@oxyhq/services 13.0.1 → 13.0.3

package/src/ui/context/OxyContext.tsx

@@ -161,42 +161,26 @@ export interface OxyContextState {
   // the caller). The cryptographic Commons/DID "identity" is a SEPARATE concept.
   //
   // UX concept: the user picks an account and the WHOLE app becomes that account
-  // — a genuine switch, NOT an "acting on behalf of" delegation. `actingAs` +
-  // `X-Acting-As` remain the underlying transport (the only one that works for
-  // passwordless org/project/bot accounts), but the framing everywhere is simply
-  // "this is the active account". Read {@link activeAccount} for "who am I"
-  // surfaces; `actingAs` is the low-level mechanism state.
-  /**
-   * The id of the account switched INTO (`X-Acting-As`), or `null` when the
-   * active account is the sign-in's own personal account. This is the underlying
-   * mechanism state — UI should present the result through {@link activeAccount}
-   * rather than framing it as delegation.
-   */
-  actingAs: string | null;
+  // — a genuine, REAL-SESSION switch (`switchToAccount`), identical to switching
+  // between device sign-ins. There is NO separate "active account" concept:
+  // `user` IS the active account after a switch. The removed `X-Acting-As`
+  // delegation header is gone entirely.
   /** Every account the caller can access — own personal root, owned, and shared — from `listAccounts()`. */
   accounts: AccountNode[];
   /**
-   * The {@link AccountNode} switched into, resolved from `accounts` by
-   * `actingAs`. `null` when the active account is the sign-in's own personal
-   * account, or while the switched-into id has not yet appeared in the loaded
-   * `accounts` list.
-   */
-  actingAsAccount: AccountNode | null;
-  /**
-   * The effective ACTIVE account presented across the whole app — the account
-   * the user switched into when one is set and resolved, otherwise the signed-in
-   * user's own personal account. This is the single "who am I" source every
-   * identity surface (header avatar/name, profile chrome, context cues) should
-   * read, so a switch is reflected everywhere as a real account change.
+   * Switch the active session INTO an account from the {@link accounts} graph
+   * (a managed org/project/bot, or an account shared with the caller).
    *
-   * It is a {@link User} (the personal user, or the switched-into account's
-   * embedded user) so every identity surface renders it identically. Falls back
-   * to the personal `user` during the brief window after a switch before
-   * `accounts` has loaded the switched-into node, so the header never flashes
-   * empty. `null` only when signed out.
+   * Mints and plants a REAL session for the target via
+   * `oxyServices.switchToAccount`, then commits it into context state the SAME
+   * way sign-in / {@link switchSession} do — so afterwards `user` IS the target
+   * account and every request authenticates as it. The minted session joins the
+   * device multi-account set (server-set httpOnly `oxy_rt_<authuser>` cookie), so
+   * it survives reload / `refresh-all` and appears in the device account list
+   * exactly like a device sign-in. Refreshes the account graph and invalidates
+   * all React Query data so everything reloads as the new account.
    */
-  activeAccount: User | null;
-  setActingAs: (accountId: string | null) => void;
+  switchToAccount: (accountId: string) => Promise<void>;
   refreshAccounts: () => Promise<void>;
   createAccount: (data: CreateAccountInput) => Promise<AccountNode>;
 }
@@ -1325,6 +1309,29 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       }
     }
 
