[nwparker]

Mobile transport repair — 2026-10-04

ELI5 / What Changed

An account reply without a result, or carrying an error envelope instead of account data, now leaves the phone's current balance alone. A current malformed account snapshot still retires that host's old money, and newer account removal, replacement, or client evidence still prevents delayed replies from bringing it back.

Why

The Accounts refresh reuses the existing validated RPC operation and preserves its direct request promise. Home and Accounts check result admission before accepting the read; their existing decoder still decides snapshot validity. This keeps missing transport results separate from actual newer account evidence without changing amounts, polling, credentials, host ownership, or the protocol. The stream inventory now names the extracted production subscriber and truthfully marks its mountable recording scenario as unwritten; the raw-request inventory shrinks rather than admitting a new requester.

Testing / Visual Proof

The actual three-file CI reproduction failed the same five assertions before repair. The unchanged transport/recording suite now passes 2,984 tests (six existing live-device/socket skips); the affected mobile feature cohort passes 171 tests, including the four original peer controls, nine earlier author retirement cases, seven unchanged later independent controls, and fourteen new invalid-result/error/ordering/compatibility cases. These cohorts overlap. Root and mobile app typechecks, the normal 925-file mobile test ratchet with 124 unchanged grandfathered files, changed-code quality, formatting, and ordinary commit hooks pass. No golden, existing assertion, timeout, skip, baseline, or max-lines rule was weakened.

No new app capture was required to restore this established no-effect contract: the exact recording and complete production Accounts React route provide causal synthetic proof. The existing media and their navigation/pairing/provider limits below remain historical evidence. Native pairing/navigation, real authentication/provider balances, platform execution, full repository/release gates, fresh hosted CI and independent source acceptance remain separate.

Review

Checked head 047012d5a0a41171e92eb16412e298c9d79dcb7d, tree bbbc1cb8645b44d1e8364788f0293e3c25cc9548, direct parent 697adc622328fc3eb2d997b201d3ebc693a83aac. This is a non-force descendant with the exact existing desktop stack base. The accepted 85-path composed feature grows to 90 paths; this does not claim a fresh review of the older public 213-path stacked diff. This author repair remains OPEN/DRAFT and requires coordinator-owned independent review and release acceptance.

The complete freshly captured publication record follows unchanged, including the generated LoC block, contributor credit, media, previous checks, incident disclosure, and limitations.

	Files	Added	Deleted	Net
Test	109	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​7017	$\color{#cf222e}{\Huge{\mathbf{−}}}$​583	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​6434
Prod	111	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​3397	$\color{#cf222e}{\Huge{\mathbf{−}}}$​710	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​2687

Current account evidence repair

On this repair head, a delayed account-list reply no longer brings back DeepSeek money after the same connected host has pushed account removal, replacement, or an invalid snapshot. A malformed successful Home list now clears only that host's account evidence; ordinary request failures retain its last-good data and other hosts remain intact.

Home and Accounts now share a small host/client evidence revision and request acceptance order across their existing subscriptions and reads. Each new push retires older pending reads, and overlapping current reads accept the newest completed request without blocking a later valid refresh. Home retains its existing single-flight follow-up sharing, while Accounts' existing refresh callback moves into a named hook to stay within the file-length limit. This extends the account ownership machinery without a money cache, new polling, or protocol change.

The four unchanged independent controls reproduced three failures and one pass before the repair, then all four passed. The complete mobile cohort passes 150 tests (the existing 137 plus four peer controls and nine added boundary cases); the backend cohort passes 134 tests, including its unchanged real timeout. Root and mobile app typechecks, the normal mobile test ratchet (124 unchanged grandfathered files), changed-code quality, formatting, and normal commit hooks pass. Replacement/malformed pushes, overlapping reads in both completion orders, fresh recovery, other-host preservation, legacy clients, generation/disposal fences and listener cleanup are covered by the current and retained controls.

Current head: 697adc622328fc3eb2d997b201d3ebc693a83aac; tree: a6d39a90d6ed6203568a669c24df40782917e971; direct parent: b43168d3de0fa8f38b8631b81723d2fd8b6ceadc. This is an ordinary descendant preserving the complete earlier feature, desktop stack, contributor credit, and integration history. Fresh CI remains pending and ROOT must obtain fresh independent source review; the source author cannot clear this repair.

The six images and earlier web build below remain historical synthetic rendering evidence. They do not exercise pending-list ordering, native navigation, pairing, authentication, or a live provider; this source repair required no new app launch and makes no new rendered ordering claim. The original publication record is preserved below, including its earlier head and test/build results.

Preserved original feature publication record

ELI5

Mobile Home and Accounts show the DeepSeek prepaid money reported by the selected host, preserving every currency and decimal digit. Balances disappear when their host connection or account evidence is retired.

What Changed

Before, mobile did not display DeepSeek money, and cached account data or a late response could outlive a host switch or reconnect. Home now shows exact CNY/USD totals; Accounts shows total, granted, and topped-up amounts, with loading, unavailable, insufficient-balance, and failed-refresh messages. Claude/Codex percentage usage and reset-credit actions remain separate.

