[LIghtJUNction]

Refs #219, #82, #85.

Restoring local account files without their selection marker could silently use or create default. Listing accounts also created state and moved legacy credentials, while rejecting an unregistered account switch could still change the remembered service.

Changes:

• Require explicit selection when saved accounts exist without a current-account marker; preserve normal legacy singleton migration.
• Reject a selected account with missing state before automatic migration, and do not import another legacy handle into a selected empty account.
• Make account listing read-only, include partial restores, and reflect invocation-only account overrides accurately.
• Reject an unauthenticated account switch before saving a different service.
• Keep explicit recovery/import, existing keys, journals and account isolation covered by regression tests.
• Repair the pre-existing 3D root-page smoke failure: verify exact bundled bytes, canvas and accessible catalog instead of obsolete landing-page copy. CSP/font/HTTP assertions remain.

Validation:

• Baseline fa0d14a (implementation unchanged), service-alias run 36907335525: 9 new account-regression failures, 1 existing branding failure, 168 passed.
• The branding failure independently exists on main 4bbdbca in run 36904405959.
• Fixed head b31cc5b9c562477c089b4fc0bb598eef20121277, tree 32ae78ca1868024654212a68b358f8d5c2492f36: service-alias run 36908143997 passed 185 tests, including all 16 account-recovery cases, with zero failures/errors/skips. Artifact SHA-256, source head/tree and JUnit were downloaded and verified.
• Python quality 36908143927: Python 3.15.0rc2 / Ruff 0.16.9, zero diagnostics, empty stderr and all 717 files formatted; downloaded artifact digest/tree verified. Client-only installation, Post universe, Recovery safety and Storage session checks also passed.
• All 14 applicable PR workflows passed at this exact head. Rewrite contracts 36908143770: 3,166 core tests + 8 conformance, zero failures/errors/skips. Downloaded all eight shard ZIPs, verified their SHA-256/run/head, and checked exact JUnit node IDs form the complete disjoint suite; all 16 new recovery cases are present.
• Deployment rehearsal 36908144094: 12 installed-server checks, 7 real isolated OpenSSH/Git checks, all 42 official selftests, and client-only installation passed. Downloaded source/tree and artifact digest verified. Its wheel/sdist match the full-suite build byte-for-byte.
• Manual diff review completed; no inline review findings. Copilot exhausted its quota, so no external review approval is claimed.

Progress and recovery instructions: docs/CLIENT_ACCOUNT_RECOVERY_PROGRESS.md, docs/FILESYSTEM_LAYOUT.md.

No release or deployment. #219 remains open for separate server-account retirement and the remainder of full recovery acceptance.

Merged as 2ae1851a302465e3c9e40650838efa8081d488a8. The actual merged tree 32ae78ca1868024654212a68b358f8d5c2492f36 was read back and exactly matches the verified PR tree. Independent main push checks have started and are not included in the PR success claims above; no release or production deployment was performed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.