instar 1.3.1238 → 1.3.1239

package/dashboard/subscriptions.js

@@ -79,6 +79,31 @@ export function effectiveAccountStatus(account) {
   return account && account.status;
 }
 
+const KNOWN_REPAIR_STATES = new Set([
+  'suggested', 'approved', 'cli-starting', 'artifact-ready', 'browser-driving',
+  'cli-finishing', 'identity-verifying', 'auth-verifying', 'waiting-operator-only',
+  'succeeded', 'refused', 'cancelled', 'failed',
+]);
+
+/** A suggested/failed repair is actionable only while current pool truth still says
+ *  the account cell needs authentication. Terminal repair rows remain durable audit
+ *  history, but must never shadow a newer Active observation or offer a retry that
+ *  the server's admission policy is required to refuse. In-flight states remain
+ *  visible because pool activation can precede the controller's final ledger close. */
+export function repairAppliesToCurrentState(repair, currentState) {
+  if (!repair || !KNOWN_REPAIR_STATES.has(repair.state)) return false;
+  if (repair.state === 'suggested' || repair.state === 'failed') {
+    return currentState === 'needs-reauth';
+  }
+  return true;
+}
+
+export function repairConflictMessage(error) {
+  return /^(?:retry|approval)-revalidation-refused:account-not-needs-reauth$/.test(
+    typeof error === 'string' ? error : '',
+  ) ? 'This account is already active. Refreshing its status…' : null;
+}
+
 const PROVIDER_WORDS = { anthropic: 'Claude', openai: 'Codex', 'github-copilot': 'Copilot', google: 'Gemini' };
 export function friendlyProvider(provider) {
   return PROVIDER_WORDS[typeof provider === 'string' ? provider : ''] || sanitizeForDisplay(provider, 'label');
@@ -294,9 +319,12 @@ export function renderAccounts(doc, target, accounts, now = Date.now(), inUseAcc
     if (refAge) {
       card.appendChild(el(doc, 'div', 'sub-account-refresh', `Token auto-refreshed ${refAge}`));
     }
-    const repair = Array.isArray(reloginEpisodes)
+    const repairCandidate = Array.isArray(reloginEpisodes)
       ? reloginEpisodes.find((episode) => episode && a && episode.accountId === a.id)
       : null;
+    const repair = repairAppliesToCurrentState(repairCandidate, effectiveAccountStatus(a))
+      ? repairCandidate
+      : null;
     if (repair) {
       const repairBox = el(doc, 'div', 'sub-account-repair');
       const terminal = ['succeeded', 'refused', 'cancelled', 'failed'].includes(repair.state);
@@ -855,9 +883,12 @@ export function renderAccountMatrix(doc, target, poolScope, pendingScope, transi
     const tr = doc.createElement('tr');
     tr.appendChild(el(doc, 'th', 'sub-matrix-acct', sanitizeForDisplay(row.account.email, 'label')));
     for (const c of row.cells) {
-      const repair = Array.isArray(reloginEpisodes)
+      const repairCandidate = Array.isArray(reloginEpisodes)
         ? reloginEpisodes.find((episode) => episode && episode.accountId === c.accountId && episode.machineId === c.machineId)
         : null;
+      const repair = repairAppliesToCurrentState(repairCandidate, c.state)
+        ? repairCandidate
+        : null;
       const repairUnavailable = Array.isArray(reloginFailures)
         && reloginFailures.some((failure) => failure && failure.machineId === c.machineId);
       // just-verified rides a transient highlight on an otherwise-active cell (D4 ceremony).
@@ -1360,8 +1391,12 @@ export function createController(opts) {
       });
       if (!response.ok) {
         if (response.status === 401) requestUnlock();
-        button.textContent = response.status === 401 ? 'Enter PIN, then try again' : 'Couldn’t start — try again';
+        const body = await response.json().catch(() => ({}));
+        const resolvedConflict = repairConflictMessage(body.error);
+        button.textContent = response.status === 401 ? 'Enter PIN, then try again'
+          : resolvedConflict || 'Couldn’t start — try again';
         button.removeAttribute('disabled');
+        if (resolvedConflict) await tick();
         return;
       }
       await tick();
@@ -1564,10 +1599,12 @@ export function createController(opts) {
         const body = await response.json().catch(() => ({}));
         if (!response.ok) {
           if (response.status === 401) requestUnlock();
+          const resolvedConflict = repairConflictMessage(body.error);
           setCellStatus(cell, response.status === 401
             ? 'Enter your dashboard PIN, then tap Repair sign-in once.'
-            : body.error || 'Couldn’t start the repair — try again.');
+            : resolvedConflict || body.error || 'Couldn’t start the repair — try again.');
           btn.removeAttribute('disabled');
+          if (resolvedConflict) await tick();
           return;
         }
         setCellStatus(cell, 'Repair started — Instar is handling the sign-in.');

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "890eec3dcf80e4388c396f43001a0bd3fabc80c88f79aa9525885d6402a6dfdf",
-  "packageVersion": "1.3.1238",
+  "packageVersion": "1.3.1239",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "af9c9662b90d97f6fc09aa4a3228738e21756d3c8aa9fe686863ced09da5bb30",
+  "sha256": "ba4938bd77943c4fdd078bda04c5f6421eeddf240ea6ccc23b6e4030e1a08339",
   "registrySha256": "890eec3dcf80e4388c396f43001a0bd3fabc80c88f79aa9525885d6402a6dfdf",
-  "packageVersion": "1.3.1238"
+  "packageVersion": "1.3.1239"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "890eec3dcf80e4388c396f43001a0bd3fabc80c88f79aa9525885d6402a6dfdf",
   "articleCount": 91,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1238"
+  "packageVersion": "1.3.1239"
 }

package/dist/server/routes.js

@@ -29544,7 +29544,7 @@ document.getElementById('mcpForm').addEventListener('submit', async function (e)
         catch (error) {
             const message = error instanceof Error ? error.message : 're-login approval failed';
             const status = message === 'relogin-episode-not-found' ? 404
-                : /mismatch|approvable|conflict|closed|expired/.test(message) ? 409 : 500;
+                : /mismatch|approvable|conflict|closed|expired|revalidation-refused/.test(message) ? 409 : 500;
             res.status(status).json({ error: message });
         }
     });
@@ -29617,7 +29617,7 @@ document.getElementById('mcpForm').addEventListener('submit', async function (e)
         }
         catch (error) {
             const message = error instanceof Error ? error.message : 're-login approval failed';
-            res.status(/mismatch|approvable|conflict|closed|expired/.test(message) ? 409 : 500).json({ error: message });
+            res.status(/mismatch|approvable|conflict|closed|expired|revalidation-refused/.test(message) ? 409 : 500).json({ error: message });
         }
     });
     // Fronting one-click route: recent dashboard unlock → exact account/machine