Source of truth
- “Does this user have a working X connection?” → the mirror (cheap local read).
- “Can this connection execute right now?” → the provider.
executealways goes through the provider; if it rejects, the mirror is updated inline.
The INITIATED → ACTIVE gap
There is noconnected_account.activated push event from the provider, and the
OAuth callback returns to your app, not to Naive. So a freshly connected account
would sit at INITIATED until the cron swept it.
Fix — lazy reconcile on read. GET /v1/users/:user_id/connections/connected
inspects each row; any INITIATED row older than ~10s is refreshed synchronously from
the provider before responding. Once ACTIVE/EXPIRED/REVOKED it never
lazy-refreshes again.
Out-of-order webhooks
Webhook delivery is eventual and unordered. Status updates use last-write-wins on the event timestamp:EXPIRED arriving after a fresh reconnect is dropped (zero-row update).