Vest: one refused account token fails only its account, and the relay sends the current session's token

Every open Vest tab renews the login on its own, and each renewal moves the
session on: a token from before still reads, but Vest refuses to mint an
account's token with it (401, code 1002). The extension relayed the first
tab's token, so mints failed most of the time with two tabs open, and each
refusal dropped the whole session — every later account in a history pass
failed "no Vest session", and new accounts waited out 5-minute retries for
up to an hour (2026-10-28/29).

The client now fails only that account's call on a refused mint, keeps the
session and the cached account tokens, and logs the refusal now and then
with the login token's life left. An active account with no history is read
again every minute even while a whole pass's retry waits; a pass reads those
first and inactive accounts last, whose failures no longer set the retry.
Exits, lone take-profits and flattens wait up to 90s for the session and the
account's token instead of failing at once; entries still go now or not at
all. Closed accounts' history is read through the login first.

Extension 0.18.0: the hook records each token's session id and takes sign-in
tokens too; the relay reads every Vest tab and Vest's own current-session
record, and sends the token that session holds, else the newest, saying in
the popup when none is current.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

extension/README.md

@@ -103,6 +103,18 @@ dashboard      POST /api/vest/session  holds it in memory for the firm's Vest cl
 - The token lives ~15 minutes and the app renews it by itself while the tab is
   open. The tab is marked not auto-discardable, since a discarded tab stops
   renewing.
+- Several Vest tabs each renew on their own, and every renewal moves the login
+  on to a new session (localStorage `vest-auth-session`). A token from before
+  still reads, but Vest refuses to mint an account's token with it (401, code
+  1002), so the bot's orders and history reads fail. Since 0.18.0 the hook
+  records each token's session id, and the relay sends the token Vest's
+  current session holds, whichever tab has it, not the first tab's. A tab
+  hooked by an older build is matched by its token's expiry instead; one that
+  renewed before any hook was in it shows in the popup as "none holds the
+  current session" until it renews again or is reloaded.
+- A sign-in's answer (`/register`) carries the login's own refresh token, and
+  is taken too since 0.18.0; before, the first token after a sign-in waited
+  for the tab's first renewal.
 - When the dashboard has a Vest firm (its credential is the login's wallet)
   and no Vest tab is open, the extension opens one in the background. The app
   signs back in from its 30-day session. After that the person signs in again