   }
 
   /**
-   * Execute after auto loan renewed is completed
-   * - show success message
-   * - then change the remaining time
-   * - reset timer state
+   * Runs after a loan renewal completes (successfully or not): shows the
+   * outcome, updates the remaining time, and resets renewal-in-flight state.
    * @param {object} event
    */
   async handleLoanAutoRenewed({ detail }) {
     const activeLoan = detail?.data?.loan;
 
-    /**
-     * Defensive: ActionsHandler only dispatches this event for a CONFIRMED
-     * renewal, but treat anything else as a failure rather than a success.
-     *
-     * A `renewal: false` loan reaching the success path below is actively
-     * harmful: setBrowseTimeSession() never ran, so the loanTime read comes
-     * back undefined, and the NaN fallback then invents a full fresh hour —
-     * putting a brand-new countdown on screen alongside the "someone else
-     * has now borrowed it" modal.
-     *
-     * Clearing loanRenewInProgress here matters just as much. Leaving it set
-     * latches the component: autoLoanRenewChecker() and
-     * autoRenewExpiredLoan() both no-op on it, and neither the countdown nor
-     * the token poller will restart — the loan sits "active" forever with a
-     * dead timer.
-     */
+    // Treat anything but a confirmed renewal as a failure, or
+    // loanRenewInProgress stays latched forever (autoLoanRenewChecker/
+    // autoRenewExpiredLoan both no-op on it).
     if (!activeLoan?.renewal) {
       this.loanRenewInProgress = false;
       this.recoveringFromLoanExpiry = false;
@@ -816,7 +724,6 @@ export default class IABookActions extends LitElement {
     }
 
     if (this.loanRenewResult.renewNow) {
-      // Now, let's reset loan duration & this.lendingStatus
       const loanTime = await this.localCache.get(`${this.identifier}-loanTime`);
 
       // number of seconds left in current loan
@@ -834,19 +741,8 @@ export default class IABookActions extends LitElement {
       });
 
       if (this.recoveringFromLoanExpiry) {
-        // The loan genuinely lapsed, and renew_loan has now CONFIRMED it's
-        // renewed server-side — only now is it safe to let BookReader
-        // re-initialize (create_token was minting its access cookie off
-        // the loan's expiry; doing this before confirmation risked reading
-        // the still-expired record). loanRenewInProgress already kept the
-        // token poller from restarting early, so it'll pick up fresh here
-        // once lendingStatus below re-triggers setupLendingToolbarActions().
-        // recoveringFromLoanExpiry itself is consumed/reset there, not
-        // here — this ONLY applies to an actual recovery, not a routine
-        // renewal (re-running br.init() on every routine top-up would be
-        // needlessly disruptive). create_token's own retry logic (see
-        // LoanTokenPoller) handles the datanode write-propagation race
-        // for both recovery and routine renewals.
+        // Only now is it safe to re-initialize BookReader — not for a
+        // routine top-up, where that would be disruptive.
         this.postInitComplete = false;
       }
 
@@ -870,46 +766,34 @@ export default class IABookActions extends LitElement {
     this.loanRenewInProgress = false;
   }
 
-  /**
-   * start timer countdown interval after loan auto-renewed
-   *
-   * @memberof IABookActions
-   */
+  /** Start the countdown interval; ticks read the live secondsLeftOnLoan
+   * each time rather than a value frozen at start, so drift can't compound
+   * across ticks (see loanStatusCheckInterval). */
   async startTimerCountdown() {
     window?.IALendingIntervals?.clearTimerCountdown();
-
-    const secondsLeft = Number(this.lendingStatus.secondsLeftOnLoan);
     this.timeWhenTimerStart = new Date();
 
     window.IALendingIntervals.timerCountdown = setInterval(async () => {
-      // interval execution block
-      await this.loanStatusCheckInterval(secondsLeft);
+      await this.loanStatusCheckInterval(
+        Number(this.lendingStatus.secondsLeftOnLoan)
+      );
     }, this.timerExecutionSeconds * 1000);
   }
 
