@@ -99,7 +99,7 @@ class HostedConnectSheet extends HookConsumerWidget {
             ? 'Choose a backed-up identity to connect to Builderlab. Your other backups and saved community keys will be kept. This app cannot change the selected Builderlab identity later.'
             : flow.identityChoices.any((choice) => choice.fromCloud)
             ? 'Use your Builderlab identity on this device? It differs from your saved community identities. Those keys and your cloud backups will be kept. This app cannot change the selected Builderlab identity later.'
-            : 'Choose the identity to connect to Builderlab. It will be bound to your account and backed up. Existing keys will be kept. This app cannot change the selected Builderlab identity later.',
+            : 'Choose the identity to connect to Builderlab${flow.canCreateIdentity ? ', or create a new one' : ''}. It will be bound to your account and backed up. Existing keys will be kept. This app cannot change the selected Builderlab identity later.',
       HostedFlowStage.profile =>
         'What should people in this community call you? You can add a photo in Settings.',
       HostedFlowStage.acceptPolicy =>
@@ -161,6 +161,12 @@ class HostedConnectSheet extends HookConsumerWidget {
             ),
           ),
         ),
+      if (stage == HostedFlowStage.chooseIdentity && flow.canCreateIdentity)
+        FilledButton(
+          style: actionStyle,
+          onPressed: flow.createIdentity,
+          child: const Text('Create a new identity'),
+        ),
       if (stage == HostedFlowStage.setupIdentity) ...[
         if (flow.canCreateIdentity) ...[
           FilledButton(
@@ -218,6 +224,11 @@ class HostedConnectSheet extends HookConsumerWidget {
           onPressed: flow.skipConflictingCommunity,
           child: const Text('Keep saved identity and skip'),
         ),
+      if (flow.canChooseDifferentIdentity)
+        FilledButton(
+          onPressed: flow.chooseDifferentIdentity,
+          child: const Text('Choose a different identity'),
+        ),
       if (flow.canSkipFailedCommunity)
         TextButton(
           onPressed: flow.skipFailedCommunity,
 
@@ -232,6 +232,41 @@ class AccountIdentityStore {
     return identities.values.toList();
   });
 
+  /// Release this slot's unconfirmed copy of [pubkey] so a definitively
+  /// rejected choice can be made again. Refuses (false) unless another saved
+  /// slot or [heldElsewhere] holds the same key; never releases a receipt.
+  /// An already-empty slot counts as released, so a retry after a partial
+  /// failure or restart converges.
+  Future<bool> releaseUnconfirmed(
+    String pubkey, {
+    required Future<bool> Function(String nsec) heldElsewhere,
+    required void Function() checkCurrent,
+  }) => _serialized(() async {
+    final record = await _read();
+    if (record == null) return true;
+    if (record.pubkey != pubkey || record.backup != null) return false;
+    var kept = false;
+    for (final key in await _identityKeys(pubkey: pubkey)) {
+      if (key == _key) continue;
+      try {
+        if ((await _atKey(key)._read())?.nsec == record.nsec) kept = true;
+      } on AccountIdentityFailure {
+        // An unreadable slot is never evidence of a copy.
+      }
+    }
+    if (!kept && !await heldElsewhere(record.nsec)) return false;
+    checkCurrent();
+    try {
+      await _storage.delete(key: _key);
+    } catch (_) {
+      throw AccountIdentityFailure.unreadable;
+    }
+    if (await _storage.read(key: _key) != null) {
+      throw AccountIdentityFailure.unreadable;
+    }
+    return true;
+  });
+
   /// Copy a chosen saved account key without deleting its original owner.
   Future<AccountIdentitySnapshot> adoptSaved(
     String pubkey, {
 
