@zackbart/connecta 0.35.0 → 0.36.1

package/documentation/auth.md

@@ -412,6 +412,11 @@ agent. Enabling `preview` lets code on any pushed preview branch act as the agen
 Treat the project's OIDC token as a bearer credential for all of this agent's
 pools. Its default audience, `https://vercel.com/<team-slug>`, is shared by every
 service accepting Vercel's default OIDC tokens; it is not specific to Connecta.
+Connecta accepts only that default audience. Vercel's custom-audience token
+exchange can produce a validly signed token for another service; Connecta
+refuses it. For example, a token exchanged for `https://tickets.example.com`
+cannot authenticate to `/agent/assistant`. Resolve the ordinary workload token
+with `getVercelOidcToken()` without an `audience` option.
 Anything holding the project's token can act as the agent:
 project code, builds (including build steps and dependency install scripts with
 access to `VERCEL_OIDC_TOKEN`), and services the project sends the token to,
@@ -448,7 +453,7 @@ export default defineMcpClientConnection({
   url: "https://connecta.example.com/agent/assistant",
   description: "Use the assistant's shared CRM and ticket tools.",
   auth: {
-    credentialOwner: "app",
+    principalType: "app",
     getToken: async () => ({ token: await getVercelOidcToken() }),
   },
 });
@@ -1390,8 +1395,10 @@ leaves the local grant removed. The management route returns HTTP 200 with
 code. Revoke the old grant in the provider's console if removal there matters.
 With no advertised endpoint, Disconnect makes no request. Repeating Disconnect
 never retries revocation, because the removed grant is no longer available.
-Restart makes no revocation request. Static `api()` OAuth has no discovered
-revocation endpoint and continues to remove authorization locally.
+Restart makes no revocation request. Static `api()` OAuth uses the same
+removal and revocation flow when deployment configuration supplies
+`revocationEndpoint`; without it, removal remains local. The configured
+client secret is used in memory and is never saved with the grant.
 
 ## Refresh failures
 
@@ -1406,11 +1413,11 @@ Copy these durable records during storage migration.
 
 Each fingerprint record names its dispatch epoch, holder, and resolution state:
 
-| State         | Send gate                                                                                                                                                                                                   |
-| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `outstanding` | Dispatched without a definitive outcome yet. Refuse the fingerprint in every epoch.                                                                                                                         |
-| `ambiguous`   | The sent request's outcome is unknowable. Refuse the fingerprint in every epoch, including when re-consent returns it again.                                                                                |
-| `resolved`    | The tokens were committed or a definitive failure was recorded. Refuse another send in the same epoch. A later epoch may send once only when its code exchange completed after the resolution was recorded. |
+| State         | Send gate                                                                                                                                                                                                                                                     |
+| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `outstanding` | Dispatched without a definitive outcome yet. Refuse the fingerprint in every epoch.                                                                                                                                                                           |
+| `ambiguous`   | The sent request's outcome is unknowable. Refuse the fingerprint in every epoch, including when re-consent returns it again.                                                                                                                                  |
+| `resolved`    | The tokens were committed or a definitive failure was recorded. A completed lease whose token digest matches the current grant may start the next generation in the same epoch. A later epoch needs a code exchange that observed this exact resolved record. |
 
 Resolution writes use CAS against the exact outstanding record and record a
 `resolvedAt` timestamp with a resolved outcome. When accepting a code response,
@@ -1423,6 +1430,14 @@ outstanding dispatch. An earlier consent cannot become eligible merely because
 the pending refresh later resolves. Competing epochs cannot both replace the
 same record, and a late answer cannot turn an ambiguous record into resolved.
 
+For vendors that return unchanged refresh-token bytes, a successful token
+commit and its matching completed lease authorize the next refresh generation
+in that epoch. It must replace the exact resolved fingerprint by CAS before
+sending. Outstanding, ambiguous and failed attempts never authorize reuse;
+concurrent callers with an older access token adopt the committed result.
+An unsent successor retains the prior successful proof during cleanup, so a
+transient storage failure before dispatch can be retried without losing the grant.
+
 An ambiguous token stays blocked even if re-consent returns identical bytes.
 Recovery requires re-consent that yields a different refresh token, or
 revocation at the provider. Restart never deletes spent records or moves old
@@ -2400,6 +2415,13 @@ need `consumeAuthError` to accept error callbacks, sharing `finishAuth`'s atomic
 consent claim. Reissue
 pending consent links after upgrading; callbacks without a saved initiating user cannot complete.
 
