[Chadpiha]

Summary

When the app launched with no network, it ran entirely as a guest. Better Auth's get-session never resolved, so fetchPolicy never ran, usePolicyStore.accountId stayed null, and team spaces, the workspace switcher and the account UI were all hidden. #2921's workspace list cache was never read on that path.

When get-session gets no answer (network error, 408, 429 or 5xx), the app now shows the last validated account read-only, if all of these hold:

• main's account binding (accountScopeBinding.js, keyed by a sha256 of the exact bearer token it validated) names that account for the current credential generation;
• the renderer's account scope was last reconciled for that same account, with nothing pending (scope action "none");
• a profile saved during a validated session in the last 30 days exists for that account (openwhispr:accountProfile).

In that state, useAuth reports isSignedIn: true, the saved user, session: null and a new isOfflineAccount: true. Policy, managed config and the workspace list load from their existing caches for that account.

What stays fenced

• Nothing marks the credential generation as validated, so getValidatedAuthGeneration() stays null. Sync, leaderboard and insights don't run.
• Authenticated cloudApi calls are refused before any request (AUTH_CONTEXT_UNVALIDATED).
• Account reconciliation, purge, set-active-account-scope and setIsSignedIn run only after a real get-session.

Back online

• Same user: confirmed through the normal path, and the saved profile is refreshed.
• Different user, or no user: purged through reconciliation, as today. The purge also clears the saved profile.
• 401 or 403: drops to guest, and that credential is never shown offline again.

Signing out offline clears the token, which ends the offline account, and clears the saved profile.

The threat model is in docs/superpowers/specs/2026-10-23-offline-account-presentation-design.md.

Changes

• src/lib/authRequestContext.ts: tracks the offline account and the generations the server rejected; adds getOfflineAccount(). handleAuthRequestError now separates "the server couldn't answer" from "the server rejected this credential".
• src/lib/offlineAccountProfile.ts (new): the saved profile and the pure resolveOfflineAccount decision.
• src/hooks/useAuth.ts: shows the offline account, loads its cached policy, managed config and workspace list, saves the profile while validated, and clears it on purge.
• src/lib/auth.ts: sign-out clears the saved profile.

No main-process changes and no new UI strings.

Tests

• test/hooks/useAuthOfflineAccount.test.js (new) mounts the real useAuth over the real auth context and account scope:
  • an offline launch shows the account read-only, with sync blocked;
  • a scope reconciled for another account, or a pending purge, stays a guest;
  • back online: same user confirmed; different user purged; no user purged; 401 drops to guest.
• test/lib/authRequestContext.test.js: binding match and mismatch, 503 counted as offline, 401 rejection, confirmation, sign-out.
• test/lib/offlineAccountProfile.test.js: id mismatch, 30-day age, malformed entries, and the decision helper.
• test/stores/workspaceListCache.test.js: a fenced list request shows the account's own cache and never another account's.

Locally, the auth, account-scope, workspace and sign-out tests pass (72/72), and tsc and eslint are clean. The rest of npm test fails only for environment reasons here: better-sqlite3 is built for a different Node version, and some connector tests time out under load but pass when run alone.