fix: clean up replicatedInstances and registry on federation identity deletion

After deleting a federated identity, the server-side user_federation_registry
and users.replicated_instances were not cleaned up, causing "already connected"
errors when trying to re-federate. The deletion endpoint now authoritatively
removes both the registry row and the replicatedInstances entry, and bumps the
LWW timestamp to prevent stale client syncs from re-inserting them.

Also extends the endpoint to accept mode 'leave' (skip S2S, just clean up),
and enables the "Select instances..." scope option in DeleteIdentityDialog.

packages/server/src/routes/users.ts

@@ -610,8 +610,8 @@ export async function userRoutes(app: FastifyInstance): Promise<void> {
   }, async (request, reply) => {
     const { origins, mode } = request.body;
 
-    if (!mode || !['soft', 'full'].includes(mode)) {
-      return reply.code(400).send({ error: 'Invalid mode: must be "soft" or "full"', statusCode: 400 });
+    if (!mode || !['leave', 'soft', 'full'].includes(mode)) {
+      return reply.code(400).send({ error: 'Invalid mode: must be "leave", "soft", or "full"', statusCode: 400 });
     }
     if (!Array.isArray(origins) || origins.length === 0 || !origins.every(o => typeof o === 'string')) {
       return reply.code(400).send({ error: 'origins must be a non-empty array of strings', statusCode: 400 });
@@ -625,7 +625,11 @@ export async function userRoutes(app: FastifyInstance): Promise<void> {
 
     await Promise.all(origins.map(async (origin) => {
       try {
-        // Look up peer
+        // Leave mode: no S2S call, just clean up the registry entry
+        if (mode === 'leave') {
+          results[origin] = { success: true };
+        } else {
+          // Soft/full mode: S2S relay to remote instance
           const peer = db
             .select()
             .from(schema.federationPeers)
@@ -637,7 +641,6 @@ export async function userRoutes(app: FastifyInstance): Promise<void> {
             return;
           }
 
-        // Build HMAC-signed request
           const body = JSON.stringify({
             homeUserId: request.userId,
             homeInstance,
@@ -646,7 +649,6 @@ export async function userRoutes(app: FastifyInstance): Promise<void> {
 
           const headers = buildFederationHeaders(body, peer.hmacSecret, ourOrigin);
 
-        // Send to remote with 15s timeout
           const controller = new AbortController();
           const timeout = setTimeout(() => controller.abort(), 15_000);
 
@@ -684,6 +686,22 @@ export async function userRoutes(app: FastifyInstance): Promise<void> {
               results[origin] = { success: false, error: 'unreachable' };
             }
           }
+        }
+
+        // On success, authoritatively remove the registry entry and bump LWW timestamp
+        if (results[origin]?.success) {
+          db.delete(schema.userFederationRegistry)
+            .where(and(
+              eq(schema.userFederationRegistry.userId, request.userId),
+              eq(schema.userFederationRegistry.origin, origin),
+            ))
+            .run();
+
+          db.update(schema.users)
+            .set({ federationRegistryUpdatedAt: Date.now() })
+            .where(eq(schema.users.id, request.userId))
+            .run();
+        }
       } catch (err) {
         results[origin] = {
           success: false,
@@ -692,6 +710,27 @@ export async function userRoutes(app: FastifyInstance): Promise<void> {
       }
     }));
 
+    // Remove successful origins from the user's replicatedInstances JSON column
+    const successfulOrigins = Object.entries(results)
+      .filter(([, r]) => r.success)
+      .map(([o]) => o);
+
+    if (successfulOrigins.length > 0) {
+      const user = db.select({ replicatedInstances: schema.users.replicatedInstances })
+        .from(schema.users)
+        .where(eq(schema.users.id, request.userId))
+        .get();
+
+      if (user?.replicatedInstances) {
+        const parsed: ReplicatedInstance[] = JSON.parse(user.replicatedInstances);
+        const filtered = parsed.filter(ri => !successfulOrigins.includes(ri.origin));
+        db.update(schema.users)
+          .set({ replicatedInstances: JSON.stringify(filtered) })
+          .where(eq(schema.users.id, request.userId))
+          .run();
+      }
+    }
+
     const response: FederationIdentityDeleteResponse = { results };
     return reply.code(200).send(response);
   });

