@bongos/core 1.24.4 → 1.24.6

package/modules/copy-desk/tests/copy_page_auto_close.mjs

@@ -33,7 +33,7 @@ const ROUNDS = {
   blank: round({ id: '11' }),
   empty_batch: round({ id: '12', description: `${draft}\n\n${batch([])}` }),
   real_batch: round({ id: '13', description: `${draft}\n\n${batch([line])}` }),
-  draft_only: round({ id: '14', description: draft }),
+  draft_only: round({ id: '14', description: draft, updated_at: new Date(NOW - 12 * 3600_000).toISOString() }),
   held: round({ id: '15', status: 'active', holder_id: '7' }),
   waiting: round({ id: '16', status: 'completed', description: `${draft}\n\n${batch([line])}` }),
   fresh_blank: round({ id: '17', updated_at: new Date(NOW - 5 * 60_000).toISOString() }),
@@ -56,18 +56,44 @@ await test('a blank round and an empty batch are the only two that close', () =>
   });
 });
 
-await test('a draft left untouched for two weeks expires; a younger one stays (task 1004901)', () => {
+await test('a draft left untouched for a day expires; a younger one stays (task 1004901, one day since task 1004976)', () => {
   const D = 86400000;
   const at = (days) => round({ description: draft, updated_at: new Date(NOW - days * D).toISOString() });
-  assert.equal(autoClose.closeReason(at(13.9), { now: NOW }), null);
-  assert.equal(autoClose.closeReason(at(14.1), { now: NOW }), 'draft_expired');
+  assert.equal(autoClose.closeReason(at(0.9), { now: NOW }), null);
+  assert.equal(autoClose.closeReason(at(1.1), { now: NOW }), 'draft_expired');
   assert.equal(autoClose.closeReason({ ...at(30), holder_id: '7' }, { now: NOW }), null, 'a held draft is being written, never expired');
 });
 
 await test('the grace period is honoured: a round touched within it stays', () => {
-  const t = round({ updated_at: new Date(NOW - 59 * 60_000).toISOString() });
+  const t = round({ description: `${draft}\n\n${batch([])}`, updated_at: new Date(NOW - 59 * 60_000).toISOString() });
   assert.equal(autoClose.closeReason(t, { now: NOW, graceMs: 60 * 60_000 }), null);
-  assert.equal(autoClose.closeReason(t, { now: NOW, graceMs: 30 * 60_000 }), 'blank');
+  assert.equal(autoClose.closeReason(t, { now: NOW, graceMs: 30 * 60_000 }), 'nothing_to_apply');
+});
+
+// task 1004972 (owner, task 1004971): a blank round closes after one day, not an hour.
+await test('a blank round closes once a day old, and a round with a draft or a batch never closes as blank', () => {
+  const D = 86400000;
+  const at = (days, over = {}) => round({ updated_at: new Date(NOW - days * D).toISOString(), ...over });
+  assert.equal(autoClose.closeReason(at(0.9), { now: NOW }), null, 'under a day: it stays, reading "Opened, nothing written yet"');
+  assert.equal(autoClose.closeReason(at(1.1), { now: NOW }), 'blank');
+  assert.equal(autoClose.closeReason(at(1.1, { holder_id: '7' }), { now: NOW }), null, 'a held round is being written');
+  for (const [name, description] of [['draft', draft], ['batch with lines', `${draft}\n\n${batch([line])}`],
+    ['approved batch', `${batch([line])}\n\n${pages.composeWordsApprovedBlock({ at: OLD, by: '7' })}`]]) {
+    assert.notEqual(autoClose.closeReason(at(1.1, { description }), { now: NOW }), 'blank', `${name} is not blank`);
+  }
+  assert.equal(autoClose.closeReason(at(30, { description: `${draft}\n\n${batch([line])}` }), { now: NOW }), null, 'a batch with lines is never closed, however old');
+});
+
+await test('the blank note says nothing was written, and the sweep never writes words', async () => {
+  const calls = [];
+  const lifecycle = {
+    listPageTweakTasks: async () => [ROUNDS.blank],
+    releaseStuckTweak: async (args) => { calls.push(args); return { outcome: 'abandoned' }; },
+  };
+  await autoClose.runAutoClose({ now: NOW, resolve: () => lifecycle, founder: async () => ({ id: '1' }) });
+  assert.equal(calls.length, 1);
+  assert.match(calls[0].note, /^Closed: nothing was written\./);
+  assert.deepEqual(Object.keys(calls[0]).sort(), ['builderId', 'expectedStatus', 'note', 'taskId'], 'no compose, no description, no wording');
 });
 
 await test('the sweep abandons through the lifecycle port, as the owner, with a plain note and no rewrite', async () => {
@@ -86,6 +112,42 @@ await test('the sweep abandons through the lifecycle port, as the owner, with a
   }
 });
 
