From 35e696f0b997d6d14363e405ebc125dc71c5f6e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Igor=20=C5=A0=C4=87eki=C4=87?=
 <4062236+iscekic@users.noreply.github.com>
Date: Mon, 19 Oct 2026 09:42:33 +0000
Subject: [PATCH 1/9] fix(mobile): keep the login email across rotation and
 show code-step feedback

The login screen now writes the module-level drafts back to SecureStore when
it unmounts, so a rotation that recreates the activity restores the typed
email instead of blanking the field.

Email-code verification returns a result object instead of toasting: a wrong,
spent, or contested code renders its localized message inline above the
verify button, cleared by editing the code, resending, going back, or
requesting a new code.
---
 .../src/components/login-screen.test.ts       |  19 +++-
 apps/mobile/src/components/login-screen.tsx   |  12 +++
 .../idle-auth-email-flow.mounted.test.tsx     | 102 ++++++++++++++++++
 .../src/components/login/email-otp-form.tsx   |  16 ++-
 .../src/components/login/email-otp-state.ts   |   7 +-
 .../mobile/src/components/login/idle-auth.tsx |  16 ++-
 .../src/lib/auth/use-native-auth.test.ts      |   5 +-
 apps/mobile/src/lib/auth/use-native-auth.ts   |  31 +++---
 8 files changed, 183 insertions(+), 25 deletions(-)

diff --git a/apps/mobile/src/components/login-screen.test.ts b/apps/mobile/src/components/login-screen.test.ts
index 40572713369..c0d92508391 100644
--- a/apps/mobile/src/components/login-screen.test.ts
+++ b/apps/mobile/src/components/login-screen.test.ts
@@ -95,7 +95,7 @@ vi.mock('@/lib/hooks/use-theme-colors', () => ({
 vi.mock('@/lib/login-draft', () => ({
   clearLoginDrafts: vi.fn(),
   clearPersistedLoginDrafts: vi.fn(),
-  persistLoginDrafts: vi.fn(),
+  persistLoginDrafts: vi.fn().mockResolvedValue(undefined),
   restoreLoginDrafts: vi.fn().mockResolvedValue(null),
 }));
 vi.mock('@/lib/picker-bridge', () => ({
@@ -512,6 +512,7 @@ describe('login-screen idle skeleton', () => {
     deviceAuth.resumed = false;
     vi.mocked(restoreLoginDrafts).mockResolvedValue({ email: '', ssoRecovery: null });
     vi.mocked(clearPersistedLoginDrafts).mockClear();
+    vi.mocked(persistLoginDrafts).mockClear();
   });
 
   it('shows a form skeleton until the draft restore finishes', async () => {
@@ -563,6 +564,22 @@ describe('login-screen idle skeleton', () => {
 
     renderer.unmount();
   });
+
+  it('persists the drafts when the screen unmounts so a rotation remount restores them', async () => {
+    const renderer = await mountLoginScreen();
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+    expect(persistLoginDrafts).not.toHaveBeenCalled();
+
+    renderer.unmount();
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(persistLoginDrafts).toHaveBeenCalledTimes(1);
+  });
 });
 
 describe('login-screen approved wait surface', () => {
diff --git a/apps/mobile/src/components/login-screen.tsx b/apps/mobile/src/components/login-screen.tsx
index ac5c0386874..d317608de07 100644
--- a/apps/mobile/src/components/login-screen.tsx
+++ b/apps/mobile/src/components/login-screen.tsx
@@ -90,6 +90,18 @@ export function LoginScreen() {
     void restoreDrafts();
     return () => {
       cancelled = true;
+      // Write the module-level drafts back before this mount's state dies, so
+      // the next mount restores what the user had typed — a device rotation
+      // that recreates the activity must not blank the email field. A failed
+      // write leaves the field empty on the next mount; the restore path
+      // already tolerates missing drafts.
+      void (async () => {
+        try {
+          await persistLoginDrafts();
+        } catch {
+          // Swallow: nothing to show on an unmounting screen.
+        }
+      })();
     };
   }, []);
 