packages/shared/src/types.ts

@@ -710,7 +710,7 @@ export interface DeleteAccountRequest {
 
 export interface FederationIdentityDeleteRequest {
   origins: string[];
-  mode: 'soft' | 'full';
+  mode: 'leave' | 'soft' | 'full';
 }
 
 export interface FederationIdentityDeleteResult {

packages/web/src/components/modals/ConnectedInstances.tsx

@@ -427,6 +427,7 @@ function DeleteIdentityDialog({
   const registry = useInstanceStore((s) => s.registry);
   const [mode, setMode] = useState<DeletionMode>('leave');
   const [scope, setScope] = useState<DeletionScope>('this');
+  const [selectedOrigins, setSelectedOrigins] = useState<Set<string>>(new Set());
   const [loading, setLoading] = useState(false);
 
   const handleConfirm = async () => {
@@ -434,6 +435,8 @@ function DeleteIdentityDialog({
     let targetOrigins: string[];
     if (scope === 'all') {
       targetOrigins = Array.from(registry.keys());
+    } else if (scope === 'select') {
+      targetOrigins = Array.from(selectedOrigins);
     } else {
       targetOrigins = [origin];
     }
@@ -564,7 +567,7 @@ function DeleteIdentityDialog({
           <div className="flex gap-1.5">
             {([
               { key: 'this' as DeletionScope, label: 'This instance only', disabled: false },
-              { key: 'select' as DeletionScope, label: 'Select instances...', disabled: true },
+              { key: 'select' as DeletionScope, label: 'Select instances...', disabled: false },
               { key: 'all' as DeletionScope, label: 'All remote instances', disabled: false },
             ]).map((opt) => (
               <button
@@ -587,6 +590,37 @@ function DeleteIdentityDialog({
           </div>
         </div>
 
+        {/* Instance picker for 'select' scope */}
+        {scope === 'select' && (
+          <div className="mb-4 p-2 bg-surface-input rounded-lg max-h-40 overflow-y-auto scrollbar-thin space-y-0.5">
+            {Array.from(registry.values()).map((entry) => {
+              const checked = selectedOrigins.has(entry.origin);
+              return (
+                <label
+                  key={entry.origin}
+                  className="flex items-center gap-2.5 px-2 py-1.5 rounded hover:bg-interactive-hover transition-colors cursor-pointer"
+                >
+                  <input
+                    type="checkbox"
+                    checked={checked}
+                    onChange={() => {
+                      setSelectedOrigins((prev) => {
+                        const next = new Set(prev);
+                        if (checked) next.delete(entry.origin);
+                        else next.add(entry.origin);
+                        return next;
+                      });
+                    }}
+                    disabled={loading}
+                    className="accent-accent-lavender w-3.5 h-3.5 shrink-0"
+                  />
+                  <span className="text-xs text-txt-secondary truncate">{safeHost(entry.origin)}</span>
+                </label>
+              );
+            })}
+          </div>
+        )}
+
         {/* Actions */}
         <div className="flex gap-3">
           <button
@@ -598,7 +632,7 @@ function DeleteIdentityDialog({
           </button>
           <button
             onClick={handleConfirm}
-            disabled={loading}
+            disabled={loading || (scope === 'select' && selectedOrigins.size === 0)}
             className="flex-1 py-2.5 bg-accent-rose hover:bg-accent-rose/80 text-white text-sm font-medium rounded-lg transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
           >
             {loading ? 'Deleting...' : mode === 'leave' ? 'Disconnect' : 'Delete Identity'}

packages/web/src/stores/instanceStore.ts

@@ -704,15 +704,6 @@ export const useInstanceStore = create<InstanceState>((set, get) => ({
   },
 
   deleteIdentity: async (origins: string[], mode: 'leave' | 'soft' | 'full' = 'leave') => {
-    // Leave mode: client-only cleanup, no server call
-    if (mode === 'leave') {
-      for (const origin of origins) {
-        get().forceRemoveEntry(origin);
-      }
-      return Object.fromEntries(origins.map(o => [o, { success: true as const }]));
-    }
-
-    // Soft/full mode: S2S relay via home instance
     try {
       const { results } = await api.users.deleteFederationIdentity({ origins, mode });