+    // LAST-ACTIVE-ACCOUNT priority (web multi-account). When the user has an
+    // explicit persisted active slot (`oxy_active_authuser`, written on every
+    // device sign-in / account SWITCH / cookie restore), the multi-account
+    // refresh-cookie restore is the ONLY cold-boot step that honors WHICH slot
+    // was last active — `restoreViaRefreshCookie` selects it via
+    // `selectActiveRefreshAccount(accounts, readActiveAuthuser())`. The
+    // `fedcm-silent` and per-apex `silent-iframe` steps only ever recover the
+    // PRIMARY central IdP session, so if either ran first they would clobber a
+    // switched (managed/org) account back to the primary on reload — the exact
+    // "switch is lost on reload" regression. So when a slot selection exists we
+    // run cookie-restore BEFORE those probes (and disable the later duplicate).
+    //
+    // Read ONCE here (synchronously usable by the step `enabled` gates below).
+    // It is non-null ONLY on first-party `*.oxy.so` web apps that persist the
+    // slot — a cross-apex RP never writes it (its restore funnels through
+    // `handleWebSSOSession`, which does not touch the authuser), and native has
+    // no localStorage, so both keep their existing order untouched. The
+    // earlier `stored-session` step still runs first (FIX-A latency), and when
+    // a slot exists but its cookies have all lapsed, cookie-restore simply
+    // returns no accounts and the chain falls through to the cross-domain
+    // fallbacks exactly as before.
+    const prioritizeMultiAccount = isWebBrowser() && readActiveAuthuser() !== null;
+
     try {
       const outcome = await runColdBoot<true>({
         steps: [
@@ -1419,6 +1426,28 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
               return { kind: 'session', session: true };
             },
           },
+          {
+            // 2.75) LAST-ACTIVE multi-account restore (WEB, prioritized). Runs
+            // ONLY when an explicit persisted slot selection exists
+            // (`prioritizeMultiAccount`) — i.e. the user previously signed in or
+            // SWITCHED accounts on this first-party app. It runs BEFORE the
+            // `fedcm-silent` / `silent-iframe` probes (which only ever recover the
+            // PRIMARY central session) so a switched managed/org account survives
+            // reload instead of being clobbered back to the primary. The restore
+            // itself is the SAME `restoreViaRefreshCookie` as the terminal-tier
+            // step below: it rotates every device-local `oxy_rt_<authuser>` cookie
+            // and picks the persisted slot via `selectActiveRefreshAccount`,
+            // committing it (token + state + durable persistence + `markAuthResolved`).
+            // When no slot is persisted this is disabled and the original order is
+            // unchanged; when the slot's cookies have lapsed it returns no accounts
+            // and the chain falls through to the cross-domain fallbacks below.
+            id: 'cookie-restore-active',
+            enabled: () => prioritizeMultiAccount,
+            run: async () => {
+              const restored = await restoreViaRefreshCookie();
+              return restored ? { kind: 'session', session: true } : { kind: 'skip' };
+            },
+          },
           {
             // 3) FedCM silent reauthn (Chrome) against the CENTRAL IdP
             // (auth.oxy.so). `silentSignInWithFedCM` plants the access token
@@ -1493,8 +1522,15 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             // is correct; cross-domain restore is handled by the SSO bounce.
             // FIX-D: `restoreViaRefreshCookie` bounds the request with
             // `COOKIE_RESTORE_TIMEOUT` so a cross-domain stall cannot hang here.
+            //
+            // Disabled when `prioritizeMultiAccount` already ran the
+            // `cookie-restore-active` step above (an explicit persisted slot) — that
+            // earlier step is the identical restore, so this terminal-tier copy
+            // would be a redundant second `refreshAllSessions`. It still runs in the
+            // common no-persisted-slot case (e.g. first visit to a first-party app
+            // whose central refresh cookies already exist).
             id: 'cookie-restore',
-            enabled: () => isWebBrowser(),
+            enabled: () => isWebBrowser() && !prioritizeMultiAccount,
             run: async () => {
               const restored = await restoreViaRefreshCookie();
               return restored ? { kind: 'session', session: true } : { kind: 'skip' };
@@ -2018,38 +2054,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   });
 
   // --- Account graph state ---
-  const [actingAs, setActingAsState] = useState<string | null>(null);
   const [accounts, setAccounts] = useState<AccountNode[]>([]);
 
