@bongos/core 1.24.5 → 1.24.6

package/migrations/core_286_credit_log_no_spend.sql

@@ -0,0 +1,128 @@
+-- core_286_credit_log_no_spend.sql — task 1004988 (goal 1000092; ADR 0385
+-- decision 2, ADR 0387).
+--
+-- Credits measure contribution. They are never spent, transferred or redeemed,
+-- so the ledger has no row that takes credits away for something in return.
+-- Until now that was a convention: credit_log's own column notes listed
+-- 'redemption' as a reason and called a negative delta "spent (future)", and
+-- nothing in Postgres stopped a negative spend row. This makes the DATABASE
+-- refuse it, so no code path — present or future, ours or a module's — can
+-- book one.
+--
+-- WHAT IS ADMITTED. A row with delta >= 0 is admitted as before (earning, and the
+-- delta-0 audit rows rank changes and builder exits write). A NEGATIVE row is
+-- admitted only as a REVERSAL of an existing positive row, in one of two shapes:
+--
+--   1. reason = 'reversal:<credit_log id>' — the general shape. The named row
+--      must exist, belong to the same builder and be positive, and all the
+--      reversals of it together may not exceed it.
+--   2. reason = '<original reason>_reversal' with task_id set — the shape
+--      core_194 (ADR 0120's one-time clawback, reason 'task.confirmed_reversal')
+--      already wrote. The reference is the (builder, task, original reason)
+--      rows, which must exist and sum positive; reversals may not exceed them.
+--      Kept so that migration, and the integration test that re-runs it, stay
+--      valid on a database that carries this trigger.
+--
+-- Any other negative row is refused. A row whose reason names a spend,
+-- redemption or transfer is refused at any sign: a positive "transfer in" is
+-- the other half of a transfer, and decision 2 forbids the transfer itself.
+--
+-- WHAT IS NOT CHANGED (ADR 0387). No column is added and no existing row is
+-- read, converted or rewritten: the trigger is BEFORE INSERT only, so history —
+-- including core_194's reversal rows — stays exactly as booked. This does not
+-- contradict ADR 0387's "the only schema change is the money record": that
+-- sentence is about the SHAPE of credit_log (no money column, no backfill), and
+-- this adds none. It enforces ADR 0387 decision 1 ("never redeemable") in the
+-- database rather than in the code that writes the ledger.
+--
+-- Concurrency: the reversed row(s) are locked FOR UPDATE before the reversal
+-- total is summed, so two reversals racing for the same row cannot both pass
+-- the "may not exceed" check.
+--
+-- Cost: a positive row (every normal earning) pays one regex test and returns.
+-- Only a negative row reads the ledger, and every read is indexed: the reversed
+-- row by its primary key (shape 1), the original rows by idx_credit_log_task
+-- (core_189, shape 2), and the reversals already booked by the PARTIAL index
+-- below, which holds negative rows only — so it stays as small as the number of
+-- reversals ever made, not the size of the ledger.
+--
+-- The refused names match as whole words: the name, then a separator (. _ : -)
+-- or the end. So 'spend', 'spend.x' and 'transfer:3' are refused, and a reason
+-- that merely starts with the letters ('spender-of-the-month') is not.
+
+CREATE INDEX IF NOT EXISTS idx_credit_log_reversals
+  ON credit_log (builder_id, reason) WHERE delta < 0;
+
+CREATE OR REPLACE FUNCTION credit_log_refuse_spend() RETURNS trigger AS $$
+DECLARE
+  ref_id      bigint;
+  orig_rec    record;
+  orig_reason text;
+  orig_total  bigint;
+  reversed    bigint;
+BEGIN
+  IF NEW.reason ~* '^(redemption|redeem|spend|spent|transfer)([._:-]|$)' THEN
+    RAISE EXCEPTION 'credit_log refuses %: credits are never spent, transferred or redeemed (ADR 0385 decision 2)', NEW.reason
+      USING ERRCODE = 'check_violation';
+  END IF;
+
+  IF NEW.delta >= 0 THEN
+    RETURN NEW;
+  END IF;
+
+  -- Shape 1: 'reversal:<credit_log id>'.
+  IF NEW.reason ~ '^reversal:[0-9]{1,18}$' THEN
+    ref_id := substring(NEW.reason FROM 10)::bigint;
+    SELECT id, builder_id, delta INTO orig_rec FROM credit_log WHERE id = ref_id FOR UPDATE;
+    -- Two IFs, not one OR: plpgsql does not promise to short-circuit, and the
+    -- fields of a record no row was selected into must not be read.
+    IF NOT FOUND THEN
+      RAISE EXCEPTION 'credit_log refuses a reversal of row %: no such row', ref_id
+        USING ERRCODE = 'check_violation';
+    END IF;
+    IF orig_rec.builder_id <> NEW.builder_id OR orig_rec.delta <= 0 THEN
+      RAISE EXCEPTION 'credit_log refuses a reversal of row %: it must name an existing positive row of the same builder', ref_id
+        USING ERRCODE = 'check_violation';
+    END IF;
+    SELECT COALESCE(SUM(delta), 0) INTO reversed
+      FROM credit_log WHERE builder_id = NEW.builder_id AND reason = NEW.reason AND delta < 0;
+    IF orig_rec.delta + reversed + NEW.delta < 0 THEN
+      RAISE EXCEPTION 'credit_log refuses a reversal of row %: it would reverse more than the row booked', ref_id
+        USING ERRCODE = 'check_violation';
+    END IF;
+    RETURN NEW;
+  END IF;
+
+  -- Shape 2: '<original reason>_reversal' against the same builder and task.
+  IF NEW.reason ~ '^[a-z0-9_.]+_reversal$' AND NEW.task_id IS NOT NULL THEN
+    orig_reason := left(NEW.reason, length(NEW.reason) - length('_reversal'));
+    PERFORM 1 FROM credit_log
+      WHERE builder_id = NEW.builder_id AND task_id = NEW.task_id AND reason = orig_reason
+      FOR UPDATE;
+    SELECT COALESCE(SUM(delta), 0) INTO orig_total
+      FROM credit_log WHERE builder_id = NEW.builder_id AND task_id = NEW.task_id AND reason = orig_reason;
+    SELECT COALESCE(SUM(delta), 0) INTO reversed
+      FROM credit_log WHERE builder_id = NEW.builder_id AND task_id = NEW.task_id AND reason = NEW.reason AND delta < 0;
+    IF orig_total <= 0 OR orig_total + reversed + NEW.delta < 0 THEN
+      RAISE EXCEPTION 'credit_log refuses %: it must reverse existing % credit on the same task, and no more than was booked', NEW.reason, orig_reason
+        USING ERRCODE = 'check_violation';
+    END IF;
+    RETURN NEW;
+  END IF;
+
+  RAISE EXCEPTION 'credit_log refuses a negative row (reason %): credits are never spent or redeemed; only a reversal of an existing row may be negative (ADR 0385 decision 2)', NEW.reason
+    USING ERRCODE = 'check_violation';
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS trg_credit_log_refuse_spend ON credit_log;
+CREATE TRIGGER trg_credit_log_refuse_spend
+  BEFORE INSERT ON credit_log
+  FOR EACH ROW EXECUTE FUNCTION credit_log_refuse_spend();
+
+COMMENT ON TABLE credit_log IS
+  'Append-only contribution ledger (ADR 0385, ADR 0387). Credits measure work: they are never money, never spent, transferred or redeemed. builders.total_credits is a cache kept by trg_credit_log_apply.';
+COMMENT ON COLUMN credit_log.delta IS
+  'Credits earned (positive), an audit row (0), or a reversal of an earlier row (negative). The trigger trg_credit_log_refuse_spend refuses every other negative row.';
+COMMENT ON COLUMN credit_log.reason IS
+  'What earned the credits, e.g. task.shipped, session.token_reward, idea.credit.*. A negative row must read reversal:<credit_log id> or <original reason>_reversal with its task_id set.';

