Visible User State
Callback URL is exempt from worker cleanup until the next plain navigation.
Reloading during callback can consume a provider code before the app handles it.
Phase 7B Session Contract Harness
Service Worker Skip
Global worker eviction skips one-time callback URLs and runs later.
Pass/session-contract/callback-simulation?code=one-time-code
Production Routes Still Owned By SPA
- /login
- /register
- /forgot-password
- /reset-password
- /auth/callback
Detect callback
One-time auth params prevent service-worker eviction on this navigation.
Preserve code
No reload happens before the server exchange can consume the code once.
Cleanup later
Worker cleanup resumes on the next non-callback page load.
Scenario Assertions
- No reload loop
- PassDo not reload while a one-time code is present.
Cutover Rules
- Do not exchange provider codes in the browser.
- Do not replay callback URLs after one-time params are consumed.
- Do not navigate to protected destinations until user state exists.
- Do not run worker eviction on one-time callback URLs.
- Do not move real auth routes until the browser matrix passes.
Provider Shell
Query: ready
Shell: isolated
Production router: untouched