[lawalajose]

What changed

Adds token-free BroadcastChannel synchronization for logout and acting-for profile changes. A logout clears auth, profile, and React Query state in every listening tab; profile changes carry only the profile ID and are applied without rebroadcasting. Browsers without BroadcastChannel keep working as single-tab sessions. Mocked-channel tests cover received events, payload privacy, deferred profile selection, fallback behavior, and cleanup.

This progresses #124 but does not close it: refresh single-flight is not implemented because the required POST /auth/refresh flow from #9 is still open and absent from the base branch. No access tokens are sent over the channel.

Which ROADMAP.md item does this close/progress?

closes #124
Progresses the W7 multi-tab session sync item for #124; refresh coordination remains blocked on #9.

Docs updated in this PR (check all that apply)

• ROADMAP.md
• ARCHITECTURE.md
• ARCHITECTURE_ESSENTIALS.md
• PRD.md
• N/A for this change

Validation:

• npm run typecheck — passed.
• npx vitest run src/hooks/useSessionSync.test.ts — passed (6 tests).
• npm test — passed (41 files, 379 tests).
• npm run build — passed, with existing malformed-CSS and >500 KB chunk warnings.
• npm run check:dist — passed.
• GitHub PR malware scan — passed. No other CI workflow checks are reported.
• No lint script is defined in package.json.

No screenshots: this PR changes no screen or visual UI.

[github-actions]

@lawalajose This PR now has merge conflicts with main, most likely because #135 (feat(messaging): message attachments — upload with progress, preview and secure download (#23)) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-web.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared files like ROADMAP.md and ARCHITECTURE*.md. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[drips-wave]

@lawalajose Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[github-actions]

@lawalajose This PR now has merge conflicts with main, most likely because #190 (feat(search): search across my own records) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-web.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[afeezorobsco-cyber]

@lawalajose CI is failing on this branch: npm run typecheck stops on two unused imports in src/features/auth/hooks/useLogout.ts:

useLogout.ts(3,10): error TS6133: 'broadcastLogout' is declared but its value is never read.
useLogout.ts(5,10): error TS6133: 'useProfileStore' is declared but its value is never read.

Either call them, which I'd expect for a cross-tab logout broadcast, or remove the imports. Then run npm run typecheck && npm test and push.

[github-actions]

@lawalajose This PR now has merge conflicts with main, most likely because #157 (feat(platform): complete W7 API client, errors, PWA, and i18n) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-web.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}