fix(mobile): serialize initial device identity creation

[saphid]

Problem

On a fresh install, the mobile app creates its agent-awareness device ID lazily. Push registration and the background-activity reporter start independently. Both can read "no ID", generate different UUIDs and write the same secure-storage key. The relay registration can keep ID A while storage ends up with ID B, so sign-out later unregisters B and leaves A registered.

Change

MobileStorage.make creates a one-permit semaphore and runs the whole read, generate and write sequence for the device ID under it. Concurrent callers share one ID. Nothing is cached, so a failed write is still retried on the next call.

Scope and approval

A small, focused fix for an obvious race, so it uses the no-prior-issue exception. No UI change.

Verification

• New mobile-storage.test.ts case with the production MobileStorage and MobileSecureStorage over in-memory storage and deterministic UUIDs. On main two concurrent first-use callers get generated-device-1 and generated-device-2 (log). With the fix both get the same ID, an existing ID is reused, and a failed first write is retried. 3 passed (log), rerun after rebasing on current main.
• vp lint and apps/mobile typecheck: clean.
• Independent review by Claude Opus 5.5 (high) through a T3 delegated task: no defects.
• Not run on a device; this has no visible UI.

Found by a GPT-6.1 Sol (high) audit and implemented by GPT-6.1 Sol (medium) in T3 Code. Reviewed by Claude Opus 5.5. Coordinated by Claude Opus 5.5 in Claude Code via T3 Code. Agent-authored, sponsored by Alex Southwell.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Only developers with an assigned seat can use this organization's usage-based review budget, and seats here are assigned manually. Ask an admin to assign a seat, or change the review continuation mode in Billing.

Next included review available in 23 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 834a457d-4825-45cf-b869-4c07b4fb9bae

📥 Commits

Reviewing files that changed from the base of the PR and between 511d20c and af402b1.

📒 Files selected for processing (2)

• apps/mobile/src/persistence/mobile-storage.test.ts
• apps/mobile/src/persistence/mobile-storage.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved at af402b1

Macroscope's review found this PR approvable — This is a focused mobile persistence race fix that serializes only initial device-identity creation, preserving existing behavior for stored identities and retries. The accompanying tests cover the concurrent and failure cases, with no product-default or static-analysis changes.

^{You can add or adjust custom eligibility rules. Learn more.}