+// task 1004973: an apply that stopped without finishing is released with a reason.
+await test('an orphaned apply (active, nobody holds it) is released back to the queue with the reason; a live apply is not', async () => {
+  const approved = `${draft}\n\n${batch([line])}\n\n${pages.composeWordsApprovedBlock({ at: OLD, by: '7' })}`;
+  const orphan = round({ id: '21', status: 'active', holder_id: null, description: approved });
+  const orphanDraft = round({ id: '22', status: 'active', holder_id: null, description: draft });
+  const live = round({ id: '23', status: 'active', holder_id: '7', holder_worktree: true, description: approved });
+  const fresh = round({ id: '24', status: 'active', holder_id: null, description: approved, updated_at: new Date(NOW - 5 * 60_000).toISOString() });
+  assert.deepEqual([orphan, orphanDraft, live, fresh].map((t) => autoClose.orphanReason(t, { now: NOW })), ['orphaned_apply', 'orphaned_apply', null, null]);
+  assert.equal(autoClose.closeReason(orphan, { now: NOW }), null, 'the ready-round rules never see an active round');
+
+  const calls = [];
+  const lifecycle = {
+    listPageTweakTasks: async () => [orphan, orphanDraft, live, fresh, ROUNDS.real_batch],
+    releaseStuckTweak: async (args) => { calls.push(args); return { outcome: 'released' }; },
+  };
+  const r = await autoClose.runAutoClose({ now: NOW, resolve: () => lifecycle, founder: async () => ({ id: '1' }) });
+  assert.deepEqual(r.closed.map((c) => [c.task_id, c.why, c.outcome]), [['21', 'orphaned_apply', 'released'], ['22', 'orphaned_apply', 'released']],
+    'after one sweep no round sits active with nobody holding it; the live apply and the fresh one are left alone');
+  for (const c of calls) {
+    assert.equal(c.expectedStatus, 'active');
+    assert.match(c.note, /^Released: the apply stopped without finishing\./);
+    assert.equal(typeof c.compose, 'function', 'released back to the queue, not abandoned');
+  }
+  // The reason is on the round, and the words are kept whole: the compose only appends.
+  const [batchOut, draftOut] = calls.map((c, i) => c.compose([orphan, orphanDraft][i]));
+  assert.equal(batchOut.ok, true);
+  assert.ok(batchOut.description.startsWith(approved), 'the draft, batch and approval are unchanged');
+  assert.ok(draftOut.description.startsWith(draft), 'a draft stays as it was');
+  const p = pages.blockPresence(batchOut.description);
+  assert.equal(p.batch && p.words_approved && !!p.last_sent_back_at, true, 'the batch carries the sent-back reason');
+  const pageStatus = require('../page-status.js');
+  assert.equal(pageStatus.roundState({ status: 'ready', holder_id: null, description: batchOut.description }), 'submitted', 'back in the /tweak queue');
+  assert.equal(pageStatus.roundState({ status: 'ready', holder_id: null, description: draftOut.description }), 'draft', 'a draft is its artist\'s again');
+  assert.match(draftOut.description, /the apply stopped without finishing/);
+});
+
 await test('nothing due, no owner read; no owner, no sweep; no lifecycle, no sweep', async () => {
   let asked = 0;
   const quiet = { listPageTweakTasks: async () => [ROUNDS.real_batch], releaseStuckTweak: async () => { throw new Error('must not run'); } };

package/modules/copy-desk/tests/copy_page_status.mjs

@@ -199,6 +199,8 @@ await test('every row of the D7 state table', () => {
 ${pages.composeWordsApprovedBlock({ at: 't2', by: '7' })}` }, 'submitted'],
     [{ status: 'ready', description: sentBackAfterApply }, 'submitted'],
     [{ status: 'ready', description: applied }, 'unknown'],
+    // task 1004972: opened and nothing written is its own state, never "Needs to be reviewed".
+    [{ status: 'ready', description: 'Page tweak round 1.' }, 'blank'],
     [{ status: 'completed', grade_passed: true }, 'waiting_for_artist'],
     [{ status: 'completed', grade_passed: false }, 'applying'],
     [{ status: 'confirmed' }, 'landing'],
@@ -258,7 +260,9 @@ ${pages.composeWordsApprovedBlock({ at: ago(9), by: '7' })}`;
     round(3, 'landing:c', { status: 'confirmed', updated_at: ago(17) }),
     round(4, 'builders:d', { status: 'completed', grade_passed: true, updated_at: ago(20) }),
     round(5, 'builders:e', { status: 'active', holder_id: '7', holder_login: 'me', holder_worktree: false, updated_at: ago(5) }),
-    round(6, 'builders:f', { status: 'ready', updated_at: ago(0.2) }),
+    // An active round nobody holds is one the reads cannot name. (A blank ready
+    // round is no longer that: it reads 'blank', task 1004972.)
+    round(6, 'builders:f', { status: 'active', holder_id: null, updated_at: ago(0.2) }),
     round(7, 'builders:g', { status: 'shipped', shipped_at: ago(3), updated_at: ago(3) }),
     round(8, 'status:h', { status: 'active', holder_id: '8', holder_worktree: true, updated_at: ago(2) }),
   ];

package/modules/hall-ui/public/tweak-editor.js

@@ -319,7 +319,8 @@
       notice('<p>The page changed after your draft was saved, so the draft is not shown over its new words. Rewrite the lines again here.</p>');
     }
     if (st.writable) { if (!st.ed.draft_on_older_reading) notice(''); return; }
-    if (!r || r.state === 'draft' || (r.state === 'writing' && !r.holder)) {
+    // A blank round (opened, nothing written; task 1004972) is free to take, like a draft.
+    if (!r || r.state === 'draft' || r.state === 'blank' || (r.state === 'writing' && !r.holder)) {
       notice('<p>Nobody is writing this page. Take it, and every line here is yours to type over.</p>'
         + '<button class="tw-notice__act" id="tw-claim" type="button">take this page</button>');
       return;

