Add the iCloud devices section and Main-device designation to Devices

The Devices screen (Settings > Devices) gains a footer under the
paired-installations section ("Devices paired to your account") and a
second section ("Other devices in iCloud") listing identities from the
iCloud-synced keychain backup that aren't paired to the current
account. Tapping one arms the standard initiator pairing sheet with
the scan instruction naming that device - the current account stays
the main account and the join happens from the other device. Unlike
the first-install prompt, the section applies no newer-than-own
ordering filter: it is an explicit, user-navigated inventory, not an
unsolicited demotion offer.

The oldest key on the iCloud account is designated the Main device
(ICloudDeviceBackupsSnapshot, backedUpAt as the creation proxy with
the same caveats as the prompt's ordering rule): badged on whichever
row holds it, and the delete-all confirmation escalates its copy when
wiping the main device, since other devices pair through that key.

Verified by new structured QA test 46 (first run e16c3876a045, all
five criteria pass, runner navigation notes folded into the YAML) and
four unit tests for the snapshot builder.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: yewreeka

.claude/commands/qa.md

@@ -122,7 +122,7 @@ The canonical order (from `qa/SKILL.md` "Run all tests") is:
    → 16 → 17 → 20 → 27 → 28 → 19 → 15 → 34 → 18
 ```
 
-plus secondary tests `14, 22, 23, 23b, 24, 25, 26, 28b, 29, 30, 31, 32, 33, 43, 44b, 45` slotted where they don't conflict with destructive steps (09, 18). Test 43 (long-message rendering) explodes the shared conversation in teardown, so slot it late in the sequence, after other tests that reuse `shared_conversation_id`. Tests 44b and 45 briefly shut down the primary simulator to clone it (like 03/04), so don't overlap them with tests running on the primary; they otherwise run entirely on their own disposable clones.
+plus secondary tests `14, 22, 23, 23b, 24, 25, 26, 28b, 29, 30, 31, 32, 33, 43, 44b, 45, 46` slotted where they don't conflict with destructive steps (09, 18). Test 43 (long-message rendering) explodes the shared conversation in teardown, so slot it late in the sequence, after other tests that reuse `shared_conversation_id`. Tests 44b, 45, and 46 briefly shut down the primary simulator to clone it (like 03/04), so don't overlap them with tests running on the primary; they otherwise run entirely on their own disposable clones.
 
 **What can actually run in parallel:**
 

Convos/App Settings/AppSettingsViewModel.swift

@@ -10,6 +10,10 @@ final class AppSettingsViewModel {
     private(set) var isDeleting: Bool = false
     private(set) var deletionProgress: InboxDeletionProgress?
     private(set) var deletionError: Error?
+    /// Whether this device holds the account's main (oldest) iCloud key.
+    /// Escalates the delete-all confirmation copy - wiping the main
+    /// device removes the key other devices pair through.
+    private(set) var currentDeviceIsMain: Bool = false
 
     // MARK: - Dependencies
 
@@ -35,6 +39,14 @@ final class AppSettingsViewModel {
 
     // MARK: - Actions
 
+    /// Refreshes the main-device designation for the delete-all
+    /// confirmation. Best-effort - defaults to false on failure so the
+    /// escalated warning never blocks a legitimate delete.
+    func refreshMainDeviceStatus() async {
+        let snapshot = await session.iCloudDeviceBackupsSnapshot()
+        currentDeviceIsMain = snapshot.currentDeviceIsMain
+    }
+
     func deleteAllData(onComplete: @escaping () -> Void) {
         guard !isDeleting else { return }
         prepareForDeletion()

Convos/App Settings/DeleteAllDataView.swift

@@ -22,7 +22,9 @@ struct DeleteAllDataView: View {
     }
 
     var subtitle: String {
-        "This will permanently delete all conversations on this device, as well as your profile."
+        let base = "This will permanently delete all conversations on this device, as well as your profile."
+        guard viewModel.currentDeviceIsMain else { return base }
+        return base + " This is your main device — the first one created for your account — and other devices pair through it."
