The app offers password login, verified-email signup, password recovery and password change in Account settings. Email-code login remains available. Signup and recovery keep their email proof in memory until password creation succeeds; the resulting credential is validated before adoption and native secure storage.

Password changes replace the root inside the same serialized queue as account switching and discard revoked access/refresh credentials. A response for another owner is rejected. Public sign-out waits for server revocation even when a legacy root has not yet been exchanged, and preserves the local credential on failure. The existing owner-scoped ledgers and keyed private-screen reset are retained; sign-in copy explains that changing accounts does not merge their cards.

Native React reconciler journeys cover verified signup, account-settings password change and wrong-owner response rejection. API/store tests cover preserved whitespace, malformed credentials, recovery purpose, failed logout and a stale operation for A after switching to B. Existing account-isolation integration tests remain green. Lint and typecheck passed; the final pre-push run passed 2706 tests with 11 optional skips. PR CI passed. Maestro could not run locally because the CLI and Android SDK/device were unavailable; the new smoke flow is committed.

TestFlight build 1.0.2 (41) was compiled from reviewed PR head dcc85e91f5ca9412dc1c5bb5c5f785681da696ba; the PR was merged as 54d1a64. The IPA's identity, version, password/logout routes, production backend URL, native Keychain module and account-storage markers were verified statically. Its SHA256 is 3b4aa66b26fe153ee81df2100b2dfc84fb02dcd3701f2d4316a53bebc647a3f6. This does not establish physical-device execution. Build 41 intentionally records the reviewed account PR source; other work integrated concurrently into staging is not silently claimed to be part of this particular IPA.

EAS build and Apple submission. Submission was scheduled after the backend deployment and public HTTPS checks. Apple subsequently confirmed build 41 as VALID, IN_BETA_TESTING internally and READY_FOR_BETA_SUBMISSION externally. EAS submission finished successfully. The user was asked to install build 41 and verify sign-in/signup and account/ collection persistence across an app restart. No physical-device result has been reported yet.

Remaining physical iPhone checks

Use TestFlight build 41 and disposable accounts. Verify signup and real code entry; kill/reopen the app and confirm secure session persistence; change and recover a password; confirm old sessions stop working; sign out; then switch between accounts A/B with distinct holdings and confirm no cards or drafts leak between them. Confirm erasure waits for explicit confirmation and survives a restart after completion. Do not delete a real collection for QA.

The user has an iPhone with TestFlight. Phone execution and public App Store publication remain unverified; implementation, static IPA checks and backend tests do not make the app officially launched.