[leviFrosty]

Summary

The account now has a security history the User can see in the app, along with its list of signed-in devices (witness-work ADR 0028). It records high-level actions that matter for security: which devices signed in, sessions that ended, backups deleted or downloaded, the account moved to a new phone, and suspensions. It doesn't record ordinary views.

Stacked on #49. Review that PR first; this diff is only the activity log. App PR: leviFrosty/witness-work#777.

Routes (Bearer)

Route	What
GET /accounts/v1/activity?limit=&before=	The account's entries, newest first, with a nextCursor
GET /accounts/v1/sessions	Live sessions; current marks the caller's
POST /accounts/v1/sessions/revoke	{ sessionId }: sign a device out

Revoke is a POST, so the session id stays out of the URL. A session that belongs to another account, or doesn't exist, is 404 not_found. All three routes count against the read edge tier and work for suspended accounts.

What's recorded

Kind	When
account.created	Registration
session.opened	A device signs in (attested session/open)
session.signed_out	DELETE /sessions/current
session.revoked	Another device signed this one out
session.replaced	The 10-session cap ended the oldest
session.refresh_reused	A replaced refresh token came back after its grace minute. The app flags it. Never recorded for forged or malformed tokens.
handoff.sent	The account key was sent to a new phone
backup.deleted	One slot, or all of them
backup.downloaded	Once per slot, session, and day
account.suspended / account.reinstated	Status only, never the reason
buddies.inbox_linked / buddies.deleted	A new inbox link; Buddies deleted

Each entry is written in the same D1 batch as its action wherever the action is in D1. Backup records before the R2 change. Handoff and buddies.deleted record after their Durable Object accepted the change, and a failed write is reported through captureFailure.

Privacy

• Entries never include IP addresses, location, user agents, content, or anything about buddies. Writer ops log nothing, so nothing ties one account to another account's inbox.
• Each entry carries its session's platform and the sealed device label the app sends with session/open. The server can't read the label; the app decrypts the device name.
• The hourly cron deletes entries older than 400 days.
• Migration: migrations/accounts/0002_account-activity.sql (table account_activity). The tag deploy applies it.

Testing

Run on d798ec4 (rebased onto #49's 1b825cc):

• pnpm test: 1,053 passed.
• pnpm exec tsc --noEmit: clean.
• Both dry-runs build.
• verify-ww-api loop: doctor ok; pnpm test:e2e 77 passed with 3 skipped, including the new activity.e2e.test.ts; pnpm fuzz:buddies ok.
• A unit test sends three forged refresh tokens (right session id, bad MAC). Each gets 401, nothing is logged, and the session still refreshes afterwards.
• src/test/memoryD1.ts: failQueries now throws synchronously from rows(), the way a failing statement inside a real D1 batch does. Before, a failure inside a batch was silently skipped.
• Dev worker: migration 0002 applied to ww-accounts-dev, and this branch deployed to ww-proxy-dev. The activity, accounts, and bearer Buddies e2e suites run against the deployed worker: 24 passed, 5 skipped. The skips are the tests that need the local launcher's KV or caller IPs.

Open questions

1. Signing a device out isn't final: a device that still holds the account key can open a new session.
2. Revoking another device needs only a bearer token, with no account-key step-up.
3. Device names in the label are model names (for example "iPhone 16 Pro").
4. A handoff entry names only the old phone. The new phone appears as its own session.opened.
5. The privacy policy should mention the activity history.