# Census: console email sign-in

Status: APPROVED by Paul (census owner), 2026-10-24, recorded on #280 with
main at 65ca4aca. The rows keep `rev3=PROPOSED-email-signin`: under the #369
process nothing is flipped, and later overlays re-froze units at these
dispositions, so a flip would move their fingerprints.

Branch `email-signin`, cut from main at 4d6f0e6c. Design:
`docs/superpowers/specs/2026-10-21-console-email-signin-design.md`.

## What changed

The front page has one address box. An address with a Keymail mailbox goes
to Keymail's sign-in as before. Any other address gets an emailed link and a
six-digit code. A session that signed in by email re-confirms risky actions
by email instead of a passkey. The old Apps-inbox confirmation link is
retired: its route stays, but only says the link has expired.

None of this runs as root. Every unit below runs in the console
(cmd/console serve under console.service, user carlos-console). The root
`carlos` binary links neither `internal/console` nor `internal/mail`, and
`TestRootBinaryLinksNoConsoleOrMail`
(`internal/provision/root_binary_deps_test.go`) pins that with
`go list -deps`. No root read is added.

## Root-read census (TestPlan14RootReadCensus)

Overlay `internal/provision/testdata/plan14-root-reads-email-signin.tsv`,
loaded last, after `plan14-root-reads-claim-merge-main-4.tsv`. Without it the
test reports 47 discrepancies; with it, none.

### Changed units, re-frozen at main's disposition

Each keeps main's basis, with this branch's identity and change appended
(the run-lifecycle-logs-325 form).

| unit | change | sites |
|---|---|---|
| `cmd/console/main.go` `serve` | passes `CARLOS_CONSOLE_NAME` to NewServer as `Config.ConsoleName` | same three `/data` literals, same offsets |
| `server.go` `NewServer` | sets `consoleNameCfg` and the `challengeSem` send bound; registers the four `/auth/email` routes | the logs/data route pattern, moved |
| `authcli.go` `Server.handleCLIApprovePage` | signed out, renders the front page with `next` back to `/auth/cli` instead of redirecting | adds `r.URL.Query()` (a URL, not a file); old site moves |
| `server.go` `Server.handleCallback` | session minting moves into `finishSignin`; reads the `next` cookie | `r.URL.Query()`, unchanged |
| `store.go` `Store.PurgeExpired` | also deletes expired `email_challenges` rows | one more SQLite `Exec` on CONSOLE_DB |
| `store.go` `Store.migrate` | adds `sessions.method` (default `keymail`) and calls `migrateEmailSignin` | SQLite DDL; old site moves |
| templates `check`, `home`, `layout`, `team` | approved copy, the address and code forms, CSS for email inputs | embedded UI input |

### New units, accepted legacy at their siblings' class

All J4 root-input, the class of the console's other store methods,
URL-query handlers and templates.

| unit | what it reads |
|---|---|
| `emailsignin_store.go`: `Store.HoldEmailChallenge`, `LiveEmailChallenge`, `PeekEmailLink`, `TakeEmailCode`, `TakeEmailLink`, `insertEmailChallenge`, `migrateEmailSignin`, `deleteBound` | SQLite on the console's own `email_challenges` table |
| `store.go` `Store.SessionInfo` | one `QueryRow` on `sessions`, as `SessionAddress` |
| `store.go` `Store.PendingInviteAddress` | one `QueryRow` on `invites`, without consuming it, as `PendingInviteFor` |
| `store.go` `Store.CreateSessionMethod` | `CreateSession`'s `INSERT`, moved, plus the method column |
| `stepup.go` `Store.takePendingActionByHash` | `TakePendingAction`'s body and both sites, moved unchanged, keyed by hash |
| `store.go` `newStore` | two `crypto/rand.Read` calls: an in-memory 32-byte HMAC key for codes and an 8-byte epoch label, never written down; as `Keymail.sealEnvelope` |
| `server.go` `Server.handleHome`, `Server.handleSignin`; `emailsignin.go` `Server.handleEmailLinkPage` | `r.URL.Query()` of the request URL (`next`, `t`), not a file; as `handleCallback` |
| templates `email_link.html`, `stepup_email.html` | embedded UI input, as their sibling templates |

### Retired units

Each is still declared and reads nothing now, so it is retired by an H3
removal. The loader accepts an H3 removal only with a `census-ruling-`
basis, so the rows read `census-ruling-email-signin (PROPOSED, awaiting the
census owner on #280): ...`. That is the form console-invite-delivery used
for `Keymail.SendApp` before its ruling. A removal is not in the seal.

- `server.go` `Server.handleConfirm`: renders the expired message only. Its
  `TakeConfirmation`, `EnsureUser`, `GrantToken` and `CreateSession` calls
  are gone.
- `stepup.go` `Store.TakePendingAction`: calls `takePendingActionByHash`.
- `store.go` `Store.CreateSession`: calls `CreateSessionMethod` with
  `MethodKeymail`.

### Envelopes and seal

`cmd/console`, `internal/console` and `internal/console/templates` are
re-pinned. The scan finds no other read-site change in them. Twenty-eight
frozen declarations are added, so the seal moves from securelisten-337's
`33a8ff46…c430` to `b25dfda5a68d2183af759b42398f79bb471749d46e68d267545647d1a2e6046b`.

## Record-write census (TestPlan9B8RecordWriteCensus)

`internal/console/server.go:NewServer` is re-digested to `9a49c1fc…8169`. The
effective entry is the replacement in `scanDemandWriteCensusInventory`
(`scan_demand_census_test.go`), which overrides the `plan9B8CensusInventory`
row, so that is the entry changed. Its kinds are still `lit:instances`. The
diff adds two struct fields and four route registrations. No record write is
added or moved.

## Questions for the census owner

1. Accept the ten changed and eighteen new units as accepted legacy under the
   console's identity, with seal `1221062f…1d00`?
2. Retire `handleConfirm`, `TakePendingAction` and `CreateSession` by H3
   removal? If ruled, the marker becomes `census-ruling-email-signin` in
   every row and the seal is recomputed.