@oxy.so/core 1.2.1 → 1.3.0

package/dist/esm/session/accountDialogController.js

@@ -57,7 +57,7 @@
  */
 import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
-import { CENTRAL_IDP_APEX } from '../utils/authWebUrl.js';
+import { IDENTITY_WEB_ORIGIN } from '../utils/authWebUrl.js';
 import { getSocketIO } from './socketLoader.js';
 import { resolveActiveContext } from './deviceDirectory.js';
 import { pushTargetsFromDelivery, selectCommonsDelivery, } from '../utils/commonsDelivery.js';
@@ -112,28 +112,36 @@ const IDLE_SIGN_IN_FACTS = {
     qrPayload: null,
     expiresAt: null,
     error: null,
+    failure: null,
     route: null,
     routeFailed: false,
     pushSentAt: null,
     openedAt: null,
 };
-const IDLE_SIGN_IN = {
-    ...IDLE_SIGN_IN_FACTS,
-    progress: deriveSignInProgress(IDLE_SIGN_IN_FACTS),
-};
 /**
- * Terminal SUCCESS state: the session was claimed and committed. Holds no live
+ * Terminal SUCCESS facts: the session was claimed and committed. Holds no live
  * resources and no request handles — only the terminal progress the surface
  * shows ("Identity confirmed") before it closes.
  */
-const COMPLETED_SIGN_IN = {
-    ...IDLE_SIGN_IN_FACTS,
-    phase: 'completed',
-    progress: deriveSignInProgress({ ...IDLE_SIGN_IN_FACTS, phase: 'completed' }),
-};
+const COMPLETED_SIGN_IN_FACTS = { ...IDLE_SIGN_IN_FACTS, phase: 'completed' };
+/** The full flow state for `facts`, stamped with the attempt it belongs to. */
+function buildSignIn(facts, attempt) {
+    return { ...facts, progress: deriveSignInProgress(facts), attempt };
+}
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
+/**
+ * Classify a request that never produced a response. `OxyServices.handleError`
+ * normalizes transport failures to `NETWORK_ERROR` / `TIMEOUT` with status `0`.
+ */
+function requestFailureReason(error) {
+    const code = error && typeof error === 'object' ? error.code : undefined;
+    if (code === 'NETWORK_ERROR' || code === 'TIMEOUT' || extractErrorStatus(error) === 0) {
+        return 'network';
+    }
+    return 'unknown';
+}
 export class AccountDialogController {
     constructor(options) {
         this.listeners = new Set();
@@ -144,9 +152,25 @@ export class AccountDialogController {
         this.activatingContextId = null;
         this.removingContextId = null;
         this.removingPrincipalId = null;
-        this.signIn = IDLE_SIGN_IN;
+        /**
+         * `true` while an operation run through {@link runDeviceMutation} (a host
+         * sign-out) is in flight. The fourth member of the ONE device-mutation gate,
+         * alongside the three flags above.
+         */
+        this.exclusiveMutationInFlight = false;
+        this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, 0);
         this.commonsAvailability = 'unknown';
         // --- Sign-in device-flow bookkeeping ---
+        /**
+         * The CURRENT sign-in attempt. Every asynchronous step of a sign-in captures
+         * it before awaiting and re-checks it after (`isCurrentAttempt`); cancelling,
+         * starting another attempt, or destroying the controller moves it, so a late
+         * response from an abandoned attempt can neither update the surface nor
+         * install a session.
+         */
+        this.signInAttempt = 0;
+        /** How the current attempt was started, so a retry repeats the user's choice. */
+        this.signInMethod = 'oxy';
         /** The secret device-flow token of the active QR flow (never surfaced). */
         this.signInToken = null;
         this.pollTimer = null;
@@ -159,9 +183,10 @@ export class AccountDialogController {
         /**
          * Guards {@link pollOnce} against re-entrancy: the fallback timer and a socket
          * `auth_update` wake can fire together — without this both could claim the
-         * single-use token concurrently.
+         * single-use token concurrently. Keyed by token, so a poll still running for an
+         * ABANDONED request never blocks the next request's first poll.