-  // Latest `actingAs`, mirrored into a ref so `refreshAccounts` can reconcile a
-  // stale switch without taking `actingAs` as a dependency (which would re-run
-  // the account load on every switch). See the reconciliation block below.
-  const actingAsRef = useRef(actingAs);
-  actingAsRef.current = actingAs;
-  // `setActingAs` is declared after `refreshAccounts`; route the reconciliation
-  // clear through a ref so the load callback can call the latest implementation.
-  const setActingAsRef = useRef<((accountId: string | null) => void) | null>(null);
-
-  // Restore actingAs from storage on startup
-  useEffect(() => {
-    if (!storage || !initialized) return;
-    let mounted = true;
-    (async () => {
-      try {
-        const stored = await storage.getItem(`${storageKeyPrefix}_acting_as`);
-        if (mounted && stored) {
-          setActingAsState(stored);
-          oxyServices.setActingAs(stored);
-        }
-      } catch (err) {
-        if (__DEV__) {
-          loggerUtil.debug('Failed to restore actingAs from storage', { component: 'OxyContext' }, err as unknown);
-        }
-      }
-    })();
-    return () => { mounted = false; };
-  }, [storage, initialized, storageKeyPrefix, oxyServices]);
-
   // Load the unified account graph when authenticated
   const refreshAccounts = useCallback(async (): Promise<void> => {
     if (!isAuthenticated || !tokenReady || !oxyServices.getAccessToken()) {
@@ -2060,15 +2066,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     try {
       const list = await oxyServices.listAccounts();
       setAccounts(list);
-      // Reconcile a stale switch: if the active account was switched INTO an id
-      // that is no longer accessible (account removed/archived, or it belonged
-      // to a now-inactive sign-in), drop back to the personal account so the
-      // app never keeps sending a dead `X-Acting-As` header. `list` is the
-      // authoritative accessible set on a successful fetch.
-      const current = actingAsRef.current;
-      if (current && !list.some((node) => node.accountId === current)) {
-        setActingAsRef.current?.(null);
-      }
     } catch (err) {
       if (isUnauthorizedStatus(err)) {
         setAccounts([]);
@@ -2087,47 +2084,64 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     }
   }, [isAuthenticated, initialized, tokenReady, refreshAccounts]);
 
