diff --git a/src-tauri/src/device_activation.rs b/src-tauri/src/device_activation.rs
index b2015aeb..de42c95c 100644
--- a/src-tauri/src/device_activation.rs
+++ b/src-tauri/src/device_activation.rs
@@ -66,12 +66,15 @@ pub struct ActivatedResult {
     pub device_id: String,
     pub limit: u32,
     pub used: u32,
-    /// Device-bound 30-day lease — persisted into the session store.
-    /// The backend keeps `access_token`-style snake_case for token fields;
-    /// `refreshToken` is aliased because camelCase responses were observed
-    /// in the wild and a silent None here is what kills session renewal.
-    #[serde(rename = "refresh_token", alias = "refreshToken", default)]
+    /// Accept the API's snake_case token and expose camelCase over IPC.
+    #[serde(alias = "refresh_token", default)]
     pub refresh_token: Option<String>,
+    #[serde(
+        alias = "access_token",
+        default,
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub access_token: Option<String>,
 }
 
 fn device_limit_error(info: &DeviceLimitInfo) -> String {
@@ -196,6 +199,7 @@ pub async fn activate_device(
     }
     let payload = state.payload();
 
+    let mut rotated_access = None;
     let mut attempt = post_activate(&token, &payload, replace_device_id.as_deref()).await;
     if let ActivateAttempt::Unauthorized = attempt {
         let lease = refresh_token.as_deref().unwrap_or("").trim();
@@ -206,6 +210,7 @@ pub async fn activate_device(
                     json!({
                         "accessToken": refreshed.access_token,
                         "refreshToken": refreshed.refresh_token,
+                        "previousRefreshToken": refreshed.previous_refresh_token,
                     }),
                 );
                 attempt = post_activate(
@@ -214,6 +219,7 @@ pub async fn activate_device(
                     replace_device_id.as_deref(),
                 )
                 .await;
+                rotated_access = Some(refreshed.access_token);
             }
         }
     }
@@ -221,7 +227,10 @@ pub async fn activate_device(
     match attempt {
         // The device-bound lease rides back to the frontend, which persists
         // it alongside the rest of the account session.
-        ActivateAttempt::Ok(result) => Ok(result),
+        ActivateAttempt::Ok(mut result) => {
+            result.access_token = rotated_access;
+            Ok(result)
+        }
         ActivateAttempt::LimitReached(info) => Err(device_limit_error(&info)),
         ActivateAttempt::Unauthorized => Err("session expired — please sign in again".to_string()),
         ActivateAttempt::Failed(message) => Err(message),
@@ -296,6 +305,9 @@ mod tests {
         });
         let result: ActivatedResult = serde_json::from_value(raw).expect("result");
         assert_eq!(result.refresh_token.as_deref(), Some("opaque-lease"));
+        let ipc = serde_json::to_value(&result).expect("IPC result");
+        assert_eq!(ipc["refreshToken"], "opaque-lease");
+        assert!(ipc.get("refresh_token").is_none());
 
         // camelCase lease responses must land too — a silent None here is
         // exactly what broke session renewal in the field.
diff --git a/src-tauri/src/entitlement.rs b/src-tauri/src/entitlement.rs
index 667217da..58b1814e 100644
--- a/src-tauri/src/entitlement.rs
+++ b/src-tauri/src/entitlement.rs
@@ -181,6 +181,8 @@ pub struct EntitlementView {
     /// Session health verdict (`SESSION_PHASE_*`) — see the constant docs.
     pub session_phase: &'static str,
     pub last_error: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub refreshed_session: Option<crate::session::RefreshedSession>,
 }
 
 /// Pure entitlement decision. Fail-closed: an unparseable release date or
@@ -274,6 +276,7 @@ impl EntitlementState {
             fetched_at_ms: binding.as_ref().map(|c| c.fetched_at_ms),
             session_phase,
             last_error,
+            refreshed_session: None,
         }
     }
 
@@ -478,7 +481,7 @@ pub async fn refresh_entitlement(
     identity: State<'_, crate::device_activation::DeviceIdentityState>,
     app: AppHandle,
 ) -> Result<EntitlementView, String> {
-    let (view, rotated) = refresh_entitlement_core(
+    let (mut view, rotated) = refresh_entitlement_core(
         &token,
         refresh_token.as_deref(),
         force,
@@ -488,11 +491,13 @@ pub async fn refresh_entitlement(
     )
     .await?;
     if let Some(refreshed) = rotated {
+        view.refreshed_session = Some(refreshed.clone());
         let _ = app.emit(
             "session-refreshed",
             json!({
                 "accessToken": refreshed.access_token,
                 "refreshToken": refreshed.refresh_token,
+                "previousRefreshToken": refreshed.previous_refresh_token,
             }),
         );
     }
@@ -713,6 +718,66 @@ mod tests {
             .respond_with(wiremock::ResponseTemplate::new(status).set_body_json(body))
     }
 
+    #[tokio::test]
+    async fn a_transient_rotation_failure_can_retry_the_same_lease() {
+        let server = console_server().await;
+        let lease = format!("transient-{}", uuid::Uuid::new_v4().simple());
+        let state = crate::session::SessionState::default();
+        let identity = identity_state("transient-rotation").payload();
+        let failure = mock_refresh_lease(&lease, 503, json!({ "code": 5000 }))
+            .expect(1)
+            .mount_as_scoped(server)
+            .await;
+        assert!(crate::session::rotate_session(&state, &lease, &identity)
+            .await
+            .is_err());
+        drop(failure);
+        let success = mock_refresh_lease(
+            &lease,
+            200,
+            json!({
+                "code": 2000,
+                "data": { "access_token": "next-access", "refresh_token": "next-lease" }
+            }),
+        )
+        .expect(1)
+        .mount_as_scoped(server)
+        .await;
+        let rotated = crate::session::rotate_session(&state, &lease, &identity)
+            .await
+            .expect("retry after transient failure");
+        assert_eq!(rotated.previous_refresh_token, lease);
+        drop(success);
+    }
+
+    #[tokio::test]
+    async fn concurrent_rotations_share_the_successor_without_replaying_the_lease() {
+        let server = console_server().await;
+        let lease = format!("concurrent-{}", uuid::Uuid::new_v4().simple());
+        let response = mock_refresh_lease(
+            &lease,
+            200,
+            json!({
+                "code": 2000,
+                "data": { "access_token": "next-access", "refresh_token": "next-lease" }
+            }),
+        )
+        .expect(1)
+        .mount_as_scoped(server)
+        .await;
+        let state = crate::session::SessionState::default();
+        let identity = identity_state("concurrent-rotation").payload();
+        let (first, second) = tokio::join!(
+            crate::session::rotate_session(&state, &lease, &identity),
+            crate::session::rotate_session(&state, &lease, &identity),
+        );
+        let first = first.expect("first rotation");
+        let second = second.expect("shared rotation");
+        assert_eq!(first.refresh_token, second.refresh_token);
+        assert_eq!(second.previous_refresh_token, lease);
+        drop(response);
+    }
+
     #[test]
     fn views_carry_the_derived_session_phase() {
         let state = EntitlementState::load(None);
diff --git a/src-tauri/src/session.rs b/src-tauri/src/session.rs
index 5d980ae8..292b9025 100644
--- a/src-tauri/src/session.rs
+++ b/src-tauri/src/session.rs
@@ -6,13 +6,13 @@
 //! lease + device identity, receive the successor pair, and classify
 //! rejections so the frontend can drop dead leases.
 //!
-//! Rotations serialize through `SessionState::rotate_lock`: the lease is
-//! single-use and the server treats presenting an already-rotated token as a
-//! leak that revokes the device scope, so two concurrent rotations must
-//! never race.
+//! Successful rotations are shared by callers presenting the same lease so
+//! concurrent entitlement and activation requests cannot replay a consumed token,
+//! including when the app sleeps between queued callers.
 