package/modules/lifecycle/db-claims.js

@@ -39,7 +39,7 @@ const { unsatisfiedDeps } = require('./db-deps-criteria.js');
 const { depRefusalRow } = require('./dead-deps.js');
 const { siblingOverlaps, RESOLVED_STATUSES } = require('./goal-conflicts.js');
 const { claimGate, claimPermissionsFor, disambiguateWorktreeName, foldWorktreeName } = require('./db-rank-authz.js');
-const { sealSessionLog } = require('./db-shared.js');
+const { idKey, sealSessionLog } = require('./db-shared.js');
 const { gatingRebaseTasksForBuilder, shouldRefuseClaimResolve } = require('./db-ship.js');
 const { splitRebaseGate, rebaseRefusalTasks } = require('./rebase-gate.js');
 const { REWARD_SUGGESTION_CAP, rewardGateAssignment } = require('./db-tasks.js');
@@ -898,7 +898,7 @@ async function releaseClaimsBatch({ claimIds, builderId, resolverSessionId, reso
     for (const claimId of uniqIds) {
       const claim = byId.get(claimId);
       if (!claim) { failures.push({ claim_id: claimId, reason: 'CLAIM_NOT_FOUND' }); continue; }
-      if (claim.builder_id !== builderId) { failures.push({ claim_id: claimId, reason: 'NOT_YOUR_CLAIM' }); continue; }
+      if (idKey(claim.builder_id) !== idKey(builderId)) { failures.push({ claim_id: claimId, reason: 'NOT_YOUR_CLAIM' }); continue; }
       if (claim.released_at) { failures.push({ claim_id: claimId, reason: 'ALREADY_RESOLVED' }); continue; }
       // task 1003767: the SAME decision resolveClaim uses, not a third copy of
       // the auth-session compare (this was the second of three). Batch release

package/modules/lifecycle/db-ship.js

@@ -16,7 +16,7 @@ const log = api.logger('lifecycle');
 const seams = api;
 const doneWhen = require('./done-when.js');
 const { THETES_GRADUATION_THRESHOLD, maybeAutoGraduateToThetes, foldWorktreeName } = require('./db-rank-authz.js');
-const { mostRecentClaimHolderId, sealSessionLog, staleClaimHourPredicate } = require('./db-shared.js');
+const { idKey, mostRecentClaimHolderId, sealSessionLog, staleClaimHourPredicate } = require('./db-shared.js');
 const { LIVE_STATUSES } = require('./dead-deps.js');
 const { isPageTweak } = require('./page-tweak-hold.js');
 const pageTweakArtist = require('./page-tweak-artist.js');
@@ -138,7 +138,7 @@ async function resolveClaim({ claimId, builderId, outcome, notesMd, valueSummary
     );
     if (claimRows.length === 0) throw { code: 'CLAIM_NOT_FOUND' };
     const claim = claimRows[0];
-    if (claim.builder_id !== builderId) throw { code: 'NOT_YOUR_CLAIM' };
+    if (idKey(claim.builder_id) !== idKey(builderId)) throw { code: 'NOT_YOUR_CLAIM' }; // task 1005004: pg bigint string vs a number
     if (claim.released_at) throw { code: 'ALREADY_RESOLVED' };
     // Resolve lock: only the WORKING TREE that created this claim can resolve it
     // (task 1003767) — falling back to the creating session where no tree is

package/modules/lifecycle/routes/claims.js

@@ -443,7 +443,13 @@ module.exports = function buildClaimsRouter() {
   // rank: any-builder — atomic multi-claim; same Xenos row-level filter applies.
   // V3.R13 (#237): same newcomer gate as POST /claims — a fresh builder can't
   // sneak around the "one claim at a time" rule by batching.
-  router.post('/claims/batch', auth.requireBuilder, gateNewcomerClaim, async (req, res) => {
+  // task 1005005: and the same gateOneActiveClaimPerSession as POST /claims, in
+  // the same order, so a session already holding a claim in this tree cannot
+  // batch more work into it. It reads the SESSION's existing active claims (the
+  // batch's own rows do not exist yet), keyed on the body's worktree_name — the
+  // caller's tree, which a batch also uses as its row-name prefix. A
+  // bind_session:false batch (the hall) has no session and passes, as on /claims.
+  router.post('/claims/batch', auth.requireBuilder, gateOneActiveClaimPerSession, gateNewcomerClaim, async (req, res) => {
     if (validateOrRespond(req, res, {
       task_ids: { required: true, type: 'array', maxItems: 20 },
       worktree_name: { type: 'string', maxLength: LIMITS.WORKTREE_NAME },

package/modules/platform-identity/account-logins.js

@@ -192,6 +192,131 @@ async function listLoginsForPerson(personKey, { pool = defaultPool } = {}) {
   return rows;
 }
 