diff --git a/apps/mobile/src/components/login/__tests__/idle-auth-email-flow.mounted.test.tsx b/apps/mobile/src/components/login/__tests__/idle-auth-email-flow.mounted.test.tsx
index b6568a5df69..50ad5417f56 100644
--- a/apps/mobile/src/components/login/__tests__/idle-auth-email-flow.mounted.test.tsx
+++ b/apps/mobile/src/components/login/__tests__/idle-auth-email-flow.mounted.test.tsx
@@ -323,4 +323,106 @@ describe('IdleAuth email sign-in flow (real useNativeAuth)', () => {
       renderer.unmount();
     });
   });
+
+  it('renders a wrong-code refusal inline on the code step and clears it on edit', async () => {
+    mockPostAuth.mockResolvedValue({
+      ok: true,
+      data: { success: true, challengeId: 'c0000000-0000-4000-8000-000000000001' },
+    });
+
+    const renderer = await mountIdleAuth();
+
+    const field = findAll(renderer.root, 'FormField')[0];
+    if (!field) {
+      throw new Error('FormField not found');
+    }
+    act(() => {
+      (field.props.onChangeText as (value: string) => void)('wrong@example.com');
+    });
+
+    await act(async () => {
+      (continueButton(renderer.root).props.onPress as () => void)();
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    const otpForm = findAll(renderer.root, 'EmailOtpForm')[0];
+    if (!otpForm) {
+      throw new Error('EmailOtpForm not found');
+    }
+    expect(otpForm.props.error).toBeUndefined();
+
+    mockPostAuth.mockResolvedValue({
+      ok: false,
+      errorCode: 'INVALID_CODE',
+      ssoOrganizationId: undefined,
+    });
+    await act(async () => {
+      (otpForm.props.onVerify as (code: string) => void)('000000');
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect(findAll(renderer.root, 'EmailOtpForm')[0]?.props.error).toBe(
+      'That code is incorrect. Please try again.'
+    );
+
+    // Editing the code retires the refusal message.
+    act(() => {
+      (otpForm.props.onCodeChange as () => void)();
+    });
+    expect(findAll(renderer.root, 'EmailOtpForm')[0]?.props.error).toBeUndefined();
+
+    act(() => {
+      renderer.unmount();
+    });
+  });
+
+  it('signs in when the correct code verifies and stays silent on success', async () => {
+    mockPostAuth.mockResolvedValue({
+      ok: true,
+      data: { success: true, challengeId: 'c0000000-0000-4000-8000-000000000001' },
+    });
+
+    const renderer = await mountIdleAuth();
+
+    const field = findAll(renderer.root, 'FormField')[0];
+    if (!field) {
+      throw new Error('FormField not found');
+    }
+    act(() => {
+      (field.props.onChangeText as (value: string) => void)('correct@example.com');
+    });
+
+    await act(async () => {
+      (continueButton(renderer.root).props.onPress as () => void)();
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    const otpForm = findAll(renderer.root, 'EmailOtpForm')[0];
+    if (!otpForm) {
+      throw new Error('EmailOtpForm not found');
+    }
+
+    mockPostAuth.mockResolvedValue({
+      ok: true,
+      data: { token: 'at', refreshToken: 'rt', expiresIn: 3600 },
+    });
+    await act(async () => {
+      (otpForm.props.onVerify as (code: string) => void)('123456');
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect(findAll(renderer.root, 'EmailOtpForm')[0]?.props.error).toBeUndefined();
+
+    act(() => {
+      renderer.unmount();
+    });
+  });
 });
diff --git a/apps/mobile/src/components/login/email-otp-form.tsx b/apps/mobile/src/components/login/email-otp-form.tsx
index b9a27299154..a1876928d2e 100644
--- a/apps/mobile/src/components/login/email-otp-form.tsx
+++ b/apps/mobile/src/components/login/email-otp-form.tsx
@@ -6,7 +6,7 @@ import { Button } from '@/components/ui/button';
 import { formFieldA11y } from '@/components/ui/form-field-a11y';
 import { Input } from '@/components/ui/input';
 import { Text } from '@/components/ui/text';
-import { type useNativeAuth } from '@/lib/auth/use-native-auth';
+import { type BusyAction } from '@/lib/auth/use-native-auth';
 import { useThemeColors } from '@/lib/hooks/use-theme-colors';
 import { canSubmitEmailCode } from './email-otp-state';
 
@@ -35,13 +35,19 @@ function formatCodeDestination(message: string, email: string): string {
 export function EmailOtpForm({
   email,
   busy,
+  error,
   onVerify,
+  onCodeChange,
   onResend,
   onBack,
 }: Readonly<{
   email: string;
-  busy: ReturnType<typeof useNativeAuth>['busy'];
+  busy: BusyAction;
+  /** A verify refusal in the active language, rendered above the verify button. */
+  error?: string;
   onVerify: (code: string) => void;
+  /** Fires on every code-input change so the caller can retire a stale refusal message. */
+  onCodeChange?: () => void;
   onResend: () => void;
   onBack: () => void;
 }>) {
@@ -83,9 +89,15 @@ export function EmailOtpForm({
         onChangeText={value => {
           codeRef.current = value;
           setHasCompleteCode(/^\d{6}$/.test(value));
+          onCodeChange?.();
         }}
         accessibilityLabel={formFieldA11y({ label: t('login.signInCodeField'), required: true })}
       />
+      {error ? (
+        <Text className="text-center text-sm text-destructive" accessibilityLiveRegion="polite">
+          {error}
+        </Text>
+      ) : null}
       <Button
         size="lg"
         className="flex-row gap-2"
diff --git a/apps/mobile/src/components/login/email-otp-state.ts b/apps/mobile/src/components/login/email-otp-state.ts
index 4155e310530..7b4cdf8b8ca 100644
--- a/apps/mobile/src/components/login/email-otp-state.ts
+++ b/apps/mobile/src/components/login/email-otp-state.ts
@@ -1,8 +1,5 @@
-import { type useNativeAuth } from '@/lib/auth/use-native-auth';
+import { type BusyAction } from '@/lib/auth/use-native-auth';
 
