Account and offline queue integration

Status: Active Last reviewed: 2026-09-07

Slice contract and ownership

Codex owns implementation closure of the drafted account-switching/offline-queue repair. Claude owns independent orchestration and merge/release review under the multi-agent operating model. The worktree is /home/sungkyu08/Dev/twomore-v2-venue-pipeline, branch codex/venue-pipeline-20260906, starting from 9e5d67c7. Claude's main checkout and wireframe work remain separate. A coordination notice in both worktrees names the shared integration points; no main-checkout runtime files are changed.

Mode: closure-only integration. The blocker is unintegrated, partly reviewed draft code and test fixtures that still assume an unowned global queue. The intended result is that an old account's queued work, callbacks and delayed responses cannot execute or publish as a newly signed-in account, while the same account retains valid offline work across restart and provider remount.

Allowed scope: the frozen Q1/Q2/producer/Q3 path maps, relevant queue/session and mutation tests, test helpers and test registration, this audit, the rebuild log and generated documentation. Integration points include app registry/barrels, native/web providers, auth storage, query persistence and queue producers. Existing venue ownership behavior must remain intact.

Excluded: payment acknowledgment, immutable server action receipts, notification registration/delivery, new backend areas, wireframe/UI redesign, hosted writes, push, deployment and dependency upgrades. Adjacent findings become follow-ups.

Plan and validation ladder

1. Reuse retained source-bound evidence; finish the interrupted Q3 author run and independent review. Codex subagents own these bounded checks; root owns producer compatibility and integration. No additional audit track is opened.
2. Adapt existing tests to an explicitly admitted account and the scoped replay dependency. Preserve their business assertions. Promote the accepted layers together, with permanent regressions for the repaired ownership boundaries.
3. Run targeted joined tests/types/lint during integration, then one full yarn check before handoff. Repeat only for a new failure or runtime change.
4. Record changed paths, exact evidence, limitations and the next Claude action. Stop after this slice; the remaining backend roadmap stays deferred.

Acceptance requires current-account positive controls, durable queue ownership, stale callback/response/write suppression, native/web provider wiring and a passing repository gate. Local harnesses do not prove device behavior, hosted auth behavior or exactly-once server execution. Web multi-tab durable ownership remains an explicitly separate gap.

Evidence and progress

The retained draft and review directories are beneath .audit/backend-pipelines-20260906/: queue-auth-q1/, queue-auth-q2/, queue-auth-producers/, queue-auth-producers-review/, queue-auth-q3/ and queue-auth-q3-review/. They are local ignored artifacts. Existing acceptance must match the source being promoted; a predecessor receipt is insufficient for subsequently amended code.

The 56 runtime paths have been promoted together from the reviewed freeze. The resumed author acceptance passes 63 integration cases, 53 existing queue/session Jest cases, app/native/web type overlays, lint and formatting. Independent Q3 review passes 19 lifecycle schedules with no open finding from those schedules. The seven producer Jest suites pass 52 existing cases after explicit account setup; their business assertions remain unchanged. Permanent regression installation is complete: 205 queue cases in 24 suites, plus five adapted existing owner-client cases and one contribution-persistence case. Targeted executions pass against canonical runtime; app typecheck and focused strict lint are part of the integration evidence. The canonical repository gate passes. Claude's independent review is pending.

The portable command is yarn test:queue-integrity, included in yarn test and therefore yarn check. Permanent suites under scripts/__tests__/queue-integrity/ read checked-in sources and installed SDK/framework modules; they do not import ignored drafts or write acceptance artifacts into the source tree.

Final yarn check passes 758 existing script cases (two existing skips), all 205 queue cases, and 393 Jest suites / 5,614 cases, along with workspace types and architecture/documentation gates. The 104 changed runtime/test/helper paths pass focused strict lint. The web production build passes with synthetic loopback settings; the existing expo-location export and Next ESLint-plugin warnings remain. No dependency upgrade or device/hosted validation is claimed.

The source-bound final receipt is .audit/backend-pipelines-20260906/queue-integration/repository-check-2/receipt.json; its log SHA-256 is 361f44614f6a400bf1f51ec1d90bbc7d5dbe2d77af0fde53a8f9689dc1796b5e. Runtime/test sources stayed unchanged during this check. The first run stopped at the README's stale migration reference left after the payment commit: it now correctly lists 623 tracked migrations through 00631. That diagnostic is retained in repository-check-1; no runtime change was made to obtain the final pass.

Behavior and upgrade boundaries

Queue entries bind an author and account generation. Online and replayed actions use captured credentials through the scoped repository port. Logout/account change revokes old work, hides stale mutation results and prevents old callbacks from writing into the replacement account's cache. Storage writes and cleanup serialize; provider suspension preserves owned offline intents for a freshly verified return of the same account. Native and web mount the same replay provider.

Legacy queue entries without an attributable owner are discarded rather than assigned to the next signed-in account. Cold-start query cache is cleared because the existing persisted query records do not establish account ownership. This limits offline browsing of previously cached data after a cold start; it does not discard the separately owned queue. Document and account for this upgrade behavior before any rollout. Durable cross-tab coordination and immutable server receipts are outside this change; cancellation cannot undo a request already committed by the server.

Handoff to Claude

Read this page first, then inspect the branch diff and the final evidence below. Do not copy one queue layer in isolation or assume the main checkout contains these changes. Preserve existing venue/payment commits when deciding integration order. Shared generated docs must be regenerated after merging concurrent work. No OTA/build/backend release is requested by this slice.

Status: implementation and local self-verification complete; ready for Claude's review. Review the account/queue lifecycle and upgrade behavior first, then the 15 producers and permanent regressions. At the recorded main head 0a6b41df, none of the queue-owned runtime/test paths overlap committed main changes. Refresh this comparison before merging, preserve Claude's uncommitted work, and regenerate shared documentation on the combined result. A local commit is a handoff artifact, not Claude's sign-off or release acceptance. Stop here; payment acknowledgment and notification repairs remain separate future slices.