   /**
-   * setInterval execution function do following things
-   * - if setInterval timer gone off, let's resync
-   * - loan-renew attempt to renew the loan OR show relavant message
-   * - if loan has expired, clear interval timers
-   *
+   * Runs on every countdown tick: resyncs against wall-clock time, attempts
+   * a renewal near expiry, and clears the timers once the loan expires.
    * @param {Number} secondsLeftOnLoan
    */
   async loanStatusCheckInterval(secondsLeftOnLoan) {
     let secondsLeft = secondsLeftOnLoan;
     secondsLeft -= this.timerExecutionSeconds;
-    secondsLeft = Math.round(secondsLeft); // round number
+    secondsLeft = Math.round(secondsLeft);
 
-    // re-sync timer if gone off because of background window
-    // side effect: updates this.lendingStatus & kicks off lifecycle,
-    // if really updated, escape from here
     const resyncd = this.reSyncTimerIfGoneOff(secondsLeft);
-
     if (resyncd.hasSynced) {
       secondsLeft = resyncd.whatShouldLeft;
-      log('[IABookActions] timer: timer re-synced', {
-        secondsLeft,
-      });
+      log('[IABookActions] timer: timer re-synced', { secondsLeft });
     }
 
     log('[IABookActions] timer', {
@@ -917,19 +801,20 @@ export default class IABookActions extends LitElement {
       whatIsleft: secondsLeft,
     });
 
-    /**
-     * execute from last 10th minutes to 0th minute
-     * - 10th - to check if user has viewed
-     * - till 0th - to show warning msg with remaining time to auto expired
-     * @see IABookActions::bindLoanRenewEvents
-     */
+    // Re-anchor every tick so drift from wall-clock time can't compound
+    // across ticks that don't happen to trigger a resync above.
+    this.timeWhenTimerStart = new Date();
+    this.lendingStatus = { ...this.lendingStatus, secondsLeftOnLoan: secondsLeft };
+
+    // 10 minutes out: start checking for a renewal. 0: show the "about to
+    // auto-return" warning. @see IABookActions::bindLoanRenewEvents
     if (secondsLeft <= this.loanRenewTimeConfig.loanRenewAtLast) {
       await this.loanRenewAttempt(secondsLeft);
     }
 
-    // clear interval in secondsLeft if less
     if (secondsLeft <= this.timerExecutionSeconds) {
-      this.disconnectedCallback();
+      window?.IALendingIntervals?.clearAll();
+      this.tokenPoller?.disconnectedCallback();
       this.sentryCaptureMsg(sentryLogs.clearOneHourTimer);
     }
   }
@@ -984,13 +869,8 @@ export default class IABookActions extends LitElement {
    */
   async loanRenewAttempt(secondsLeft) {
     let loanSecondsLeft = secondsLeft;
-    /**
-     * auto-renew is not possible in last seconds (let say 50 second) because,
-     * 1. less time to execute ajax call
-     * 2. less time to write loan on datanodes
-     * 3. less time to load images by create_token api
-     * so if seconds left is < 50, just expire the loan
-     */
+    // Under 50s left there isn't enough time for the renew_loan round-trip
+    // and create_token to load images, so just expire the loan.
     if (loanSecondsLeft < 50) {
       log('[IABookActions] loanRenewAttempt: < 50s left, expiring loan');
       await this.browseHasExpired();
@@ -999,17 +879,13 @@ export default class IABookActions extends LitElement {
 
     await this.autoLoanRenewChecker(false);
 
-    // show warning modal with remaining time to auto returned it.
-    // once the patron has dismissed it, don't re-show it on every subsequent
-    // tick — only an actual renewal (see handleLoanAutoRenewed) re-arms it.
+    // Once dismissed, don't re-show the warning on every subsequent tick —
+    // only an actual renewal (handleLoanAutoRenewed) re-arms it.
     if (
       this.loanRenewResult.renewNow === false &&
       !this.warningModalDismissed
     ) {
-      /**
-       * so compensate for the 50 second buffer to handle above race conditions
-       * let's reduce 1 min from warning texts and early return the book when 1 min left.
-       */
+      // Compensate for the 50s buffer above by warning a minute early.
       loanSecondsLeft -= 60;
       this.loanRenewResult.secondsLeft = loanSecondsLeft;
 
