[schlessera]

Refs #1364

What changed

Each application owns its login failure windows, pending passkey challenges and sync admission set. Message receipt order belongs to its WebSocket host. Exhausting one application’s failure budget or issuing a challenge there no longer affects another application in the same process.

Why this shape

createApp supplies one limiter to its password and passkey routes and one challenge store to public and management ceremonies. Password/passkey CPU reservations remain process-wide, with existing ceilings, thresholds and expiry unchanged. Receipt order compares entries only within a host’s queues, so a process-global counter is unnecessary. The existing host boundary continues coordinating repository writers.

Proof

Current head d54b10667a91d799289f16560731d669fdf943b0 merges live base 775eb17aab740fa759c2182f306c38fc17acbcbe; tree 78338b90096b97f729ad314206abf720c1e69251. Its refresh adds browser-shard/diagram/native-proof test changes, with no production-source delta across the relevant server, SDK, backend or React packages from tested head e51ca9be5 / base 82a64a13a. The base includes native maintenance #2361 and TCP-listener fixture #2371. Source merges were inspected; conflicting citation offsets were reconciled against actual anchors. All 1,154 citation records validate.

• At e51ca9be5 / base 82a64a13a, focused proof: 100 tests / 1,572 assertions across real two-app creation, authentication, passkeys, sync and follow-up startup/queue behavior.
• At that same recorded head/base, shared-store mutations: app B login expected 200, received 429; cross-app challenge expected 401, received 200; independent sync expected 200, received 409. All three fail on intended assertions. Byte-restoration passes 53 tests / 266 assertions.
• At that recorded head/base, receipt-order omission fails a refused follow-up still runs ahead of messages queued after it, reversing the expected prompt order. Restoring passes the named runtime case. Earlier failing-first receipts on base 0d780605 also establish the original login/challenge defects.
• Same-class audit covers all four stores/counters and preserves the two global CPU reservation pools. Server patch changeset and complete pending release plan validate. The public API report had no contribution diff; supported API/contract shapes are unchanged. PR and issue target confirmed upcoming 0.44.0 (registry publishes 0.43.1).
• Prior head c6dbf875 / base 0d780605: required preflight passed lint/metadata and 548 fast invariants, then its 158-file import-graph feedback lost browser targets in association-signout, chat-focus and connection-continuity using Arch Chromium 152. The owned run was stopped after repeated loss (child 137, preflight exit 1). This remains failed/incomplete proof. ci: attribute browser target loss during combined runtime proof #2378 records exact failures, missing cause evidence and a single installed Chrome 153 comparison: four targeted cases / 18 assertions pass with both browser exits 0. That differently versioned isolated result is recovery evidence only.
• Historical complete-server attempt also remains failed/incomplete (declaration deadline, EDQUOT/SQLite errors, interrupted execution); the concurrent typecheck SIGKILL remains failed. A sequential strict typecheck passed at the earlier implementation tree. None is relabelled as current combined-tree proof.
• Required preflight passed on e51ca9be5 / base 82a64a13a: 548 fast invariants plus 2,134 affected tests across 158 files, 19,024 affected assertions, zero failures, 4,191.54 seconds for affected feedback with installed Chrome 153. This receipt retains that head/base. Strict types pass on current d54b10667. Its required preflight completed against 775eb17aa: 548 fast invariants pass, but affected feedback fails with 2,133 pass / one fail / 19,012 assertions across 158 files in 3,691.40 seconds. The sole failure is Pi curated-tool indexing: ok=true, indexed=false. ci: attribute partial index failure in combined hosted-adapter proof #2403 records the missing indexError/cause evidence. One temporary-logging isolated diagnostic passes (1 test / 15 assertions / 3.99 seconds) and was restored; it is recovery only. Complete selected hosted proof, including server discovery, runtime, pinned browsers and actual candidate checkout identities, remains required.

Checklist

• Fresh local preflight and complete selected hosted proof passed with actual checkout identities.
• Isolation regression criteria and intended mutation failures are covered.
• PR and issue milestone 0.44.0 assigned; read back again before merge.
• Server patch changeset included and complete pending release plan validates.
• Leakage gate clean; fictional fixtures retained.
• No supported API/contract shape changed.
• Moved source citations updated and checked against anchors.
• Current selected provider-history/runtime proof completed.

Anything left open

Blocked by #2403: current-head preflight is failed, with the indexing cause still unattributed. Keep this PR draft until that evidence/correction and fresh complete candidate proof are supplied. Complete selected hosted proof, matching-head merge and main/closure reconciliation have not occurred; no merge qualification or issue completion is claimed. The independently observed browser-loss investigation remains open in #2378, with its failed and diagnostic receipts kept distinct. This PR does not close #1364 until its required candidate proof is complete.