package/modules/copy-desk/auto-close.js

@@ -18,8 +18,10 @@
 //                     (unplaced, shared or removed lines), so /tweak has no line
 //                     to apply and the round can never move on its own.
 //   draft_expired     `ready` with a draft and no batch, untouched for
-//                     page-status's DRAFT_EXPIRES_AFTER (14 days, task 1004901):
-//                     its artist was reminded at 7 days and never came back.
+//                     page-status's DRAFT_EXPIRES_AFTER (task 1004901; one day
+//                     since task 1004976, the owner's answer on task 1004971,
+//                     with no reminder step first). The draft text stays on
+//                     the task: no compose, so the description is not touched.
 //
 // All three are abandoned through the lifecycle port's releaseStuckTweak (no compose,
 // so the note is the reason and nothing is written to the description). The
@@ -38,7 +40,7 @@ const GRACE_MS = Number(process.env.COPY_AUTO_CLOSE_GRACE_MS) || 60 * 60_000;
 const NOTES = Object.freeze({
   blank: 'Closed: nothing was written. The round was opened and left blank for a day; claim the page again to start one.',
   nothing_to_apply: 'Closed by itself: every rewritten line went to an engineer task, so nothing was left to apply on the page.',
-  draft_expired: 'Closed by itself: the draft sat untouched for two weeks. Its words stay on this task; claim the page again to start over.',
+  draft_expired: 'Closed by itself: the draft sat untouched for a day. Its words stay on this task; claim the page again to start over.',
   orphaned_apply: 'Released: the apply stopped without finishing. Nobody holds this round any more, so it is back in the queue.',
 });
 

package/modules/copy-desk/page-status.js

@@ -311,8 +311,8 @@ function orderedSurfaces(inventory) {
 // This is every page with an open round, where it is, since when (the round's
 // last update), and whether it has sat there too long. Waiting for review is
 // the artist's own move and a draft is theirs to finish: a draft or a page
-// being written is stuck after 7 days and a draft expires after 14 (task
-// 1004901); a review is stuck after 3 days (task 1004777, so its artist is
+// being written is stuck after 7 days, and a draft left untouched expires after
+// one day (task 1004901, shortened by task 1004976); a review is stuck after 3 days (task 1004777, so its artist is
 // told); a state the reads cannot name always needs to be reviewed.
 // ---------------------------------------------------------------------------
 