@@ -1032,17 +908,9 @@ export default class IABookActions extends LitElement {
       this.handleLendingActionError(eventObj);
     };
 
-    /**
-     * LoanTokenPoller is a class that polls the loan token
-     * it takes 5 params
-     * 1. this.identifier
-     * 2. this.borrowType
-     * 3. successCallback - it used to
-     *    - disptach lendingFlow::PostInit event
-     *    - initialize bookreader using br.init()
-     * 4. errorCallback
-     * 5. tokenPollerDelay
-     */
+    // Tear down any previous poller first, so only one is ever controlling
+    // window.IALendingIntervals.tokenPoller at a time.
+    this.tokenPoller?.disconnectedCallback();
     this.tokenPoller = new LoanTokenPoller(
       this.identifier,
       this.borrowType,
@@ -1062,13 +930,12 @@ export default class IABookActions extends LitElement {
   }
 
   /**
-   * handle lending errors occure during different operation like
-   * browse book, borrow book, borrowed book token etc...
-   *
+   * Handles lending errors from any action (browse_book, borrow_book,
+   * create_token, renew_loan, etc).
    * @event IABookActions#lendingActionError
-   * @param {Object} event - The employee who is responsible for the project
-   *  @param {string} event.detail.action - action when error occurred like 'browseBook', 'borrowBook'
-   *  @param {string} event.detail.data.error - error message
+   * @param {Object} event
+   * @param {string} event.detail.action
+   * @param {string} event.detail.data.error
    */
   handleLendingActionError(event) {
     this.disableActionGroup = false;
@@ -1087,42 +954,29 @@ export default class IABookActions extends LitElement {
     });
 
     if (action === 'create_token') {
-      // A create_token hiccup only affects BookReader's page-image access
-      // token — it says nothing about how much time is left on the loan
-      // itself, so it must not stop the reading countdown. Only clear the
-      // token poller so it can be retried.
-      window?.IALendingIntervals?.clearTokenPoller();
-
-      /**
-       * Only the INITIAL token matters to the patron: without it BookReader
-       * can't be initialized at all, so the book genuinely won't open and
-       * they need to know. A routine interval refresh failing is a
-       * different thing — the patron is already reading, the pages they
-       * have are still served, and LoanTokenPoller will try again on the
-       * next tick. Interrupting a mid-read session with a blocking modal
-       * over a transient blip (the recurring 405s QA is seeing, say) is
-       * worse than the blip. This is why the original code suppressed
-       * create_token errors outright; keep that for the interval case.
-       */
+      // Only the INITIAL token matters enough to interrupt the patron — a
+      // routine interval refresh stays silent; the pages already loaded
+      // are still served, and the next scheduled poll tries again on its
+      // own without any special retry.
       if (!isInitial) {
         log(
-          '[IABookActions] create_token failed on interval refresh — staying silent, poller will retry'
+          '[IABookActions] create_token failed on interval refresh — staying silent'
         );
         return;
       }
 
-      // The loan itself is fine — just the token failed — but the action
-      // bar must reflect that the book isn't openable right now rather
-      // than silently doing nothing.
+      // The book never opened, and we don't retry — reset the bar to
+      // Borrow and the timer to 0 rather than leaving a red "Return now"
+      // with a stale countdown for a session that isn't accessible.
+      window?.IALendingIntervals?.clearAll();
+      this.tokenPoller?.disconnectedCallback();
       this.lendingStatus = {
         ...this.lendingStatus,
         user_has_browsed: false,
         available_to_browse: true,
+        secondsLeftOnLoan: 0,
       };
 
-      // LoanTokenPoller has already exhausted its retries for the
-      // transient datanode-propagation race by the time we get here (or
-      // the error was never that), so this is a genuine failure.
       // showErrorModal has dedicated create_token messaging (refresh
       // button + support email).
       if (errorMsg) this.showErrorModal(errorMsg, action);
@@ -1131,11 +985,8 @@ export default class IABookActions extends LitElement {
       this.loanRenewInProgress = false;
       this.recoveringFromLoanExpiry = false;
 
