[Serph91P]

Summary

Refs #900. Partial return-navigation fix only. Keep #900 open.

• Preserve an existing safe returnTo when late parallel API 401s arrive after login has rendered. Authentication loss on a protected page retains its path, query and hash.
• Reuse loginLocationFor and its existing sanitizer. External, protocol-relative, JavaScript and nested-auth destinations stay rejected. Session cleanup, single-flight refresh, cookies/CSRF, genuine application updates and chunk recovery remain unchanged.
• Add public-boundary unit regressions and eight original REAL-build desktop/mobile, cold/previously-visited and normal/late-401 browser cases; retain the additive CI step.
• Regularly forward-integrated with actual develop e6c21f24f9081f13aa188412ea8d6b3575c3efdc, including reviewed Resolve canonical PWA precache URLs in UX06 loading measurements #1042 / fix: resolve canonical PWA URLs in UX06 loading measurements #1043. No dependency/lock, budget, scanner, service-worker behavior or threshold delta against current develop.

Current exact composition

• Head: e20ebf9419d04eeb62453cc84bb2fa3dd0f53421
• Base: develop at e6c21f24f9081f13aa188412ea8d6b3575c3efdc
• Tested tree: 136db4756e1fd59bf3366658524d4fbf42c9002b
• Original independent review APPROVED at bf590cedd6c90d07fa785fd59ac064d6fad14d75 remains applicable to the unchanged auth regression files and minimal shared redirect. Integration was conflict-free; no new product implementation or gate relaxation.

Fresh owner verification

Actual isolated --rm Playwright 1.63.0 Noble container, Node 24.20.0, safe exact Git export without .env*, no operator data or provider contacts:

• 637 unit tests passed / 4 existing mode-dependent skips; 45 Foundation tests passed.
• Type checks, lint (0 errors / 135 existing warnings), token and generated-Foundation checks passed.
• Original build-output contract: two identical clean MOCK builds, 85 files. Both REAL and MOCK provenance, precache integrity, output budgets and original UX06 loading measurement passed without changing assertions, limits, baselines or timeouts.

Build	Initial bytes	Playback bytes	Precache entries	Precache bytes	Initial HLS
MOCK	727497	692028	81	2412037	0
REAL	722645	692028	82	2408272	0

• All eight original REAL-build browser cases passed: exactly one document request/navigation entry, no second document or input remount after login rendered, username preserved, internal returnTo retained and final target reached after synthetic login. Current late cases observe four held API 401s and one grouped refresh; the assertions are unchanged, not pinned to the historical 19-request count.
• Browser HTTP/auth responses are synthetic; build, DOM and service worker are real. This is not a real operator login, physical-device pass or original production-reload reproduction.

Current CI and security

All 23 current-head checks completed successfully, including all seven active Required contexts matched to GitHub App 15368 in ruleset 23886776. Tests 41593793737, Security 41593793774 and Docker 41593793659 are successful. CI merge 9f649c984b4f657dcb04530e3530cd0a6eca014c has the exact tested candidate tree and expected base/head parents. Current backend CI: 1092 passed / 20 existing skips / 2 subtests, plus 12 migration foundation/orchestration tests. Main browser job: 244 passed, Foundation 5+1+5; the original return suite passes all eight cases. Integration confirms concurrent fresh PostgreSQL first boot, 48/48 distinct successful migrations, healthy applications, persisted proxy key unchanged after immediate restart and the complete HTTP surface. #1043's three exact-merge postmerge pipelines are also successful. Ready/merge is guarded again immediately against live develop and head; this does not close #900.

