@bongos/core 1.24.5 → 1.24.7

package/modules/lifecycle/autopickup.js

@@ -56,11 +56,26 @@ async function countForRound(exec, taskId) {
   return Number(rows[0] && rows[0].n) || 0;
 }
 
-// autoPickupRefusal(client, task, settings) — null when the marked claim may
+// effectiveCap(settings, rank) — { cap, from: 'rank' | 'project' } (task 1005003).
+// The claimer's rank's own cap when the project set one, else the project cap. The
+// cap is measured against the project's monthly count either way: a rank cap says
+// how far into the month a runner of that rank may still pick up, not a separate
+// allowance per builder, so the ledger count stays one project-wide number. Pure.
+function effectiveCap(settings, rank) {
+  const s = settings || {};
+  const caps = s.rank_caps || {};
+  if (rank && Object.prototype.hasOwnProperty.call(caps, rank) && Number.isInteger(caps[rank])) {
+    return { cap: caps[rank], from: 'rank' };
+  }
+  return { cap: s.cap, from: 'project' };
+}
+
+// autoPickupRefusal(client, task, settings, rank) — null when the marked claim may
 // proceed, else the refusal object claimTask throws. `settings` is the resolved
-// { mode, cap }, read BEFORE the transaction opens (the claimPermissionsFor
-// precedent: a settings read is not part of the claim's consistency).
-async function autoPickupRefusal(client, task, settings) {
+// { mode, cap, rank_caps }, read BEFORE the transaction opens (the
+// claimPermissionsFor precedent: a settings read is not part of the claim's
+// consistency). `rank` is the claimer's rank, read inside it.
+async function autoPickupRefusal(client, task, settings, rank = null) {
   if (!task || task.source !== PAGE_TWEAK_SOURCE) {
     return { code: 'AUTO_PICKUP_NOT_A_TWEAK', message: 'Only a page tweak round can be claimed with the auto_pickup mark.' };
   }
@@ -77,11 +92,12 @@ async function autoPickupRefusal(client, task, settings) {
     };
   }
   const used = await countThisMonth(client);
-  if (used >= s.cap) {
-    return {
-      code: 'AUTO_PICKUP_CAP_REACHED', used, cap: s.cap,
-      message: `Auto-pickup has used this month's ${s.cap} rounds, so submitted pages wait for a person until next month.`,
-    };
+  const { cap, from } = effectiveCap(s, rank);
+  if (used >= cap) {
+    const message = from === 'rank'
+      ? `This month's auto-pickups have reached ${cap}, the limit this project sets for a ${rank} builder's runner, so submitted pages wait for a person until next month.`
+      : `Auto-pickup has used this month's ${cap} rounds, so submitted pages wait for a person until next month.`;
+    return { code: 'AUTO_PICKUP_CAP_REACHED', used, cap, cap_from: from, message };
   }
   return null;
 }
@@ -90,5 +106,6 @@ module.exports = {
   LOCK_KEY,
   MAX_AUTO_APPLIES_PER_ROUND,
   countThisMonth,
+  effectiveCap,
   autoPickupRefusal,
 };

package/modules/lifecycle/db-claims.js

@@ -374,7 +374,7 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     // limit are counted under a project-wide advisory lock that this transaction
     // holds through the insert below, so two runners cannot both take the last slot.
     if (autoPickup) {
-      const refusal = await autoPickupRefusal(client, task, autoPickupSettings);
+      const refusal = await autoPickupRefusal(client, task, autoPickupSettings, builderRank);
       if (refusal) throw refusal;
     }
 

package/modules/lifecycle/routes/claims.js

@@ -443,7 +443,13 @@ module.exports = function buildClaimsRouter() {
   // rank: any-builder — atomic multi-claim; same Xenos row-level filter applies.
   // V3.R13 (#237): same newcomer gate as POST /claims — a fresh builder can't
   // sneak around the "one claim at a time" rule by batching.
-  router.post('/claims/batch', auth.requireBuilder, gateNewcomerClaim, async (req, res) => {
+  // task 1005005: and the same gateOneActiveClaimPerSession as POST /claims, in
+  // the same order, so a session already holding a claim in this tree cannot
+  // batch more work into it. It reads the SESSION's existing active claims (the
+  // batch's own rows do not exist yet), keyed on the body's worktree_name — the
+  // caller's tree, which a batch also uses as its row-name prefix. A
+  // bind_session:false batch (the hall) has no session and passes, as on /claims.
+  router.post('/claims/batch', auth.requireBuilder, gateOneActiveClaimPerSession, gateNewcomerClaim, async (req, res) => {
     if (validateOrRespond(req, res, {
       task_ids: { required: true, type: 'array', maxItems: 20 },
       worktree_name: { type: 'string', maxLength: LIMITS.WORKTREE_NAME },

package/modules/lifecycle/routes/project-settings.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// modules/lifecycle/routes/project-settings.js — the five fundamentals of a project,
+// modules/lifecycle/routes/project-settings.js — the seven fundamentals of a project,
 // in one read, each carrying WHERE its value came from (task 1003280, goal 1000072,
 // criterion legibility-project-settings).
 //
@@ -60,6 +60,33 @@ function shipModeRow(resolved) {
   };
 }
 