+Custom connectors may implement `verifyCallbackParameters(params, ctx)` for
+provider-specific callback assertions. The route calls it after successful
+state verification and before issuer validation, handoff consumption, error
+handling, or code exchange. Returning false or throwing produces the generic
+invalid-callback refusal. Apply the same assertions inside `finishAuth` when
+supporting direct programmatic completion.
+
 `compareAndSet` atomically claims link nonces, callback handoffs, and consents, with one concurrent winner,
 so each completes once.
 [Meta-tools](./meta-tools.md#authorization-recovery) describes recovery.
@@ -2506,15 +2528,28 @@ api("church", {
 No discovery or registration occurs; all URLs are configuration, so the
 [advertised-URL rule](#urls-a-downstream-advertises) does not apply.
 
-| Option or binding         | Contract                                                                                                                                                                                                                                                                            |
-| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Endpoints                 | Checked at construction: HTTPS, HTTP only on loopback, no credentials or fragment.                                                                                                                                                                                                  |
-| `pkce`                    | S256 by default; `false` omits challenge and verifier.                                                                                                                                                                                                                              |
-| `authorizationParams`     | Adds provider parameters; cannot restate the grant's own.                                                                                                                                                                                                                           |
-| `tokenRequestHeaders`     | Adds code-exchange and every refresh's headers; cannot set `Authorization`, `Content-Type`, `Content-Length`, `Cookie`, or `Host`.                                                                                                                                                  |
-| `tokenEndpointAuthMethod` | Defaults to `client_secret_basic` with a secret, `none` without; mismatched pairings refuse construction.                                                                                                                                                                           |
-| Issuer/resource           | No advertised issuer means no required RFC 9207 `iss` or sent RFC 8707 `resource`. The grant binds to the token endpoint; after it changes, old tokens are never sent and the next consent replaces them.                                                                           |
-| Client                    | One deployment-config identity, never written or sealed to storage; no owner vault slot. Store leaks contain no client secret; Disconnect deletes none and Restart carries none. Read from environment or Worker secrets; empty strings refuse construction without quoting values. |
+| Option or binding            | Contract                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Endpoints                    | Checked at construction: HTTPS, HTTP only on loopback, no credentials or fragment.                                                                                                                                                                                                                                                                                                                                             |
+| `pkce`                       | S256 by default; `false` omits challenge and verifier.                                                                                                                                                                                                                                                                                                                                                                         |
+| `authorizationParams`        | Adds provider parameters; cannot restate the grant's own.                                                                                                                                                                                                                                                                                                                                                                      |
+| `expectedCallbackParameters` | Optional `Readonly<Record<string, string>>` of fixed provider response values. Each configured parameter must occur exactly once with its exact decoded value, after pending-state verification and before issuer validation, flow claims, code exchange, or grant persistence. Missing, duplicate, or mismatched values refuse without exchanging a code or returning parameter values. Omission preserves existing behavior. |
+| `revocationEndpoint`         | Optional trusted HTTPS revocation URL (loopback HTTP allowed), without credentials, query or fragment. Disconnect removes the local grant before one bounded attempt using the configured client. Failure reports `oauth_revocation_failed`; a repeated Disconnect never retries.                                                                                                                                              |
+| `revocationRequestFormat`    | `"form"` by default; `"json"` sends JSON without `token_type_hint`. Requires `revocationEndpoint` when set.                                                                                                                                                                                                                                                                                                                    |
+| `tokenRequestHeaders`        | Adds code-exchange and every refresh's headers; cannot set `Authorization`, `Content-Type`, `Content-Length`, `Cookie`, or `Host`.                                                                                                                                                                                                                                                                                             |
+| `tokenEndpointAuthMethod`    | Defaults to `client_secret_basic` with a secret, `none` without; mismatched pairings refuse construction.                                                                                                                                                                                                                                                                                                                      |
+| Issuer/resource              | No advertised issuer means no required RFC 9207 `iss` or sent RFC 8707 `resource`. The grant binds to the token endpoint; after it changes, old tokens are never sent and the next consent replaces them.                                                                                                                                                                                                                      |
+| Client                       | One deployment-config identity, never written or sealed to storage; no owner vault slot. Store leaks contain no client secret; Disconnect deletes none and Restart carries none. Read from environment or Worker secrets; empty strings refuse construction without quoting values.                                                                                                                                            |
+
+For a connector bound to a fixed company, set
+`expectedCallbackParameters: { realmId: "company_alice" }`. This checks all
+callbacks, including errors, and direct `finishAuth` calls. Names must be
+nonempty ASCII letters, digits, dots, underscores, or hyphens; values must be
+nonempty strings. The protocol fields `code`, `state`, `iss`, `error`,
+`error_description`, and `error_uri` are reserved. Malformed expectations throw
+at construction without quoting values. Unconfigured provider parameters are
+ignored. Expectations are deployment configuration, never grant metadata or
+dynamic company selection; they do not inspect or rebind an existing grant.
 
