[DoodleBears]

Refs #2603 · Original claim · Continuation

Tasks: codex/local/01a164b0-214b-7371-bf06-ca7c00c54137 (initial implementation), codex/local/01a164fc-d3fd-7d10-9e86-415381f16211 (review fixes and QA handoff).

Why the change

Sign out currently runs without confirmation and leaves saved Host connections behind, so both account actions now explain their effects, require confirmation, and clean only phone connections with recorded account ownership.

Special things to note

• Merge risk: one-way door after confirmation, large blast radius — removed phone credentials require re-pairing and permanent account deletion cannot be reverted. Review ownership provenance, cancellation and stale-dialog guards, durable local cleanup, and uncertain remote outcomes. Manual, other-account and unknown legacy records remain; a retained manual Connect record still loses its route when its tunnel is deleted.
• Draft; independent Human merge authorization and native QA remain pending. Head 05b20d6d3c3841a800054f26a993e8ee541391c6 includes main bdcc996a1ae1fa6d83439647bda4e4643b2b21ae. This PR adds no native inputs relative to that base, but main added the LAN native module/config/plugin since Batch58: the runner must requalify the installed binary. Color/alignment PR fix(mobile): color and align account action symbols #2602 remains separate.
• No Human account operations. The development-only fixture uses memory stores and a closed request substitute. It does not prove actual WorkOS/Cloudflare deletion. The sole QA owner must capture native before/after dialogs, three text sizes × two themes, English/Chinese, accessibility, Cancel/confirm/error/retry. No native screenshot is available for this functional PR yet; no merge, release or deployment was performed.

Change outline

 AccountHosts → native confirmation for Sign out AND Delete account
+ Cancel/dismiss: no account action, write, refresh or disconnect
+ Confirm: bind captured sign-in instance; reject stale/duplicate/busy callbacks
+ Android failure: retain dialog/error and retry; iOS: retain page error for a new confirmation

 Account-mediated pairing → existing paired-Host store
+ record authenticated issuer + relay + OAuth client + WorkOS subject
+ serialize final pairing save with account actions; migrate stable login identity
  preserve manual/unknown legacy records; never infer ownership from email or route

 Confirmed account action → existing SecureStore recovery markers
+ Sign out: owned phone connections + local account session only
+ Delete: existing account-wide Connect links/tunnels/DNS + WorkOS deletion
+ confirmed remote success: retry local cleanup without another remote request
+ unknown outcome: retry deletion, or separately confirm “Clear this phone only”
  phone-only recovery makes no claim about remote completion

 HostSession → durable cleanup journal
+ retry unreadable pairing storage before executing any mutation
+ persist removal → stop owned clients → drafts/cache/recent chats/shortcuts/filter
+ retain journal on required cleanup failure; push unregister remains best-effort
+ clear local account session only after cleanup succeeds

Validation at this head: 1,254 mobile tests passed; 9 skipped. Mobile typecheck, repository lint (existing warnings), formatting, bilingual ledger and diff checks passed. Independent Standards review reported no remaining findings; Spec review's startup-storage failure was fixed and rechecked. Focused tests cover cancellation, identity rotation, stale/duplicate callbacks, ownership isolation, actual HostSession client stop, failed storage, restart, completion-marker failure and expired-auth local recovery. Native and real-service acceptance remain separate.

Safe native path: development app /qa/account-actions?scenario=success; verify the test title and fixture@example.invalid before any action. Reset between Sign out and Delete. Failure scenarios: local-write, session-write, delete-partial, expired-retry, completion-write. Record the fixture counters before opening, after Cancel, and after confirmation. The route requires both __DEV__ and a .dev app ID. Never operate the Human's real account page.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[DoodleBears]

Review aid for exact head 05b20d6d3c3841a800054f26a993e8ee541391c6, base bdcc996a1ae1fa6d83439647bda4e4643b2b21ae:

• HTML explainer — download and open locally
• Readable Markdown companion
• Safe native QA procedure

The HTML was inspected at desktop and phone widths, with no console errors. These are review documents, not native screenshots or runtime acceptance. Public bytes were verified against the reviewed local artifacts. No private images, credentials or machine paths are included.

Source checks: 1,254 mobile tests passed, 9 skipped; types/lint/format/ledger passed. Standards: no remaining findings. Spec: startup pairing-store read failure fixed and independently rechecked; no remaining finding. Native verification is queued with the sole device owner; this PR adds no native inputs relative to its current base, but that base includes LAN native changes since Batch58. Draft and separate Human merge authorization remain.

[DoodleBears]

Source continuation: codex/local/01a16534-c59b-7a90-b7b9-d2aa1149c60f now owns #2603 source follow-up under the successor claim. Prior source task handed off and is not working in parallel.

Reverified Draft head 05b20d6d3c3841a800054f26a993e8ee541391c6; applicable verify jobs passed, real-model scenarios skipped, and CodeRabbit has not reviewed this Draft. No new native result or Human acceptance is claimed.

The existing sole device runner has been notified; #2604 remains queued separately from its active batch and from icon/color PR #2602. Current main 843d84b1c304a6dfac4c405c1da70ebfe2512ed1 adds #2605 LAN native configuration beyond the candidate's integrated base, so the next owner cut must qualify its source and installed binary. No source changes, runtime launch, merge, release, deployment or real account deletion performed.

[DoodleBears]

QA runner receipt: source continuation acknowledged at #2603 (comment).

• Current Batch59 remains active on frozen recording candidate 914bfa57; this intake does not acquire a new device lease or interrupt it. fix(mobile): confirm account actions and clean owned connections #2604 is next-candidate intake, with no assigned batch number yet.
• Live PR head is still 05b20d6d3c3841a800054f26a993e8ee541391c6, Draft/open. Shared queue and PR records contain no completed fix(mobile): confirm account actions and clean owned connections #2604 native run, native evidence, or native product finding. Source tests and review documents are separate from native acceptance.
• Candidate integrated base is bdcc996a1ae1fa6d83439647bda4e4643b2b21ae. Live main is 843d84b1c304a6dfac4c405c1da70ebfe2512ed1; comparison confirms fix(mobile): make LAN network-security domains explicit (#2599) #2605 changes apps/mobile/with-lan-channel.js and its test. Existing READY qualifies only the exact candidate on its recorded base; it does not qualify a main-integrated version. Any updated integration needs a fresh exact source/head before the next cut.
• Before assigning the next batch, recheck ownership and qualify native inputs, installed binary, and loaded JavaScript against that cut. Batch58 or Batch59 package compatibility is not established. The fixture requires __DEV__ as well as a .dev application ID; Batch59's Release package cannot be assumed suitable merely because its ID ends in .dev.
• Run only /qa/account-actions?scenario=success after seeing the test title and fixture@example.invalid, then the documented failure scenarios. Preserve real login/pairings; no real account deletion, merge, release, deployment, or private-image upload. No new runtime/build/device operation was started for this intake.

Next allocation and any native results/findings will be recorded in the shared queue and this PR after Batch59 completes or is explicitly deferred and its owned resources are reconciled.