@@ -322,12 +322,15 @@ const DAY_MS = 24 * 60 * 60 * 1000;
 // work) and WHEN it is overdue (stuck_after: then it is pushed to that person on
 // Home and in the daily digest). A draft nobody touches also EXPIRES
 // (expires_after): the auto-close sweep abandons it, its words kept on the task.
-const DRAFT_EXPIRES_AFTER = 14 * DAY_MS;
+// task 1004976 (owner, task 1004971): a draft expires after ONE day, and there
+// is no separate reminder step at that length, so the draft is due when it
+// expires (stuck_after = expires_after), not reminded a week before.
+const DRAFT_EXPIRES_AFTER = DAY_MS;
 // task 1004972 (owner, task 1004971): a round opened and left blank closes after a day.
 const BLANK_CLOSES_AFTER = DAY_MS;
 const IN_FLIGHT = Object.freeze({
   blank: { word: 'Opened, nothing written yet', stuck_after: BLANK_CLOSES_AFTER, waits_on: 'artist', expires_after: BLANK_CLOSES_AFTER },
-  draft: { word: 'Being written', stuck_after: 7 * DAY_MS, waits_on: 'artist', expires_after: DRAFT_EXPIRES_AFTER },
+  draft: { word: 'Being written', stuck_after: DRAFT_EXPIRES_AFTER, waits_on: 'artist', expires_after: DRAFT_EXPIRES_AFTER },
   writing: { word: 'Being written', stuck_after: 7 * DAY_MS, waits_on: 'artist' },
   words_review: { word: 'Words waiting for review', stuck_after: 3 * DAY_MS, waits_on: 'artist' },
   submitted: { word: 'Approved, waiting to be applied', stuck_after: 3 * DAY_MS, waits_on: 'appliers' },

package/modules/copy-desk/tests/copy_page_auto_close.mjs

@@ -33,7 +33,7 @@ const ROUNDS = {
   blank: round({ id: '11' }),
   empty_batch: round({ id: '12', description: `${draft}\n\n${batch([])}` }),
   real_batch: round({ id: '13', description: `${draft}\n\n${batch([line])}` }),
-  draft_only: round({ id: '14', description: draft }),
+  draft_only: round({ id: '14', description: draft, updated_at: new Date(NOW - 12 * 3600_000).toISOString() }),
   held: round({ id: '15', status: 'active', holder_id: '7' }),
   waiting: round({ id: '16', status: 'completed', description: `${draft}\n\n${batch([line])}` }),
   fresh_blank: round({ id: '17', updated_at: new Date(NOW - 5 * 60_000).toISOString() }),
@@ -56,11 +56,11 @@ await test('a blank round and an empty batch are the only two that close', () =>
   });
 });
 
-await test('a draft left untouched for two weeks expires; a younger one stays (task 1004901)', () => {
+await test('a draft left untouched for a day expires; a younger one stays (task 1004901, one day since task 1004976)', () => {
   const D = 86400000;
   const at = (days) => round({ description: draft, updated_at: new Date(NOW - days * D).toISOString() });
-  assert.equal(autoClose.closeReason(at(13.9), { now: NOW }), null);
-  assert.equal(autoClose.closeReason(at(14.1), { now: NOW }), 'draft_expired');
+  assert.equal(autoClose.closeReason(at(0.9), { now: NOW }), null);
+  assert.equal(autoClose.closeReason(at(1.1), { now: NOW }), 'draft_expired');
   assert.equal(autoClose.closeReason({ ...at(30), holder_id: '7' }, { now: NOW }), null, 'a held draft is being written, never expired');
 });
 

package/modules/lifecycle/routes/claims.js

@@ -443,7 +443,13 @@ module.exports = function buildClaimsRouter() {
   // rank: any-builder — atomic multi-claim; same Xenos row-level filter applies.
   // V3.R13 (#237): same newcomer gate as POST /claims — a fresh builder can't
   // sneak around the "one claim at a time" rule by batching.
-  router.post('/claims/batch', auth.requireBuilder, gateNewcomerClaim, async (req, res) => {
+  // task 1005005: and the same gateOneActiveClaimPerSession as POST /claims, in
+  // the same order, so a session already holding a claim in this tree cannot
+  // batch more work into it. It reads the SESSION's existing active claims (the
+  // batch's own rows do not exist yet), keyed on the body's worktree_name — the
+  // caller's tree, which a batch also uses as its row-name prefix. A
+  // bind_session:false batch (the hall) has no session and passes, as on /claims.
+  router.post('/claims/batch', auth.requireBuilder, gateOneActiveClaimPerSession, gateNewcomerClaim, async (req, res) => {
     if (validateOrRespond(req, res, {
       task_ids: { required: true, type: 'array', maxItems: 20 },
       worktree_name: { type: 'string', maxLength: LIMITS.WORKTREE_NAME },