          */
-        this.pollInFlight = false;
+        this.pollInFlightToken = null;
         /** The popup opened by {@link startPasskeyHubSignIn}, or `null`. */
         this.activePopup = null;
         /** Watches {@link activePopup}'s `closed` state; see {@link watchPopup}. */
@@ -183,7 +208,7 @@ export class AccountDialogController {
         this.canOpenApp = options.canOpenApp;
         this.socketFactory = options.socketFactory;
         this.openPopup = options.openPopup;
-        this.hubBaseUrl = options.hubBaseUrl ?? `https://auth.${CENTRAL_IDP_APEX}`;
+        this.identityOrigin = options.identityOrigin ?? options.hubBaseUrl ?? IDENTITY_WEB_ORIGIN;
         this.platform = options.platform ?? 'unknown';
         this.snapshot = this.computeSnapshot();
     }
@@ -249,6 +274,8 @@ export class AccountDialogController {
      */
     destroy() {
         this.started = false;
+        // Nothing still in flight may act on a destroyed controller.
+        this.signInAttempt += 1;
         if (this.unsubscribeSession) {
             this.unsubscribeSession();
             this.unsubscribeSession = null;
@@ -320,7 +347,7 @@ export class AccountDialogController {
         // another view is a NEW intention, so drop it; otherwise a later `add()`
         // would open on the previous sign-in's terminal state.
         if (this.signIn.phase === 'completed') {
-            this.signIn = IDLE_SIGN_IN;
+            this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, this.signInAttempt);
         }
         this.emit();
     }
@@ -345,6 +372,9 @@ export class AccountDialogController {
      * — and the reconstruction was not merely redundant: it enumerated the
      * CALLER's account graph, which on a device holding two people is one
      * person's answer presented as the device's.
+     *
+     * Resolves `false` when THIS read failed (a 401 is the signed-out edge, not a
+     * failure). Never rejects.
      */
     async refresh() {
         const seq = ++this.refreshSeq;
@@ -355,13 +385,14 @@ export class AccountDialogController {
             this.loading = false;
             this.error = null;
             this.emit();
-            return;
+            return true;
         }
         // Nothing to show yet is the only state worth a spinner; a re-read behind an
         // already-rendered directory refreshes in place.
         this.loading = this.sessionClient.getDirectory() === null;
         this.error = null;
         this.emit();
+        let failure = null;
         try {
             await this.sessionClient.refreshDirectory();
         }
@@ -375,14 +406,18 @@ export class AccountDialogController {
                 logger.debug('[AccountDialogController] directory unauthorized (signed out)', { component: 'AccountDialogController' }, error);
             }
             else {
-                this.error = errorMessage(error);
+                failure = errorMessage(error);
                 logger.warn('[AccountDialogController] directory refresh failed', { component: 'AccountDialogController' }, error);
             }
         }
+        // Superseded by a newer refresh: that read owns `error` and `loading`, so an
+        // older failure must not overwrite its outcome.
         if (seq !== this.refreshSeq)
-            return; // superseded by a newer refresh
+            return failure === null;
+        this.error = failure;
         this.loading = false;
         this.emit();
+        return failure === null;
     }
     // =========================================================================
     // Activation and the two removals (ADR 0002)
@@ -400,26 +435,18 @@ export class AccountDialogController {
      * A context id is not stable across a removal, so a stale one is an ordinary
      * outcome rather than a bug: the server answers 404 or 403, heals the row, and
      * the refresh below re-reads a directory that no longer offers it.
+     *
+     * Resolves `true` once the SWITCH happened — even if the directory re-read
+     * after it fails (that failure lands on `error`, but the subject did change).
+     * Resolves `false` when the switch failed, or was refused because another
+     * device mutation is in flight ({@link isDeviceMutationInFlight}).
      */
     async activateContext(contextId) {
-        if (this.activatingContextId)
-            return false;
-        this.activatingContextId = contextId;
-        this.error = null;
-        this.emit();
-        try {
-            await this.sessionClient.activateContext(contextId);
-            await this.refresh();
-            return true;
-        }
-        catch (error) {
-            this.error = errorMessage(error);
-            return false;
-        }
-        finally {
+        return this.mutateDevice(() => {
+            this.activatingContextId = contextId;
+        }, () => {
             this.activatingContextId = null;
-            this.emit();
-        }
+        }, () => this.sessionClient.activateContext(contextId));
     }
     /**
      * Remove ONE `principal → account` pair, and only that pair.