 use serde::{Deserialize, Serialize};
 use serde_json::json;
+use std::collections::VecDeque;
 use tauri::{AppHandle, Emitter, State};
 
 use crate::common::console;
@@ -22,10 +22,16 @@ pub const SESSION_REJECTED_ERROR_TYPE: &str = "SESSION_REJECTED";
 
 #[derive(Default)]
 pub struct SessionState {
-    /// See module docs — guards the present-then-replace window.
-    pub rotate_lock: tokio::sync::Mutex<()>,
+    rotations: tokio::sync::Mutex<VecDeque<CachedRotation>>,
 }
 
+struct CachedRotation {
+    previous: String,
+    session: RefreshedSession,
+}
+
+const ROTATION_CACHE_LIMIT: usize = 64;
+
 pub fn session_rejected_error(message: &str) -> String {
     json!({
         "error_type": SESSION_REJECTED_ERROR_TYPE,
@@ -40,6 +46,8 @@ pub struct RefreshedSession {
     pub access_token: String,
     #[serde(rename = "refresh_token")]
     pub refresh_token: String,
+    #[serde(default, skip_deserializing)]
+    pub previous_refresh_token: String,
 }
 
 /// Exchange a lease for the successor pair. The caller must surface the
@@ -60,7 +68,13 @@ pub async fn rotate_session(
         return Err("no stored refresh token".to_string());
     }
 
-    let _guard = state.rotate_lock.lock().await;
+    let mut rotations = state.rotations.lock().await;
+    if let Some(cached) = rotations
+        .iter()
+        .find(|entry| entry.previous == refresh_token)
+    {
+        return Ok(cached.session.clone());
+    }
     let response = console::client()
         .post(format!("{}/api/v1/auth/refresh", console::api_base_url()))
         .json(&json!({ "refresh_token": refresh_token, "device": device_payload }))
@@ -89,8 +103,19 @@ pub async fn rotate_session(
     }
 
     let data = raw.get("data").cloned().unwrap_or(json!({}));
-    let session: RefreshedSession =
+    let mut session: RefreshedSession =
         serde_json::from_value(data).map_err(|e| format!("invalid refresh result: {e}"))?;
+    if !status.is_success() {
+        return Err(format!("refresh endpoint returned HTTP {status}"));
+    }
+    session.previous_refresh_token = refresh_token.to_string();
+    if rotations.len() >= ROTATION_CACHE_LIMIT {
+        rotations.pop_front();
+    }
+    rotations.push_back(CachedRotation {
+        previous: refresh_token.to_string(),
+        session: session.clone(),
+    });
     Ok(session)
 }
 
@@ -114,6 +139,7 @@ pub async fn rotate_session_now(
         json!({
             "accessToken": refreshed.access_token,
             "refreshToken": refreshed.refresh_token,
+            "previousRefreshToken": refreshed.previous_refresh_token,
         }),
     );
     Ok(refreshed)
@@ -134,7 +160,10 @@ pub async fn revoke_session(refresh_token: Option<String>) -> Result<(), String>
         .await
         .map_err(|e| format!("network error: {e}"))?;
     if !response.status().is_success() {
-        return Err(format!("logout endpoint returned HTTP {}", response.status()));
+        return Err(format!(
+            "logout endpoint returned HTTP {}",
+            response.status()
+        ));
     }
     Ok(())
 }
diff --git a/src/App.vue b/src/App.vue
index f0cedaa6..a543d0eb 100644
--- a/src/App.vue
+++ b/src/App.vue
@@ -1,11 +1,10 @@
 <script setup lang="ts">
-import type { UnlistenFn } from '@tauri-apps/api/event'
 import { invoke } from '@tauri-apps/api/core'
 import { listen } from '@tauri-apps/api/event'
 import { storeToRefs } from 'pinia'
 import { onMounted, onUnmounted, watch } from 'vue'
 import { RouterView } from 'vue-router'
-import { shouldRotateToken } from '@/common'
+import { createSessionLifecycle } from '@/common'
 import DeviceReplaceDialog from '@/components/DeviceReplaceDialog.vue'
 import AppNotifications from '@/components/ui/notification/AppNotifications.vue'
 import UpdateNotification from '@/components/UpdateNotification.vue'
@@ -18,17 +17,6 @@ import { useDeviceStore } from '@/store/deviceStore'
 import { useEntitlementStore } from '@/store/entitlementStore'
 import { lang } from './lang'
 
-type AuthPayload = {
-  token: string
-  username: string
-  email: string
-  userId?: string
-  avatar?: string
-  ultimateExpiresAt?: string | null
-  versionLockHorizon?: string | null
-  cancelScheduledAt?: string | null
-}
-
 const appStore = useAppStore()
 const { themeType } = storeToRefs(appStore)
 const accountStore = useAccountStore()
@@ -41,81 +29,34 @@ watch(themeType, (newTheme) => {
   appStore.setThemeType(newTheme)
 }, { immediate: true })
 
-let unlistenAuth: UnlistenFn | null = null
-let unlistenSessionRefresh: UnlistenFn | null = null
-
-// Idempotent: events and the cold-start pull may both deliver the same link.
-async function handleAuth(payload: AuthPayload) {
-  accountStore.setAuth(payload.token, payload.username, payload.email, payload.userId, payload.avatar)
-  // Await the local seed so it can never land after the network refresh
-  // below and overwrite a fresher server answer with the snapshot.
-  await entitlementStore.seedFromHandoff(payload)
-  entitlementStore.refreshEntitlement(true)
-  // The deep-linked token comes from a web login with no device attached —
-  // register/verify this machine right away.
-  deviceStore.ensureActivated(true)
-}
-
-async function rotateStaleSession() {
-  if (!accountStore.refreshToken || !shouldRotateToken(accountStore.token, accountStore.refreshToken))
-    return
-  try {
-    const refreshed = await invoke<{ access_token: string, refresh_token: string }>(
-      'rotate_session_now',
-      { refreshToken: accountStore.refreshToken },
-    )
-    accountStore.setToken(refreshed.access_token)
-    accountStore.setRefreshToken(refreshed.refresh_token)
-  }
-  catch {
-    // rejected or transient — the reactive 401 paths still recover
-  }
-}
+const sessionLifecycle = createSessionLifecycle({
+  read: () => ({ token: accountStore.token, refreshToken: accountStore.refreshToken, revision: accountStore.sessionRevision }),
+  authenticate: (payload) => {
+    entitlementStore.view = null
+    entitlementStore.sessionRejections = 0
+    deviceStore.$reset()
+    accountStore.setAuth(payload.token, payload.username ?? '', payload.email ?? '', payload.userId ?? '', payload.avatar ?? '')
+  },
+  applyRotation: payload => accountStore.applySessionRefresh(payload.previousRefreshToken, payload.accessToken, payload.refreshToken),
+  seed: payload => entitlementStore.seedFromHandoff(payload),
+  hydrate: () => entitlementStore.hydrate(),
+  refresh: () => entitlementStore.refreshEntitlement(true),
+  activate: force => deviceStore.ensureActivated(force),
+  clearCache: () => entitlementStore.clearCachedEntitlement(),
+  rotate: refreshToken => invoke('rotate_session_now', { refreshToken }),
+  listenAuth: handler => listen('sqlkit://auth', event => handler(event.payload as Parameters<typeof handler>[0])),
+  listenRotation: handler => listen('session-refreshed', event => handler(event.payload as Parameters<typeof handler>[0])),
+  consumeAuth: () => invoke('consume_pending_auth'),
+})
 
 onMounted(async () => {
   checkForUpdates(false)
 
