// __root.tsx - Auth check
beforeLoad: async (ctx) => {
  const { userId, token } = await fetchAuth()
  if (token) ctx.context.convexQueryClient.setAuth(token)
  return { userId, token }
}

// (app)/route.tsx - Permission check  
beforeLoad: async ({ context }) => {
  if (!context.token) throw redirect({ to: '/sign-in' })
  const { success } = await canAccessDashboard() // Convex query
  if (!success) throw redirect({ to: '/unauthorized' })
  return { userId: context.userId }
},
shouldReload: false // ❌ Doesn't help

// (app)/users/index.tsx
const uid = Route.useSearch({ select: (s) => s.uid })
navigate({ 
  search: (prev) => ({ ...prev, uid: user.id }),
  replace: true // ❌ Doesn't help
})