+// ── Linking (task 1004995) ──────────────────────────────────────────────────
+// A signed-in person adds a second way in by signing in with it. Never a merge:
+// a way in that already reaches ANOTHER person is refused with 'taken', because
+// both accounts may hold credits, ranks and history and joining them is a
+// decision the server must not make on anyone's behalf (owner, 2026-10-29).
+
+// Who signs in with this GitHub user id? → the person key, or null when no one
+// does yet. Every GitHub sign-in on the hub asks this first, so a GitHub account
+// linked to someone who joined with Google reaches THEM, not a second person
+// keyed on the GitHub id (the ADR 0393 carry-over).
+async function personKeyForGithub(githubId, { pool = defaultPool } = {}) {
+  const person = await findPersonByLogin({ provider: 'github', subject: githubId }, { pool });
+  return person ? person.personKey : null;
+}
+
+// Add a way in to the signed-in person → { linked: true, already } or
+// { refused: 'taken' | 'already_linked' | 'no_account' }. For GitHub the linked
+// login is also written on the account (ADR 0393 §4: NULL until linking sets it).
+async function linkLogin({ personKey, provider, subject, email, githubLogin } = {}, { pool = defaultPool } = {}) {
+  const l = normalizeLogin({ provider, subject });
+  if (!l || !pi.isNumericGithubId(personKey)) throw new Error('linkLogin: not a valid person or provider identity');
+  const owner = await findPersonByLogin(l, { pool });
+  if (owner) return owner.personKey === String(personKey) ? { linked: true, already: true } : { refused: 'taken' };
+  try {
+    return await withTx(async (client) => {
+      const { rows } = await client.query(
+        `SELECT id FROM platform_identity_accounts WHERE github_id = $1`, [String(personKey)],
+      );
+      if (!rows[0]) return { refused: 'no_account' };
+      await client.query(
+        `INSERT INTO platform_identity_account_logins (account_id, provider, subject, email, last_used_at)
+         VALUES ($1, $2, $3, $4, now())`,
+        [rows[0].id, l.provider, l.subject, cleanEmail(email)],
+      );
+      if (l.provider === 'github') {
+        await client.query(
+          `UPDATE platform_identity_accounts SET github_login = $2 WHERE id = $1`,
+          [rows[0].id, typeof githubLogin === 'string' && githubLogin ? githubLogin.slice(0, 100) : null],
+        );
+      }
+      return { linked: true, already: false };
+    }, { pool });
+  } catch (err) {
+    if (err && err.code === '23505') {
+      // Which UNIQUE fired decides the answer: another person took this way in
+      // a moment ago, or this person already holds one for the provider.
+      const raced = await findPersonByLogin(l, { pool });
+      if (raced && raced.personKey !== String(personKey)) return { refused: 'taken' };
+      if (raced) return { linked: true, already: true };
+      return { refused: 'already_linked' };
+    }
+    throw err;
+  }
+}
+
+// Why this way in cannot be removed, or null when it can. Never the last way in
+// (owner, 2026-10-29); and never GitHub from an account born with it, because
+// that account's key IS its GitHub id, so a GitHub sign-in would still reach it.
+function unlinkRefusal({ personKey, provider, count }) {
+  if (provider === 'github' && !isMintedPersonKey(personKey)) return 'born_with';
+  if (count <= 1) return 'last_way_in';
+  return null;
+}
+
+// Remove a way in from the signed-in person → { unlinked: true } or
+// { refused: 'not_linked' | 'last_way_in' | 'born_with' }. The count and the
+// delete share one transaction, with the rows locked, so two racing removals
+// cannot both pass the last-way-in check.
+async function unlinkLogin({ personKey, provider } = {}, { pool = defaultPool } = {}) {
+  if (!LOGIN_PROVIDERS.includes(provider) || !pi.isNumericGithubId(personKey)) return { refused: 'not_linked' };
+  return withTx(async (client) => {
+    const { rows } = await client.query(
+      `SELECT l.id, l.provider, a.id AS account_id
+         FROM platform_identity_account_logins l
+         JOIN platform_identity_accounts a ON a.id = l.account_id
+        WHERE a.github_id = $1
+        FOR UPDATE OF l`,
+      [String(personKey)],
+    );
+    const row = rows.find((r) => r.provider === provider);
+    if (!row) return { refused: 'not_linked' };
+    const why = unlinkRefusal({ personKey: String(personKey), provider, count: rows.length });
+    if (why) return { refused: why };
+    await client.query(`DELETE FROM platform_identity_account_logins WHERE id = $1`, [row.id]);
+    if (provider === 'github') {
+      await client.query(`UPDATE platform_identity_accounts SET github_login = NULL WHERE id = $1`, [row.account_id]);
+    }
+    return { unlinked: true };
+  }, { pool });
+}
+
+// A first sign-in whose address another way in already carries → the providers
+// to suggest instead, e.g. ['github'], or [] (task 1004995). Asked only while
+// this provider identity reaches no one yet, so the person can sign in with the
+// account they already have and link this one there, rather than make a second
+// account they would never be able to join to the first. Only provider NAMES
+// come back — never who, never the address — and nothing is joined: owning a
+// matching address must not reach anyone's account (owner, 2026-10-29). This is
+// the one read that compares emails.
+async function existingAccountHint({ provider, subject, email } = {}, { pool = defaultPool } = {}) {
+  const l = normalizeLogin({ provider, subject });
+  const e = cleanEmail(email);
+  if (!l || !e) return [];
+  if (await findPersonByLogin(l, { pool })) return [];
+  const { rows } = await pool.query(
+    `SELECT DISTINCT provider FROM platform_identity_account_logins
+      WHERE provider <> $1 AND lower(email) = lower($2)`,
+    [l.provider, e],
+  );
+  return LOGIN_PROVIDERS.filter((p) => rows.some((r) => r.provider === p));
+}
+
+// The hub's own GitHub sign-in stamps its way in as used, and keeps the address
+// GitHub showed (its public one), so a later Google sign-in can be offered a
+// link. Display and suggestion only, like every email here.
+async function touchGithubLogin({ githubId, email } = {}, { pool = defaultPool } = {}) {
+  const l = normalizeLogin({ provider: 'github', subject: githubId });
+  if (!l) return;
+  await pool.query(
+    `UPDATE platform_identity_account_logins SET last_used_at = now(), email = COALESCE($2, email)
+      WHERE provider = 'github' AND subject = $1`,
+    [l.subject, cleanEmail(email)],
+  );
+}
+
 module.exports = {
   LOGIN_PROVIDERS,
   normalizeLogin,
@@ -202,4 +327,10 @@ module.exports = {
   createAccountForLogin,
   signInWithLogin,
   listLoginsForPerson,
+  personKeyForGithub,
+  linkLogin,
+  unlinkRefusal,
+  unlinkLogin,
+  existingAccountHint,
+  touchGithubLogin,
 };

