@@ -29,6 +29,12 @@ export function makeQueryClient() {
       },
       mutations: {
         retry: false,
+        /**
+         * The default pauses a mutation started offline until reconnect. Nothing here persists or
+         * shows that queue: the caller just waits, holding a pending dialog open, and the action
+         * then runs long after the person gave up on it. Failing fast lets them see it and decide.
+         */
+        networkMode: 'always',
       },
     },
   })
 
@@ -37,6 +37,8 @@ export function useOrganizationRetention(orgId: string | undefined) {
     queryFn: ({ signal }) => fetchDataRetention(orgId as string, signal),
     enabled: Boolean(orgId),
     staleTime: DATA_RETENTION_STALE_TIME,
+    // A save re-reads this first: offline, that read must fail rather than wait and write on reconnect.
+    networkMode: 'always',
   })
 }
 
@@ -54,6 +56,9 @@ export function useUpdateOrganizationRetention() {
         params: { id: orgId },
         body: settings,
       }),
+    onSuccess: ({ data }, { orgId }) => {
+      queryClient.setQueryData(dataRetentionKeys.settings(orgId), data)
+    },
     onSettled: (_data, _error, { orgId }) => {
       queryClient.invalidateQueries({ queryKey: dataRetentionKeys.settings(orgId) })
     },
 
@@ -14,7 +14,7 @@ export async function listViewerOrganizationAccounts(input: {
   const accounts = await db
     .select({
       credentialId: credential.id,
-      accountId: credential.accountId,
+      providerSubjectId: credential.providerSubjectId,
       displayName: credential.displayName,
       status: credential.managedOauthStatus,
       groupId: credentialGroup.id,
 
@@ -9,6 +9,7 @@ export const MAX_CUSTOM_PII_PATTERNS = 20
  * removed rather than kept.
  */
 export function customPatternError(regex: string): string | undefined {
-  const validation = regex.length > 0 ? validateRegexPattern(regex) : null
-  return validation && !validation.valid ? validation.error : undefined
+  if (regex.length === 0) return 'Enter a regular expression, or remove this pattern'
+  const validation = validateRegexPattern(regex)
+  return validation.valid ? undefined : validation.error
 }
@@ -107,7 +107,7 @@ interface WidgetReadResult<T> {
 
 /** One account's read: which grant it is, and how many accounts this widget read is sharing. */
 interface ViewerAccountRead extends ProviderTokenInput {
-  accountId: string | null
+  providerSubjectId: string | null
   readableAccounts: number
   withToken: AccountTokenRead
 }
@@ -173,7 +173,8 @@ async function readViewerAccounts<T>(
 
   const results = await Promise.all(
     candidates.map(async (candidate) => {
-      const { credentialId, accountId, displayName, provider, providerId, status, read } = candidate
+      const { credentialId, providerSubjectId, displayName, provider, providerId, status, read } =
+        candidate
       const settled = (state: HomeWidgetAccount['state'], rows: T[] = []) => ({
         account: { credentialId, displayName, state },
         rows: rows.map((row) => ({ ...row, credentialId })),
@@ -186,7 +187,7 @@ async function readViewerAccounts<T>(
         const tokenInput = { context, credentialId, providerId }
         const account = {
           ...tokenInput,
-          accountId,
+          providerSubjectId,
           readableAccounts: toRead.size,
           withToken: createAccountTokenRead(tokenInput),
         }
@@ -261,7 +262,7 @@ export const readOrganizationHomeEmail = defineOrganizationAccountsUseCase({
           accessToken,
           signal,
           credentialId: account.credentialId,
-          accountId: account.accountId,
+          providerSubjectId: account.providerSubjectId,
           count: Math.ceil(HOME_EMAIL_THREAD_LIMIT / account.readableAccounts),
         })
         cursors.set(account.credentialId, { ...cursor, account })
 
@@ -83,7 +83,7 @@ async function readGmailThreads(input: { accessToken: string; signal: AbortSigna
   const { threads } = await readGmailThreadsPage({
     ...input,
     credentialId: `credential-${credentialCount}`,
-    accountId: 'account',
+    providerSubjectId: 'google-sub',
     count: HOME_EMAIL_THREAD_LIMIT,
   })
   return threads
@@ -296,7 +296,13 @@ describe('sharing a Gmail read across accounts', () => {
         : respond(gmailThread('t', [metadataMessage('Ada', 'S', 'P')]))
     )
     const read = (accessToken: string, credentialId: string) =>
-      readGmailThreadsPage({ accessToken, signal, credentialId, accountId: 'account', count: 1 })
+      readGmailThreadsPage({
+        accessToken,
+        signal,
+        credentialId,
+        providerSubjectId: 'google-sub',
+        count: 1,
+      })
     await read('token-a', 'mailbox-cached')
     const rotated = await read('token-b', 'mailbox-cached')
     expect(mailboxEmail).toHaveBeenCalledTimes(1)
@@ -305,23 +311,23 @@ describe('sharing a Gmail read across accounts', () => {
     expect(mailboxEmail).toHaveBeenCalledTimes(2)
   })
 
