[kinqsradio]

Summary

• After the emailed code is spent, a failed key-store save keeps the keys and the session in PendingSignUp (memory only, wiped on drop).
• New retry_save(&mut pending) saves them with no server call; verify_sign_up again does the same whatever code is passed.
• A store that now holds a device is StoreNotEmpty; nothing to save is InvalidInput.
• Documents the fallback when the PendingSignUp is dropped first: the delete-unused link (docs/device-client.md).

Testing

• Full gate with Postgres: fmt, clippy, structure, wasm32, workspace tests (959 pass).
• Mutation checks: 4 mutations; 3 killed. The survivor (not clearing the held session after a successful save) is not observable by behavior: it only wipes the token sooner.
• Not tested: none

Co-authors

none

AI usage

• Written by hand, with no AI
• Harness and version: Claude Code 2.1.317
• Models: claude-sonnet-5-5 (all)
• Effort: medium
• Human role: set scope (reviewer's follow-up before real sign-in)
• Sources: none

Checklist

• Works on Windows, macOS and Linux
• docs/architecture.md with any rule change; generated wire types with any contract change
• No copied source, secrets, credentials or personal data; no AI attribution in commits, title or branch