 Handlers never see the grant. `ctx.oauth.fetch(url, init)` sends the calling
 owner's access token as `Authorization: Bearer` with these rules:
@@ -2668,8 +2703,10 @@ The encoding lattice is exactly this, and anything outside it is out of scope:
 
 [Decision 0007](https://github.com/zackbart/connecta/blob/main/decisions/0007-agent-pool-layout.md)
 explains the pool layout; [decision 0006](https://github.com/zackbart/connecta/blob/main/decisions/0006-pools-are-the-access-model.md)
-explains pools as the access model. `test/identity-scope.test.ts` checks identity
-boundaries, and `src/storage/keys.ts` owns credential key families.
+explains pools as the access model. `test/identity-write-journey.node.test.ts`
+checks real HTTP identity, pool and personal credential isolation;
+`test/identity-scope.test.ts` retains handoff, callback and admission-revocation
+fault probes. `src/storage/keys.ts` owns credential key families.
 
 Inbound adapters live in [src/auth](https://github.com/zackbart/connecta/tree/main/src/auth);
 [auth routes](https://github.com/zackbart/connecta/blob/main/src/routes/oauth.ts)

package/documentation/code-mode.md

@@ -1274,7 +1274,7 @@ rejection, and branded adapter acceptance across module copies.
 | `S9`                   | `test/result-shapes.test.ts` (value exclusion, bounds, merging, LRU and time expiry, runtime isolation, read-only admission, declared precedence, definition invalidation, unwrapped MCP results, discovery provenance, copy isolation, failure isolation)                                                                                                                                                                                                                                                                      |
 | `S10`                  | `test/resource-read.test.ts` (qualified routing, whole-connector grants, personal credentials, redaction, admission, timeout, cancellation and downstream MCP reads), both guest-contract executors (successful resource reads and caught/uncaught typed failures)                                                                                                                                                                                                                                                              |
 | `E2`, `E8`             | `test/guest-api-contract.test.ts` (code → `retryable`, caught, parallel, and uncaught validation recovery, a conflict's bounded `current`), `test/meta-tools-call.test.ts` (direct, destructive, provider fallback), `test/validate.test.ts` (bounded payload-free findings), `test/errors.test.ts`                                                                                                                                                                                                                             |
-| `E3`, `E4`             | `test/guest-api-contract.test.ts`, `test/execute.test.ts` (`auth_required`, destructive reroute), `test/program-writes.test.ts` (the refusal's `nextAction`, nothing sent, a caught refusal)                                                                                                                                                                                                                                                                                                                                    |
+| `E3`, `E4`             | `test/guest-api-contract.test.ts`, `test/execute.test.ts` (`auth_required`, destructive reroute), `test/identity-write-journey.node.test.ts` (read-only refusals before validation or dispatch, actual QuickJS)                                                                                                                                                                                                                                                                                                                 |
 | `E5`                   | `test/guest-api-contract.test.ts` (execution-failure channel, in-flight `cancelled`), `test/execute.test.ts` (admission), `test/executor-admission.test.ts`, `test/quickjs-executor.node.test.ts` (mid-run shutdown)                                                                                                                                                                                                                                                                                                            |
 | `E6`, `X8`             | `test/guest-api-contract.test.ts` (unknown and inherited members, retained error identities), `test/quickjs-executor.node.test.ts`                                                                                                                                                                                                                                                                                                                                                                                              |
 | `E7`                   | `test/guest-api-contract.test.ts` (refusals about a `503`-named connector), `test/errors.test.ts`                                                                                                                                                                                                                                                                                                                                                                                                                               |
@@ -1288,10 +1288,10 @@ rejection, and branded adapter acceptance across module copies.
 | `L3`, `X1`             | `test/guest-api-contract.test.ts` (short-deadline executors), `test/execute.test.ts` (the watchdog ends a never-settling executor, frees the default pool, spares a slow run, and falls back from an unusable value)                                                                                                                                                                                                                                                                                                            |
 | `L4`, `L8`             | `test/guest-api-contract.test.ts`, `test/execute.test.ts` (shared discovery/call budgets and terminal catch-and-continue loops and queued-write cancellation on both executors), `test/worker-budget-response.node.test.ts` (native handle disposal and admission recovery across completed HTTP responses)                                                                                                                                                                                                                     |