-  if (accountStore.isLoggedIn) {
-    await entitlementStore.hydrate()
-    // Rotate before the refresh so it goes out with a valid bearer.
-    await rotateStaleSession()
-    entitlementStore.refreshEntitlement(true)
-    // geekfun#59: entitlement-activation point — register/verify this device.
-    deviceStore.ensureActivated()
-  }
-  else {
-    // A cached plan must not outlive the session.
-    void entitlementStore.clearCachedEntitlement()
-  }
-
-  // Listeners must exist before the pending-auth pull below.
-  unlistenAuth = await listen<AuthPayload>('sqlkit://auth', ({ payload }) => {
-    handleAuth(payload)
-  })
-
-  // Transparent session refresh (Rust rotates the lease): keep the frontend
-  // copy of both tokens in sync.
-  unlistenSessionRefresh = await listen<{ accessToken: string, refreshToken: string }>('session-refreshed', ({ payload }) => {
-    accountStore.setToken(payload.accessToken)
-    accountStore.setRefreshToken(payload.refreshToken)
-  })
-
-  // Cold start: a deep link can arrive before these listeners exist — Rust
-  // parks it in pending state; consume it now.
-  try {
-    const pending = await invoke<AuthPayload | null>('consume_pending_auth')
-    if (pending) {
-      handleAuth(pending)
-    }
-  }
-  catch {
-    // no pending auth is the normal case
-  }
+  await sessionLifecycle.start()
 })
 
 onUnmounted(() => {
-  unlistenAuth?.()
-  unlistenSessionRefresh?.()
+  sessionLifecycle.dispose()
 })
 
 // The store resolves the loss; surface the single notice.
diff --git a/src/common/entitlement.ts b/src/common/entitlement.ts
index 778c4412..fa556c7b 100644
--- a/src/common/entitlement.ts
+++ b/src/common/entitlement.ts
@@ -4,9 +4,19 @@ export const SSH_TUNNEL_STRIPPED_ERROR_TYPE = 'SSH_TUNNEL_STRIPPED'
 
 export const UPGRADE_URL = 'https://www.geekfun.club/pricing'
 
-export type PaidFeature = 'ai' | 'er_diagram' | 'transfer' | 'ssh_tunnel' | 'mcp_bridge'
+export type PaidFeature
+  = | 'ai'
+    | 'er_diagram'
+    | 'transfer'
+    | 'ssh_tunnel'
+    | 'mcp_bridge'
 
 export type EntitlementView = {
+  refreshedSession?: {
+    access_token: string
+    refresh_token: string
+    previous_refresh_token: string
+  }
   ultimateActive: boolean
   versionLocked: boolean
   localUltimate: boolean
diff --git a/src/common/index.ts b/src/common/index.ts
index 01752896..83baea9c 100644
--- a/src/common/index.ts
+++ b/src/common/index.ts
@@ -7,6 +7,8 @@ export * from './agentPrompt'
 export * from './aiPermissions'
 export * from './entitlement'
 export * from './sessionExpiry'
+export * from './sessionLifecycle'
+
 export * from './sessionPhase'
 
 export * from './sqlParser'
diff --git a/src/common/sessionLifecycle.ts b/src/common/sessionLifecycle.ts
new file mode 100644
index 00000000..1aa20461
--- /dev/null
+++ b/src/common/sessionLifecycle.ts
@@ -0,0 +1,131 @@
+import { shouldRotateToken } from './sessionExpiry'
+
+type AuthPayload = {
+  token: string
+  username?: string | null
+  email?: string | null
+  userId?: string | null
+  avatar?: string | null
+  ultimateExpiresAt?: string | null
+  versionLockHorizon?: string | null
+  cancelScheduledAt?: string | null
+}
+
+type Rotation = {
+  accessToken: string
+  refreshToken: string
+  previousRefreshToken: string
+}
+type Unlisten = () => void
+type SessionLifecycle = {
+  read: () => { token: string, refreshToken: string, revision: number }
+  authenticate: (payload: AuthPayload) => void
+  applyRotation: (rotation: Rotation) => void
+  seed: (payload: AuthPayload) => Promise<void>
+  hydrate: () => Promise<void>
+  refresh: () => Promise<unknown>
+  activate: (force: boolean) => Promise<void>
+  clearCache: () => Promise<void>
+  rotate: (
+    refreshToken: string,
+  ) => Promise<{ access_token: string, refresh_token: string }>
+  listenAuth: (handler: (payload: AuthPayload) => void) => Promise<Unlisten>
+  listenRotation: (handler: (rotation: Rotation) => void) => Promise<Unlisten>
+  consumeAuth: () => Promise<AuthPayload | null>
+}
+
+export const createSessionLifecycle = (ports: SessionLifecycle) => {
+  let lastHandoff: { token: string, revision: number } | null = null
+  let unlisteners: Unlisten[] = []
+  let disposed = false
+
+  const current = (revision: number) =>
+    !disposed && ports.read().revision === revision
+
+  const handleAuth = async (payload: AuthPayload) => {
+    if (disposed || !payload.token)
+      return
+    if (lastHandoff?.token === payload.token && current(lastHandoff.revision))
+      return
+    ports.authenticate(payload)
+    const revision = ports.read().revision
+    lastHandoff = { token: payload.token, revision }
+    await ports.seed(payload)
+    if (!current(revision))
+      return
+    await ports.activate(true)
+    if (current(revision))
+      await ports.refresh()
+  }
+
+  const register = async (subscription: Promise<Unlisten>) => {
+    const unlisten = await subscription
+    if (disposed)
+      unlisten()
+    else unlisteners = [...unlisteners, unlisten]
+  }
+
+  const start = async () => {
+    const initialRevision = ports.read().revision
+    await register(
+      ports.listenRotation((rotation) => {
+        if (!disposed)
+          ports.applyRotation(rotation)
+      }),
+    )
+    if (disposed)
+      return
+    await register(
+      ports.listenAuth((payload) => {
+        void handleAuth(payload)
+      }),
+    )
+    if (disposed)
+      return
+    const pending = await ports.consumeAuth().catch(() => null)
+    if (disposed)
+      return
+    if (pending) {
+      await handleAuth(pending)
+      return
+    }
+    if (!current(initialRevision))
+      return
+    if (!ports.read().token) {
+      await ports.clearCache()
+      return
+    }
+    await ports.hydrate()
+    if (!current(initialRevision))
+      return
+    const session = ports.read()
+    if (shouldRotateToken(session.token, session.refreshToken)) {
+      try {
+        const rotated = await ports.rotate(session.refreshToken)
+        if (!current(initialRevision))
+          return
+        ports.applyRotation({
+          accessToken: rotated.access_token,
+          refreshToken: rotated.refresh_token,
+          previousRefreshToken: session.refreshToken,
+        })
+      }
+      catch {
+        // The reactive request can retry transport failures or report a dead lease.
+      }
+    }
+    if (!current(initialRevision))
+      return
+    await ports.activate(false)
+    if (current(initialRevision))
+      await ports.refresh()
+  }
+
+  const dispose = () => {
+    disposed = true
+    unlisteners.forEach(unlisten => unlisten())
+    unlisteners = []
+  }
+
+  return { start, dispose }
+}
diff --git a/src/store/accountStore.ts b/src/store/accountStore.ts
index ae0ba5c1..bbe0e1a4 100644
--- a/src/store/accountStore.ts
+++ b/src/store/accountStore.ts
@@ -1,6 +1,7 @@
 import { defineStore } from 'pinia'
 
