Business Adjacent · Flight Log · FL-032
·platform·locked
Background work never steals the operator's session
Signal
Always-fresh UI will faithfully show any session flip, including ones the operator never asked for.
Wrong turn
Scripts that switch active tenant to sync docs or run admin jobs, then try to restore.
Correction
Cross-tenant data ops use explicit target-tenant overrides. Only UI-initiated actions call tenant switch. Session state stays user-owned.
The bug class was not "data wrong in the database." It was "the screen blinked to another tenant while a cron or sync ran." Freshness that contradicts intent feels like a broken product.
COURSE: early admin tooling reused the same switch path humans use. The correction is a different door for background work: mutate the target row, never the caller's focus.
If a script needs another tenant's documents, it names that tenant on the request. The operator stays where they were. Flicker becomes structurally impossible for that path.