 | `L5`, `L7`, `X2`       | `test/quickjs-executor.node.test.ts` (CPU, heap), `test/execute.test.ts` and `test/executor-admission.test.ts` (bounded admission and queue)                                                                                                                                                                                                                                                                                                                                                                                    |
-| `L6`, `X10`            | `test/guest-api-contract-quickjs.node.test.ts` and `test/guest-api-contract.test.ts` (whole oversized reads and one-write pageable handles), `test/sqlite-storage.node.test.ts` and `test/d1-storage.node.test.ts` (shared stash transfers), `test/quickjs-executor.node.test.ts` (bridge and IPC bounds for arguments and result; the address in the over-bound message), `test/quickjs-child-stderr.node.test.ts` (outer reply serialization failure settles the call)                                                        |
-| `V1`–`V4`              | `test/guest-api-contract.test.ts` (dispatched calls, every refusal class including an address no connector owns, the friction each derives, no event for the execution itself), `test/activity.test.ts` (the shared code → friction table, the identity clamp, the one-attempt floor), `test/operator-view.test.ts`, `test/sql-storage-contract.ts`, run by `test/d1-storage.node.test.ts` and `test/sqlite-storage.node.test.ts` (historical pause and approval rows still render and round-trip)                              |
-| `V5`, `W9`             | `test/program-writes.test.ts` (an unawaited program write finished and recorded, its unknown outcome reported, counts on a failed program, the classification table), `test/invocation-pipeline.test.ts` (the gate after validation, an unrecorded refusal)                                                                                                                                                                                                                                                                     |
-| `W10`, `W12`           | `test/program-writes.test.ts` (a writable endpoint's program write runs, a read-only endpoint omits writes from search and describe and refuses every write call on every path, including a write its guide names, a required deployment `readOnly`, the write budget, `readOnly` inheritance and overrides, `call_tool` still refusing, search and describe verdicts, construction refusals including retired `trust`), `test/operator-ui-model.test.ts`, `test/browser/operator-ui.spec.ts` (the badge)                       |
+| `L6`, `X10`            | `test/guest-api-contract-quickjs.node.test.ts` and `test/guest-api-contract.test.ts` (whole oversized reads and one-write pageable handles), `test/sqlite-storage.node.test.ts` and `test/kv-to-d1.test.ts` (SQL stash and native D1 fault probes), `test/quickjs-executor.node.test.ts` (bridge and IPC bounds for arguments and result; the address in the over-bound message), `test/quickjs-child-stderr.node.test.ts` (outer reply serialization failure settles the call)                                                 |
+| `V1`–`V4`              | `test/guest-api-contract.test.ts` (dispatched calls, every refusal class including an address no connector owns, the friction each derives, no event for the execution itself), `test/activity.test.ts` (the shared code → friction table, the identity clamp, the one-attempt floor), `test/browser/operator-ui.spec.ts` (identity changes), `test/sql-storage-contract.ts`, run by `test/sqlite-storage.node.test.ts` (historical activity rows still round-trip)                                                             |
+| `V5`, `W9`             | `test/program-writes.test.ts` (unawaited program drain, failed-program accounting), `test/identity-write-journey.node.test.ts` (committed ambiguity, reconciliation and physical writes), `test/invocation-pipeline.test.ts` (the gate after validation, an unrecorded refusal)                                                                                                                                                                                                                                                 |
+| `W10`, `W12`           | `test/identity-write-journey.node.test.ts` (real HTTP/MCP and QuickJS: write budget, read-only discovery and refusal, named guide, pool inheritance/reopening and connector policy), `test/program-writes.test.ts` (construction refusals and classification drift), `test/operator-ui-model.test.ts`, `test/browser/operator-ui.spec.ts` (the badge)                                                                                                                                                                           |
 | `M1`                   | `test/guest-api-contract.test.ts` (invalid emits throw catchably, accept nothing), `test/execute-emit.test.ts` (rejected shapes, bounded native snapshots, paging before metadata traversal, and cyclic presentation refusal)                                                                                                                                                                                                                                                                                                   |
 | `M2`, `M3`             | `test/guest-api-contract.test.ts` (delivery order, truncated return plus delivered blocks), `test/execute-emit.test.ts` (envelope, `structuredContent`, byte-for-byte no-emit path)                                                                                                                                                                                                                                                                                                                                             |
 | `M4`                   | `test/guest-api-contract.test.ts` (discard is visible), `test/execute-emit.test.ts` (structured and plain paths), `test/quickjs-executor.node.test.ts` (mid-run shutdown)                                                                                                                                                                                                                                                                                                                                                       |
@@ -1304,4 +1304,4 @@ rejection, and branded adapter acceptance across module copies.
 