+// --- the monthly tweak-round cap (task 1005003) -----------------------------
+//
+// The project cap and one optional cap per builder rank, editable on the settings
+// page. The ranks come from the kernel's live ladder, never re-typed here or on the
+// page; a rank with no number follows the project cap.
+function tweakCapRow(resolved) {
+  const r = resolved || {};
+  const rankCaps = r.rank_caps || {};
+  return {
+    key: 'tweak_round_cap',
+    title: 'Monthly tweak rounds',
+    editable: true,
+    state: 'live',
+    value: {
+      cap: r.cap,
+      max: api.projectSettings.MAX_AUTOPICKUP_CAP,
+      ranks: api.LIVE_RANK_LADDER.map((rank) => ({ rank, cap: Object.prototype.hasOwnProperty.call(rankCaps, rank) ? rankCaps[rank] : null })),
+    },
+    sentence: `Tweak auto-pickup may apply up to ${r.cap} submitted pages a month. A builder rank can have its own limit; `
+      + 'a rank left blank follows the project limit. When the limit is reached, pages wait for a person.',
+    source: r.source ? r.source.cap : 'default',
+    // Only a cap value this row draws; an unusable on/off switch is not this row's.
+    invalid: (r.invalid || []).find((i) => /autopickup_(monthly_cap|rank_cap\.)/.test(String(i && i.where))) || null,
+    reads: { file: 'project_settings[\'tweak.autopickup_monthly_cap\', \'tweak.autopickup_rank_cap.<rank>\']', adr: 'ADR 0371 D5' },
+  };
+}
+
 // callerHolds(builderId, atom) → true | false | null. null means authority could
 // not be established (government port missing or the resolver threw); a reader
 // treats that as unknown, never as a grant.
@@ -264,6 +291,7 @@ module.exports = function buildProjectSettingsRouter() {
       // category the owner cannot see is one they cannot bring back.
       const categories = await goalCategory.listCategories({ includeInactive: true });
       const shipMode = await api.projectSettings.resolveShipMode();
+      const tweak = await api.projectSettings.resolveTweakAutopickup();
 
       // A settings read is a configuration comparison — a cached one is wrong the
       // moment somebody turns a knob (the rot.js precedent).
@@ -271,6 +299,7 @@ module.exports = function buildProjectSettingsRouter() {
       res.json({
         rows: [
           shipModeRow(shipMode),
+          tweakCapRow(tweak),
           {
             key: 'rot_timer',
             title: 'Stale timer',
@@ -443,14 +472,23 @@ module.exports = function buildProjectSettingsRouter() {
   //
   // rank: any signed-in builder. The runner reads it before it tries a round, and
   // the studio shows the count; it carries no reward internals or file paths.
-  async function autopickupBody() {
+  //
+  // cap is the project's; rank_caps the per-rank caps the project set (task
+  // 1005003). my_cap is the one that applies to the CALLER's rank, and
+  // remaining_this_month is measured against it, so a runner reads the number the
+  // claim gate will hold it to.
+  async function autopickupBody(rank = null) {
     const resolved = await api.projectSettings.resolveTweakAutopickup();
     const used = await autopickup.countThisMonth();
+    const mine = autopickup.effectiveCap(resolved, rank);
     return {
       mode: resolved.mode,
       cap: resolved.cap,
+      rank_caps: resolved.rank_caps || {},
+      my_cap: mine.cap,
+      my_cap_from: mine.from,
       used_this_month: used,
-      remaining_this_month: Math.max(0, resolved.cap - used),
+      remaining_this_month: Math.max(0, mine.cap - used),
       per_round_limit: autopickup.MAX_AUTO_APPLIES_PER_ROUND,
       source: resolved.source,
       invalid: resolved.invalid,
@@ -461,32 +499,54 @@ module.exports = function buildProjectSettingsRouter() {
   router.get('/project-settings/tweak-autopickup', api.requireBuilder, async (req, res) => {
     try {
       res.set('Cache-Control', 'no-store');
-      res.json(await autopickupBody());
+      res.json(await autopickupBody(req.builder && req.builder.rank));
     } catch (err) {
       log.error(`GET /project-settings/tweak-autopickup: ${err && err.message}`);
       res.fail('project_settings_read_failed', { status: 500, message: 'internal error' });
     }
   });
 
