Cross-user client-state pollution: previous user's workspace shown to a new user, and the guided first-run flow suppressed

[os-zhuang]

Found during the full signup-onwards E2E on staging (2026-08-22, build 0de1c130), in a browser that had previously held a different user's session.

Symptom chain, reproduced live

A brand-new user (magicflow-…@e2e.objectos.app) signs in on a browser previously used by another account:

1. Header workspace chip renders the previous user's workspace — literally "JIANGUO Zhuang's Workspace" and the "JZ" avatar — for a user whose organization/list is [].
2. auth-active-organization-id in localStorage is not namespaced per user (its own siblings ARE: objectui-recent-items:u:<userId>, flow-palette-recents:u:<userId>). The new session reads the old user's org id.
3. Removing the key does not stick — something rewrites it from another client-side cache (the workspace name also survives, so at least one more unnamespaced store exists; the writer needs locating).
4. Consequence beyond cosmetics: the polluted state suppresses the RequireOrganization → guided "Create your workspace" routing. The new user lands on a Welcome page furnished for the old context instead of the guided first-run — on a shared/handed-over browser the new-user flow silently never happens. (After a full localStorage.clear() + IndexedDB wipe, the clean flow works exactly as designed: chip "MF", "创建你的环境" → guided dialog → org+env born. Verified end to end.)

Server side is CLEAN — verified, not assumed

With the stale org id, as the new user: get-full-organization → 403 USER_IS_NOT_A_MEMBER, set-active → 403, sys_environment list → 0 rows. The #957 wall holds; this is purely client state.

Fix shape

• Namespace auth-active-organization-id (and whatever store carries the workspace display name) with :u:<userId> like its siblings — or key the whole persisted workspace state by user id.
• Find the writer that re-creates the key after removal; it will point at the second unnamespaced store.
• On session-user change (get-session user id differs from the persisted one), drop the previous user's UI state wholesale — that is the invariant that keeps any future unnamespaced key from re-opening this.

[huangyiirene]

Triage first-touch (bare-card sweep): queued pm:queue (bug + domain:ui stand), size S–M. Staging-reproduced, server-side verified clean (the #957 wall holds) — this is pure client state, but the consequence is real: a new user on a shared browser sees the previous user's workspace identity and loses the guided first-run flow.

The card's own three-part fix shape is adopted, with the third part named as the load-bearing one: (1) namespace auth-active-organization-id (and the store carrying the workspace display name) per-user like their :u: siblings; (2) locate the writer that re-creates the key after removal — that hunt finds the second unnamespaced store; (3) the invariant: on session-user change, drop the previous user's UI state wholesale — that is what keeps any future unnamespaced key from re-opening this class, and it gets the pin (sign in as user B after user A ⇒ zero A-scoped reads). Related family: #5703 (queued this session — same storage layer, different defect); coordinate, fold-or-serial per the five gates.

---

Generated by Claude Code

[os-zhuang]

Claim: domain:ui execution seat (seat post #5560), round 20, slot 1 of 3.

• Session: session_01EuPCi56cnGyykygi3z9w4m
• Branch: claude/issue-5664-per-user-client-state
• Worktree: dedicated, one per repo, created off origin/main at 8689166f6
• Domain: domain:ui · Tier: claude-opus-5 (lane default)
• Clause-②: no — client-side storage keys and a session-user-change invariant. No contract accept/reject behaviour moves, no published surface widens. ActiveOrganizationStorage's method signatures are internal to packages/auth's own consumers and are not a metadata authoring face.

File surface granted (write):

packages/auth/src/ActiveOrganizationStorage.ts
packages/auth/src/createAuthenticatedFetch.ts
packages/auth/src/AuthProvider.tsx
packages/auth/src/__tests__/**
apps/console/src/lib/auth-preflight.ts
.changeset/*

Read-only reference (do not edit): packages/app-shell/src/context/UserStateAdapters.tsx:125 — the :u:<userId> convention this fix is asked to match.

Serial constraints — two live, both real:

1. ⛔ packages/auth/src/createAuthenticatedFetch.ts is claimed by THIS card and by nothing else this round. Card Metadata type: 'api' actions send the Bearer token and X-Tenant-ID to absolute third-party URLs — the #2725 sameOriginOnly mitigation was never applied to this lane #5702 (slot 2, dispatched in the same batch) has that file as read-only; its ruled change is confined to packages/app-shell/src/hooks/useConsoleActionRuntime.tsx. If you change the wrapper's signature or its storage reads, say so in your report — Metadata type: 'api' actions send the Bearer token and X-Tenant-ID to absolute third-party URLs — the #2725 sameOriginOnly mitigation was never applied to this lane #5702's dev is instructed to stop and report rather than cross into it, so a silent shape change here lands on them.
2. ⚠️ ActiveOrganizationStorage.ts and createAuthenticatedFetch.ts were both changed 40 minutes ago by ActiveOrganizationStorage's in-memory fallback is unreachable when localStorage exists but rejects writes — the tenant header is then never stamped for the whole session #5703/PR fix(auth): make the ActiveOrganizationStorage memory fallback reachable when localStorage rejects writes #5730 (merged 02:13Z). Re-read them on origin/main; the pre-fix(auth): make the ActiveOrganizationStorage memory fallback reachable when localStorage rejects writes #5730 shape the card was written against is gone. In particular clear() now nulls _memoryValue before removeItem, and the read point is localStorage-first with a memory fallback — a per-user namespacing change has to keep both of those properties, and fix(auth): make the ActiveOrganizationStorage memory fallback reachable when localStorage rejects writes #5730 left a pin (packages/auth/src/__tests__/activeOrgStorageFallback-5703.test.tsx) that will tell you if you broke either.

Slot 3 (#5709) holds packages/sdui-parser/**; no overlap with this fence.

---

Generated by Claude Code