-export function canSubmitEmailCode(
-  code: string,
-  busy?: ReturnType<typeof useNativeAuth>['busy']
-): boolean {
+export function canSubmitEmailCode(code: string, busy?: BusyAction): boolean {
   return busy === undefined && /^\d{6}$/.test(code);
 }
diff --git a/apps/mobile/src/components/login/idle-auth.tsx b/apps/mobile/src/components/login/idle-auth.tsx
index 724f0f51d18..688c3cebbb1 100644
--- a/apps/mobile/src/components/login/idle-auth.tsx
+++ b/apps/mobile/src/components/login/idle-auth.tsx
@@ -66,6 +66,7 @@ export function IdleAuth({
   const { t } = useTranslation();
   const colors = useThemeColors();
   const [view, setView] = useState<'main' | 'otp'>('main');
+  const [verifyError, setVerifyError] = useState<string | undefined>(undefined);
   const [appleAvailable, setAppleAvailable] = useState(false);
   const [browserAuthStarting, setBrowserAuthStarting] = useState(false);
   const emailRef = useRef(initialEmail);
@@ -133,6 +134,7 @@ export function IdleAuth({
     // reports a rejected address (`INVALID_REQUEST` / `INVALID_EMAIL`).
     const ok = await requestEmailCode(emailRef.current);
     if (ok) {
+      setVerifyError(undefined);
       setView('otp');
     }
   };
@@ -186,10 +188,21 @@ export function IdleAuth({
       <EmailOtpForm
         email={emailRef.current.trim().toLowerCase()}
         busy={busy}
+        error={verifyError}
         onVerify={code => {
-          void verifyEmailCode(emailRef.current, code);
+          void (async () => {
+            const outcome = await verifyEmailCode(emailRef.current, code);
+            if (!outcome.ok) {
+              setVerifyError(outcome.message);
+            }
+          })();
+        }}
+        onCodeChange={() => {
+          // Editing the code retires the refusal message above the field.
+          setVerifyError(undefined);
         }}
         onResend={() => {
+          setVerifyError(undefined);
           void (async () => {
             const ok = await requestEmailCode(emailRef.current);
             if (ok) {
@@ -198,6 +211,7 @@ export function IdleAuth({
           })();
         }}
         onBack={() => {
+          setVerifyError(undefined);
           setView('main');
         }}
       />
diff --git a/apps/mobile/src/lib/auth/use-native-auth.test.ts b/apps/mobile/src/lib/auth/use-native-auth.test.ts
index caa18c6a829..95e88287d17 100644
--- a/apps/mobile/src/lib/auth/use-native-auth.test.ts
+++ b/apps/mobile/src/lib/auth/use-native-auth.test.ts
@@ -646,10 +646,11 @@ describe('useNativeAuth signup step-up', () => {
       const resultRef = await mountNativeAuth();
 
       await act(async () => {
-        expect(await resultRef.current?.verifyEmailCode('user@example.com', '123456')).toBe(false);
+        const outcome = await resultRef.current?.verifyEmailCode('user@example.com', '123456');
+        expect(outcome).toEqual({ ok: false, message: i18n.t(key) });
       });
 
-      expect(toast.error).toHaveBeenCalledWith(i18n.t(key));
+      expect(toast.error).not.toHaveBeenCalled();
       expect(authMock.signIn).not.toHaveBeenCalled();
     }
   );
diff --git a/apps/mobile/src/lib/auth/use-native-auth.ts b/apps/mobile/src/lib/auth/use-native-auth.ts
index 6e0f01b8eb1..78dc8658658 100644
--- a/apps/mobile/src/lib/auth/use-native-auth.ts
+++ b/apps/mobile/src/lib/auth/use-native-auth.ts
@@ -65,7 +65,10 @@ async function tokenRefusalMessage(
   return signupStepUpMessage(result.signupMethods, { apple, google: googleConfigured });
 }
 