@@ -62,6 +62,11 @@ class DeviceIdentitySource {
     return null;
   }
 
+  /// Whether a saved community or previous device record holds exactly [nsec].
+  Future<bool> holds(String nsec) async =>
+      (await _read())[AccountIdentityStore.publicKeyForNsec(nsec)]?.nsec ==
+      nsec;
+
   /// Reread and validate the chosen key immediately before create-only adoption.
   Future<AccountIdentitySnapshot> adopt(
     String pubkey,
 
@@ -21,6 +21,8 @@ import 'hosted_community_connection.dart';
 import 'web_connect_binding.dart';
 import 'hosted_join_policy.dart';
 
+part 'hosted_flow_identity_recovery.dart';
+
 enum HostedFlowStage {
   idle,
   working,
@@ -133,6 +135,8 @@ class HostedFlow extends ChangeNotifier {
   bool accountOnly = false;
   bool _importRequested = false;
   bool canCreateIdentity = false;
+  _RejectedBinding? _rejectedBinding;
+
   String? requiredIdentityPubkey;
   String? _pairedPubkey;
   SensitiveActionPolicy? pairedSensitiveActionPolicy;
@@ -540,14 +544,20 @@ class HostedFlow extends ChangeNotifier {
     return _enqueue(() => _continue(generation, selectedPubkey: pubkey));
   }
 
-  /// Web-binding links retain an explicit choice before creating an identity.
+  /// Create explicitly from setup, or beside the saved identities offered.
   Future<void> createIdentity() {
-    if (stage != HostedFlowStage.setupIdentity || !canCreateIdentity) {
+    if ((_target == null && !accountOnly) ||
+        !canCreateIdentity ||
+        (stage != HostedFlowStage.setupIdentity &&
+            stage != HostedFlowStage.chooseIdentity)) {
       return Future.value();
     }
+    final offered = {for (final item in identityChoices) item.pubkey};
     final generation = _nextGeneration();
     _set(HostedFlowStage.working);
-    return _enqueue(() => _continue(generation, createNew: true));
+    return _enqueue(
+      () => _continue(generation, createNew: true, offered: offered),
+    );
   }
 
   /// Import through the secure store, rechecking the account binding.
@@ -572,6 +582,7 @@ class HostedFlow extends ChangeNotifier {
     int generation, {
     String? selectedPubkey,
     bool createNew = false,
+    Set<String> offered = const {},
   }) async {
     final target = _target;
     final session = account.account;
@@ -612,15 +623,17 @@ class HostedFlow extends ChangeNotifier {
       );
       if (_disposed || generation != _generation) return;
     }
-    if (resolved.state == HostedIdentityState.needsSetup &&
+    // Selection offers creation beside saved identities only on request.
+    final creatable =
         resolved.canCreate &&
-        createNew &&
-        !canSealBackup) {
+        (resolved.state == HostedIdentityState.needsSetup ||
+            (createNew &&
+                resolved.state == HostedIdentityState.needsSelection));
+    if (creatable && createNew && !canSealBackup) {
       _set(HostedFlowStage.blocked, HostedFlowProblem.unsupportedPlatform);
       return;
     }
-    if (resolved.state == HostedIdentityState.needsSetup &&
-        resolved.canCreate &&
+    if (creatable &&
         canSealBackup &&
         (target is! NostrBindDeepLink || createNew) &&
         !_importRequested) {
@@ -629,6 +642,7 @@ class HostedFlow extends ChangeNotifier {
       resolved = await identity.resolve(
         isCurrent: _isCurrent(generation),
         createNew: true,
+        offered: offered,
       );
     }
     if (_pairedPubkey != null && resolved.pubkey != _pairedPubkey) {
@@ -692,13 +706,19 @@ class HostedFlow extends ChangeNotifier {
           if (response['error'] != null || request == null) {
             throw AccountFailure.invalidResponse;
           }
-          await WebConnectBindingService().complete(
-            request: request,
-            subject: session.subject,
-            expectedPubkey: resolved.pubkey!,
-            withKeys: store.withKeys,
-            verify: _verifyBinding,
-            isCurrent: _isCurrent(generation),
+          final pubkey = resolved.pubkey!;
+          await _observeBinding(
+            session.subject,
+            pubkey,
+            generation,
+            () => WebConnectBindingService().complete(
+              request: request,
+              subject: session.subject,
+              expectedPubkey: pubkey,
+              withKeys: store.withKeys,
+              verify: _verifyBinding,
+              isCurrent: _isCurrent(generation),
+            ),
           );
         } else if (resolved.state == HostedIdentityState.needsBackup) {
           await HostedBackupService(
@@ -721,6 +741,8 @@ class HostedFlow extends ChangeNotifier {
       return;
     }
     if (resolved.state == HostedIdentityState.needsSelection) {
+      canCreateIdentity =
+          resolved.canCreate && _pairedPubkey == null && !_importRequested;
       identityChoices = List.unmodifiable(resolved.choices);
       _set(HostedFlowStage.chooseIdentity);
       return;
@@ -988,7 +1010,7 @@ class HostedFlow extends ChangeNotifier {
     if (account.account?.subject != subject) {
       throw AccountFailure.differentAccount;
     }
-    final response = await account.post('/v1/buzz/nostr-identities/verify', {
+    final response = await account.post(_verifyPath, {
       'challenge_id': challengeId,
       'nonce': nonce,
       'signed_payload': signedPayload,
 