-  const setActingAs = useCallback((accountId: string | null) => {
-    oxyServices.setActingAs(accountId);
-    setActingAsState(accountId);
-    // Switching the acting-as identity changes every server response, but React
-    // Query keys are not namespaced by the acting-as target, so the cache would
-    // otherwise keep serving the previous account's data. Invalidate everything
-    // so each query refetches under the new identity (the next request carries
-    // the updated `X-Acting-As` header). `invalidateQueries` (not `clear`) keeps
-    // the account list/switcher populated mid-switch instead of blanking out.
-    queryClient.invalidateQueries();
-    // Persist to storage
-    if (storage) {
-      if (accountId) {
-        storage.setItem(`${storageKeyPrefix}_acting_as`, accountId).catch((persistError) => {
-          loggerUtil.debug('Failed to persist acting-as account', { component: 'OxyContext' }, persistError as unknown);
-        });
-      } else {
-        storage.removeItem(`${storageKeyPrefix}_acting_as`).catch((persistError) => {
-          loggerUtil.debug('Failed to clear acting-as account', { component: 'OxyContext' }, persistError as unknown);
-        });
+  // Switch the active session INTO an account from the unified graph. In the
+  // REAL-SESSION model this is identical to switching device sign-ins: mint a
+  // real session for the target and make the whole app that account. The removed
+  // `X-Acting-As` delegation header is gone — `oxyServices.switchToAccount`
+  // plants the minted access token (the refresh token is the server-set httpOnly
+  // `oxy_rt_<authuser>` cookie, so the session joins the device multi-account set
+  // and survives reload / `refresh-all`). We then commit the session into context
+  // state the SAME way sign-in / `switchSession` do, refresh the account graph,
+  // and invalidate every query so all data reloads as the new account.
+  const switchToAccount = useCallback(async (accountId: string): Promise<void> => {
+    const result = await oxyServices.switchToAccount(accountId);
+    if (!result?.user || !result?.sessionId) {
+      throw new Error('Account switch did not return a valid session');
+    }
+
+    // `oxyServices.switchToAccount` already planted `result.accessToken` as the
+    // active token; mirror the minted session into the multi-account store and
+    // mark it current, recording the device `authuser` slot so web silent-switch
+    // and the device account chooser can address it.
+    const now = new Date();
+    const clientSession: ClientSession = {
+      sessionId: result.sessionId,
+      deviceId: result.deviceId || '',
+      expiresAt: result.expiresAt || new Date(now.getTime() + DEFAULT_SESSION_VALIDITY_MS).toISOString(),
+      lastActive: now.toISOString(),
+      userId: result.user.id?.toString() ?? '',
+      isCurrent: true,
+      ...(typeof result.authuser === 'number' ? { authuser: result.authuser } : null),
+    };
+    updateSessions([clientSession], { merge: true });
+    setActiveSessionId(result.sessionId);
+    if (isWebBrowser() && typeof result.authuser === 'number') {
+      writeActiveAuthuser(result.authuser);
+    }
+    await persistSessionDurably(result.sessionId);
+
+    // Fetch the canonical User for the new account (the switch result carries
+    // only MinimalUserData); fall back to that minimal shape if the profile
+    // fetch fails so the app still reflects the switched identity.
+    let fullUser: User;
+    try {
+      fullUser = await oxyServices.getCurrentUser();
+    } catch (profileError) {
+      if (__DEV__) {
+        loggerUtil.debug('Failed to fetch full user after account switch; using switch result user', { component: 'OxyContext', method: 'switchToAccount' }, profileError as unknown);
       }
+      fullUser = result.user as unknown as User;
     }
-  }, [oxyServices, storage, storageKeyPrefix, queryClient]);
-  setActingAsRef.current = setActingAs;
-
-  // The account switched into, resolved from the loaded graph.
-  const actingAsAccount = useMemo<AccountNode | null>(() => {
-    if (!actingAs) return null;
-    return accounts.find((node) => node.accountId === actingAs) ?? null;
-  }, [actingAs, accounts]);
-
-  // The effective ACTIVE account presented across the app: the switched-into
-  // account's user when a switch is set and resolved, otherwise the signed-in
-  // user's own personal account. Derived (no effect) so identity surfaces always
-  // render the current account without separate syncing. Falls back to `user`
-  // while a just-set switch has not yet resolved in `accounts`, so the header
-  // never flashes empty mid-switch.
-  const activeAccount = useMemo<User | null>(
-    () => (actingAs && actingAsAccount ? actingAsAccount.account : user),
-    [actingAs, actingAsAccount, user],
-  );
+    loginSuccess(fullUser);
+    onAuthStateChange?.(fullUser);
+
+    // Reload the switchable account graph (the new active account's relationships
+    // differ) and invalidate every query so all data refetches as the new
+    // account — the deviceAccounts probe re-enumerates the multi-account set so
+    // the switched account now appears as a device session.
+    await refreshAccounts();
+    queryClient.invalidateQueries();
+  }, [oxyServices, updateSessions, setActiveSessionId, persistSessionDurably, loginSuccess, onAuthStateChange, refreshAccounts, queryClient]);
 
   const createAccountFn = useCallback(async (data: CreateAccountInput): Promise<AccountNode> => {
     const account = await oxyServices.createAccount(data);
@@ -2177,11 +2191,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     useFollow: useFollowHook,
     showBottomSheet: showBottomSheetForContext,
     openAvatarPicker,
-    actingAs,
     accounts,
-    actingAsAccount,
-    activeAccount,
-    setActingAs,
+    switchToAccount,
     refreshAccounts,
     createAccount: createAccountFn,
   }), [
@@ -2224,11 +2235,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     user,
     showBottomSheetForContext,
     openAvatarPicker,
-    actingAs,
     accounts,
-    actingAsAccount,
-    activeAccount,
-    setActingAs,
+    switchToAccount,
     refreshAccounts,
     createAccountFn,
   ]);
@@ -2297,11 +2305,8 @@ const LOADING_STATE: OxyContextState = {
   clientId: null,
   oxyServices: LOADING_STATE_OXY_SERVICES,
   openAvatarPicker: () => {},
-  actingAs: null,
   accounts: [],
-  actingAsAccount: null,
-  activeAccount: null,
-  setActingAs: () => {},
+  switchToAccount: () => rejectMissingProvider<void>(),
   refreshAccounts: () => rejectMissingProvider<void>(),
   createAccount: () => rejectMissingProvider<AccountNode>(),
 };

