fix(auth): codes after the recovery phrase count apart from the password's

The full reading's M3: whoever knows the password made the account's codes
wait, and that wait refused the phrase's owner their reset too, so they were
held out of both without end. Codes now count per account and per way they
came (SecondFactorPath: after the password, after the phrase), each with
its own waits; a code accepted either way clears both.

Migration (module, Learn's and Todo's servers; Learn's device schema
rebuilds the server-only table):
  DROP INDEX "second_factor_failures_person_idx";
  ALTER TABLE "second_factor_failures" ADD COLUMN "path" text NOT NULL
    DEFAULT 'password'::text;
  CREATE UNIQUE INDEX "second_factor_failures_person_idx" ON
    "second_factor_failures" USING btree ("authUserId", "path");
Existing rows are the password's, unique per account, so unique per
account and way too.

Also the hosts' generated future calls, for the pruning's doc comment the
lapsed resets' commit changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/learn/halkyon_learn_client/lib/migrations/20261021110159867-second-factor-paths/migration.json

@@ -0,0 +1,80 @@
+{
+  "__className__": "serverpod.DatabaseMigration",
+  "actions": [
+    {
+      "__className__": "serverpod.DatabaseMigrationAction",
+      "type": "alterTable",
+      "alterTable": {
+        "__className__": "serverpod.TableMigration",
+        "name": "second_factor_failures",
+        "schema": "public",
+        "addColumns": [
+          {
+            "__className__": "serverpod.ColumnDefinition",
+            "name": "path",
+            "fieldName": "path",
+            "columnType": 0,
+            "isNullable": false,
+            "columnDefault": "'password'",
+            "dartType": "protocol:SecondFactorPath"
+          }
+        ],
+        "deleteColumns": [],
+        "modifyColumns": [],
+        "addIndexes": [
+          {
+            "__className__": "serverpod.IndexDefinition",
+            "indexName": "second_factor_failures_person_idx",
+            "elements": [
+              {
+                "__className__": "serverpod.IndexElementDefinition",
+                "type": 0,
+                "definition": "authUserId"
+              },
+              {
+                "__className__": "serverpod.IndexElementDefinition",
+                "type": 0,
+                "definition": "path"
+              }
+            ],
+            "type": "btree",
+            "isUnique": true,
+            "isPrimary": false
+          }
+        ],
+        "deleteIndexes": [
+          "second_factor_failures_person_idx"
+        ],
+        "addForeignKeys": [],
+        "deleteForeignKeys": [],
+        "warnings": [
+          {
+            "__className__": "serverpod.DatabaseMigrationWarning",
+            "type": "uniqueIndexCreated",
+            "message": "Unique index \"second_factor_failures_person_idx\" is added to table \"second_factor_failures\". If there are existing rows with duplicate values, this migration will fail.",
+            "table": "second_factor_failures",
+            "columns": [
+              "authUserId",
+              "path"
+            ],
+            "destrucive": false
+          }
+        ]
+      }
+    }
+  ],
+  "warnings": [
+    {
+      "__className__": "serverpod.DatabaseMigrationWarning",
+      "type": "uniqueIndexCreated",
+      "message": "Unique index \"second_factor_failures_person_idx\" is added to table \"second_factor_failures\". If there are existing rows with duplicate values, this migration will fail.",
+      "table": "second_factor_failures",
+      "columns": [
+        "authUserId",
+        "path"
+      ],
+      "destrucive": false
+    }
+  ],
+  "migrationApiVersion": 1
+}

apps/learn/halkyon_learn_client/lib/migrations/migration_registry.dart

@@ -25,6 +25,7 @@ part '20261020194228286-second-factor-waits/migration.dart';
 part '20261020204619104-session-code-tries/migration.dart';
 part '20261020211224692-email-code-purpose/migration.dart';
 part '20261021100422048-session-ended-warning/migration.dart';
+part '20261021110159867-second-factor-paths/migration.dart';
 
 /// Migration registry for the client-side database.
 class MigrationRegistry {
@@ -52,6 +53,7 @@ class MigrationRegistry {
     _Migration20261020204619104_session_code_tries(),
     _Migration20261020211224692_email_code_purpose(),
     _Migration20261021100422048_session_ended_warning(),
+    _Migration20261021110159867_second_factor_paths(),
   ];
 
   /// List of all client-side database migration versions.

apps/learn/halkyon_learn_server/lib/src/generated/future_calls.dart

@@ -293,7 +293,8 @@ class FilePruningPruneFilesFutureCall extends _is.FutureCall
 }
 
