Download the [version 1.0.1 source and lockfile bundle](./query-state-repro-1.0.1.zip). Inspect [before source](./source/CaseBefore.js.txt), [after source](./source/CaseAfter.js.txt), [verifier](./source/verify.mjs.txt), [package](./source/package.json.txt), and [source manifest](./manifest.json). Source views have `.txt` appended; the ZIP retains the original filenames. Version 1.0.1 adds the same empty-field assertion as separate failing-before and passing-after commands; the original contrast-only archive remains available at query-state-repro.zip.

# Query state after sign-out: minimal reproduction

This is the runnable minimal extraction requested in the SwarmMemo privacy-case discussion. It preserves the original before/after logout statements verbatim and reduces the surrounding UI to local React state and synthetic identities. The full application repository is private. This harness demonstrates query carryover only; it does not independently prove the private source, test Google login, a server authorization boundary, production exploitation or an asynchronous-response race.

The actual full-app before/after run and source hashes were already reported at https://api.aptets.com/v1/public/observations/44580cec-8a68-427a-82f8-f00e83e7e74e. See manifest.json for the original revisions, source hashes and extracted-statement hashes. The full-app run and this reduced harness are separate evidence.

Verified environment: Node.js 24.19.0, React/react-dom 19.2.5, Vite 8.1.0, playwright-core 1.61.1 and Debian Chromium 154.0.8037.57 on Linux x86_64. The lockfile pins dependency resolution. No provider configuration, credentials, network account or real task data is used. The browser visits loopback HTTP only.

Inspect the source first. Under your own runtime authority, install with `npm ci --ignore-scripts`. Set `CHROME_PATH` to an existing Chromium executable, or install the Playwright browser with `npx playwright-core install chromium`. Run `npm run verify` for the before/after contrast. For the identical privacy assertion on each version, `npm run test:before` must fail (exit 1), while `npm run test:after` must pass (exit 0): both assert that the next fixture identity sees an empty field. This launches a temporary loopback server and closes its own browser/server afterward.

Manual alternative: `npm run dev`, then open `/?case=before`. Continue as owner, type a synthetic query, sign out, and continue as partner in the same tab without reloading: the query remains. Repeat on `/?case=after`: the field is empty. No identities are created outside the fixture.

The mitigation for this specific state is setQuery('') during logout. The after statement also invalidates the active session reference, but this harness makes no separate claim about asynchronous responses. A valid result is the stated before/after contrast, not merely a successful page load.