@@ -3,17 +3,22 @@ import {
   confirmPhraseAccess,
   createBackupPasskey,
   createRecoverablePasskeyBackup,
+  describeStoreStatus,
   enableSyncBackup,
+  getRuntimeDiagnostics,
   isAccountReplacementError,
   isAuthError,
   isRecoverablePasskeyError,
   isRecoveryError,
+  isSyncOwnerError,
   readAccountSession,
   restoreFromPasskey,
   restoreFromRecoveryPhrase,
   revealRecoveryPhrase,
+  runtimeRecreatedEvent,
   type Session,
   stopSyncBackup,
+  subscribeRuntimeDiagnostics,
 } from "@nzip/lofi";
 import { encodeSharingIdentity } from "@nzip/lofi/access";
 import { TicketEnrollForm } from "@nzip/lofi/preact";
@@ -54,6 +59,7 @@ function describe(error: unknown): string {
   }
   if (isRecoveryError(error)) return error.message;
   if (isRecoverablePasskeyError(error) || isAccountReplacementError(error)) return error.message;
+  if (isSyncOwnerError(error)) return error.message;
   return error instanceof Error ? error.message : String(error);
 }
 
@@ -74,9 +80,19 @@ export default function AccountGate() {
   // so the phrase block can say so honestly rather than imply a confirmation.
   const [unguarded, setUnguarded] = useState(false);
 
+  const [diagnostics, setDiagnostics] = useState(getRuntimeDiagnostics());
+
   useEffect(() => {
-    void readAccountSession().then(setSession, (cause) => setError(describe(cause)));
+    const refresh = () =>
+      void readAccountSession().then(setSession, (cause) => setError(describe(cause)));
+    refresh();
+    // Electing sync, stopping it, or restoring an account recreates the
+    // runtime; a snapshot read once on mount would keep rendering the old
+    // account state over the new reality.
+    globalThis.addEventListener(runtimeRecreatedEvent, refresh);
+    return () => globalThis.removeEventListener(runtimeRecreatedEvent, refresh);
   }, []);
+  useEffect(() => subscribeRuntimeDiagnostics(() => setDiagnostics(getRuntimeDiagnostics())), []);
 
   // Every account action funnels through here: one busy flag, one error line,
   // and any returned Session becomes the new snapshot.
@@ -182,6 +198,41 @@ export default function AccountGate() {
     </>
   );
 
+  // Sync on this device was elected by a different account: the runtime booted
+  // with transport suppressed so neither store can merge into the other. The
+  // two remediations are exactly the actions offered here — stop syncing
+  // releases the election for the current account, restore adopts the owner.
+  if (session.syncOwnerMismatch) {
+    const owner = diagnostics.syncOwner.state === "mismatch"
+      ? diagnostics.syncOwner.owner_user_id
+      : null;
+    return (
+      <section class="account account-out" aria-labelledby="account-title">
+        <header>
+          <p class="eyebrow">Account</p>
+          <h2 id="account-title">Sync paused — set up by a different account</h2>
+        </header>
+        <p>
+          Sync on this device was set up by{" "}
+          {owner ? <code>{owner}</code> : "a different account"}, so nothing connects — syncing now
+          would merge two accounts&rsquo; data. Stop syncing to release this device for the current
+          account, or restore the owning account to resume where it left off.
+        </p>
+        <div class="account-actions">
+          <button
+            type="button"
+            disabled={disabled}
+            onClick={() => run("stop", stopSyncBackup)}
+          >
+            {busy === "stop" ? "Stopping…" : "Stop syncing & release this device"}
+          </button>
+        </div>
+        {restoreBlock}
+        {error && <p class="account-error" role="alert">{error}</p>}
+      </section>
+    );
+  }
+
   // No sync location yet: offer the connect step, with restore available so a
   // fresh device recovers its identity before or after choosing where to sync.
   if (!session.syncAvailable) {
@@ -228,6 +279,16 @@ export default function AccountGate() {
     </div>
   );
 