 type AccountState = {
+  sessionRevision: number
   token: string
   /**
    * Device-bound 30-day lease (geekfun#59) — lives with the session so a
@@ -17,6 +18,7 @@ type AccountState = {
 
 export const useAccountStore = defineStore('account', {
   state: (): AccountState => ({
+    sessionRevision: 0,
     token: '',
     refreshToken: '',
     username: '',
@@ -24,12 +26,18 @@ export const useAccountStore = defineStore('account', {
     userId: '',
     avatar: '',
   }),
-  persist: true,
+  persist: { pick: ['token', 'refreshToken', 'username', 'email', 'userId', 'avatar'] },
   getters: {
     isLoggedIn: (state): boolean => state.token.length > 0,
   },
   actions: {
+    applySessionRefresh(previousRefreshToken: string, accessToken: string, refreshToken: string): void {
+      if (!this.isLoggedIn || !previousRefreshToken || this.refreshToken !== previousRefreshToken)
+        return
+      this.$patch({ token: accessToken, refreshToken })
+    },
     setAuth(token: string, username: string, email: string, userId = '', avatar = '') {
+      this.sessionRevision += 1
       this.token = token
       this.username = username
       this.email = email
@@ -45,6 +53,7 @@ export const useAccountStore = defineStore('account', {
       this.refreshToken = token
     },
     clearAuth() {
+      this.sessionRevision += 1
       this.token = ''
       this.refreshToken = ''
       this.username = ''
diff --git a/src/store/deviceStore.ts b/src/store/deviceStore.ts
index 639b6bf7..70154846 100644
--- a/src/store/deviceStore.ts
+++ b/src/store/deviceStore.ts
@@ -22,6 +22,7 @@ export type DeviceLimitInfo = {
 }
 
 export type ActivatedResult = {
+  accessToken?: string | null
   deviceId: string
   limit: number
   used: number
@@ -50,6 +51,7 @@ export const useDeviceStore = defineStore('device', {
     used: number
     limitInfo: DeviceLimitInfo | null
     showReplaceDialog: boolean
+    activationRevision: number
     activating: boolean
     /** Last activation failure — shown in the plan section (plan-section.vue). */
     activationError: string | null
@@ -59,6 +61,7 @@ export const useDeviceStore = defineStore('device', {
     used: 0,
     limitInfo: null,
     showReplaceDialog: false,
+    activationRevision: -1,
     activating: false,
     activationError: null,
   }),
@@ -68,7 +71,7 @@ export const useDeviceStore = defineStore('device', {
   },
   actions: {
     shouldAttempt(force: boolean): boolean {
-      if (force) {
+      if (force || !useAccountStore().refreshToken) {
         return true
       }
       const last = Number(localStorage.getItem(LAST_ACTIVATED_KEY) ?? 0)
@@ -78,32 +81,49 @@ export const useDeviceStore = defineStore('device', {
     // cannot self-heal; 5030 needs the user's replace decision instead.
     async ensureActivated(force = false): Promise<void> {
       const accountStore = useAccountStore()
-      if (!accountStore.isLoggedIn || this.activating || !this.shouldAttempt(force)) {
+      const revision = accountStore.sessionRevision
+      if (
+        !accountStore.isLoggedIn
+        || (this.activating && this.activationRevision === revision)
+        || !this.shouldAttempt(force)
+      ) {
         return
       }
+      this.activationRevision = revision
       this.activating = true
       try {
         for (let attempt = 0; ; attempt += 1) {
+          if (accountStore.sessionRevision !== revision)
+            return
           try {
             const result = await invoke<ActivatedResult>('activate_device', {
               token: accountStore.token,
               refreshToken: accountStore.refreshToken || null,
               replaceDeviceId: null,
             })
+            if (accountStore.sessionRevision !== revision)
+              return
             this.applyActivated(result)
             this.activationError = null
-            localStorage.setItem(LAST_ACTIVATED_KEY, String(Date.now()))
+            if (accountStore.refreshToken)
+              localStorage.setItem(LAST_ACTIVATED_KEY, String(Date.now()))
             return
           }
           catch (err) {
+            if (accountStore.sessionRevision !== revision)
+              return
             const limitInfo = parseLimitReached(err)
             if (limitInfo) {
               this.limitInfo = limitInfo
               this.showReplaceDialog = true
               return
             }
-            if (attempt >= ACTIVATION_RETRY_DELAYS_MS.length || isActivationFatal(err)) {
-              this.activationError = typeof err === 'string' ? err : String(err)
+            if (
+              attempt >= ACTIVATION_RETRY_DELAYS_MS.length
+              || isActivationFatal(err)
+            ) {
+              this.activationError
+                = typeof err === 'string' ? err : String(err)
               return
             }
             await sleep(ACTIVATION_RETRY_DELAYS_MS[attempt])
@@ -111,15 +131,22 @@ export const useDeviceStore = defineStore('device', {
         }
       }
       finally {
-        this.activating = false
+        if (this.activationRevision === revision)
+          this.activating = false
       }
     },
     /** Replace the picked device with this machine (geekfun#59 F2). */
     async replaceDevice(deviceId: string): Promise<boolean> {
       const accountStore = useAccountStore()
-      if (!accountStore.isLoggedIn || !deviceId || this.activating) {
+      const revision = accountStore.sessionRevision
+      if (
+        !accountStore.isLoggedIn
+        || !deviceId
+        || (this.activating && this.activationRevision === revision)
+      ) {
         return false
       }
+      this.activationRevision = revision
       this.activating = true
       try {
         const result = await invoke<ActivatedResult>('activate_device', {
@@ -127,12 +154,16 @@ export const useDeviceStore = defineStore('device', {
           refreshToken: accountStore.refreshToken || null,
           replaceDeviceId: deviceId,
         })
+        if (accountStore.sessionRevision !== revision)
+          return false
         this.applyActivated(result)
         this.activationError = null
         localStorage.setItem(LAST_ACTIVATED_KEY, String(Date.now()))
         return true
       }
       catch (err) {
+        if (accountStore.sessionRevision !== revision)
+          return false
         const limitInfo = parseLimitReached(err)
         if (limitInfo) {
           // The picked device may have been replaced concurrently — refresh
@@ -142,7 +173,8 @@ export const useDeviceStore = defineStore('device', {
         return false
       }
       finally {
-        this.activating = false
+        if (this.activationRevision === revision)
+          this.activating = false
       }
     },
     /**
@@ -151,6 +183,8 @@ export const useDeviceStore = defineStore('device', {
      */
     applyActivated(result: ActivatedResult): void {
       const accountStore = useAccountStore()
+      if (result.accessToken)
+        accountStore.setToken(result.accessToken)
       this.deviceId = result.deviceId
       this.limit = result.limit
       this.used = result.used
@@ -173,7 +207,10 @@ function parseLimitReached(err: unknown): DeviceLimitInfo | null {
       error_type?: string
       limit_reached?: DeviceLimitInfo
     }
-    if (parsed?.error_type === DEVICE_LIMIT_ERROR_TYPE && parsed.limit_reached) {
+    if (
+      parsed?.error_type === DEVICE_LIMIT_ERROR_TYPE
+      && parsed.limit_reached
+    ) {
       return parsed.limit_reached
     }
   }
diff --git a/src/store/entitlementStore.ts b/src/store/entitlementStore.ts
index bf38608d..16fe0e78 100644
--- a/src/store/entitlementStore.ts
+++ b/src/store/entitlementStore.ts
@@ -1,7 +1,11 @@
 import type { EntitlementView, SessionPhase } from '../common'
 import { invoke } from '@tauri-apps/api/core'
 import { defineStore } from 'pinia'
-import { isEntitlementError, isSessionRejected, sessionPhaseFromTokens } from '../common'
+import {
+  isEntitlementError,
+  isSessionRejected,
+  sessionPhaseFromTokens,
+} from '../common'
 import { useAccountStore } from './accountStore'
 import { useDeviceStore } from './deviceStore'
 
