Download MarkdownOriginal source on GitHub
Launch SDK account logout retry fix
Date: 2026-10-24. AUTH-07 has been fixed, and the account lifecycle entry points for Go, JavaScript, Python, C#, Java, Ruby, Rust, C, and C++ have been synced. SDK was not deployed, published, nor was Git submitted or pushed. This task did not modify the Launch or Licentivo server-side business code.
Action
Explicit logout first marks the account record in secure storage as “pending revocation only,” then calls the official SDK logout and submits the account session revocation to Launch. Regardless of network or cancellation status, the local runtime will stop and will not continue executing protected functions.
When Launch has not confirmed the revocation, the SDK keeps the original account credentials needed for pending tasks and retries, without treating it as a logged-in account. Another request with Logout, Login, or Restore will resume the revocation request; Restore will not take pending task identity or start an authorized runtime. The account is only removed from pending tasks after receiving a success response or an HTTP 401 indicating the original session is no longer valid for authentication. This way, even if a response is lost, it can be recovered, preventing cases where “the second logout returns success but the revocation was never submitted.”
Normal login records are still compatible with v2. Records to be revoked use a private v3 format; Java and Rust also removed the credential fields needed for normal login to prevent older SDKs from mistaking tasks as normal logins. Tasks do not store short-term identity assertions, license keys, or signed permissions.
Account tasks use the originally configured secure Store. Cross-process recovery requires persistent secure storage, such as Windows DPAPI or SDK-supported encrypted storage; the default MemoryStore only retains data in this process. Retry is triggered by subsequent login, recovery, or logout actions, with no new independent background tasks. Storage or revocation failures will return errors or pending results, without indicating success.
Device logout tickets for Licentivo SDK and .logout.json are still managed by it. Launch does not delete its cache directory and does not check device, feature, or offline permissions. Native examples and SDK documentation for each language have been updated simultaneously.
Verification
| Scope | Results |
|---|---|
| Launch Go source package | 185 test pass records, including subcases; no failures; go vet passed |
| Real Launch HTTP and MySQL | After the logout request is interrupted, secure tasks are retained; after rebuilding the SDK, login cannot be restored; after network recovery, submission of revocation is made, and authentication and identity interfaces for old tokens return denial |
| JavaScript | 10 items passed, including failed logout, rebuild recovery, and 401 confirmation |
| Python | 8 items passed, including local account cleanup after logout, rebuild recovery, and Windows DPAPI |
| C# | Lifecycle, task recovery, SDK logout log retention, and DPAPI check passed |
| Java | 7 sets of lifecycle and security tests passed, including offline logout retries |
| Ruby | Account lifecycle, task recovery, and encrypted storage regression passed |
| Rust | All local tests passed, including pending rebuild recovery and actual SDK runtime. |
| C / C++ | Actual signed SDK, offline rebuild recovery, 401 confirmation, DPAPI and C++ entry points all passed. |
| Licentivo current authorization fixed. | 45 test records passed with no failures or skips; includes negative notifications under policy drift, low-end device coordination, manual device limit, and existing authorization regression. |
| Embedded official SDK. | All 115 file hashes in the manifest match; no modification of authorization or encryption implementation. |
Launch source code regression ongoing; TestMySQLBaseline, TestProductUploadRoundTrip, TestInitialAdministratorMustChangePasswordBeforeAdministration, TestNewPaymentProvidersAndRegistrationWithoutMail tests that rely on other dedicated libraries were skipped, not counted as passed; this time SDK, account HTTP, purchase sync, and mapping processes were verified using an independent test library.
Two-end integration testing.
Using local independent MySQL 8.0.32, current Launch, Licentivo services and processes, actual Go Launch SDK and official authorization runtime, and DPAPI account storage, completed 15 business stages.
Added two types of exit failure verification:
- Request not delivered to Launch: Account logout interface temporarily returns 503. SDK stops local functions, real Licentivo device bindings released, pending account tasks retained. After rebuilding the SDK, it will still only retry logout; once the connection is restored, the original Launch session is revoked, and Licentivo confirms receiving the corresponding session notification.
- Server already revoked but reply lost: Launch has processed logout, test proxy replaced the response with 503. Pending tasks retained across SDK rebuilds; after restoring the connection, the original session is confirmed invalid via HTTP 401 and the pending tasks are deleted. During the process, no relogin or device reactivation occurs.
The remaining stages cover the operation of actual purchase synchronization and signature features, normal shutdown recovery, normal exit, remote unbinding, previous generations, renewal refunds, account cancellation and re-login, full refund rejection operation, refund recovery, chargeback, and large document translation regression. The three updates of Licentivo are provided by their responsible party, and this task only constructs and verifies them.
Payment channels and DeepL use isolated simulation services, without real deductions, refunds, or paid translations. Real joint service verification uses Go; other languages complete local SDK regression, without claiming that nine languages individually completed a set of real service deployment acceptance.
192.168.2.177 was not accessed in this round. MySQL and Licentivo temporary processes have stopped, and original services and test evidence are retained. Original materials are in .local/logout-retry-fix-20261024/, summary and source code hashes see Verification Evidence .