fix(events): authorize the events queued before a stream opens once

[waleedlatif1]

Summary

Review follow-ups to #8700's SSE opening gate.

• Shared pre-open authorization: events that arrived before a revalidated stream opened each queued their own authorization behind the write chain, so ten of them made ten serial checks. They now share one authorization that starts when the stream opens, while each event is still written in order. The comment on the write chain now says exactly which events share a check.
• Defensive guards documented: comments explain the two guards no test can reach without depending on promise-scheduling depth:
  • the fast path's empty-queue check, which covers an event sent from a microtask between the opening and the writes queued before it;
  • the rejection handler on each authorization, which keeps a rejection from surfacing as unhandled until the write chain reaches that event.
• Mock hygiene: the mothership and MCP event route tests reset their ready mocks in beforeEach, so a mockReturnValueOnce cannot leak into the next test.

Type of Change

• Bug fix

Testing

• New writes every event queued before it opened once one authorization passes: ten events are queued before the open, and each authorization is a promise the test controls. Settling only the first writes all ten, in order. On staging it fails, because only the first event can be written before the next serial check.
• SSE, mothership, MCP and desktop route suites pass.
• The desktop inbox E2E over real HTTP on cold apps passed 3/3.
• The full gate (lint, typecheck, audits, unit and integration tests) passes.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 7, 2026 2:58am UTC

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Changes authorization logic for event stream access.

The PR appears safe to merge; no blocking issue remains.

Summary

Events queued before an SSE stream opens now share one authorization check while keeping their write order.

• The revised test releases one authorization and checks every resulting chunk.
• Both earlier review threads are addressed: the mock-call assertion is gone, and the full event sequence is checked.
• The route tests reset their ready mocks between tests.
• No new actionable issues or changed-line rule violations were found.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Events arrive before opening] --> B[Wait for stream to open]
  B --> C[Share one authorization check]
  C --> D{Check passes?}
  D -->|Yes| E[Write each event in arrival order]
  D -->|No| F[Close the stream]

Loading

_{Reviews (2) · Last reviewed commit: "test(events): prove the shared pre-open ..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}