package/modules/platform-identity/migrations/platform_identity_035_account_login_email_idx.sql

@@ -0,0 +1,19 @@
+-- platform_identity_035 — index the ways in by address, for the one email read
+-- (task 1004995, ADR 0396 amendment "linking").
+--
+-- existingAccountHint (account-logins.js) asks, on a first Google sign-in, whether
+-- another way in shows the address Google verified, so the person can be offered
+-- the account they already have instead of a second one. It compares
+-- lower(email) = lower($2), which no index served: every first Google sign-in
+-- would scan the whole table. This partial expression index serves exactly that
+-- read and skips the rows with no address (most GitHub ways in).
+--
+-- Additive and idempotent: an index only, no column or constraint changes, so a
+-- reader that never applies this file still works, only slower.
+
+CREATE INDEX IF NOT EXISTS platform_identity_account_logins_lower_email_idx
+  ON platform_identity_account_logins (lower(email))
+  WHERE email IS NOT NULL;
+
+COMMENT ON INDEX platform_identity_account_logins_lower_email_idx IS
+  'Serves existingAccountHint''s lower(email) match on a first Google sign-in (task 1004995). A suggestion read only: no sign-in or link is decided by an email.';

package/modules/platform-identity/routes/profile.js

@@ -239,9 +239,17 @@ module.exports = function profileRoutes() {
   // ADR 0393): GitHub, Google, or both, with the address each provider vouched
   // for. Keyed on the authenticated github_id (the person key); the provider's
   // user id never crosses. A system:* principal has no platform account: [].
+  //
+  // Each method carries `unlink_refused` (null, 'last_way_in' or 'born_with') so the
+  // page can say why a Remove is missing (task 1004995).
   router.get('/me/sign-in-methods', requireBuilder, async (req, res) => {
     try {
-      const methods = await logins.listLoginsForPerson(req.builder.github_id, { pool });
+      const key = req.builder.github_id;
+      const rows = await logins.listLoginsForPerson(key, { pool });
+      const methods = rows.map((m) => ({
+        ...m,
+        unlink_refused: logins.unlinkRefusal({ personKey: String(key), provider: m.provider, count: rows.length }),
+      }));
       res.set('Cache-Control', 'no-store');
       res.json({ methods, providers: logins.LOGIN_PROVIDERS });
     } catch (err) {
@@ -250,5 +258,25 @@ module.exports = function profileRoutes() {
     }
   });
 
+  // rank: any-builder — remove one way in from the caller's OWN account (task
+  // 1004995), keyed on the authenticated person key. Never the last way in, and
+  // never GitHub from an account born with it (its key is its GitHub id). Adding
+  // a way in is a sign-in, so it lives with the sign-in routes, not here.
+  router.delete('/me/sign-in-methods/:provider', requireBuilder, async (req, res) => {
+    const provider = String(req.params.provider || '');
+    if (!logins.LOGIN_PROVIDERS.includes(provider)) return res.fail('unknown_provider', 404);
+    try {
+      const out = await logins.unlinkLogin({ personKey: req.builder.github_id, provider }, { pool });
+      res.set('Cache-Control', 'no-store');
+      if (out.unlinked) return res.json({ ok: true });
+      if (out.refused === 'not_linked') return res.fail('not_linked', { status: 404, message: 'that way in is not linked to your account' });
+      if (out.refused === 'last_way_in') return res.fail('last_way_in', { status: 409, message: 'this is your only way in, so it cannot be removed — link another first' });
+      return res.fail('born_with', { status: 409, message: 'your account was made with GitHub, so GitHub stays linked' });
+    } catch (err) {
+      api.logger('platform-identity').error(`DELETE /me/sign-in-methods/:provider failed: ${err && err.message}`);
+      res.fail('sign_in_method_unlink_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };

package/modules/platform-identity/routes/sso.js

@@ -32,7 +32,8 @@ const guildEngagements = require('../guild-engagements');
 const instanceFeedback = require('../instance-feedback');
 const projectStats = require('../project-stats');
 // Ways in other than GitHub (task 1004993, ADR 0393/0396).
-const { signInWithLogin, hallTakesPersonKey } = require('../account-logins');
+const logins = require('../account-logins');
+const { signInWithLogin, hallTakesPersonKey } = logins;
 
