acceptRemoteIdentityChange

Accepts change, an identity change the user explicitly approved (docs/identity-verification.md). Never called by the client itself: until this runs, every message and bundle with the new key fails with SecureMessageClientException.IdentityChanged.

Only if RemoteIdentityChange.previousIdentityKey is still pinned, in one transaction: the session with the remote device is removed and its initiation retired (so neither it nor a replay of its PreKeyMessages can come back), and the pin becomes exactly RemoteIdentityChange.presentedIdentityKey, never a key fetched now, as VerificationState.UNVERIFIED. Otherwise it throws SecureMessageClientException.RemoteIdentityConflict (for example a second, competing acceptance) or SecureMessageClientException.RemoteIdentityNotKnown and changes nothing. Other devices' sessions and pins are not touched.

Pending messages to the device stay pending and processed message IDs stay processed: retryPendingMessages sends pending messages again, with their logical IDs, on a new session with the new identity. The envelope that raised SecureMessageClientException.IdentityChanged changed nothing, so it can be passed to decrypt again. No network I/O.