{"version":"2.1.234","anchor":"remote-control-stops-a-live-session-when-the-signed-in-accou","canonical_anchor":"remote-control-stops-a-live-session-when-the-signed-in-accou","heading":"Remote Control stops a live session when the signed-in account changes","tier":"notice","area":"Remote Control","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234\/e\/remote-control-stops-a-live-session-when-the-signed-in-accou","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234","markdown":"### Remote Control stops a live session when the signed-in account changes\n\nA live remote session now shuts down if you sign into a different account mid-session.\n\n**What**\n\nA remote-control bridge session now pins the credential the server accepted at the start, and if the local signed-in account changes while the session is live it shuts the session down instead of carrying on under the new identity. Credential work in flight, including re-minting, refreshing and recovery, stops at the same point rather than running against the old owner. The whole behaviour sits behind the `tengu_bridge_owner_pinned_end` gate, which falls back to on.\n\n**Details**\n\n- On detecting the change the session logs \"Signed-in account changed under \u2026 \u2014 stopping\", sends an `account_changed` frame to the connected peer, and stops recovery and token-refresh work.\n- Subscription and unsubscription calls refuse with `{ ok: !1, reason: \"owner_changed\" }`, and token fetches short-circuit.\n- Early-exit checks named `owner_changed_refresh` and `owner_changed_recovery` cover the credential paths, and the session settles into a terminal state named `owner_changed`.\n- Credential fetches can use a token pinned to the original owner, recorded in telemetry as `source: \"pinned_owner\"`.\n- Archiving is skipped with its own outcome, `skipped_owner_changed`, rather than falling into the generic suppression path, and message delivery treats the condition as terminal and does not retry.\n- Reconnect returns `suppressed_owner_changed` and closes the connection instead of rebuilding the transport.\n- New telemetry `tengu_bridge_owner_changed` carries the site, the archive status and whether the episode was already dead; teardown telemetry gained an `archive_credential` field; the diagnostics event is `bridge_repl_v2_owner_changed`.\n- Per-attempt send-time bookkeeping was dropped from these paths, and the older `tengu_bridge_recover_stale_epoch` gate was deleted in the same rework.\n\n**Evidence**\n\n`bridge_repl_archive_suppressed_owner_changed`, `tengu_bridge_owner_changed`, `bridge_repl_v2_owner_changed`, `suppressed_owner_changed`\n\n- Flag `tengu_bridge_owner_pinned_end`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: on)\n- Flag `tengu_bridge_recover_stale_epoch`: Not enough to say (read for one account on one subscription tier against v2.1.234; this account: no value returned, anonymous baseline: no value returned, compiled default: not a boolean we can read)\n- Area: Remote Control\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}