 // What a Google-only person reads when a project's hall runs a core too old to
 // take them (task 1004994).
@@ -243,8 +244,21 @@ function registerSeams() {
       // a human accepts the platform terms, beside /sso/authorize. Core passes the
       // identity GitHub returned for the code it exchanged, never a request field,
       // and `activate: true` is a source literal here exactly as it is there.
-      recordHubSignin: ({ githubId, githubLogin, displayName, avatarUrl }) => pi.upsertAccount({
-        githubId, githubLogin, displayName, avatarUrl, activate: true,
+      // `githubId` is the PERSON key the sign-in resolved (task 1004995: a GitHub
+      // account linked to someone who joined with Google reaches their key), and
+      // `githubUserId` + `email` stamp the GitHub way in itself as used.
+      recordHubSignin: async ({ githubId, githubLogin, displayName, avatarUrl, githubUserId, email }) => {
+        await pi.upsertAccount({ githubId, githubLogin, displayName, avatarUrl, activate: true }, { pool });
+        await logins.touchGithubLogin({ githubId: githubUserId || githubId, email }, { pool });
+      },
+      // task 1004995: who a GitHub sign-in reaches (null = no one yet, so the
+      // GitHub id itself), and linking a second way in to the signed-in person.
+      personKeyForGithub: (githubUserId) => logins.personKeyForGithub(githubUserId, { pool }),
+      // A first Google sign-in whose verified address another way in carries →
+      // the providers to offer instead (names only; nothing is joined).
+      googleSignInHint: ({ subject, email }) => logins.existingAccountHint({ provider: 'google', subject, email }, { pool }),
+      linkLogin: ({ personKey, provider, subject, email, githubLogin }) => logins.linkLogin({
+        personKey, provider, subject, email, githubLogin,
       }, { pool }),
       // task 1004993 (ADR 0396): the hub's own Google sign-in. Finds the person by
       // Google's own id or creates them; never by an email. Core passes only what it
@@ -501,6 +515,14 @@ module.exports = function ssoRoutes() {
       if (out.state !== 'ok') return res.json(out); // pending | slow_down | expired | denied
       if (!out.client_id) return res.fail('device_poll_failed', { status: 500, message: 'internal error' });
       const id = out.identity;
+      // A GitHub account linked to someone who joined with Google is THAT person
+      // (task 1004995). This leg carries no sign of whether the project's core can
+      // take their key, so it never mints one for them: it says to sign in to the
+      // project in the browser, where /sso/authorize can tell.
+      const personKey = await logins.personKeyForGithub(id.github_id);
+      if (personKey && personKey !== String(id.github_id)) {
+        return res.fail('sign_in_in_browser', { status: 409, message: 'This GitHub account is linked to an account that joined with Google. Sign in to the project in your browser instead.' });
+      }
       await pi.upsertAccount({
         githubId: id.github_id,
         githubLogin: id.github_login,

package/modules/public-landing/public/account.html

@@ -214,6 +214,22 @@
       </form>
     </section>
 
+    <!-- WAYS TO SIGN IN — GET/DELETE /me/sign-in-methods (task 1004995). Linking is
+         a sign-in with the other account, so Link is a link to the sign-in routes,
+         and their answer comes back here as ?linked= or ?link_refused=. A way in
+         the server says cannot be removed shows why instead of a Remove. The rows
+         are cosmos.css's .mineRow, as under "projects you build on". -->
+    <section class="aSec" id="aWaysIn" aria-labelledby="aWaysIn-h">
+      <h2 id="aWaysIn-h">ways to sign in</h2>
+      <p class="aSide">GitHub, Google or both. Each one opens this same account, with the same credits, ranks and history.</p>
+      <div class="aBody">
+        <p class="aWhat" id="waysLoading">Reading your ways to sign in…</p>
+        <ul class="mineRows" id="waysList"></ul>
+        <p class="finePrint">Linking never joins two accounts. If the other one already has its own account here, we say so and change nothing.</p>
+        <p class="projMsg" id="waysMsg" role="status" aria-live="polite"></p>
+      </div>
+    </section>
+
     <!-- WHO CAN FIND YOU — account_visibility + recruiter_discoverable (privacy
          spec D1/D3, task 1002966), PATCH /me/cross-project. Ported from the hall's
          old "Profile privacy" section. The recruiter copy must name EXACTLY what
@@ -378,6 +394,7 @@
       }
       loadBuilding();
       loadGuilds();
+      loadWaysIn();
     }, function () { showAlert('Couldn’t reach the server — check your connection and refresh.'); });
   }
 
@@ -697,6 +714,103 @@
     }, function () { restore(); say(msg, 'Couldn’t reach the server. Try again.', 'err'); });
   }
 