@@ -434,24 +461,11 @@ export class AccountDialogController {
      * revision — so nothing may hold a context id across this call.
      */
     async signOutContext(contextId) {
-        if (this.removingContextId || this.removingPrincipalId)
-            return false;
-        this.removingContextId = contextId;
-        this.error = null;
-        this.emit();
-        try {
-            await this.sessionClient.signOutContext(contextId);
-            await this.refresh();
-            return true;
-        }
-        catch (error) {
-            this.error = errorMessage(error);
-            return false;
-        }
-        finally {
+        return this.mutateDevice(() => {
+            this.removingContextId = contextId;
+        }, () => {
             this.removingContextId = null;
-            this.emit();
-        }
+        }, () => this.sessionClient.signOutContext(contextId));
     }
     /**
      * Remove ONE PERSON and every context they reach — and nobody else's,
@@ -462,22 +476,75 @@ export class AccountDialogController {
      * and elects a replacement active context in one transition.
      */
     async signOutPrincipal(principalId) {
-        if (this.removingContextId || this.removingPrincipalId)
+        return this.mutateDevice(() => {
+            this.removingPrincipalId = principalId;
+        }, () => {
+            this.removingPrincipalId = null;
+        }, () => this.sessionClient.signOutPrincipal(principalId));
+    }
+    /**
+     * Whether ANY operation that changes who is on this device, or which of them
+     * is active, is in flight: an activation, either removal, or a host operation
+     * run through {@link runDeviceMutation}.
+     *
+     * They share ONE gate because they mutate the same device set: a removal that
+     * elects a replacement active context racing a switch could leave either one
+     * active. A refused call is refused, never queued — a press that could not run
+     * must not fire later, after the user has moved on.
+     */
+    isDeviceMutationInFlight() {
+        return (this.activatingContextId !== null ||
+            this.removingContextId !== null ||
+            this.removingPrincipalId !== null ||
+            this.exclusiveMutationInFlight);
+    }
+    /**
+     * Run a device mutation the controller does not own (the host's sign-out)
+     * under the same gate as {@link activateContext} and the removals.
+     *
+     * Resolves `{ ran: false }` without calling `operation` when another mutation
+     * is in flight; otherwise `{ ran: true, value }`. A rejection from `operation`
+     * propagates, after the gate is released.
+     */
+    async runDeviceMutation(operation) {
+        if (this.isDeviceMutationInFlight())
+            return { ran: false };
+        this.exclusiveMutationInFlight = true;
+        try {
+            return { ran: true, value: await operation() };
+        }
+        finally {
+            this.exclusiveMutationInFlight = false;
+        }
+    }
+    /**
+     * The shared body of the three controller-owned device mutations: take the
+     * gate, run the mutation, then re-read the directory.
+     *
+     * The mutation's outcome and the re-read's are kept apart. Once `operation`
+     * has resolved the device HAS changed, so this resolves `true` even when the
+     * re-read fails — that failure is the directory's (`error`), and reporting it
+     * as a failed switch would invite the user to repeat something that happened.
+     */
+    async mutateDevice(mark, clear, operation) {
+        if (this.isDeviceMutationInFlight())
             return false;
-        this.removingPrincipalId = principalId;
+        mark();
         this.error = null;
         this.emit();
         try {
-            await this.sessionClient.signOutPrincipal(principalId);
+            try {
+                await operation();
+            }
+            catch (error) {
+                this.error = errorMessage(error);
+                return false;
+            }
             await this.refresh();
             return true;
         }
-        catch (error) {
-            this.error = errorMessage(error);
-            return false;
-        }
         finally {
-            this.removingPrincipalId = null;
+            clear();
             this.emit();
         }
     }
@@ -488,24 +555,31 @@ export class AccountDialogController {
      * Start "Sign in with Oxy". Native devices with a shared identity mint a
      * session silently (`signInWithSharedIdentity`); everything else (web, or a
      * native device without a shared identity) falls through to the cross-device
-     * QR handoff.
+     * QR handoff — as the SAME attempt, so cancelling during either half stops both.
      */
     async signInWithOxy() {
+        const attempt = this.beginSignInAttempt('oxy');
         this.setView('qr');
         this.setSignIn({ ...IDLE_SIGN_IN_FACTS, phase: 'starting' });
         try {
-            const session = await this.oxyServices.signInWithSharedIdentity();
+            // Minted WITHOUT planting the bearer: `completeSignIn` installs it only if
+            // this attempt is still the current one when the mint returns.
