fix(mobile): preserve push registration across authentication refresh #197

Current status (2026-10-16)

Completed within this ticket's written implementation and automated-test boundary. Checked criteria below refer to that boundary, not full physical-device acceptance. Refresh preserves registration while rotation, captured-context uploads, revocation and stale-account completion remain fenced by Server/native tests.

Evidence: implementation merged in #206; acceptance checkpoint merged in #218. Candidate Server CI passed 90 mobile-push integration and 95 mobile-router tests. iOS CI passed 473 tests, zero skipped, including all three actual Rust ciphertext consumers. The unchanged Worker has 73 workerd plus one native ingress test; unchanged bilingual guidance has passing documentation CI. Local zh-Hans verification passed 64/64 and all six native redirect-boundary checks passed. Earlier-SHA Worker/docs results are reused evidence, not a fresh candidate-wide run.

The dedicated ServerBee Worker is deployed. One authorized real APNs sandbox test reached a dedicated Simulator: registration revision 2, persisted Server receipt accepted/Accepted, NSE-decrypted background presentation, and opening the existing notification from a terminated app into Settings. No simctl push injection was used. The system required side-swipe to open; earlier failed harness attempts remain recorded. Initial enqueue and raw APNs HTTP responses were not separately captured; the Server receipt reports the Relay/APNs verdict and still correctly says presentation=unobserved. The dedicated session was revoked and confirmed absent. This is not physical-device or production evidence.

Remaining live acceptance is retained in #205 and #196: Physical login/refresh/logout behavior and signed-upgrade continuity. Closing this implementation ticket does not close or waive those gates.

Dated checkpoints below are historical. This status supersedes earlier statements that the Worker is undeployed or that all live APNs checks are unrun; production and physical-device gates remain pending.

Parent

#196

What to build

A signed-in iOS user keeps the current installation's notification registration across ordinary authentication refresh, while logout and credential revocation continue to terminate eligibility. Establish this behavior before expanding registration for the relay.

Acceptance criteria

• Drive mobile login, push registration, refresh, and logout through the real Server HTTP stack; refresh retains and atomically rebinds the same user's installation registration, with no relaunch required.
• Old credentials remain invalid after rotation; failed or concurrent refresh cannot revive a revoked registration or transfer ownership between users.
• iOS registration uploads use captured deployment/account context; a completion arriving after logout or account change cannot register against the replacement login.
• Registration ownership, device revocation, password changes, user deletion, and mobile-session expiry retain their security guarantees.
• Existing mobile-auth and cross-user push tests remain green; add behavior coverage for preserved registration and stale-upload/logout ordering. No Relay, encryption, or event-category expansion is required in this ticket.

Blocked by

None (can start immediately).