 The surface itself is checked by `test/server.test.ts` (the exact six-tool list),
 `test/code-first-surface.test.ts` (construction, executor, removed tools, copy, and size),
-and `test/program-writes.test.ts` (the retired pause options refused at construction).
+and `test/program-writes.test.ts` (deployment policy and classification construction refusals).

package/documentation/integrating.md

@@ -328,7 +328,7 @@ check shared behavior. Provider-specific tests remain beside each provider.
 
 Use [`@zackbart/connecta-eve`](https://github.com/zackbart/connecta/blob/main/packages/connecta-eve/README.md)
 in the Eve app for an app-owned connection and endpoint instructions refreshed
-at turn start. It requires Node 24 and Eve 0.83.x, and installs separately from
+once per turn. It requires Node 24 and Eve 0.84.x, and installs separately from
 Connecta. Follow its README for the two agent files, token environment variables,
 optional write approval and Vercel OIDC token source. Configure the server's
 [agent and pool membership](./auth.md#issue-rotate-or-revoke-an-agent-token)

package/documentation/meta-tools.md

@@ -1292,7 +1292,7 @@ window, a native `tools/list` carries a 300-second private cache hint, against
 an hour on meta endpoints. This hint does not guarantee that a host refreshes
 its cached annotations; the stale-approval race is accepted on writable pools.
 
-**Listing.** `tools/list` is one page with no cursor (Eve 0.83 reads only the
+**Listing.** `tools/list` is one page with no cursor (Eve 0.84 reads only the
 first page). A pool listing more than 1,000 tools fails `tools/list` with a
 JSON-RPC error asking the operator to narrow the pool; nothing is silently
 dropped. A connector whose catalog cannot load is left out of that listing
@@ -1334,8 +1334,11 @@ Connector ids already appear in native tool names. The
 operator UI and `describeConfig()` show every pool's effective `surface` and
 `executeCode` as facts from deployment code. Change these settings in code.
 
-Keep native pools bounded. Comparisons so far used 40 synthetic tools;
-large production catalogs near the cap have not been evaluated.
+Keep native pools bounded. Local real-Eve validation uses seeded catalogs from
+40 through 1,000 downstream tools across meta, native and native-plus-code
+surfaces, with a deterministic model transport and no paid model calls. These
+checks establish local runtime contracts; model task quality and large
+production catalogs near the cap remain unmeasured.
 
 ### Eve agents
 

package/documentation/operator-tests.md

@@ -190,8 +190,17 @@ OAuth provider validates the code exchange and PKCE. Credential Test calls a
 loopback downstream endpoint. Operator APIs, cookie/bearer admission, CSRF,
 assets, handoffs, callbacks, and encrypted storage use production code.
 