package/modules/platform-identity/account-logins.js

@@ -192,6 +192,131 @@ async function listLoginsForPerson(personKey, { pool = defaultPool } = {}) {
   return rows;
 }
 
+// ── Linking (task 1004995) ──────────────────────────────────────────────────
+// A signed-in person adds a second way in by signing in with it. Never a merge:
+// a way in that already reaches ANOTHER person is refused with 'taken', because
+// both accounts may hold credits, ranks and history and joining them is a
+// decision the server must not make on anyone's behalf (owner, 2026-10-29).
+
+// Who signs in with this GitHub user id? → the person key, or null when no one
+// does yet. Every GitHub sign-in on the hub asks this first, so a GitHub account
+// linked to someone who joined with Google reaches THEM, not a second person
+// keyed on the GitHub id (the ADR 0393 carry-over).
+async function personKeyForGithub(githubId, { pool = defaultPool } = {}) {
+  const person = await findPersonByLogin({ provider: 'github', subject: githubId }, { pool });
+  return person ? person.personKey : null;
+}
+
+// Add a way in to the signed-in person → { linked: true, already } or
+// { refused: 'taken' | 'already_linked' | 'no_account' }. For GitHub the linked
+// login is also written on the account (ADR 0393 §4: NULL until linking sets it).
+async function linkLogin({ personKey, provider, subject, email, githubLogin } = {}, { pool = defaultPool } = {}) {
+  const l = normalizeLogin({ provider, subject });
+  if (!l || !pi.isNumericGithubId(personKey)) throw new Error('linkLogin: not a valid person or provider identity');
+  const owner = await findPersonByLogin(l, { pool });
+  if (owner) return owner.personKey === String(personKey) ? { linked: true, already: true } : { refused: 'taken' };
+  try {
+    return await withTx(async (client) => {
+      const { rows } = await client.query(
+        `SELECT id FROM platform_identity_accounts WHERE github_id = $1`, [String(personKey)],
+      );
+      if (!rows[0]) return { refused: 'no_account' };
+      await client.query(
+        `INSERT INTO platform_identity_account_logins (account_id, provider, subject, email, last_used_at)
+         VALUES ($1, $2, $3, $4, now())`,
+        [rows[0].id, l.provider, l.subject, cleanEmail(email)],
+      );
+      if (l.provider === 'github') {
+        await client.query(
+          `UPDATE platform_identity_accounts SET github_login = $2 WHERE id = $1`,
+          [rows[0].id, typeof githubLogin === 'string' && githubLogin ? githubLogin.slice(0, 100) : null],
+        );
+      }
+      return { linked: true, already: false };
+    }, { pool });
+  } catch (err) {
+    if (err && err.code === '23505') {
+      // Which UNIQUE fired decides the answer: another person took this way in
+      // a moment ago, or this person already holds one for the provider.
+      const raced = await findPersonByLogin(l, { pool });
+      if (raced && raced.personKey !== String(personKey)) return { refused: 'taken' };
+      if (raced) return { linked: true, already: true };
+      return { refused: 'already_linked' };
+    }
+    throw err;
+  }
+}
+
+// Why this way in cannot be removed, or null when it can. Never the last way in
+// (owner, 2026-10-29); and never GitHub from an account born with it, because
+// that account's key IS its GitHub id, so a GitHub sign-in would still reach it.
+function unlinkRefusal({ personKey, provider, count }) {
+  if (provider === 'github' && !isMintedPersonKey(personKey)) return 'born_with';
+  if (count <= 1) return 'last_way_in';
+  return null;
+}
+
+// Remove a way in from the signed-in person → { unlinked: true } or
+// { refused: 'not_linked' | 'last_way_in' | 'born_with' }. The count and the
+// delete share one transaction, with the rows locked, so two racing removals
+// cannot both pass the last-way-in check.
+async function unlinkLogin({ personKey, provider } = {}, { pool = defaultPool } = {}) {
+  if (!LOGIN_PROVIDERS.includes(provider) || !pi.isNumericGithubId(personKey)) return { refused: 'not_linked' };
+  return withTx(async (client) => {
+    const { rows } = await client.query(
+      `SELECT l.id, l.provider, a.id AS account_id
+         FROM platform_identity_account_logins l
+         JOIN platform_identity_accounts a ON a.id = l.account_id
+        WHERE a.github_id = $1
+        FOR UPDATE OF l`,
+      [String(personKey)],
+    );
+    const row = rows.find((r) => r.provider === provider);
+    if (!row) return { refused: 'not_linked' };
+    const why = unlinkRefusal({ personKey: String(personKey), provider, count: rows.length });
+    if (why) return { refused: why };
+    await client.query(`DELETE FROM platform_identity_account_logins WHERE id = $1`, [row.id]);
+    if (provider === 'github') {
+      await client.query(`UPDATE platform_identity_accounts SET github_login = NULL WHERE id = $1`, [row.account_id]);
+    }
+    return { unlinked: true };
+  }, { pool });
+}
+
+// A first sign-in whose address another way in already carries → the providers
+// to suggest instead, e.g. ['github'], or [] (task 1004995). Asked only while
+// this provider identity reaches no one yet, so the person can sign in with the
+// account they already have and link this one there, rather than make a second
+// account they would never be able to join to the first. Only provider NAMES
+// come back — never who, never the address — and nothing is joined: owning a
+// matching address must not reach anyone's account (owner, 2026-10-29). This is
+// the one read that compares emails.
+async function existingAccountHint({ provider, subject, email } = {}, { pool = defaultPool } = {}) {
+  const l = normalizeLogin({ provider, subject });
+  const e = cleanEmail(email);
+  if (!l || !e) return [];
+  if (await findPersonByLogin(l, { pool })) return [];
+  const { rows } = await pool.query(
+    `SELECT DISTINCT provider FROM platform_identity_account_logins
+      WHERE provider <> $1 AND lower(email) = lower($2)`,
+    [l.provider, e],
+  );
+  return LOGIN_PROVIDERS.filter((p) => rows.some((r) => r.provider === p));
+}
+
+// The hub's own GitHub sign-in stamps its way in as used, and keeps the address
+// GitHub showed (its public one), so a later Google sign-in can be offered a
+// link. Display and suggestion only, like every email here.
+async function touchGithubLogin({ githubId, email } = {}, { pool = defaultPool } = {}) {
+  const l = normalizeLogin({ provider: 'github', subject: githubId });
+  if (!l) return;
+  await pool.query(
+    `UPDATE platform_identity_account_logins SET last_used_at = now(), email = COALESCE($2, email)
+      WHERE provider = 'github' AND subject = $1`,
+    [l.subject, cleanEmail(email)],
+  );
+}
+
 module.exports = {
   LOGIN_PROVIDERS,
   normalizeLogin,
@@ -202,4 +327,10 @@ module.exports = {
   createAccountForLogin,
   signInWithLogin,
   listLoginsForPerson,
+  personKeyForGithub,
+  linkLogin,
+  unlinkRefusal,
+  unlinkLogin,
+  existingAccountHint,
+  touchGithubLogin,
 };