+            const session = await this.oxyServices.signInWithSharedIdentity({ plantTokens: false });
+            if (!this.isCurrentAttempt(attempt))
+                return;
             if (session) {
-                await this.completeSignIn(session, session.user);
+                await this.completeSignIn(attempt, session, session.user);
                 return;
             }
         }
         catch (error) {
+            if (!this.isCurrentAttempt(attempt))
+                return;
             // Shared-key mint failed — log and fall through to the QR handoff rather
             // than dead-ending the sign-in.
             logger.warn('[AccountDialogController] signInWithSharedIdentity failed', { component: 'AccountDialogController' }, error);
         }
-        await this.showQr();
+        await this.startDeviceFlowSession(attempt, { deliver: true });
     }
     /**
      * Begin (or restart) the cross-device QR handoff: create a device-flow
@@ -514,16 +588,38 @@ export class AccountDialogController {
      * session committed. Requires `clientId`.
      */
     async showQr() {
-        this.cancelSignIn();
+        const attempt = this.beginSignInAttempt('qr');
         this.setView('qr');
-        await this.startDeviceFlowSession({ deliver: true });
+        await this.startDeviceFlowSession(attempt, { deliver: true });
     }
     /**
-     * Web-only: "Sign in with a passkey" on a non-Oxy origin cannot run the
-     * WebAuthn ceremony locally — a credential minted with `WEBAUTHN_RP_ID=oxy.so`
-     * can only be asserted from `oxy.so`/a subdomain/loopback, a browser-enforced
-     * boundary `isOxyRpOrigin()` (consumer-side) already gates on. Instead, open
-     * a popup at the auth.oxy.so passkey hub, scoped to the SAME device-flow
+     * Start a NEW attempt the same way the last one was started — "Try again"
+     * repeats the user's choice rather than silently switching method. A failed
+     * passkey-hub attempt reopens the hub popup; a failed "Sign in with Oxy"
+     * retries that; an explicit QR request shows the QR.
+     *
+     * Call it straight from the press handler: the hub route opens its popup
+     * synchronously, before this method's first `await`, so the browser still
+     * attributes it to the click.
+     */
+    retrySignIn() {
+        switch (this.signInMethod) {
+            case 'passkey-hub':
+                return this.startPasskeyHubSignIn();
+            case 'qr':
+                return this.showQr();
+            default:
+                return this.signInWithOxy();
+        }
+    }
+    /**
+     * Web-only: sign in (or create an account) with a passkey at the web identity
+     * carrier. The ceremony runs on `id.oxy.so`, never on the calling origin, for
+     * two reasons: a credential minted with `WEBAUTHN_RP_ID=oxy.so` can only be
+     * asserted from `oxy.so`/a subdomain/loopback (a browser-enforced boundary),
+     * and only the identity origin may unseal or create the account's identity
+     * (one identity, two carriers). Opens a popup at `<identityOrigin>/continue`,
+     * scoped to the SAME device-flow
      * session {@link showQr} would create (same `authorizeCode`/`sessionToken`
      * pair), and let the SAME poll/socket/claim engine complete it once the hub
      * authorizes the session (`POST /auth/session/authorize-code/:authorizeCode`,
@@ -538,83 +634,119 @@ export class AccountDialogController {
      * `showQr`'s plain QR rendering — no dead end.
      */
     async startPasskeyHubSignIn() {
-        this.cancelSignIn();
+        const attempt = this.beginSignInAttempt('passkey-hub');
         this.setView('qr');
         const popup = this.openPopup?.() ?? null;
         if (!popup) {
-            await this.startDeviceFlowSession({ deliver: true });
+            await this.startDeviceFlowSession(attempt, { deliver: true });
             return;
         }
+        // Owned by the attempt from the moment it exists, so cancelling while the
+        // session is still being created closes it instead of leaving a blank
+        // window behind.
+        this.activePopup = popup;
         // The hub popup IS the primary surface here, chosen explicitly by the user —
         // so this flow does NOT run automatic Commons delivery (ringing the user's
         // phone because they asked for a passkey would be exactly the "menu of
         // methods" the one-primary-action rule forbids). The underlying request is
         // the same `AuthSession`, and its Commons route stays the QR the view
         // renders beneath the popup.
