后台/会话三诉求：子会话（一台设备一会话）+ 离线消息队列 + 被登出推送 + 后台唤醒层

- Req 1 子会话（iOS 多进程在用户视角＝一台设备一会话，内部多条独立刷新逻辑会话）：brokerclient 加 MintParams.Sub + SessionInfo.Sub + RevokeDeviceSessions(user,meta) 级联；device-session sub!="" 挂在主 device_id 之下、走 tier=clipboard 且不建第二个 device 行；handleSessionsList 按 meta 归并、隐藏 sub!=""（但保留“仅控件会话存活”的设备，不简单丢弃）；revokeDevice 改走 meta 级联（移除设备连带吊控件子会话）。iOS provisionWidgetSessionIfNeeded 改用主 device_id + sub="widget"（弃用独立 dev_widget），控件令牌仍隔离持有、独立刷新——不碰引擎主会话，#7 隔离不变。蓝本 auth/docs/子会话方案.md（cdrop 提案 + Broker 评审接受 + cdrop 确认 6 点：用 sub、R1 cdrop 归并、scope 复用 tier=clipboard、级联 DELETE …?meta=）。
- Req 2a 离线消息队列：新增 pending_messages 表（0001_init + sqlc 查询）；message.go 收件设备离线即入队（无论是否配推送都入队，恒 202），修“离线消息只随推送横幅一闪、不入收件列表”；GET /api/messages/pending 取即删（DELETE..RETURNING，单次投递）；web hub.ts onOpen 每次 SSE 连接 / 重连即拉取补收、逐条 addMessage（全端受益，iOS 经桥推原生 + 累积未读）；复用 login-request reaper 清 TTL。
- Req 3 被登出推送：push 加 KindSessionRevoked + 本地化文案，apns/web 双通道；revokeDevice 加 notifyRevoked 参（跨端 revoke=true、自登出=false），跨端移除时推送告知被踢设备；iOS AppDelegate 收 session:revoked 即清 Keychain 主会话 + 控件会话、发 .cdropSessionRevoked，前台经 AppRoot 即时回登录页、关闭态下次启动即登出。
- #6 后台唤醒层：apns apsEnvelope 加 content-available:1（服务端有消息时既弹可点横幅又短暂后台唤醒）；iOS DeviceItem 加 Codable、presence 快照持久化（冷启即时显示设备列表，缓解“长时间重连”观感，SSE 一连即整组替换自校正）；控件会话回前台补铸（scenePhase active）+ content-available 唤醒时刷新隔离的控件会话（剪贴板保活，绝不碰引擎主会话以免 #7 回归）。
- 测试：qr_test mock broker 加 sub 幂等键 + 级联吊销端点；bootstrap_test 期望表集加 pending_messages。

internal/httpapi/sessions.go

@@ -1,13 +1,16 @@
 package httpapi
 
 import (
+	"context"
 	"log/slog"
 	"net/http"
 
 	"github.com/go-chi/chi/v5"
 
+	"commilitia.net/cdrop/internal/brokerclient"
 	"commilitia.net/cdrop/internal/db"
 	"commilitia.net/cdrop/internal/jwtauth"
+	"commilitia.net/cdrop/internal/push"
 )
 