-The flows cover Clerk sign-in/reload/sign-out; OAuth connect/consent/callback/
-connected reread/reload; and credential save/test/replace/remove. They collect
+The flows use a real SQLite file and cover Clerk sign-in/reload/sign-out,
+actual Settings provenance and asset cache validators; OAuth
+connect/consent/callback/connected reread/disconnect; and credential
+save/test/replace/remove. They close and reopen the app, database and vault
+before rereading OAuth and credential state. A rejected SQL replacement leaves
+the previous secret usable downstream after restart. Trigger rows read from an
+independent SQL connection require one save, one replacement and one removal;
+reads and the rejected save commit no credential writes. Actual MCP calls
+check that credential edits preserve a reader pool's read access and refusal. Activity renders
+successful calls recorded before the SQLite restart without exposing either
+credential value. They collect
 CSP violations across every document and popup, and fail on unexpected network
 traffic. No credentials enter visual fixtures or screenshot baselines.
 

package/documentation/operator-ui.md

@@ -519,8 +519,9 @@ says the snapshot is for maintainers. It requires the UI module and the
 existing doctor authentication environment variables; it runs no diagnostic
 program, follows no redirects, and prints no raw HTTP failure body.
 
-The operator shell uses React, TanStack Router/Query/Table, Radix, cmdk and
-Tailwind v4. Hanken Grotesk, JetBrains Mono, CSS, JavaScript and dependency notices are hashed assets
+The operator shell uses React, TanStack Router, Radix and cmdk. Esbuild bundles
+the authored CSS with an explicit browser reset; it generates no utility classes.
+Hanken Grotesk, JetBrains Mono, CSS, JavaScript and dependency notices are hashed assets
 under `/ui/assets/*`, served identically with immutable cache headers on Node
 and Workers. HTML contains only mount points and escaped inert configuration;
 it remains uncached. Ahead of the stylesheet, every operator page (sign-in
@@ -537,7 +538,11 @@ private browsing: a read finds nothing stored and a write keeps nothing, so a
 bearer token is not remembered there. `generated.ts` is ignored and generated before build and
 test; `check:operator-ui` detects stale assets and shared page styles. The UI
 stays behind `./ui`, outside the root import graph. The identity-fenced store
-owns authenticated reads and existing mutations. An Access-only shell selects
+owns authenticated reads and existing mutations, with explicit identity and
+read-cycle AbortControllers, revision fences, and no query cache or automatic
+mutation replay. Browser-only view models ship inside the hashed bundle, with
+no duplicate standalone server modules. The shared contract owns the unchanged
+`OperatorPage` union exported from `@zackbart/connecta/ui`. An Access-only shell selects
 Access even when the HTML request has no trusted context; only authenticated
 API responses establish the session. A gated Access session offers Retry.
 Focus, visibility, and timer-driven recovery share one admission-read schedule
@@ -639,8 +644,7 @@ and each personal connector's exact `manage`;
 The Overview's map and attention rows are pure functions of the contract in
 [connection-map.ts](https://github.com/zackbart/connecta/blob/main/src/operator-ui/connection-map.ts)
 and [overview.ts](https://github.com/zackbart/connecta/blob/main/src/operator-ui/overview.ts),
-covered by `test/operator-connection-map.test.ts` and
-`test/operator-overview.test.ts`; `src/operator-ui/styles/overview.css` holds
+exercised in Chromium by `test/browser/operator-overview.spec.ts`; `src/operator-ui/styles/overview.css` holds
 the page's styles.
 
 `src/operator-ui/config-summary.ts` maps the snapshot and its provenance to
@@ -661,3 +665,11 @@ serve the authenticated shell and data. The browser lives in
 and [browser flows](https://github.com/zackbart/connecta/blob/main/test/browser/operator-ui.spec.ts)
 defend filtering and behavior. Use [Operator UI tests](./operator-tests.md)
 for the browser state matrix and Linux snapshot procedure.
+
+The browser flows also hold configuration and connector reads open across a
+bearer identity switch, observe cancellation of the old HTTP response, and
+require only the replacement viewer's data after navigation. A held OAuth poll
+must abort on navigation without sending its start again; the Access recovery
+flow checks explicit Retry and browser-history navigation without a document
+reload. The packed deployment journey compiles every `OperatorPage` through
+the public `@zackbart/connecta/ui` alias after declaration pruning.