-type BusyAction = 'apple' | 'google' | 'passkey' | 'otp-send' | 'otp-verify' | undefined;
+export type BusyAction = 'apple' | 'google' | 'passkey' | 'otp-send' | 'otp-verify' | undefined;
+
+/** Outcome of an email-code verification attempt: a token, or an inline refusal message. */
+export type EmailCodeVerifyResult = { ok: true } | { ok: false; message: string };
 
 type NativeAuthResult = {
   busy: BusyAction;
@@ -76,7 +79,7 @@ type NativeAuthResult = {
   signInWithGoogle: () => Promise<void>;
   signInWithPasskey: () => Promise<void>;
   requestEmailCode: (email: string) => Promise<boolean>;
-  verifyEmailCode: (email: string, code: string) => Promise<boolean>;
+  verifyEmailCode: (email: string, code: string) => Promise<EmailCodeVerifyResult>;
   ssoRecovery: SsoRecovery | null;
   clearSsoRecovery: () => void;
   handleSsoError: (email: string, ssoOrganizationId: string | undefined) => void;
@@ -348,11 +351,10 @@ export function useNativeAuth(): NativeAuthResult {
   );
 
   const verifyEmailCode = useCallback(
-    async (rawEmail: string, code: string) => {
+    async (rawEmail: string, code: string): Promise<EmailCodeVerifyResult> => {
       const email = rawEmail.trim().toLowerCase();
       if (!startAction('otp-verify')) {
-        toast.error(i18n.t('login.couldNotCompleteSignIn'));
-        return false;
+        return { ok: false, message: i18n.t('login.couldNotCompleteSignIn') };
       }
       try {
         // Only send a challengeId when the email matches. A mismatched
@@ -363,7 +365,7 @@ export function useNativeAuth(): NativeAuthResult {
         try {
           admissionBody = await resolveAdmission();
         } catch {
-          return false;
+          return { ok: false, message: i18n.t('authErrors.retryableAdmission') };
         }
 
         const result = await postAuth('/api/auth/native/token', {
@@ -377,15 +379,17 @@ export function useNativeAuth(): NativeAuthResult {
         if (!result.ok) {
           if (result.errorCode === 'SSO_ERROR') {
             handleSsoError(email, result.ssoOrganizationId);
-          } else {
-            toast.error(await tokenRefusalMessage(result, googleConfigured));
           }
-          return false;
+          // Every other refusal surfaces inline on the code step: the form owns
+          // the message slot, so a wrong, spent, or contested code reads in the
+          // active language right where the input is. A toast here was the
+          // reported dead end — the screen kept its silence while the toast
+          // could land behind the keyboard or expire unnoticed.
+          return { ok: false, message: await tokenRefusalMessage(result, googleConfigured) };
         }
         const parsed = parseTokenPair(result.data);
         if (!parsed) {
-          toast.error(defaultErrorMessage());
-          return false;
+          return { ok: false, message: defaultErrorMessage() };
         }
         await signIn(
           parsed.token,
@@ -395,12 +399,11 @@ export function useNativeAuth(): NativeAuthResult {
         if (parsed.created === true) {
           announcingToast.success(i18n.t('login.accountCreated'));
         }
-        return true;
+        return { ok: true };
       } catch (error) {
         // eslint-disable-next-line no-console -- surface swallowed auth errors to Sentry
         console.error('[native-auth] verifyEmailCode signIn failed:', error);
-        toast.error(defaultErrorMessage());
-        return false;
+        return { ok: false, message: defaultErrorMessage() };
       } finally {
         finishAction('otp-verify');
       }

From 4f65ba19df6c40e2187d1a62b89d2cb635f89946 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Igor=20=C5=A0=C4=87eki=C4=87?=
 <4062236+iscekic@users.noreply.github.com>
Date: Mon, 19 Oct 2026 10:12:56 +0000
Subject: [PATCH 2/9] fix(mobile): keep EmailCodeVerifyResult internal

The verify result type is only used inside the hook; knip flags the export.
---
 apps/mobile/src/lib/auth/use-native-auth.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/mobile/src/lib/auth/use-native-auth.ts b/apps/mobile/src/lib/auth/use-native-auth.ts
index 78dc8658658..4b92868eef3 100644
--- a/apps/mobile/src/lib/auth/use-native-auth.ts
+++ b/apps/mobile/src/lib/auth/use-native-auth.ts
@@ -68,7 +68,7 @@ async function tokenRefusalMessage(
 export type BusyAction = 'apple' | 'google' | 'passkey' | 'otp-send' | 'otp-verify' | undefined;
 
 /** Outcome of an email-code verification attempt: a token, or an inline refusal message. */
-export type EmailCodeVerifyResult = { ok: true } | { ok: false; message: string };
+type EmailCodeVerifyResult = { ok: true } | { ok: false; message: string };
 
 type NativeAuthResult = {
   busy: BusyAction;

From cf5a58740df73d9e17d6bda24c7041f94a9bc9fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Igor=20=C5=A0=C4=87eki=C4=87?=
 <4062236+iscekic@users.noreply.github.com>
Date: Mon, 19 Oct 2026 12:41:52 +0000
Subject: [PATCH 3/9] fix(mobile): retire stale login-state feedback after the
 user moves on

Two review fixes:

