[RCmerci]

Summary

• Preserve the registered worker session when the first authentication SDK confirmation matches the locally restored account. Continue revoking on changed users, signout, graph replacement, and coalesced authority changes.
• Keep media and offline asset read ownership across a transient worker binding replacement, including shared consumers. Wait for the replacement baseline before admitting new reads.
• Retain the coordinator's existing expected-owner checks and read-only replay boundary. Genuine account/graph changes retire stale consumers; this patch adds no write-retry path.

Regression scope

The first-confirmation decision is owned by the real worker service and its latest-control queue; the pure Sync reducer already preserves generations. These regressions therefore use the existing service/runtime boundary. Media and offline asset adapters own the pending read slots and resource retirement not represented in the pure coordinator or policy reducers. Existing pure coordinator rebind, sealed-continuation, and durable-operation regressions remain required.

Tests cover same-user restoration online/offline, duplicate confirmation, changed account, signout, admitted/coalesced A→B→A and A→signout→A, full/cancelled control admissions, outstanding reads, old graph capabilities, shared dependency consumers, queued and admitted media reads, offline scan ownership, cleanup ordering, and sealed-cursor rejection. The full existing durable-operation suite also passes.

Validation

• Passed: locked-switch dune build @all app/native_embed.exe.o.
• Passed: dune runtest --force, 22 Alcotest suites / 1340 cases plus custom runtime suites.
• Passed: focused authentication, media/asset runtime, live-read rebind, and sealed continuation regressions (including RED → GREEN reproductions).
• Passed: independent read-only review and git diff --check.
• Passed: official native producer and imported-envelope Simulator build on final clean commit 40aabc0a0171c3dc5faa3e0ff9e753284465cfd0.
• Passed: dedicated iPhone 13 / iOS 26.1 synthetic real-runtime smoke: encrypted offline timeline, Detail → Back, Capture → discard, and missing-key recovery with no timeline admitted.
• Simulator uses the explicit experimental host-restamp route; cross_abi_validated=false. This is not live-login or real-device/full iOS ABI validation. The exact delayed-baseline identity/media race is covered at deterministic service/coordinator/adapter boundaries, not reproduced in GUI.
• Not run: spec-dev-tool check --all because the tool is unavailable.

Base: current main at 1a7f738f6416ceea4519849303674388c1f5cc8e, verified online after push. Full tests used tool-reviewed macOS localhost DNSService access; no system or security settings changed.

No Dune files or spec/ OCaml files changed.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-10T12:50:21.609526Z	40aabc0	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.