     }
 
     var body: some View {
@@ -65,6 +67,9 @@ struct DeleteAllDataView: View {
             ensureNavigator()
             navState.markScreenAppeared()
         }
+        .task {
+            await viewModel.refreshMainDeviceStatus()
+        }
         .onDisappear {
             navigator?.closed(context: navState.closeContext())
         }

Convos/Devices/DevicesView.swift

@@ -92,6 +92,18 @@ struct DevicesView: View {
                 ForEach(viewModel.devices) { device in
                     deviceRow(device)
                 }
+            } footer: {
+                Text("Devices paired to your account")
+            }
+
+            if !viewModel.iCloudDevices.isEmpty {
+                Section {
+                    ForEach(viewModel.iCloudDevices) { backup in
+                        iCloudDeviceRow(backup)
+                    }
+                } footer: {
+                    Text("Other devices in iCloud")
+                }
             }
 
             Section {
@@ -112,8 +124,43 @@ struct DevicesView: View {
         .background(.colorBackgroundRaisedSecondary)
     }
 
+    private func iCloudDeviceRow(_ backup: PairableDeviceBackup) -> some View {
+        let pairAction = { viewModel.pairICloudDevice(backup) }
+        let isMain: Bool = viewModel.mainDeviceInboxId == backup.inboxId
+        return Button(action: pairAction) {
+            HStack(spacing: DesignConstants.Spacing.step3x) {
+                Image(systemName: "icloud")
+                    .foregroundStyle(.colorTextPrimary)
+                    .frame(width: 24)
+
+                VStack(alignment: .leading, spacing: 2) {
+                    Text(backup.deviceName ?? DevicesViewModel.shortICloudDeviceName(inboxId: backup.inboxId))
+                        .foregroundStyle(.colorTextPrimary)
+
+                    if isMain {
+                        Text("Main device")
+                            .font(.caption)
+                            .foregroundStyle(.colorTextSecondary)
+                    }
+                }
+
+                Spacer()
+
+                Image(systemName: "chevron.right")
+                    .font(.caption)
+                    .foregroundStyle(.colorTextSecondary)
+            }
+            .contentShape(Rectangle())
+        }
+        .accessibilityIdentifier("icloud-device-row-\(backup.inboxId)")
+    }
+
     private func deviceRow(_ device: PairedDevice) -> some View {
-        HStack(spacing: DesignConstants.Spacing.step3x) {
+        let caption: String? = {
+            guard device.isCurrentDevice else { return nil }
+            return viewModel.currentDeviceIsMain ? "This device · Main device" : "This device"
+        }()
+        return HStack(spacing: DesignConstants.Spacing.step3x) {
             Image(systemName: "iphone.gen3")
                 .foregroundStyle(.colorTextPrimary)
                 .frame(width: 24)
@@ -122,8 +169,8 @@ struct DevicesView: View {
                 Text(device.name)
                     .foregroundStyle(.colorTextPrimary)
 
-                if device.isCurrentDevice {
-                    Text("This device")
+                if let caption {
+                    Text(caption)
                         .font(.caption)
                         .foregroundStyle(.colorTextSecondary)
                 }

Convos/Devices/DevicesViewModel.swift

@@ -26,6 +26,17 @@ struct PairedDevice: Identifiable, Equatable, Sendable {
 @MainActor
 final class DevicesViewModel {
     var devices: [PairedDevice] = []
+    /// Other identities' private keys found in the iCloud-synced keychain
+    /// backup - devices on the same iCloud account that are not paired to
+    /// the current account. Oldest first, so the account's original key
+    /// leads the section.
+    var iCloudDevices: [PairableDeviceBackup] = []
+    /// The inboxId of the oldest key on the iCloud account - the "main"
+    /// device. Nil when ordering can't be established.
+    var mainDeviceInboxId: String?
+    /// Whether the current account holds the main (oldest) key, so the
+    /// current-device row carries the Main badge.
+    var currentDeviceIsMain: Bool = false
     var isLoading: Bool = false
     var showPairingSheet: Bool = false
     var pairingViewModel: PairingSheetViewModel?
