[mckaragoz]

Interactive Blazor Server management events were constructing access contexts through IHttpContextAccessor. The circuit context can lack the browser's current Device ID, so session validation returns DeviceMismatch and denies otherwise valid Owner creation and Ladmin repair operations.

Route these operations through the existing UltimateAuth browser JSON transport and protected Identity Lab endpoints. Validate the session/device once at the HTTP boundary, derive the actor from that context, and pass it into the existing application services. Provisioning rollback retargets the same validated flow to the created account while retaining actor checks, the trusted single-use rollback gate and the independent cleanup timeout.

The audit also migrates owner recovery and demo role/permission operations that had the same context dependency. Registration/availability remain anonymous workflows; existing browser SDK operations retain their transport. apps/identity-lab/README.md documents the integration pattern and audit.

Device ID enforcement, cookie settings, tenant isolation, ownership/capacity checks, Ladmin authorization, provisioning gates and UI repair confirmations remain enforced. Every new POST validates the existing UltimateAuth antiforgery token. Failures return safe messages and log server exceptions.

Validation (.NET SDK 10.0.403, net10.0):

• Identity Lab xUnit v3 suite, real PostgreSQL: 117 passed, 0 failed, 0 skipped.
• UltimateAuth integration suite: 417 passed, 0 failed, 0 skipped.
• Focused Blazor request transport/session validator unit tests: 35 passed, 0 failed, 0 skipped.
• Affected app/test project build: 0 warnings, 0 errors (UltimateAuthBuildTargetFrameworks=net10.0).
• Chromium against a locally published production app: Owner sign-in → Create User returns HTTP 200 and succeeds; Ladmin sign-in → Scan returns HTTP 200 and renders the snapshot.
• Final diff/security review and git diff --check passed.

The new regressions exercise session/device rejection, anonymous and revoked/invalid sessions, CSRF, server-derived actor identity, Owner/Member restrictions, foreign-sandbox targeting, capacity, role/membership creation, UI transport, and rollback identity/target/gate behavior. No planned checks remain blocked; no known remaining limitations in this scope.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.21%. Comparing base (a09c4de) to head (3391db2).

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #154   +/-   ##
=======================================
  Coverage   87.20%   87.21%           
=======================================
  Files         580      580           
  Lines       18915    18915           
  Branches     2228     2228           
=======================================
+ Hits        16495    16496    +1     
+ Misses       1617     1616    -1     
  Partials      803      803           

Flag	Coverage Δ
framework	87.21% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.