# ADR 0019. Scoped Bootstrap Proofs and Controlled Merge

## Status
Accepted.

Closes the "sign in as existing PlayerPal account" mechanics left open under
[ADR 0010](0010-linking-unifies-no-separate-claim.md).

## Context
Without email, name or government ID, PlayerPal cannot guarantee one natural
person equals one account. Silent merge on IP, device or timing would be both
a privacy violation and an account-takeover path. Retrying registration must
not create duplicate players for the same trusted proof.

## Decision
Prevent accidental duplicates and same-proof double registration.
Raise the cost of abuse. Provide an audited correction path. This is
Sybil-resistance, not civil-identity deduplication.

- Repeatable proofs (social `iss + sub`, operator assertion subject,
  integration-scoped provider subject) map through a non-reversible
  issuer-scoped lookup key. An active proof cannot map to two players.
- Account discovery offers passkey, approved social, PlayerPal ID + password,
  existing-device QR, or recovery code. Never email/phone lookup. Uniform
  errors; do not reveal whether a PlayerPal ID exists.
- IP, device fingerprint, timing, gameplay or profile similarity must never
  become durable linking keys or automatic merge criteria.
- Merge requires recent independent proof of **both** accounts, a preview,
  programme reconciliation, immutable ledger with compensating entries, and
  session invalidation. Unresolved value or compliance conflicts block merge.

Fragmented independent accounts (player does not sign in at a later audience)
remain an expected outcome of ADR 0010.

## Consequences
- Registration is an idempotent state machine (spec §46.3).
- Password-only accounts are too weak to treat as unique persons (ADR 0020).
- See [docs/linking-and-bootstrap.md](../linking-and-bootstrap.md) and spec §46.