-        const handle = await this.startDeviceFlowSession({ deliver: false });
-        if (!handle) {
-            popup.close();
+        const handle = await this.startDeviceFlowSession(attempt, { deliver: false });
+        // `null` means the attempt failed (its teardown closed the popup) or was
+        // abandoned (the cancel closed it).
+        if (!handle)
             return;
-        }
         // The user may have closed the popup during the async session creation
         // above, before any watcher was attached to catch it — guard rather than
         // navigate a dead window (browsers vary on whether that throws).
         if (popup.closed) {
-            this.failSignIn('Sign-in was cancelled.');
+            const pendingCode = this.signIn.authorizeCode;
+            this.failSignIn('cancelled', 'Sign-in was cancelled.');
+            if (pendingCode)
+                void this.withdrawRequest(pendingCode);
             return;
         }
-        this.activePopup = popup;
-        popup.location.href = `${this.hubBaseUrl}/hub-passkey?code=${encodeURIComponent(handle.authorizeCode)}`;
+        popup.location.href = `${this.identityOrigin}/continue?code=${encodeURIComponent(handle.authorizeCode)}`;
         this.watchPopup(popup);
     }
+    /**
+     * End whatever attempt is running (withdrawing its request) and begin a new
+     * one. Returns the new attempt's identity for the caller to re-check after
+     * every `await`.
+     */
+    beginSignInAttempt(method) {
+        this.cancelSignIn();
+        this.signInMethod = method;
+        return this.signInAttempt;
+    }
+    /** Whether `attempt` is still the one the surface is waiting on. */
+    isCurrentAttempt(attempt) {
+        return attempt === this.signInAttempt;
+    }
     /**
      * Shared device-flow session creation for both {@link showQr} (renders the
      * QR) and {@link startPasskeyHubSignIn} (also opens the hub popup) — the
      * same `startCommonsSignIn` → poll/socket wiring either way. Returns the
-     * handle on success (already reflected in `signIn`), or `null` on failure
-     * (already set as `signIn.error`).
+     * handle on success (already reflected in `signIn`), or `null` when the
+     * attempt failed (already set as `signIn.failure`) or was abandoned while the
+     * request was being created.
      *
+     * @param attempt - The attempt this request belongs to. A request that comes
+     *   back for an abandoned attempt is withdrawn server-side and never wired up:
+     *   closing the dialog on a slow connection must not leave an approvable
+     *   request, a socket, and a poll behind it.
      * @param opts.deliver - Whether to run automatic Commons delivery selection
      *   ({@link resolveDeliveryRoute}). `true` for the normal one-primary-action
      *   entry; `false` when the caller already owns the primary surface (the
      *   passkey hub popup), where the request's Commons route is simply the QR.
      */
-    async startDeviceFlowSession(opts) {
+    async startDeviceFlowSession(attempt, opts) {
+        if (!this.isCurrentAttempt(attempt))
+            return null;
         if (!this.clientId) {
-            this.setSignIn({ ...IDLE_SIGN_IN_FACTS, phase: 'error', error: 'This app is not configured for sign-in (missing clientId).' });
+            this.failSignIn('not-configured', 'This app is not configured for sign-in (missing clientId).');
             return null;
         }
         this.setSignIn({ ...IDLE_SIGN_IN_FACTS, phase: 'starting' });
+        let handle;
         try {
-            const handle = await this.oxyServices.startCommonsSignIn({ clientId: this.clientId });
-            this.signInToken = handle.sessionToken;
-            this.setSignIn({
-                ...IDLE_SIGN_IN_FACTS,
-                phase: 'waiting',
-                authorizeCode: handle.authorizeCode,
-                qrPayload: handle.qrPayload,
-                expiresAt: handle.expiresAt,
-                // No route yet: the surface shows "Preparing request" until the primary
-                // route is resolved below. It is never guessed in the meantime.
-                route: opts.deliver ? null : 'qr',
-            });
-            // Primary path: an instant `auth_update` wake over the `/auth-session`
-            // socket. The poll below is only the fallback for when the socket can't
-            // connect, so it now runs at the slow fallback cadence.