+  // A definite store problem is worth a line here, not only in the device
+  // report: the account panel is where the user just acted, and each of these
+  // states means writes are not replicating despite sync being on.
+  const storeStatus = diagnostics.storeStatus;
+  const storeProblem = storeStatus.state === "no_schema" ||
+      storeStatus.state === "ticket_rejected" ||
+      storeStatus.state === "store_unavailable"
+    ? describeStoreStatus(storeStatus)
+    : null;
+
   if (session.backedUp) {
     return (
       <section class="account account-in" aria-labelledby="account-title">
@@ -246,6 +307,11 @@ export default function AccountGate() {
             Share identity: <code data-sharing-identity>{sharingIdentity}</code>
           </p>
         )}
+        {storeProblem && (
+          <p class="account-note" role="alert">
+            Sync location: {storeProblem}. See the device report for details.
+          </p>
+        )}
         <div class="account-actions">
           {!session.passkeyRecoverable && (
             <button
 
@@ -15,7 +15,7 @@ import { describeStorageFork, dismissStorageFork } from "../runtime/storage-fork
 import { useStorageFork } from "./use-storage-fork.ts";
 import { readSession, type Session } from "../runtime/session.ts";
 import { readSinkRestoreOutcome } from "../runtime/data-sink.ts";
-import { describeStoreStatus } from "../runtime/store-status.ts";
+import { describeStoreStatus, type RuntimeStoreStatus } from "../runtime/store-status.ts";
 import { RuntimeRecovery } from "./RuntimeRecovery.tsx";
 
 // One label/value row inside a category's definition list.
@@ -30,6 +30,30 @@ function Row({ label, value }: { label: string; value: string }): VNode {
 
 const available = (present: boolean) => (present ? "available" : "missing");
 
+/**
+ * The one-line Data sync verdict. The blocked dispositions are first-class —
+ * the report must say *why* nothing is syncing, not merely that it is not:
+ * the election belongs to another account, the store refused (no schema, or
+ * the ticket is no longer accepted), the declared sink's sealed record cannot
+ * be opened on this device, or no sync location exists at all. Exported for
+ * tests; the entry does not re-export it.
+ */
+export function describeSyncState(input: {
+  syncing: boolean;
+  syncAvailable: boolean;
+  ownerMismatch: boolean;
+  storeState: RuntimeStoreStatus["state"];
+  sinkUnopenable: boolean;
+}): string {
+  if (input.ownerMismatch) return "paused — sync belongs to another account on this device";
+  if (input.storeState === "no_schema") return "blocked — store has no schema for this app";
+  if (input.storeState === "ticket_rejected") return "blocked — ticket no longer accepted";
+  if (input.sinkUnopenable) return "blocked — sync location record unopenable";
+  if (input.syncing) return "syncing to your account";
+  if (input.syncAvailable) return "available — not yet backed up";
+  return "local-only";
+}
+
 /**
  * Renders the Device gate: every subsystem's live status — storage, sync,
  * auth, and PWA — grouped by the module that owns it, so the panel doubles
@@ -72,6 +96,8 @@ export function DeviceStatus(): VNode {
   if (!report) return <p class="device-status">Checking device capabilities…</p>;
 
