Cold Authentication Recovery Ladder

Cold Authentication Recovery Ladder A sequence diagram generated by Archify. fetch_tokens fetch CSRF + session tokens or auth failure Only a failed initial attempt enters the recovery ladder. run configured command replace profile cookies reload pair + validate A failed or ineligible L2.5 attempt falls through only for a login redirect with writable storage. claim path + policy flight lock path + reload profile try optional L3 re-auth try L4 after L3 fails Each produced cookie pair is validated before the coordinator advances. persist + reload cookie pair validate recovered cookies cloned tokens or terminal error Initial token acquisition L2.5 refresh command Coalesced L3 / L4 recovery Client Open · token request · Sequence participant Client Open token request Token Driver · _auth.refresh · Sequence participant Token Driver _auth.refresh NotebookLM · homepage / CSRF · Sequence participant NotebookLM homepage / CSRF Refresh Cmd · L2.5 · Sequence participant Refresh Cmd L2.5 Cold Recovery · path + rung policy · Sequence participant Cold Recovery path + rung policy Headless Rung · L3 opt-in · Sequence participant Headless Rung L3 opt-in Master Token · L4 re-mint · Sequence participant Master Token L4 re-mint Profile Store · cookies + baseline · Sequence participant Profile Store cookies + baseline Legend request return security async trace

One Ordered Ladder

  • • _fetch_tokens_with_refresh_core owns the ordered ladder

Concurrency Boundaries

  • • ColdRecoveryState serializes each path; SingleFlight keys by path plus rung policy
  • • L2.5 refresh-command execution uses its own single flight

Fail-Closed Conditions

  • • Env auth skips file recovery; exhaustion preserves the error