The original feature now includes desktop #24783 at bfbc795e77850438bf9e93ab35ead403b1665035 and main at 8c617301f71b42e133f9e5fa44451d63e651dfc6 through ordinary additive merges. Accounts resets its screen state by host/client/connection generation; Home retires account subscriptions and late reads, and strips monetary fields from persisted snapshots until fresh host evidence arrives. The existing desktop balance decoder, account services, optional snapshot fields, and mobile components remain the source of amounts. No new credential access, polling, or remote protocol field is added.

Why

The execution host owns authentication and balance polling. Reusing its account snapshots preserves host/account ownership, exact strings, mixed-version compatibility, and SSH/WSL authority without a separate money service or invented quota. Clearing unverified cached money is safer than presenting it as the current account's balance.

Credit remains with @innocarpe / Wooseong Kim's desktop proposal #12873 and mobile proposal #23294, including the original contributor credit in inherited commits.

Linked Issue

Fixes #12869 (mobile parity, stacked on desktop/API #24783).

Visual Proof

New screenshots attached below show the complete production Home screen and production Accounts route in a hidden Electron renderer built from PRIMARY. Balances and host/account metadata are synthetic. The fixture supplies a previously acquired host and notification-consent choice; Home is registered in a fixture host route and Accounts is opened separately through shell initialization. This proves rendered monetary states, not the native Home-to-Accounts navigation gesture, pairing, live authentication, or a real paired device.

The legacy-host screenshot is the before comparison; supported Home, reconnected Accounts, unavailable Home/Accounts, and disconnected Accounts are the after/error comparisons. Twelve state checks passed with no uncaught page errors or component fault reports. The reconnected Accounts capture is the stable full-detail image; the earlier initial-Accounts capture caught a route transition and is not attached.

Testing

• Inspected synthetic rendered behavior on macOS at 390 × 844 through Playwright CDP in a hidden, task-owned Electron renderer.
• Added tests for A→B→A ownership, retired streams and responses, reconnect/generation cutovers, cached money, and malformed/legacy data.
• Mobile behavior: 109 tests in 18 files; additional capability/reset-credit contracts: 28 tests in six files. Original caller assertions remain intact.
• DeepSeek credentials/RPC/fetcher/loopback/desktop scope/account routes: 60 tests in seven files, including the real timeout duration. Broader refresh, account-target, proxy guard, mobile allowlist, Overview, and status checks: 74 tests in ten files.
• Full root pnpm tc, mobile app typecheck, normal mobile test-typecheck ratchet, changed-code quality, formatting/normal commit hooks, and shipped mobile web build/verification pass. The ratchet retains 124 existing grandfathered test files; no new exception was added. A supplemental all-test-source typecheck remains outside that normal gate and has inherited failures.
• Fresh checked head: b43168d3de0fa8f38b8631b81723d2fd8b6ceadc. Hosted CI must assess this head; older green runs do not establish acceptance.

Review

This remains an owned draft stacked on nwparker/deepseek-balance-accounts-1002. Independent source review and full merge-risk acceptance remain with the coordinator. No ready/approval/merge action is requested.

Agent skill upstream boundary

• Not applicable; no upstream skill implementation is copied.

Notes

Native iOS/Android, real pairing/keyring acceptance, Windows/Linux, and live native/WSL/SSH providers were not exercised. Visible-window/native-focus tests remain for CI or an isolated display. The first hidden development launch used isolated userdata but retained the shared home and logged a Codex trust/hook write; it was stopped and disclosed, with no blind restoration. Accepted rendered proof used the existing E2E home/userdata isolation seam, mock keychain, ORCA_DISABLE_CODEX_TRUST_RPC=1, and ORCA_BACKGROUND_LAUNCH=1; task-owned processes were stopped afterward.

Checklist

• Explained before/after, mechanism, and approach
• Synthetic before/after and error-state screenshots attached
• Self-reviewed for correctness, ownership, and cleanup
• Cross-platform, folder workspace, SSH/WSL, and older-host behavior considered
• Full repository lint/full suite/native builds and fresh hosted CI remain for CI

Journal CI correction — 2026-10-04

The hosted run at 047012d5a0a41171e92eb16412e298c9d79dcb7d had one recovery-lock baseline mismatch; Verify failed as its dependent aggregate. The independently accepted two-test-path correction is now published at 87fb122d73c88212e01bf762b655d774abe61726: the test settles attach's capsule work before its directory baseline, and a real-lock control checks durable DB/WAL/recovery bytes, journal and session-record SQL rows, and an unrelated chat's recovery offer through corrupt-send refusal and mock-adapter Stop. Production code and all 90 existing feature blobs are unchanged from parent 047; named 8c617301 defines that feature-path inventory, not literal feature-byte equality with the baseline.

The author's 195-case cohort and independent 98-case/six-file cohort overlap and must not be summed; independent actual-lock causal red/green, node typecheck and two-file quality passed. New-head hosted CI remains pending/unverified. The control does not check every SQLite file's bytes or prove real-provider process Stop, native Home-to-Accounts navigation, platform/SSH/paired acceptance, or release readiness; prior incident disclosures and all existing limitations remain in effect. Increment risk is Low; full mobile PR risk remains High pending fresh CI and the prior acceptance gaps.