fix(accounts): integrate credential and file recovery lifecycles

[veryCrunchy]

Account removal, credential changes, queued work, and retained Android file access now share account ownership and recoverable cleanup boundaries. A delayed operation cannot reopen a removed account's private state, take a new folder permission for a cancelled selection, or use another account's credentials.

This integrates #436, #438, #439, #445, #446, #447, #455, #456, and #457 against main, preserving their commits and incorporating the fixes found during combined review.

Behavior

• Android and desktop credential slots retain explicit account ownership through migration, replacement, removal, and interrupted cleanup. Unsupported and malformed stored state has distinct recovery guidance; cleanup preserves uncertain local data rather than discarding its evidence. Cancellation propagates through credential migration and persistence boundaries.
• Android background uploads resolve their persisted account's credentials without switching the selected account. Scheduling and cleanup retain durable ownership after interrupted handoffs, classify permanent failures separately from bounded retries, and preserve ambiguous upload outcomes for reconciliation.
• Folder setup preserves grants owned by configured pairs and recovers abandoned selections. A cancelled save does not revoke a committed pair's permission. Chooser results recheck the exact session and raw/canonical retirement generations before acquiring access, and a cancelled chooser cannot deliver its later result to a replacement request.
• Android document access is bound to account incarnations and verified legacy aliases. Removal retires retained grants and outstanding handoff producers; delayed staging or registration cannot recreate revoked access. Provider edits retain durable recovery and remote preconditions, and self-provider picker roots are rejected before sync work starts.
• Account removal fences dynamic reads and retires scoped contracts, previews, drafts, workspace memory, and media routes. Other accounts' offline contracts remain intact. Desktop rollback restores cache admission only after credential restoration succeeds, while incomplete cleanup remains recoverable.

Advances #172 and #52.

Validation

• Passed on Windows: 350 focused desktop tests across 28 suites, with no failures or skips.
• Passed on Windows: desktop distributable build and the packaged SQLite runtime probe.
• Passed on Windows: all 1,125 Android unit tests, with no failures or skips. Debug APK assembly also passed.
• Passed: repository architecture, text/privacy, Markdown, changelog, update-manifest, release-workflow, and channel-promotion checks. Linux package metadata validation awaits Linux CI because the local Linux environment is unavailable.
• Passed on Windows: 242 real Compose captures regenerated and verified against all 427 capture inputs. Public screenshots will use the canonical Linux refresh before merge to avoid Windows rasterization churn.
• Passed on Windows: website build with bundled GitHub snapshots, 82 tests, client and SSR bundles, and 32 prerendered routes. The existing POSIX notifier test remains Linux-only.
• Pending before merge: fresh combined-head hosted CI, canonical Linux capture freshness, and Codex review against main.

These are source and deterministic validation results, not a release or a claim of complete multi-account product support. This combined revision has not been validated on a physical Android device or against a live Nextcloud server. The repository emulator launcher requires Linux KVM and could not start on the Windows host, so emulator smoke and Android Keystore instrumentation remain unverified. Linux/macOS platform integration, native credential-store behavior, Android WorkManager process recovery, and external document-client lifecycle behavior still require the relevant platform evidence; Windows-hosted unit tests do not establish those outcomes.

[obiente-cloud]

Obiente preview

NC Native · e12b914bdf70 · Ready

Open preview

View in Obiente

_{Obiente updates this comment as the preview changes.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T06:09:04.383548Z	c25a4df	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.