-            this.openAuthSessionSocket(handle.sessionToken);
-            this.scheduleNextPoll(handle.sessionToken);
-            if (opts.deliver) {
-                // Non-blocking on purpose: the QR/authorizeCode are already renderable
-                // and the popup caller can navigate immediately, while the route (a
-                // local probe plus at most one delivery round-trip) resolves behind it.
-                void this.resolveDeliveryRoute(handle);
-            }
-            return handle;
+            handle = await this.oxyServices.startCommonsSignIn({ clientId: this.clientId });
         }
         catch (error) {
-            this.setSignIn({ ...IDLE_SIGN_IN_FACTS, phase: 'error', error: errorMessage(error) });
+            if (!this.isCurrentAttempt(attempt))
+                return null;
+            this.failSignIn(requestFailureReason(error), errorMessage(error));
+            return null;
+        }
+        if (!this.isCurrentAttempt(attempt)) {
+            // Created after the user walked away. The cancel could not withdraw it (it
+            // had no code yet), so withdraw it now — best effort, like every withdrawal.
+            void this.withdrawRequest(handle.authorizeCode);
             return null;
         }
+        this.signInToken = handle.sessionToken;
+        this.setSignIn({
+            ...IDLE_SIGN_IN_FACTS,
+            phase: 'waiting',
+            authorizeCode: handle.authorizeCode,
+            qrPayload: handle.qrPayload,
+            expiresAt: handle.expiresAt,
+            // No route yet: the surface shows "Preparing request" until the primary
+            // route is resolved below. It is never guessed in the meantime.
+            route: opts.deliver ? null : 'qr',
+        });
+        // Primary path: an instant `auth_update` wake over the `/auth-session`
+        // socket. The poll below is only the fallback for when the socket can't
+        // connect, so it now runs at the slow fallback cadence.
+        void this.openAuthSessionSocket(handle.sessionToken);
+        this.scheduleNextPoll(handle.sessionToken);
+        if (opts.deliver) {
+            // Non-blocking on purpose: the QR/authorizeCode are already renderable
+            // and the popup caller can navigate immediately, while the route (a
+            // local probe plus at most one delivery round-trip) resolves behind it.
+            void this.resolveDeliveryRoute(handle);
+        }
+        return handle;
     }
     /**
      * Choose and carry out the ONE primary delivery route for the active request
@@ -731,7 +863,7 @@ export class AccountDialogController {
             if (this.signIn.phase === 'starting' || this.signIn.phase === 'waiting') {
                 // Closing the surface cancels the REQUEST too, not just this listener.
                 const pendingCode = this.signIn.authorizeCode;
-                this.failSignIn('Sign-in was cancelled.');
+                this.failSignIn('cancelled', 'Sign-in was cancelled.');
                 if (pendingCode) {
                     void this.withdrawRequest(pendingCode);
                 }
@@ -794,8 +926,15 @@ export class AccountDialogController {
      * cancel the request, not just stop listening to it. Without the withdrawal a
      * dismissed QR would stay approvable until it expired, so a later scan of a
      * stale code could authorize a session nobody is waiting for.
+     *
+     * It also ENDS the attempt: anything of it still awaiting a response (the
+     * request being created, a shared-identity mint, a claim) finds itself
+     * superseded when that response arrives, and neither touches the surface nor
+     * installs a session. The withdrawal itself is best effort — cancelling
+     * locally is not proof the server received it (see {@link withdrawRequest}).
      */
     cancelSignIn() {
+        this.signInAttempt += 1;
         // Capture before the teardown clears it, and only for a request that can
         // still be approved — a completed/failed flow has nothing to withdraw.
         const pendingCode = this.signIn.phase === 'starting' || this.signIn.phase === 'waiting'
@@ -805,7 +944,7 @@ export class AccountDialogController {
         this.closeAuthSessionSocket();
         this.closeActivePopup();
         this.signInToken = null;
-        if (this.signIn !== IDLE_SIGN_IN) {
+        if (this.signIn.phase !== 'idle') {
             this.setSignIn(IDLE_SIGN_IN_FACTS);
         }
         if (pendingCode) {
@@ -844,13 +983,14 @@ export class AccountDialogController {
      */
     async pollOnce(sessionToken) {
         // A superseded / cancelled flow must not act; a poll already running owns the claim.