@@ -0,0 +1,80 @@
+part of 'hosted_flow.dart';
+
+const _verifyPath = '/v1/buzz/nostr-identities/verify';
+
+/// Definitive rejection of binding an account's chosen key, valid only for
+/// the attempt that observed it.
+typedef _RejectedBinding = ({String subject, String pubkey, int generation});
+
+/// Recovery when binding the chosen key was definitively rejected.
+extension HostedFlowIdentityRecovery on HostedFlow {
+  bool get canChooseDifferentIdentity {
+    final rejected = _rejectedBinding;
+    // A paired transfer pins its key, so there is no other identity to choose.
+    return _pairedPubkey == null &&
+        stage == HostedFlowStage.blocked &&
+        problem == HostedFlowProblem.requestRejected &&
+        rejected != null &&
+        rejected.generation == _generation &&
+        rejected.subject == account.account?.subject;
+  }
+
+  /// Release this account's copy of the rejected key (kept elsewhere) and
+  /// return to identity choice.
+  Future<void> chooseDifferentIdentity() {
+    final rejected = _rejectedBinding;
+    if (!canChooseDifferentIdentity || rejected == null) return Future.value();
+    final generation = _nextGeneration();
+    _set(HostedFlowStage.working);
+    return _enqueue(() async {
+      var released = false;
+      try {
+        released = await identity.releaseRejected(
+          rejected.pubkey,
+          subject: rejected.subject,
+          isCurrent: _isCurrent(generation),
+        );
+      } catch (_) {
+        if (_disposed ||
+            generation != _generation ||
+            account.account?.subject != rejected.subject) {
+          rethrow;
+        }
+      }
+      if (_disposed || generation != _generation) return;
+      if (released) return _continue(generation);
+      // The rejection still stands, so the choice can be made again.
+      _rejectedBinding = (
+        subject: rejected.subject,
+        pubkey: rejected.pubkey,
+        generation: generation,
+      );
+      _set(HostedFlowStage.blocked, HostedFlowProblem.requestRejected);
+    });
+  }
+
+  /// Run [bind], recording only a definitive 4xx on verify for this attempt,
+  /// account and key as evidence against it.
+  Future<void> _observeBinding(
+    String subject,
+    String pubkey,
+    int generation,
+    Future<void> Function() bind,
+  ) async {
+    account.lastRejectedRequest = null;
+    try {
+      await bind();
+    } on AccountFailure catch (failure) {
+      if (failure == AccountFailure.rejected &&
+          account.lastRejectedRequest?.path == _verifyPath &&
+          account.account?.subject == subject) {
+        _rejectedBinding = (
+          subject: subject,
+          pubkey: pubkey,
+          generation: generation,
+        );
+      }
+      rethrow;
+    }
+  }
+}
@@ -48,13 +48,15 @@ class HostedIdentityService {
     bool Function()? isCurrent,
     String? selectedPubkey,
     bool createNew = false,
+    Set<String> offered = const {},
     String? importNsec,
-  }) => _resolve(isCurrent, selectedPubkey, createNew, importNsec);
+  }) => _resolve(isCurrent, selectedPubkey, createNew, offered, importNsec);
 