-      // The loan was NOT actually renewed — reflect that immediately
-      // (show Borrow, and clear the stale timer value) instead of leaving
-      // the action bar showing "Return now" with a frozen countdown from
-      // before the failed attempt, which falsely implies the book is
-      // still actively being read.
+      // The loan was NOT renewed — reflect that immediately (show Borrow,
+      // clear the stale timer) rather than leaving a frozen "Return now".
       this.lendingStatus = {
         ...this.lendingStatus,
         user_has_browsed: false,
@@ -1143,11 +994,8 @@ export default class IABookActions extends LitElement {
         secondsLeftOnLoan: 0,
       };
 
-      // Show the real error and refresh the page on dismissal (the
-      // modal's Okay button) so the client picks up whatever the server
-      // now authoritatively considers true — matching on "not available"
-      // to guess the reason was fragile since the server can return any
-      // message (e.g. a lending limit).
+      // Refresh the page on dismissal so the client picks up whatever the
+      // server now authoritatively considers true (any error message).
       this.showLoanUnavailableModal(errorMsg);
     } else {
       // Every other action failure genuinely affects loan state.

package/test/core/services/loan-token-poller.test.js

@@ -1,4 +1,4 @@
-import { expect, aTimeout } from '@open-wc/testing';
+import { expect } from '@open-wc/testing';
 import Sinon from 'sinon';
 
 import { LoanTokenPoller } from '../../../src/core/services/loan-token-poller.js';
@@ -57,15 +57,9 @@ describe('Get Loan Token', () => {
   });
 });
 
-describe('handleTokenError retry (WEBDEV-8322 follow-up)', () => {
-  // Lending::do_renew() (backend) deletes the old loan record and writes
-  // a brand-new one on every renewal, so the initial create_token call
-  // right after a renewal can race that write's propagation and come
-  // back with this exact error even though the loan is genuinely valid.
-  const staleLoanReadError = {
-    error: 'You do not currently have this book borrowed.',
-  };
-
+describe('handleTokenError (no retry)', () => {
+  // A create_token failure is treated as terminal on the first attempt —
+  // no retry, whether it's the "stale loan read" race or anything else.
   const makeTokenPoller = () =>
     new LoanTokenPoller(
       'identifier1',
@@ -75,126 +69,43 @@ describe('handleTokenError retry (WEBDEV-8322 follow-up)', () => {
       2000
     );
 
-  it('retries the initial call on a stale-loan-read error instead of failing immediately', () => {
+  it('reports the error immediately, without retrying, on the initial call', () => {
     const tokenPoller = makeTokenPoller();
     const handleLoanTokenPollerSpy = Sinon.spy(
       tokenPoller,
       'handleLoanTokenPoller'
     );
     const errorCallbackSpy = Sinon.spy(tokenPoller, 'errorCallback');
-    const clock = Sinon.useFakeTimers();
-
-    try {
-      tokenPoller.handleTokenError(staleLoanReadError, true, 0);
-
-      expect(errorCallbackSpy.called).to.be.false;
-
-      clock.tick(tokenPoller.tokenRetryDelay);
-
-      expect(handleLoanTokenPollerSpy.calledWith(true, 1)).to.be.true;
-    } finally {
-      clock.restore();
-    }
-  });
-
-  it('gives up and calls errorCallback after exhausting retries', () => {
-    const tokenPoller = makeTokenPoller();
-    const errorCallbackSpy = Sinon.spy(tokenPoller, 'errorCallback');
 
     tokenPoller.handleTokenError(
-      staleLoanReadError,
-      true,
-      tokenPoller.maxTokenRetries
+      { error: 'You do not currently have this book borrowed.' },
+      true
     );
 
     expect(errorCallbackSpy.calledOnce).to.be.true;
+    expect(handleLoanTokenPollerSpy.called).to.be.false;
   });
 