package/modules/platform-identity/migrations/platform_identity_035_account_login_email_idx.sql

@@ -0,0 +1,19 @@
+-- platform_identity_035 — index the ways in by address, for the one email read
+-- (task 1004995, ADR 0396 amendment "linking").
+--
+-- existingAccountHint (account-logins.js) asks, on a first Google sign-in, whether
+-- another way in shows the address Google verified, so the person can be offered
+-- the account they already have instead of a second one. It compares
+-- lower(email) = lower($2), which no index served: every first Google sign-in
+-- would scan the whole table. This partial expression index serves exactly that
+-- read and skips the rows with no address (most GitHub ways in).
+--
+-- Additive and idempotent: an index only, no column or constraint changes, so a
+-- reader that never applies this file still works, only slower.
+
+CREATE INDEX IF NOT EXISTS platform_identity_account_logins_lower_email_idx
+  ON platform_identity_account_logins (lower(email))
+  WHERE email IS NOT NULL;
+
+COMMENT ON INDEX platform_identity_account_logins_lower_email_idx IS
+  'Serves existingAccountHint''s lower(email) match on a first Google sign-in (task 1004995). A suggestion read only: no sign-in or link is decided by an email.';

package/modules/platform-identity/routes/profile.js

@@ -239,9 +239,17 @@ module.exports = function profileRoutes() {
   // ADR 0393): GitHub, Google, or both, with the address each provider vouched
   // for. Keyed on the authenticated github_id (the person key); the provider's
   // user id never crosses. A system:* principal has no platform account: [].
+  //
+  // Each method carries `unlink_refused` (null, 'last_way_in' or 'born_with') so the
+  // page can say why a Remove is missing (task 1004995).
   router.get('/me/sign-in-methods', requireBuilder, async (req, res) => {
     try {
-      const methods = await logins.listLoginsForPerson(req.builder.github_id, { pool });
+      const key = req.builder.github_id;
+      const rows = await logins.listLoginsForPerson(key, { pool });
+      const methods = rows.map((m) => ({
+        ...m,
+        unlink_refused: logins.unlinkRefusal({ personKey: String(key), provider: m.provider, count: rows.length }),
+      }));
       res.set('Cache-Control', 'no-store');
       res.json({ methods, providers: logins.LOGIN_PROVIDERS });
     } catch (err) {
@@ -250,5 +258,25 @@ module.exports = function profileRoutes() {
     }
   });
 
