[TheGreatAxios]

MCP PKCE verifier is now instance-local: saveCodeVerifier no longer writes the auth file, MCPAuthState drops the codeVerifier field, and the stale-token guard only adopts tokens when present. resetAuthorization scrubs a legacy on-disk verifier as a one-version migration.

Review fixes:

1. Sibling logout propagates (blocking): the durable cache refresh now treats a successful disk read with no tokens key as an explicit logout and clears the in-memory mirror, while a missing/corrupt/unreadable file still keeps the mirror. The old else-delete was not restored: a raw client-only overwrite is no longer the test path — the client-only test now uses a realistic sibling saveClientInformation through the merge chain (tokens preserved). Added sibling-logout propagation test (B.resetAuthorization -> A.tokens() undefined); the :240 guard (reset never deletes a sibling's different fresh token) still passes.
2. Legacy verifier scrubbed at startup (should-fix): the create-time updateAuthState mutator now deletes state.codeVerifier, so first boot writes a clean file and later load→mutate→write round-trips cannot re-persist it; resetAuthorization's scrub is kept. Restored the disk.codeVerifier assertion in the stale-DCR test and added a saveTokens round-trip test (seeded legacy file -> raw bytes contain no codeVerifier).

Verification: src/mcp + mcp unit suites 181 pass; oauth-provider 28 pass; bun run lint/typecheck/dead-exports/build clean; full suite 8594 pass / 1 fail — tests/integration/exec-signal-finalize SIGINT timing flake that passes in isolation (3 pass) and is unrelated to this change.

Fixes CL-9001

[linear-code]

CL-9001

[TheGreatAxios]

Closing after the 0333 merge wave: rebase onto origin/main hit conflicts, and parent guidance is not to fight those. Reopen on a fresh branch if this still improves operator output without regression.