fix(app): cancel stale onboarding redirects

[reachjalil]

Problem

After a successful Den sign-in, the shell recursively scheduled up to ten organization checks. Cleanup removed only the session event listener; it did not cancel those timers. Repeated success events could create overlapping polling chains, and an older chain could redirect to onboarding after sign-out, navigation, a newer sign-in, or unmount.

State and ordering contract

• Every session event invalidates any older redirect wait.
• Only a success event with a token starts a new bounded wait.
• The current stored token must still match that success event when the organization appears.
• A matching token plus active organization may navigate once.
• Sign-out, error, newer success, and unmount cancel pending timers.
• The existing ten checks at 500ms remain the maximum wait; expiry is silent.

Implementation

• Extracted a small cancellable redirect scheduler with a generation boundary.
• Captured the successful sign-in token and compare it with current Den settings before navigation.
• Clear the active timer and invalidate the generation on every session event and effect cleanup.
• Mark the generation complete before navigating so no duplicate callback can redirect twice.

Regression proof

Deterministic fake-timer tests prove:

• two successful sign-ins leave only the latest eligible to navigate;
• a matching current token and organization navigate exactly once;
• sign-out/unmount cancellation leaves no timer or navigation;
• a different current token cannot redirect;
• the bounded wait expires without late navigation.

Validation

• bun test apps/app/scripts/den-onboarding-redirect-order.test.ts — 4 passed, 0 failed
• pnpm --filter @openwork/app typecheck — passed
• pnpm fraimz --flow den-onboarding-redirect-order — Passed, 4 proof frames plus voiceover coverage

Evidence limitations

The fraimz run is an internal scheduler proof with deterministic timers. It is not a live UI recording and does not exercise browser handoff timing against a real Den deployment.

Human review still required

This draft is intentionally not ready to merge until a human reviewer confirms:

• the session event token is the correct identity to bind to the redirect;
• all success producers include the token required to start the wait;
• cancelling on every non-success session event matches intended error and sign-out behavior;
• retaining the existing five-second maximum is still the desired UX;
• a manual desktop test covering success, rapid second sign-in, sign-out during org loading, and route navigation produces no surprise redirect;
• the branch remains appropriate against the latest dev head.

Scope and mergeability

This is an independent shell ordering fix with no merge dependency on the other Den synchronization drafts.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 12, 2026 4:47pm

[vercel]

@reachjalil is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.

[reachjalil]

Review map: independent state and sync reliability drafts

These drafts address separate ownership/order boundaries and are intended to be reviewed independently against dev:

• fix(app): keep Settings connections on the workspace server #2688 — Settings connection actions stay on the selected workspace server
• fix(app): discard stale Den cloud snapshots #2689 — stale Den resource snapshots cannot cross an organization/session switch
• fix(app): coalesce Den sync requests #2690 — settings events received during provider sync coalesce instead of disappearing
• fix(app): cancel stale onboarding redirects #2691 — stale sign-in timers cannot redirect after a newer session or sign-out
• fix(app): ignore stale Den organization refreshes #2692 — only the latest Den organization refresh may mutate state

There is no required merge order. Each PR body includes its own validation, evidence limitations, and a Human review still required checklist. Internal fraimz proofs in this set are test-backed ordering evidence, not live UI recordings.