-  // PATCH /project-settings/tweak-autopickup — body { mode?: 'off' | 'on', cap?: n }.
+  // PATCH /project-settings/tweak-autopickup — body { mode?: 'off' | 'on', cap?: n,
+  // rank_caps?: { <rank>: n | null } }.
   //
   // rank: project.settings.manage (metic+, government_010), the same atom as the
   // other writes on this page. Each field is validated by the resolver's own parser,
-  // and both are checked before either is written, so a half-valid body writes nothing.
+  // and all are checked before any is written, so a half-valid body writes nothing.
+  //
+  // rank_caps (task 1005003) is a PARTIAL update: a rank named with a number gets
+  // that cap, a rank named with null loses its own cap (and follows the project cap
+  // again), and a rank not named is left as it was. A rank must be on the live
+  // ladder; each number goes through parseAutopickupCap, the project cap's parser.
   router.patch('/project-settings/tweak-autopickup', api.requireBuilder, api.requirePermission('project.settings.manage'), api.requireActAlone('rules'), async (req, res) => {
-    if (api.validateOrRespond(req, res, { mode: { type: 'string' }, cap: { type: 'number' } })) return;
+    if (api.validateOrRespond(req, res, { mode: { type: 'string' }, cap: { type: 'number' }, rank_caps: { type: 'object' } })) return;
     const body = req.body || {};
-    if (body.mode == null && body.cap == null) {
-      return res.fail('bad_tweak_autopickup', { status: 400, message: 'send mode, cap, or both' });
+    if (body.mode == null && body.cap == null && body.rank_caps == null) {
+      return res.fail('bad_tweak_autopickup', { status: 400, message: 'send mode, cap, rank_caps, or any of them' });
     }
     const mode = body.mode == null ? null : api.projectSettings.parseAutopickup(body.mode);
     if (mode && !mode.mode) return res.fail('bad_tweak_autopickup', { status: 400, message: `mode: ${mode.reason}` });
     const cap = body.cap == null ? null : api.projectSettings.parseAutopickupCap(body.cap);
     if (cap && cap.cap == null) return res.fail('bad_tweak_autopickup', { status: 400, message: `cap: ${cap.reason}` });
+    const rankEdits = [];
+    for (const [rank, value] of Object.entries(body.rank_caps || {})) {
+      if (!api.LIVE_RANK_LADDER.includes(rank)) {
+        return res.fail('bad_tweak_autopickup', { status: 400, message: `rank_caps: unknown rank '${rank}' (one of ${api.LIVE_RANK_LADDER.join(' | ')})` });
+      }
+      if (value === null) { rankEdits.push([rank, null]); continue; }
+      const got = api.projectSettings.parseAutopickupCap(value);
+      if (got.cap == null) return res.fail('bad_tweak_autopickup', { status: 400, message: `rank_caps.${rank}: ${got.reason}` });
+      rankEdits.push([rank, got.cap]);
+    }
     try {
       if (mode) await api.projectSettings.set(api.projectSettings.KEYS.TWEAK_AUTOPICKUP, mode.mode, req.builder.id);
       if (cap) await api.projectSettings.set(api.projectSettings.KEYS.TWEAK_AUTOPICKUP_CAP, cap.cap, req.builder.id);
-      res.json({ ok: true, ...(await autopickupBody()) });
+      // One row per rank, each a single upsert: no read-modify-write, so two people
+      // editing two ranks at once cannot drop each other's edit. '' clears a rank
+      // (the resolver reads an empty value as "no cap of its own").
+      for (const [rank, n] of rankEdits) {
+        await api.projectSettings.set(`${api.projectSettings.KEYS.TWEAK_AUTOPICKUP_RANK_CAP_PREFIX}${rank}`, n === null ? '' : n, req.builder.id);
+      }
+      res.json({ ok: true, ...(await autopickupBody(req.builder && req.builder.rank)) });
     } catch (err) {
       log.error(`PATCH /project-settings/tweak-autopickup: ${err && err.message}`);
       res.fail('project_settings_write_failed', { status: 500, message: 'internal error' });
@@ -498,3 +558,4 @@ module.exports = function buildProjectSettingsRouter() {
 
 module.exports.settingsDeskRows = settingsDeskRows;
 module.exports.shipModeRow = shipModeRow;
+module.exports.tweakCapRow = tweakCapRow;

package/modules/platform-identity/account-logins.js

@@ -192,6 +192,131 @@ async function listLoginsForPerson(personKey, { pool = defaultPool } = {}) {
   return rows;
 }
 