package/src/ui/hooks/queries/useAccountQueries.ts

@@ -233,6 +233,9 @@ export const useAuthorizedApps = (options?: { enabled?: boolean }) => {
  */
 export const usePrivacySettings = (userId?: string, options?: { enabled?: boolean }) => {
   const { oxyServices, activeSessionId, user } = useOxy();
+  // When no explicit user id is supplied, target the ACTIVE account (the
+  // account switched into) so "my privacy settings" reflects the current
+  // account, matching the imperative PrivacySettingsScreen.
   const targetUserId = userId || user?.id;
 
   return useQuery({

package/src/ui/hooks/queries/useServicesQueries.ts

@@ -5,8 +5,11 @@ import { queryKeys } from './queryKeys';
 import { useOxy } from '../../context/OxyContext';
 import { fetchSessionsWithFallback, mapSessionsToClient } from '../../utils/sessionHelpers';
 
-const accountQueryScope = (activeSessionId: string | null, actingAs?: string | null): string =>
-  `${activeSessionId ?? 'no-session'}:${actingAs ?? 'self'}`;
+// Per-account query scope. In the real-session switch model the active session
+// id uniquely identifies the active account (switching mints a new session), so
+// it alone scopes the cache — no separate acting-as key is needed.
+const accountQueryScope = (activeSessionId: string | null): string =>
+  `${activeSessionId ?? 'no-session'}`;
 
 /**
  * Get all active sessions for the current user
@@ -93,10 +96,10 @@ export const useDeviceSessions = (options?: { enabled?: boolean }) => {
  * Get user devices
  */
 export const useUserDevices = (options?: { enabled?: boolean }) => {
-  const { oxyServices, isAuthenticated, activeSessionId, actingAs } = useOxy();
+  const { oxyServices, isAuthenticated, activeSessionId } = useOxy();
 
   return useQuery({
-    queryKey: queryKeys.devices.list(accountQueryScope(activeSessionId, actingAs)),
+    queryKey: queryKeys.devices.list(accountQueryScope(activeSessionId)),
     queryFn: async () => {
       return authenticatedApiCall(
         oxyServices,
@@ -135,10 +138,10 @@ export const useSecurityInfo = (options?: { enabled?: boolean }) => {
  * `useEffect` fetches.
  */
 export const useAccountStorageUsage = (options?: { enabled?: boolean }) => {
-  const { oxyServices, isAuthenticated, activeSessionId, actingAs } = useOxy();
+  const { oxyServices, isAuthenticated, activeSessionId } = useOxy();
 
   return useQuery<AccountStorageUsageResponse>({
-    queryKey: queryKeys.storage.usage(accountQueryScope(activeSessionId, actingAs)),
+    queryKey: queryKeys.storage.usage(accountQueryScope(activeSessionId)),
     queryFn: async () => {
       return authenticatedApiCall(
         oxyServices,

package/src/ui/screens/AccountSettingsScreen.tsx

@@ -38,7 +38,7 @@ const AccountSettingsScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, nav
   const bloomTheme = useTheme();
   const colors = bloomTheme.colors;
   const { t } = useI18n();
-  const { oxyServices, canUsePrivateApi, actingAs, setActingAs } = useOxy();
+  const { oxyServices, canUsePrivateApi, user, accounts, switchToAccount } = useOxy();
   const queryClient = useQueryClient();
 