 // Session management. After the unified-session-model rework, every logged-in client —
@@ -82,19 +85,33 @@ func (s *Server) handleSessionsList(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	out := make([]sessionView, 0, len(sessions))
+	// 按 meta 归并：一台设备（meta）只呈现一条。子会话（sub!=""，如控件剪贴板会话）与主会话共享 meta
+	// ——优先用主会话作代表；但若某设备只剩子会话存活（主会话已过期、控件会话仍独立刷新着），仍按该
+	// meta 呈现一台，故不能简单丢弃 sub!="" 行（否则“仅控件存活”的设备会从列表消失，见 auth/docs/
+	// 子会话方案.md §四）。meta-less 会话是非 cdrop 托管的机器会话（桌面 device-authorize bootstrap，
+	// 随即被代铸替换），无 device_id、不是托管设备，跳过。
+	rep := make(map[string]brokerclient.SessionInfo, len(sessions))
+	order := make([]string, 0, len(sessions))
 	for _, sess := range sessions {
-		// A meta-less session is a non-cdrop-managed machine session — a desktop
-		// device-authorize bootstrap that the desktop replaces via 代铸 right away. It has
-		// no device_id, so it isn't a managed device and must not show as a phantom row.
 		if sess.Meta == "" {
 			continue
 		}
-		typ := typeByID[sess.Meta]
+		if cur, ok := rep[sess.Meta]; !ok {
+			rep[sess.Meta] = sess
+			order = append(order, sess.Meta)
+		} else if cur.Sub != "" && sess.Sub == "" {
+			rep[sess.Meta] = sess // 主会话优先覆盖先到的子会话，作该设备的代表
+		}
+	}
+
+	out := make([]sessionView, 0, len(order))
+	for _, meta := range order {
+		sess := rep[meta]
+		typ := typeByID[meta]
 		if typ == "" {
 			typ = "browser"
 		}
-		name := nameByID[sess.Meta]
+		name := nameByID[meta]
 		if name == "" {
 			name = sess.Label
 		}
@@ -103,13 +120,13 @@ func (s *Server) handleSessionsList(w http.ResponseWriter, r *http.Request) {
 			scope = "guest"
 		}
 		out = append(out, sessionView{
-			ID:         sess.Meta,
-			DeviceID:   sess.Meta,
+			ID:         meta,
+			DeviceID:   meta,
 			DeviceName: name,
 			Kind:       typ,
 			Scope:      scope,
-			Current:    sess.Meta == claims.DeviceID,
-			Online:     s.hub.Online(claims.UserID, sess.Meta),
+			Current:    meta == claims.DeviceID,
+			Online:     s.hub.Online(claims.UserID, meta),
 			CreatedAt:  sess.CreatedAt,
 			LastUsedAt: sess.LastUsedAt,
 		})
@@ -127,7 +144,7 @@ func (s *Server) handleSessionRevoke(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "missing id"})
 		return
 	}
-	status, ok := s.revokeDevice(r, claims.UserID, id)
+	status, ok := s.revokeDevice(r, claims.UserID, id, true)
 	if !ok {
 		writeJSON(w, status, map[string]string{"error": revokeErrorMsg(status)})
 		return
@@ -141,63 +158,62 @@ func (s *Server) handleSessionRevoke(w http.ResponseWriter, r *http.Request) {
 // (they are the same operation). The broker session id is resolved cache-first (the local row
 // holds the stable broker_sid) and falls back to R1 — the authoritative list — so a missing or
 // pruned cache row still revokes correctly and stays authorized to this user.
-func (s *Server) revokeDevice(r *http.Request, userID, deviceID string) (int, bool) {
-	sid, name := "", ""
+func (s *Server) revokeDevice(r *http.Request, userID, deviceID string, notifyRevoked bool) (int, bool) {
+	// Resolve the device name (for the live SSE kick + the cross-device revoke push). Cache-first
+	// (the local row holds the live name, which a decoupled rename keeps current); fall back to the
+	// broker R1 label for a row-less session.
+	name := ""
 	localRowOwned := false
 	if dev, err := s.queries.GetDevice(r.Context(), deviceID); err == nil && dev.UserID == userID {
-		sid = dev.BrokerSid
 		name = dev.Name
 		localRowOwned = true
 	}
-	if sid == "" {
-		sessions, err := s.broker.ListSessions(r.Context(), userID)
-		if err != nil {
-			slog.Error("revoke: list sessions failed", "err", err, "user", userID)
-			return http.StatusBadGateway, false
-		}
-		for _, sess := range sessions {
-			if sess.Meta == deviceID {
-				sid = sess.SID
-				name = sess.Label
-				break
+	if name == "" {
+		if sessions, err := s.broker.ListSessions(r.Context(), userID); err == nil {
+			for _, sess := range sessions {
+				if sess.Meta == deviceID {
+					name = sess.Label
+					break