+  // rank: any-builder — remove one way in from the caller's OWN account (task
+  // 1004995), keyed on the authenticated person key. Never the last way in, and
+  // never GitHub from an account born with it (its key is its GitHub id). Adding
+  // a way in is a sign-in, so it lives with the sign-in routes, not here.
+  router.delete('/me/sign-in-methods/:provider', requireBuilder, async (req, res) => {
+    const provider = String(req.params.provider || '');
+    if (!logins.LOGIN_PROVIDERS.includes(provider)) return res.fail('unknown_provider', 404);
+    try {
+      const out = await logins.unlinkLogin({ personKey: req.builder.github_id, provider }, { pool });
+      res.set('Cache-Control', 'no-store');
+      if (out.unlinked) return res.json({ ok: true });
+      if (out.refused === 'not_linked') return res.fail('not_linked', { status: 404, message: 'that way in is not linked to your account' });
+      if (out.refused === 'last_way_in') return res.fail('last_way_in', { status: 409, message: 'this is your only way in, so it cannot be removed — link another first' });
+      return res.fail('born_with', { status: 409, message: 'your account was made with GitHub, so GitHub stays linked' });
+    } catch (err) {
+      api.logger('platform-identity').error(`DELETE /me/sign-in-methods/:provider failed: ${err && err.message}`);
+      res.fail('sign_in_method_unlink_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };

package/modules/platform-identity/routes/sso.js

@@ -32,7 +32,8 @@ const guildEngagements = require('../guild-engagements');
 const instanceFeedback = require('../instance-feedback');
 const projectStats = require('../project-stats');
 // Ways in other than GitHub (task 1004993, ADR 0393/0396).
-const { signInWithLogin, hallTakesPersonKey } = require('../account-logins');
+const logins = require('../account-logins');
+const { signInWithLogin, hallTakesPersonKey } = logins;
 
 // What a Google-only person reads when a project's hall runs a core too old to
 // take them (task 1004994).
@@ -243,8 +244,21 @@ function registerSeams() {
       // a human accepts the platform terms, beside /sso/authorize. Core passes the
       // identity GitHub returned for the code it exchanged, never a request field,
       // and `activate: true` is a source literal here exactly as it is there.
-      recordHubSignin: ({ githubId, githubLogin, displayName, avatarUrl }) => pi.upsertAccount({
-        githubId, githubLogin, displayName, avatarUrl, activate: true,
+      // `githubId` is the PERSON key the sign-in resolved (task 1004995: a GitHub
+      // account linked to someone who joined with Google reaches their key), and
+      // `githubUserId` + `email` stamp the GitHub way in itself as used.
+      recordHubSignin: async ({ githubId, githubLogin, displayName, avatarUrl, githubUserId, email }) => {
+        await pi.upsertAccount({ githubId, githubLogin, displayName, avatarUrl, activate: true }, { pool });
+        await logins.touchGithubLogin({ githubId: githubUserId || githubId, email }, { pool });
+      },
+      // task 1004995: who a GitHub sign-in reaches (null = no one yet, so the
+      // GitHub id itself), and linking a second way in to the signed-in person.
+      personKeyForGithub: (githubUserId) => logins.personKeyForGithub(githubUserId, { pool }),
+      // A first Google sign-in whose verified address another way in carries →
+      // the providers to offer instead (names only; nothing is joined).
+      googleSignInHint: ({ subject, email }) => logins.existingAccountHint({ provider: 'google', subject, email }, { pool }),
+      linkLogin: ({ personKey, provider, subject, email, githubLogin }) => logins.linkLogin({
+        personKey, provider, subject, email, githubLogin,
       }, { pool }),
       // task 1004993 (ADR 0396): the hub's own Google sign-in. Finds the person by
       // Google's own id or creates them; never by an email. Core passes only what it
@@ -501,6 +515,14 @@ module.exports = function ssoRoutes() {
       if (out.state !== 'ok') return res.json(out); // pending | slow_down | expired | denied
       if (!out.client_id) return res.fail('device_poll_failed', { status: 500, message: 'internal error' });
       const id = out.identity;
+      // A GitHub account linked to someone who joined with Google is THAT person
+      // (task 1004995). This leg carries no sign of whether the project's core can
+      // take their key, so it never mints one for them: it says to sign in to the
+      // project in the browser, where /sso/authorize can tell.
+      const personKey = await logins.personKeyForGithub(id.github_id);
+      if (personKey && personKey !== String(id.github_id)) {
+        return res.fail('sign_in_in_browser', { status: 409, message: 'This GitHub account is linked to an account that joined with Google. Sign in to the project in your browser instead.' });
+      }
       await pi.upsertAccount({
         githubId: id.github_id,
         githubLogin: id.github_login,