@@ -99,12 +110,56 @@ final class DevicesViewModel {
                     if role.isInitiator, let baseline {
                         await self.broadcastProfileSnapshotsAfterPair(baseline: baseline)
                     }
+                    // A completed pairing changes the iCloud picture (the
+                    // joined device's separate key is retired when it
+                    // adopts this account), so refresh the section too.
+                    await self.refreshICloudDevices()
                 }
             }
         }
         Task { @MainActor in
             await refreshInstallations(refreshFromNetwork: true)
         }
+        Task { @MainActor in
+            await refreshICloudDevices()
+        }
+    }
+
+    /// Loads the iCloud backup inventory for the "Other devices in
+    /// iCloud" section and the Main-device designation. Re-run alongside
+    /// installation refreshes so a completed pairing (which retires the
+    /// adopted identity's separate backup) updates the section.
+    func refreshICloudDevices() async {
+        guard let session else { return }
+        let snapshot = await session.iCloudDeviceBackupsSnapshot()
+        iCloudDevices = snapshot.otherDevices
+        mainDeviceInboxId = snapshot.mainDeviceInboxId
+        currentDeviceIsMain = snapshot.currentDeviceIsMain
+    }
+
+    /// Starts the initiator pairing flow targeted at a specific iCloud
+    /// device: this account stays the main account, the sheet shows the
+    /// standard invite (QR/PIN), and the scan instruction names the
+    /// tapped device. The join itself happens from that device.
+    func pairICloudDevice(_ backup: PairableDeviceBackup) {
+        guard pairingViewModel == nil else { return }
+        let service = pairingServiceFactory()
+        let vm = PairingSheetViewModel(
+            pairingService: service,
+            appGroupIdentifier: appGroupIdentifier,
+            targetDeviceName: backup.deviceName ?? Self.shortICloudDeviceName(inboxId: backup.inboxId)
+        )
+        pairingViewModel = vm
+        showPairingSheet = true
+        QAEvent.emit(.pairing, "devices_icloud_pair_tapped", ["inboxId": backup.inboxId])
+    }
+
+    /// Display name for an iCloud backup row: the device name stamped on
+    /// the backup when the writer had one, otherwise a short
+    /// tail-fingerprint of the inboxId (mirrors `shortDeviceName`).
+    static func shortICloudDeviceName(inboxId: String) -> String {
+        let suffix = inboxId.suffix(6)
+        return "Device \(suffix)"
     }
 
     /// The inbox's currently-known installation IDs (cached, no network

Convos/Devices/PairingSheetView.swift

@@ -65,8 +65,11 @@ struct PairingSheetView: View {
 
     @ViewBuilder
     private func qrCodeContent(url: String) -> some View {
+        let scanInstruction: String = viewModel.targetDeviceName.map {
+            "Open Convos on \"\($0)\" and scan this code to pair"
+        } ?? "Scan this code with your new device to pair"
         VStack(spacing: DesignConstants.Spacing.step4x) {
-            Text("Scan this code with your new device to pair")
+            Text(scanInstruction)
                 .font(.subheadline)
                 .foregroundStyle(.colorTextPrimary)
                 .frame(maxWidth: .infinity, alignment: .leading)

Convos/Devices/PairingSheetViewModel.swift

@@ -66,6 +66,10 @@ final class PairingSheetViewModel: Identifiable {
     private let appGroupIdentifier: String?
     private let timeoutInterval: TimeInterval
     private let mode: PairingSheetMode
+    /// When the invite targets a specific iCloud device (the Devices
+    /// screen's "Other devices in iCloud" section), the sheet's scan
+    /// instruction names it instead of the generic "your new device".
+    let targetDeviceName: String?
     private(set) var coordinator: PairingCoordinator?
     private var joinerDeviceName: String = "New Device"
     private var joinerInboxId: String?
