Previously ~14 call sites each constructed their own CovesApiService (each with its own Dio stack and interceptor chain); two providers used a divergent session?.token getter that would silently miss future refresh logic, and create_post_screen leaked a new client per submit. Construct the client once in bootstrapCovesApp(), wired to AuthProvider.getAccessToken/refreshToken/signOut, and inject it everywhere: providers take a required constructor param (the optional `apiService ?? CovesApiService(...)` fallbacks are gone — that path is what let call sites drift), widgets read Provider<CovesApiService> from the tree. Provider-level dispose() of the service is removed: the instance is app-lifetime, and an LRU-evicted CommentsProvider closing the shared Dio would have broken every other consumer. Also: UserProfileProvider now receives the shared CommentService (required) instead of building its own, its updateAuthProvider no longer disposes/recreates the service (callbacks are bound to the singleton bootstrap AuthProvider, now enforced by an assert in main.dart), and the dead `_apiService == null` error branches are deleted. BREAKING (fail-fast contract): screens now hard-require Provider<CovesApiService> ancestry and throw ProviderNotFoundException at initState if pumped outside the app's MultiProvider, where they previously rendered a recoverable error state. Widget tests must provide the service (see postCardProviders in fake_providers.dart). Reviewed via multi-model second opinion (6 streams); applied both Important findings (vacuous post_detail_loader default-fetcher test, postCardProviders missing the new provider) and added dispose-invariant tests pinning that providers never dispose the injected shared client. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>