   const id = typeof accountId === 'string' ? accountId : '';
@@ -91,10 +91,14 @@ const AccountSettingsScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, nav
   const archiveMutation = useMutation({
     mutationKey: ['accounts', 'archive', id],
     mutationFn: () => oxyServices.archiveAccount(id),
-    onSuccess: () => {
-      // If this was the active account, drop back to the personal account.
-      if (actingAs === id) {
-        setActingAs(null);
+    onSuccess: async () => {
+      // If we archived the account we're currently signed in AS, switch back to
+      // the personal account so the app isn't left as an archived identity.
+      if (user?.id === id) {
+        const personal = accounts.find((node) => node.relationship === 'self');
+        if (personal) {
+          await switchToAccount(personal.accountId).catch(() => undefined);
+        }
       }
       queryClient.invalidateQueries({ queryKey: ['accounts'] });
       toast.success(t('accounts.settings.toasts.archived') || 'Account archived');

package/src/ui/screens/AccountSwitcherScreen.tsx

@@ -8,9 +8,9 @@ import { useI18n } from '../hooks/useI18n';
 
 /**
  * Bottom-sheet route wrapper around {@link AccountSwitcherView}. Used when the
- * switcher is opened as a sheet (e.g. from the `ActiveAccountBanner` cue or the
- * "Your accounts" entry in ManageAccount) rather than as the header-chip
- * popover (which uses the `AccountSwitcher` modal directly).
+ * switcher is opened as a sheet (e.g. from the "Your accounts" entry in
+ * ManageAccount) rather than as the header-chip popover (which uses the
+ * `AccountSwitcher` modal directly).
  */
 const AccountSwitcherScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, navigate }) => {
   const { t } = useI18n();

package/src/ui/screens/CreateAccountScreen.tsx

@@ -84,7 +84,7 @@ const CreateAccountScreen: React.FC<BaseScreenProps> = ({
   parentAccountId,
 }) => {
   const bloomTheme = useTheme();
-  const { oxyServices, createAccount, setActingAs } = useOxy();
+  const { oxyServices, createAccount, switchToAccount } = useOxy();
   const { t } = useI18n();
 
   const parentId = typeof parentAccountId === 'string' ? parentAccountId : undefined;
@@ -181,9 +181,11 @@ const CreateAccountScreen: React.FC<BaseScreenProps> = ({
 
       toast.success(t('accounts.create.toasts.success') || 'Account created');
 
-      // Switch to the new account
+      // Switch INTO the new account (real-session switch — the whole app becomes
+      // it). Best-effort: creation already succeeded, so a switch hiccup should
+      // not surface as a create failure.
       if (account.accountId) {
-        setActingAs(account.accountId);
+        await switchToAccount(account.accountId).catch(() => undefined);
       }
 
       onClose?.();
@@ -195,7 +197,7 @@ const CreateAccountScreen: React.FC<BaseScreenProps> = ({
     } finally {
       setIsCreating(false);
     }
-  }, [canCreate, kind, username, displayName, bio, parentId, createAccount, setActingAs, onClose, t]);
+  }, [canCreate, kind, username, displayName, bio, parentId, createAccount, switchToAccount, onClose, t]);
 
   // Status icon + color shown alongside the username field message
   const usernameIsInvalid = usernameStatus === 'taken' || usernameStatus === 'invalid';

package/src/ui/screens/EditProfileFieldScreen.tsx

@@ -88,6 +88,10 @@ const EditProfileFieldScreen: React.FC<EditProfileFieldScreenProps> = ({
     theme,
     fieldType = 'displayName',
 }) => {
+    // Editing "my" profile targets the ACTIVE account — writes authenticate as
+    // the active session, which IS that account — so the initial field values
+    // must mirror the active account (an org/project/bot when switched, else the
+    // personal user).
     const { user } = useOxy();
     const { t } = useI18n();
     const { saveProfile, updateField, isSaving } = useProfileEditing();
@@ -262,7 +266,7 @@ const EditProfileFieldScreen: React.FC<EditProfileFieldScreenProps> = ({
         }
     }, [fieldType, t]);
 
