Acknowledge already-ended application support sessions
Allows an application to finish cleanup after an earlier native support session and its short-lived binding have both disappeared. The fallback acknowledges absence without granting authority over any existing session.
What changed
- The absence-only acknowledgement requires a current application support registration, exact signed main-app/project transport and a live ordinary native actor. It performs no session mutation and discloses no additional session identifiers.
- Any existing native session still requires the complete retained actor/session/audit proof before it can be revoked. Missing or forged transport, an unrelated origin, no live actor and disabled delegation remain denied.
- Existing bound cleanup, 24-hour receipts, ordinary sign-in and immutable SDK 1.4.5 remain compatible.
Release provenance
release
A failing-first fixture reproduced the expired-binding/already-deleted-session cleanup error. Forty-five support/introspection regressions pass, including repeat-safe absence acknowledgement, preserved ordinary actor sign-in, unsigned/cookieless/wrong-origin/disabled-policy denial and refusal to touch existing sessions lacking their full binding. Service typecheck, production build and immutable SDK checks passed before deployment.
Reviewed package files: support-plugin.ts, support-plugin.test.ts, allauth-support-sessions.mdx
deployment
Railway deployment d559b8a9-f7fe-4a92-b36e-ce5eace30105 of source 5485ca2966c9cb1f58b5493dddce9fd05ed2eb36 reached SUCCESS on 2026-11-06T03:30:00.701Z. Service readiness, anonymous native session response and an existing verified management session passed after deployment. Application browser cleanup acceptance is recorded separately.
Reviewed package files: support-plugin.ts, support-plugin.test.ts