- The PR list hears every finished action again, as before GitCafe's
  durable merges scoped its own refresh to the visible pull request.
- Paused restacks and landings say they are waiting on the reader.
- A locked conversation offers its composer to moderators only.
- API calls and attachment downloads never follow a redirect with the token.
- A refused token from a refreshed cafe login is retried once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>