-    // Initialize field values from user data
+    // Initialize field values from the active account's data
     useEffect(() => {
         if (!user) return;
 

package/src/ui/screens/FileManagementScreen.tsx

@@ -763,7 +763,10 @@ const FileManagementScreen: React.FC<FileManagementScreenProps> = ({
     defaultVisibility = 'private',
     linkContext,
 }) => {
-    // Use useOxy() hook for OxyContext values
+    // Use useOxy() hook for OxyContext values. Files are owned by the ACTIVE
+    // account (the org/project/bot when switched, else the personal user): the
+    // default file owner and every "is this mine?" ownership check resolve
+    // against `user`, so switching shows/manages that account's files.
     const { user, oxyServices } = useOxy();
     const { t } = useI18n();
     const uploadFileMutation = useUploadFile();

package/src/ui/screens/HistoryViewScreen.tsx

@@ -15,6 +15,8 @@ import { Dialog, useDialogControl } from '@oxyhq/bloom';
 interface HistoryItem { id: string; query: string; type: 'search' | 'browse'; timestamp: Date; }
 
 const HistoryViewScreen: React.FC<BaseScreenProps> = ({ onClose, goBack }) => {
+    // History is scoped to the ACTIVE account so a switch into an org/project/bot
+    // shows that account's history, not the device-session owner's.
     const { user } = useOxy();
     const { t } = useI18n();
     const bloomTheme = useTheme();

package/src/ui/screens/LanguageSelectorScreen.tsx

@@ -33,7 +33,9 @@ const LanguageSelectorScreen: React.FC<LanguageSelectorScreenProps> = ({
     onClose,
     theme,
 }) => {
-    // Use useOxy() hook for OxyContext values
+    // Use useOxy() hook for OxyContext values. The language preference persists
+    // on the ACTIVE account's profile — the active session IS that account — so
+    // gate the server sync on the active account.
     const { user, currentLanguage, setLanguage, oxyServices, isAuthenticated } = useOxy();
     const { t } = useI18n();
     const bloomTheme = useTheme();

package/src/ui/screens/ManageAccountScreen.tsx

@@ -100,6 +100,11 @@ const ManageAccountScreen: React.FC<BaseScreenProps> = ({
     const { data: userFromQuery, isLoading: userLoading } = useCurrentUser({
         enabled: isAuthenticated,
     });
+    // `user` IS the active account. In the real-session switch model, switching
+    // into an org/project/bot makes it the active session, so `useOxy().user`
+    // (and the freshest `useCurrentUser` copy) already reflects the switched
+    // account everywhere — identity-of-me surfaces and management/GDPR actions
+    // alike read this single `user`.
     const user = userFromQuery ?? contextUser;
 
     const { data: subscription } = useUserSubscription({ enabled: isAuthenticated });

package/src/ui/screens/PremiumSubscriptionScreen.tsx

@@ -91,7 +91,8 @@ const PremiumSubscriptionScreen: React.FC<BaseScreenProps> = ({
     navigate,
     goBack,
 }) => {
-    // Use useOxy() hook for OxyContext values
+    // Premium state belongs to the ACTIVE account (the org/project/bot when
+    // switched, else the personal user), not the device-session owner.
     const { user } = useOxy();
     const [loading, setLoading] = useState(true);
     const [subscription, setSubscription] = useState<UserSubscription | null>(null);

package/src/ui/screens/PrivacySettingsScreen.tsx

@@ -65,6 +65,8 @@ const PrivacySettingsScreen: React.FC<BaseScreenProps> = ({
     onClose,
     goBack,
 }) => {
+    // Privacy settings belong to the ACTIVE account (the org/project/bot when
+    // switched, else the personal user).
     const { oxyServices, user } = useOxy();
     const { t, locale } = useI18n();
     const bloomTheme = useTheme();
@@ -131,7 +133,10 @@ const PrivacySettingsScreen: React.FC<BaseScreenProps> = ({
         };
 
