[lumirth]

Summary

Temporary GitHub refusals could erase public reading or renewable authorization, stale negative discovery could create a duplicate discussion, and confirmed writes could become uncertain after a cache failure. Finish those recovery boundaries and release 7.1.2.

ordinary read → retained public observation + coordinated reconciliation
explicit refresh / creation → successful current acquisition or visible failure
confirmed absence → withdraw old bodies and release the missing mapping
confirmed write → persist receipt → maintain disposable cache independently
OAuth exchange refusal → wait → fresh authorization code
issued credentials + identity refusal → wait → retry identity only

Failed sorting restores the order belonging to the displayed conversation. Structured logs correlate provider operations, grant kind, admission, cooldown, edge/cache outcomes and original observation age. Non-JSON failures retain a safe fingerprint/restriction marker; credentials and raw bodies remain excluded.

Evidence

• Before: real Worker/SQLite reproductions produced duplicate discussions after stale negative discovery, retained 20 withdrawn bodies, kept stale mappings indefinitely, and displayed an old traversal under a failed new sort.
• After: existing independent-provider journeys verify current discovery, withdrawal/draft preservation, replacement discovery without a webhook, failed-sort recovery, and one confirmed external comment despite a real SQLite cache-write failure.
• Chromium/WebKit native/iframe journeys exercise a consumed old authorization code, fresh authorization, issued-token identity retry, expired return, preserved editing and contribution readback. The complete local release gate passed: Worker/SQLite flows, Chromium/WebKit native/iframe journeys, types, builds and extracted-package isolation. Hosted qualification passed on de8c241 (run 38647802035).

Merge Danger

Door: two-way

No storage migration or service identity change. Explicit fresh reads now surface acquisition failures rather than substituting stale data.

Blast Radius: comments

Reusable Worker/browser authentication, public reading and diagnostics; Kukas consumes the released archive separately.