@@ -78,12 +82,14 @@ final class PairingSheetViewModel: Identifiable {
         pairingService: any PairingServiceProtocol,
         timeoutInterval: TimeInterval = 120,
         mode: PairingSheetMode = .createInvite,
-        appGroupIdentifier: String? = nil
+        appGroupIdentifier: String? = nil,
+        targetDeviceName: String? = nil
     ) {
         self.pairingService = pairingService
         self.appGroupIdentifier = appGroupIdentifier
         self.timeoutInterval = timeoutInterval
         self.mode = mode
+        self.targetDeviceName = targetDeviceName
         self.secondsRemaining = Int(timeoutInterval)
         self.observers = PairingNotificationObservers()
         if case .respondToJoinRequest = mode {

ConvosCore/Sources/ConvosCore/Pairing/PairableDeviceBackup.swift

@@ -6,18 +6,98 @@ import Foundation
 /// the backup's key material stays inside ConvosCore
 /// (`SessionManager.pairingInviteSlug(forBackupInboxId:expiresAt:)` signs
 /// with it on demand).
-public struct PairableDeviceBackup: Sendable, Equatable {
+public struct PairableDeviceBackup: Sendable, Equatable, Identifiable {
     public let inboxId: String
     public let deviceName: String?
     public let backedUpAt: Date?
 
+    public var id: String { inboxId }
+
     public init(inboxId: String, deviceName: String?, backedUpAt: Date?) {
         self.inboxId = inboxId
         self.deviceName = deviceName
         self.backedUpAt = backedUpAt
     }
 }
 
+/// Everything the Devices screen needs from the iCloud-synced backup
+/// slot: the current identity's own mirror, every other identity's
+/// backup, and which of them is the "main" device - the identity whose
+/// key was created first. `backedUpAt` is the best available proxy for
+/// key creation (a mirror is written when the identity is saved; pairing
+/// re-saves and late backfills can re-stamp it, the same caveat the
+/// prompt's ordering rule carries).
+///
+/// Unlike `PairableDeviceBackup.pairableBackups`, `otherDevices` is not
+/// filtered by the newer-than-own ordering rule: that rule exists so the
+/// unsolicited first-install prompt never offers a device demotion,
+/// whereas the Devices screen is an explicit, user-navigated inventory
+/// of every key on the iCloud account.
+public struct ICloudDeviceBackupsSnapshot: Sendable, Equatable {
+    /// The current identity's own mirror, nil when it hasn't been
+    /// written yet (or the keychain read failed upstream).
+    public let currentDevice: PairableDeviceBackup?
+    /// Every other identity's backup, oldest first.
+    public let otherDevices: [PairableDeviceBackup]
+
+    /// The inboxId of the oldest key on the iCloud account, nil when no
+    /// key carries a timestamp to order by.
+    public var mainDeviceInboxId: String? {
+        let candidates = ([currentDevice].compactMap { $0 } + otherDevices)
+            .filter { $0.backedUpAt != nil }
+        let oldest = candidates.min { (lhs: PairableDeviceBackup, rhs: PairableDeviceBackup) -> Bool in
+            (lhs.backedUpAt ?? .distantFuture, lhs.inboxId) < (rhs.backedUpAt ?? .distantFuture, rhs.inboxId)
+        }
+        return oldest?.inboxId
+    }
+
+    /// Whether the current identity holds the account's main (oldest)
+    /// key. False when ordering can't be established.
+    public var currentDeviceIsMain: Bool {
+        guard let currentDevice else { return false }
+        return mainDeviceInboxId == currentDevice.inboxId
+    }
+
+    public init(currentDevice: PairableDeviceBackup?, otherDevices: [PairableDeviceBackup]) {
+        self.currentDevice = currentDevice
+        self.otherDevices = otherDevices
+    }
+}
+
+extension ICloudDeviceBackupsSnapshot {
+    /// Builds the snapshot from raw synced backups. Static and pure so
+    /// it can be unit tested without a keychain. A nil `currentInboxId`
+    /// (no identity yet) leaves `currentDevice` nil and treats every
+    /// backup as another device's.
+    static func snapshot(
+        from backups: [KeychainIdentityBackup],
+        currentInboxId: String?