package/modules/public-landing/public/account.html

@@ -214,6 +214,22 @@
       </form>
     </section>
 
+    <!-- WAYS TO SIGN IN — GET/DELETE /me/sign-in-methods (task 1004995). Linking is
+         a sign-in with the other account, so Link is a link to the sign-in routes,
+         and their answer comes back here as ?linked= or ?link_refused=. A way in
+         the server says cannot be removed shows why instead of a Remove. The rows
+         are cosmos.css's .mineRow, as under "projects you build on". -->
+    <section class="aSec" id="aWaysIn" aria-labelledby="aWaysIn-h">
+      <h2 id="aWaysIn-h">ways to sign in</h2>
+      <p class="aSide">GitHub, Google or both. Each one opens this same account, with the same credits, ranks and history.</p>
+      <div class="aBody">
+        <p class="aWhat" id="waysLoading">Reading your ways to sign in…</p>
+        <ul class="mineRows" id="waysList"></ul>
+        <p class="finePrint">Linking never joins two accounts. If the other one already has its own account here, we say so and change nothing.</p>
+        <p class="projMsg" id="waysMsg" role="status" aria-live="polite"></p>
+      </div>
+    </section>
+
     <!-- WHO CAN FIND YOU — account_visibility + recruiter_discoverable (privacy
          spec D1/D3, task 1002966), PATCH /me/cross-project. Ported from the hall's
          old "Profile privacy" section. The recruiter copy must name EXACTLY what
@@ -378,6 +394,7 @@
       }
       loadBuilding();
       loadGuilds();
+      loadWaysIn();
     }, function () { showAlert('Couldn’t reach the server — check your connection and refresh.'); });
   }
 
@@ -697,6 +714,103 @@
     }, function () { restore(); say(msg, 'Couldn’t reach the server. Try again.', 'err'); });
   }
 
+  // ---- ways to sign in (task 1004995). Read once the account is shown. A
+  // link's answer arrives in the address (?linked= / ?link_refused=) from the
+  // sign-in routes, and is said here in the page's own words. ----
+  var PROVIDER_NAME = { github: 'GitHub', google: 'Google' };
+  var LINK_START = { github: '/auth/link/github/start', google: '/auth/google/start?link=1' };
+  var KEPT_WHY = {
+    last_way_in: 'Your only way in, so it stays. Link another to be able to remove it.',
+    born_with: 'Your account was made with GitHub, so GitHub stays linked.',
+  };
+  function linkAnswer() {
+    var q = window.location.search || '';
+    var linked = /[?&]linked=(github|google)(&|$)/.exec(q);
+    if (linked) return { text: PROVIDER_NAME[linked[1]] + ' is linked. You can now sign in with either.', kind: 'ok' };
+    var refused = /[?&]link_refused=([a-z_]+)/.exec(q);
+    if (!refused) return null;
+    var p = /[?&]provider=(github|google)(&|$)/.exec(q);
+    var name = p ? PROVIDER_NAME[p[1]] : 'That';
+    var words = {
+      taken: 'That ' + name + ' account already has its own account here, so it was not linked. We never join two accounts; nothing changed.',
+      already_linked: 'Your account already has a ' + name + ' account linked. Remove it first to link a different one.',
+      cancelled: 'You cancelled linking ' + name + '. Nothing changed.',
+      expired: 'Linking ' + name + ' took too long. Try again.',
+    };
+    return { text: words[refused[1]] || 'Couldn’t link ' + name + '. Try again.', kind: 'err' };
+  }
+  function loadWaysIn() {
+    var msg = $('waysMsg');
+    var answer = linkAnswer();
+    if (answer) say(msg, answer.text, answer.kind);
+    return request('GET', '/me/sign-in-methods').then(function (res) {
+      $('waysLoading').hidden = true;
+      if (!res.ok || !res.data) { say(msg, 'Couldn’t read your ways to sign in — refresh in a moment.', 'err'); return; }
+      paintWaysIn(res.data.methods || [], res.data.providers || []);
+    }, function () {
+      $('waysLoading').hidden = true;
+      say(msg, 'Couldn’t reach the server — check your connection and refresh.', 'err');
+    });
+  }
+  function paintWaysIn(methods, providers) {
+    var ul = $('waysList');
+    ul.textContent = '';
+    providers.forEach(function (p) {
+      var held = methods.filter(function (m) { return m.provider === p; })[0];
+      ul.appendChild(wayRow(p, held));
+    });
+  }
+  function wayRow(provider, held) {
+    var name = PROVIDER_NAME[provider] || provider;
+    var row = rowEl('li', 'mineRow');
+    var main = rowEl('div', 'mineRow__main');
+    var title = rowEl('div', 'mineRow__name');
+    title.textContent = name;
+    main.appendChild(title);
+    var line = rowEl('span', 'mineRow__host');
+    line.textContent = held ? (held.email || 'linked') : 'not linked';
+    main.appendChild(line);
+    if (held && held.unlink_refused && KEPT_WHY[held.unlink_refused]) {
+      var why = rowEl('span', 'aTag');
+      why.textContent = KEPT_WHY[held.unlink_refused];
+      main.appendChild(why);
+    }
+    row.appendChild(main);
+    var actions = rowEl('div', 'mineRow__actions');
+    if (!held) {
+      var a = document.createElement('a');
+      a.className = 'btn small';
+      a.href = API + LINK_START[provider];
+      a.textContent = 'Link ' + name;
+      actions.appendChild(a);
+    } else if (!held.unlink_refused) {
+      var btn = document.createElement('button');
+      btn.type = 'button';
+      btn.className = 'btn small ghost';
+      btn.textContent = 'Remove';
+      btn.setAttribute('aria-label', 'Remove ' + name);
+      btn.addEventListener('click', function () { unlinkWay(provider, name, btn); });
+      actions.appendChild(btn);
+    }
+    row.appendChild(actions);
+    return row;
+  }
+  function unlinkWay(provider, name, btn) {
+    var msg = $('waysMsg');
+    btn.disabled = true;
+    btn.textContent = 'Removing…';
+    request('DELETE', '/me/sign-in-methods/' + provider).then(function (res) {
+      if (res.status === 401) { btn.disabled = false; btn.textContent = 'Remove'; sessionGone(msg); return; }
+      if (!res.ok) {
+        btn.disabled = false; btn.textContent = 'Remove';
+        say(msg, serverWords(res, 'Couldn’t remove ' + name + '. Try again.'), 'err');
+        return;
+      }
+      say(msg, name + ' is removed. It no longer opens this account.', 'ok');
+      loadWaysIn();
+    }, function () { btn.disabled = false; btn.textContent = 'Remove'; say(msg, 'Couldn’t reach the server. Try again.', 'err'); });
+  }
+
   // The identity read failing is not a sign-out. If the account itself was
   // read, the chip names it from that answer, so the way out is never lost.
   load().then(function () { return bar.ready; }).then(function () {