 /// Prunes one batch and logs how many people went; once GitHub sign-in
-/// has ended (`GITHUB_SIGN_IN_ENDS`), forgets every GitHub ID too.
+/// has ended (`GITHUB_SIGN_IN_ENDS`), forgets every GitHub ID too; and
+/// forgets the resets that lapsed (ADR 0017).
 class PruningPruneAnonymousPeopleFutureCall extends _is.FutureCall
     implements _is.InvokableFutureCall {
   @override

apps/learn/halkyon_learn_server/migrations/20261021110159867-second-factor-paths/migration.json

@@ -0,0 +1,80 @@
+{
+  "__className__": "serverpod.DatabaseMigration",
+  "actions": [
+    {
+      "__className__": "serverpod.DatabaseMigrationAction",
+      "type": "alterTable",
+      "alterTable": {
+        "__className__": "serverpod.TableMigration",
+        "name": "second_factor_failures",
+        "schema": "public",
+        "addColumns": [
+          {
+            "__className__": "serverpod.ColumnDefinition",
+            "name": "path",
+            "fieldName": "path",
+            "columnType": 0,
+            "isNullable": false,
+            "columnDefault": "'password'",
+            "dartType": "protocol:SecondFactorPath"
+          }
+        ],
+        "deleteColumns": [],
+        "modifyColumns": [],
+        "addIndexes": [
+          {
+            "__className__": "serverpod.IndexDefinition",
+            "indexName": "second_factor_failures_person_idx",
+            "elements": [
+              {
+                "__className__": "serverpod.IndexElementDefinition",
+                "type": 0,
+                "definition": "authUserId"
+              },
+              {
+                "__className__": "serverpod.IndexElementDefinition",
+                "type": 0,
+                "definition": "path"
+              }
+            ],
+            "type": "btree",
+            "isUnique": true,
+            "isPrimary": false
+          }
+        ],
+        "deleteIndexes": [
+          "second_factor_failures_person_idx"
+        ],
+        "addForeignKeys": [],
+        "deleteForeignKeys": [],
+        "warnings": [
+          {
+            "__className__": "serverpod.DatabaseMigrationWarning",
+            "type": "uniqueIndexCreated",
+            "message": "Unique index \"second_factor_failures_person_idx\" is added to table \"second_factor_failures\". If there are existing rows with duplicate values, this migration will fail.",
+            "table": "second_factor_failures",
+            "columns": [
+              "authUserId",
+              "path"
+            ],
+            "destrucive": false
+          }
+        ]
+      }
+    }
+  ],
+  "warnings": [
+    {
+      "__className__": "serverpod.DatabaseMigrationWarning",
+      "type": "uniqueIndexCreated",
+      "message": "Unique index \"second_factor_failures_person_idx\" is added to table \"second_factor_failures\". If there are existing rows with duplicate values, this migration will fail.",
+      "table": "second_factor_failures",
+      "columns": [
+        "authUserId",
+        "path"
+      ],
+      "destrucive": false
+    }
+  ],
+  "migrationApiVersion": 1
+}

apps/learn/halkyon_learn_server/migrations/20261021110159867-second-factor-paths/migration.sql

@@ -0,0 +1,59 @@
+BEGIN;
+
+--
+-- ACTION ALTER TABLE
+--
+DROP INDEX "second_factor_failures_person_idx";
+ALTER TABLE "second_factor_failures" ADD COLUMN "path" text NOT NULL DEFAULT 'password'::text;
+CREATE UNIQUE INDEX "second_factor_failures_person_idx" ON "second_factor_failures" USING btree ("authUserId", "path");
+
+--
+-- MIGRATION VERSION FOR halkyon_learn
+--
+INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
+    VALUES ('halkyon_learn', '20261021110159867-second-factor-paths', now())
+    ON CONFLICT ("module")
+    DO UPDATE SET "version" = '20261021110159867-second-factor-paths', "timestamp" = now();
+
+--
+-- MIGRATION VERSION FOR halkyon_base
+--
+INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
+    VALUES ('halkyon_base', '20261021110159448-second-factor-paths', now())
+    ON CONFLICT ("module")
+    DO UPDATE SET "version" = '20261021110159448-second-factor-paths', "timestamp" = now();
+
+--
+-- MIGRATION VERSION FOR serverpod
+--
+INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
+    VALUES ('serverpod', '20260824182259319', now())
+    ON CONFLICT ("module")
+    DO UPDATE SET "version" = '20260824182259319', "timestamp" = now();
+
+--
+-- MIGRATION VERSION FOR serverpod_auth_idp
+--
+INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
+    VALUES ('serverpod_auth_idp', '20260924105404509', now())
+    ON CONFLICT ("module")
+    DO UPDATE SET "version" = '20260924105404509', "timestamp" = now();
+
+--
+-- MIGRATION VERSION FOR serverpod_offline_sync
+--
+INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
+    VALUES ('serverpod_offline_sync', '20260914143806119', now())
+    ON CONFLICT ("module")
+    DO UPDATE SET "version" = '20260914143806119', "timestamp" = now();
+
+--
+-- MIGRATION VERSION FOR serverpod_auth_core
+--
+INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
+    VALUES ('serverpod_auth_core', '20260924105232991', now())
+    ON CONFLICT ("module")
+    DO UPDATE SET "version" = '20260924105232991', "timestamp" = now();
+
+
+COMMIT;

