auth: a sign-out during a renewal must not write half a session

2026-09-17T08:26:09Z

`{ ..._auth }` after the await spreads a null _auth to {}, so the renewal stored a token with no username and no userId. The app renders the signed-in interface from that and throws on user.username[0] — a blank page on every load, in localStorage, until the site's data is cleared. The sign-out wins the race now, and loadAuth treats an identity-less object as signed out so a browser already holding one heals itself. Co-Authored-By: Claude Opus 5

meshbay.git/packages/meshbay-hub/tests/test_auth_race.py, branch main

auth: a sign-out during a renewal must not write half a session