+// ── Linking (task 1004995) ──────────────────────────────────────────────────
+// A signed-in person adds a second way in by signing in with it. Never a merge:
+// a way in that already reaches ANOTHER person is refused with 'taken', because
+// both accounts may hold credits, ranks and history and joining them is a
+// decision the server must not make on anyone's behalf (owner, 2026-10-29).
+
+// Who signs in with this GitHub user id? → the person key, or null when no one
+// does yet. Every GitHub sign-in on the hub asks this first, so a GitHub account
+// linked to someone who joined with Google reaches THEM, not a second person
+// keyed on the GitHub id (the ADR 0393 carry-over).
+async function personKeyForGithub(githubId, { pool = defaultPool } = {}) {
+  const person = await findPersonByLogin({ provider: 'github', subject: githubId }, { pool });
+  return person ? person.personKey : null;
+}
+
+// Add a way in to the signed-in person → { linked: true, already } or
+// { refused: 'taken' | 'already_linked' | 'no_account' }. For GitHub the linked
+// login is also written on the account (ADR 0393 §4: NULL until linking sets it).
+async function linkLogin({ personKey, provider, subject, email, githubLogin } = {}, { pool = defaultPool } = {}) {
+  const l = normalizeLogin({ provider, subject });
+  if (!l || !pi.isNumericGithubId(personKey)) throw new Error('linkLogin: not a valid person or provider identity');
+  const owner = await findPersonByLogin(l, { pool });
+  if (owner) return owner.personKey === String(personKey) ? { linked: true, already: true } : { refused: 'taken' };
+  try {
+    return await withTx(async (client) => {
+      const { rows } = await client.query(
+        `SELECT id FROM platform_identity_accounts WHERE github_id = $1`, [String(personKey)],
+      );
+      if (!rows[0]) return { refused: 'no_account' };
+      await client.query(
+        `INSERT INTO platform_identity_account_logins (account_id, provider, subject, email, last_used_at)
+         VALUES ($1, $2, $3, $4, now())`,
+        [rows[0].id, l.provider, l.subject, cleanEmail(email)],
+      );
+      if (l.provider === 'github') {
+        await client.query(
+          `UPDATE platform_identity_accounts SET github_login = $2 WHERE id = $1`,
+          [rows[0].id, typeof githubLogin === 'string' && githubLogin ? githubLogin.slice(0, 100) : null],
+        );
+      }
+      return { linked: true, already: false };
+    }, { pool });
+  } catch (err) {
+    if (err && err.code === '23505') {
+      // Which UNIQUE fired decides the answer: another person took this way in
+      // a moment ago, or this person already holds one for the provider.
+      const raced = await findPersonByLogin(l, { pool });
+      if (raced && raced.personKey !== String(personKey)) return { refused: 'taken' };
+      if (raced) return { linked: true, already: true };
+      return { refused: 'already_linked' };
+    }
+    throw err;
+  }
+}
+
+// Why this way in cannot be removed, or null when it can. Never the last way in
+// (owner, 2026-10-29); and never GitHub from an account born with it, because
+// that account's key IS its GitHub id, so a GitHub sign-in would still reach it.
+function unlinkRefusal({ personKey, provider, count }) {
+  if (provider === 'github' && !isMintedPersonKey(personKey)) return 'born_with';
+  if (count <= 1) return 'last_way_in';
+  return null;
+}
+
+// Remove a way in from the signed-in person → { unlinked: true } or
+// { refused: 'not_linked' | 'last_way_in' | 'born_with' }. The count and the
+// delete share one transaction, with the rows locked, so two racing removals
+// cannot both pass the last-way-in check.
+async function unlinkLogin({ personKey, provider } = {}, { pool = defaultPool } = {}) {
+  if (!LOGIN_PROVIDERS.includes(provider) || !pi.isNumericGithubId(personKey)) return { refused: 'not_linked' };
+  return withTx(async (client) => {
+    const { rows } = await client.query(
+      `SELECT l.id, l.provider, a.id AS account_id
+         FROM platform_identity_account_logins l
+         JOIN platform_identity_accounts a ON a.id = l.account_id
+        WHERE a.github_id = $1
+        FOR UPDATE OF l`,
+      [String(personKey)],
+    );
+    const row = rows.find((r) => r.provider === provider);
+    if (!row) return { refused: 'not_linked' };
+    const why = unlinkRefusal({ personKey: String(personKey), provider, count: rows.length });
+    if (why) return { refused: why };
+    await client.query(`DELETE FROM platform_identity_account_logins WHERE id = $1`, [row.id]);
+    if (provider === 'github') {
+      await client.query(`UPDATE platform_identity_accounts SET github_login = NULL WHERE id = $1`, [row.account_id]);
+    }
+    return { unlinked: true };
+  }, { pool });
+}
+
+// A first sign-in whose address another way in already carries → the providers
+// to suggest instead, e.g. ['github'], or [] (task 1004995). Asked only while
+// this provider identity reaches no one yet, so the person can sign in with the
+// account they already have and link this one there, rather than make a second
+// account they would never be able to join to the first. Only provider NAMES
+// come back — never who, never the address — and nothing is joined: owning a
+// matching address must not reach anyone's account (owner, 2026-10-29). This is
+// the one read that compares emails.
+async function existingAccountHint({ provider, subject, email } = {}, { pool = defaultPool } = {}) {
+  const l = normalizeLogin({ provider, subject });
+  const e = cleanEmail(email);
+  if (!l || !e) return [];
+  if (await findPersonByLogin(l, { pool })) return [];
+  const { rows } = await pool.query(
+    `SELECT DISTINCT provider FROM platform_identity_account_logins
+      WHERE provider <> $1 AND lower(email) = lower($2)`,
+    [l.provider, e],
+  );
+  return LOGIN_PROVIDERS.filter((p) => rows.some((r) => r.provider === p));
+}
+
+// The hub's own GitHub sign-in stamps its way in as used, and keeps the address
+// GitHub showed (its public one), so a later Google sign-in can be offered a
+// link. Display and suggestion only, like every email here.
+async function touchGithubLogin({ githubId, email } = {}, { pool = defaultPool } = {}) {
+  const l = normalizeLogin({ provider: 'github', subject: githubId });
+  if (!l) return;
+  await pool.query(
+    `UPDATE platform_identity_account_logins SET last_used_at = now(), email = COALESCE($2, email)
+      WHERE provider = 'github' AND subject = $1`,
+    [l.subject, cleanEmail(email)],
+  );
+}
+
 module.exports = {
   LOGIN_PROVIDERS,
   normalizeLogin,
@@ -202,4 +327,10 @@ module.exports = {
   createAccountForLogin,
   signInWithLogin,
   listLoginsForPerson,
+  personKeyForGithub,
+  linkLogin,
+  unlinkRefusal,
+  unlinkLogin,
+  existingAccountHint,
+  touchGithubLogin,
 };