   const synced = Boolean(session?.syncAvailable);
+  const ownerMismatch = Boolean(session?.syncOwnerMismatch);
+  const syncOwner = runtimeDiagnostics.syncOwner;
   const sinkUnopenable = !session?.sink && readSinkRestoreOutcome() === "unopenable";
   const sinkState = session?.sink
     ? session.sink.source === "declared"
@@ -80,11 +106,13 @@ export function DeviceStatus(): VNode {
     : sinkUnopenable
     ? "declared — record unopenable on this device"
     : "not configured";
-  const syncState = session?.syncing
-    ? "syncing to your account"
-    : session?.syncAvailable
-    ? "available — not yet backed up"
-    : "local-only";
+  const syncState = describeSyncState({
+    syncing: Boolean(session?.syncing),
+    syncAvailable: synced,
+    ownerMismatch,
+    storeState: runtimeDiagnostics.storeStatus.state,
+    sinkUnopenable,
+  });
   const backupState = session?.backedUp
     ? "recovery phrase"
     : session?.syncAvailable
@@ -140,6 +168,20 @@ export function DeviceStatus(): VNode {
           <Row label="Sync location" value={sinkState} />
           <Row label="Store" value={describeStoreStatus(runtimeDiagnostics.storeStatus)} />
         </dl>
+        {ownerMismatch && (
+          <p>
+            Sync on this device was set up by{" "}
+            {syncOwner.state === "mismatch" && syncOwner.owner_user_id
+              ? (
+                <>
+                  the account <code>{syncOwner.owner_user_id}</code>
+                </>
+              )
+              : "a different account"}. Nothing connects while the accounts differ, so neither store
+            can merge into the other. Stop syncing in the account panel to release this device for
+            the current account, or restore the owning account to resume.
+          </p>
+        )}
         {runtimeDiagnostics.storeStatus.state === "no_schema" && (
           <p>{runtimeDiagnostics.storeStatus.message}</p>
         )}
@@ -158,10 +200,12 @@ export function DeviceStatus(): VNode {
             data is intact and pushes up.
           </p>
         )}
-        {!synced && (
+        {!synced && !ownerMismatch && (
           <p>
-            Set <code>JAZZ_APP_ID</code> and <code>JAZZ_SERVER_URL</code> in <code>.env</code>{" "}
-            and rebuild, or enroll a sync ticket at runtime, to replicate writes to your account.
+            Enroll an app-connect ticket from your node to replicate writes to your account — a
+            saved ticket autofills from your password manager. Building with{" "}
+            <code>JAZZ_APP_ID</code> and <code>JAZZ_SERVER_URL</code> in <code>.env</code>{" "}
+            remains the compiled-in alternative.
           </p>
         )}
       </div>
 
@@ -0,0 +1,47 @@
+import { describeSyncState } from "./DeviceStatus.tsx";
+
+// The report's contract after the sync-state integrity pass: a reader must be
+// able to tell *why* nothing is syncing. Each blocked disposition names its
+// cause, and the precedence puts the most specific cause first — an owner
+// mismatch explains more than a store answer, a store refusal more than a
+// missing sink.
+Deno.test("describeSyncState names each blocked disposition first-class", () => {
+  const base = {
+    syncing: false,
+    syncAvailable: false,
+    ownerMismatch: false,
+    storeState: "unchecked" as const,
+    sinkUnopenable: false,
+  };
+  const cases: [Parameters<typeof describeSyncState>[0], string][] = [
+    [{ ...base, ownerMismatch: true, syncing: true }, "another account"],
+    [{ ...base, storeState: "no_schema", syncing: true }, "no schema"],
+    [{ ...base, storeState: "ticket_rejected", syncing: true }, "ticket no longer accepted"],
+    [{ ...base, sinkUnopenable: true }, "unopenable"],
+    [{ ...base, syncing: true, syncAvailable: true }, "syncing to your account"],
+    [{ ...base, syncAvailable: true }, "not yet backed up"],
+    [base, "local-only"],
+  ];
+  for (const [input, needle] of cases) {
+    const verdict = describeSyncState(input);
+    if (!verdict.includes(needle)) {
+      throw new Error(`disposition lost its cause: ${JSON.stringify(input)} → ${verdict}`);
+    }
+  }
+});
+
+// The owner mismatch outranks every other explanation: transport is suppressed
+// because of it, so store-level answers describe a connection that is not
+// being attempted.
+Deno.test("describeSyncState puts the owner mismatch above store answers", () => {
+  const verdict = describeSyncState({
+    syncing: true,
+    syncAvailable: true,
+    ownerMismatch: true,
+    storeState: "no_schema",
+    sinkUnopenable: false,
+  });
+  if (!verdict.includes("another account")) {
+    throw new Error(`owner mismatch was outranked: ${verdict}`);
+  }
+});
@@ -7,7 +7,8 @@ import {
   type SealOutcome,
   sealProvisionCapability,
 } from "../runtime/provision.ts";
-import { enrollSyncTicket, type Session } from "../runtime/session.ts";
+import { enrollSyncTicket, isSyncEnrollmentError, type Session } from "../runtime/session.ts";
+import { isSyncOwnerError } from "../runtime/sync-owner.ts";
 