@@ -13,7 +17,10 @@ const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms))
 
 // Terminal failure without a cached view — a synthetic answer so the UI
 // lands on Unknown (with its retry CTA) instead of an endless Checking…
-function unknownView(lastError: string, sessionPhase: SessionPhase): EntitlementView {
+function unknownView(
+  lastError: string,
+  sessionPhase: SessionPhase,
+): EntitlementView {
   return {
     ultimateActive: false,
     versionLocked: false,
@@ -77,19 +84,20 @@ export const useEntitlementStore = defineStore('entitlement', {
     async clearSessionState(): Promise<void> {
       const accountStore = useAccountStore()
       const lease = accountStore.refreshToken || null
-      await this.clearCachedEntitlement()
       accountStore.clearAuth()
+      this.sessionRejections = 0
       useDeviceStore().$reset()
       void invoke('revoke_session', { refreshToken: lease }).catch(() => {})
+      await this.clearCachedEntitlement()
     },
     async handleSessionLoss(): Promise<void> {
       const accountStore = useAccountStore()
       const hadIdentity = accountStore.isLoggedIn
-      await this.clearSessionState()
-      this.sessionRejections = 0
+      const clearing = this.clearSessionState()
       if (hadIdentity) {
         this.sessionLostNotice = Date.now()
       }
+      await clearing
     },
     async resolveSessionRejection(): Promise<void> {
       this.sessionRejections += 1
@@ -101,40 +109,56 @@ export const useEntitlementStore = defineStore('entitlement', {
     },
     async attemptSessionRecovery(): Promise<'recovered' | 'lost'> {
       const accountStore = useAccountStore()
+      const revision = accountStore.sessionRevision
       const lease = accountStore.refreshToken || ''
       if (lease.trim()) {
         try {
-          const refreshed = await invoke<{ access_token: string, refresh_token: string }>(
-            'rotate_session_now',
-            { refreshToken: lease },
+          const refreshed = await invoke<{
+            access_token: string
+            refresh_token: string
+          }>('rotate_session_now', { refreshToken: lease })
+          if (accountStore.sessionRevision !== revision)
+            return 'recovered'
+          accountStore.applySessionRefresh(
+            lease,
+            refreshed.access_token,
+            refreshed.refresh_token,
           )
-          accountStore.setToken(refreshed.access_token)
-          accountStore.setRefreshToken(refreshed.refresh_token)
           this.sessionRejections = 0
         }
         catch (e) {
+          if (accountStore.sessionRevision !== revision)
+            return 'recovered'
+          if (accountStore.refreshToken !== lease)
+            return 'recovered'
           if (isSessionRejected(e)) {
             await this.resolveSessionRejection()
             return 'lost'
           }
         }
       }
-      return (await this.refreshEntitlement(true)) === 'lost' ? 'lost' : 'recovered'
+      return (await this.refreshEntitlement(true)) === 'lost'
+        ? 'lost'
+        : 'recovered'
     },
     async seedFromHandoff(payload: {
       ultimateExpiresAt?: string | null
       versionLockHorizon?: string | null
       cancelScheduledAt?: string | null
     }): Promise<void> {
-      const { ultimateExpiresAt, versionLockHorizon, cancelScheduledAt } = payload
+      const revision = useAccountStore().sessionRevision
+      const { ultimateExpiresAt, versionLockHorizon, cancelScheduledAt }
+        = payload
       if (!ultimateExpiresAt && !versionLockHorizon)
         return
       try {
-        this.view = await invoke<EntitlementView>('seed_entitlement', {
+        const seeded = await invoke<EntitlementView>('seed_entitlement', {
           ultimateExpiresAt: ultimateExpiresAt ?? null,
           versionLockHorizon: versionLockHorizon ?? null,
           cancelScheduledAt: cancelScheduledAt ?? null,
         })
+        if (useAccountStore().sessionRevision === revision)
+          this.view = seeded
       }
       catch {
         // best effort — the refresh below still verifies
@@ -142,27 +166,52 @@ export const useEntitlementStore = defineStore('entitlement', {
     },
     // only a real server answer (fetchedAtMs) may surface as a confirmed plan
     async hydrate(): Promise<void> {
+      const revision = useAccountStore().sessionRevision
       if (!useAccountStore().isLoggedIn) {
         this.view = null
         return
       }
-      const cached = await invoke<EntitlementView>('get_entitlement', { tokenPresent: true }).catch(() => null)
+      const cached = await invoke<EntitlementView>('get_entitlement', {
+        tokenPresent: true,
+      }).catch(() => null)
+      if (useAccountStore().sessionRevision !== revision)
+        return
       if (cached?.fetchedAtMs != null)
         this.view = cached
     },
     async refreshEntitlement(force = false): Promise<'ok' | 'lost'> {
       const accountStore = useAccountStore()
+      const revision = accountStore.sessionRevision
       if (!accountStore.isLoggedIn) {
         await this.clearCachedEntitlement()
         return 'ok'
       }
       for (let attempt = 0; ; attempt += 1) {
+        if (accountStore.sessionRevision !== revision)
+          return 'ok'
+        const lease = accountStore.refreshToken
         try {
           const view = await invoke<EntitlementView>('refresh_entitlement', {
             token: accountStore.token,
             refreshToken: accountStore.refreshToken || null,
             force,
           })
+          if (accountStore.sessionRevision !== revision)
+            return 'ok'
+          if (view.refreshedSession) {
+            const rotated = view.refreshedSession
+            accountStore.applySessionRefresh(
+              rotated.previous_refresh_token,
+              rotated.access_token,
+              rotated.refresh_token,
+            )
+          }
+          if (
+            view.sessionPhase === 'expired'
+            && accountStore.refreshToken !== lease
+          ) {
+            return 'ok'
+          }
           this.view = view
           if (view.sessionPhase === 'expired') {
             await this.handleSessionLoss()
@@ -172,7 +221,11 @@ export const useEntitlementStore = defineStore('entitlement', {
           return 'ok'
         }
         catch (e) {
+          if (accountStore.sessionRevision !== revision)
+            return 'ok'
           if (isSessionRejected(e)) {
+            if (accountStore.refreshToken !== lease)
+              return 'ok'
             await this.resolveSessionRejection()
             return 'lost'
           }
@@ -183,7 +236,9 @@ export const useEntitlementStore = defineStore('entitlement', {
               this.view = unknownView(
                 isEntitlementError(e)
                   ? 'entitlement check failed'
-                  : typeof e === 'string' ? e : String(e),
+                  : typeof e === 'string'
+                    ? e
+                    : String(e),
                 'signed-in',
               )
             }
@@ -194,13 +249,13 @@ export const useEntitlementStore = defineStore('entitlement', {
       }
     },
     async clearCachedEntitlement(): Promise<void> {
+      this.view = null
       try {