- A verify refusal that settles after the user edited the code, resent, or
  went back no longer re-appears: each user step bumps an attempt counter and
  only the attempt it belongs to may write its message.
- The unmount draft persistence stays off once the mount completed a sign-in,
  so a typed email from an abandoned attempt cannot survive into the next
  login.
---
 .../src/components/login-screen.test.ts       | 19 ++++++
 apps/mobile/src/components/login-screen.tsx   | 17 +++++-
 .../idle-auth-email-flow.mounted.test.tsx     | 61 +++++++++++++++++++
 .../mobile/src/components/login/idle-auth.tsx | 16 ++++-
 4 files changed, 109 insertions(+), 4 deletions(-)

diff --git a/apps/mobile/src/components/login-screen.test.ts b/apps/mobile/src/components/login-screen.test.ts
index c0d92508391..aa2fe451efa 100644
--- a/apps/mobile/src/components/login-screen.test.ts
+++ b/apps/mobile/src/components/login-screen.test.ts
@@ -580,6 +580,25 @@ describe('login-screen idle skeleton', () => {
 
     expect(persistLoginDrafts).toHaveBeenCalledTimes(1);
   });
+
+  it('skips unmount persistence once the mount completed a sign-in', async () => {
+    deviceAuth.status = 'approved';
+    deviceAuth.token = 'tok';
+
+    const renderer = await mountLoginScreen();
+
+    await act(async () => {
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    renderer.unmount();
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(persistLoginDrafts).not.toHaveBeenCalled();
+  });
 });
 
 describe('login-screen approved wait surface', () => {
diff --git a/apps/mobile/src/components/login-screen.tsx b/apps/mobile/src/components/login-screen.tsx
index d317608de07..b1d81275fdb 100644
--- a/apps/mobile/src/components/login-screen.tsx
+++ b/apps/mobile/src/components/login-screen.tsx
@@ -2,7 +2,7 @@
 import * as Clipboard from 'expo-clipboard';
 import { type Href, useRouter } from 'expo-router';
 import { Globe } from '@/components/ui/icons';
-import { useCallback, useEffect, useState } from 'react';
+import { useCallback, useEffect, useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { I18nManager, Pressable, ScrollView, View } from 'react-native';
 import { useKeyboardState } from 'react-native-keyboard-controller';
@@ -59,12 +59,21 @@ export function LoginScreen() {
     ssoRecovery: SsoRecoveryDraft | null;
   } | null>(null);
 
+  // Set once this mount completes a sign-in: the unmount persistence then
+  // stays off, because the signed-in session owns the screen and a typed
+  // email from the abandoned attempt must not survive into the next login.
+  const signedInRef = useRef(false);
+
   const persistToken = useCallback(
     async (tokenValue: string, refreshTokenValue?: string, expiresInValue?: number) => {
       setPersistError(undefined);
       try {
         await signIn(tokenValue, refreshTokenValue, expiresInValue);
         clearLoginDrafts();
+        // Signed in: the session took over, so the unmount persistence must
+        // not write a typed email from this attempt into SecureStore after
+        // the drafts were cleared above.
+        signedInRef.current = true;
       } catch {
         setPersistError(t('login.couldNotCompleteSignIn'));
       }
@@ -94,7 +103,11 @@ export function LoginScreen() {
       // the next mount restores what the user had typed — a device rotation
       // that recreates the activity must not blank the email field. A failed
       // write leaves the field empty on the next mount; the restore path
-      // already tolerates missing drafts.
+      // already tolerates missing drafts. After a completed sign-in the
+      // drafts were cleared on purpose, so persistence stays off.
+      if (signedInRef.current) {
+        return;
+      }
       void (async () => {
         try {
           await persistLoginDrafts();
diff --git a/apps/mobile/src/components/login/__tests__/idle-auth-email-flow.mounted.test.tsx b/apps/mobile/src/components/login/__tests__/idle-auth-email-flow.mounted.test.tsx
index 50ad5417f56..0ffe59d591a 100644
--- a/apps/mobile/src/components/login/__tests__/idle-auth-email-flow.mounted.test.tsx
+++ b/apps/mobile/src/components/login/__tests__/idle-auth-email-flow.mounted.test.tsx
@@ -324,6 +324,67 @@ describe('IdleAuth email sign-in flow (real useNativeAuth)', () => {
     });
   });
 
