Without a client-side cache, every sync invokeRemoteMethod re-mints a
fresh capability token. On Linux, QtRO's waitForFinished() spins a nested
QEventLoop that dispatches queued slots mid-wait, so back-to-back calls
reenter the function and each fires its own requestModule. The target
stores ONE token per caller (TokenManager::saveToken replaces) — last
inform wins and earlier in-flight calls arrive with a superseded token,
rejected by ModuleProxy::isAuthorized as "auth token not recognized".
Fix: save the minted token into the client's TokenManager after a
successful requestModule on both the sync path and the async drain
callback. Subsequent calls short-circuit the handshake — one mint per
(client, target), no rotation.
Khushboo Mehta
84be236552