   Future<HostedIdentityResult> _resolve(
     bool Function()? isCurrent,
     String? selectedPubkey,
     bool createNew,
+    Set<String> offered,
     String? importNsec,
   ) async {
     void checkCurrent() {
@@ -142,7 +144,9 @@ class HostedIdentityService {
     // decryption, even when the account retains backups of older identities.
     final matchingDevice =
         bound != null && choices.any((item) => item.pubkey == bound);
-    if ((statusKeys.isEmpty && bound == null) || matchingDevice) {
+    // An unclaimed account may keep its saved keys and start a new identity.
+    final unclaimed = statusKeys.isEmpty && bound == null;
+    if ((unclaimed && !createNew) || matchingDevice) {
       final eligible = choices
           .where((item) => bound == null || item.pubkey == bound)
           .toList();
@@ -156,6 +160,7 @@ class HostedIdentityService {
           return HostedIdentityResult(
             HostedIdentityState.needsSelection,
             choices: eligible,
+            canCreate: unclaimed,
           );
         }
         void checkSelection() {
@@ -190,7 +195,11 @@ class HostedIdentityService {
         authorize: () async {
           _sameAccount(subject);
           checkCurrent();
-          final reconciled = (await deviceIdentities.choices()).isEmpty;
+          // Every device key must have been offered beside creation, so a
+          // new identity never silently passes over an unseen prior one.
+          final reconciled = (await deviceIdentities.choices()).every(
+            (item) => offered.contains(item.pubkey),
+          );
           _sameAccount(subject);
           checkCurrent();
           return reconciled;
@@ -319,6 +328,49 @@ class HostedIdentityService {
     return _result(saved, bound, subject);
   }
 
+  /// After a definitive binding rejection of [pubkey], release this account's
+  /// unconfirmed copy so the user can choose again. Rechecks that the account
+  /// is still unbound with no backups and that the key survives elsewhere;
+  /// returns false and keeps the slot otherwise.
+  Future<bool> releaseRejected(
+    String pubkey, {
+    required String subject,
+    bool Function()? isCurrent,
+  }) async {
+    void checkCurrent() {
+      if (isCurrent != null && !isCurrent()) throw AccountFailure.unavailable;
+    }
+
+    checkCurrent();
+    _sameAccount(subject);
+    final store = this.store.forSubject(subject);
+    final local = await store.read();
+    if (local == null) return true;
+    if (local.pubkey != pubkey || local.backup != null) return false;
+    final current = await account.currentIdentity();
+    _sameAccount(subject);
+    if (current['error'] != null) throw AccountFailure.invalidResponse;
+    if (current['identity'] != null) return false;
+    final status = await account.post('/v1/buzz/nsec-backups/status', {});
+    _sameAccount(subject);
+    final listed = status['backup_nostr_pubkeys'];
+    if (status['error'] != null || listed is! List) {
+      throw AccountFailure.invalidResponse;
+    }
+    if (status['current_nostr_pubkey'] != null || listed.isNotEmpty) {
+      return false;
+    }
+    checkCurrent();
+    return store.releaseUnconfirmed(
+      pubkey,
+      heldElsewhere: deviceIdentities.holds,
+      checkCurrent: () {
+        _sameAccount(subject);
+        checkCurrent();
+      },
+    );
+  }
+
   HostedIdentityResult _result(
     AccountIdentitySnapshot local,
     String? bound,