         await invoke<EntitlementView>('clear_entitlement')
       }
       catch {
         // best effort — the local view reset below always applies
       }
-      this.view = null
     },
   },
 })
diff --git a/tests/common/sessionLifecycle.test.ts b/tests/common/sessionLifecycle.test.ts
new file mode 100644
index 00000000..27d58190
--- /dev/null
+++ b/tests/common/sessionLifecycle.test.ts
@@ -0,0 +1,279 @@
+import { createSessionLifecycle } from '../../src/common/sessionLifecycle'
+
+type Ports = Parameters<typeof createSessionLifecycle>[0]
+type Auth = Parameters<Ports['authenticate']>[0]
+type Rotation = Parameters<Ports['applyRotation']>[0]
+
+const fixture = (token = 'opaque-access', refreshToken = 'lease') => {
+  let session = { token, refreshToken, revision: 0 }
+  let auth: (_payload: Auth) => void = () => {}
+  let rotation: (_payload: Rotation) => void = () => {}
+  const unlisten = jest.fn()
+  const ports: Ports = {
+    read: () => session,
+    authenticate: jest.fn((payload) => {
+      session = {
+        token: payload.token,
+        refreshToken: '',
+        revision: session.revision + 1,
+      }
+    }),
+    applyRotation: jest.fn((payload) => {
+      session = {
+        ...session,
+        token: payload.accessToken,
+        refreshToken: payload.refreshToken,
+      }
+    }),
+    seed: jest.fn(async () => {}),
+    hydrate: jest.fn(async () => {}),
+    refresh: jest.fn(async () => {}),
+    activate: jest.fn(async () => {}),
+    clearCache: jest.fn(async () => {}),
+    rotate: jest.fn(async () => ({
+      access_token: 'next-access',
+      refresh_token: 'next-lease',
+    })),
+    listenAuth: jest.fn(async (handler) => {
+      auth = handler
+      return unlisten
+    }),
+    listenRotation: jest.fn(async (handler) => {
+      rotation = handler
+      return unlisten
+    }),
+    consumeAuth: jest.fn(async () => null),
+  }
+  return {
+    ports,
+    lifecycle: createSessionLifecycle(ports),
+    unlisten,
+    auth: (payload: Auth) => auth(payload),
+    rotation: (payload: Rotation) => rotation(payload),
+  }
+}
+
+const flush = async () => {
+  await Promise.resolve()
+  await Promise.resolve()
+  await Promise.resolve()
+}
+
+describe('session startup and handoff', () => {
+  it('ignores empty auth events and allows the same handoff after logout', async () => {
+    const f = fixture()
+    await f.lifecycle.start()
+    f.auth({ token: '' })
+    expect(f.ports.authenticate).not.toHaveBeenCalled()
+    f.auth({ token: 'handoff' })
+    await flush()
+    f.ports.authenticate({ token: '' })
+    f.auth({ token: 'handoff' })
+    await flush()
+    expect(f.ports.authenticate).toHaveBeenCalledTimes(3)
+  })
+
+  it('stops an older handoff while its seed is pending', async () => {
+    const f = fixture()
+    await f.lifecycle.start()
+    jest.mocked(f.ports.activate).mockClear()
+    let resolve!: () => void
+    jest.mocked(f.ports.seed).mockImplementationOnce(
+      () =>
+        new Promise((done) => {
+          resolve = done
+        }),
+    )
+    f.auth({ token: 'old' })
+    f.auth({ token: 'new' })
+    await flush()
+    resolve()
+    await flush()
+    expect(f.ports.activate).toHaveBeenCalledTimes(1)
+    expect(f.ports.read().token).toBe('new')
+  })
+
+  it('prefers an event login arriving while pending authentication is read', async () => {
+    const f = fixture()
+    jest.mocked(f.ports.consumeAuth).mockImplementation(async () => {
+      f.auth({ token: 'new' })
+      return null
+    })
+    await f.lifecycle.start()
+    expect(f.ports.hydrate).not.toHaveBeenCalled()
+  })
+
+  it('abandons old restoration when a new login arrives during hydration', async () => {
+    const f = fixture()
+    jest.mocked(f.ports.hydrate).mockImplementation(async () => {
+      f.auth({ token: 'new' })
+    })
+    await f.lifecycle.start()
+    await flush()
+    expect(f.ports.activate).toHaveBeenCalledTimes(1)
+    expect(f.ports.activate).toHaveBeenCalledWith(true)
+  })
+
+  it('does not refresh an old login after activation completes', async () => {
+    const f = fixture()
+    jest.mocked(f.ports.activate).mockImplementation(async () => {
+      f.ports.authenticate({ token: 'new' })
+    })
+    await f.lifecycle.start()
+    expect(f.ports.refresh).not.toHaveBeenCalled()
+  })
+
+  it('cleans up both listeners when disposed during pending auth consumption', async () => {
+    const f = fixture()
+    jest.mocked(f.ports.consumeAuth).mockImplementation(async () => {
+      f.lifecycle.dispose()
+      return { token: 'late' }
+    })
+    await f.lifecycle.start()
+    expect(f.unlisten).toHaveBeenCalledTimes(2)
+    expect(f.ports.authenticate).not.toHaveBeenCalled()
+  })
+
+  it('stops registration if disposed while the auth listener is installing', async () => {
+    const f = fixture()
+    jest.mocked(f.ports.listenAuth).mockImplementation(async () => {
+      f.lifecycle.dispose()
+      return f.unlisten
+    })
+    await f.lifecycle.start()
+    expect(f.unlisten).toHaveBeenCalledTimes(2)
+    expect(f.ports.consumeAuth).not.toHaveBeenCalled()
+  })
+
+  it('subscribes before restoration, and activates before checking entitlement', async () => {
+    const { ports, lifecycle } = fixture()
+    const order: string[] = []
+    jest.mocked(ports.hydrate).mockImplementation(async () => {
+      order.push('hydrate')
+    })
+    jest.mocked(ports.activate).mockImplementation(async () => {
+      order.push('activate')
+    })
+    jest.mocked(ports.refresh).mockImplementation(async () => {
+      order.push('refresh')
+    })
+    jest.mocked(ports.consumeAuth).mockImplementation(async () => {
+      expect(ports.listenAuth).toHaveBeenCalled()
+      expect(ports.listenRotation).toHaveBeenCalled()
+      return null
+    })
+    await lifecycle.start()
+    expect(order).toEqual(['hydrate', 'activate', 'refresh'])
+    expect(ports.rotate).not.toHaveBeenCalled()
+  })
+
+  it('consumes pending authentication before restoring an expired previous account', async () => {
+    const { ports, lifecycle } = fixture()
+    jest.mocked(ports.consumeAuth).mockResolvedValue({ token: 'new-login' })
+    await lifecycle.start()
+    expect(ports.authenticate).toHaveBeenCalledTimes(1)
+    expect(ports.hydrate).not.toHaveBeenCalled()
+    expect(ports.activate).toHaveBeenCalledWith(true)
+  })
+
+  it('deduplicates event and pending delivery without clearing the new lease', async () => {
+    const f = fixture()
+    const payload = { token: 'handoff' }
+    jest.mocked(f.ports.consumeAuth).mockImplementation(async () => {
+      f.auth(payload)
+      return payload
+    })
+    await f.lifecycle.start()
+    await flush()
+    expect(f.ports.authenticate).toHaveBeenCalledTimes(1)
+    expect(f.ports.activate).toHaveBeenCalledTimes(1)
+  })
+
+  it('renews an expired bearer before authenticated startup work', async () => {
+    const jwt = `a.${btoa(JSON.stringify({ exp: 1 }))}.s`
+    const { ports, lifecycle } = fixture(jwt)
+    await lifecycle.start()
+    expect(ports.rotate).toHaveBeenCalledWith('lease')
+    expect(ports.applyRotation).toHaveBeenCalledWith({
+      accessToken: 'next-access',
+      refreshToken: 'next-lease',
+      previousRefreshToken: 'lease',
+    })
+  })
+
