fix: preserve route limits and harden restore marker

2026-09-19 10:01:23 -04:00
parent 99fe7e1ca2
commit cb86497724
11 changed files with 171 additions and 30 deletions
@@ -29,6 +29,10 @@ The web server checks the allowlist at the relevant boundary:
 - `/api/sync` and the application synchronizer check `asset_sync`.
 - `/api/session/token` checks `session_token`.
 - Character management and OAuth entry points check `identity`.
+- The root layout skips its authenticated session lookup only when every
+  capability represented by the root assistant/navigation shell is disabled;
+  if a separate asset, identity, session-token, subscription, or assistant
+  capability remains enabled, it preserves the existing user session state.
 - The Convex browser status subscription checks `subscriptions`; sync bridge
  mutations check `asset_sync` in the backend authorization plane too. The
  allowlist is copied into Convex by `bun run convex:configure`; that setting