+  it('drops a refusal that settles after the user edited the code', async () => {
+    mockPostAuth.mockResolvedValue({
+      ok: true,
+      data: { success: true, challengeId: 'c0000000-0000-4000-8000-000000000001' },
+    });
+
+    const renderer = await mountIdleAuth();
+
+    const field = findAll(renderer.root, 'FormField')[0];
+    if (!field) {
+      throw new Error('FormField not found');
+    }
+    act(() => {
+      (field.props.onChangeText as (value: string) => void)('late@example.com');
+    });
+
+    await act(async () => {
+      (continueButton(renderer.root).props.onPress as () => void)();
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    const otpForm = findAll(renderer.root, 'EmailOtpForm')[0];
+    if (!otpForm) {
+      throw new Error('EmailOtpForm not found');
+    }
+
+    // The refusal resolves only after the user has edited the code.
+    const verifyGate = Promise.withResolvers<unknown>();
+    mockPostAuth.mockReturnValue(verifyGate.promise as never);
+
+    await act(async () => {
+      (otpForm.props.onVerify as (code: string) => void)('000000');
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    // The user edits the code while the attempt is in flight.
+    act(() => {
+      (otpForm.props.onCodeChange as () => void)();
+    });
+
+    await act(async () => {
+      verifyGate.resolve({
+        ok: false,
+        errorCode: 'INVALID_CODE',
+        ssoOrganizationId: undefined,
+      });
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect(findAll(renderer.root, 'EmailOtpForm')[0]?.props.error).toBeUndefined();
+
+    act(() => {
+      renderer.unmount();
+    });
+  });
+
   it('renders a wrong-code refusal inline on the code step and clears it on edit', async () => {
     mockPostAuth.mockResolvedValue({
       ok: true,
diff --git a/apps/mobile/src/components/login/idle-auth.tsx b/apps/mobile/src/components/login/idle-auth.tsx
index 688c3cebbb1..9e6ad02fbed 100644
--- a/apps/mobile/src/components/login/idle-auth.tsx
+++ b/apps/mobile/src/components/login/idle-auth.tsx
@@ -67,6 +67,9 @@ export function IdleAuth({
   const colors = useThemeColors();
   const [view, setView] = useState<'main' | 'otp'>('main');
   const [verifyError, setVerifyError] = useState<string | undefined>(undefined);
+  // Bumps on every user step that retires a refusal (edit, resend, back), so a
+  // slow refusal from an earlier attempt cannot re-appear after the user moved on.
+  const verifyAttemptRef = useRef(0);
   const [appleAvailable, setAppleAvailable] = useState(false);
   const [browserAuthStarting, setBrowserAuthStarting] = useState(false);
   const emailRef = useRef(initialEmail);
@@ -134,6 +137,7 @@ export function IdleAuth({
     // reports a rejected address (`INVALID_REQUEST` / `INVALID_EMAIL`).
     const ok = await requestEmailCode(emailRef.current);
     if (ok) {
+      verifyAttemptRef.current += 1;
       setVerifyError(undefined);
       setView('otp');
     }
@@ -190,18 +194,25 @@ export function IdleAuth({
         busy={busy}
         error={verifyError}
         onVerify={code => {
+          const attempt = verifyAttemptRef.current;
           void (async () => {
             const outcome = await verifyEmailCode(emailRef.current, code);
-            if (!outcome.ok) {
+            // A refusal may settle after the user has moved on — edited the
+            // code (clearing the message), requested a resend, or gone back.
+            // Only the attempt this refusal belongs to may write its message.
+            if (!outcome.ok && attempt === verifyAttemptRef.current) {
               setVerifyError(outcome.message);
             }
           })();
         }}
         onCodeChange={() => {
-          // Editing the code retires the refusal message above the field.
+          // Editing the code retires the refusal message above the field and
+          // disowns any verify attempt still in flight for the old code.
+          verifyAttemptRef.current += 1;
           setVerifyError(undefined);
         }}
         onResend={() => {
+          verifyAttemptRef.current += 1;
           setVerifyError(undefined);
           void (async () => {
             const ok = await requestEmailCode(emailRef.current);
@@ -211,6 +222,7 @@ export function IdleAuth({
           })();
         }}
         onBack={() => {
+          verifyAttemptRef.current += 1;
           setVerifyError(undefined);
           setView('main');
         }}

From 9a71711004996019b56d047b3feda615afa7ac58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Igor=20=C5=A0=C4=87eki=C4=87?=
 <4062236+iscekic@users.noreply.github.com>
Date: Tue, 20 Oct 2026 11:20:07 +0000
Subject: [PATCH 4/9] fix(mobile): retire login drafts for every provider
 sign-in

A completed sign-in previously only disarmed the unmount draft
persistence on the device-code path. Email-code, Apple, Google, and
passkey sign-ins publish their session token through the auth context
directly, so a typed address could survive into the next login mount
and pre-fill the previous account's field. The guard now watches the
published token, which every provider path sets.
---
 .../src/components/login-screen.test.ts       | 35 +++++++++++++++++--
 apps/mobile/src/components/login-screen.tsx   | 18 +++++++---
 2 files changed, 46 insertions(+), 7 deletions(-)

diff --git a/apps/mobile/src/components/login-screen.test.ts b/apps/mobile/src/components/login-screen.test.ts
index aa2fe451efa..3cb825517cf 100644
--- a/apps/mobile/src/components/login-screen.test.ts
+++ b/apps/mobile/src/components/login-screen.test.ts
@@ -39,7 +39,7 @@ const setLanguagePickerBridge = vi.hoisted(() => vi.fn());
 const announcingWarning = vi.hoisted(() => vi.fn());
 // `sessionEnded` is toggled per test to drive the login screen's announcement
 // effect without re-mocking the module.
-const authState = vi.hoisted(() => ({ sessionEnded: false }));
+const authState = vi.hoisted(() => ({ sessionEnded: false, token: undefined as string | undefined }));
 
