Disk cache entries deliberately carry no identity, so the new account-key
gate rejected every identified account during restore instead of telling
two of them apart: an early failed refresh discarded the cached quota and
the following encode erased it. The cache context fingerprint already pins
the selected account for that path, so reconcile now takes a scopeVerified
flag that restore sets, while the live refresh path keeps comparing keys.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>