         loadUsers();
-    }, [oxyServices]);
+        // Re-load when the active account changes so the block/restrict lists
+        // reflect the account currently switched into (they resolve from the
+        // active session, which IS that account).
+    }, [oxyServices, user?.id]);
 
     const handleUnblock = useCallback(async (userId: string) => {
         if (!oxyServices) return;

package/src/ui/screens/ProfileScreen.tsx

@@ -27,7 +27,10 @@ const AVATAR_OVERLAP = -56;
 const INFO_ICON_SIZE = 18;
 
 const ProfileScreen: React.FC<ProfileScreenProps> = ({ userId, username, theme, goBack, navigate }) => {
-    // Use useOxy() hook for OxyContext values
+    // Use useOxy() hook for OxyContext values. "Me" for own-profile detection
+    // and the own-profile fallback is the ACTIVE account (the account switched
+    // into), so previewing my profile while switched into an org/project/bot
+    // resolves "this is mine" against that account, not the session owner.
     const { oxyServices, user: currentUser } = useOxy();
     const [profile, setProfile] = useState<User | null>(null);
     const [reputationTotal, setReputationTotal] = useState<number | null>(null);

package/src/ui/screens/SavesCollectionsScreen.tsx

@@ -38,7 +38,8 @@ const SavesCollectionsScreen: React.FC<BaseScreenProps> = ({
     onClose,
     goBack,
 }) => {
-    // Use useOxy() hook for OxyContext values
+    // Saves & collections belong to the ACTIVE account (the org/project/bot when
+    // switched, else the personal user).
     const { oxyServices, user } = useOxy();
     const { t } = useI18n();
     const bloomTheme = useTheme();

package/src/ui/screens/SearchSettingsScreen.tsx

@@ -21,6 +21,9 @@ const SearchSettingsScreen: React.FC<BaseScreenProps> = ({
     onClose,
     goBack,
 }) => {
+    // Search settings are persisted on the ACTIVE account's profile (the
+    // org/project/bot when switched, else the personal user); reads/writes
+    // authenticate as the active session, which IS that account.
     const { oxyServices, user } = useOxy();
     const { t } = useI18n();
     const bloomTheme = useTheme();

package/src/ui/screens/WelcomeNewUserScreen.tsx

@@ -63,7 +63,10 @@ const WelcomeNewUserScreen: React.FC<BaseScreenProps & { newUser?: any }> = ({
     theme,
     newUser,
 }) => {
-    // Use useOxy() hook for OxyContext values
+    // Use useOxy() hook for OxyContext values. The greeting/avatar identity is
+    // the ACTIVE account (the personal user during onboarding, but read through
+    // `user` so this stays correct everywhere), with the freshly
+    // registered `newUser` as the pre-store-hydration fallback.
     const { user, oxyServices } = useOxy();
     const { t, locale } = useI18n();
     const updateProfileMutation = useUpdateProfile();
@@ -88,7 +91,7 @@ const WelcomeNewUserScreen: React.FC<BaseScreenProps & { newUser?: any }> = ({
     const [lastName, setLastName] = useState(() => (currentUser?.name?.last ?? '').trim());
     const [savingName, setSavingName] = useState(false);
 
-    // Update selectedAvatarId when user changes
+    // Update selectedAvatarId when the active account's avatar changes
     useEffect(() => {
         if (user?.avatar) {
             setSelectedAvatarId(user.avatar);

package/src/ui/screens/trust/TrustCenterScreen.tsx

@@ -20,7 +20,8 @@ const TrustCenterScreen: React.FC<BaseScreenProps> = ({
     goBack,
     navigate,
 }) => {
-    // Use useOxy() hook for OxyContext values
+    // Reputation/trust is the ACTIVE account's standing (the org/project/bot
+    // when switched, else the personal user).
     const { user, oxyServices, isAuthenticated } = useOxy();
     const { t } = useI18n();
     const [reputationTotal, setReputationTotal] = useState<number | null>(null);