[jlucaso1]

After remote logout and isolated re-pairing, the GUI could use the successor while CLI and tray stayed on local account 1. CLI now supports --local-account independently of the profile/socket --account flag, requires a confirmed selection before sending commands, and stays bound to that identity. Existing wire clients keep their prior handshake behavior. Linux, Windows and macOS trays follow current runtimes, aggregate connected unread state, and route Open/Hide/toggle across existing windows.

Confirmed relinks now use a persistent retirement journal. Both persisted PN and LID must match through Jid::to_non_ad, the complete paired device must load from durable storage, and live successor identity must agree. Different, incomplete or conflicting identities retain both entries. Names, photos and partial strings are never identity evidence. Credentials and device IDs are never moved.

The journal survives old-row deletion and preserves successor chains. Once the durable successor is verified, it requests a retaining local shutdown of the logged-out predecessor without assigning a removal disposition; cleanup only follows completed writer teardown and task joining. It pins the valid successor lifecycle, waits for old session/chat/plugin/publication teardown and in-flight web media operations, and reuses account-scoped lifecycle cleanup. Cleanup failure retains a retryable record and never removes the new session. Journal read errors preserve the previous protection snapshot; unavailable or mismatching identities never reactivate a retired ID. Terminal cleanup is tracked outside the supervisor command loop and waits for the old task to be joined. Failed joins release waiters without granting cleanup permission: a runtime whose close was not proven retains its data and reports an incomplete lifecycle request. Downloads and socket response writes have 30-second deadlines so stalled peers release their cleanup leases. Upload bodies retain their existing read deadline, while disk mutations are awaited without cancellation before releasing the lease. Native consumers receive an explicit retirement redirect and must attach again; GUI active/retained references reconcile it. Relaxed IndexedDB cannot confirm ordinary-write durability, so it retains old history; native SQLite and durable OPFS support consolidation.

Synthetic regressions cover selection ambiguity and missing legacy slot, immutable wire binding, old-daemon refusal, tray subscription retirement, PN/LID device suffixes and conflicts, incomplete persisted sessions, unfinished old tasks, cleanup failure, restart after intent and row purge, concurrent passes, successor pinning, chains, stale identity decisions, journal read failures, incomplete successor protection, supervisor responsiveness while an old task is pending, stalled response lease release, failed-join shutdown safety, and GUI selection reconciliation.

Validation at a64273c: Codex review completed with no findings; the Windows CI job passed, including the retained-runtime quiescence, partial-cleanup retry, failed-join, storage-read protection and stalled-response regressions. Current-head CI still has Linux, macOS, web, MSRV and xtask jobs queued without assigned runners; Pages and release-artifact gates are also pending. The PR remains draft until all final-head gates pass. Local checks were rustfmt and git diff --check only. Cargo, builds and tests are intentionally left to CI at the user's request. No live daemon, user session database or personal account data was used. No release version bump, merge or deployment.

Protocol evidence: whatspec snapshot 587a514, schema 4.3.0, WhatsApp Web 2.3000.1047483476. All 579 files from the pinned bundle archive matched their lock SHA-256 and sizes. Archive SHA-256: 22243b9c2ff18a66cea8fd66551821fe0f9f09786d107e2be8284637db86c349. AST extraction found one definition each of WAWebWid, WAWebWidFactory and WAWebUserPrefsMeUser in bundle 09d91fdc4089c50ab1d35dd6c796ee82ef4c3296710316d20383c85738b871b8. Their byte ranges are 2728079–2737164, 2737282–2741052 and 2748336–2753656. The Web code compares user plus addressing namespace separately from the device suffix. This supports normalization, not a claim that LIDs remain stable across relinks. The retirement policy conservatively requires agreement in both namespaces and retains hosted or unsupported identities.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no new actionable issue was found.

Summary

This PR makes CLI and tray actions follow the selected local account and safely removes old accounts after confirmed relinks.

• The CLI selects a local account and stays bound to it.
• Confirmed relinks retire old accounts while preserving the successor session.
• The tray follows current accounts and routes actions to their windows.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Logged-out predecessor] --> B{Saved and live identities match?}
  B -->|No| C[Keep both accounts]
  B -->|Yes| D[Save retirement intent and protect successor]
  D --> E[Request predecessor stop]
  E --> F[Close old writers without deleting storage]
  F --> G{Close succeeded and task finished?}
  G -->|No| H[Keep data and pending record]
  G -->|Yes| I[Drain media requests and clean old account]
  I --> J{Cleanup succeeded?}
  J -->|No| H
  J -->|Yes| K[Mark retirement complete]

Loading

_{Reviews (7) · Last reviewed commit: "Quiesce retained logged-out runtimes aft..." · Reviewed by Greptile}

[jlucaso1]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T22:16:39.955664Z	a64273c	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 70655cb56a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Quiesce logged-out runtimes before requiring quiescence

After an ordinary logout followed by successful pairing of the same identity, this gate prevents consolidation indefinitely. In crates/session/src/whatsapp/mod.rs, both the persisted-logout startup path and the retain_local completion path wait on shutdown.notified() to keep retained history available. Consequently, session_bridge::run keeps receiving commands instead of reaching teardown, leaving the old runtime Running and not quiesced. AccountRegistry::relink only starts the successor; it never stops the predecessor. Restarting repeats the persisted-logout path, so it does not help either. The consolidation flow needs to stop and join the old runtime safely once the successor is verified, rather than requiring a lifecycle state that the normal relink flow never establishes.

Useful? React with 👍 / 👎.

[jlucaso1]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: a64273ce55

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".