package/modules/public-landing/public/account.states.json

@@ -13,6 +13,7 @@
     "in-projects-band": { "auth": true, "actions": [["wait", 400], ["click", "#projTrig"], ["wait", 300]], "expect": { "visible": ["#menuProjects", "#mineCell"], "hidden": ["#menuProfile"] } },
     "in-profile-band": { "auth": true, "actions": [["wait", 400], ["click", "#who"], ["wait", 300]], "expect": { "visible": ["#menuProfile"], "hidden": ["#menuProjects"], "text": [["#bandWhoLogin", "builder"], ["#menuProfile [aria-current=\"page\"]", "Account"]] } },
     "in-building": { "auth": true, "url": "/account#aBuilding", "actions": [["wait", 500]], "expect": { "visible": ["#aBuilding", "#buildingList"], "hidden": ["#buildingEmpty", "#buildingLoading"], "count": [["#buildingList .mineRow", 2]], "text": [["#buildingList .mineRow:first-child .mineRow__name", "Example World"], ["#buildingList .mineRow:first-child .mineRow__host", "example.com"]], "attr": [["#buildingList .mineRow:first-child button", "aria-label", "Leave Example World"]] } },
+    "in-ways": { "auth": true, "url": "/account#aWaysIn", "actions": [["wait", 500]], "expect": { "visible": ["#aWaysIn", "#waysList"], "hidden": ["#waysLoading"], "count": [["#waysList .mineRow", 2]], "text": [["#waysList .mineRow:first-child .mineRow__name", "GitHub"], ["#waysList .mineRow:nth-child(2) .mineRow__host", "octo@example.com"]], "attr": [["#waysList .mineRow:nth-child(2) button", "aria-label", "Remove Google"]] } },
     "in-privacy": { "auth": true, "actions": [["wait", 400], ["click", "#aPrivacy .aOpt:nth-child(2)"], ["wait", 150]], "expect": { "checked": "input[name=visibility][value=private]", "visible": ["#visGuilds"], "hidden": ["#recordGuilds"], "count": [["#visGuildList li", 2]], "attr": [["#visGuildList li:first-child a", "href", "/g/forge-crew"]], "text": [["#visGuildList li:first-child a", "Forge Crew"], ["#recWhat", "They will see your name, your picture, your roles, and whether you have been active in the last 30 days — never your credits, works shipped, karma, or the projects you build on. This is the one thing a recruiter can see while your profile page is private. Turning this off removes you from both recruiting surfaces — the recruiting directory, and a recruiter’s look-up of one builder — straight away. · For now this follows your profile page setting."]] } }
   },
   "reducedMotion": { "auth": true, "actions": [["wait", 300]] }