package/modules/platform-identity/migrations/platform_identity_035_account_login_email_idx.sql

@@ -0,0 +1,19 @@
+-- platform_identity_035 — index the ways in by address, for the one email read
+-- (task 1004995, ADR 0396 amendment "linking").
+--
+-- existingAccountHint (account-logins.js) asks, on a first Google sign-in, whether
+-- another way in shows the address Google verified, so the person can be offered
+-- the account they already have instead of a second one. It compares
+-- lower(email) = lower($2), which no index served: every first Google sign-in
+-- would scan the whole table. This partial expression index serves exactly that
+-- read and skips the rows with no address (most GitHub ways in).
+--
+-- Additive and idempotent: an index only, no column or constraint changes, so a
+-- reader that never applies this file still works, only slower.
+
+CREATE INDEX IF NOT EXISTS platform_identity_account_logins_lower_email_idx
+  ON platform_identity_account_logins (lower(email))
+  WHERE email IS NOT NULL;
+
+COMMENT ON INDEX platform_identity_account_logins_lower_email_idx IS
+  'Serves existingAccountHint''s lower(email) match on a first Google sign-in (task 1004995). A suggestion read only: no sign-in or link is decided by an email.';

package/modules/platform-identity/routes/profile.js

@@ -239,9 +239,17 @@ module.exports = function profileRoutes() {
   // ADR 0393): GitHub, Google, or both, with the address each provider vouched
   // for. Keyed on the authenticated github_id (the person key); the provider's
   // user id never crosses. A system:* principal has no platform account: [].
+  //
+  // Each method carries `unlink_refused` (null, 'last_way_in' or 'born_with') so the
+  // page can say why a Remove is missing (task 1004995).
   router.get('/me/sign-in-methods', requireBuilder, async (req, res) => {
     try {
-      const methods = await logins.listLoginsForPerson(req.builder.github_id, { pool });
+      const key = req.builder.github_id;
+      const rows = await logins.listLoginsForPerson(key, { pool });
+      const methods = rows.map((m) => ({
+        ...m,
+        unlink_refused: logins.unlinkRefusal({ personKey: String(key), provider: m.provider, count: rows.length }),
+      }));
       res.set('Cache-Control', 'no-store');
       res.json({ methods, providers: logins.LOGIN_PROVIDERS });
     } catch (err) {
@@ -250,5 +258,25 @@ module.exports = function profileRoutes() {
     }
   });
 