-  it('reads the mailbox again when a reconnect moves the credential to another account', async () => {
+  it('reads the mailbox again when a reconnect binds a credential that had no subject', async () => {
     providerFetch.mockImplementation(async (url: string) =>
       url.includes('/threads?')
         ? respond({ threads: [{ id: 't' }] })
         : respond(gmailThread('t', [metadataMessage('Ada', 'S', 'P')]))
     )
-    const read = (accountId: string) =>
+    const read = (providerSubjectId: string | null) =>
       readGmailThreadsPage({
         accessToken: 'token',
         signal,
         credentialId: 'mailbox-reconnected',
-        accountId,
+        providerSubjectId,
         count: 1,
       })
-    await read('account-old')
+    await read(null)
     mailboxEmail.mockResolvedValue('new@example.com')
-    const reconnected = await read('account-new')
+    const reconnected = await read('google-sub-new')
     expect(reconnected.threads[0].url).toBe(gmailThreadUrl('t', 'new@example.com'))
   })
 
@@ -338,7 +344,7 @@ describe('sharing a Gmail read across accounts', () => {
       accessToken: 'token',
       signal,
       credentialId: 'mailbox-parallel',
-      accountId: 'account',
+      providerSubjectId: 'google-sub',
       count: 1,
     })
     await vi.waitFor(() => expect(mailboxEmail).toHaveBeenCalledOnce())
@@ -358,7 +364,7 @@ describe('sharing a Gmail read across accounts', () => {
         accessToken: 't',
         signal,
         credentialId: 'mailbox-failed',
-        accountId: 'account',
+        providerSubjectId: 'google-sub',
         count: 1,
       })
     await expect(read()).rejects.toMatchObject({ failure: 'unavailable' })
 
@@ -175,9 +175,9 @@ function mailboxReadFailure(error: unknown): HomeProviderReadError {
 }
 
 /**
- * The address thread links open as. A reconnect can point a credential at another Google account, on
- * any instance, so the key names the account too. It holds only the address: the token itself is
- * resolved fresh for every read.
+ * The address thread links open as. A reconnect can bind a credential to a Google account it had no
+ * identity for, on any instance, so the key names the account's subject too. It holds only the
+ * address: the token itself is resolved fresh for every read.
  */
 const gmailMailboxes = new LRUCache<string, string>({
   max: 10_000,
@@ -188,9 +188,9 @@ async function readGmailMailbox({
   accessToken,
   signal,
   credentialId,
-  accountId,
-}: ProviderReadInput & { credentialId: string; accountId: string | null }) {
-  const key = `${credentialId}:${accountId}`
+  providerSubjectId,
+}: ProviderReadInput & { credentialId: string; providerSubjectId: string | null }) {
+  const key = `${credentialId}:${providerSubjectId}`
   const cached = gmailMailboxes.get(key)
   if (cached !== undefined) return cached
   const mailbox = await getGmailMailboxEmail(accessToken, { signal }).catch((error: unknown) => {
@@ -211,9 +211,13 @@ export async function readGmailThreads({
   accessToken,
   signal,
   credentialId,
-  accountId,
+  providerSubjectId,
   count,
-}: ProviderReadInput & { credentialId: string; accountId: string | null; count: number }): Promise<{
+}: ProviderReadInput & {
+  credentialId: string
+  providerSubjectId: string | null
+  count: number
+}): Promise<{
   threads: HomeEmailThread[]
   cursor: GmailThreadCursor
 }> {
@@ -223,7 +227,7 @@ export async function readGmailThreads({
       { accessToken, labelIds: 'INBOX', maxResults: HOME_EMAIL_THREAD_LIMIT },
       signal
     ),
-    readGmailMailbox({ accessToken, signal, credentialId, accountId }),
+    readGmailMailbox({ accessToken, signal, credentialId, providerSubjectId }),
   ])
   if (!list.success) throw new HomeProviderReadError('unavailable')
   const cursor: GmailThreadCursor = {
 
@@ -34,7 +34,9 @@ type DraftAction<T> =
 /**
  * An editing buffer over a value another tab or admin can change. A newer server value is adopted
  * while the draft is clean. While it is dirty the edits stay and `conflict` holds the choice, so a
- * refetch can neither overwrite an edit nor let a save overwrite a change the editor never saw.
+ * refetch cannot overwrite an edit. It knows only the values that reach it and checks no version: a
+ * save before a refetch lands can still overwrite a change the editor never saw, unless the caller
+ * re-reads the value at save or the route compares versions.
  */
 export function useServerDraft<T>({
   server,