@@ -16,7 +16,9 @@ reduced to passing capability flags into the host.
    (`runtime-environment.ts`) *before* the host is built, so `getRuntimeRegion()`,
    `getRuntimeBuildEnv()` and `isManagedRuntime()` see the same scope the credential reader served.
    The WebUI does this for itself because ADR 0003 forbids importing the terminal client's module. A
-   start with no client-side login falls back to the harness defaults (`en` / `dev`, not managed).
+   A complete explicit environment pair wins, otherwise it resolves the live OAuth namespace. A
+   fresh install with no account scope defaults to `cn/prod`, so the login page reaches the
+   production account service instead of the old `en/dev` placeholder endpoint.
 3. **Create the one OAuth core, its lease and its refresh timer** (`auth-session.ts`). It reads the
    shared `mcode login` credential, so a browser session never signs in again. A failure here aborts
    the boot before any host exists.
 
@@ -399,6 +399,14 @@ export interface WebuiAccountWorkflows {
   /** Claim today's check-in; records the result for the menu's animation. */
   readonly claimSignin: () => Promise<void>;
 
+  /**
+   * Read the persisted login state without starting a device flow.
+   *
+   * The login page asks this first: an account that is already signed in is
+   * offered the switch, not a second sign-in. It reads the store and changes
+   * nothing.
+   */
+  readonly loadLoginStatus: () => Promise<void>;
   /** Begin a device-authorization flow and start polling its status. */
   readonly beginLogin: () => Promise<void>;
   /** Cancel the in-flight attempt, stop polling and reset the view to idle. */
@@ -622,6 +630,18 @@ export function createWebuiAccountWorkflows(deps: {
     );
   };
 
+  const loadLoginStatus = async (): Promise<void> => {
+    const read = port.getAccountLoginStatus;
+    if (!read) return;
+    try {
+      const view = await read();
+      applyLoginView(view);
+    } catch {
+      // A status that cannot be read leaves the page where it is. The page
+      // offers a sign-in, and the attempt that follows reports its own error.
+    }
+  };
+
   const beginLogin = async (): Promise<void> => {
     stopLoginPolling();
     const begin = port.beginAccountLogin;
@@ -1183,6 +1203,12 @@ export function createWebuiAccountWorkflows(deps: {
       // identity cannot land as current.
       lastCredentialFingerprint = undefined;
       afterCredentialChange();
+      // The sign-in state belonged to the account that just left. A page that
+      // still reads as signed in would offer a switch instead of a sign-in.
+      set((current) => ({
+        ...current,
+        login: { ...current.login, view: { state: "idle" } },
+      }));
       // The account and quota answers belong to the account that just left:
       // re-read both so no surface keeps showing the previous identity.
       await Promise.all([loadAccount(), loadUsage(true)]);
@@ -1257,6 +1283,7 @@ export function createWebuiAccountWorkflows(deps: {
     redeemResetCard,
     loadSigninPanel,
     claimSignin,
+    loadLoginStatus,
     beginLogin,
     cancelLogin,
     stopLoginPolling,
 
@@ -0,0 +1,60 @@
+// Which phase the account login page is in.
+//
+// The Desktop's login page is a state machine of its own: signed out, opening
+// the browser, waiting for the authorization, failed. This module derives
+// those states from the server's answer so the page renders a phase rather
+// than reading the answer's shape.
+//
+// It is a separate derivation from `login-phase.ts` on purpose. The compact
+// sign-in dialog and the page are two different surfaces over one answer: the
+// dialog opens a flow the moment it appears, so "idle" is a state it passes
+// through and never rests in, while the page waits for the user to ask for a
+// sign-in — so "idle" is the page's own resting state, and it means the
+// account is signed out.
+
+import type { WebuiAccountLoginView } from "../../../../shared/contracts/account.js";
+
+/** Everything the login page can show, derived (not fetched). */
+export type WebuiAccountLoginPagePhase =
+  /** Nobody is signed in; the page offers the sign-in. */
+  | { readonly kind: "signed-out" }
+  /** A device flow is running and the code has not arrived yet. */
+  | { readonly kind: "opening" }
+  /** A device code is waiting; the authorization page can be opened. */
+  | {
+      readonly kind: "awaiting";
+      readonly verificationUri: string;
+    }
+  /** The account is signed in. */
+  | { readonly kind: "authenticated" }
+  /** The attempt failed. */
+  | { readonly kind: "error"; readonly error: string };
+
+/**
+ * Derive the page's phase from the server's answer.
+ *
+ * `undefined` means the answer has not arrived yet. It reads as "signed out"
+ * because that is the state the page rests in, and the page disables its call
+ * to action until the answer lands — a page that offered a sign-in before it
+ * knew whether one was needed would offer a second sign-in to somebody who is
+ * already signed in.
+ */
+export function deriveWebuiAccountLoginPagePhase(
+  view: WebuiAccountLoginView | undefined,
+): WebuiAccountLoginPagePhase {
+  if (!view) return { kind: "signed-out" };
+  switch (view.state) {
+    case "authenticated":
+      return { kind: "authenticated" };
+    case "error":
+      return { kind: "error", error: view.error };
+    case "pending": {
+      // The complete URL carries the code, so it is the one to open; the bare
+      // verification URL asks for the code to be typed in.
+      const uri = view.prompt?.verificationUriComplete ?? view.prompt?.verificationUri;
+      return uri ? { kind: "awaiting", verificationUri: uri } : { kind: "opening" };
+    }
+    default:
+      return { kind: "signed-out" };
+  }
+}
@@ -8,7 +8,7 @@
 // transport method for the account operations.
 //
 // Three peers read through these hooks: the account business's `UserMenu` and
-// `AccountLoginDialog` need the workflow handle and the live snapshot to drive
+// `AccountLoginPage` need the workflow handle and the live snapshot to drive
 // their panels, the settings dialog mounts both the workflows and the state
 // to drive its account tab and the sign-out button, and the composer's draft
 // loop watches the workflows state so its banner tracks the signed-in user.