+  // rank: any-builder — remove one way in from the caller's OWN account (task
+  // 1004995), keyed on the authenticated person key. Never the last way in, and
+  // never GitHub from an account born with it (its key is its GitHub id). Adding
+  // a way in is a sign-in, so it lives with the sign-in routes, not here.
+  router.delete('/me/sign-in-methods/:provider', requireBuilder, async (req, res) => {
+    const provider = String(req.params.provider || '');
+    if (!logins.LOGIN_PROVIDERS.includes(provider)) return res.fail('unknown_provider', 404);
+    try {
+      const out = await logins.unlinkLogin({ personKey: req.builder.github_id, provider }, { pool });
+      res.set('Cache-Control', 'no-store');
+      if (out.unlinked) return res.json({ ok: true });
+      if (out.refused === 'not_linked') return res.fail('not_linked', { status: 404, message: 'that way in is not linked to your account' });
+      if (out.refused === 'last_way_in') return res.fail('last_way_in', { status: 409, message: 'this is your only way in, so it cannot be removed — link another first' });
+      return res.fail('born_with', { status: 409, message: 'your account was made with GitHub, so GitHub stays linked' });
+    } catch (err) {
+      api.logger('platform-identity').error(`DELETE /me/sign-in-methods/:provider failed: ${err && err.message}`);
+      res.fail('sign_in_method_unlink_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };

package/modules/platform-identity/routes/sso.js

@@ -32,7 +32,8 @@ const guildEngagements = require('../guild-engagements');
 const instanceFeedback = require('../instance-feedback');
 const projectStats = require('../project-stats');
 // Ways in other than GitHub (task 1004993, ADR 0393/0396).
-const { signInWithLogin, hallTakesPersonKey } = require('../account-logins');
+const logins = require('../account-logins');
+const { signInWithLogin, hallTakesPersonKey } = logins;
 
 // What a Google-only person reads when a project's hall runs a core too old to
 // take them (task 1004994).
@@ -243,8 +244,21 @@ function registerSeams() {
       // a human accepts the platform terms, beside /sso/authorize. Core passes the
       // identity GitHub returned for the code it exchanged, never a request field,
       // and `activate: true` is a source literal here exactly as it is there.
-      recordHubSignin: ({ githubId, githubLogin, displayName, avatarUrl }) => pi.upsertAccount({
-        githubId, githubLogin, displayName, avatarUrl, activate: true,
+      // `githubId` is the PERSON key the sign-in resolved (task 1004995: a GitHub
+      // account linked to someone who joined with Google reaches their key), and
+      // `githubUserId` + `email` stamp the GitHub way in itself as used.
+      recordHubSignin: async ({ githubId, githubLogin, displayName, avatarUrl, githubUserId, email }) => {
+        await pi.upsertAccount({ githubId, githubLogin, displayName, avatarUrl, activate: true }, { pool });
+        await logins.touchGithubLogin({ githubId: githubUserId || githubId, email }, { pool });
+      },
+      // task 1004995: who a GitHub sign-in reaches (null = no one yet, so the
+      // GitHub id itself), and linking a second way in to the signed-in person.
+      personKeyForGithub: (githubUserId) => logins.personKeyForGithub(githubUserId, { pool }),
+      // A first Google sign-in whose verified address another way in carries →
+      // the providers to offer instead (names only; nothing is joined).
+      googleSignInHint: ({ subject, email }) => logins.existingAccountHint({ provider: 'google', subject, email }, { pool }),
+      linkLogin: ({ personKey, provider, subject, email, githubLogin }) => logins.linkLogin({
+        personKey, provider, subject, email, githubLogin,
       }, { pool }),
       // task 1004993 (ADR 0396): the hub's own Google sign-in. Finds the person by
       // Google's own id or creates them; never by an email. Core passes only what it
@@ -501,6 +515,14 @@ module.exports = function ssoRoutes() {
       if (out.state !== 'ok') return res.json(out); // pending | slow_down | expired | denied
       if (!out.client_id) return res.fail('device_poll_failed', { status: 500, message: 'internal error' });
       const id = out.identity;
+      // A GitHub account linked to someone who joined with Google is THAT person
+      // (task 1004995). This leg carries no sign of whether the project's core can
+      // take their key, so it never mints one for them: it says to sign in to the
+      // project in the browser, where /sso/authorize can tell.
+      const personKey = await logins.personKeyForGithub(id.github_id);
+      if (personKey && personKey !== String(id.github_id)) {
+        return res.fail('sign_in_in_browser', { status: 409, message: 'This GitHub account is linked to an account that joined with Google. Sign in to the project in your browser instead.' });
+      }
       await pi.upsertAccount({
         githubId: id.github_id,
         githubLogin: id.github_login,

