[SiteRelEnby]

Two from the docs pass, both on the Account screen, plus a third they led to.

Turning on 2FA failed every time. The server has required the account password to start enrolment since 0.5.0 and this client sent no body at all, so every attempt was a 422 and there was no way to add a second factor from the phone. Setup now asks for the password first. /auth/totp/setup also goes on TokenAuthenticator's no-retry list: a wrong password answers 401 there, and retrying burns a refresh rotation and sends the same wrong password again, which the server counts twice towards the password lockout.

"Revoke All Other Sessions" quietly did nothing. It posts to an endpoint that identifies the caller's session from the sheaf_session cookie, which this client never sends, so every attempt came back 400 "No current session". It now revokes each handle in turn, which works with a bearer token. The endpoint is no longer declared, with a note saying why.

And a third, found on the way. The session list identifies the current session by cookie too, so the app already fell back to the sid claim from its own token and compared it against the list's id. Those can never be equal: the raw id is the cookie credential, so every read surface returns sha256(id) truncated to 32 hex instead. The fallback was dead code, the list showed no "this session" at all, and revoke-all was asking the server to kill the session it was asking from, surviving only because the server refuses. The client now derives the handle the same way, pinned to fixed digests so the two cannot drift without a test failing.

Verified on device: setup reaches a real secret and reports a wrong password without leaving the step; revoking took the account from 31 sessions to 3; the list now shows "THIS SESSION" with rename but no revoke.