+  it('keeps reactive recovery available after a transient proactive failure', async () => {
+    const f = fixture(`a.${btoa(JSON.stringify({ exp: 1 }))}.s`)
+    jest.mocked(f.ports.rotate).mockRejectedValue('network timeout')
+    await f.lifecycle.start()
+    expect(f.ports.refresh).toHaveBeenCalledTimes(1)
+  })
+
+  it('clears leftover cache for an anonymous start and tolerates a missing pending command', async () => {
+    const f = fixture('', '')
+    jest.mocked(f.ports.consumeAuth).mockRejectedValue('not available')
+    await f.lifecycle.start()
+    expect(f.ports.clearCache).toHaveBeenCalled()
+    expect(f.ports.hydrate).not.toHaveBeenCalled()
+  })
+
+  it('does not apply an old startup rotation after a new handoff', async () => {
+    const f = fixture(`a.${btoa(JSON.stringify({ exp: 1 }))}.s`)
+    let resolve!: (_value: {
+      access_token: string
+      refresh_token: string
+    }) => void
+    jest.mocked(f.ports.rotate).mockImplementation(
+      () =>
+        new Promise((done) => {
+          resolve = done
+        }),
+    )
+    const starting = f.lifecycle.start()
+    await flush()
+    await flush()
+    f.auth({ token: 'new-login' })
+    resolve({ access_token: 'old-access', refresh_token: 'old-lease' })
+    await starting
+    await flush()
+    expect(f.ports.applyRotation).not.toHaveBeenCalled()
+    expect(f.ports.read().token).toBe('new-login')
+  })
+
+  it('delivers rotations received during restoration', async () => {
+    const f = fixture()
+    const payload = {
+      accessToken: 'a',
+      refreshToken: 'r',
+      previousRefreshToken: 'lease',
+    }
+    jest.mocked(f.ports.hydrate).mockImplementation(async () => {
+      f.rotation(payload)
+    })
+    await f.lifecycle.start()
+    expect(f.ports.applyRotation).toHaveBeenCalledWith(payload)
+  })
+
+  it('ignores events and releases subscriptions after disposal', async () => {
+    const f = fixture()
+    await f.lifecycle.start()
+    f.lifecycle.dispose()
+    f.auth({ token: 'late' })
+    f.rotation({
+      accessToken: 'late',
+      refreshToken: 'late',
+      previousRefreshToken: 'lease',
+    })
+    expect(f.unlisten).toHaveBeenCalledTimes(2)
+    expect(f.ports.authenticate).not.toHaveBeenCalled()
+    expect(f.ports.applyRotation).not.toHaveBeenCalled()
+  })
+
+  it('stops startup when disposed while a subscription is registering', async () => {
+    const f = fixture()
+    const starting = f.lifecycle.start()
+    f.lifecycle.dispose()
+    await starting
+    expect(f.unlisten).toHaveBeenCalledTimes(1)
+    expect(f.ports.consumeAuth).not.toHaveBeenCalled()
+  })
+})
diff --git a/tests/sessionPersistence.test.ts b/tests/sessionPersistence.test.ts
new file mode 100644
index 00000000..a17af2e9
--- /dev/null
+++ b/tests/sessionPersistence.test.ts
@@ -0,0 +1,308 @@
+import { createPinia, setActivePinia } from 'pinia'
+
+let mockInvoke = jest.fn()
+jest.mock('@tauri-apps/api/core', () => ({
+  invoke: (...args: unknown[]) => mockInvoke(...args),
+}))
+
+const fixture = () => {
+  const account = (
+    jest.requireActual(
+      '../src/store/accountStore',
+    ) as typeof import('../src/store/accountStore')
+  ).useAccountStore()
+  const device = (
+    jest.requireActual(
+      '../src/store/deviceStore',
+    ) as typeof import('../src/store/deviceStore')
+  ).useDeviceStore()
+  const entitlement = (
+    jest.requireActual(
+      '../src/store/entitlementStore',
+    ) as typeof import('../src/store/entitlementStore')
+  ).useEntitlementStore()
+  account.setAuth('first-access', 'First', 'first@example.test')
+  account.setRefreshToken('first-lease')
+  return { account, device, entitlement }
+}
+
+const deferred = <T>() => {
+  let resolve!: (_value: T) => void
+  let reject!: (_error: unknown) => void
+  const promise = new Promise<T>((done, fail) => {
+    resolve = done
+    reject = fail
+  })
+  return { resolve, reject, promise }
+}
+
+const data = new Map<string, string>()
+const storage = {
+  getItem: (key: string) => data.get(key) ?? null,
+  setItem: (key: string, value: string) => data.set(key, value),
+  removeItem: (key: string) => data.delete(key),
+}
+
+beforeEach(() => {
+  data.clear()
+  Object.defineProperty(globalThis, 'localStorage', {
+    configurable: true,
+    value: storage,
+  })
+  setActivePinia(createPinia())
+  mockInvoke = jest.fn().mockResolvedValue(undefined)
+})
+
+describe('session ownership across asynchronous operations', () => {
+  it('persists credentials returned by entitlement renewal even if its event was missed', async () => {
+    const { account, entitlement } = fixture()
+    mockInvoke.mockResolvedValue({
+      sessionPhase: 'signed-in',
+      refreshedSession: {
+        previous_refresh_token: 'first-lease',
+        access_token: 'renewed-access',
+        refresh_token: 'renewed-lease',
+      },
+    })
+    await entitlement.refreshEntitlement(true)
+    expect(account.refreshToken).toBe('renewed-lease')
+    expect(account.token).toBe('renewed-access')
+  })
+
+  it('accepts the renewed bearer returned by activation without relying on its event', async () => {
+    const { account, device } = fixture()
+    mockInvoke.mockResolvedValue({
+      deviceId: 'device',
+      limit: 3,
+      used: 1,
+      accessToken: 'renewed-access',
+      refreshToken: 'renewed-lease',
+    })
+    await device.ensureActivated(true)
+    expect(account.token).toBe('renewed-access')
+    expect(account.refreshToken).toBe('renewed-lease')
+  })
+  it('ignores a previous login rotation rejection during manual recovery', async () => {
+    const { account, entitlement } = fixture()
+    const rotation = deferred<unknown>()
+    mockInvoke.mockReturnValueOnce(rotation.promise)
+    const pending = entitlement.attemptSessionRecovery()
+    account.setAuth('new', 'New', 'new@example.test')
+    rotation.reject(JSON.stringify({ error_type: 'SESSION_REJECTED' }))
+    await pending
+    expect(account.isLoggedIn).toBe(true)
+    expect(entitlement.sessionRejections).toBe(0)
+  })
+
+  it('ignores manual recovery rejection for an already replaced lease', async () => {
+    const { account, entitlement } = fixture()
+    const rotation = deferred<unknown>()
+    mockInvoke.mockReturnValueOnce(rotation.promise)
+    const pending = entitlement.attemptSessionRecovery()
+    account.applySessionRefresh('first-lease', 'new', 'new-lease')
+    rotation.reject(JSON.stringify({ error_type: 'SESSION_REJECTED' }))
+    await pending
+    expect(entitlement.sessionRejections).toBe(0)
+    expect(account.refreshToken).toBe('new-lease')
+  })
+
+  it('does not hydrate a cache result into a newer login', async () => {
+    const { account, entitlement } = fixture()
+    const cached = deferred<unknown>()
+    mockInvoke.mockReturnValueOnce(cached.promise)
+    const pending = entitlement.hydrate()
+    account.setAuth('new', 'New', 'new@example.test')
+    cached.resolve({ fetchedAtMs: 42 })
+    await pending
+    expect(entitlement.view).toBeNull()
+  })
+
+  it('does not apply a handoff seed after logout', async () => {
+    const { account, entitlement } = fixture()
+    const seeded = deferred<unknown>()
+    mockInvoke.mockReturnValueOnce(seeded.promise)
+    const pending = entitlement.seedFromHandoff({
+      ultimateExpiresAt: '2099-01-01',
+    })