+				}
 			}
 		}
 	}
-	if sid == "" {
-		// No broker session for this device_id. If we still own a local cache row, it is a stale /
-		// phantom entry — a synthetic test device (the Diag residue) or a row whose broker session
-		// is long gone. Drop the local row + kick + republish so the user can always clear such a
-		// device from their list; only a device_id we own nothing for is a genuine 404.
-		if !localRowOwned {
-			return http.StatusNotFound, false
-		}
-		if _, err := s.queries.DeleteDevice(r.Context(), db.DeleteDeviceParams{
-			DeviceID: deviceID,
-			UserID:   userID,
-		}); err != nil {
-			slog.Warn("delete phantom device cache failed", "err", err, "user", userID, "device", deviceID)
-		}
-		s.hub.Kick(userID, deviceID, name)
-		s.hub.PublishPresence(r.Context(), userID)
-		return http.StatusNoContent, true
-	}
-	// Revoke the broker session first so the device can't refresh; a 404 (already gone) is
-	// idempotent success inside RevokeSession.
-	if err := s.broker.RevokeSession(r.Context(), sid); err != nil {
-		slog.Error("broker revoke failed", "err", err, "user", userID, "sid", sid)
+
+	// Cascade-revoke the whole device by meta: the main session AND any subordinate (clipboard
+	// widget) sessions sharing this device_id, so no orphan sub-session survives to keep reading
+	// the clipboard. Idempotent — revoked:0 when the device's sessions are already gone.
+	revoked, err := s.broker.RevokeDeviceSessions(r.Context(), userID, deviceID)
+	if err != nil {
+		slog.Error("broker cascade revoke failed", "err", err, "user", userID, "meta", deviceID)
 		return http.StatusBadGateway, false
 	}
+	// Nothing revoked and we own no local row → a device_id we have nothing for is a genuine 404.
+	// (A phantom row with no broker session still owns a local row, so it falls through to cleanup
+	// below — the user can always clear such a stale entry from their list.)
+	if revoked == 0 && !localRowOwned {
+		return http.StatusNotFound, false
+	}
+
+	// 跨设备登出（非自登出）：推送告知被踢设备，使其立即知晓并清本地登录态——即便其页面 / app 已关闭，
+	// 也不必等下次请求 401 才发现。用一次性 context（请求 ctx 会随响应取消），best-effort 异步发。
+	if notifyRevoked && name != "" {
+		n := push.Notification{Type: push.KindSessionRevoked, Tag: "session:revoked"}
+		if s.push.Enabled() {
+			go s.push.Notify(context.Background(), userID, name, n)
+		}
+		if s.apns.Enabled() {
+			go s.apns.Notify(context.Background(), userID, name, n)
+		}
+	}
+	// Drop the local cache row (idempotent; non-fatal — the sweeper / next list-prune also clean it).
 	if _, err := s.queries.DeleteDevice(r.Context(), db.DeleteDeviceParams{
 		DeviceID: deviceID,
 		UserID:   userID,
 	}); err != nil {
-		// The session is already revoked; a failed cache delete is non-fatal (the sweeper
-		// and the next list-prune clean it). Report success so the client sees the logout.
 		slog.Warn("delete device cache failed", "err", err, "user", userID, "device", deviceID)
 	}
-	// Kick by the stable device_id (the hub key); name rides along for the code-less fallback
-	// path inside Kick. This makes cross-device revoke land reliably (the prior name-keyed Kick
-	// could miss a renamed device, leaving it able to keep refreshing — the "移除失败" symptom).
+	// Kick by the stable device_id (the hub key); name rides along for the code-less fallback path
+	// inside Kick, so a renamed device is still kicked reliably (the prior "移除失败" symptom).
 	s.hub.Kick(userID, deviceID, name)
 	s.hub.PublishPresence(r.Context(), userID)
 	return http.StatusNoContent, true
@@ -214,7 +230,7 @@ func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
 	}
 	claims, _ := jwtauth.ClaimsFromContext(r.Context())
 	if claims.DeviceID != "" {
-		if status, ok := s.revokeDevice(r, claims.UserID, claims.DeviceID); !ok && status != http.StatusNotFound {
+		if status, ok := s.revokeDevice(r, claims.UserID, claims.DeviceID, false); !ok && status != http.StatusNotFound {
 			slog.Warn("logout revoke failed", "status", status, "user", claims.UserID)
 		}
 	}