-        if (this.signInToken !== sessionToken || this.pollInFlight)
+        if (this.signInToken !== sessionToken || this.pollInFlightToken === sessionToken)
             return;
-        this.pollInFlight = true;
+        const attempt = this.signInAttempt;
+        this.pollInFlightToken = sessionToken;
         try {
             const expiresAt = this.signIn.expiresAt;
             if (typeof expiresAt === 'number' && Date.now() > expiresAt) {
-                this.failSignIn('Session expired. Please try again.');
+                this.failSignIn('expired', 'Session expired. Please try again.');
                 return;
             }
             try {
@@ -866,20 +1006,20 @@ export class AccountDialogController {
                     // OAuth-bound sessions mint no sessionId on approval — they finalize
                     // into an authorization code. The account dialog only starts device
                     // sign-in today; stop rather than poll until expiry.
-                    this.failSignIn('This sign-in flow cannot be completed here. Use the app\'s OAuth sign-in instead.');
+                    this.failSignIn('unsupported-flow', 'This sign-in flow cannot be completed here. Use the app\'s OAuth sign-in instead.');
                     return;
                 }
                 if (status.authorized && status.sessionId) {
                     this.clearPollTimer();
-                    await this.claimAndComplete(status.sessionId, sessionToken);
+                    await this.claimAndComplete(attempt, status.sessionId, sessionToken);
                     return;
                 }
                 if (status.status === 'cancelled') {
-                    this.failSignIn('Authorization was denied.');
+                    this.failSignIn('denied', 'Authorization was denied.');
                     return;
                 }
                 if (status.status === 'expired') {
-                    this.failSignIn('Session expired. Please try again.');
+                    this.failSignIn('expired', 'Session expired. Please try again.');
                     return;
                 }
             }
@@ -892,7 +1032,8 @@ export class AccountDialogController {
             }
         }
         finally {
-            this.pollInFlight = false;
+            if (this.pollInFlightToken === sessionToken)
+                this.pollInFlightToken = null;
         }
     }
     /**
@@ -910,18 +1051,24 @@ export class AccountDialogController {
             return;
         this.patchSignIn({ pushSentAt: nextPushSentAt, openedAt: nextOpenedAt });
     }
-    async claimAndComplete(sessionId, sessionToken) {
+    async claimAndComplete(attempt, sessionId, sessionToken) {
         this.patchSignIn({ phase: 'authorized' });
         let claimed;
         try {
-            claimed = await this.oxyServices.claimSessionByToken(sessionToken);
+            // Claimed WITHOUT planting the bearer — `completeSignIn` installs it only
+            // if the user is still waiting for this attempt when the claim returns.
+            claimed = await this.oxyServices.claimSessionByToken(sessionToken, { plantTokens: false });
         }
         catch (error) {
-            this.failSignIn(errorMessage(error));
+            if (!this.isCurrentAttempt(attempt))
+                return;
+            this.failSignIn('claim-failed', errorMessage(error));
             return;
         }
+        if (!this.isCurrentAttempt(attempt))
+            return;
         if (!claimed?.accessToken || !claimed.user) {
-            this.failSignIn('Authorization succeeded but the session could not be claimed. Please try again.');
+            this.failSignIn('claim-failed', 'Authorization succeeded but the session could not be claimed. Please try again.');
             return;
         }
         // `SessionLoginResponse.user` is the minimal session-carried shape; the claim
@@ -934,7 +1081,7 @@ export class AccountDialogController {
             avatar: claimed.user.avatar ?? undefined,
         };
         try {
-            await this.completeSignIn({
+            await this.completeSignIn(attempt, {
                 sessionId: claimed.sessionId || sessionId,
                 deviceId: claimed.deviceId ?? '',
                 expiresAt: claimed.expiresAt ?? '',
@@ -944,24 +1091,63 @@ export class AccountDialogController {
             }, minimalUser);
         }
         catch (error) {
-            this.failSignIn(errorMessage(error));
+            if (this.isCurrentAttempt(attempt))
+                this.failSignIn('unknown', errorMessage(error));
         }
     }
     /**
-     * Commit an authorized session, notify, and return to the account list. Shared
-     * by the shared-key, QR, and mint-switch paths so they cannot drift.
+     * Install an authorized session, notify, and return to the account list.
+     * Shared by the shared-key and QR paths so they cannot drift.
