[Olga Lavrichenko (OLavrik)]

Fixes #949. Follow-up to #808: the three robustness problems the review split out.

1. In-app login ownership

• A login is now owned by the start that requested it (startReservedLogin). If the connect surface closes or Skip is pressed before provider.loginStart answers, the returned loginId is cancelled and cleared instead of running hidden with no UI.
• The post-connect handoff clears only the matching provider's finished login (clearSettledLogin(providerId)), so it can no longer drop a newer login. clearLogin(loginId?) clears only the named login when an id is given.
• Starting a login that supersedes another now publishes a terminal error frame for the superseded loginId (so another client stops sitting on "Working…") and calls dropLogin via an onSuperseded callback, so the analytics entry no longer leaks.
• A terminal frame for a login this client does not hold opens no dialog; it is buffered as unheldLoginFrame only so a client's own fast failure can still surface when its start response lands.

2. Hermetic smoke:logins

• The host runs with cwd: sandbox, --no-env-file and toolHomeEnv(sandbox home) from @thinkrail/shared/toolHomes, so neither the repo-root .env nor a real tool home leaks in (USERPROFILE is now set).
• A flow passes only on authUrl / deviceCode / prompt; an immediate success and a run with zero outcomes now fail.
• Every wire request has a 10 s timeout and pending requests are rejected when the connection closes.
• The host binds port 0 and reports it (no free-port race), and the script awaits the host's exit before rmSync.

3. Cancellable account detection

• detectAccounts (the host, argument-less call) is single-flight, and a read still pending for a path is reused until it settles, so repeated detection over a hung mount no longer stacks file-system operations.

Tests

• New unit coverage: login cancelled when its surface closed before the id arrived, the superseded terminal frame, the handoff clearing only its own provider's login, the buffered-then-claimed terminal frame, and the hung-read reuse.
• bun run smoke:logins: 56/56 flows reached their first sign-in step.
• Full bun run e2e (all 8 shards), unit tests, and all fast gates pass.

[jetbrains-air]

Approved — ready to merge.