package/modules/public-landing/public/account.html

@@ -214,6 +214,22 @@
       </form>
     </section>
 
+    <!-- WAYS TO SIGN IN — GET/DELETE /me/sign-in-methods (task 1004995). Linking is
+         a sign-in with the other account, so Link is a link to the sign-in routes,
+         and their answer comes back here as ?linked= or ?link_refused=. A way in
+         the server says cannot be removed shows why instead of a Remove. The rows
+         are cosmos.css's .mineRow, as under "projects you build on". -->
+    <section class="aSec" id="aWaysIn" aria-labelledby="aWaysIn-h">
+      <h2 id="aWaysIn-h">ways to sign in</h2>
+      <p class="aSide">GitHub, Google or both. Each one opens this same account, with the same credits, ranks and history.</p>
+      <div class="aBody">
+        <p class="aWhat" id="waysLoading">Reading your ways to sign in…</p>
+        <ul class="mineRows" id="waysList"></ul>
+        <p class="finePrint">Linking never joins two accounts. If the other one already has its own account here, we say so and change nothing.</p>
+        <p class="projMsg" id="waysMsg" role="status" aria-live="polite"></p>
+      </div>
+    </section>
+
     <!-- WHO CAN FIND YOU — account_visibility + recruiter_discoverable (privacy
          spec D1/D3, task 1002966), PATCH /me/cross-project. Ported from the hall's
          old "Profile privacy" section. The recruiter copy must name EXACTLY what
@@ -378,6 +394,7 @@
       }
       loadBuilding();
       loadGuilds();
+      loadWaysIn();
     }, function () { showAlert('Couldn’t reach the server — check your connection and refresh.'); });
   }
 
@@ -697,6 +714,103 @@
     }, function () { restore(); say(msg, 'Couldn’t reach the server. Try again.', 'err'); });
   }
 
+  // ---- ways to sign in (task 1004995). Read once the account is shown. A
+  // link's answer arrives in the address (?linked= / ?link_refused=) from the
+  // sign-in routes, and is said here in the page's own words. ----
+  var PROVIDER_NAME = { github: 'GitHub', google: 'Google' };
+  var LINK_START = { github: '/auth/link/github/start', google: '/auth/google/start?link=1' };
+  var KEPT_WHY = {
+    last_way_in: 'Your only way in, so it stays. Link another to be able to remove it.',
+    born_with: 'Your account was made with GitHub, so GitHub stays linked.',
+  };
+  function linkAnswer() {
+    var q = window.location.search || '';
+    var linked = /[?&]linked=(github|google)(&|$)/.exec(q);
+    if (linked) return { text: PROVIDER_NAME[linked[1]] + ' is linked. You can now sign in with either.', kind: 'ok' };
+    var refused = /[?&]link_refused=([a-z_]+)/.exec(q);
+    if (!refused) return null;
+    var p = /[?&]provider=(github|google)(&|$)/.exec(q);
+    var name = p ? PROVIDER_NAME[p[1]] : 'That';
+    var words = {
+      taken: 'That ' + name + ' account already has its own account here, so it was not linked. We never join two accounts; nothing changed.',
+      already_linked: 'Your account already has a ' + name + ' account linked. Remove it first to link a different one.',
+      cancelled: 'You cancelled linking ' + name + '. Nothing changed.',
+      expired: 'Linking ' + name + ' took too long. Try again.',
+    };
+    return { text: words[refused[1]] || 'Couldn’t link ' + name + '. Try again.', kind: 'err' };
+  }
+  function loadWaysIn() {
+    var msg = $('waysMsg');
+    var answer = linkAnswer();
+    if (answer) say(msg, answer.text, answer.kind);
+    return request('GET', '/me/sign-in-methods').then(function (res) {
+      $('waysLoading').hidden = true;
+      if (!res.ok || !res.data) { say(msg, 'Couldn’t read your ways to sign in — refresh in a moment.', 'err'); return; }
+      paintWaysIn(res.data.methods || [], res.data.providers || []);
+    }, function () {
+      $('waysLoading').hidden = true;
+      say(msg, 'Couldn’t reach the server — check your connection and refresh.', 'err');
+    });
+  }
+  function paintWaysIn(methods, providers) {
+    var ul = $('waysList');
+    ul.textContent = '';
+    providers.forEach(function (p) {
+      var held = methods.filter(function (m) { return m.provider === p; })[0];
+      ul.appendChild(wayRow(p, held));
+    });
+  }
+  function wayRow(provider, held) {
+    var name = PROVIDER_NAME[provider] || provider;
+    var row = rowEl('li', 'mineRow');
+    var main = rowEl('div', 'mineRow__main');
+    var title = rowEl('div', 'mineRow__name');
+    title.textContent = name;
+    main.appendChild(title);
+    var line = rowEl('span', 'mineRow__host');
+    line.textContent = held ? (held.email || 'linked') : 'not linked';
+    main.appendChild(line);
+    if (held && held.unlink_refused && KEPT_WHY[held.unlink_refused]) {
+      var why = rowEl('span', 'aTag');
+      why.textContent = KEPT_WHY[held.unlink_refused];
+      main.appendChild(why);
+    }
+    row.appendChild(main);
+    var actions = rowEl('div', 'mineRow__actions');
+    if (!held) {
+      var a = document.createElement('a');
+      a.className = 'btn small';
+      a.href = API + LINK_START[provider];
+      a.textContent = 'Link ' + name;
+      actions.appendChild(a);
+    } else if (!held.unlink_refused) {
+      var btn = document.createElement('button');
+      btn.type = 'button';
+      btn.className = 'btn small ghost';
+      btn.textContent = 'Remove';
+      btn.setAttribute('aria-label', 'Remove ' + name);
+      btn.addEventListener('click', function () { unlinkWay(provider, name, btn); });
+      actions.appendChild(btn);
+    }
+    row.appendChild(actions);
+    return row;
+  }
+  function unlinkWay(provider, name, btn) {
+    var msg = $('waysMsg');
+    btn.disabled = true;
+    btn.textContent = 'Removing…';
+    request('DELETE', '/me/sign-in-methods/' + provider).then(function (res) {
+      if (res.status === 401) { btn.disabled = false; btn.textContent = 'Remove'; sessionGone(msg); return; }
+      if (!res.ok) {
+        btn.disabled = false; btn.textContent = 'Remove';
+        say(msg, serverWords(res, 'Couldn’t remove ' + name + '. Try again.'), 'err');
+        return;
+      }
+      say(msg, name + ' is removed. It no longer opens this account.', 'ok');
+      loadWaysIn();
+    }, function () { btn.disabled = false; btn.textContent = 'Remove'; say(msg, 'Couldn’t reach the server. Try again.', 'err'); });
+  }
+
   // The identity read failing is not a sign-out. If the account itself was
   // read, the chip names it from that answer, so the way out is never lost.
   load().then(function () { return bar.ready; }).then(function () {

