Merge pages and notices: prove both, choose survivor with preview, undo, notice feed (dark by default) #87
2026-11-14
Merge page blocks a shared provider before consent; requested-undo notice, no passkey promise, every access prunes bearers
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Test: provider-overlap block, grace clauses, proof provider mismatch, requested-undo wording, no passkey promise, bearer prune (red where the code is wrong)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Merge notice feed: derived merged/undone/final notices, idempotent acks, bearer-gated pull routes
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Test: merge notice feed and its bearer (red; the feed is a skeleton and the routes do not exist)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Test: the plan digest binds the survivor id (two memberless survivors with identical records digest differently)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Schema: AddAccountMergeNoticeAcks, the ack row a notice reader adds (notices themselves are derived, nothing stored)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Docs: merge page, its flag and deploy order
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
MergeAccounts page: prove both accounts, choose the survivor against a preview, consent for both, confirm through the saga
Dark behind AccountMerge:Enabled. MergePreview is the one wording of the plan, MergeWording.Confirm the closed refusal words. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Test: merge page, preview wording and the AccountMerge flag (red; page, preview and confirm words are skeletons)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Test: an ended merge shows no notice even with its grace date ahead
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
MergeNotice in the layout and a Merge status link on Membership status
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
MergeStatus page: the member's merges and undo by fresh proof of every moved login
Test files: the bearer list is kept apart from the surface it is checked against; wording tests use the Razor encoder. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
MergeWording: the closed words of the merge pages
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Test: merge status page, notice, wording and undo by fresh proof (red; page, component and wording are skeletons)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Test: a sign-in through a moved login lands on the survivor's account (saga rig opens to page tests)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Test: first undefined attempt purpose is now 11 (9 and 10 are the merge proofs)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Complete merge-proof sign-ins into MergeProofs; refusals return to the starting page
Self redeems as the session's account; Other redeems a verified different account that has a member account found by Heimdall account id. Every refusal precedes the identity list, and the bearer is held only by MergeProofs.Put. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Test: merge-proof sign-ins complete into MergeProofs (red; completion cases are stubs)
Adds the two attempt purposes, their start methods, the four outcomes, the step's return path and the MergeProofs registration; the completion switch cases throw until the next commit. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
MergeProofs: in-memory per-actor holder of merge proofs
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Test: MergeProofs holder (red; type is a skeleton)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Auth and member clients follow no redirect: one WithoutRedirects for all three
The mover's inline no-redirect handler becomes the shared extension; the app-secret auth client and the member-bearer client use it too. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Test: a 307 from Heimdall is not followed by the auth and member clients (red)
AddHeimdallClients gathers the three Heimdall client registrations so the test exercises the registrations Program uses. The auth and member clients still follow redirects here; the mover already does not. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>