-  it('retries a routine (non-initial) poll on the same error too', () => {
-    // A routine tick landing moments after a renewal hits the very same
-    // write-propagation race as the initial call, so it's equally worth
-    // retrying. isInitial only decides how a FINAL failure is reported.
-    const tokenPoller = makeTokenPoller();
-    const handleLoanTokenPollerSpy = Sinon.spy(
-      tokenPoller,
-      'handleLoanTokenPoller'
-    );
-    const errorCallbackSpy = Sinon.spy(tokenPoller, 'errorCallback');
-    const clock = Sinon.useFakeTimers();
-
-    try {
-      tokenPoller.handleTokenError(staleLoanReadError, false, 0);
-
-      expect(errorCallbackSpy.called).to.be.false;
-
-      clock.tick(tokenPoller.tokenRetryDelay);
-
-      expect(handleLoanTokenPollerSpy.calledWith(false, 1)).to.be.true;
-    } finally {
-      clock.restore();
-    }
-  });
-
-  it('does not retry a genuinely different error, even on the initial call', () => {
+  it('reports the error immediately on a routine (non-initial) poll too', () => {
     const tokenPoller = makeTokenPoller();
     const errorCallbackSpy = Sinon.spy(tokenPoller, 'errorCallback');
 
     tokenPoller.handleTokenError(
-      { error: 'loan token not found. please try again later.' },
-      true,
-      0
+      { error: 'You do not currently have this book borrowed.' },
+      false
     );
 
     expect(errorCallbackSpy.calledOnce).to.be.true;
   });
-});
-
-describe('LoanTokenPoller - WEBDEV-8322 review fixes', () => {
-  it('retries a stale-loan-read error on interval refreshes too, not just the initial call', async () => {
-    const poller = new LoanTokenPoller('foo', 'browsed', () => {}, () => {}, 120);
-    poller.disconnectedCallback(); // stop the real poller started in the ctor
-
-    const retrySpy = Sinon.stub(poller, 'handleLoanTokenPoller');
-    poller.tokenRetryDelay = 1;
-
-    poller.handleTokenError(
-      { error: 'you do not currently have this book borrowed' },
-      false, // interval refresh
-      0
-    );
-    await aTimeout(30);
-
-    expect(retrySpy.calledOnce).to.be.true;
-    expect(retrySpy.firstCall.args).to.deep.equal([false, 1]);
-    poller.disconnectedCallback();
-  });
 
   it('passes isInitial through to the error callback', () => {
     const errorCallback = Sinon.spy();
     const poller = new LoanTokenPoller('foo', 'browsed', () => {}, errorCallback, 120);
     poller.disconnectedCallback();
 
-    poller.handleTokenError({ error: 'something else went wrong' }, true, 0);
+    poller.handleTokenError({ error: 'something else went wrong' }, true);
 
     expect(errorCallback.calledOnce).to.be.true;
     expect(errorCallback.firstCall.args[0].detail.isInitial).to.be.true;
   });
-
-  it('cancels a pending retry on teardown', async () => {
-    const poller = new LoanTokenPoller('foo', 'browsed', () => {}, () => {}, 120);
-    const retrySpy = Sinon.stub(poller, 'handleLoanTokenPoller');
-    poller.tokenRetryDelay = 20;
-
-    poller.handleTokenError(
-      { error: 'you do not currently have this book borrowed' },
-      true,
-      0
-    );
-    expect(poller.retryTimeout).to.not.be.undefined;
-
-    poller.disconnectedCallback();
-    await aTimeout(60);
-
-    expect(retrySpy.called).to.be.false;
-  });
 });

package/test/ia-book-actions.test.js

@@ -1101,14 +1101,11 @@ describe('handleLendingActionError - create_token failures must not stop the cou
     expect(window.IALendingIntervals.timerCountdown).to.not.equal(0);
   });
 
