[xservzeroman]

Stacked on #124.

Saleh, test266: "after signing in with an email with no Xbox account you can't sign out to start fresh."

Root cause

Xbox.pollSignIn() saved the Microsoft tokens, then ran try { webAuth(ctx) } catch {}, which swallowed the XSTS refusal (401 with XErr 2148916233 for "no Xbox profile"). So the app ended "Signed in" with no gamertag. Sign out existed. But "Open the page" used the phone's browser, which was still logged in to that Microsoft account at microsoft.com/link, so the next sign-in went straight back to the same account.

Fix (shared sign-in, so the handheld and the TV both get it)

• Profile check: after the token arrives, XSTS is checked right away.
  • XErr 2148916233 (no profile), 2148916238 (child account), 2148916235 (country), 2148916236/7 (age verification), 2148916227 (banned), 2148916229 (parental settings), or any other 401/403: the tokens are dropped (signOut) and Xbox.ProfileError carries a plain message, e.g. "This Microsoft account has no Xbox profile. Sign in with the account you use on your Xbox."
  • Network errors: the sign-in is kept and marked unverified. The handheld says Xbox network couldn't be reached.
• Broken state: Settings → Xbox shows "Signed in, no Xbox profile" when signed in with no gamertag and not unverified. Sign out is picked in its question (handheld and TV).
• Handheld: new XboxSignInActivity. It opens https://www.microsoft.com/link?otc=<code> in a WebView inside MoonCast, after clearing cookies and web storage every time, so no remembered account. It closes itself when the poll succeeds or the profile check fails, and Close returns to the code card. Xbox.signOut() clears those cookies too.
• TV: the code card is wider and shows:
  • a QR code for microsoft.com/link?otc=<code>, generated on the device by Qr.kt, a compact port of Project Nayuki's QR Code generator (MIT; added to Licences with its text);
  • the line "To use a different Microsoft account, open the page in a private browser window."

Testing

• Compiles: debug test267, handheld and TV.
• QR encoder: compiled standalone. A v4 code for https://www.microsoft.com/link?otc=ABCD1234 and a v9 multi-block one both decode correctly with zxing-cpp (EC level M).
• Handheld test267 is installed on the Odin, not opened (its lock screen was in front).
• Not tested: a real sign-in with a non-Xbox account (needs Saleh). The TV card wasn't seen on screen: the Streamer had the Moro launcher in front, not MoonCast's home, so no screencap.

🤖 Generated with Claude Code