+     *
+     * THE install point, and so the last place an abandoned attempt is stopped:
+     * the bearer is planted and the session committed only while `attempt` is
+     * still current. A commit that fails restores the bearer the client had
+     * before, so a half-installed session never leaves requests going out as an
+     * account the device does not hold.
+     *
+     * A failed commit REJECTS (after that restore), so each caller keeps its own
+     * policy: the QR path fails the attempt, the shared-identity path falls
+     * through to the QR handoff.
+     *
+     * Once the commit has resolved the session IS this device's, whether or not
+     * the user moved on while it ran. It is reported (`onSignedIn`, re-read) either
+     * way; only the surface bookkeeping is skipped for a superseded attempt, so a
+     * newer attempt's state is never overwritten.
+     *
+     * Residual: an attempt abandoned after the server minted its session (a claim
+     * or shared-identity mint that was already in flight) leaves that server
+     * session un-installed on this device — it is never planted or committed here,
+     * but it is not revoked either.
      */
-    async completeSignIn(session, user) {
-        await this.commitAuthorizedSession(session, user);
-        this.signInToken = null;
-        this.clearPollTimer();
-        this.closeAuthSessionSocket();
-        this.closeActivePopup();
-        // Terminal SUCCESS, not idle: the surface gets one honest frame to show
-        // "Identity confirmed" before it closes. Cleared on the next view change.
-        this.signIn = COMPLETED_SIGN_IN;
-        this.view = 'accounts';
-        this.emit();
+    async completeSignIn(attempt, session, user) {
+        if (!this.isCurrentAttempt(attempt))
+            return;
+        const previousToken = this.oxyServices.getAccessToken();
+        try {
+            if (session.accessToken)
+                this.oxyServices.setTokens(session.accessToken);
+            await this.commitAuthorizedSession(session, user);
+        }
+        catch (error) {
+            if (session.accessToken && this.oxyServices.getAccessToken() === session.accessToken) {
+                if (previousToken)
+                    this.oxyServices.setTokens(previousToken);
+                else
+                    this.oxyServices.clearTokens();
+            }
+            throw error;
+        }
+        if (this.isCurrentAttempt(attempt)) {
+            this.signInToken = null;
+            this.clearPollTimer();
+            this.closeAuthSessionSocket();
+            this.closeActivePopup();
+            // Terminal SUCCESS, not idle: the surface gets one honest frame to show
+            // "Identity confirmed" before it closes. Cleared on the next view change.
+            this.signIn = buildSignIn(COMPLETED_SIGN_IN_FACTS, this.signInAttempt);
+            this.view = 'accounts';
+            this.emit();
+        }
         this.onSignedIn?.(user);
         await this.refresh();
     }
@@ -978,12 +1164,16 @@ export class AccountDialogController {
             await this.sessionClient.registerAndActivate(user.id);
         }
     }
-    failSignIn(message) {
+    /**
+     * End the CURRENT attempt as failed. The attempt keeps its identity (the
+     * failure belongs to it); only a new attempt or a cancel moves it on.
+     */
+    failSignIn(failure, message) {
         this.clearPollTimer();
         this.closeAuthSessionSocket();
         this.closeActivePopup();
         this.signInToken = null;
-        this.setSignIn({ ...IDLE_SIGN_IN_FACTS, phase: 'error', error: message });
+        this.setSignIn({ ...IDLE_SIGN_IN_FACTS, phase: 'error', error: message, failure });
     }
     clearPollTimer() {
         if (this.pollTimer !== null) {
@@ -1073,18 +1263,19 @@ export class AccountDialogController {
      * to advance without a fact behind it.
      */
     setSignIn(facts) {
-        this.signIn = { ...facts, progress: deriveSignInProgress(facts) };
+        this.signIn = buildSignIn(facts, this.signInAttempt);
         this.emit();
     }
     /** Update a subset of the device-flow facts, re-deriving `progress`. */
     patchSignIn(patch) {
-        const { phase, authorizeCode, qrPayload, expiresAt, error, route, routeFailed, pushSentAt, openedAt, } = this.signIn;
+        const { phase, authorizeCode, qrPayload, expiresAt, error, failure, route, routeFailed, pushSentAt, openedAt, } = this.signIn;
         this.setSignIn({
             phase,
             authorizeCode,
             qrPayload,
             expiresAt,
             error,
+            failure,
             route,
             routeFailed,
             pushSentAt,