···143143 })?;
144144145145 // 5. Store tokens in Keychain.
146146- // If either token write fails, clean up the private key (best-effort) to avoid
147147- // orphaning a key on the relay with no tokens to access it.
146146+ // If session-token write fails, best-effort remove the already-written device-token.
147147+ // The device key is persistent by design and is NOT cleaned up on failure.
148148 keychain::store_item("device-token", body.device_token.as_bytes()).map_err(|_| {
149149 // device-token write failed — nothing to clean up; the device key is persistent by design.
150150 CreateAccountError::KeychainError