-  it('shows the error modal for a create_token failure that reaches here (retries already exhausted)', async () => {
-    // By the time handleLendingActionError runs for a create_token
-    // failure, LoanTokenPoller has already retried and given up (see
-    // loan-token-poller.js's handleTokenError). For the INITIAL token
-    // that's terminal — BookReader can't be initialized and the book
-    // won't open — so the patron must be told rather than left staring
-    // at nothing. (An interval refresh failing is handled separately and
-    // stays silent; see the WEBDEV-8322 review fixes below.)
+  it('shows the error modal and resets to Borrow/0 on a failed INITIAL create_token (no retry)', async () => {
+    // For the INITIAL token, BookReader never got page images — the book
+    // never opened. We don't retry, so the bar must reflect that honestly
+    // (Borrow, 0 left) instead of staying red with a stale countdown for a
+    // session that isn't actually accessible.
     const el = await fixture(
       container({
         userid: '@user1',
@@ -1136,6 +1133,40 @@ describe('handleLendingActionError - create_token failures must not stop the cou
     expect(showErrorModalSpy.calledOnceWith(errorMsg, 'create_token')).to.be
       .true;
     expect(el.lendingStatus.user_has_browsed).to.be.false;
+    expect(el.lendingStatus.available_to_browse).to.be.true;
+    expect(el.lendingStatus.secondsLeftOnLoan).to.equal(0);
+  });
+
+  it('stops the countdown/expiry timers on a failed INITIAL create_token — nothing to read yet', async () => {
+    // Unlike the interval-refresh case above (pages already loaded, keep
+    // ticking), an initial create_token failure means BookReader never got
+    // page images and we're resetting the bar to Borrow — both timers
+    // should stop rather than keep counting down a dead session.
+    const el = await fixture(
+      container({
+        userid: '@user1',
+        identifier: 'foobar',
+        lendingStatus: {
+          user_has_browsed: true,
+          browsingExpired: false,
+          secondsLeftOnLoan: 100,
+        },
+      })
+    );
+    await el.updateComplete;
+    expect(window.IALendingIntervals.timerCountdown).to.not.equal(0);
+    expect(window.IALendingIntervals.browseExpireTimeout).to.not.equal(0);
+
+    el.handleLendingActionError({
+      detail: {
+        action: 'create_token',
+        isInitial: true,
+        data: { error: 'loan token not found. please try again later.' },
+      },
+    });
+
+    expect(window.IALendingIntervals.timerCountdown).to.equal(0);
+    expect(window.IALendingIntervals.browseExpireTimeout).to.equal(0);
   });
 
   it('still clears everything on a renew_loan failure', async () => {
@@ -1511,11 +1542,14 @@ describe('WEBDEV-8322 review fixes', () => {
     expect(el.lendingStatus.user_has_browsed).to.be.true;
   });
 
-  it('surfaces a failed initial create_token, which blocks opening the book', async () => {
+  it('tears down the previous poller before starting a new one', async () => {
+    // Regression: startLoanTokenPoller() always replaced this.tokenPoller
+    // without cancelling the old instance's pending internal retry timer,
+    // which could later fire against stale state.
     const el = await fixture(
       container({
         userid: '@user1',
-        identifier: 'token-initial',
+        identifier: 'poller-teardown',
         lendingStatus: {
           is_lendable: true,
           available_to_browse: true,
@@ -1526,7 +1560,34 @@ describe('WEBDEV-8322 review fixes', () => {
       })
     );
     await el.updateComplete;
-    const spy = Sinon.spy(el, 'showErrorModal');
+
+    el.startLoanTokenPoller();
+    const firstPoller = el.tokenPoller;
+    const disconnectSpy = Sinon.spy(firstPoller, 'disconnectedCallback');
+
+    el.startLoanTokenPoller();
+
+    expect(disconnectSpy.calledOnce).to.be.true;
+    expect(el.tokenPoller).to.not.equal(firstPoller);
+  });
+
+  it('never restarts the poller on a create_token failure — no retry', async () => {
+    const el = await fixture(
+      container({
+        userid: '@user1',
+        identifier: 'token-exhausted',
+        lendingStatus: {
+          is_lendable: true,
+          available_to_browse: true,
+          user_has_browsed: true,
+          browsingExpired: false,
+          secondsLeftOnLoan: 300,
+        },
+      })
+    );
+    await el.updateComplete;
+
+    const startSpy = Sinon.spy(el, 'startLoanTokenPoller');
 
     el.handleLendingActionError({
       detail: {
@@ -1535,9 +1596,7 @@ describe('WEBDEV-8322 review fixes', () => {
         data: { error: 'loan token not found. please try again later.' },
       },
     });
-    await el.updateComplete;
 
-    expect(spy.calledOnce).to.be.true;
-    expect(el.lendingStatus.user_has_browsed).to.be.false;
+    expect(startSpy.called).to.be.false;
   });
 });