A failed push-key lookup was always a warning, so `repo configure --account B` against an unreachable PDS wrote B into `[user]`, left A's `core.sshCommand` in force and exited 0 — the next push authenticating as A while every commit said B. With nothing pinned the warning is still right; with a pin already there it is now a refusal that names the half-applied state, matching `clone --ssh`. Change-Id: I010a3c383fa7854b1d288efb90e933876da389cd