feat: recall an already-registered address without REGISTER

web/js/app.js

@@ -883,6 +883,37 @@ $("register-form").onsubmit = async (event) => {
   }
 };
 
+// Restoring a seed brings back the identity, not the memory of what address a
+// *different* browser registered it under — "account" is local-only state,
+// never asked of the server. This binds it without REGISTER: RESOLVE the
+// address and require it name this exact key, so a typo or someone else's
+// address can't silently misfile outgoing Reply-To / fetch under it.
+$("recall-form").onsubmit = async (event) => {
+  event.preventDefault();
+  const form = event.target;
+  try {
+    const me = store.identity();
+    if (!me) throw new SmolError("no identity yet");
+    const addr = parseAddress(form.address.value.trim());
+    const opened = await connect(addr, { requirePin: true });
+    let current;
+    try {
+      ({ identity: current } = await resolveOp(opened.session, addr.user));
+    } finally {
+      opened.session.stream.close();
+    }
+    if (!timingSafeEqual(current, me.publicKey))
+      throw new SmolError(`${addr.short} resolves to a different key — not this identity`);
+    store.setAccount(addr);
+    status(`recalled ${addr.short}\nshare: ${addr.uri(me.publicKey)}`);
+    renderAccount();
+    renderSettings();
+    form.reset();
+  } catch (err) {
+    status(err.message, true);
+  }
+};
+
 async function rotateIdentity() {
   const me = store.identity();
   const addr = accountAddress();