+    account.clearAuth()
+    seeded.resolve({ fetchedAtMs: 42 })
+    await pending
+    expect(entitlement.view).toBeNull()
+  })
+
+  it('does not display an activation failure from an earlier login', async () => {
+    const { account, device } = fixture()
+    const activation = deferred<unknown>()
+    mockInvoke.mockReturnValueOnce(activation.promise)
+    const pending = device.ensureActivated(true)
+    account.setAuth('new', 'New', 'new@example.test')
+    activation.reject('session expired')
+    await pending
+    expect(device.activationError).toBeNull()
+  })
+
+  it('does not apply a replace result from an earlier login', async () => {
+    const { account, device } = fixture()
+    const activation = deferred<unknown>()
+    mockInvoke.mockReturnValueOnce(activation.promise)
+    const pending = device.replaceDevice('old-device')
+    account.clearAuth()
+    activation.resolve({ deviceId: 'late', refreshToken: 'late' })
+    expect(await pending).toBe(false)
+    expect(account.refreshToken).toBe('')
+  })
+
+  it('persists an activated lease and restores it into a fresh app session', async () => {
+    const { createApp } = jest.requireActual('vue') as typeof import('vue')
+    const persisted = jest.requireActual('pinia-plugin-persistedstate')
+    const install = () => {
+      const pinia = createPinia()
+      pinia.use(persisted.createPersistedState({ storage }))
+      createApp({}).use(pinia)
+      setActivePinia(pinia)
+    }
+    install()
+    const { account, device } = fixture()
+    mockInvoke.mockResolvedValue({
+      deviceId: 'device',
+      limit: 3,
+      used: 1,
+      refreshToken: 'persisted-lease',
+    })
+    await device.ensureActivated(true)
+    expect(JSON.parse(localStorage.getItem('account')!).refreshToken).toBe(
+      'persisted-lease',
+    )
+    install()
+    const restored = (
+      jest.requireActual(
+        '../src/store/accountStore',
+      ) as typeof import('../src/store/accountStore')
+    ).useAccountStore()
+    expect(restored.refreshToken).toBe('persisted-lease')
+    expect(restored.token).toBe(account.token)
+    expect(restored.sessionRevision).toBe(0)
+  })
+
+  it('ignores an expired response when another request has already renewed its lease', async () => {
+    const { account, entitlement } = fixture()
+    const request = deferred<unknown>()
+    mockInvoke.mockReturnValueOnce(request.promise)
+    const pending = entitlement.refreshEntitlement(true)
+    account.applySessionRefresh('first-lease', 'new-access', 'new-lease')
+    request.resolve({ sessionPhase: 'expired' })
+    await pending
+    expect(entitlement.view).toBeNull()
+    expect(account.refreshToken).toBe('new-lease')
+  })
+  it('only applies a rotation to the lease that requested it', () => {
+    const { account } = fixture()
+    account.applySessionRefresh('first-lease', 'next-access', 'next-lease')
+    expect(account.refreshToken).toBe('next-lease')
+    account.applySessionRefresh('first-lease', 'stale-access', 'stale-lease')
+    expect(account.refreshToken).toBe('next-lease')
+    account.clearAuth()
+    account.applySessionRefresh('next-lease', 'late-access', 'late-lease')
+    expect(account.isLoggedIn).toBe(false)
+    expect(account.refreshToken).toBe('')
+  })
+
+  it.each(['expired', 'rejected', 'healthy'])(
+    'ignores a delayed %s answer from a previous login',
+    async (result) => {
+      const { account, entitlement } = fixture()
+      const request = deferred<unknown>()
+      mockInvoke.mockReturnValueOnce(request.promise)
+      const pending = entitlement.refreshEntitlement(true)
+      account.setAuth('new-access', 'New', 'new@example.test')
+      account.setRefreshToken('new-lease')
+      if (result === 'rejected') {
+        request.reject(JSON.stringify({ error_type: 'SESSION_REJECTED' }))
+      }
+      else {
+        request.resolve({
+          sessionPhase: result === 'expired' ? 'expired' : 'signed-in',
+        })
+      }
+      await pending
+      expect(account.isLoggedIn).toBe(true)
+      expect(account.refreshToken).toBe('new-lease')
+      expect(entitlement.view).toBeNull()
+    },
+  )
+
+  it('does not let a delayed cache clear wipe a new login or plan', async () => {
+    const { account, entitlement } = fixture()
+    const clearing = deferred<unknown>()
+    mockInvoke.mockImplementation(name =>
+      name === 'clear_entitlement' ? clearing.promise : Promise.resolve(),
+    )
+    const pending = entitlement.clearSessionState()
+    expect(account.isLoggedIn).toBe(false)
+    account.setAuth('new-access', 'New', 'new@example.test')
+    const nextView = { sessionPhase: 'signed-in' } as NonNullable<
+      typeof entitlement.view
+    >
+    entitlement.view = nextView
+    clearing.resolve(undefined)
+    await pending
+    expect(account.isLoggedIn).toBe(true)
+    expect(entitlement.view).toEqual(nextView)
+  })
+
+  it('repairs an access-only session despite a recent activation timestamp', async () => {
+    const { account, device } = fixture()
+    account.setRefreshToken('')
+    localStorage.setItem('device_last_activated_at', String(Date.now()))
+    mockInvoke.mockResolvedValue({
+      deviceId: 'device',
+      limit: 3,
+      used: 1,
+      refreshToken: 'repaired-lease',
+    })
+    await device.ensureActivated()
+    expect(account.refreshToken).toBe('repaired-lease')
+  })
+
+  it('ignores activation completion after logout', async () => {
+    const { account, device } = fixture()
+    const activation = deferred<unknown>()
+    mockInvoke.mockReturnValueOnce(activation.promise)
+    const pending = device.ensureActivated(true)
+    account.clearAuth()
+    activation.resolve({
+      deviceId: 'old-device',
+      limit: 3,
+      used: 1,
+      refreshToken: 'old-lease',
+    })
+    await pending
+    expect(account.refreshToken).toBe('')
+    expect(device.deviceId).toBe('')
+  })
+
+  it('allows a new login to activate while the previous activation is pending', async () => {
+    const { account, device } = fixture()
+    const previous = deferred<unknown>()
+    mockInvoke
+      .mockReturnValueOnce(previous.promise)
+      .mockResolvedValue({
+        deviceId: 'new-device',
+        limit: 3,
+        used: 1,
+        refreshToken: 'new-lease',
+      })
+    const pending = device.ensureActivated(true)
+    account.setAuth('new-access', 'New', 'new@example.test')
+    await device.ensureActivated(true)
+    previous.resolve({
+      deviceId: 'old-device',
+      limit: 3,
+      used: 1,
+      refreshToken: 'old-lease',
+    })
+    await pending
+    expect(account.refreshToken).toBe('new-lease')
+    expect(device.deviceId).toBe('new-device')
+  })
+})
diff --git a/tests/store/entitlementStore.test.ts b/tests/store/entitlementStore.test.ts
index 2d12a3ac..6d9fe1bb 100644
--- a/tests/store/entitlementStore.test.ts
+++ b/tests/store/entitlementStore.test.ts
@@ -26,6 +26,10 @@ jest.mock('@/store/accountStore', () => ({
     get refreshToken() {
       return mockLoggedIn ? 'lease-1' : ''
     },
+    applySessionRefresh: (_previous: string, access: string, refresh: string) => {
+      mockSetToken(access)
+      mockSetRefreshToken(refresh)
+    },
     setToken: mockSetToken,
     setRefreshToken: mockSetRefreshToken,
     clearAuth: mockClearAuth,