Reset leaves Immich-link passwords in the keychain, and lands link/iCloud users on the server form

[kipp-ing]

Found: 2026-09-14 as a side note while verifying product fact SRC-12 (the fact itself holds: connection edits are checked before saving, a failed check keeps the old connection, Reset clears server + API key + source library).

1. Orphaned secrets. Reset (Packages/OnboardingKit/Sources/OnboardingKit/OnboardingViewModel.swift:190-199) clears the server address, API key and source library, but saved Immich-link passwords stay in the keychain (SharedLinkSecretStore). They're no longer reachable from the app, so they're dead secrets on the device. Constitution III keeps secrets in the keychain; a reset that forgets their sources should delete them too.

2. Wrong landing screen for some users. Reset routes to the server form (OwnFrame/OwnFrameApp.swift:686-694), not the welcome choice screen. That matches FR-200-24's wording, but a person who set up with an Immich link or an iCloud album is dropped into a server + API key form they never used. Spec 220 made the welcome choice the first screen.

3. (minor) A link-only user who later adds a server gets the album re-select sheet because the stored album id is empty.

Todo

• Red test: after Reset, no shared-link password remains in the secret store.
• Decide/spec whether Reset lands on the welcome choice (220) — amend FR-200-24 if so.
• Look at item 3.

[kipp-ing]

Part 1 (orphaned secrets) landed in e17c5c2 (private main; reaches this mirror with the next publish). Reset now deletes the Keychain password of every saved Immich link before it clears the library (FR-120-14). There's a host test with an in-memory store and an app-hosted test against the real Keychain. Removing a single source already deleted its password; that's now pinned by a test.

Leaving this open:

• Where Reset lands (server form vs. welcome choice) is still a product decision.
• Item 3 (link-only user adds a server → album re-select sheet) is untouched.

Two smaller password residues found by review, both older than this change:

• The iPad's CloudKit copy of link passwords only clears on the next foreground publish after Reset.
• Sources with a duplicate or blank label are dropped when the library loads, so Reset can't find their passwords.

Also, the tvOS onboarding model gets no secret store yet. That's latent, since tvOS has no Reset.

[kipp-ing]

Decision on part 2 (2026-09-14): no preference, so Reset keeps landing on the server + API-key step. FR-200-24 stays as it is. Only item 3 remains open here: a link-only user who later adds a server gets the album re-select sheet.