Lofi-Node + demo.lofi.host Testing

[FelineStateMachine]

• Sync-only ticket failed to create schema and silently (demo author doesn't consume the permission denied) degrades to local-only
• Stop Sync button requires environment variables to be set despite ticket system being user dynamic and not env based. "Db.disconnect() requires a configured serverUrl."
• Data Sync in Device report does not respect tickets. (unsure if template gap, related to the fact that I was downgraded to local-only already)
• Infinite reload cycles likely from one of our force reloads based on store conditions (hint being a cookie reset triggered it to begin)
• Lifecycle for sync should not outlive or even appear connected to a different identity than the sync owner. that would silently merge two users stores

[FelineStateMachine]

Triage of the five findings, traced to root cause. Four of the five share one: per-device sync state (election flag lofi:sync-elected:*, sealed sink envelope, namespace record) is appId-scoped only — nothing binds it to the account that elected sync or to the transport the running client was created with, so partial browser-state resets produce contradictory states each surface reads differently.

Finding	Root cause	Fix
Sync-only ticket silently degrades to local-only	enrollSyncTicket never consults the store preflight; the no_schema answer lands in diagnostics only, fire-and-forget	#180 — enrollment awaits the preflight; no_schema/ticket_rejected roll the sink back and throw SyncEnrollmentError; unreachable stores enroll with a surfaced warning
Stop Sync throws Db.disconnect() requires a configured serverUrl.	stopSyncBackup calls disconnect unconditionally; a stale-election tab's runtime was created without transport	#180 — disconnect guarded on runtimeCanReconnect(); election + owner pin cleared either way
Device report doesn't respect tickets	Mostly downstream of the degrade: the report is truthful but can't distinguish why (no sink vs unopenable vs store-denied vs owner-mismatch), and its hint copy leads with env vars	PR 2 (template/component quality pass) — four first-class sync states in DeviceStatus, ticket-first copy
Infinite reload cycle after a cookie reset	enableSyncBackup → reloadBrowserRuntime re-triggers whenever persisted state contradicts itself; no budget	#180 — per-tab reload budget (settled boot resets it; third unbroken attempt stops with a reload-loop startup failure) plus the owner pin removing the main re-trigger
Sync lifecycle outlives identity (silent-merge risk)	No sync key is bound to the account; a restored/reset identity boots syncing under the previous owner's grant	#180 — sync-owner pin: election records the account fingerprint; a different account boots with transport suppressed and an explicit syncOwnerMismatch state; explicit restore ceremonies adopt ownership

Also worth noting: enableSyncBackup, stopSyncBackup, and enrollSyncTicket had zero test coverage, which is how this shipped — #180 adds 19 unit tests over injected seams. PR 2 follows with the template quality pass (AccountGate freshness + owner-mismatch branch + store-status surfacing, TicketEnrollForm typed-error handling, DeviceStatus states, demo overlay verification, starter snapshot regen).

https://claude.ai/code/session_016xDZrYJA4JDbM3wPwmWX8c