fix(auth): harden diagnostic cleanup races

frontend/src/shell/WorkspaceManager.test.tsx

@@ -327,6 +327,7 @@ test("ignores an older validation response that completes after a newer connecti
 	act(() => releaseTest());
 	const authentication = await screen.findByTestId("workspace-authentication");
 	expect(within(authentication).getByText(/Newer connection result/)).toBeVisible();
+	expect(screen.getByRole("button", { name: "Validate workspace source" })).not.toBeDisabled();
 
 	act(() => releaseValidation());
 	await act(async () => {
@@ -335,6 +336,163 @@ test("ignores an older validation response that completes after a newer connecti
 	});
 	expect(within(authentication).getByText(/Newer connection result/)).toBeVisible();
 	expect(within(authentication).queryByText("Passed")).not.toBeInTheDocument();
+	expect(screen.getByRole("button", { name: "Validate workspace source" })).not.toBeDisabled();
+});
+
+test("does not apply a diagnostic that completes after its dialog is closed and reopened", async () => {
+  const user = userEvent.setup();
+  let release!: () => void;
+  let started!: () => void;
+  let settled!: () => void;
+  const held = new Promise<void>((resolve) => { release = resolve; });
+  const requestStarted = new Promise<void>((resolve) => { started = resolve; });
+  const requestSettled = new Promise<void>((resolve) => { settled = resolve; });
+  server.use(http.post("/api/workspaces/validate", async () => {
+    started();
+    try {
+      await held;
+      return HttpResponse.json({
+        workspace, contract: {}, activatable: true, diagnostics: [], authentication: readyAuthentication,
+      });
+    } finally {
+      settled();
+    }
+  }));
+  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  const onClose = vi.fn();
+  const view = render(
+    <QueryClientProvider client={client}>
+      <WorkspaceManager open onClose={onClose} canManageWorkspace canManageSecrets />
+    </QueryClientProvider>,
+  );
+  await user.click(await screen.findByRole("button", { name: "PSD Clinical" }));
+  await user.click(screen.getByRole("button", { name: "Validate workspace source" }));
+  await requestStarted;
+
+  await user.click(screen.getByRole("button", { name: "Close workspace management" }));
+  expect(onClose).toHaveBeenCalledTimes(1);
+  view.rerender(
+    <QueryClientProvider client={client}>
+      <WorkspaceManager open={false} onClose={onClose} canManageWorkspace canManageSecrets />
+    </QueryClientProvider>,
+  );
+  view.rerender(
+    <QueryClientProvider client={client}>
+      <WorkspaceManager open onClose={onClose} canManageWorkspace canManageSecrets />
+    </QueryClientProvider>,
+  );
+  expect(await screen.findByRole("button", { name: "Validate workspace source" })).not.toBeDisabled();
+
+  act(() => release());
+  await act(async () => {
+    await requestSettled;
+    await new Promise((resolve) => { setTimeout(resolve, 50); });
+  });
+  expect(screen.queryByTestId("workspace-authentication")).not.toBeInTheDocument();
+});
+
+test("does not apply a diagnostic that completes after returning through Level 1", async () => {
+  const user = userEvent.setup();
+  let release!: () => void;
+  let started!: () => void;
+  let settled!: () => void;
+  const held = new Promise<void>((resolve) => { release = resolve; });
+  const requestStarted = new Promise<void>((resolve) => { started = resolve; });
+  const requestSettled = new Promise<void>((resolve) => { settled = resolve; });
+  server.use(http.post("/api/workspaces/validate", async () => {
+    started();
+    try {
+      await held;
+      return HttpResponse.json({
+        workspace, contract: {}, activatable: true, diagnostics: [], authentication: readyAuthentication,
+      });
+    } finally {
+      settled();
+    }
+  }));
+  renderManager();
+  await user.click(await screen.findByRole("button", { name: "PSD Clinical" }));
+  await user.click(screen.getByRole("button", { name: "Validate workspace source" }));
+  await requestStarted;
+
+  await user.click(within(screen.getByRole("navigation", { name: "Workspaces" }))
+    .getByRole("button", { name: "Back to Level 1" }));
+  expect(screen.getByTestId("workspace-overview")).toBeVisible();
+  await user.click(screen.getByRole("button", { name: "PSD Clinical" }));
+  expect(await screen.findByRole("button", { name: "Validate workspace source" })).not.toBeDisabled();
+
+  act(() => release());
+  await act(async () => {
+    await requestSettled;
+    await new Promise((resolve) => { setTimeout(resolve, 50); });
+  });
+  expect(screen.queryByTestId("workspace-authentication")).not.toBeInTheDocument();
+});
+
+test("does not apply a diagnostic after changing workspaces and returning", async () => {
+  const user = userEvent.setup();
+  const alternateId = "other-clinical";
+  const alternateWorkspace = canonicalWorkspaceFixture(alternateId);
+  const alternateRevision = workspaceRevisionFixture(alternateId);
+  let release!: () => void;
+  let started!: () => void;
+  let settled!: () => void;
+  const held = new Promise<void>((resolve) => { release = resolve; });
+  const requestStarted = new Promise<void>((resolve) => { started = resolve; });
+  const requestSettled = new Promise<void>((resolve) => { settled = resolve; });
+  server.use(
+    http.get("/api/workspaces", () => HttpResponse.json([
+      workspaceSummaryFixture("psd-clinical", {
+        displayName: "PSD Clinical",
+        description: "Clinical data",
+        configurationState: "configuration_required",
+        revision,
+      }),
+      workspaceSummaryFixture(alternateId, {
+        displayName: "Other Clinical",
+        description: "Other data",
+        configurationState: "configuration_required",
+        revision: alternateRevision,
+      }),
+    ])),
+    http.get(`/api/workspaces/${alternateId}`, () => HttpResponse.json({
+      workspace: alternateWorkspace,
+      revision: alternateRevision,
+    })),
+    http.get(`/api/workspaces/${alternateId}/runtime-configuration`, () => HttpResponse.json({
+      workspaceId: alternateId,
+      revision: alternateRevision,
+      configurationState: "configuration_required",
+      requirements: [{ ...requirement }],
+    })),
+    http.post("/api/workspaces/validate", async () => {
+      started();
+      try {
+        await held;
+        return HttpResponse.json({
+          workspace, contract: {}, activatable: true, diagnostics: [], authentication: readyAuthentication,
+        });
+      } finally {
+        settled();
+      }
+    }),
+  );
+  renderManager();
+  await user.click(await screen.findByRole("button", { name: "PSD Clinical" }));
+  await user.click(screen.getByRole("button", { name: "Validate workspace source" }));
+  await requestStarted;
+
+  await user.click(screen.getByRole("button", { name: "Other Clinical" }));
+  expect(await screen.findByRole("heading", { name: "Other Clinical" })).toBeVisible();
+  await user.click(screen.getByRole("button", { name: "PSD Clinical" }));
+  expect(await screen.findByRole("button", { name: "Validate workspace source" })).not.toBeDisabled();
+
+  act(() => release());
+  await act(async () => {
+    await requestSettled;
+    await new Promise((resolve) => { setTimeout(resolve, 50); });
+  });
+  expect(screen.queryByTestId("workspace-authentication")).not.toBeInTheDocument();
 });
 
 test("never renders a hostile authentication field rejected by the API decoder", async () => {