fix: race condition in app initialization

Ensures `accessControl` lists are fully loaded before the application
finishes initialization, preventing potential moderation bypasses or UI
flicker.

- Awaits `_initAccessControl` in `initializeDataAndSession`.
- Refactors `_initAccessControl` to return a Promise.
- Adds weekly race condition report.

Co-authored-by: PR0M3TH3AN <[email protected]>

docs/agents/task-logs/weekly/2026-02-22_race-condition-agent_completed.md

@@ -0,0 +1,20 @@
+# Race Condition Agent - Weekly Run
+
+**Date:** 2026-02-22
+**Agent:** race-condition-agent
+**Status:** Completed
+
+## Summary
+Executed weekly race condition audit.
+
+### Findings
+- **Critical:** Identified and fixed an initialization race condition in `js/app.js` where `accessControl` lists were being loaded asynchronously without the application waiting for them.
+
+### Actions Taken
+- Refactored `_initAccessControl` in `js/app.js` to return a Promise.
+- Updated `initializeDataAndSession` to `await` the access control initialization.
+- Verified changes with unit tests (`npm run test:unit`) and linting.
+- Produced report: `artifacts/race-condition/weekly-race-condition-report-2026-02-22.md`.
+
+## Next Run Focus
+- PlaybackService state management.

js/app.js

@@ -1170,7 +1170,7 @@ class Application {
   async initializeDataAndSession() {
     await this._initTrustedSeeds();
     this._initViewCounter();
-    this._initAccessControl();
+    await this._initAccessControl();
 
     await this._initSessionActor();
     this._initAccessControlListeners();