Function adopt_passwordless 

async fn adopt_passwordless(
    services: &Services,
    subjects: &Arc<Map>,
    deactivated: Option<&Arc<Map>>,
) -> Result

Restores the sentinel password on accounts an identity provider authenticates.

A foreign database spells “no local password” as an empty hash, which reads here as deactivated and refuses the account every login flow. Only accounts carrying a provider subject are restored, because an empty hash on its own cannot be told apart from a deactivation this server wrote.

The sentinel carries that meaning locally, leaving the account active with no password to verify against, while an account the foreign column marks deactivated keeps its deactivation.