apps/learn/halkyon_learn_server/migrations/migration_registry.txt

@@ -42,3 +42,4 @@
 20261020204619104-session-code-tries
 20261020211224692-email-code-purpose
 20261021100422048-session-ended-warning
+20261021110159867-second-factor-paths

apps/todo/halkyon_todo_server/lib/src/generated/future_calls.dart

@@ -224,7 +224,8 @@ class _PruningFutureCallDispatcher {
 }
 
 /// Prunes one batch and logs how many people went; once GitHub sign-in
-/// has ended (`GITHUB_SIGN_IN_ENDS`), forgets every GitHub ID too.
+/// has ended (`GITHUB_SIGN_IN_ENDS`), forgets every GitHub ID too; and
+/// forgets the resets that lapsed (ADR 0017).
 class PruningPruneAnonymousPeopleFutureCall extends _is.FutureCall
     implements _is.InvokableFutureCall {
   @override

apps/todo/halkyon_todo_server/migrations/20261021110200318-second-factor-paths/definition_project.json

@@ -0,0 +1,29 @@
+{
+  "__className__": "serverpod.DatabaseDefinition",
+  "schemaVersion": 2,
+  "moduleName": "halkyon_todo",
+  "tables": [],
+  "installedModules": [
+    {
+      "__className__": "serverpod.DatabaseMigrationVersion",
+      "module": "halkyon_base",
+      "version": "20261021110159448-second-factor-paths"
+    },
+    {
+      "__className__": "serverpod.DatabaseMigrationVersion",
+      "module": "serverpod",
+      "version": "20260824182259319"
+    },
+    {
+      "__className__": "serverpod.DatabaseMigrationVersion",
+      "module": "serverpod_auth_idp",
+      "version": "20260924105404509"
+    },
+    {
+      "__className__": "serverpod.DatabaseMigrationVersion",
+      "module": "serverpod_auth_core",
+      "version": "20260924105232991"
+    }
+  ],
+  "migrationApiVersion": 1
+}

apps/todo/halkyon_todo_server/migrations/20261021110200318-second-factor-paths/migration.json

@@ -0,0 +1,80 @@
+{
+  "__className__": "serverpod.DatabaseMigration",
+  "actions": [
+    {
+      "__className__": "serverpod.DatabaseMigrationAction",
+      "type": "alterTable",
+      "alterTable": {
+        "__className__": "serverpod.TableMigration",
+        "name": "second_factor_failures",
+        "schema": "public",
+        "addColumns": [
+          {
+            "__className__": "serverpod.ColumnDefinition",
+            "name": "path",
+            "fieldName": "path",
+            "columnType": 0,
+            "isNullable": false,
+            "columnDefault": "'password'",
+            "dartType": "protocol:SecondFactorPath"
+          }
+        ],
+        "deleteColumns": [],
+        "modifyColumns": [],
+        "addIndexes": [
+          {
+            "__className__": "serverpod.IndexDefinition",
+            "indexName": "second_factor_failures_person_idx",
+            "elements": [
+              {
+                "__className__": "serverpod.IndexElementDefinition",
+                "type": 0,
+                "definition": "authUserId"
+              },
+              {
+                "__className__": "serverpod.IndexElementDefinition",
+                "type": 0,
+                "definition": "path"
+              }
+            ],
+            "type": "btree",
+            "isUnique": true,
+            "isPrimary": false
+          }
+        ],
+        "deleteIndexes": [
+          "second_factor_failures_person_idx"
+        ],
+        "addForeignKeys": [],
+        "deleteForeignKeys": [],
+        "warnings": [
+          {
+            "__className__": "serverpod.DatabaseMigrationWarning",
+            "type": "uniqueIndexCreated",
+            "message": "Unique index \"second_factor_failures_person_idx\" is added to table \"second_factor_failures\". If there are existing rows with duplicate values, this migration will fail.",
+            "table": "second_factor_failures",
+            "columns": [
+              "authUserId",
+              "path"
+            ],
+            "destrucive": false
+          }
+        ]
+      }
+    }
+  ],
+  "warnings": [
+    {
+      "__className__": "serverpod.DatabaseMigrationWarning",
+      "type": "uniqueIndexCreated",
+      "message": "Unique index \"second_factor_failures_person_idx\" is added to table \"second_factor_failures\". If there are existing rows with duplicate values, this migration will fail.",
+      "table": "second_factor_failures",
+      "columns": [
+        "authUserId",
+        "path"
+      ],
+      "destrucive": false
+    }
+  ],
+  "migrationApiVersion": 1
+}

apps/todo/halkyon_todo_server/migrations/20261021110200318-second-factor-paths/migration.sql