 vi.mock('expo-router', () => ({
   useRouter: () => ({ push }),
@@ -71,7 +71,7 @@ vi.mock('@/lib/a11y/announcing-toast', () => ({
   announcingToast: { warning: announcingWarning },
 }));
 vi.mock('@/lib/auth/auth-context', () => ({
-  useAuth: () => ({ sessionEnded: authState.sessionEnded, signIn: vi.fn() }),
+  useAuth: () => ({ sessionEnded: authState.sessionEnded, signIn: vi.fn(), token: authState.token }),
 }));
 vi.mock('@/lib/auth/use-device-auth', () => ({
   useDeviceAuth: () => ({
@@ -322,6 +322,7 @@ describe('login-screen language globe', () => {
     deviceAuth.error = undefined;
     deviceAuth.verificationUrl = undefined;
     deviceAuth.resumed = false;
+    authState.token = undefined;
     push.mockClear();
     setLanguagePickerBridge.mockClear();
   });
@@ -510,6 +511,7 @@ describe('login-screen idle skeleton', () => {
     deviceAuth.error = undefined;
     deviceAuth.verificationUrl = undefined;
     deviceAuth.resumed = false;
+    authState.token = undefined;
     vi.mocked(restoreLoginDrafts).mockResolvedValue({ email: '', ssoRecovery: null });
     vi.mocked(clearPersistedLoginDrafts).mockClear();
     vi.mocked(persistLoginDrafts).mockClear();
@@ -584,6 +586,9 @@ describe('login-screen idle skeleton', () => {
   it('skips unmount persistence once the mount completed a sign-in', async () => {
     deviceAuth.status = 'approved';
     deviceAuth.token = 'tok';
+    // signIn's mock does not publish through the context; the completed
+    // sign-in publishes the token there, which is what retires the drafts.
+    authState.token = 'tok';
 
     const renderer = await mountLoginScreen();
 
@@ -599,6 +604,32 @@ describe('login-screen idle skeleton', () => {
 
     expect(persistLoginDrafts).not.toHaveBeenCalled();
   });
+
+  it('skips unmount persistence when a non-device sign-in published its token', async () => {
+    // Email-code, Apple, Google, and passkey sign-ins complete without the
+    // device-auth approved path: they publish the token through the auth
+    // context directly. The unmount persistence must stay off for them too,
+    // or the typed email would pre-fill the next login as the previous
+    // account's address.
+    const renderer = await mountLoginScreen();
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    authState.token = 'provider-token';
+    await act(async () => {
+      renderer.update(createElement(LoginScreen));
+      await Promise.resolve();
+    });
+
+    renderer.unmount();
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(persistLoginDrafts).not.toHaveBeenCalled();
+  });
 });
 
 describe('login-screen approved wait surface', () => {
diff --git a/apps/mobile/src/components/login-screen.tsx b/apps/mobile/src/components/login-screen.tsx
index b1d81275fdb..d2699ec7762 100644
--- a/apps/mobile/src/components/login-screen.tsx
+++ b/apps/mobile/src/components/login-screen.tsx
@@ -33,7 +33,7 @@ import { setLanguagePickerBridge } from '@/lib/picker-bridge';
 import { useScreenInsets } from '@/lib/screen-insets';
 
 export function LoginScreen() {
-  const { sessionEnded, signIn } = useAuth();
+  const { sessionEnded, signIn, token: publishedToken } = useAuth();
   const router = useRouter();
   const {
     status,
@@ -70,10 +70,6 @@ export function LoginScreen() {
       try {
         await signIn(tokenValue, refreshTokenValue, expiresInValue);
         clearLoginDrafts();
-        // Signed in: the session took over, so the unmount persistence must
-        // not write a typed email from this attempt into SecureStore after
-        // the drafts were cleared above.
-        signedInRef.current = true;
       } catch {
         setPersistError(t('login.couldNotCompleteSignIn'));
       }
@@ -81,6 +77,18 @@ export function LoginScreen() {
     [signIn, t]
   );
 
+  // Every provider's completed sign-in — device code, email code, Apple,
+  // Google, passkey — publishes its token through the auth context, so this
+  // one watch covers them all: the unmount persistence must not write a
+  // typed email from the abandoned attempt into SecureStore once a session
+  // took over, or the next login mount would pre-fill the previous account's
+  // address.
+  useEffect(() => {
+    if (publishedToken !== undefined) {
+      signedInRef.current = true;
+    }
+  }, [publishedToken]);
+
   useEffect(() => {
     let cancelled = false;
     const restoreDrafts = async () => {