+  // ---- ways to sign in (task 1004995). Read once the account is shown. A
+  // link's answer arrives in the address (?linked= / ?link_refused=) from the
+  // sign-in routes, and is said here in the page's own words. ----
+  var PROVIDER_NAME = { github: 'GitHub', google: 'Google' };
+  var LINK_START = { github: '/auth/link/github/start', google: '/auth/google/start?link=1' };
+  var KEPT_WHY = {
+    last_way_in: 'Your only way in, so it stays. Link another to be able to remove it.',
+    born_with: 'Your account was made with GitHub, so GitHub stays linked.',
+  };
+  function linkAnswer() {
+    var q = window.location.search || '';
+    var linked = /[?&]linked=(github|google)(&|$)/.exec(q);
+    if (linked) return { text: PROVIDER_NAME[linked[1]] + ' is linked. You can now sign in with either.', kind: 'ok' };
+    var refused = /[?&]link_refused=([a-z_]+)/.exec(q);
+    if (!refused) return null;
+    var p = /[?&]provider=(github|google)(&|$)/.exec(q);
+    var name = p ? PROVIDER_NAME[p[1]] : 'That';
+    var words = {
+      taken: 'That ' + name + ' account already has its own account here, so it was not linked. We never join two accounts; nothing changed.',
+      already_linked: 'Your account already has a ' + name + ' account linked. Remove it first to link a different one.',
+      cancelled: 'You cancelled linking ' + name + '. Nothing changed.',
+      expired: 'Linking ' + name + ' took too long. Try again.',
+    };
+    return { text: words[refused[1]] || 'Couldn’t link ' + name + '. Try again.', kind: 'err' };
+  }
+  function loadWaysIn() {
+    var msg = $('waysMsg');
+    var answer = linkAnswer();
+    if (answer) say(msg, answer.text, answer.kind);
+    return request('GET', '/me/sign-in-methods').then(function (res) {
+      $('waysLoading').hidden = true;
+      if (!res.ok || !res.data) { say(msg, 'Couldn’t read your ways to sign in — refresh in a moment.', 'err'); return; }
+      paintWaysIn(res.data.methods || [], res.data.providers || []);
+    }, function () {
+      $('waysLoading').hidden = true;
+      say(msg, 'Couldn’t reach the server — check your connection and refresh.', 'err');
+    });
+  }
+  function paintWaysIn(methods, providers) {
+    var ul = $('waysList');
+    ul.textContent = '';
+    providers.forEach(function (p) {
+      var held = methods.filter(function (m) { return m.provider === p; })[0];
+      ul.appendChild(wayRow(p, held));
+    });
+  }
+  function wayRow(provider, held) {
+    var name = PROVIDER_NAME[provider] || provider;
+    var row = rowEl('li', 'mineRow');
+    var main = rowEl('div', 'mineRow__main');
+    var title = rowEl('div', 'mineRow__name');
+    title.textContent = name;
+    main.appendChild(title);
+    var line = rowEl('span', 'mineRow__host');
+    line.textContent = held ? (held.email || 'linked') : 'not linked';
+    main.appendChild(line);
+    if (held && held.unlink_refused && KEPT_WHY[held.unlink_refused]) {
+      var why = rowEl('span', 'aTag');
+      why.textContent = KEPT_WHY[held.unlink_refused];
+      main.appendChild(why);
+    }
+    row.appendChild(main);
+    var actions = rowEl('div', 'mineRow__actions');
+    if (!held) {
+      var a = document.createElement('a');
+      a.className = 'btn small';
+      a.href = API + LINK_START[provider];
+      a.textContent = 'Link ' + name;
+      actions.appendChild(a);
+    } else if (!held.unlink_refused) {
+      var btn = document.createElement('button');
+      btn.type = 'button';
+      btn.className = 'btn small ghost';
+      btn.textContent = 'Remove';
+      btn.setAttribute('aria-label', 'Remove ' + name);
+      btn.addEventListener('click', function () { unlinkWay(provider, name, btn); });
+      actions.appendChild(btn);
+    }
+    row.appendChild(actions);
+    return row;
+  }
+  function unlinkWay(provider, name, btn) {
+    var msg = $('waysMsg');
+    btn.disabled = true;
+    btn.textContent = 'Removing…';
+    request('DELETE', '/me/sign-in-methods/' + provider).then(function (res) {
+      if (res.status === 401) { btn.disabled = false; btn.textContent = 'Remove'; sessionGone(msg); return; }
+      if (!res.ok) {
+        btn.disabled = false; btn.textContent = 'Remove';
+        say(msg, serverWords(res, 'Couldn’t remove ' + name + '. Try again.'), 'err');
+        return;
+      }
+      say(msg, name + ' is removed. It no longer opens this account.', 'ok');
+      loadWaysIn();
+    }, function () { btn.disabled = false; btn.textContent = 'Remove'; say(msg, 'Couldn’t reach the server. Try again.', 'err'); });
+  }
+
   // The identity read failing is not a sign-out. If the account itself was
   // read, the chip names it from that answer, so the way out is never lost.
   load().then(function () { return bar.ready; }).then(function () {