@@ -0,0 +1,51 @@
+BEGIN;
+
+--
+-- ACTION ALTER TABLE
+--
+DROP INDEX "second_factor_failures_person_idx";
+ALTER TABLE "second_factor_failures" ADD COLUMN "path" text NOT NULL DEFAULT 'password'::text;
+CREATE UNIQUE INDEX "second_factor_failures_person_idx" ON "second_factor_failures" USING btree ("authUserId", "path");
+
+--
+-- MIGRATION VERSION FOR halkyon_todo
+--
+INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
+    VALUES ('halkyon_todo', '20261021110200318-second-factor-paths', now())
+    ON CONFLICT ("module")
+    DO UPDATE SET "version" = '20261021110200318-second-factor-paths', "timestamp" = now();
+
+--
+-- MIGRATION VERSION FOR halkyon_base
+--
+INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
+    VALUES ('halkyon_base', '20261021110159448-second-factor-paths', now())
+    ON CONFLICT ("module")
+    DO UPDATE SET "version" = '20261021110159448-second-factor-paths', "timestamp" = now();
+
+--
+-- MIGRATION VERSION FOR serverpod
+--
+INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
+    VALUES ('serverpod', '20260824182259319', now())
+    ON CONFLICT ("module")
+    DO UPDATE SET "version" = '20260824182259319', "timestamp" = now();
+
+--
+-- MIGRATION VERSION FOR serverpod_auth_idp
+--
+INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
+    VALUES ('serverpod_auth_idp', '20260924105404509', now())
+    ON CONFLICT ("module")
+    DO UPDATE SET "version" = '20260924105404509', "timestamp" = now();
+
+--
+-- MIGRATION VERSION FOR serverpod_auth_core
+--
+INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
+    VALUES ('serverpod_auth_core', '20260924105232991', now())
+    ON CONFLICT ("module")
+    DO UPDATE SET "version" = '20260924105232991', "timestamp" = now();
+
+
+COMMIT;

apps/todo/halkyon_todo_server/migrations/migration_registry.txt

@@ -14,3 +14,4 @@
 20261020204619863-session-code-tries
 20261020211225101-email-code-purpose
 20261021100422779-session-ended-warning
+20261021110200318-second-factor-paths

packages/halkyon_base_client/lib/src/protocol/password/second_factor_path.dart

@@ -0,0 +1,45 @@
+/* AUTOMATICALLY GENERATED CODE DO NOT MODIFY */
+/*   To generate run: "serverpod generate"    */
+
+// ignore_for_file: implementation_imports
+// ignore_for_file: library_private_types_in_public_api
+// ignore_for_file: non_constant_identifier_names
+// ignore_for_file: public_member_api_docs
+// ignore_for_file: type_literal_in_constant_pattern
+// ignore_for_file: use_super_parameters
+// ignore_for_file: invalid_use_of_internal_member
+
+// ignore_for_file: no_leading_underscores_for_library_prefixes
+import 'package:serverpod_client/serverpod_client.dart' as _isc;
+
+/// Which way codes reach an account's second factor without a session
+/// (ADR 0017; the full reading's M3): after the password proved right, or
+/// after the recovery phrase did. Each counts its own refused codes, so
+/// whoever knows the password and makes codes wait never holds back the
+/// phrase's owner from their reset.
+enum SecondFactorPath implements _isc.SerializableModel {
+  /// A sign-in, or a reset of the authenticators asked with the password.
+  password,
+
+  /// A new password set with the recovery phrase.
+  phrase;
+
+  static SecondFactorPath fromJson(String name) {
+    switch (name) {
+      case 'password':
+        return SecondFactorPath.password;
+      case 'phrase':
+        return SecondFactorPath.phrase;
+      default:
+        throw ArgumentError(
+          'Value "$name" cannot be converted to "SecondFactorPath"',
+        );
+    }
+  }
+
+  @override
+  String toJson() => name;
+
+  @override
+  String toString() => name;
+}