[schlessera]

Refs #1364

What changed

Each createApp owns its login failure buckets, pending passkey challenges and sync admission set. Each WebSocket host owns message receipt ordering, so independent apps no longer share these stores or counters. Password and passkey CPU verification reservations remain process-wide.

Why this shape

This follows #1364 and epic #1343: construct state at the app boundary and pass it to the existing routes. Receipt order is compared only within one host's session queues. Rate thresholds, challenge expiry, repository writer coordination and the ten-second shutdown grace from #2475 retain their existing behavior. The patch changeset names @schlessera/brain-ui-server; no supported machine surface changes and no CONTRACT: commit is needed.

Proof

Current published head: 26fc4d9e8895b05ba7b773858b363773edb3f443. Merged base: 7b8a755ea329bd48a11b790e916c417b6f608eee. A normal merge preserves the original published head d54b10667a91d799289f16560731d669fdf943b0. Eight citation-only conflicts were reconciled against the merged source, including all eight HTTP coverage citations and their range endpoints. The contribution contains 23 files.

• Focused app/auth/passkey/sync/follow-up/shutdown/citation batch: 238 pass, 0 fail, 2,179 assertions across 11 files.
• bun run typecheck (tsc --noEmit): pass.
• Citation audit: 1,159 citations, no drift.
• Pending changeset package validation and full bunx --no-install changeset status: pass; all 19 packages resolve to the existing minor release plan, with no major bump.
• Claude/Pi provider-history guards: 25 pass, 0 fail, 135 assertions.
• Required bun run check:pr --base origin/main: PASS, exit 0, one unchanged attempt on the head/base above. Lint/leakage, environment docs and changeset gates passed. Fast batch: 562 pass / 0 fail / 3,760 assertions across 25 files. Affected feedback: 2,177 pass / 0 fail / 19,442 assertions across 166 files, 3,255.50 seconds. Mount count at entry: 91.
• The prior cold-capture timeout case passed in 3,165.09 ms; the 1440px parallel-session reload case recorded in ui-react: attribute unexpected browser closure during parallel-session reload #2309 passed in 16,061.84 ms. These are fresh current-head observations; they do not attribute or erase the historical failures.
• The default preflight's import graph misses spawned/file-read inputs. The 840-file full unit inventory and complete selected hosted categories remain pending and are not claimed as executions.

Four current-head whole-file mutation/restoration controls, with unchanged assertions and deadlines:

• Shared login map: createApp isolates login and passkey option buckets (#1364) fails app B expected 200, received 429 (0 pass / 1 fail / 7 assertions). Restored: 1 pass / 19 assertions.
• Shared challenge map: another app cannot consume a pending challenge fails app B expected 401, received 200 (32 pass / 1 fail / 180 assertions). Restored: 33 pass / 182 assertions, including the original app's single-use checks.
• Shared sync set: independent apps do not share sync admission (#1364) fails app B expected 200, received 409 (2 pass / 1 fail / 13 assertions). Restored: 3 pass / 15 assertions.
• Omitted queued/refused follow-up sendOrder: a refused follow-up still runs ahead of messages queued after it fails the prompt-order assertion (13 pass / 3 fail / 49 assertions, including two related order/recovery failures). Restored: 16 pass / 50 assertions.

All four mutated files were restored byte for byte before focused proof and publication. One restored passkey control's unnecessary native-slot waiter was cancelled before Bun launched; the separately recorded ordinary control supplied the 33 passing tests. These copied fixtures do not qualify Btrfs or loop storage.

The missing unpublished 11dc5224 candidate and its raw local artifacts were unavailable. This continuation reconstructed from the published contribution and fresh main; it does not reuse the old candidate's proof. The 2026-10-22 handoff and failed historical preflight / instrumented non-reproduction remain historical evidence. The maintainer's removal of #2403 as a blocker remains in force and does not erase those failures.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof.
• Both per-app acceptance tests have failing mutations and restored passing controls; remaining qualification is named below.
• The PR and advanced issue retain the verified 0.44.0 milestone.
• A server patch changeset is included.
• The complete leakage preflight passed.
• Nothing in the supported machine surface moved.
• Documentation citations reflect the merged source.
• Provider-history guards passed.

Anything left open

This remains draft under the implementation-worker brief. The coordinator owns ready-candidate confirmation, complete selected hosted proof, final review and merge. Local preflight passed; the default command does not replace hosted proof. No readiness, merge, closure, or historical-failure waiver is claimed.