package/modules/public-landing/public/account.states.json

@@ -13,6 +13,7 @@
     "in-projects-band": { "auth": true, "actions": [["wait", 400], ["click", "#projTrig"], ["wait", 300]], "expect": { "visible": ["#menuProjects", "#mineCell"], "hidden": ["#menuProfile"] } },
     "in-profile-band": { "auth": true, "actions": [["wait", 400], ["click", "#who"], ["wait", 300]], "expect": { "visible": ["#menuProfile"], "hidden": ["#menuProjects"], "text": [["#bandWhoLogin", "builder"], ["#menuProfile [aria-current=\"page\"]", "Account"]] } },
     "in-building": { "auth": true, "url": "/account#aBuilding", "actions": [["wait", 500]], "expect": { "visible": ["#aBuilding", "#buildingList"], "hidden": ["#buildingEmpty", "#buildingLoading"], "count": [["#buildingList .mineRow", 2]], "text": [["#buildingList .mineRow:first-child .mineRow__name", "Example World"], ["#buildingList .mineRow:first-child .mineRow__host", "example.com"]], "attr": [["#buildingList .mineRow:first-child button", "aria-label", "Leave Example World"]] } },
+    "in-ways": { "auth": true, "url": "/account#aWaysIn", "actions": [["wait", 500]], "expect": { "visible": ["#aWaysIn", "#waysList"], "hidden": ["#waysLoading"], "count": [["#waysList .mineRow", 2]], "text": [["#waysList .mineRow:first-child .mineRow__name", "GitHub"], ["#waysList .mineRow:nth-child(2) .mineRow__host", "octo@example.com"]], "attr": [["#waysList .mineRow:nth-child(2) button", "aria-label", "Remove Google"]] } },
     "in-privacy": { "auth": true, "actions": [["wait", 400], ["click", "#aPrivacy .aOpt:nth-child(2)"], ["wait", 150]], "expect": { "checked": "input[name=visibility][value=private]", "visible": ["#visGuilds"], "hidden": ["#recordGuilds"], "count": [["#visGuildList li", 2]], "attr": [["#visGuildList li:first-child a", "href", "/g/forge-crew"]], "text": [["#visGuildList li:first-child a", "Forge Crew"], ["#recWhat", "They will see your name, your picture, your roles, and whether you have been active in the last 30 days — never your credits, works shipped, karma, or the projects you build on. This is the one thing a recruiter can see while your profile page is private. Turning this off removes you from both recruiting surfaces — the recruiting directory, and a recruiter’s look-up of one builder — straight away. · For now this follows your profile page setting."]] } }
   },
   "reducedMotion": { "auth": true, "actions": [["wait", 300]] }

package/modules/ui-design/kit/serve.js

@@ -580,6 +580,27 @@ function myGuilds(res) {
   }));
   return json(res, 200, { guilds: mine, count: mine.length });
 }
+// GET/DELETE /me/sign-in-methods (the account page's ways to sign in, task 1004995).
+// The fixture builder is GitHub-born with Google linked, held for the run so a
+// Remove reads back. Each way in carries the route's own unlink_refused, by
+// account-logins.js unlinkRefusal's rule, and DELETE refuses as the route does.
+let _ways = null;
+function waysHeld() { return _ways || (_ways = [{ provider: 'github', email: null }, { provider: 'google', email: 'octo@example.com' }]); }
+function wayRefusal(provider, count) { return provider === 'github' ? 'born_with' : count <= 1 ? 'last_way_in' : null; }
+function signInMethods(res) {
+  const held = waysHeld();
+  return json(res, 200, { methods: held.map((m) => ({ ...m, unlink_refused: wayRefusal(m.provider, held.length) })), providers: ['github', 'google'] });
+}
+function signInMethodDelete(res, provider) {
+  const held = waysHeld();
+  if (!['github', 'google'].includes(provider)) return refuse(res, 404, 'unknown_provider', 'unknown_provider');
+  if (!held.some((m) => m.provider === provider)) return refuse(res, 404, 'not_linked', 'that way in is not linked to your account');
+  const why = wayRefusal(provider, held.length);
+  if (why === 'born_with') return refuse(res, 409, why, 'your account was made with GitHub, so GitHub stays linked');
+  if (why) return refuse(res, 409, why, 'this is your only way in, so it cannot be removed — link another first');
+  _ways = held.filter((m) => m.provider !== provider);
+  return json(res, 200, { ok: true });
+}
 function myGuildRequests(res) {
   const q = heldFixture('me__guild-requests');
   const owner = ownedRequests();
@@ -790,6 +811,9 @@ const server = http.createServer((req, res) => {
     if (guild && guild[2] === '/membership' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => guildMembershipPatch(res, guild[1], body)) : json(res, 401, UNAUTH);
     if (guild && guild[2] === '/engagements' && req.method === 'POST') return AUTH ? readBody(req, (body) => guildEngagementPost(res, guild[1], body)) : json(res, 401, UNAUTH);
     if (rest === '/me/guilds' && req.method === 'GET') return AUTH ? myGuilds(res) : json(res, 401, UNAUTH);
+    if (rest === '/me/sign-in-methods' && req.method === 'GET') return AUTH ? signInMethods(res) : json(res, 401, UNAUTH);
+    const way = rest.match(/^\/me\/sign-in-methods\/([^/]+)$/);
+    if (way && req.method === 'DELETE') return AUTH ? signInMethodDelete(res, way[1]) : json(res, 401, UNAUTH);
     if (rest === '/me/guild-requests' && req.method === 'GET') return AUTH ? myGuildRequests(res) : json(res, 401, UNAUTH);
     if (rest === '/community/leaderboard' && req.method === 'GET') return communityBoard(res, u, origin);
     if (rest === '/community/search' && req.method === 'GET') return communitySearch(res, u, origin);