From 81d7bb8697c4d6f38841e24f746ab4dd28462b84 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Igor=20=C5=A0=C4=87eki=C4=87?=
 <4062236+iscekic@users.noreply.github.com>
Date: Tue, 20 Oct 2026 11:22:12 +0000
Subject: [PATCH 5/9] style: format login screen test

---
 apps/mobile/src/components/login-screen.test.ts | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/apps/mobile/src/components/login-screen.test.ts b/apps/mobile/src/components/login-screen.test.ts
index 3cb825517cf..21033947d53 100644
--- a/apps/mobile/src/components/login-screen.test.ts
+++ b/apps/mobile/src/components/login-screen.test.ts
@@ -39,7 +39,10 @@ const setLanguagePickerBridge = vi.hoisted(() => vi.fn());
 const announcingWarning = vi.hoisted(() => vi.fn());
 // `sessionEnded` is toggled per test to drive the login screen's announcement
 // effect without re-mocking the module.
-const authState = vi.hoisted(() => ({ sessionEnded: false, token: undefined as string | undefined }));
+const authState = vi.hoisted(() => ({
+  sessionEnded: false,
+  token: undefined as string | undefined,
+}));
 
 vi.mock('expo-router', () => ({
   useRouter: () => ({ push }),
@@ -71,7 +74,11 @@ vi.mock('@/lib/a11y/announcing-toast', () => ({
   announcingToast: { warning: announcingWarning },
 }));
 vi.mock('@/lib/auth/auth-context', () => ({
-  useAuth: () => ({ sessionEnded: authState.sessionEnded, signIn: vi.fn(), token: authState.token }),
+  useAuth: () => ({
+    sessionEnded: authState.sessionEnded,
+    signIn: vi.fn(),
+    token: authState.token,
+  }),
 }));
 vi.mock('@/lib/auth/use-device-auth', () => ({
   useDeviceAuth: () => ({

From 14ef8feb926bf2fff8430cdc2bbd59b4620913f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Igor=20=C5=A0=C4=87eki=C4=87?=
 <4062236+iscekic@users.noreply.github.com>
Date: Tue, 20 Oct 2026 11:30:49 +0000
Subject: [PATCH 6/9] fix(mobile): drop module drafts on every published
 sign-in token

The token watch only suppressed the unmount write; the module email
draft stayed populated after an email-code, Apple, Google, or passkey
sign-in, so a later sign-out plus rotation or language reload could
persist the previous account's address again. The watch now clears the
drafts itself, which also makes it the single draft-clearing point for
all provider paths.
---
 apps/mobile/src/components/login-screen.tsx | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/apps/mobile/src/components/login-screen.tsx b/apps/mobile/src/components/login-screen.tsx
index d2699ec7762..9e3f14e3002 100644
--- a/apps/mobile/src/components/login-screen.tsx
+++ b/apps/mobile/src/components/login-screen.tsx
@@ -69,7 +69,6 @@ export function LoginScreen() {
       setPersistError(undefined);
       try {
         await signIn(tokenValue, refreshTokenValue, expiresInValue);
-        clearLoginDrafts();
       } catch {
         setPersistError(t('login.couldNotCompleteSignIn'));
       }
@@ -79,12 +78,13 @@ export function LoginScreen() {
 
   // Every provider's completed sign-in — device code, email code, Apple,
   // Google, passkey — publishes its token through the auth context, so this
-  // one watch covers them all: the unmount persistence must not write a
-  // typed email from the abandoned attempt into SecureStore once a session
-  // took over, or the next login mount would pre-fill the previous account's
-  // address.
+  // one watch covers them all: the module drafts are dropped (a later
+  // sign-out must not re-persist the previous account's address) and the
+  // unmount persistence stays off, or the next login mount would pre-fill
+  // the previous account's address.
   useEffect(() => {
     if (publishedToken !== undefined) {
+      clearLoginDrafts();
       signedInRef.current = true;
     }
   }, [publishedToken]);

From f2a415e982a36d79ab98370b732887fef543d2e1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Igor=20=C5=A0=C4=87eki=C4=87?=
 <4062236+iscekic@users.noreply.github.com>
Date: Tue, 20 Oct 2026 13:04:12 +0000
Subject: [PATCH 7/9] chore: retrigger review of the login draft hardening


From 8f40df4858bf11181bf3b06c323927632bef0b76 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Igor=20=C5=A0=C4=87eki=C4=87?=
 <4062236+iscekic@users.noreply.github.com>
Date: Tue, 20 Oct 2026 14:06:16 +0000
Subject: [PATCH 8/9] chore: request review of the final login-screen tree


From 00069da59db0679376fed9a3001d00049a8193cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Igor=20=C5=A0=C4=87eki=C4=87?=
 <4062236+iscekic@users.noreply.github.com>
Date: Tue, 20 Oct 2026 14:56:23 +0000
Subject: [PATCH 9/9] chore: refresh review state on the login hardening branch