package/modules/public-landing/public/account.states.json

@@ -13,6 +13,7 @@
     "in-projects-band": { "auth": true, "actions": [["wait", 400], ["click", "#projTrig"], ["wait", 300]], "expect": { "visible": ["#menuProjects", "#mineCell"], "hidden": ["#menuProfile"] } },
     "in-profile-band": { "auth": true, "actions": [["wait", 400], ["click", "#who"], ["wait", 300]], "expect": { "visible": ["#menuProfile"], "hidden": ["#menuProjects"], "text": [["#bandWhoLogin", "builder"], ["#menuProfile [aria-current=\"page\"]", "Account"]] } },
     "in-building": { "auth": true, "url": "/account#aBuilding", "actions": [["wait", 500]], "expect": { "visible": ["#aBuilding", "#buildingList"], "hidden": ["#buildingEmpty", "#buildingLoading"], "count": [["#buildingList .mineRow", 2]], "text": [["#buildingList .mineRow:first-child .mineRow__name", "Example World"], ["#buildingList .mineRow:first-child .mineRow__host", "example.com"]], "attr": [["#buildingList .mineRow:first-child button", "aria-label", "Leave Example World"]] } },
+    "in-ways": { "auth": true, "url": "/account#aWaysIn", "actions": [["wait", 500]], "expect": { "visible": ["#aWaysIn", "#waysList"], "hidden": ["#waysLoading"], "count": [["#waysList .mineRow", 2]], "text": [["#waysList .mineRow:first-child .mineRow__name", "GitHub"], ["#waysList .mineRow:nth-child(2) .mineRow__host", "octo@example.com"]], "attr": [["#waysList .mineRow:nth-child(2) button", "aria-label", "Remove Google"]] } },
     "in-privacy": { "auth": true, "actions": [["wait", 400], ["click", "#aPrivacy .aOpt:nth-child(2)"], ["wait", 150]], "expect": { "checked": "input[name=visibility][value=private]", "visible": ["#visGuilds"], "hidden": ["#recordGuilds"], "count": [["#visGuildList li", 2]], "attr": [["#visGuildList li:first-child a", "href", "/g/forge-crew"]], "text": [["#visGuildList li:first-child a", "Forge Crew"], ["#recWhat", "They will see your name, your picture, your roles, and whether you have been active in the last 30 days — never your credits, works shipped, karma, or the projects you build on. This is the one thing a recruiter can see while your profile page is private. Turning this off removes you from both recruiting surfaces — the recruiting directory, and a recruiter’s look-up of one builder — straight away. · For now this follows your profile page setting."]] } }
   },
   "reducedMotion": { "auth": true, "actions": [["wait", 300]] }