 /** Dependencies {@link TicketEnrollForm} accepts for testing and composition. */
 export interface TicketEnrollFormProps {
@@ -21,6 +22,22 @@ export interface TicketEnrollFormProps {
   readonly seal?: () => Promise<SealOutcome>;
 }
 
+/**
+ * Turns an enrollment failure into the sentence the form shows. The typed
+ * refusals carry user-presentable messages that name their remediation — a
+ * refused store preflight ({@link isSyncEnrollmentError}), a sync election
+ * owned by another account ({@link isSyncOwnerError}), and malformed or
+ * conflicting tickets ({@link isDataSinkError}) — so those pass through
+ * verbatim; only an unrecognized failure gets the generic retry line.
+ * Exported for tests; the entry does not re-export it.
+ */
+export function describeEnrollmentProblem(error: unknown): string {
+  if (isSyncEnrollmentError(error) || isSyncOwnerError(error) || isDataSinkError(error)) {
+    return error.message;
+  }
+  return "Enrollment failed; check the ticket and the node, then paste it again.";
+}
+
 type Phase =
   | { name: "edit"; problem?: string }
   | { name: "enrolling" }
@@ -101,10 +118,7 @@ export function TicketEnrollForm({
       setPhase({ name: "enrolled", sealOffer: provision.held && !provision.sealed });
       onEnrolled?.(session);
     } catch (error) {
-      const problem = isDataSinkError(error)
-        ? error.message
-        : "Enrollment failed; check the ticket and the node, then paste it again.";
-      setPhase({ name: "edit", problem });
+      setPhase({ name: "edit", problem: describeEnrollmentProblem(error) });
     }
   }
 
 
@@ -1,5 +1,7 @@
 import { render } from "npm:preact-render-to-string@6.7.0";
-import { TicketEnrollForm } from "./TicketEnrollForm.tsx";
+import { describeEnrollmentProblem, TicketEnrollForm } from "./TicketEnrollForm.tsx";
+import { SyncEnrollmentError } from "../runtime/session.ts";
+import { SyncOwnerError } from "../runtime/sync-owner.ts";
 
 // The form's manager-facing semantics are the contract: password managers key
 // on a real form with a current-password field, a username companion, and a
@@ -20,6 +22,33 @@ Deno.test("TicketEnrollForm renders password-manager-compatible form semantics",
   }
 });
 
+// The typed refusals carry their own remediation; the form must not flatten
+// them into the generic "paste it again" line — re-pasting cannot fix an
+// unprovisioned store or a foreign sync owner.
+Deno.test("describeEnrollmentProblem relays typed refusals verbatim", () => {
+  const cases: [Error, string][] = [
+    [new SyncEnrollmentError("no_schema", "sync"), "no schema deployed"],
+    [new SyncEnrollmentError("ticket_rejected"), "revoked or the node was reset"],
+    [new SyncOwnerError("alice"), "set up by a different account"],
+  ];
+  for (const [error, needle] of cases) {
+    const problem = describeEnrollmentProblem(error);
+    if (problem !== error.message) {
+      throw new Error(`typed refusal was rewritten: ${problem}`);
+    }
+    if (!problem.includes(needle)) {
+      throw new Error(`refusal message lost its remediation: ${problem}`);
+    }
+  }
+});
+
+Deno.test("describeEnrollmentProblem keeps the generic line for unknown failures", () => {
+  const problem = describeEnrollmentProblem(new TypeError("fetch failed"));
+  if (!problem.includes("check the ticket and the node")) {
+    throw new Error(`unknown failure leaked internals: ${problem}`);
+  }
+});
+
 Deno.test("TicketEnrollForm states the custody story without overclaiming", () => {
   const html = render(<TicketEnrollForm />);
   if (!html.includes("bearer credential")) {