+    ) -> ICloudDeviceBackupsSnapshot {
+        let own = backups
+            .first { $0.inboxId == currentInboxId }
+            .map { (backup: KeychainIdentityBackup) -> PairableDeviceBackup in
+                PairableDeviceBackup(
+                    inboxId: backup.inboxId,
+                    deviceName: backup.deviceName,
+                    backedUpAt: backup.backedUpAt
+                )
+            }
+        let others = backups
+            .filter { $0.inboxId != currentInboxId }
+            .map { (backup: KeychainIdentityBackup) -> PairableDeviceBackup in
+                PairableDeviceBackup(
+                    inboxId: backup.inboxId,
+                    deviceName: backup.deviceName,
+                    backedUpAt: backup.backedUpAt
+                )
+            }
+            .sorted { (lhs: PairableDeviceBackup, rhs: PairableDeviceBackup) -> Bool in
+                (lhs.backedUpAt ?? .distantFuture, lhs.inboxId) < (rhs.backedUpAt ?? .distantFuture, rhs.inboxId)
+            }
+        return ICloudDeviceBackupsSnapshot(currentDevice: own, otherDevices: others)
+    }
+}
+
 extension PairableDeviceBackup {
     /// Filters raw synced backups down to identities other than
     /// `currentInboxId` (a fresh install's own placeholder identity mirrors

ConvosCore/Sources/ConvosCore/Sessions/SessionManager.swift

@@ -1148,6 +1148,21 @@ public extension SessionManager {
         }
     }
 
+    /// Same slot read as `pairableDeviceBackups`, but shaped for the
+    /// Devices screen: includes the current identity's own mirror and
+    /// applies no ordering filter (see `ICloudDeviceBackupsSnapshot`).
+    /// Best-effort: keychain failures return an empty snapshot.
+    func iCloudDeviceBackupsSnapshot() async -> ICloudDeviceBackupsSnapshot {
+        do {
+            let backups = try await identityStore.loadSyncedBackups()
+            let currentInboxId = try identityStore.loadSync()?.inboxId
+            return ICloudDeviceBackupsSnapshot.snapshot(from: backups, currentInboxId: currentInboxId)
+        } catch {
+            Log.warning("SessionManager.iCloudDeviceBackupsSnapshot failed: \(error)")
+            return ICloudDeviceBackupsSnapshot(currentDevice: nil, otherDevices: [])
+        }
+    }
+
     /// Signs a pairing invite with the synced backup's private key. The
     /// key never leaves ConvosCore - the caller only receives the slug,
     /// which carries the same authority as a slug minted by the backed-up

ConvosCore/Sources/ConvosCore/Sessions/SessionManagerProtocol.swift

@@ -45,6 +45,12 @@ public protocol SessionManagerProtocol: AnyObject, Sendable {
     /// array when there is nothing to offer.
     func pairableDeviceBackups() async -> [PairableDeviceBackup]
 
+    /// The full iCloud backup inventory for the Devices screen: the
+    /// current identity's own mirror plus every other identity's backup,
+    /// unfiltered by the prompt's ordering rule (see
+    /// `ICloudDeviceBackupsSnapshot`).
+    func iCloudDeviceBackupsSnapshot() async -> ICloudDeviceBackupsSnapshot
+
     /// Mints a signed pairing-invite slug on behalf of the backed-up
     /// device (its synced private key signs the invite, exactly like the
     /// QR flow does on the initiator), so the joiner flow can target that
@@ -263,6 +269,12 @@ extension SessionManagerProtocol {
         []
     }
 
+    /// Default for conformers without keychain access (test mocks): an
+    /// empty inventory. The real lookup lives on `SessionManager`.
+    public func iCloudDeviceBackupsSnapshot() async -> ICloudDeviceBackupsSnapshot {
+        ICloudDeviceBackupsSnapshot(currentDevice: nil, otherDevices: [])
+    }
+
     /// Default for conformers without keychain access (test mocks). The
     /// real signing path lives on `SessionManager`.
     public func pairingInviteSlug(forBackupInboxId inboxId: String, expiresAt: Date) async throws -> String {