Original current security reports were read and compared with actual develop Security 41593765744 and preceding baseline 41586781783:

• npm: 25 Moderate / 2 Low / 0 High / 0 Critical; report exactly identical to current develop. No dependency delta.
• pip-audit: 75 dependencies, 0 skipped, 0 vulnerabilities. Gitleaks: 0 results.
• Bandit: 0 results in the unchanged High-Severity/High-Confidence filter, 0 scan errors; full metrics remain 0 High / 2 Medium / 66 Low / 1 skipped test, identical to base.
• Trivy HIGH/CRITICAL gates passed; current table reports 0 in scanned targets. Existing Alpine EOL-list/SBOM warnings limit the scanner claim. Five current Dockerfile alerts (DL3018/DL3025/DL3066) remain; historical Trivy alerts on old commits are not current scan findings.
• Existing findings remain in the exclusive refactor(backend): complete production-grade modernization and operational gates #842 owner scope; no suppression or whole-product all-clean/risk-acceptance claim.

Historical observations and open original criteria

• Original reviewer independently reproduced three unit and four late-401 browser REDs before the return fix. Original broad host/container attempts were not green (host browser libraries/timeouts and visual-reference differences); no snapshots were refreshed to hide them. Historical exact-head remote suite passed 192 browser cases / 46 existing skips, plus Foundation 5+1+5; backend passed 630 / 13 existing skips plus 12 migration foundation/orchestration cases. These are history, not current-composition results.
• Original unchanged-version startup reload was not reproduced. Separately, a genuine installed-old-worker -> newer REAL-build experiment recorded two activated worker versions, actual document reload and unsaved-login-input loss on desktop/mobile. That is not a draft-preservation PASS and is not fixed by this PR.
• That earlier version experiment retained the original backend /sw.js push append but needed explicit test-only delivery of exact root build files after unchanged isolated backend routes returned 404. It does not establish full original deployment/backend-auth acceptance. The canonical public-asset repair is now separately integrated; no new version-transition acceptance is inferred.
• The older issue comment promising an additional update correction on this PR is superseded for this delivery: this PR ships only the independently reviewed return-navigation fix. Original installed-profile reproduction, legacy-to-fixed/multi-tab update behavior, failed/in-flight-login preservation and safe update/restart acceptance remain open owner work under fix(auth): prevent extra login page reload after unauthenticated redirect #900 / Make the safe-update scripts fail closed and honor the documented installation layout #943. No credentials or drafts are persisted and no update/recovery behavior is disabled.

No manual release or deployment is part of this PR delivery. Existing develop branch automation runs normally after an authorized merge.

[Serph91P]

Owner delivery verified: regular merge to develop 1a364a25433623ebad481deeeb769197c72e3e0d, parents e6c21f24 + e20ebf94, exact tested tree 136db4756e1fd59bf3366658524d4fbf42c9002b. Original independent review retained; ready only after all 23 exact-head checks, seven Required App15368 contexts, current security reports and immediate base/head/CI-tree guards passed.

Fresh owner: 637 unit passes / 4 existing skips, 45 Foundation passes, eight original REAL-build synthetic-auth browser cases and every unchanged REAL/MOCK measurement/output/precache/budget gate passed. REAL loading bytes: initial 722645 / playback 692028 / precache 2408272 in 82 entries; MOCK 727497 / 692028 / 2412037 in 81 entries; initial HLS 0 in both.

All three actual-merge postmerge workflows completed/success and original logs read: Tests, Security, existing develop automation. Postmerge: 1092 backend passes / 20 existing skips / 2 subtests, 244 main browser passes, 8 original auth cases; concurrent fresh PostgreSQL first boot, 48/48 distinct successful migrations, persisted key unchanged after restart and HTTP surface verified. No manual release/deploy.

Security is base-equivalent, not all-clean: npm 25 Moderate / 2 Low / 0 High/Critical; pip 75 dependencies / 0 skipped / 0 vulnerabilities; Bandit 0 High / 2 Medium / 66 Low / 1 skipped test and 0 High/High-filtered results; Gitleaks 0 / Trivy HIGH-CRITICAL gates passed. Five current Dockerfile alerts remain in the existing #842 scope; historical old-commit alerts are separated. #900 stays open for original reload/update/real-auth criteria and #943 for update/restart acceptance. The eight synthetic-auth cases do not close those contracts.