test(identity): prove same-subject relink drops ended capability

.gitignore

@@ -1 +1,2 @@
 /target/
+/.netlify

CHANGELOG.md

@@ -5,8 +5,10 @@ All notable product and architecture changes are recorded here. Releases use imm
 ## Unreleased
 
 ### Added
-- Active PR #248 adds PostgreSQL 18 durability for immutable normalized longitudinal observation evidence: exact source identity, separate validity/recorded/received/ingested clocks, explicit membership shares whose deferred transaction invariant totals 10,000 basis points, exact replay, tenant isolation, and fail-closed rebinding/immutability. This entry is active-PR evidence only and is not a protected-main or release claim.
-- Active PR #287 rejects padded or otherwise noncanonical published narrative, style-mapping, interpretation-unit, and approved-selection references before deterministic rendering. Numeric score authority and the protected-main narrative boundary are unchanged; this is active-PR evidence only and not a release claim.
+- Hosted dual-proof account-link write, recover, and unlink commands so a transport adapter can authorize both proofs, persist the append-only history, recover the same product-owned participant from a still-valid Keyverse account proof after restart, and end that current binding from the same still-valid proof. Expired proofs fail before persist, lookup, or unlink. A rebound current subject cannot be unlinked with an ended subject's proof. A later account-linked capability is bound to the current `link_event_ref`, so unlink, rebound, or a later same-subject attach under a new event invalidates a previously issued grant. HTTP transport and live token verification remain target.
+- PostgreSQL 18 append-only participant identity-link persistence so a dual-proof account link, unlink, and relink survive process restart without rewriting the product-owned participant reference. Persist applies each link and then its matching ends in one transaction, exact replay is idempotent, and exact replay also restores or clears the derived current projection so operator repair cannot leave a missing or stale unique enforcer. Conflicting evidence fails closed, and one unterminated issuer-scoped subject cannot belong to two participants even when the derived current projection is missing. A returning account recovers the same `participant_ref` from that history. A link-end cannot attach to another participant's link.
+- Merged #248 adds PostgreSQL 18 durability for immutable normalized longitudinal observation evidence: exact source identity, separate validity/recorded/received/ingested clocks, explicit membership shares whose deferred transaction invariant totals 10,000 basis points, exact replay, tenant isolation, and fail-closed rebinding/immutability.
+- Merged #287 rejects padded or otherwise noncanonical published narrative, style-mapping, interpretation-unit, and approved-selection references before deterministic rendering. Numeric score authority and the protected-main narrative boundary are unchanged.
 - Personal result export delivery authorization (`authorize_result_export_read`) reuses the stored-record `ReadOwnResult` check on the product-owned participant and immutable result, then requires the export's result snapshot reference and copied participant reference to match that exact snapshot. A cross-tenant caller fails closed with the ordinary result-authorization denial before export-binding details are evaluated, so a mismatched export is not an existence oracle. No new permission or persistence is introduced; authorized HTTP transport ships through merged `src/result_export_http.rs` and `openapi/result-exports.yaml`. This is the post-#231 export-delivery guard (ADR-0010 provenance; ADR-0003 tenant-bound authorization).
 - Personal result export copies one immutable snapshot into JSON and a human-readable report so a purchaser can archive the same Extraversion estimate, standard error, and version provenance they were shown. The owner participant reference stays in both artifacts. Abstained or failed constructs keep their disposition and do not receive an invented score. Approved limitation text is required.
 - Product and technical gap baseline records the exact protected-main snapshot, current participant-visible gaps, all open repository PRs, issue #260 dependency, and the next executable delivery loop.
@@ -73,6 +75,7 @@ All notable product and architecture changes are recorded here. Releases use imm
 
 ### Fixed
 
+- Hosted account-link recover now keeps a loaded participant only when its current tenant, issuer, and subject still match the still-valid proof, so a concurrent unlink+relink cannot hand back a rebound identity.
 - Stale shorter assessment-session command history now fails closed instead of rewinding the current-state projection, so a later Pause/Resume still reloads after a rejected Activate-only persist.
 - Same-enrollment longitudinal ingest now keeps a later iOS copy and a later Android ping as distinct source identities instead of treating them as a rewrite of the first row.
 - Outbox delivery-lease expiry recovery now classifies liveness from the PostgreSQL clock, so a future caller timestamp cannot steal a still-live exclusive lease.