Loading issues
Code-quality audit finding 1 (baseline 08d99ee, confirmed on main). The Auth.js session callback copies accessToken into the session JSON returned by /api/private/auth/session, despite a server-only intent. Separate the public session projection from server token access without breaking refresh/sign-out. Acceptance: a real auth session-handler test with a synthetic encrypted cookie proves access/refresh tokens are absent from browser JSON while server callers can retrieve the refreshed actor token. Preserve PAR-447 behavior. Rules 7, 18.
Implemented in https://github.com/ParadauxIO/taskl.ie/pull/107 as part of the ordered quality stack #107 → #108 → #109 → #110 → #111 → #112 → #113 → #114. Each layer targets its predecessor; #107 targets main. Local final-stack verification: 1,312 backend tests against disposable PostgreSQL 17/pgvector, 1,218 web unit tests, 486 Chromium stories, lint, TypeScript, production build/CSS gate and standalone HTTP smoke all pass. A focused listener cleanup regression also passes after the final lifecycle change. CI results are tracked on the PRs; no merges or deployments performed.
Implementing as one layer of the user-requested code-quality fix stack. Base is current main (rebuild has merged and its remote branch is gone). Plan: add focused behavioral regression coverage, implement this issue without weakening architecture rules, run affected checks and full applicable suites, then publish a stacked PR with validation and dependency links. Stack order: PAR-489 → PAR-492 → PAR-490 → PAR-494 → PAR-491 → PAR-454 → PAR-478 → PAR-493.