[l-henri]

Closes #776

Why

A user imported their Ready private key as Ready Account and got an empty Argent 0.4.0 address, reported as a successful import. Their real account was deployed at Argent 0.3.1 ([owner, 0]) and later upgraded to 0.4.0 and given a guardian. One key has a different address under every Argent release, because the class hash and the constructor calldata both feed the address, and the raw-key import only ever derived 0.4.0. It never read the chain either.

What changes

1. Raw-key import scans every Argent release (apps/extension/src/background/accounts/raw-key-class.ts). For both the in-wallet import and the first-run key vault, the background previews the key's address at each Argent deployment class through a new key-free vault method (previewImportedAccount), reads the chain, and passes the deployed release (else a funded one) to the vault. The class is chosen in the background and never read from the message. The vault still refuses any class Argent was never deployed with.
2. No account means no import. When no release has a deployed or funded account for the key, the import is refused before anything is written. An unreachable network fails the import too, rather than storing an address nobody uses. The Bramble Account key import is unchanged, since that path can legitimately create a new account.
3. Phrase scan: every Argent release is now tried on both key ladders. Previously the 0.3.x releases were only tried on the Ready extension's ETH-seeded ladder (Seed import finds zero Ready (Argent X) software accounts — wrong master seed, wrong axis #505), and Bramble's own BIP-44 ladder only got 0.4.0. This adds two candidate shapes per scanned index. The new rows appear only with on-chain evidence.
4. Shared activity read: "deployed or funded" now lives in account-activity.ts, used by both phrase discovery and raw-key import.
5. Guardian refusal copy now names the in-wallet escape (shipped in v0.10.5) instead of sending the user back to Ready.

Overlaps #763 (Xverse) in recoveryScanShapes. Whichever lands second resolves a small conflict; with this PR, #763's class is scanned on the own ladder automatically and #763's filter keeps it off Ready's.

Copy for owner review

• New: "No Ready account uses this key on this network." (refusal, friendly-error-copy.ts)
• Changed: "This account has a guardian, a second approver this wallet can't provide. Use it in Ready, or remove the guardian there." → "This account has a guardian, a second approver this wallet can't provide. Remove it with Recover account on Home, or use the account in Ready."

Verification

• bun run check and bun run check:coverage pass locally (run under LC_ALL=en_US.UTF-8; the terminal tests are locale-sensitive). The new modules have 100% coverage.
• New tests:
  • tests/background/accounts/raw-key-class.test.ts: deployed/funded/none/other-family/RPC-failure cases, plus routing through wallet.importAccount for "stores the deployed release" and "writes nothing, key not echoed".
  • tests/background/onboarding/recovery-discovery-own-ladder.test.ts: fails without change 3.
  • Copy assertions in friendly-error.test.ts.
• Real Krusty, throwaway script: previewImportedAccount addresses match the fixture-pinned accountAddressCandidates for every Argent release, and the output never contains the key.
• On-chain: the reported key with 0.3.1 [owner, 0] reproduces the user's address exactly. Not exercised with the user's actual key.

🤖 Generated with Claude Code

[cursor]

PR Summary

High Risk
Touches raw private-key import, vault writes, and on-chain verification at the trust boundary; mistakes could import wrong addresses or persist keys under stale session state.

Overview
Fixes Ready Account raw-key import (#776): one Argent private key maps to a different address per contract release, so importing only at the wallet’s default release could create an empty 0.4.0 account while the user’s funds sat at 0.3.1.

Ready-key flow: New wallet.discoverReadyKeyAccounts derives each Argent release locally (previewImportedAccount), uses shared readAccountActivity (deployed vs recovery-token balances), and returns public candidates only. Onboarding and Settings run discovery first, show a picker (deployed rows pre-ticked; funded-only rows optional), then send classHashes on wallet.importAccount / wallet.createKeyVault. The background re-proves picks with verifyReadyKeyClasses before any write; Argent imports must name releases, other families must not. The vault can persist multiple accounts from one key in a single commit.

Recovery phrase scan: Every Argent deployment class is tried on both the Ready ETH-seeded ladder and the wallet’s own BIP-44 ladder (not only 0.4.0 on the own ladder), with onboarding using the same activity helper and stricter balance parsing.

Safety / UX: Session authorization is captured around chain reads on in-wallet import; phrase recovery unlocks inside the coordinator task; network switches announce so the picker clears; new friendly errors for “no Ready account” and unavailable checks; guardian copy points at Recover account.

^{Reviewed by Cursor Bugbot for commit 12ec2d4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6813eb9. Configure here.}

[derek-flossman]

Merged by the repo owner via the release-review bypass; no second review. Head ea5df8c was up to date with release/v0.10.8, with fast-checks and pr-guards green.