oauth_device keeps the IP address and user agent of every browser that signed in, but nothing ever deleted a row: account deletion cascaded only the oauth_account_device link, so the device row outlived the account, and the tranquil-store backend kept the link too. Every account deletion path (delete_account_complete, the admin one and delete_account_with_firehose; tranquil-store's shared delete path) now deletes, in the same transaction or write batch, the devices only that account is linked to. Devices another account also signs in on keep their row and just lose the link. A sweep on the scheduled delete-check tick removes devices unused for scheduled.oauth_device_retention_secs (OAUTH_DEVICE_RETENTION_SECS, default 90 days, 0 disables), and unlinked devices after a day: they are created when a sign-in starts, before any account is linked. Use is the newest of the device's last_seen_at, its account links' updated_at (bumped on every sign-in on it) and, on postgres, the updated_at of tokens issued through it (bumped on refresh); tokens in tranquil-store don't record their device. Devices still trusted for 2FA are kept until the trust ends. last_seen_at was never refreshed before; the authorize endpoints now bump it whenever they read the device cookie, and a cookie naming a swept device is treated as no cookie, so a sign-in can't hit the oauth_device foreign keys with a dead id. oauth_token.device_id and oauth_authorization_request.device_id are ON DELETE SET NULL, so deleting a device never ends a session. Tests: store_parity covers all three deletion paths and the sweep on both backends, plus postgres-only trust and token-refresh cases; a tranquil-store unit test covers the sweep with backdated links and a trusted device.